• Vegard Nossum's avatar
    bdev: fix NULL pointer dereference · e9e5e3fa
    Vegard Nossum authored
    I got this:
    
        kasan: GPF could be caused by NULL-ptr deref or user memory access
        general protection fault: 0000 [#1] PREEMPT SMP KASAN
        Dumping ftrace buffer:
           (ftrace buffer empty)
        CPU: 0 PID: 5505 Comm: syz-executor Not tainted 4.8.0-rc2+ #161
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
        task: ffff880113415940 task.stack: ffff880118350000
        RIP: 0010:[<ffffffff8172cb32>]  [<ffffffff8172cb32>] bd_mount+0x52/0xa0
        RSP: 0018:ffff880118357ca0  EFLAGS: 00010207
        RAX: dffffc0000000000 RBX: ffffffffffffffff RCX: ffffc90000bb6000
        RDX: 0000000000000018 RSI: ffffffff846d6b20 RDI: 00000000000000c7
        RBP: ffff880118357cb0 R08: ffff880115967c68 R09: 0000000000000000
        R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801188211e8
        R13: ffffffff847baa20 R14: ffff8801139cb000 R15: 0000000000000080
        FS:  00007fa3ff6c0700(0000) GS:ffff88011aa00000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 00007fc1d8cc7e78 CR3: 0000000109f20000 CR4: 00000000000006f0
        DR0: 000000000000001e DR1: 000000000000001e DR2: 0000000000000000
        DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
        Stack:
         ffff880112cfd6c0 ffff8801188211e8 ffff880118357cf0 ffffffff8167f207
         ffffffff816d7a1e ffff880112a413c0 ffffffff847baa20 ffff8801188211e8
         0000000000000080 ffff880112cfd6c0 ffff880118357d38 ffffffff816dce0a
        Call Trace:
         [<ffffffff8167f207>] mount_fs+0x97/0x2e0
         [<ffffffff816d7a1e>] ? alloc_vfsmnt+0x55e/0x760
         [<ffffffff816dce0a>] vfs_kern_mount+0x7a/0x300
         [<ffffffff83c3247c>] ? _raw_read_unlock+0x2c/0x50
         [<ffffffff816dfc87>] do_mount+0x3d7/0x2730
         [<ffffffff81235fd4>] ? trace_do_page_fault+0x1f4/0x3a0
         [<ffffffff816df8b0>] ? copy_mount_string+0x40/0x40
         [<ffffffff8161ea81>] ? memset+0x31/0x40
         [<ffffffff816df73e>] ? copy_mount_options+0x1ee/0x320
         [<ffffffff816e2a02>] SyS_mount+0xb2/0x120
         [<ffffffff816e2950>] ? copy_mnt_ns+0x970/0x970
         [<ffffffff81005524>] do_syscall_64+0x1c4/0x4e0
         [<ffffffff83c3282a>] entry_SYSCALL64_slow_path+0x25/0x25
        Code: 83 e8 63 1b fc ff 48 85 c0 48 89 c3 74 4c e8 56 35 d1 ff 48 8d bb c8 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 36 4c 8b a3 c8 00 00 00 48 b8 00 00 00 00 00 fc
        RIP  [<ffffffff8172cb32>] bd_mount+0x52/0xa0
         RSP <ffff880118357ca0>
        ---[ end trace 13690ad962168b98 ]---
    
    mount_pseudo() returns ERR_PTR(), not NULL, on error.
    
    Fixes: 3684aa70 ("block-dev: enable writeback cgroup support")
    Cc: Shaohua Li <shli@fb.com>
    Cc: Tejun Heo <tj@kernel.org>
    Cc: Jens Axboe <axboe@fb.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarVegard Nossum <vegard.nossum@oracle.com>
    Signed-off-by: default avatarJens Axboe <axboe@fb.com>
    e9e5e3fa
block_dev.c 47.9 KB