2020-08-06 17:49:24

by Eiichi Tsukata

Subject: [PATCH] xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init

If xfs_sysfs_init is called with parent_kobj == NULL, UBSAN
shows the following warning:

UBSAN: null-ptr-deref in ./fs/xfs/xfs_sysfs.h:37:23
member access within null pointer of type 'struct xfs_kobj'
Call Trace:
dump_stack+0x10e/0x195
ubsan_type_mismatch_common+0x241/0x280
__ubsan_handle_type_mismatch_v1+0x32/0x40
init_xfs_fs+0x12b/0x28f
do_one_initcall+0xdd/0x1d0
do_initcall_level+0x151/0x1b6
do_initcalls+0x50/0x8f
do_basic_setup+0x29/0x2b
kernel_init_freeable+0x19f/0x20b
kernel_init+0x11/0x1e0
ret_from_fork+0x22/0x30

Fix it by checking parent_kobj before the code accesses its member.

Signed-off-by: Eiichi Tsukata <[email protected]>
---
fs/xfs/xfs_sysfs.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/xfs_sysfs.h b/fs/xfs/xfs_sysfs.h
index e9f810fc6731..aad67dc4ab5b 100644
--- a/fs/xfs/xfs_sysfs.h
+++ b/fs/xfs/xfs_sysfs.h
@@ -32,9 +32,9 @@ xfs_sysfs_init(
struct xfs_kobj *parent_kobj,
const char *name)
{
+ struct kobject *parent = parent_kobj ? &parent_kobj->kobject : NULL;
init_completion(&kobj->complete);
- return kobject_init_and_add(&kobj->kobject, ktype,
- &parent_kobj->kobject, "%s", name);
+ return kobject_init_and_add(&kobj->kobject, ktype, parent, "%s", name);
}

static inline void
--
2.26.2

2020-08-06 19:35:09

by Darrick J. Wong

Subject: Re: [PATCH] xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init

On Fri, Aug 07, 2020 at 12:05:27AM +0900, Eiichi Tsukata wrote:
> If xfs_sysfs_init is called with parent_kobj == NULL, UBSAN
> shows the following warning:

This needs to be sent to the xfs mailing list, per get_maintainers.pl.

--D

> UBSAN: null-ptr-deref in ./fs/xfs/xfs_sysfs.h:37:23
> member access within null pointer of type 'struct xfs_kobj'
> Call Trace:
> dump_stack+0x10e/0x195
> ubsan_type_mismatch_common+0x241/0x280
> __ubsan_handle_type_mismatch_v1+0x32/0x40
> init_xfs_fs+0x12b/0x28f
> do_one_initcall+0xdd/0x1d0
> do_initcall_level+0x151/0x1b6
> do_initcalls+0x50/0x8f
> do_basic_setup+0x29/0x2b
> kernel_init_freeable+0x19f/0x20b
> kernel_init+0x11/0x1e0
> ret_from_fork+0x22/0x30
>
> Fix it by checking parent_kobj before the code accesses its member.
>
> Signed-off-by: Eiichi Tsukata <[email protected]>
> ---
> fs/xfs/xfs_sysfs.h | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/xfs/xfs_sysfs.h b/fs/xfs/xfs_sysfs.h
> index e9f810fc6731..aad67dc4ab5b 100644
> --- a/fs/xfs/xfs_sysfs.h
> +++ b/fs/xfs/xfs_sysfs.h
> @@ -32,9 +32,9 @@ xfs_sysfs_init(
> struct xfs_kobj *parent_kobj,
> const char *name)
> {
> + struct kobject *parent = parent_kobj ? &parent_kobj->kobject : NULL;
> init_completion(&kobj->complete);
> - return kobject_init_and_add(&kobj->kobject, ktype,
> - &parent_kobj->kobject, "%s", name);
> + return kobject_init_and_add(&kobj->kobject, ktype, parent, "%s", name);
> }
>
> static inline void
> --
> 2.26.2
>

2020-08-06 21:29:51

by Eiichi Tsukata

Subject: Re: [PATCH] xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init

Thanks, I sent it to linux-xfs ML. I had some trouble with gmail server.

Eiichi

On 2020/08/07 0:13, Darrick J. Wong wrote:
> On Fri, Aug 07, 2020 at 12:05:27AM +0900, Eiichi Tsukata wrote:
>> If xfs_sysfs_init is called with parent_kobj == NULL, UBSAN
>> shows the following warning:
>
> This needs to be sent to the xfs mailing list, per get_maintainers.pl.
>
> --D
>
>> UBSAN: null-ptr-deref in ./fs/xfs/xfs_sysfs.h:37:23
>> member access within null pointer of type 'struct xfs_kobj'
>> Call Trace:
>> dump_stack+0x10e/0x195
>> ubsan_type_mismatch_common+0x241/0x280
>> __ubsan_handle_type_mismatch_v1+0x32/0x40
>> init_xfs_fs+0x12b/0x28f
>> do_one_initcall+0xdd/0x1d0
>> do_initcall_level+0x151/0x1b6
>> do_initcalls+0x50/0x8f
>> do_basic_setup+0x29/0x2b
>> kernel_init_freeable+0x19f/0x20b
>> kernel_init+0x11/0x1e0
>> ret_from_fork+0x22/0x30
>>
>> Fix it by checking parent_kobj before the code accesses its member.
>>
>> Signed-off-by: Eiichi Tsukata <[email protected]>
>> ---
>> fs/xfs/xfs_sysfs.h | 4 ++--
>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/fs/xfs/xfs_sysfs.h b/fs/xfs/xfs_sysfs.h
>> index e9f810fc6731..aad67dc4ab5b 100644
>> --- a/fs/xfs/xfs_sysfs.h
>> +++ b/fs/xfs/xfs_sysfs.h
>> @@ -32,9 +32,9 @@ xfs_sysfs_init(
>> struct xfs_kobj *parent_kobj,
>> const char *name)
>> {
>> + struct kobject *parent = parent_kobj ? &parent_kobj->kobject : NULL;
>> init_completion(&kobj->complete);
>> - return kobject_init_and_add(&kobj->kobject, ktype,
>> - &parent_kobj->kobject, "%s", name);
>> + return kobject_init_and_add(&kobj->kobject, ktype, parent, "%s", name);
>> }
>>
>> static inline void
>> --
>> 2.26.2
>>