From:   Zheng Wang <zyytlz.wz@163.com>
To:     colyli@suse.de
Cc:     hackerzheng666@gmail.com, kent.overstreet@gmail.com,
        linux-bcache@vger.kernel.org, linux-kernel@vger.kernel.org,
        security@kernel.org, alex000young@gmail.com,
        Zheng Wang <zyytlz.wz@163.com>
Subject: [PATCH] bcache: Fix a NULL or wild pointer dereference in btree_split
Date:   Thu,  2 Feb 2023 19:05:43 +0800
Message-Id: <20230202110543.27548-1-zyytlz.wz@163.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

In btree_split, btree_node_alloc_replacement() is assigned to
n1 and return error code or NULL on failure. n1->c->cache is
passed to block_bytes. So there is a dereference of it
 without checks, which may lead to wild pointer dereference or
  NULL pointer dereference depending on n1. The initial code only
  judge the error code but igore the NULL pointer.
So does n2 and n3.

Fix this bug by adding IS_ERR_OR_NULL check of n1, n2 and n3.

Note that, as a bug found by static analysis, it can be a false
positive or hard to trigger.

Fixes: cafe56359144 ("bcache: A block layer cache")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
---
 drivers/md/bcache/btree.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index 147c493a989a..d5ed382fc43c 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -2206,7 +2206,7 @@ static int btree_split(struct btree *b, struct btree_op *op,
 	}
 
 	n1 = btree_node_alloc_replacement(b, op);
-	if (IS_ERR(n1))
+	if (IS_ERR_OR_NULL(n1))
 		goto err;
 
 	split = set_blocks(btree_bset_first(n1),
@@ -2218,12 +2218,12 @@ static int btree_split(struct btree *b, struct btree_op *op,
 		trace_bcache_btree_node_split(b, btree_bset_first(n1)->keys);
 
 		n2 = bch_btree_node_alloc(b->c, op, b->level, b->parent);
-		if (IS_ERR(n2))
+		if (IS_ERR_OR_NULL(n2))
 			goto err_free1;
 
 		if (!b->parent) {
 			n3 = bch_btree_node_alloc(b->c, op, b->level + 1, NULL);
-			if (IS_ERR(n3))
+			if (IS_ERR_OR_NULL(n3))
 				goto err_free2;
 		}
 
-- 
2.25.1