Received: by 2002:a05:6358:3188:b0:123:57c1:9b43 with SMTP id q8csp2829653rwd; Mon, 15 May 2023 18:09:16 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ7SFwRIjAcu0VPwyHcvAuL6hBWIdkoWnFLadxYBM2w7JQEPW3lDhcvcw3DtgAAvFaRIk+xu X-Received: by 2002:a17:903:1208:b0:1a6:4606:6e06 with SMTP id l8-20020a170903120800b001a646066e06mr41217719plh.17.1684199355383; Mon, 15 May 2023 18:09:15 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1684199355; cv=none; d=google.com; s=arc-20160816; b=amPoj0h23+OH6dNna07IvI2hx7o99AglhD73A58HkBf+IsncJr6fjiBNC5HuBvR9+k 4dAy5opV6jhGV8Gsd2jc6CbJ3ncd1o0OUhuh74uI+6YUFWs+Gmo6oGGaC7801cOfiPNj K1xqXPj4cHe9Wjjg4EGoK/dPQGtG6slitsxgSBWuusLvVXB33ThgbaRSoNY9xf9nsp6c b3kFYRK4DOKFmNYH4ApBYXyx5dOZGBHZbw2/yxm0FgIbYxVr/V2+/2oU5OybSzblPinN v0bkcr9zYftyE/gFJ8ap99M54bULTkBDmmlH0+9xDn8XEqoS3C9YL4pGMJVAB5pL/f3f zfOg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:subject:cc:to:from:date :dkim-signature; bh=RVkJA3lTgCORmQkh7N6TzUrBQFxDZlWdNA3lW0Mj46Y=; b=pNs9QqyS5Ggiaqii/7P/YWJ3FTBGPLEv7hj0ep+a8Ed+Vtv+pmpS4Cw1m5KssU9JZZ VjrgNONyFUK+nAYHB2++oJ6AZ0HCFgdygOw0EM1PsbI1I01XZjGm8eR2VEFco0+tZsZv Y/+g4LY1KWymvlxP98Y14n5F33ZsG++5My9fJYE0hw3jog6ER4+jnQZtmy4w5snAxeKW Bu9D7xspKIyKu7Ga/3MPNMsveBPBYSSnLUCo86cGUsNYlQTdwYbJdcNNn6PpNQLBF76H OFOGms0OdXiGo+skVfZCvAh+e/dUh7gfPXuSoyXTta+nLHa4SW1j4LFK2ZIrR1QQMoiH CaSw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20221208 header.b=J4s70hg4; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id j12-20020a170902690c00b001aaee4e18dbsi16806150plk.379.2023.05.15.18.09.03; Mon, 15 May 2023 18:09:15 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20221208 header.b=J4s70hg4; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245528AbjEPA6y (ORCPT + 99 others); Mon, 15 May 2023 20:58:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37288 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236580AbjEPA6x (ORCPT ); Mon, 15 May 2023 20:58:53 -0400 Received: from mail-pl1-x62c.google.com (mail-pl1-x62c.google.com [IPv6:2607:f8b0:4864:20::62c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E98A5AA for ; Mon, 15 May 2023 17:58:50 -0700 (PDT) Received: by mail-pl1-x62c.google.com with SMTP id d9443c01a7336-1aad5245571so92898645ad.1 for ; Mon, 15 May 2023 17:58:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1684198730; x=1686790730; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=RVkJA3lTgCORmQkh7N6TzUrBQFxDZlWdNA3lW0Mj46Y=; b=J4s70hg4/JjW2UMnl2JT8bfnV8Ukk7qLfBS4DfHMVP/JOgNwokgC8Dkyy2iBK3s/cp gYZ6QgETEMQEuQcaiI/OJ5jo/jb+rywH6Mkwi5VKIqdUn+z7pLG0mH8/Xdu1ClrSnI0F D3LvdA8xlycb8GyP3a6rCitQflEC7moRpyYaf5up3ILf0Xx0cSBVaMnvbFy8NVBts9GE 5hECGlXekzHP+n599yioqGSTNeSbVPLdCnkcSBxJYGSOBFyrtH/4tmSwwxn2ZeMeC+1n AMsNcnG9GUeKoQDRdWRnVSFVTXhZtCpL5/fALCQksNQ+CACQun2/IQWigbCmHWXY7tc/ DK0Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684198730; x=1686790730; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=RVkJA3lTgCORmQkh7N6TzUrBQFxDZlWdNA3lW0Mj46Y=; b=T3cC+hu14JJp3hcVbfHupKTJ4L/Bptjz0wB4GSa8Zo+hLi5M6UuwakeNKUH7JiJ5Xd hCLncoQw9g7sY20eacwRFczzJqaTbGpbOvXNtVE8S3+Y4Y0RPojYpCV2bCpZkQOC/HdJ JEsYqt+9biAsfsFDJ4tbB6EjGcgs6FKAB9P48JGerDhQJ7fKVKuME0+ymgk8VlCBOUC6 LtTNNI9hRV4aaunaMvflc5G9+S2ix2hV7ZiS1oDO/jhBTwrvIxzkP88ZBOWrBfYHM73e 8Od0wcKxfYHHDHeplQZN4JKm/f/K1T02pYJwbXUrxuXhEdjsNG/h1msj4ONko/lD2dFc LL0g== X-Gm-Message-State: AC+VfDy7mP8gGB8UPFvpZLxcV85+w3uKMW0eHIC6AK9TRVgUTfVXZTAw mg6trskhQQ4YkGqsjbNRyoAxiYuHGNg= X-Received: by 2002:a17:902:e543:b0:1ac:8062:4f31 with SMTP id n3-20020a170902e54300b001ac80624f31mr39420635plf.37.1684198730328; Mon, 15 May 2023 17:58:50 -0700 (PDT) Received: from localhost ([156.236.96.165]) by smtp.gmail.com with ESMTPSA id v20-20020a17090ad59400b0024e1236f599sm232716pju.8.2023.05.15.17.58.48 (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Mon, 15 May 2023 17:58:50 -0700 (PDT) Date: Tue, 16 May 2023 09:06:40 +0800 From: Yue Hu To: Jingbo Xu Cc: xiang@kernel.org, chao@kernel.org, linux-erofs@lists.ozlabs.org, linux-kernel@vger.kernel.org, huyue2@coolpad.com, zhangwen@coolpad.com Subject: Re: [PATCH v2] erofs: fix null-ptr-deref caused by erofs_xattr_prefixes_init Message-ID: <20230516090640.00001a85.zbestahu@gmail.com> In-Reply-To: <20230515103941.129784-1-jefflexu@linux.alibaba.com> References: <20230515103941.129784-1-jefflexu@linux.alibaba.com> X-Mailer: Claws Mail 3.17.3 (GTK+ 2.24.32; i686-w64-mingw32) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE, URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 15 May 2023 18:39:41 +0800 Jingbo Xu wrote: > Fragments and dedupe share one feature bit, and thus packed inode may not > exist when fragment feature bit (dedupe feature bit exactly) is set, e.g. > when deduplication feature is in use while fragments feature is not. In > this case, sbi->packed_inode could be NULL while fragments feature bit > is set. > > Fix this by accessing packed inode only when it exists. > > Reported-by: syzbot+902d5a9373ae8f748a94@syzkaller.appspotmail.com > Link: https://syzkaller.appspot.com/bug?extid=902d5a9373ae8f748a94 > Fixes: 9e382914617c ("erofs: add helpers to load long xattr name prefixes") > Signed-off-by: Jingbo Xu Reviewed-by: Yue Hu