Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.32 as permitted sender) client-ip=23.128.96.32;
From:   Yuran Pereira <yuran.pereira@hotmail.com>
To:     aivazian.tigran@gmail.com
Cc:     Yuran Pereira <yuran.pereira@hotmail.com>,
        syzbot+dc6ed11a88fb40d6e184@syzkaller.appspotmail.com,
        linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
        linux-kernel-mentees@lists.linuxfoundation.org
Subject: [PATCH] bfs: Fix null pointer dereference in bfs_move_block
Date:   Mon, 27 Nov 2023 05:09:05 +0530
Message-ID: <GV1PR10MB65635AA7F497FC3EA6235261E8BEA@GV1PR10MB6563.EURPRD10.PROD.OUTLOOK.COM>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: GV1PR10MB6563:EE_|PA4PR10MB5634:EE_
X-MS-Office365-Filtering-Correlation-Id: 01c3ef28-4071-4e39-f3ef-08dbeed8eb4b
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: CkSnsF6QX0/5tqMN52I1CJUqCF+K4MIS3mw2asbWhqRbro6z+A65rqdYP4mWeCl/r7WjCSXGxDq+ckGBPhJeGlHHA6DmZcrOcVW0MLY3z8M8bQz1SP2y9rUoYAigNi/khMo6jIsqaHYVPfC6axVp/zDRiQZyz6He7jTDamzr+O0OvPe9EPsTU+uT6wQCvojxACGuAkx6RP0hCBoNiTb5ky4iu8+1re7dw/U0LJ8/e8dE6/bIWNzAXkAcQOYmPwlKQygMjOwhZcWt9lKYr8jp/m1zk4YwrNxUahv9SY5NiOi2R5/1vCqqB+WJS5LBW0gnF1Mqf0PCCVqHoNcFwnjBRtH15YXs9EJ1eqQAWnjd5qsCHhrosfMk6jAjByrk+xl0obtPZX5ncc5guEHp6+99E18MO+Cn6BL5rqCR0eeas1J6r5LQcGUOF88Ms499HiwacApr3+0Ae9lsmZcR6wKr0v5DfQTbMsuQcYatIrj1U6t/zgxxsfoB7gb1pQVYrS6XBhmH4xkdgtZ5P4uI2LVmdCo9p7mK5GicsY4rWCsrf2GOtHh0lP0cw+vjdHey35xH35qQRUW0obMFUGJhAJzeqE3oEqsmkcSu7ZpSoq5CS9OmzECzgyIZK6+cAybhdXr+
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?M4McsMYtSb0CAZnRaKX4+L2A55Njpq0bV+oByCXaBaz5QoFHPT4yaN3ZwJVF?=
 =?us-ascii?Q?fgh0PRiH5f2iE18ByFGpcpFzyQmO9Z619b/LkCpd9yjA/6NwkA4bek697Csj?=
 =?us-ascii?Q?ThEj/bBtKwZclclaTztPNJzdvwxiV7EYHlWuz6/xRCVhthl+D33+cU/TQWXR?=
 =?us-ascii?Q?A3YmUvur6YEQzJvAUJ6unlqSDHFUag868UV4JG+i/kBjyGvjE+Lj5emOQbrZ?=
 =?us-ascii?Q?C+PaUx4c9/DTsFQU1BKxi1rT4nTXlet1TAevzdUFnEB6s/cvT9vU90T11j1M?=
 =?us-ascii?Q?mV0h/JGF+CEeRlvCBzmFtzO8RUsBt47nbGjbbKNnFQ6wczL4wz1IfaqYONut?=
 =?us-ascii?Q?3bf/jSkp01J7hRl+fZJcogdmWGwhjFYIQb6oaNhepAKGq958uuKxPYfdTXPi?=
 =?us-ascii?Q?z26A6IBa8pA02KWBhA+k96CETfgnCMlwiZ5fwvNT8Gyajlr99xz4cWzmUNgZ?=
 =?us-ascii?Q?ek2BLzgb6RvtWaRG9gv8fAMq72wIxLn2eU3svahBGTrsyCkpWRd/4Vz+C+9u?=
 =?us-ascii?Q?FnwipGt486Sv8xdRqTQwOX/vQt+nfkqJiQhDCLJj5E4sq46Nu13J158YHLyV?=
 =?us-ascii?Q?JFggh9iqwSirgkxBx7XTZmdWU1YRgFA+8C9AyEZ87RyHDJEtak+gZLNRZvd0?=
 =?us-ascii?Q?EGm9HksNoaCE0VqtjCIyTr1tG9Quf+epfXAi+gwvQir3A7jrr4RSpHeWm8Hf?=
 =?us-ascii?Q?2JzdamNkkvVE/rf3Jov0ave15QcY1wLP9Dbeb9A/8TrFQJiNrlbCda/Bv6oJ?=
 =?us-ascii?Q?WMwTpljtXsmtLQuZpQH2vYmRi8pkFFDZJiu9g9yGRTeLT5Ni2fG4Tun/Kj+k?=
 =?us-ascii?Q?4Js7A6YgL/Z2ssyc294kyce1odRoctyzOky4WcQrdP+9se5T4Y5ae2yLzX90?=
 =?us-ascii?Q?eQ/GqP8I1stTQQmQb/SsypGkQlSdbzxybrwCnAvcA7t2cTMnhVZoI6RCsTLR?=
 =?us-ascii?Q?VHEudEb6SXCkcN0Oo7CSMb76V//OQSniSSA1HRHSP19YOBl5hZtGxRtbBA9h?=
 =?us-ascii?Q?XD3GWDaF24DNrMPx/jL9+dmffoN/thPbMfTQmhqkeob682ChO1Zz7yGee99/?=
 =?us-ascii?Q?rR66sm3sTdhGLHBTTG2CnhZPEZA0nGJ8dfLD0cwiUK/jVd4D4xCVU1na7z9K?=
 =?us-ascii?Q?tY27yw/K6xXaviaLcWPYafeAa5bovKcAGqfJDJuOkEtN6qVWWqjCKqEluu/7?=
 =?us-ascii?Q?gULfVzCnp/J76tzRAwSIkG4tihPQO+GuUQQHeuNK8g/+romP6hTgXmT0Zq4?=
 =?us-ascii?Q?=3D?=
X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-6b909.templateTenant
X-MS-Exchange-CrossTenant-Network-Message-Id: 01c3ef28-4071-4e39-f3ef-08dbeed8eb4b
X-MS-Exchange-CrossTenant-AuthSource: GV1PR10MB6563.EURPRD10.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Nov 2023 23:39:23.6625
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA4PR10MB5634
X-Spam-Status: No, score=0.6 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,FORGED_HOTMAIL_RCVD2,FREEMAIL_FORGED_FROMDOMAIN,
	FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,
	SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=no
	autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on agentk.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (agentk.vger.email [0.0.0.0]); Sun, 26 Nov 2023 15:40:52 -0800 (PST)

Syzkaller reported a NULL pointer dereference in
bfs_move_block.

sb_getblk may return a NULL pointer, and if unchecked
this can lead to a NULL pointer dereference. This is
the case in bfs_move_block, where `new` is not checked
before being dereferenced in the memcpy call.

This patch adds a propper check to the return value of
sb_getblk, stored in `new` and ensures that any previously
allocated resource, is deallocated before returning with
an appropriate error code if the `new` pointer is NULL.

Closes: https://syzkaller.appspot.com/bug?extid=dc6ed11a88fb40d6e184
Signed-off-by: Yuran Pereira <yuran.pereira@hotmail.com>
---
 fs/bfs/file.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/bfs/file.c b/fs/bfs/file.c
index adc2230079c6..8a97909b1484 100644
--- a/fs/bfs/file.c
+++ b/fs/bfs/file.c
@@ -38,7 +38,12 @@ static int bfs_move_block(unsigned long from, unsigned long to,
 	bh = sb_bread(sb, from);
 	if (!bh)
 		return -EIO;
+
 	new = sb_getblk(sb, to);
+	if (!new) {
+		bforget(bh);
+		return -ENOMEM;
+	}
 	memcpy(new->b_data, bh->b_data, bh->b_size);
 	mark_buffer_dirty(new);
 	bforget(bh);
-- 
2.25.1