Kees Cook <keescook@xxxxxxxxxxxx> writes: > On Wed, Oct 14, 2020 at 09:15:47AM +0200, Krzysztof Kozlowski wrote: >> I hit this since few days as well. Although the bisect points to the >> merge, the issue looks like a result of mentioned commit 4d03e3cc5982 >> ("fs: don't allow kernel reads and writes without iter ops"). >> >> The __kernel_read() last argument 'pos' can be NULL and it is >> dereferenced here (added by the commit): >> >> 525 ssize_t __kernel_write(struct file *file, const void *buf, size_t count, loff_t *pos) >> ... >> 547 kiocb.ki_pos = *pos; >> 548 iov_iter_kvec(&iter, WRITE, &iov, 1, iov.iov_len); >> >> >> The __kernel_read() is called with NULL in fs/autofs/waitq.c: >> >> 45 static int autofs_write(struct autofs_sb_info *sbi, >> 46 struct file *file, const void *addr, int bytes) >> >> ... >> 54 mutex_lock(&sbi->pipe_mutex); >> 55 while (bytes) { >> 56 wr = __kernel_write(file, data, bytes, NULL); > > I think the thread here is the same thing, but you've found it in > autofs... > https://lore.kernel.org/lkml/CAHk-=wgj=mKeN-EfV5tKwJNeHPLG0dybq+R5ZyGuc4WeUnqcmA@xxxxxxxxxxxxxx/ Indeed. Thanks, missed that. Sven