In our fault-injection testing, bio_alloc() may fail with low memory and
return NULL. In this case, the variable "bio" in xfs_rw_bdev() would be
NULL and then it is dereferenced in "bio_set_dev(bio, bdev)".
The failure log is listed as follows:
[ 16.009947] BUG: kernel NULL pointer dereference, address: 0000000000000015
...
[ 16.012406] RIP: 0010:bio_set_dev+0x76/0x160 [xfs]
...
[ 16.017773] Call Trace:
[ 16.017925] <TASK>
[ 16.018065] xfs_rw_bdev+0x29e/0x9f0 [xfs]
[ 16.018396] ? _raw_spin_unlock_irqrestore+0x3c/0x70
[ 16.018697] xlog_do_io+0x183/0x4a0 [xfs]
[ 16.019019] xlog_bwrite+0x73/0xc0 [xfs]
[ 16.019333] xlog_write_log_records+0x457/0x5c0 [xfs]
[ 16.019723] xlog_clear_stale_blocks+0x2d1/0x430 [xfs]
[ 16.020107] xlog_find_tail+0x63d/0xb60 [xfs]
[ 16.020447] xlog_recover+0x77/0x650 [xfs]
[ 16.021101] xfs_log_mount+0x720/0xcf0 [xfs]
[ 16.021437] xfs_mountfs+0xf0c/0x2440 [xfs]
[ 16.021767] xfs_fs_fill_super+0x1eaa/0x21e0 [xfs]
[ 16.022132] get_tree_bdev+0x3c3/0x5f0
[ 16.022361] ? xfs_fs_warn_deprecated+0x100/0x100 [xfs]
[ 16.022750] xfs_fs_get_tree+0x68/0xb0 [xfs]
[ 16.023090] vfs_get_tree+0x81/0x220
[ 16.023308] path_mount+0x1061/0x2340
[ 16.023532] ? kasan_quarantine_put+0x2c/0x1a0
[ 16.023804] ? slab_free_freelist_hook+0xde/0x160
[ 16.024087] ? mark_mounts_for_expiry+0x410/0x410
[ 16.024370] ? user_path_at_empty+0xf6/0x160
[ 16.024629] ? kmem_cache_free+0xb8/0x1a0
[ 16.024876] ? user_path_at_empty+0xf6/0x160
[ 16.025134] __se_sys_mount+0x217/0x2b0
[ 16.025367] ? __x64_sys_mount+0xd0/0xd0
[ 16.025605] ? exit_to_user_mode_prepare+0x32/0x130
[ 16.025899] do_syscall_64+0x41/0x90
[ 16.026116] entry_SYSCALL_64_after_hwframe+0x44/0xae
...
[ 16.030310] </TASK>
This patch adds a NULL check of "bio" and return -ENOMEM if it's NULL.
Reported-by: TOTE Robot <oslab@xxxxxxxxxxxxxxx>
Signed-off-by: Zixuan Fu <r33s3n6@xxxxxxxxx>
---
fs/xfs/xfs_bio_io.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/xfs/xfs_bio_io.c b/fs/xfs/xfs_bio_io.c
index ae4345b37621..37887029a6c7 100644
--- a/fs/xfs/xfs_bio_io.c
+++ b/fs/xfs/xfs_bio_io.c
@@ -28,6 +28,8 @@ xfs_rw_bdev(
bio = bio_alloc(bdev, bio_max_vecs(left), op | REQ_META | REQ_SYNC,
GFP_KERNEL);
+ if (!bio)
+ return -ENOMEM;
bio->bi_iter.bi_sector = sector;
do {
--
2.25.1
