Syzbot reported a null-ptr-deref Write in xfs_filestream_select_ag. When pag is not found, xfs_filestream_pick_ag() also returns 0, which leads to null pointer access in xfs_filestream_create_association(). At the end of xfs_filestream_pick_ag, we need to add a sanity check for pag, if we fail to grab any AG, we should return to -ENOSPC instead of 0. Reported-and-tested-by: syzbot+4125a3c514e3436a02e6@xxxxxxxxxxxxxxxxxxxxxxxxx Closes: https://syzkaller.appspot.com/bug?extid=4125a3c514e3436a02e6 Signed-off-by: Edward Adam Davis <eadavis@xxxxxx> --- fs/xfs/xfs_filestream.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/xfs/xfs_filestream.c b/fs/xfs/xfs_filestream.c index e3aaa0555597..dd8f193a3957 100644 --- a/fs/xfs/xfs_filestream.c +++ b/fs/xfs/xfs_filestream.c @@ -165,6 +165,10 @@ xfs_filestream_pick_ag( trace_xfs_filestream_pick(pag, pino, free); args->pag = pag; + + if (!args->pag) + return -ENOSPC; + return 0; } -- 2.43.0
