Re: [syzbot ci] Re: rust: zpool: add API for C and Rust

[Vitaly Wool]

On 9/23/25 23:59, Johannes Weiner wrote:
> On Tue, Sep 23, 2025 at 09:50:10AM -0700, syzbot ci wrote:
> > syzbot ci has tested the following series
> >
> > [v6] rust: zpool: add API for C and Rust
> > https://lore.kernel.org/all/20250923102547.2545992-1-vitaly.wool@xxxxxxxxxxx
> > * [PATCH v6 1/2] mm: reinstate zpool as a thin API
> > * [PATCH v6 2/2] rust: zpool: add abstraction for zpool drivers
> >
> > and found the following issues:
> > * BUG: unable to handle kernel NULL pointer dereference in zswap_store
> > * KASAN: slab-out-of-bounds Read in zpool_get_total_pages
> > * KASAN: slab-out-of-bounds Read in zswap_store
> > * KASAN: slab-use-after-free Read in zpool_get_total_pages
> > * KASAN: use-after-free Read in zpool_get_total_pages
> >
> > Full report is available here:
> > https://ci.syzbot.org/series/e8b22352-ae56-4d7c-9113-75573acf2b64
> >
> > ***
> >
> > BUG: unable to handle kernel NULL pointer dereference in zswap_store
>
> struct zpool {
> 	void *pool;
> };
>
> struct zpool *zpool_create_pool(const char *name) \
> { \
> 	return (struct zpool *) prefix ## _create_pool(name); \
> } \
>
> u64 zpool_get_total_pages(struct zpool *zpool) \
> { \
> 	return prefix ## _get_total_pages(zpool->pool); \
> }
>
> You create the zpool by simply casting the backend pool, but then you
> deref it twice as if it were an actual container for the backend pool.
>
> I'm guessing you didn't test this even superficially?

LOL, no, forgot to run git commit --amend so came up with a wrong version.

The Rust version is correct though.

> This also still proposes an API with no in-kernel user.

That's not correct, zsmalloc is the user.

~Vitaly