Re: BUG: unable to handle kernel NULL pointer dereference in __generic_file_write_iter

[Josh Poimboeuf]

On Thu, Feb 21, 2019 at 11:36:24AM -0800, Andrew Morton wrote:
> On Thu, 21 Feb 2019 06:52:04 -0800 syzbot <syzbot+ca95b2b7aef9e7cbd6ab@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
> 
> > Hello,
> > 
> > syzbot found the following crash on:
> > 
> > HEAD commit:    4aa9fc2a435a Revert "mm, memory_hotplug: initialize struct..
> > git tree:       upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1101382f400000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=4fceea9e2d99ac20
> > dashboard link: https://syzkaller.appspot.com/bug?extid=ca95b2b7aef9e7cbd6ab
> > compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> > 
> > Unfortunately, I don't have any reproducer for this crash yet.
> 
> Not understanding.  That seems to be saying that we got a NULL pointer
> deref in __generic_file_write_iter() at
> 
>                 written = generic_perform_write(file, from, iocb->ki_pos);
> 
> which isn't possible.
> 
> I'm not seeing recent changes in there which could have caused this.  Help.

FWIW, the panic happened in generic_perform_write() when it called
a_ops->write_begin, which was NULL.

I agree with Jann that the unwinders should handle this scenario better.

-- 
Josh