Re: [syzbot] general protection fault in __copy_super
From: syzbot
Date: Mon Sep 23 2024 - 17:06:58 EST
For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx.
***
Subject: general protection fault in __copy_super
Author: djahchankoike@xxxxxxxxx
#syz test
__bch2_read_super may return no error code when a corrupt backup
superblock has matching offsets with default opts, the superblock
is freed and is later dereferenced causing a fault. Assign EINVALID
when checking sb offsets.
Signed-off-by: Diogo Jahchan Koike <djahchankoike@xxxxxxxxx>
---
fs/bcachefs/super-io.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/bcachefs/super-io.c b/fs/bcachefs/super-io.c
index c8c2ccbdfbb5..fbca0bd302db 100644
--- a/fs/bcachefs/super-io.c
+++ b/fs/bcachefs/super-io.c
@@ -796,8 +796,10 @@ static int __bch2_read_super(const char *path, struct bch_opts *opts,
i < layout.sb_offset + layout.nr_superblocks; i++) {
offset = le64_to_cpu(*i);
- if (offset == opt_get(*opts, sb))
+ if (offset == opt_get(*opts, sb)) {
+ ret = -BCH_ERR_invalid;
continue;
+ }
ret = read_one_super(sb, offset, &err);
if (!ret)
--
2.43.0