[PATCH 1/5] gfs2: handle errors from __filemap_get_folio() with FGP_CREAT in gfs2_getbuf()

[Mauricio Faria de Oliveira]

Function __filemap_get_folio() with FGP_CREAT might fail, for example, with
ERR_PTR(-ENOMEM). This hits a kernel oops, as gfs2_getbuf() dereferences an
error pointer:

 gfs2: fsid=loop0: Trying to join cluster "lock_nolock", "loop0"
 gfs2: fsid=loop0: Now mounting FS (format 1802)...
 Oops: general protection fault, probably for non-canonical address
                      0xdffffc0000000003: 0000 [#1] SMP KASAN NOPTI
 KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
 ...
 RIP: 0010:gfs2_getbuf+0x492/0x5a0
 [  ...
 Call Trace:
  <TASK>
  gfs2_meta_read+0x106/0x7a0
  gfs2_meta_buffer+0x125/0x360
  inode_go_instantiate+0xde/0x1510
  gfs2_instantiate+0x102/0x1c0
  gfs2_glock_wait+0x19a/0x2c0
  gfs2_lookupi+0x2ba/0x570
  gfs2_lookup_meta+0xad/0x160
  init_inodes+0x350/0x20b0
  gfs2_fill_super+0x19b6/0x2730
  get_tree_bdev_flags+0x2f4/0x560
  gfs2_get_tree+0x48/0x230
  vfs_get_tree+0x87/0x2d0
  vfs_cmd_create+0xb2/0x240
  __do_sys_fsconfig+0x3d2/0x980
  do_syscall_64+0xce/0x450
  entry_SYSCALL_64_after_hwframe+0x77/0x7f
 ...
  </TASK>

That is noted more clearly in convenience function filemap_grab_folio()
(snippet below) and checked by virtually all other callers in the kernel.

 ...
  * Return: A found or created folio. ERR_PTR(-ENOMEM) if no folio is found
  * and failed to create a folio.
 ...
 static inline struct folio *filemap_grab_folio(...)
 {
         return __filemap_get_folio(...,
                                    ... | FGP_CREAT,
                                    ...);
 }

Thus, if __filemap_get_folio() returns an error, log it (as it's lost) and
return NULL. Callers will be handled.

Signed-off-by: Mauricio Faria de Oliveira <mfo@xxxxxxxxxx>
---
 fs/gfs2/meta_io.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c
index a87cfbf0df38706e6b7c63cc55f5251765d6b398..51b1a2e2bfadea6dabfac5ecba983c615a1a69fa 100644
--- a/fs/gfs2/meta_io.c
+++ b/fs/gfs2/meta_io.c
@@ -145,6 +145,10 @@ struct buffer_head *gfs2_getbuf(struct gfs2_glock *gl, u64 blkno, int create)
 		folio = __filemap_get_folio(mapping, index,
 				FGP_LOCK | FGP_ACCESSED | FGP_CREAT,
 				mapping_gfp_mask(mapping) | __GFP_NOFAIL);
+		if (IS_ERR(folio)) {
+			fs_err(sdp, "Error %ld creating buffer\n", PTR_ERR(folio));
+			return NULL;
+		}
 		bh = folio_buffers(folio);
 		if (!bh)
 			bh = create_empty_buffers(folio,

-- 
2.47.3