syzbot reported a null-ptr-deref in fuse_read_args_fill: fuse_read_folio+0xb0/0x100 fs/fuse/file.c:905 filemap_read_folio+0xc6/0x2a0 mm/filemap.c:2367 do_read_cache_folio+0x263/0x5c0 mm/filemap.c:3825 read_mapping_folio include/linux/pagemap.h:1011 [inline] erofs_bread+0x34d/0x7e0 fs/erofs/data.c:41 erofs_read_superblock fs/erofs/super.c:281 [inline] erofs_fc_fill_super+0x2b9/0x2500 fs/erofs/super.c:625
Unlike most filesystems, some network filesystems and FUSE need unavoidable valid `file` pointers for their read I/Os [1]. Anyway, those use cases need to be supported too. [1] https://docs.kernel.org/filesystems/vfs.html Reported-by: syzbot+0b1279812c46e48bb...@syzkaller.appspotmail.com Fixes: fb176750266a ("erofs: add file-backed mount support") Closes: https://lore.kernel.org/r/6727bbdf.050a0220.3c8d68.0a7e....@google.com Signed-off-by: Gao Xiang <hsiang...@linux.alibaba.com> --- fs/erofs/data.c | 10 +++++++--- fs/erofs/internal.h | 6 +++++- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/fs/erofs/data.c b/fs/erofs/data.c index 6355866220ff..43c89194d348 100644 --- a/fs/erofs/data.c +++ b/fs/erofs/data.c @@ -38,7 +38,10 @@ void *erofs_bread(struct erofs_buf *buf, erofs_off_t offset, } if (!folio || !folio_contains(folio, index)) { erofs_put_metabuf(buf); - folio = read_mapping_folio(buf->mapping, index, NULL); + folio = buf->use_fp ? + read_mapping_folio(file_inode(buf->filp)->i_mapping, + index, buf->filp) : + read_mapping_folio(buf->mapping, index, NULL); if (IS_ERR(folio)) return folio; } @@ -61,8 +64,9 @@ void erofs_init_metabuf(struct erofs_buf *buf, struct super_block *sb) { struct erofs_sb_info *sbi = EROFS_SB(sb); - if (erofs_is_fileio_mode(sbi)) - buf->mapping = file_inode(sbi->fdev)->i_mapping; + buf->use_fp = erofs_is_fileio_mode(sbi); + if (buf->use_fp) /* some fs like FUSE needs it */ + buf->filp = sbi->fdev; else if (erofs_is_fscache_mode(sb)) buf->mapping = sbi->s_fscache->inode->i_mapping; else diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h index 5459d0b39415..df67a1980ada 100644 --- a/fs/erofs/internal.h +++ b/fs/erofs/internal.h @@ -208,10 +208,14 @@ enum erofs_kmap_type { }; struct erofs_buf { - struct address_space *mapping; + union { + struct address_space *mapping; + struct file *filp; + }; struct page *page; void *base; enum erofs_kmap_type kmap_type; + bool use_fp; }; #define __EROFS_BUF_INITIALIZER ((struct erofs_buf){ .page = NULL }) -- 2.43.5
