Messages in this thread |  | | From | Deepak Karn <> | | Date | Tue, 9 Dec 2025 22:00:04 +0530 | | Subject | Re: [PATCH v2] fs: add NULL check in drop_buffers() to prevent null-ptr-deref |
| |
On Tue, Dec 9, 2025 at 4:48 PM Jan Kara <jack@suse.cz> wrote: > > On Tue 09-12-25 01:43:33, Deepakkumar Karn wrote: > > On Mon, 8 Dec 2025 11:30:24 -0800, Darrick J. Wong wrote: > > > > drop_buffers() dereferences the buffer_head pointer returned by > > > > folio_buffers() without checking for NULL. This leads to a null pointer > > > > dereference when called from try_to_free_buffers() on a folio with no > > > > buffers attached. This happens when filemap_release_folio() is called on > > > > a folio belonging to a mapping with AS_RELEASE_ALWAYS set but without > > > > release_folio address_space operation defined. In such case, > > > > > What user is that? All the users of AS_RELEASE_ALWAYS in 6.18 appear to > > > supply a ->release_folio. Is this some new thing in 6.19? > > > > AFS directories SET AS_RELEASE_ALWAYS but have not .release_folio. > > AFAICS AFS sets AS_RELEASE_ALWAYS only for symlinks but not for > directories? Anyway I agree AFS symlinks will have AS_RELEASE_ALWAYS but no > .release_folio callback. And this looks like a bug in AFS because AFAICT > there's no point in setting AS_RELEASE_ALWAYS when you don't have > .release_folio callback. Added relevant people to CC. > > Honza
Thank you for your response Jan. As you suggested, the bug is in AFS. Can we include this current defensive check in drop_buffers() and I can submit another patch to handle that bug of AFS we discussed?
Regards, Deepakkumar Karn
|  |