In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfs: break unbuffered write when netfs_alloc_subrequest() fails<\/p>\n
syzbot reported a null-ptr-deref below [1] following a fault injection in
\nnetfs_alloc_subrequest(). [0]<\/p>\n
When netfs_alloc_subrequest() fails, subreq is NULL.
\nLater, netfs_prepare_write() tries to initialize members of
\nsubreq(e.g., source), the issue in [1] is triggered.<\/p>\n
Let’s handle the error of netfs_prepare_write() properly.<\/p>\n
[0]
\nFAULT_INJECTION: forcing a failure.
\nname failslab, interval 1, probability 0, space 0, times 0
\nCall Trace:
\n netfs_alloc_subrequest+0x116\/0x3f0
\n netfs_prepare_write+0x76\/0x7b0
\n netfs_unbuffered_write+0x75c\/0x2020
\n netfs_unbuffered_write_iter_locked+0x7d6\/0xa80
\n netfs_unbuffered_write_iter+0x442\/0x720
\n v9fs_file_write_iter+0xbf\/0x100
\n vfs_write+0x6ac\/0x1050<\/p>\n
[1]
\nKASAN: null-ptr-deref in range [0x00000000000000a8-0x00000000000000af]
\nRIP: 0010:netfs_prepare_write+0xbc\/0x7b0 fs\/netfs\/write_issue.c:173
\nCall Trace:
\n netfs_unbuffered_write+0x75c\/0x2020 fs\/netfs\/direct_write.c:111
\n netfs_unbuffered_write_iter_locked+0x7d6\/0xa80 fs\/netfs\/direct_write.c:290
\n netfs_unbuffered_write_iter+0x442\/0x720 fs\/netfs\/direct_write.c:382
\n v9fs_file_write_iter+0xbf\/0x100 fs\/9p\/vfs_file.c:409
\n new_sync_write fs\/read_write.c:595 [inline]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfs: break unbuffered write when netfs_alloc_subrequest() fails<\/p>\n
syzbot reported a null-ptr-deref below [1] following a fault inj<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29273","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29273","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29273"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29273"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29273"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}