tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry

When a write subrequest is marked NETFS_SREQ_NEED_RETRY, the retry path
in netfs_unbuffered_write() unconditionally calls stream->prepare_write()
without checking if it is NULL.

Filesystems such as 9P do not set the prepare_write operation, so
stream->prepare_write remains NULL. When get_user_pages() fails with
-EFAULT and the subrequest is flagged for retry, this results in a NULL
pointer dereference at fs/netfs/direct_write.c:189.

Fix this by mirroring the pattern already used in write_retry.c: if
stream->prepare_write is NULL, skip renegotiation and directly reissue
the subrequest via netfs_reissue_write(), which handles iterator reset,
IN_PROGRESS flag, stats update and reissue internally.

Fixes: a0b4c7a49137 ("netfs: Fix unbuffered/DIO writes to dispatch subrequests in strict sequence")
Reported-by: syzbot+7227db0fbac9f348dba0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7227db0fbac9f348dba0
Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
Link: https://patch.msgid.link/20260307043947.347092-1-kartikey406@gmail.com
Tested-by: syzbot+7227db0fbac9f348dba0@syzkaller.appspotmail.com
Signed-off-by: Christian Brauner <brauner@kernel.org>

authored by

Deepanshu Kartikey and committed by
Christian Brauner e9075e42 67e467a1

+11 -3
+11 -3
fs/netfs/direct_write.c
··· 186 186 stream->sreq_max_segs = INT_MAX; 187 187 188 188 netfs_get_subrequest(subreq, netfs_sreq_trace_get_resubmit); 189 - stream->prepare_write(subreq); 190 189 191 - __set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags); 192 - netfs_stat(&netfs_n_wh_retry_write_subreq); 190 + if (stream->prepare_write) { 191 + stream->prepare_write(subreq); 192 + __set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags); 193 + netfs_stat(&netfs_n_wh_retry_write_subreq); 194 + } else { 195 + struct iov_iter source; 196 + 197 + netfs_reset_iter(subreq); 198 + source = subreq->io_iter; 199 + netfs_reissue_write(stream, subreq, &source); 200 + } 193 201 } 194 202 195 203 netfs_unbuffered_write_done(wreq);