Re: [PATCH 01/26] netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry

David Howells <[email protected]> writes:

> From: Deepanshu Kartikey <[email protected]>
>
> When a write subrequest is marked NETFS_SREQ_NEED_RETRY, the retry path
> in netfs_unbuffered_write() unconditionally calls stream->prepare_write()
> without checking if it is NULL.
>
> Filesystems such as 9P do not set the prepare_write operation, so
> stream->prepare_write remains NULL. When get_user_pages() fails with
> -EFAULT and the subrequest is flagged for retry, this results in a NULL
> pointer dereference at fs/netfs/direct_write.c:189.
>
> Fix this by mirroring the pattern already used in write_retry.c: if
> stream->prepare_write is NULL, skip renegotiation and directly reissue
> the subrequest via netfs_reissue_write(), which handles iterator reset,
> IN_PROGRESS flag, stats update and reissue internally.
>
> Fixes: a0b4c7a49137 ("netfs: Fix unbuffered/DIO writes to dispatch subrequests in strict sequence")
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=7227db0fbac9f348dba0
> Signed-off-by: Deepanshu Kartikey <[email protected]>
> Signed-off-by: David Howells <[email protected]>
> ---
>  fs/netfs/direct_write.c | 14 +++++++++++---
>  1 file changed, 11 insertions(+), 3 deletions(-)

Reviewed-by: Paulo Alcantara (Red Hat) <[email protected]>