[PATCH 1/1] radix-tree: Prevent NULL pointer dereference in radix_tree_node_rcu_free

[PATCH 1/1] radix-tree: Prevent NULL pointer dereference in radix_tree_node_rcu_free

[Ayaan Mirza Baig]

syzkaller reported a kernel NULL pointer dereference:

BUG: kernel NULL pointer dereference, address: 0000000000000000
PGD 0 P4D 0
Oops: Oops: 0010 [#1] PREEMPT SMP KASAN NOPTI

Call Trace:
 <IRQ>
 rcu_do_batch kernel/rcu/tree.c:2546 [inline]
 rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2802
 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
 __do_softirq kernel/softirq.c:595 [inline]
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xd8/0x140 kernel/locking/spinlock.c:194

Reported-by: syzbot+80e5d6f453f14a53383a@syzkaller.appspotmail.com

Link: https://syzkaller.appspot.com/bug?extid=80e5d6f453f14a53383a
Signed-off-by: Ayaan Mirza Baig <ayaanmirzabaig85@gmail.com>
---
 lib/radix-tree.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 976b9bd02a1b..5cefbfd7677e 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -292,6 +292,9 @@ void radix_tree_node_rcu_free(struct rcu_head *head)
 	struct radix_tree_node *node =
 			container_of(head, struct radix_tree_node, rcu_head);
 
+	if (unlikely(!node))
+		return; //Prevent NULL deref
+
 	/*
 	 * Must only free zeroed nodes into the slab.  We can be left with
 	 * non-NULL entries by radix_tree_free_nodes, so clear the entries
-- 
2.47.1


Note to reviewers:
I'm new to kernel development and would appreciate feedback on patch
formatting or workflow if I missed any conventions. Thank you for
your patience and guidance.

Re: [PATCH 1/1] radix-tree: Prevent NULL pointer dereference in radix_tree_node_rcu_free

[Andrew Morton]

On Mon, 24 Feb 2025 01:31:08 +0530 Ayaan Mirza Baig <ayaanmirzabaig85@gmail.com> wrote:

> syzkaller reported a kernel NULL pointer dereference:
> 
> BUG: kernel NULL pointer dereference, address: 0000000000000000
> PGD 0 P4D 0
> Oops: Oops: 0010 [#1] PREEMPT SMP KASAN NOPTI
> 
> Call Trace:
>  <IRQ>
>  rcu_do_batch kernel/rcu/tree.c:2546 [inline]
>  rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2802
>  handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
>  __do_softirq kernel/softirq.c:595 [inline]
>  invoke_softirq kernel/softirq.c:435 [inline]
>  __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
>  irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
>  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
>  sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
>  </IRQ>
>  <TASK>
>  asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
> RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
> RIP: 0010:_raw_spin_unlock_irqrestore+0xd8/0x140 kernel/locking/spinlock.c:194
> 
> Reported-by: syzbot+80e5d6f453f14a53383a@syzkaller.appspotmail.com
> 
> Link: https://syzkaller.appspot.com/bug?extid=80e5d6f453f14a53383a
> Signed-off-by: Ayaan Mirza Baig <ayaanmirzabaig85@gmail.com>
> ---
>  lib/radix-tree.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/lib/radix-tree.c b/lib/radix-tree.c
> index 976b9bd02a1b..5cefbfd7677e 100644
> --- a/lib/radix-tree.c
> +++ b/lib/radix-tree.c
> @@ -292,6 +292,9 @@ void radix_tree_node_rcu_free(struct rcu_head *head)
>  	struct radix_tree_node *node =
>  			container_of(head, struct radix_tree_node, rcu_head);
>  
> +	if (unlikely(!node))
> +		return; //Prevent NULL deref
> +
>  	/*
>  	 * Must only free zeroed nodes into the slab.  We can be left with
>  	 * non-NULL entries by radix_tree_free_nodes, so clear the entries

Well, we should work out why this happened.  Cc Paul ;)

Re: [PATCH 1/1] radix-tree: Prevent NULL pointer dereference in radix_tree_node_rcu_free

[Ayaan Mirza Baig]

Hi Andrew,

Thank you for reviewing the patch! I’d be happy to assist in debugging the issue, though I’ll need some guidance since I’m still learning kernel development workflows. Could you or Paul clarify:

What specific symptom or failure prompted the need for investigation ?

Are there subsystems or tools I should focus on ?

How can I reproduce the issue locally to gather more data?

I’ll start by re-testing my patch with CONFIG_DEBUG_ATOMIC_SLEEP and lockdep enabled, and share any findings. Please let me know how I can contribute further!