[PATCH 6.1.y] fs/ntfs3: fix null-ptr-deref in ntfs_lock_new_page()

[PATCH 6.1.y] fs/ntfs3: fix null-ptr-deref in ntfs_lock_new_page()

[Carlos Llamas]

Commit 95b917a14b15 ("ntfs: Do not overwrite uptodate pages") added an
IS_ERR() check on the folio returned by __filemap_get_folio(). However,
__filemap_get_folio() only started returning ERR_PTR() in v6.4 with
commit 66dabbb65d67 ("mm: return an ERR_PTR from __filemap_get_folio").
In 6.1.y, it returns NULL when the folio cannot be allocated. IS_ERR()
misses this and a NULL folio gets passed to folio_test_uptodate(), which
dereferences it.

This is easily reproduced by reading a compressed file while failing the
folio allocation:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 1952067 P4D 1952067 PUD 2601067 PMD 0
  Oops: 0000 [#1] PREEMPT SMP NOPTI
  CPU: 0 PID: 79 Comm: init Not tainted 6.1.190-02250-g79807e970724 #1
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
  RIP: 0010:ntfs_lock_new_page+0x23/0x120
  Code: e9 54 ff ff ff 66 90 55 89 d1 48 89 f5 53 89 d3 ba 07 00 00 00 48 83 ec 08 e8 f9 a1 dc ff 48 3d 00 f0 ff ff 0f 87 dc 00 00 00 <48> 8b 10 83 e2 04 74 53 48 89 c7 48 89 04 24 e8 d9 63 dc ff 48 8b
  RSP: 0018:ffffb9e2c024fbe8 EFLAGS: 00010207
  RAX: 0000000000000000 RBX: 0000000000100cca RCX: 0000000000000000
  RDX: ffff9f56c1ad2c00 RSI: 0000000000000001 RDI: 0000000000000000
  RBP: 0000000000000001 R08: 0000000000000000 R09: ffff9f56c260e000
  R10: ffffffffb6963140 R11: ffffb9e2c024fbd0 R12: 0000000000000010
  R13: ffffe4fc804266c0 R14: 0000000000000000 R15: 0000000000000001
  FS:  00000000092ca3c0(0000) GS:ffff9f56fec00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000000000000000 CR3: 000000000135e005 CR4: 0000000000370ef0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Call Trace:
   <TASK>
   ni_readpage_cmpr+0x102/0x270
   ntfs_read_folio+0x44/0xd0
   filemap_read_folio+0x1f/0x90
   filemap_get_pages+0x41b/0x5d0
   filemap_read+0xd3/0x350
   vfs_read+0x28c/0x370
   ksys_pread64+0x62/0xa0
   do_syscall_64+0x35/0x90
   entry_SYSCALL_64_after_hwframe+0x6e/0xd8
  RIP: 0033:0x445162
  Code: 18 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 75 1a 83 e2 39 83 fa 08 75 12 e8 1b ff ff ff 0f 1f 00 49 89 ca 48 8b 44 24 20 0f 05 <48> 83 c4 18 c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 10 ff 74 24 18
  RSP: 002b:00007ffd593a3b30 EFLAGS: 00000202 ORIG_RAX: 0000000000000011
  RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 0000000000445162
  RDX: 0000000000001000 RSI: 00000000004a9ac0 RDI: 0000000000000003
  RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
  R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffd593a3d28
  R13: 0000000000000002 R14: 0000000000000003 R15: 00000000004a4100
   </TASK>
  Modules linked in:
  CR2: 0000000000000000
  ---[ end trace 0000000000000000 ]---

Fix this by checking for NULL and returning -ENOMEM instead.

This is a stable-only fix.

Cc: stable@vger.kernel.org
Fixes: 95b917a14b15 ("ntfs: Do not overwrite uptodate pages")
Signed-off-by: Carlos Llamas <cmllamas@google.com>
---
 fs/ntfs3/frecord.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index fcdaea02ba04..49766278eb1e 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -2157,8 +2157,8 @@ static struct page *ntfs_lock_new_page(struct address_space *mapping,
 			FGP_LOCK | FGP_ACCESSED | FGP_CREAT, gfp);
 	struct page *page;
 
-	if (IS_ERR(folio))
-		return ERR_CAST(folio);
+	if (!folio)
+		return ERR_PTR(-ENOMEM);
 
 	if (!folio_test_uptodate(folio))
 		return folio_file_page(folio, index);
-- 
2.56.0.317.g454f8302e1-goog

Re: [PATCH 6.1.y] fs/ntfs3: fix null-ptr-deref in ntfs_lock_new_page()

[Sasha Levin]

> Commit 95b917a14b15 ("ntfs: Do not overwrite uptodate pages") added an
> IS_ERR() check on the folio returned by __filemap_get_folio(). However,
> __filemap_get_folio() only started returning ERR_PTR() in v6.4 with
> commit 66dabbb65d67 ("mm: return an ERR_PTR from __filemap_get_folio").
> In 6.1.y, it returns NULL when the folio cannot be allocated.

Thanks Carlos. There is no upstream commit for this, so I'd like an ack or
review from the ntfs3 maintainer before I queue it for 6.1.

Konstantin, could you take a look?

-- 
Thanks,
Sasha