[PATCH] afs: Set vllist to NULL if addr parsing fails

[PATCH] afs: Set vllist to NULL if addr parsing fails

[David Howells]

From: Edward Adam Davis <eadavis@qq.com>

syzbot reported a bug in in afs_put_vlserverlist.

  kAFS: bad VL server IP address
  BUG: unable to handle page fault for address: fffffffffffffffa
  ...
  Oops: Oops: 0002 [#1] SMP KASAN PTI
  ...
  RIP: 0010:refcount_dec_and_test include/linux/refcount.h:450 [inline]
  RIP: 0010:afs_put_vlserverlist+0x3a/0x220 fs/afs/vl_list.c:67
  ...
  Call Trace:
   <TASK>
   afs_alloc_cell fs/afs/cell.c:218 [inline]
   afs_lookup_cell+0x12a5/0x1680 fs/afs/cell.c:264
   afs_cell_init+0x17a/0x380 fs/afs/cell.c:386
   afs_proc_rootcell_write+0x21f/0x290 fs/afs/proc.c:247
   proc_simple_write+0x114/0x1b0 fs/proc/generic.c:825
   pde_write fs/proc/inode.c:330 [inline]
   proc_reg_write+0x23d/0x330 fs/proc/inode.c:342
   vfs_write+0x25c/0x1180 fs/read_write.c:682
   ksys_write+0x12a/0x240 fs/read_write.c:736
   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
   do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
   entry_SYSCALL_64_after_hwframe+0x77/0x7f

Because afs_parse_text_addrs() parses incorrectly, its return value -EINVAL
is assigned to vllist, which results in -EINVAL being used as the vllist
address when afs_put_vlserverlist() is executed.

Set the vllist value to NULL when a parsing error occurs to avoid this
issue.

Fixes: e2c2cb8ef07a ("afs: Simplify cell record handling")
Reported-by: syzbot+5c042fbab0b292c98fc6@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5c042fbab0b292c98fc6
Tested-by: syzbot+5c042fbab0b292c98fc6@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
cc: linux-fsdevel@vger.kernel.org
---
 fs/afs/cell.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/afs/cell.c b/fs/afs/cell.c
index 0168bbf53fe0..f31359922e98 100644
--- a/fs/afs/cell.c
+++ b/fs/afs/cell.c
@@ -177,6 +177,7 @@ static struct afs_cell *afs_alloc_cell(struct afs_net *net,
 					      VL_SERVICE, AFS_VL_PORT);
 		if (IS_ERR(vllist)) {
 			ret = PTR_ERR(vllist);
+			vllist = NULL;
 			goto parse_failed;
 		}
 

Re: [PATCH] afs: Set vllist to NULL if addr parsing fails

[Christian Brauner]

On Mon, 21 Jul 2025 15:26:51 +0100, David Howells wrote:
> syzbot reported a bug in in afs_put_vlserverlist.
> 
>   kAFS: bad VL server IP address
>   BUG: unable to handle page fault for address: fffffffffffffffa
>   ...
>   Oops: Oops: 0002 [#1] SMP KASAN PTI
>   ...
>   RIP: 0010:refcount_dec_and_test include/linux/refcount.h:450 [inline]
>   RIP: 0010:afs_put_vlserverlist+0x3a/0x220 fs/afs/vl_list.c:67
>   ...
>   Call Trace:
>    <TASK>
>    afs_alloc_cell fs/afs/cell.c:218 [inline]
>    afs_lookup_cell+0x12a5/0x1680 fs/afs/cell.c:264
>    afs_cell_init+0x17a/0x380 fs/afs/cell.c:386
>    afs_proc_rootcell_write+0x21f/0x290 fs/afs/proc.c:247
>    proc_simple_write+0x114/0x1b0 fs/proc/generic.c:825
>    pde_write fs/proc/inode.c:330 [inline]
>    proc_reg_write+0x23d/0x330 fs/proc/inode.c:342
>    vfs_write+0x25c/0x1180 fs/read_write.c:682
>    ksys_write+0x12a/0x240 fs/read_write.c:736
>    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>    do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
>    entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> [...]

Applied to the vfs.fixes branch of the vfs/vfs.git tree.
Patches in the vfs.fixes branch should appear in linux-next soon.

Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.

It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs.fixes

[1/1] afs: Set vllist to NULL if addr parsing fails
      https://git.kernel.org/vfs/vfs/c/8b3c655fa240

[syzbot] [afs?] BUG: unable to handle kernel paging request in afs_put_vlserverlist

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    bec7dcbc242c Merge tag 'probes-fixes-v6.14' of git://git.k..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13067a74580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=7a4e108575159039
dashboard link: https://syzkaller.appspot.com/bug?extid=5c042fbab0b292c98fc6
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=179b323f980000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17fe17cf980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/36d8f571e9a9/disk-bec7dcbc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3fc027e5e923/vmlinux-bec7dcbc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/964a62b47535/bzImage-bec7dcbc.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5c042fbab0b292c98fc6@syzkaller.appspotmail.com

kAFS: bad VL server IP address
BUG: unable to handle page fault for address: fffffffffffffffa
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD e186067 P4D e186067 PUD e188067 PMD 0 
Oops: Oops: 0002 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 5834 Comm: syz-executor362 Not tainted 6.15.0-rc1-syzkaller-00025-gbec7dcbc242c #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:arch_atomic_fetch_add arch/x86/include/asm/atomic.h:93 [inline]
RIP: 0010:raw_atomic_fetch_sub_release include/linux/atomic/atomic-arch-fallback.h:949 [inline]
RIP: 0010:atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:401 [inline]
RIP: 0010:__refcount_sub_and_test include/linux/refcount.h:389 [inline]
RIP: 0010:__refcount_dec_and_test include/linux/refcount.h:432 [inline]
RIP: 0010:refcount_dec_and_test include/linux/refcount.h:450 [inline]
RIP: 0010:afs_put_vlserverlist+0x3a/0x220 fs/afs/vl_list.c:67
Code: 53 48 83 ec 18 e8 e6 35 2f fe 48 85 ed 74 43 e8 dc 35 2f fe 4c 8d 65 10 be 04 00 00 00 bb ff ff ff ff 4c 89 e7 e8 76 ad 93 fe <f0> 0f c1 5d 10 31 ff 89 de e8 f8 30 2f fe 85 db 7e 29 e8 af 35 2f
RSP: 0018:ffffc90003e5fae0 EFLAGS: 00010246
RAX: 0000000000000001 RBX: 00000000ffffffff RCX: ffffffff838c071a
RDX: fffffc0000000000 RSI: 0000000000000004 RDI: fffffffffffffffa
RBP: ffffffffffffffea R08: 0000000000000001 R09: fffffbffffffffff
R10: fffffffffffffffd R11: 0000000000000001 R12: fffffffffffffffa
R13: ffffffffffffffea R14: ffff8880216ad700 R15: ffff888034ec2000
FS:  0000555561d3e380(0000) GS:ffff888124ab9000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffffa CR3: 000000007a922000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 afs_alloc_cell fs/afs/cell.c:218 [inline]
 afs_lookup_cell+0x12a5/0x1680 fs/afs/cell.c:264
 afs_cell_init+0x17a/0x380 fs/afs/cell.c:386
 afs_proc_rootcell_write+0x21f/0x290 fs/afs/proc.c:247
 proc_simple_write+0x114/0x1b0 fs/proc/generic.c:825
 pde_write fs/proc/inode.c:330 [inline]
 proc_reg_write+0x23d/0x330 fs/proc/inode.c:342
 vfs_write+0x25c/0x1180 fs/read_write.c:682
 ksys_write+0x12a/0x240 fs/read_write.c:736
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fab4ed8ba79
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff0c666448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007fab4ed8ba79
RDX: 000000000000009e RSI: 0000200000000200 RDI: 0000000000000003
RBP: 00007fab4edfe5f0 R08: 0000000000000006 R09: 0000000000000006
R10: 0000000000000006 R11: 0000000000000246 R12: 0000000000000001
R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Modules linked in:
CR2: fffffffffffffffa
---[ end trace 0000000000000000 ]---
RIP: 0010:arch_atomic_fetch_add arch/x86/include/asm/atomic.h:93 [inline]
RIP: 0010:raw_atomic_fetch_sub_release include/linux/atomic/atomic-arch-fallback.h:949 [inline]
RIP: 0010:atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:401 [inline]
RIP: 0010:__refcount_sub_and_test include/linux/refcount.h:389 [inline]
RIP: 0010:__refcount_dec_and_test include/linux/refcount.h:432 [inline]
RIP: 0010:refcount_dec_and_test include/linux/refcount.h:450 [inline]
RIP: 0010:afs_put_vlserverlist+0x3a/0x220 fs/afs/vl_list.c:67
Code: 53 48 83 ec 18 e8 e6 35 2f fe 48 85 ed 74 43 e8 dc 35 2f fe 4c 8d 65 10 be 04 00 00 00 bb ff ff ff ff 4c 89 e7 e8 76 ad 93 fe <f0> 0f c1 5d 10 31 ff 89 de e8 f8 30 2f fe 85 db 7e 29 e8 af 35 2f
RSP: 0018:ffffc90003e5fae0 EFLAGS: 00010246
RAX: 0000000000000001 RBX: 00000000ffffffff RCX: ffffffff838c071a
RDX: fffffc0000000000 RSI: 0000000000000004 RDI: fffffffffffffffa
RBP: ffffffffffffffea R08: 0000000000000001 R09: fffffbffffffffff
R10: fffffffffffffffd R11: 0000000000000001 R12: fffffffffffffffa
R13: ffffffffffffffea R14: ffff8880216ad700 R15: ffff888034ec2000
FS:  0000555561d3e380(0000) GS:ffff888124ab9000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffffa CR3: 000000007a922000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	53                   	push   %rbx
   1:	48 83 ec 18          	sub    $0x18,%rsp
   5:	e8 e6 35 2f fe       	call   0xfe2f35f0
   a:	48 85 ed             	test   %rbp,%rbp
   d:	74 43                	je     0x52
   f:	e8 dc 35 2f fe       	call   0xfe2f35f0
  14:	4c 8d 65 10          	lea    0x10(%rbp),%r12
  18:	be 04 00 00 00       	mov    $0x4,%esi
  1d:	bb ff ff ff ff       	mov    $0xffffffff,%ebx
  22:	4c 89 e7             	mov    %r12,%rdi
  25:	e8 76 ad 93 fe       	call   0xfe93ada0
* 2a:	f0 0f c1 5d 10       	lock xadd %ebx,0x10(%rbp) <-- trapping instruction
  2f:	31 ff                	xor    %edi,%edi
  31:	89 de                	mov    %ebx,%esi
  33:	e8 f8 30 2f fe       	call   0xfe2f3130
  38:	85 db                	test   %ebx,%ebx
  3a:	7e 29                	jle    0x65
  3c:	e8                   	.byte 0xe8
  3d:	af                   	scas   %es:(%rdi),%eax
  3e:	35                   	.byte 0x35
  3f:	2f                   	(bad)


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[PATCH] afs: Set vllist to NULL if addr parsing fails

[Edward Adam Davis]

syzbot reported a bug in in afs_put_vlserverlist. [1]

Because afs_parse_text_addrs() parses incorrectly, its return value -EINVAL
is assigned to vllist, which results in -EINVAL being used as the vllist
address when afs_put_vlserverlist() is executed.

Set the vllist value to NULL when a parsing error occurs to avoid this issue.

[1]
kAFS: bad VL server IP address
BUG: unable to handle page fault for address: fffffffffffffffa
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD e186067 P4D e186067 PUD e188067 PMD 0
Oops: Oops: 0002 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 5834 Comm: syz-executor362 Not tainted 6.15.0-rc1-syzkaller-00025-gbec7dcbc242c #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:arch_atomic_fetch_add arch/x86/include/asm/atomic.h:93 [inline]
RIP: 0010:raw_atomic_fetch_sub_release include/linux/atomic/atomic-arch-fallback.h:949 [inline]
RIP: 0010:atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:401 [inline]
RIP: 0010:__refcount_sub_and_test include/linux/refcount.h:389 [inline]
RIP: 0010:__refcount_dec_and_test include/linux/refcount.h:432 [inline]
RIP: 0010:refcount_dec_and_test include/linux/refcount.h:450 [inline]
RIP: 0010:afs_put_vlserverlist+0x3a/0x220 fs/afs/vl_list.c:67
Code: 53 48 83 ec 18 e8 e6 35 2f fe 48 85 ed 74 43 e8 dc 35 2f fe 4c 8d 65 10 be 04 00 00 00 bb ff ff ff ff 4c 89 e7 e8 76 ad 93 fe <f0> 0f c1 5d 10 31 ff 89 de e8 f8 30 2f fe 85 db 7e 29 e8 af 35 2f
RSP: 0018:ffffc90003e5fae0 EFLAGS: 00010246
RAX: 0000000000000001 RBX: 00000000ffffffff RCX: ffffffff838c071a
RDX: fffffc0000000000 RSI: 0000000000000004 RDI: fffffffffffffffa
RBP: ffffffffffffffea R08: 0000000000000001 R09: fffffbffffffffff
R10: fffffffffffffffd R11: 0000000000000001 R12: fffffffffffffffa
R13: ffffffffffffffea R14: ffff8880216ad700 R15: ffff888034ec2000
FS:  0000555561d3e380(0000) GS:ffff888124ab9000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffffa CR3: 000000007a922000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 afs_alloc_cell fs/afs/cell.c:218 [inline]
 afs_lookup_cell+0x12a5/0x1680 fs/afs/cell.c:264
 afs_cell_init+0x17a/0x380 fs/afs/cell.c:386
 afs_proc_rootcell_write+0x21f/0x290 fs/afs/proc.c:247
 proc_simple_write+0x114/0x1b0 fs/proc/generic.c:825
 pde_write fs/proc/inode.c:330 [inline]
 proc_reg_write+0x23d/0x330 fs/proc/inode.c:342
 vfs_write+0x25c/0x1180 fs/read_write.c:682
 ksys_write+0x12a/0x240 fs/read_write.c:736
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fixes: e2c2cb8ef07a ("afs: Simplify cell record handling")
Reported-by: syzbot+5c042fbab0b292c98fc6@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5c042fbab0b292c98fc6
Tested-by: syzbot+5c042fbab0b292c98fc6@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
 fs/afs/cell.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/afs/cell.c b/fs/afs/cell.c
index 0168bbf53fe0..f31359922e98 100644
--- a/fs/afs/cell.c
+++ b/fs/afs/cell.c
@@ -177,6 +177,7 @@ static struct afs_cell *afs_alloc_cell(struct afs_net *net,
 					      VL_SERVICE, AFS_VL_PORT);
 		if (IS_ERR(vllist)) {
 			ret = PTR_ERR(vllist);
+			vllist = NULL;
 			goto parse_failed;
 		}
 
-- 
2.43.0