Forwarded: [PATCH] ext4: fix null-ptr-deref in bio_add_folio

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx, syzkaller-bugs@xxxxxxxxxxxxxxxx.

***

Subject: [PATCH] ext4: fix null-ptr-deref in bio_add_folio
Author: kartikey406@xxxxxxxxx

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


bio_alloc() is called with BIO_MAX_VECS=256 which exceeds
BIO_INLINE_VECS=4, so the bvec array is allocated separately.
Under GFP_NOIO memory pressure this allocation can fail and
bio_alloc() returns NULL.

io_submit_init_bio() does not check for NULL, so NULL gets
stored in io->io_bio and causes a null-ptr-deref when
bio_add_folio() tries to use it.

Fix by adding __GFP_DIRECT_RECLAIM to guarantee the allocation
always succeeds, as documented in bio_alloc_bioset().

Reported-by: syzbot+ed8bc247f231c1a48e21@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=ed8bc247f231c1a48e21
Signed-off-by: Deepanshu Kartikey <Kartikey406@xxxxxxxxx>
---
 fs/ext4/page-io.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c
index a8c95eee91b7..aea28e5a5665 100644
--- a/fs/ext4/page-io.c
+++ b/fs/ext4/page-io.c
@@ -423,8 +423,14 @@ static void io_submit_init_bio(struct ext4_io_submit *io,
 	/*
 	 * bio_alloc will _always_ be able to allocate a bio if
 	 * __GFP_DIRECT_RECLAIM is set, see comments for bio_alloc_bioset().
-	 */
-	bio = bio_alloc(bh->b_bdev, BIO_MAX_VECS, REQ_OP_WRITE, GFP_NOIO);
+	* We must use __GFP_DIRECT_RECLAIM to guarantee the bvec array
+	* allocation succeeds - BIO_MAX_VECS exceeds BIO_INLINE_VECS so
+	* bio_alloc_bioset() allocates the bvec array separately, which
+	* can fail under GFP_NOIO memory pressure, leaving bi_io_vec NULL
+	* and causing a null-ptr-deref in bio_add_folio().
+	*/
+	bio = bio_alloc(bh->b_bdev, BIO_MAX_VECS, REQ_OP_WRITE,
+		       GFP_NOIO | __GFP_DIRECT_RECLAIM);
 	fscrypt_set_bio_crypt_ctx_bh(bio, bh, GFP_NOIO);
 	bio->bi_iter.bi_sector = bh->b_blocknr * (bh->b_size >> 9);
 	bio->bi_end_io = ext4_end_bio;
-- 
2.43.0