Re: [PATCH] PM / hibernate: Fix oops at snapshot_write().

[Rafael J. Wysocki]

On Saturday, May 26, 2018 2:59:36 AM CEST Tetsuo Handa wrote:
> syzbot is reporting NULL pointer dereference at snapshot_write() [1].
> This is because data->handle is zero-cleared by ioctl(SNAPSHOT_FREE).
> Fix this by checking data_of(data->handle) != NULL before using it.
> 
> [1] 
> https://syzkaller.appspot.com/bug?id=828a3c71bd344a6de8b6a31233d51a72099f27fd
> 
> Signed-off-by: Tetsuo Handa 
> Reported-by: syzbot 
> Cc: Rafael J. Wysocki 
> Cc: Len Brown 
> Cc: Pavel Machek 
> ---
>  kernel/power/user.c | 5 +
>  1 file changed, 5 insertions(+)
> 
> diff --git a/kernel/power/user.c b/kernel/power/user.c
> index 75c959d..abd2255 100644
> --- a/kernel/power/user.c
> +++ b/kernel/power/user.c
> @@ -186,6 +186,11 @@ static ssize_t snapshot_write(struct file *filp, const 
> char __user *buf,
>   res = PAGE_SIZE - pg_offp;
>   }
>  
> + if (!data_of(data->handle)) {
> + res = -EINVAL;
> + goto unlock;
> + }
> +
>   res = simple_write_to_buffer(data_of(data->handle), res, &pg_offp,
>   buf, count);
>   if (res > 0)
> 

Applied, thanks!

[PATCH] PM / hibernate: Fix oops at snapshot_write().

[Tetsuo Handa]

syzbot is reporting NULL pointer dereference at snapshot_write() [1].
This is because data->handle is zero-cleared by ioctl(SNAPSHOT_FREE).
Fix this by checking data_of(data->handle) != NULL before using it.

[1] 
https://syzkaller.appspot.com/bug?id=828a3c71bd344a6de8b6a31233d51a72099f27fd

Signed-off-by: Tetsuo Handa 
Reported-by: syzbot 
Cc: Rafael J. Wysocki 
Cc: Len Brown 
Cc: Pavel Machek 
---
 kernel/power/user.c | 5 +
 1 file changed, 5 insertions(+)

diff --git a/kernel/power/user.c b/kernel/power/user.c
index 75c959d..abd2255 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -186,6 +186,11 @@ static ssize_t snapshot_write(struct file *filp, const 
char __user *buf,
res = PAGE_SIZE - pg_offp;
}
 
+   if (!data_of(data->handle)) {
+   res = -EINVAL;
+   goto unlock;
+   }
+
res = simple_write_to_buffer(data_of(data->handle), res, &pg_offp,
buf, count);
if (res > 0)
-- 
1.8.3.1