[Deepin-Kernel-SIG] [linux 6.6-y] [Upstream] jfs: Fix null-ptr-deref in jfs_ioc_trim

[opsiff]

mainline inclusion
from mainline-v6.16-rc1
commit a468540
category: bugfix
CVE: CVE-2025-38203

[ Syzkaller Report ]

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000087: 0000 [#1
KASAN: null-ptr-deref in range [0x0000000000000438-0x000000000000043f] CPU: 2 UID: 0 PID: 10614 Comm: syz-executor.0 Not tainted 6.13.0-rc6-gfbfd64d25c7a-dirty #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Sched_ext: serialise (enabled+all), task: runnable_at=-30ms RIP: 0010:jfs_ioc_trim+0x34b/0x8f0
Code: e7 e8 59 a4 87 fe 4d 8b 24 24 4d 8d bc 24 38 04 00 00 48 8d 93 90 82 fe ff 4c 89 ff 31 f6
RSP: 0018:ffffc900055f7cd0 EFLAGS: 00010206
RAX: 0000000000000087 RBX: 00005866a9e67ff8 RCX: 000000000000000a RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001 RBP: dffffc0000000000 R08: ffff88807c180003 R09: 1ffff1100f830000 R10: dffffc0000000000 R11: ffffed100f830001 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000438 FS: 00007fe520225640(0000) GS:ffff8880b7e80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005593c91b2c88 CR3: 000000014927c000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:

? __die_body+0x61/0xb0
? die_addr+0xb1/0xe0
? exc_general_protection+0x333/0x510
? asm_exc_general_protection+0x26/0x30
? jfs_ioc_trim+0x34b/0x8f0
jfs_ioctl+0x3c8/0x4f0
? __pfx_jfs_ioctl+0x10/0x10
? __pfx_jfs_ioctl+0x10/0x10
__se_sys_ioctl+0x269/0x350
? __pfx___se_sys_ioctl+0x10/0x10
? do_syscall_64+0xfb/0x210
do_syscall_64+0xee/0x210
? syscall_exit_to_user_mode+0x1e0/0x330
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe51f4903ad
Code: c3 e8 a7 2b 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d
RSP: 002b:00007fe5202250c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fe51f5cbf80 RCX: 00007fe51f4903ad RDX: 0000000020000680 RSI: 00000000c0185879 RDI: 0000000000000005 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe520225640 R13: 000000000000000e R14: 00007fe51f44fca0 R15: 00007fe52021d000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:jfs_ioc_trim+0x34b/0x8f0
Code: e7 e8 59 a4 87 fe 4d 8b 24 24 4d 8d bc 24 38 04 00 00 48 8d 93 90 82 fe ff 4c 89 ff 31 f6
RSP: 0018:ffffc900055f7cd0 EFLAGS: 00010206
RAX: 0000000000000087 RBX: 00005866a9e67ff8 RCX: 000000000000000a RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001 RBP: dffffc0000000000 R08: ffff88807c180003 R09: 1ffff1100f830000 R10: dffffc0000000000 R11: ffffed100f830001 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000438 FS: 00007fe520225640(0000) GS:ffff8880b7e80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005593c91b2c88 CR3: 000000014927c000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Kernel panic - not syncing: Fatal exception

[ Analysis ]

We believe that we have found a concurrency bug in the fs/jfs module that results in a null pointer dereference. There is a closely related issue which has been fixed:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d6c1b3599b2feb5c7291f5ac3a36e5fa7cedb234

... but, unfortunately, the accepted patch appears to still be susceptible to a null pointer dereference under some interleavings.

To trigger the bug, we think that JFS_SBI(ipbmap->i_sb)->bmap is set to NULL in dbFreeBits and then dereferenced in jfs_ioc_trim. This bug manifests quite rarely under normal circumstances, but is triggereable from a syz-program.

Reported-and-tested-by: Dylan J. Wolffwolffd@comp.nus.edu.sg
Reported-and-tested-by: Jiacheng Xu stitch@zju.edu.cn

(cherry picked from commit a468540)

Summary by Sourcery

Bug Fixes:

• Add a check for bmp == NULL in jfs_ioc_trim to avoid dereferencing a null bmap pointer

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR backports an upstream bugfix (CVE-2025-38203) from mainline v6.16-rc1 to prevent a rare concurrency-induced null-pointer dereference in jfs_ioc_trim by introducing a guard on the bmap pointer.

Sequence diagram for jfs_ioc_trim null pointer guard

sequenceDiagram
    participant "User Process"
    participant "jfs_ioc_trim()"
    participant "JFS_SBI_bmap"
    "User Process"->>"jfs_ioc_trim()": Call with inode and fstrim_range
    "jfs_ioc_trim()"->>"JFS_SBI_bmap": Retrieve bmap pointer
    alt bmap is NULL
        "jfs_ioc_trim()"-->>"User Process": Return error (no dereference)
    else bmap is valid
        "jfs_ioc_trim()"->>"JFS_SBI_bmap": Access db_agsize, db_mapsize
        "jfs_ioc_trim()"-->>"User Process": Continue with trim operation
    end

Loading

Class diagram for updated jfs_ioc_trim logic

classDiagram
    class inode {
        i_sb
    }
    class fstrim_range {
        start
        len
        minlen
    }
    class super_block {
        s_umount
        s_blocksize
    }
    class jfs_sb_info {
        bmap
    }
    class bmap {
        db_agsize
        db_mapsize
    }
    inode --> super_block : i_sb
    super_block --> jfs_sb_info : JFS_SBI()
    jfs_sb_info --> bmap : bmap
    class jfs_ioc_trim {
        +int jfs_ioc_trim(inode *ip, fstrim_range *range)
        // Now checks if bmap == NULL before dereferencing
    }
    jfs_ioc_trim --> inode
    jfs_ioc_trim --> fstrim_range
    jfs_ioc_trim --> super_block
    jfs_ioc_trim --> jfs_sb_info
    jfs_ioc_trim --> bmap

Loading

File-Level Changes

Change	Details	Files
Guard against null-pointer dereference in jfs_ioc_trim	Add check for bmp == NULL in the existing if condition Adjust and reflow conditional clauses to include the null-check before size checks	fs/jfs/jfs_discard.c

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[deepin-ci-robot]

deepin pr auto review

我来对这段代码的修改进行审查：

1. 语法逻辑：

• 修改后的代码在原有的条件判断中增加了 bmp == NULL 的检查，这是正确的做法。
• 使用 || 运算符连接多个条件，逻辑清晰。
• 条件判断的顺序合理，将空指针检查放在前面是好的实践。

2. 代码质量：

• 优点：
  • 增加了对 bmp 指针的空值检查，提高了代码的健壮性
  • 保持了原有的错误处理逻辑
  • 代码格式保持一致
• 建议：
  • 可以考虑将多个条件判断分行显示，提高可读性：

    if (bmp == NULL ||
        minlen > bmp->db_agsize ||
        start >= bmp->db_mapsize ||
        range->len < sb->s_blocksize) {

3. 代码性能：

• 增加的空指针检查不会对性能产生显著影响
• 条件判断的顺序是合理的，因为空指针检查是最轻量级的操作

4. 代码安全：

• 修改增加了安全性，防止了可能的空指针解引用
• 在访问 bmp 的成员之前先检查指针是否为空，这是很好的安全实践
• 保持了原有的资源释放逻辑（up_read）

总体评价：
这个修改是一个很好的改进，主要是增加了对 bmp 指针的空值检查，提高了代码的安全性和健壮性。修改是必要的，因为在某些异常情况下，bmp 可能为 NULL，如果不进行检查就直接访问其成员会导致内核崩溃。建议合并这个修改。

[Copilot]

Pull Request Overview

This patch addresses CVE-2025-38203, a null pointer dereference vulnerability in the JFS filesystem's TRIM operation. The issue occurs when JFS_SBI(ip->i_sb)->bmap is set to NULL during concurrent operations and then dereferenced in jfs_ioc_trim, causing a kernel panic.

Key Changes:

• Added a null pointer check for the bmap variable before dereferencing it in validation conditions

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[sourcery-ai]

Hey there - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: lanlanxiyiji
Once this PR has been reviewed and has the lgtm label, please ask for approval from opsiff. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment