]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
ext4: fix possible null-ptr-deref in mbt_kunit_exit()
authorYe Bin <yebin10@huawei.com>
Mon, 30 Mar 2026 13:30:35 +0000 (21:30 +0800)
committerTheodore Ts'o <tytso@mit.edu>
Fri, 10 Apr 2026 02:04:32 +0000 (22:04 -0400)
There's issue as follows:
    # test_new_blocks_simple: failed to initialize: -12
KASAN: null-ptr-deref in range [0x0000000000000638-0x000000000000063f]
Tainted: [E]=UNSIGNED_MODULE, [N]=TEST
RIP: 0010:mbt_kunit_exit+0x5e/0x3e0 [ext4_test]
Call Trace:
 <TASK>
 kunit_try_run_case_cleanup+0xbc/0x100 [kunit]
 kunit_generic_run_threadfn_adapter+0x89/0x100 [kunit]
 kthread+0x408/0x540
 ret_from_fork+0xa76/0xdf0
 ret_from_fork_asm+0x1a/0x30

If mbt_kunit_init() init testcase failed will lead to null-ptr-deref.
So add test if 'sb' is inited success in mbt_kunit_exit().

Fixes: 7c9fa399a369 ("ext4: add first unit test for ext4_mb_new_blocks_simple in mballoc")
Signed-off-by: Ye Bin <yebin10@huawei.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Link: https://patch.msgid.link/20260330133035.287842-6-yebin@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
fs/ext4/mballoc-test.c

index 6f5bfbb0e8a42cc67a8825dad602e4589ca58825..95cb644cd32fa818984a6b9027eebab159ad7e15 100644 (file)
@@ -362,7 +362,6 @@ static int mbt_kunit_init(struct kunit *test)
                return ret;
        }
 
-       test->priv = sb;
        kunit_activate_static_stub(test,
                                   ext4_read_block_bitmap_nowait,
                                   ext4_read_block_bitmap_nowait_stub);
@@ -383,6 +382,8 @@ static int mbt_kunit_init(struct kunit *test)
                return -ENOMEM;
        }
 
+       test->priv = sb;
+
        return 0;
 }
 
@@ -390,6 +391,9 @@ static void mbt_kunit_exit(struct kunit *test)
 {
        struct super_block *sb = (struct super_block *)test->priv;
 
+       if (!sb)
+               return;
+
        mbt_mb_release(sb);
        mbt_ctx_release(sb);
        mbt_ext4_free_super_block(sb);