REDHAT-BUG-2432666: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved:
lib/buildid: use kernelread() for sleepable context
Prevent a "BUG: unable to handle kernel NULL pointer dereference in filemapreadfolio".
For the sleepable context, convert freader to use kernelread() instead of direct page cache access via readcachefolio(). This simplifies the faultable code path by using the standard kernel file reading interface which handles all the complexity of reading file data.
At the moment we are not changing the code for non-sleepable context which uses filemapgetfolio() and only succeeds if the target folios are already in memory and up-to-date. The reason is to keep the patch simple and easier to backport to stable kernels.
Syzbot repro does not crash the kernel anymore and the selftests run successfully.
In the follow up we will make kernelread() with IOCBNOWAIT work for non-sleepable contexts. In addition, I would like to replace the secretmem check with a more generic approach and will add fstest for the buildid code.
Affected Software
Event History
Frequently Asked Questions
Which build ID reading paths are changed by the fix?
The fix changes the sleepable-context reader to use __kernel_read() rather than direct page-cache access through read_cache_folio(). The non-sleepable path is not changed; it continues to use filemap_get_folio() and succeeds only when the target folios are already resident and up-to-date.
What evidence is provided that the fix addresses the failure?
The supplied Syzbot reproducer no longer crashes the kernel after the change. The relevant selftests also complete successfully.