From 4d43ccd2d984ee0b63b32c3b0b4d92956bf7cf36 Mon Sep 17 00:00:00 2001 From: Gautam Menghani Date: Sun, 26 Jun 2022 22:33:55 +0530 Subject: [PATCH] mm/kasan: fix null pointer dereference warning in qlink_to_cache() virt_to_slab() declared in slab.h can return NULL if the address does not belong to a slab. This case is not handled in qlink_to_cache() in quarantine.c, which can cause a NULL pointer dereference in "virt_to_slab(qlink)->slab_cache". This issue was discovered by fanalyzer (my gcc version: 12.1.1 20220507) Link: https://lkml.kernel.org/r/20220626170355.198913-1-gautammenghani201@gmail.com Signed-off-by: Gautam Menghani Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Dmitry Vyukov Cc: Vincenzo Frascino Cc: Shuah Khan Signed-off-by: Andrew Morton --- mm/kasan/quarantine.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c index 75585077eb6d..c7554f5b9fb6 100644 --- a/mm/kasan/quarantine.c +++ b/mm/kasan/quarantine.c @@ -128,7 +128,13 @@ static unsigned long quarantine_batch_size; static struct kmem_cache *qlink_to_cache(struct qlist_node *qlink) { - return virt_to_slab(qlink)->slab_cache; + struct slab *folio_slab = virt_to_slab(qlink); + + if (!folio_slab) { + pr_warn("The address %p does not belong to a slab", qlink); + return NULL; + } + return folio_slab->slab_cache; } static void *qlink_to_object(struct qlist_node *qlink, struct kmem_cache *cache) -- 2.50.1