Unverified Commit e9075e42 authored by Deepanshu Kartikey's avatar Deepanshu Kartikey Committed by Christian Brauner
Browse files

netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry 



When a write subrequest is marked NETFS_SREQ_NEED_RETRY, the retry path
in netfs_unbuffered_write() unconditionally calls stream->prepare_write()
without checking if it is NULL.

Filesystems such as 9P do not set the prepare_write operation, so
stream->prepare_write remains NULL. When get_user_pages() fails with
-EFAULT and the subrequest is flagged for retry, this results in a NULL
pointer dereference at fs/netfs/direct_write.c:189.

Fix this by mirroring the pattern already used in write_retry.c: if
stream->prepare_write is NULL, skip renegotiation and directly reissue
the subrequest via netfs_reissue_write(), which handles iterator reset,
IN_PROGRESS flag, stats update and reissue internally.

Fixes: a0b4c7a4 ("netfs: Fix unbuffered/DIO writes to dispatch subrequests in strict sequence")
Reported-by: default avatar <syzbot+7227db0fbac9f348dba0@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=7227db0fbac9f348dba0


Signed-off-by: default avatarDeepanshu Kartikey <Kartikey406@gmail.com>
Link: https://patch.msgid.link/20260307043947.347092-1-kartikey406@gmail.com


Tested-by: default avatar <syzbot+7227db0fbac9f348dba0@syzkaller.appspotmail.com>
Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent 67e467a1

fs/netfs/direct_write.c

+11 −3
Original line number Diff line number Diff line
@@ -186,10 +186,18 @@ static int netfs_unbuffered_write(struct netfs_io_request *wreq) 
		stream->sreq_max_segs	= INT_MAX;



		netfs_get_subrequest(subreq, netfs_sreq_trace_get_resubmit);

		stream->prepare_write(subreq);



		if (stream->prepare_write) {

			stream->prepare_write(subreq);

			__set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags);

			netfs_stat(&netfs_n_wh_retry_write_subreq);

		} else {

			struct iov_iter source;



			netfs_reset_iter(subreq);

			source = subreq->io_iter;

			netfs_reissue_write(stream, subreq, &source);

		}

	}



	netfs_unbuffered_write_done(wreq);