BUG Report: kernel NULL pointer dereference in bio_integrity_advance()

[Christoph Hellwig]

On Mon, Aug 26, 2024 at 02:32:31PM +0000, pjy at amazon.com wrote:
> This is because in the function:
> 
> void bio_integrity_advance(struct bio *bio, unsigned int bytes_done)
> {
> 	struct bio_integrity_payload *bip = bio_integrity(bio);
> 	struct blk_integrity *bi = blk_get_integrity(bio->bi_bdev->bd_disk);
> 	unsigned bytes = bio_integrity_bytes(bi, bytes_done >> 9);
> 
> 	bip->bip_iter.bi_sector += bio_integrity_intervals(bi, bytes_done >> 9);
> 	bvec_iter_advance(bip->bip_vec, &bip->bip_iter, bytes);
> }
> 
> Here blk_get_integrity() returns NULL and bio_integrity_bytes() uses it
> without checking for NULL.

So the above is on a NVMe namespace that does not support metadata?

We currently don't check if a namespace supports metadata before
sending it, so something like the patch below should fix it:

diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c
index f1d58e70933f54..b1d1422f812a63 100644
--- a/drivers/nvme/host/ioctl.c
+++ b/drivers/nvme/host/ioctl.c
@@ -4,6 +4,7 @@
  * Copyright (c) 2017-2021 Christoph Hellwig.
  */
 #include <linux/bio-integrity.h>
+#include <linux/blk-integrity.h>
 #include <linux/ptrace.h>	/* for force_successful_syscall_return */
 #include <linux/nvme_ioctl.h>
 #include <linux/io_uring/cmd.h>
@@ -121,6 +122,9 @@ static int nvme_map_user_request(struct request *req, u64 ubuffer,
 	struct block_device *bdev = ns ? ns->disk->part0 : NULL;
 	struct bio *bio = NULL;
 	int ret;
+		
+	if (meta_buffer && meta_len && !blk_get_integrity(bdev->bd_disk))
+		return -EINVAL;
 
 	if (ioucmd && (ioucmd->flags & IORING_URING_CMD_FIXED)) {
 		struct iov_iter iter;