KASAN: null-ptr-deref Write in f2fs_stop_discard_thread

From: Palash Oswal
Date: Mon Feb 20 2023 - 13:04:04 EST


Hello,
I found the following issue using syzkaller on:
HEAD commit : e60276b8c11ab4a8be23807bc67b04
8cfb937dfa (v6.0.8)
git tree: stable

C Reproducer : https://gist.github.com/oswalpalash/eb758955c10d951eae2b5995ffe11d8c
Kernel .config :
https://gist.github.com/oswalpalash/0962c70d774e5ec736a047bba917cecb

Console log :

==================================================================
BUG: KASAN: null-ptr-deref in kthread_stop+0x8b/0x710
Write of size 4 at addr 000000000000001c by task syz-executor.0/6491

CPU: 1 PID: 6491 Comm: syz-executor.0 Not tainted 6.0.8-pasta #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xcd/0x134
print_report.cold+0x36/0x63a
kasan_report+0x8a/0x1b0
kasan_check_range+0x13b/0x190
kthread_stop+0x8b/0x710
f2fs_stop_discard_thread+0x91/0xb0
kill_f2fs_super+0xde/0x3e0
deactivate_locked_super+0x8c/0xf0
deactivate_super+0xad/0xd0
cleanup_mnt+0x347/0x4b0
task_work_run+0xe0/0x1a0
exit_to_user_mode_prepare+0x25d/0x270
syscall_exit_to_user_mode+0x19/0x50
do_syscall_64+0x42/0xb0
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fb3a5c9143b
Code: ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 90 f3 0f 1e fa 31 f6
e9 05 00 00 00 0f 1f 44 00 00 f3 0f 1e fa b8 a6 00 00 00 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe801d8e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fb3a5c9143b
RDX: 00007fb3a5c28a90 RSI: 000000000000000a RDI: 00007ffe801d8f30
RBP: 00007ffe801d8f30 R08: 00007fb3a5cfba1f R09: 00007ffe801d8cf0
R10: 00000000fffffffb R11: 0000000000000246 R12: 00007fb3a5cfb9f8
R13: 00007ffe801d9fd0 R14: 0000555557244d90 R15: 0000000000000032
</TASK>
==================================================================