[PATCH] lsm: don't call d_path() when current->fs is NULL
sashiko-bot at kernel.org
sashiko-bot at kernel.org
Mon Oct 19 22:37:05 UTC 2026
> When the last reference to a file is put from exit_task_work(), the task
> has already run exit_fs(), so current->fs is NULL.
>
> syzbot reported:
>
> Unable to handle kernel paging request at virtual address dfff800000000002
> KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
>
> Call trace:
> kasan_mem_to_shadow include/linux/kasan.h:65 [inline] (P)
> kasan_byte_accessible+0xc/0x1c mm/kasan/generic.c:210 (P)
> kasan_check_byte include/linux/kasan.h:402 [inline]
> lock_acquire+0xa4/0x320 kernel/locking/lockdep.c:5916
> seqcount_lockdep_reader_access include/linux/seqlock.h:73 [inline]
> read_seqbegin+0x6c/0x144 include/linux/seqlock.h:838
> [ ... ]
>
> Fixes: 4a9d4b024a31 ("switch fput to task_work_add")
> Reported-by: syzbot+975ace299d6ba2eb1cea at syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=975ace299d6ba2eb1cea
> Signed-off-by: Drif Abdelmalek Mohamed Said <drifabdelmalekmohamedsaid at gmail.com>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261019222858.1766-1-drifabdelmalekmohamedsaid@gmail.com?part=1
More information about the Linux-security-module-archive
mailing list