drop_buffers() dereferences the buffer_head pointer returned by folio_buffers() without checking for NULL. This leads to a null pointer dereference when called from try_to_free_buffers() on a folio with no buffers attached. This happens when filemap_release_folio() is called on a folio belonging to a mapping with AS_RELEASE_ALWAYS set but without release_folio address_space operation defined. In such case, folio_needs_release() returns true because of AS_RELEASE_ALWAYS flag, the folio has no private buffer data, causing the try_to_free_buffers() with a folio that has no buffers. Adding NULL check for the buffer_head pointer and return false early if no buffers are attached to the folio. Reported-by: syzbot+e07658f51ca22ab65b4e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e07658f51ca22ab65b4e Fixes: 6439476311a6 ("fs: Convert drop_buffers() to use a folio") Signed-off-by: Deepakkumar Karn --- fs/buffer.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/buffer.c b/fs/buffer.c index 838c0c571022..fa5de0cdf540 100644 --- a/fs/buffer.c +++ b/fs/buffer.c @@ -2893,6 +2893,10 @@ drop_buffers(struct folio *folio, struct buffer_head **buffers_to_free) struct buffer_head *head = folio_buffers(folio); struct buffer_head *bh; + /* In cases of folio without buffer_head*/ + if (!head) + return false; + bh = head; do { if (buffer_busy(bh)) -- 2.52.0