__build_id_parse() only works on page-backed storage. Its helper paths eventually call mapping->a_ops->read_folio(), so explicitly reject VMAs that do not map a regular file or lack valid address_space operations. Reported-by: syzbot+e008db2ac01e282550ee@syzkaller.appspotmail.com Signed-off-by: Jinchao Wang --- lib/buildid.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/buildid.c b/lib/buildid.c index aaf61dfc0919..7131594cb071 100644 --- a/lib/buildid.c +++ b/lib/buildid.c @@ -280,7 +280,10 @@ static int __build_id_parse(struct vm_area_struct *vma, unsigned char *build_id, int ret; /* only works for page backed storage */ - if (!vma->vm_file) + if (!vma->vm_file || + !S_ISREG(file_inode(vma->vm_file)->i_mode) || + !vma->vm_file->f_mapping->a_ops || + !vma->vm_file->f_mapping->a_ops->read_folio) return -EINVAL; freader_init_from_file(&r, buf, sizeof(buf), vma->vm_file, may_fault); -- 2.43.0