Re: [syzbot ci] Re: rust: zpool: add API for C and Rust

[Vitaly Wool <vitaly.wool@konsulko.se>]

On 9/23/25 23:59, Johannes Weiner wrote:
> On Tue, Sep 23, 2025 at 09:50:10AM -0700, syzbot ci wrote:
>> syzbot ci has tested the following series
>>
>> [v6] rust: zpool: add API for C and Rust
>> https://lore.kernel.org/all/20250923102547.2545992-1-vitaly.wool@konsulko.se
>> * [PATCH v6 1/2] mm: reinstate zpool as a thin API
>> * [PATCH v6 2/2] rust: zpool: add abstraction for zpool drivers
>>
>> and found the following issues:
>> * BUG: unable to handle kernel NULL pointer dereference in zswap_store
>> * KASAN: slab-out-of-bounds Read in zpool_get_total_pages
>> * KASAN: slab-out-of-bounds Read in zswap_store
>> * KASAN: slab-use-after-free Read in zpool_get_total_pages
>> * KASAN: use-after-free Read in zpool_get_total_pages
>>
>> Full report is available here:
>> https://ci.syzbot.org/series/e8b22352-ae56-4d7c-9113-75573acf2b64
>>
>> ***
>>
>> BUG: unable to handle kernel NULL pointer dereference in zswap_store
> 
> struct zpool {
> 	void *pool;
> };
> 
> struct zpool *zpool_create_pool(const char *name) \
> { \
> 	return (struct zpool *) prefix ## _create_pool(name); \
> } \
> 
> u64 zpool_get_total_pages(struct zpool *zpool) \
> { \
> 	return prefix ## _get_total_pages(zpool->pool); \
> }
> 
> You create the zpool by simply casting the backend pool, but then you
> deref it twice as if it were an actual container for the backend pool.
> 
> I'm guessing you didn't test this even superficially?

LOL, no, forgot to run git commit --amend so came up with a wrong version.

The Rust version is correct though.

> This also still proposes an API with no in-kernel user.

That's not correct, zsmalloc is the user.

~Vitaly