All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Eiichi Tsukata <devel@etsukata.com>,
	"Darrick J. Wong" <darrick.wong@oracle.com>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.9 27/39] xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init
Date: Mon, 24 Aug 2020 10:31:26 +0200	[thread overview]
Message-ID: <20200824082349.928063821@linuxfoundation.org> (raw)
In-Reply-To: <20200824082348.445866152@linuxfoundation.org>

From: Eiichi Tsukata <devel@etsukata.com>

[ Upstream commit 96cf2a2c75567ff56195fe3126d497a2e7e4379f ]

If xfs_sysfs_init is called with parent_kobj == NULL, UBSAN
shows the following warning:

  UBSAN: null-ptr-deref in ./fs/xfs/xfs_sysfs.h:37:23
  member access within null pointer of type 'struct xfs_kobj'
  Call Trace:
   dump_stack+0x10e/0x195
   ubsan_type_mismatch_common+0x241/0x280
   __ubsan_handle_type_mismatch_v1+0x32/0x40
   init_xfs_fs+0x12b/0x28f
   do_one_initcall+0xdd/0x1d0
   do_initcall_level+0x151/0x1b6
   do_initcalls+0x50/0x8f
   do_basic_setup+0x29/0x2b
   kernel_init_freeable+0x19f/0x20b
   kernel_init+0x11/0x1e0
   ret_from_fork+0x22/0x30

Fix it by checking parent_kobj before the code accesses its member.

Signed-off-by: Eiichi Tsukata <devel@etsukata.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
[darrick: minor whitespace edits]
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/xfs_sysfs.h | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/xfs/xfs_sysfs.h b/fs/xfs/xfs_sysfs.h
index d04637181ef21..980c9429abec5 100644
--- a/fs/xfs/xfs_sysfs.h
+++ b/fs/xfs/xfs_sysfs.h
@@ -44,9 +44,11 @@ xfs_sysfs_init(
 	struct xfs_kobj		*parent_kobj,
 	const char		*name)
 {
+	struct kobject		*parent;
+
+	parent = parent_kobj ? &parent_kobj->kobject : NULL;
 	init_completion(&kobj->complete);
-	return kobject_init_and_add(&kobj->kobject, ktype,
-				    &parent_kobj->kobject, "%s", name);
+	return kobject_init_and_add(&kobj->kobject, ktype, parent, "%s", name);
 }
 
 static inline void
-- 
2.25.1




  parent reply	other threads:[~2020-08-24  9:27 UTC|newest]

Thread overview: 43+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-08-24  8:30 [PATCH 4.9 00/39] 4.9.234-rc1 review Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 01/39] x86/asm: Remove unnecessary \n\t in front of CC_SET() from asm templates Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 02/39] x86/asm: Add instruction suffixes to bitops Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 03/39] drm/imx: imx-ldb: Disable both channels for split mode in enc->disable() Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 04/39] perf probe: Fix memory leakage when the probe point is not found Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 05/39] tracing: Clean up the hwlat binding code Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 06/39] tracing/hwlat: Honor the tracing_cpumask Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 07/39] khugepaged: khugepaged_test_exit() check mmget_still_valid() Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 08/39] khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter() Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 09/39] btrfs: export helpers for subvolume name/id resolution Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 10/39] btrfs: dont show full path of bind mounts in subvol= Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 11/39] romfs: fix uninitialized memory leak in romfs_dev_read() Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 12/39] kernel/relay.c: fix memleak on destroy relay channel Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 13/39] mm: include CMA pages in lowmem_reserve at boot Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 14/39] mm, page_alloc: fix core hung in free_pcppages_bulk() Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 15/39] jbd2: add the missing unlock_buffer() in the error path of jbd2_write_superblock() Greg Kroah-Hartman
2020-08-24 11:15   ` zhangyi (F)
2020-08-24 15:38     ` Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 16/39] ext4: clean up ext4_match() and callers Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 17/39] ext4: fix checking of directory entry validity for inline directories Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 18/39] scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 19/39] media: budget-core: Improve exception handling in budget_register() Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 20/39] media: vpss: clean up resources in init Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 21/39] Input: psmouse - add a newline when printing proto by sysfs Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 22/39] m68knommu: fix overwriting of bits in ColdFire V3 cache control Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 23/39] xfs: fix inode quota reservation checks Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 24/39] jffs2: fix UAF problem Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 25/39] scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 26/39] virtio_ring: Avoid loop when vq is broken in virtqueue_poll Greg Kroah-Hartman
2020-08-24  8:31 ` Greg Kroah-Hartman [this message]
2020-08-24  8:31 ` [PATCH 4.9 28/39] alpha: fix annotation of io{read,write}{16,32}be() Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 29/39] ext4: fix potential negative array index in do_split() Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 30/39] i40e: Set RX_ONLY mode for unicast promiscuous on VLAN Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 31/39] net: fec: correct the error path for regulator disable in probe Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 32/39] ASoC: intel: Fix memleak in sst_media_open Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 33/39] net: dsa: b53: check for timeout Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 34/39] powerpc/pseries: Do not initiate shutdown when system is running on UPS Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 35/39] powerpc: Allow 4224 bytes of stack expansion for the signal frame Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 36/39] epoll: Keep a reference on files added to the check list Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 37/39] do_epoll_ctl(): clean the failure exits up a bit Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 38/39] mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible Greg Kroah-Hartman
2020-08-24  8:31 ` [PATCH 4.9 39/39] xen: dont reschedule in preemption off sections Greg Kroah-Hartman
2020-08-24 10:16 ` [PATCH 4.9 00/39] 4.9.234-rc1 review Jon Hunter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200824082349.928063821@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=darrick.wong@oracle.com \
    --cc=devel@etsukata.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.