All of lore.kernel.org
 help / color / mirror / Atom feed
From: Mathias Krause <minipli@grsecurity.net>
To: Steven Rostedt <rostedt@goodmis.org>,
	Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathias Krause <minipli@grsecurity.net>,
	Mathieu Desnoyers <mathieu.desnoyers@efficios.com>,
	linux-trace-kernel@vger.kernel.org, linux-kernel@vger.kernel.org,
	Dan Carpenter <dan.carpenter@linaro.org>,
	Ajay Kaher <ajay.kaher@broadcom.com>
Subject: [PATCH] eventfs: Don't return NULL in eventfs_create_dir()
Date: Tue, 23 Jul 2024 14:25:21 +0200	[thread overview]
Message-ID: <20240723122522.2724-1-minipli@grsecurity.net> (raw)
In-Reply-To: <20240722201125.3fa6314b@gandalf.local.home>

Commit 77a06c33a22d ("eventfs: Test for ei->is_freed when accessing
ei->dentry") added another check, testing if the parent was freed after
we released the mutex. If so, the function returns NULL. However, all
callers expect it to either return a valid pointer or an error pointer,
at least since commit 5264a2f4bb3b ("tracing: Fix a NULL vs IS_ERR() bug
in event_subsystem_dir()"). Returning NULL will therefore fail the error
condition check in the caller.

Fix this by substituting the NULL return value with a fitting error
pointer.

Fixes: 77a06c33a22d ("eventfs: Test for ei->is_freed when accessing ei->dentry")
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Ajay Kaher <ajay.kaher@broadcom.com>
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
---
v2: send as a separate patch, picking up review tags from Dan and Ajay

 fs/tracefs/event_inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c
index 5d88c184f0fc..a9c28a1d5dc8 100644
--- a/fs/tracefs/event_inode.c
+++ b/fs/tracefs/event_inode.c
@@ -736,7 +736,7 @@ struct eventfs_inode *eventfs_create_dir(const char *name, struct eventfs_inode
 	/* Was the parent freed? */
 	if (list_empty(&ei->list)) {
 		cleanup_ei(ei);
-		ei = NULL;
+		ei = ERR_PTR(-EBUSY);
 	}
 	return ei;
 }
-- 
2.43.0


  reply	other threads:[~2024-07-23 12:25 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-07-19 20:47 tracing: user events UAF crash report Mathias Krause
2024-07-20  3:33 ` Dan Carpenter
2024-07-22 11:13 ` Ajay Kaher
2024-07-22 12:08   ` Mathias Krause
2024-07-25 13:33     ` Ajay Kaher
2024-07-25 16:15       ` Ajay Kaher
2024-07-25 16:30         ` Ajay Kaher
2024-07-25 17:10           ` Steven Rostedt
2024-07-25 17:16             ` Steven Rostedt
2024-07-25 18:12               ` Mathias Krause
2024-07-25 19:05                 ` Steven Rostedt
2024-07-25 19:42                   ` Mathias Krause
2024-07-25 20:15                     ` Steven Rostedt
2024-07-25 20:41                       ` Mathias Krause
2024-07-25 21:14                         ` Steven Rostedt
2024-07-25 21:32                           ` Mathias Krause
2024-07-25 23:06                             ` Steven Rostedt
2024-07-26  8:25                               ` Mathias Krause
2024-07-25 19:53                   ` Mathias Krause
2024-07-25 16:48         ` Steven Rostedt
2024-07-23  0:11 ` Steven Rostedt
2024-07-23 12:25   ` Mathias Krause [this message]
2024-07-23 14:43 ` Steven Rostedt
2024-07-23 20:54   ` Mathias Krause
2024-07-23 21:07   ` [PATCH] eventfs: Use SRCU for freeing eventfs_inodes Mathias Krause
2024-07-23 21:23     ` Steven Rostedt

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240723122522.2724-1-minipli@grsecurity.net \
    --to=minipli@grsecurity.net \
    --cc=ajay.kaher@broadcom.com \
    --cc=dan.carpenter@linaro.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-trace-kernel@vger.kernel.org \
    --cc=mathieu.desnoyers@efficios.com \
    --cc=mhiramat@kernel.org \
    --cc=rostedt@goodmis.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.