From: Gui-Dong Han <hanguidong02@gmail.com>
To: gregkh@linuxfoundation.org, dakr@kernel.org, rafael@kernel.org
Cc: linux-kernel@vger.kernel.org, driver-core@lists.linux.dev,
intel-gfx@lists.freedesktop.org, intel-xe@lists.freedesktop.org,
dri-devel@lists.freedesktop.org, linux-sound@vger.kernel.org,
akaieurus@gmail.com, me@ziyao.cc,
Gui-Dong Han <hanguidong02@gmail.com>
Subject: [PATCH 0/4] debugfs: disallow NULL string creation and fix callers
Date: Wed, 18 Mar 2026 02:59:09 +0800 [thread overview]
Message-ID: <20260317185920.43387-1-hanguidong02@gmail.com> (raw)
A recent bug report [1] highlighted a NULL pointer dereference when
reading a debugfs string file created with a NULL pointer. The community
discussed the issue and agreed that creating string nodes with NULL is
invalid and should be forbidden at creation time [2]. Since no fix was
submitted following the discussion, I have implemented the agreed
solution.
Patch 1 modifies debugfs_create_str() to reject NULL pointers, returning
early and triggering a WARN_ON to expose offending callers.
Patch 2 is a code hygiene fix. While modifying the file, I noticed the
EXPORT_SYMBOL_GPL for debugfs_create_str() was misplaced far away from
the function body. This patch moves it to the correct location.
I carefully audited existing callers across the kernel tree. Some
drivers passing NULL have already been independently identified and
fixed [3]. The remaining two subsystems (soundwire and drm/i915) are
addressed in patches 3 and 4 by initializing their respective string
parameters to empty strings (""). The existing logic in both subsystems
correctly and safely handles empty strings.
[1] https://lore.kernel.org/lkml/17647e4c.d461.19b46144a4e.Coremail.yangshiguang1011@163.com/
[2] https://lore.kernel.org/lkml/2025122221-gag-malt-75ba@gregkh/
[3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8cc27f5c6dd1
Gui-Dong Han (4):
debugfs: check for NULL pointer in debugfs_create_str()
debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()
soundwire: debugfs: initialize firmware_file to empty string
drm/i915/display: initialize string params to empty strings
drivers/gpu/drm/i915/display/intel_display_params.h | 4 ++--
drivers/soundwire/debugfs.c | 5 +++--
fs/debugfs/file.c | 7 +++++--
3 files changed, 10 insertions(+), 6 deletions(-)
--
2.43.0
next reply other threads:[~2026-03-23 16:06 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-17 18:59 Gui-Dong Han [this message]
2026-03-17 18:59 ` [PATCH 1/4] debugfs: check for NULL pointer in debugfs_create_str() Gui-Dong Han
2026-03-17 18:59 ` [PATCH 2/4] debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() Gui-Dong Han
2026-03-17 19:10 ` [PATCH 3/4] soundwire: debugfs: initialize firmware_file to empty string Gui-Dong Han
2026-03-18 4:14 ` Gui-Dong Han
2026-03-17 19:15 ` [PATCH 4/4] drm/i915/display: initialize string params to empty strings Gui-Dong Han
2026-03-17 20:12 ` Jani Nikula
2026-03-18 1:53 ` Gui-Dong Han
2026-03-18 8:32 ` Jani Nikula
2026-03-18 8:47 ` Gui-Dong Han
2026-03-23 16:13 ` ✗ LGCI.VerificationFailed: failure for debugfs: disallow NULL string creation and fix callers Patchwork
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260317185920.43387-1-hanguidong02@gmail.com \
--to=hanguidong02@gmail.com \
--cc=akaieurus@gmail.com \
--cc=dakr@kernel.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=driver-core@lists.linux.dev \
--cc=gregkh@linuxfoundation.org \
--cc=intel-gfx@lists.freedesktop.org \
--cc=intel-xe@lists.freedesktop.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sound@vger.kernel.org \
--cc=me@ziyao.cc \
--cc=rafael@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox