[PATCH 2/2] debugfs: Fix crash problem caused by accessing uninitialized nodes

[PATCH 2/2] debugfs: Fix crash problem caused by accessing uninitialized nodes

[Yibin Ding]

From: Yibin Ding <Yibin.ding@unisoc.com>

For uninitialized nodes such as
/sys/kernel/debug/interconnect/test_client/dst_node, if the cat operation
is performed directly without writing content to the node, it will cause
a crash due to accessing a null pointer. So it is necessary to add a null
pointer check in the debugfs_read_file_str() function.

Signed-off-by: Yibin Ding <Yibin.ding@unisoc.com>
---
 fs/debugfs/file.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index c6f4a9a98b85..8bbe7df6dfd1 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -970,6 +970,10 @@ ssize_t debugfs_read_file_str(struct file *file, char __user *user_buf,
 		return ret;
 
 	str = *(char **)file->private_data;
+	if (!str) {
+		debugfs_file_put(dentry);
+		return -EINVAL;
+	}
 	len = strlen(str) + 1;
 	copy = kmalloc(len, GFP_KERNEL);
 	if (!copy) {
-- 
2.25.1

Re: [PATCH 2/2] debugfs: Fix crash problem caused by accessing uninitialized nodes

[Greg KH]

On Fri, Aug 30, 2024 at 06:23:14PM +0800, Yibin Ding wrote:
> From: Yibin Ding <Yibin.ding@unisoc.com>
> 
> For uninitialized nodes such as
> /sys/kernel/debug/interconnect/test_client/dst_node, if the cat operation
> is performed directly without writing content to the node, it will cause
> a crash due to accessing a null pointer. So it is necessary to add a null
> pointer check in the debugfs_read_file_str() function.
> 
> Signed-off-by: Yibin Ding <Yibin.ding@unisoc.com>
> ---
>  fs/debugfs/file.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
> index c6f4a9a98b85..8bbe7df6dfd1 100644
> --- a/fs/debugfs/file.c
> +++ b/fs/debugfs/file.c
> @@ -970,6 +970,10 @@ ssize_t debugfs_read_file_str(struct file *file, char __user *user_buf,
>  		return ret;
>  
>  	str = *(char **)file->private_data;
> +	if (!str) {
> +		debugfs_file_put(dentry);
> +		return -EINVAL;
> +	}

How can private_data be NULL now with patch 1 in this series?  I guess
the allocation could fail, but really, how can it?

thanks,

greg k-h