From: Mathias Krause <minipli@grsecurity.net>
To: Steven Rostedt <rostedt@goodmis.org>,
Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathias Krause <minipli@grsecurity.net>,
Mathieu Desnoyers <mathieu.desnoyers@efficios.com>,
linux-trace-kernel@vger.kernel.org, linux-kernel@vger.kernel.org,
Dan Carpenter <dan.carpenter@linaro.org>,
Ajay Kaher <ajay.kaher@broadcom.com>
Subject: [PATCH] eventfs: Don't return NULL in eventfs_create_dir()
Date: Tue, 23 Jul 2024 14:25:21 +0200 [thread overview]
Message-ID: <20240723122522.2724-1-minipli@grsecurity.net> (raw)
In-Reply-To: <20240722201125.3fa6314b@gandalf.local.home>
Commit 77a06c33a22d ("eventfs: Test for ei->is_freed when accessing
ei->dentry") added another check, testing if the parent was freed after
we released the mutex. If so, the function returns NULL. However, all
callers expect it to either return a valid pointer or an error pointer,
at least since commit 5264a2f4bb3b ("tracing: Fix a NULL vs IS_ERR() bug
in event_subsystem_dir()"). Returning NULL will therefore fail the error
condition check in the caller.
Fix this by substituting the NULL return value with a fitting error
pointer.
Fixes: 77a06c33a22d ("eventfs: Test for ei->is_freed when accessing ei->dentry")
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Ajay Kaher <ajay.kaher@broadcom.com>
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
---
v2: send as a separate patch, picking up review tags from Dan and Ajay
fs/tracefs/event_inode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c
index 5d88c184f0fc..a9c28a1d5dc8 100644
--- a/fs/tracefs/event_inode.c
+++ b/fs/tracefs/event_inode.c
@@ -736,7 +736,7 @@ struct eventfs_inode *eventfs_create_dir(const char *name, struct eventfs_inode
/* Was the parent freed? */
if (list_empty(&ei->list)) {
cleanup_ei(ei);
- ei = NULL;
+ ei = ERR_PTR(-EBUSY);
}
return ei;
}
--
2.43.0
next prev parent reply other threads:[~2024-07-23 12:25 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-07-19 20:47 tracing: user events UAF crash report Mathias Krause
2024-07-20 3:33 ` Dan Carpenter
2024-07-22 11:13 ` Ajay Kaher
2024-07-22 12:08 ` Mathias Krause
2024-07-25 13:33 ` Ajay Kaher
2024-07-25 16:15 ` Ajay Kaher
2024-07-25 16:30 ` Ajay Kaher
2024-07-25 17:10 ` Steven Rostedt
2024-07-25 17:16 ` Steven Rostedt
2024-07-25 18:12 ` Mathias Krause
2024-07-25 19:05 ` Steven Rostedt
2024-07-25 19:42 ` Mathias Krause
2024-07-25 20:15 ` Steven Rostedt
2024-07-25 20:41 ` Mathias Krause
2024-07-25 21:14 ` Steven Rostedt
2024-07-25 21:32 ` Mathias Krause
2024-07-25 23:06 ` Steven Rostedt
2024-07-26 8:25 ` Mathias Krause
2024-07-25 19:53 ` Mathias Krause
2024-07-25 16:48 ` Steven Rostedt
2024-07-23 0:11 ` Steven Rostedt
2024-07-23 12:25 ` Mathias Krause [this message]
2024-07-23 14:43 ` Steven Rostedt
2024-07-23 20:54 ` Mathias Krause
2024-07-23 21:07 ` [PATCH] eventfs: Use SRCU for freeing eventfs_inodes Mathias Krause
2024-07-23 21:23 ` Steven Rostedt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240723122522.2724-1-minipli@grsecurity.net \
--to=minipli@grsecurity.net \
--cc=ajay.kaher@broadcom.com \
--cc=dan.carpenter@linaro.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=mathieu.desnoyers@efficios.com \
--cc=mhiramat@kernel.org \
--cc=rostedt@goodmis.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).