Re: [PATCH 2/8] eventfs: adding eventfs dir add functions

Dan Carpenter
2023-01-23T12:04:24Z

Hi Ajay,

https://git-scm.com/docs/git-format-patch#_base_tree_information]

url: https://github.com/intel-lab-lkp/linux/commits/Ajay-Kaher/eventfs-adding-eventfs-dir-add-functions/20230123-010956
patch link: https://lore.kernel.org/r/1674407228-49109-2-git-send-email-akaher%40vmware.com
patch subject: [PATCH 2/8] eventfs: adding eventfs dir add functions
config: x86_64-randconfig-m001 (https://download.01.org/0day-ci/archive/20230123/202301231023.0ix6JmVM-lkp@intel.com/config)
compiler: gcc-11 (Debian 11.3.0-8) 11.3.0

If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>

smatch warnings:
fs/tracefs/event_inode.c:114 eventfs_add_subsystem_dir() error: dereferencing freed memory 'ef'

vim +/ef +114 fs/tracefs/event_inode.c

db5e58a9349f39 Ajay Kaher 2023-01-22 87 struct eventfs_file *eventfs_add_subsystem_dir(const char *name, struct dentry *parent)
db5e58a9349f39 Ajay Kaher 2023-01-22 88 {
db5e58a9349f39 Ajay Kaher 2023-01-22 89 struct eventfs_file *ef;
db5e58a9349f39 Ajay Kaher 2023-01-22 90 struct tracefs_inode *ti_parent;
db5e58a9349f39 Ajay Kaher 2023-01-22 91 struct eventfs_inode *ei_parent;
db5e58a9349f39 Ajay Kaher 2023-01-22 92
db5e58a9349f39 Ajay Kaher 2023-01-22 93 if (!parent)
db5e58a9349f39 Ajay Kaher 2023-01-22 94 return ERR_PTR(-EINVAL);
db5e58a9349f39 Ajay Kaher 2023-01-22 95
db5e58a9349f39 Ajay Kaher 2023-01-22 96 ti_parent = get_tracefs(parent->d_inode);
db5e58a9349f39 Ajay Kaher 2023-01-22 97 ei_parent = ti_parent->private;
db5e58a9349f39 Ajay Kaher 2023-01-22 98
db5e58a9349f39 Ajay Kaher 2023-01-22 99 ef = kzalloc(sizeof(*ef), GFP_KERNEL);
db5e58a9349f39 Ajay Kaher 2023-01-22 100 if (!ef)
db5e58a9349f39 Ajay Kaher 2023-01-22 101 return ERR_PTR(-ENOMEM);
db5e58a9349f39 Ajay Kaher 2023-01-22 102
db5e58a9349f39 Ajay Kaher 2023-01-22 103 ef->ei = kzalloc(sizeof(*ef->ei), GFP_KERNEL);
db5e58a9349f39 Ajay Kaher 2023-01-22 104 if (!ef->ei) {
db5e58a9349f39 Ajay Kaher 2023-01-22 105 kfree(ef);
db5e58a9349f39 Ajay Kaher 2023-01-22 106 return ERR_PTR(-ENOMEM);
db5e58a9349f39 Ajay Kaher 2023-01-22 107 }
db5e58a9349f39 Ajay Kaher 2023-01-22 108
db5e58a9349f39 Ajay Kaher 2023-01-22 109 INIT_LIST_HEAD(&ef->ei->e_top_files);
db5e58a9349f39 Ajay Kaher 2023-01-22 110
db5e58a9349f39 Ajay Kaher 2023-01-22 111 ef->name = kstrdup(name, GFP_KERNEL);
db5e58a9349f39 Ajay Kaher 2023-01-22 112 if (!ef->name) {
db5e58a9349f39 Ajay Kaher 2023-01-22 113 kfree(ef);
db5e58a9349f39 Ajay Kaher 2023-01-22 @114 kfree(ef->ei);

kfree(ef->ei); first to avoid a use after free.

db5e58a9349f39 Ajay Kaher 2023-01-22 115 return ERR_PTR(-ENOMEM);
db5e58a9349f39 Ajay Kaher 2023-01-22 116 }
db5e58a9349f39 Ajay Kaher 2023-01-22 117
db5e58a9349f39 Ajay Kaher 2023-01-22 118 ef->mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
db5e58a9349f39 Ajay Kaher 2023-01-22 119 ef->iop = &eventfs_root_dir_inode_operations;
db5e58a9349f39 Ajay Kaher 2023-01-22 120 ef->fop = &eventfs_file_operations;
db5e58a9349f39 Ajay Kaher 2023-01-22 121 ef->dentry = NULL;
db5e58a9349f39 Ajay Kaher 2023-01-22 122 ef->created = false;
db5e58a9349f39 Ajay Kaher 2023-01-22 123 ef->d_parent = parent;
db5e58a9349f39 Ajay Kaher 2023-01-22 124
db5e58a9349f39 Ajay Kaher 2023-01-22 125 list_add_tail(&ef->list, &ei_parent->e_top_files);
db5e58a9349f39 Ajay Kaher 2023-01-22 126 return ef;
db5e58a9349f39 Ajay Kaher 2023-01-22 127 }

--
0-DAY CI Kernel Test Service