Re: [PATCH] debugfs: Fix NULL pointer dereference at debugfs_read_file_str

[Greg KH <gregkh@linuxfoundation.org>]

On Mon, Dec 22, 2025 at 05:36:16PM +0800, yangshiguang1011@163.com wrote:
> From: yangshiguang <yangshiguang@xiaomi.com>
> 
> Check in debugfs_read_file_str() if the string pointer is NULL.
> 
> When creating a node using debugfs_create_str(), the string parameter
> value can be NULL to indicate empty/unused/ignored.

Why would you create an empty debugfs string file?  That is not ok, we
should change that to not allow this.

> However, reading this node using debugfs_read_file_str() will cause a
> kernel panic.
> This should not be fatal, so return an invalid error.
> 
> Signed-off-by: yangshiguang <yangshiguang@xiaomi.com>
> Fixes: 9af0440ec86e ("debugfs: Implement debugfs_create_str()")
> Cc: stable@vger.kernel.org
> ---
>  fs/debugfs/file.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
> index 3ec3324c2060..a22ff0ceb230 100644
> --- a/fs/debugfs/file.c
> +++ b/fs/debugfs/file.c
> @@ -1026,6 +1026,9 @@ ssize_t debugfs_read_file_str(struct file *file, char __user *user_buf,
>  		return ret;
>  
>  	str = *(char **)file->private_data;
> +	if (!str)
> +		return -EINVAL;

What in kernel user causes this to happen?  Let's fix that up instead
please.

thanks,

greg k-h