[PATCH] devtmpfs: move NULLing the thread pointer before unregistering fs

Alexander Atanasov
2022-12-02T12:45:43Z

In commit
31c779f293b3 ("devtmpfs: fix the dangling pointer of global devtmpfsd thread")
a dangling pointer on an error condition was fixed. But the fix
left the dangling pointer during unregister_filesystem and printk calls.
Improve the fix to clear the pointer before unregistration to close
the window where the dangling pointer can be potentially used.
Make it clear the pointer at only one place in the function.

Signed-off-by: Alexander Atanasov <alexander.atanasov@virtuozzo.com>
---
drivers/base/devtmpfs.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c
index e4bffeabf344..773e66ef5642 100644
--- a/drivers/base/devtmpfs.c
+++ b/drivers/base/devtmpfs.c
@@ -472,17 +472,15 @@ int __init devtmpfs_init(void)
}

thread = kthread_run(devtmpfsd, &err, "kdevtmpfs");
- if (!IS_ERR(thread)) {
+ if (!IS_ERR(thread))
wait_for_completion(&setup_done);
- } else {
+ else
err = PTR_ERR(thread);
- thread = NULL;
- }

if (err) {
+ thread = NULL;
printk(KERN_ERR "devtmpfs: unable to create devtmpfs %i\n", err);
unregister_filesystem(&dev_fs_type);
- thread = NULL;
return err;
}

base-commit: b7b275e60bcd5f89771e865a8239325f86d9927d
--
2.31.1