From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 47CDA3D05F5; Sat, 28 Feb 2026 17:40:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772300419; cv=none; b=H4p8ZtJX9YrpOri6wPycxiXa00EOSASU2HdDtbaz1yuee5MYnPy8P10BmvB56QXWcDy9ES2QwccBQkVtJxnpANX663fk/UsstIGO3btFOiLEIpfl+VnABtVsovBtQR7I9qbAvbTaqjJklGr6flaoP5+YyBRsRM/YynVG5VvOkh8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772300419; c=relaxed/simple; bh=Q8SaXWL93odJG0thtYeuDo3S//j8M8ja3rclt+aW2gE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Swu1DiLp+TPeV3pEhHZ/PF7LV/1r6oi9XkYrWRWn4jQMTjugzYQ6TAXWVIvfoaVnkyD1HrU2XbBI088hvpkPK2nPDyXsLsRkM+cOhylY6grEJNNSfXbSOztaETjJNxZWqv/4Ht7NfO+3pu75/TR88ZY6gF6brGEDX80DJJUXt8c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=KgILu77i; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="KgILu77i" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 941FCC19425; Sat, 28 Feb 2026 17:40:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1772300419; bh=Q8SaXWL93odJG0thtYeuDo3S//j8M8ja3rclt+aW2gE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KgILu77iEPCruMcv2g/txsGihyz6qbXM2c/VCLLgFYJGacq8V3tT3VSI1YGNdCaHy 9yV7fBROcadhkC5mMzJgYd6fMq8wMbookQVhDY4Iu9b5bz5ens3x/AIZVRH39ylVDv 8m1jHzixt3x8iq7YdRBpKg55SS2HF70w/cBdOqwjVeLXsy85Jyye9cqYi9IyysvwS5 fJbarVLKiRXo+rxjYt1ks//Te3SbQRnq0J0h4BUuFKqM24zd2Ln1BoNzMfY85CuVEk doKhn1EqxXUQfD2wuyKiPU+2IqiIiabiKUQRmsJA3OhfPnIwWWCg4vzwraGZv2qzNI dXce6AL3nJM7A== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Ethan Tidmore , Christian Brauner , Sasha Levin Subject: [PATCH 6.19 457/844] proc: Fix pointer error dereference Date: Sat, 28 Feb 2026 12:26:10 -0500 Message-ID: <20260228173244.1509663-458-sashal@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260228173244.1509663-1-sashal@kernel.org> References: <20260228173244.1509663-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit From: Ethan Tidmore [ Upstream commit f6a495484a27150fb85f943e1a7464da88c2a797 ] The function try_lookup_noperm() can return an error pointer. Add check for error pointer. Detected by Smatch: fs/proc/base.c:2148 proc_fill_cache() error: 'child' dereferencing possible ERR_PTR() Fixes: 1df98b8bbcca ("proc_fill_cache(): clean up, get rid of pointless find_inode_number() use") Signed-off-by: Ethan Tidmore Link: https://patch.msgid.link/20260219221001.1117135-1-ethantidmore06@gmail.com Signed-off-by: Christian Brauner Signed-off-by: Sasha Levin --- fs/proc/base.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/proc/base.c b/fs/proc/base.c index 4eec684baca9f..4c863d17dfb4c 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2128,6 +2128,9 @@ bool proc_fill_cache(struct file *file, struct dir_context *ctx, ino_t ino = 1; child = try_lookup_noperm(&qname, dir); + if (IS_ERR(child)) + goto end_instantiate; + if (!child) { DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq); child = d_alloc_parallel(dir, &qname, &wq); -- 2.51.0