Skip to contentSkip to conversation

eventfs: Test for dentries array allocated in eventfs_release()

PATCH In review Steven Rostedt 2 participants 2 messages Sep 30, 2023 Tracing

lore
Share & tools
lore

Steven Rostedt

author maintainer
#0 lore raw

PATCH 1/1 eventfs: Test for dentries array allocated in eventfs_release()

From: "Steven Rostedt (Google)" <[email protected]>

The dcache_dir_open_wrapper() could be called when a dynamic event is being deleted leaving a dentry with no children. In this case the dlist->dentries array will never be allocated. This needs to be checked for in eventfs_release(), otherwise it will trigger a NULL pointer dereference.

Fixes ef36b4f92868 ("eventfs: Remember what dentries were created on dir open")
Signed-off-by Steven Rostedt (Google) <[email protected]>
---
 fs/tracefs/event_inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
fs/tracefs/event_inode.c +1 -1
index 5f1714089884..8c8d64e76103 100644
@@ -421,7 +421,7 @@ static int eventfs_release(struct inode *inode, struct file *file)
 	if (WARN_ON_ONCE(!dlist))
 		return -EINVAL;
 
-	for (i = 0; dlist->dentries[i]; i++) {
+	for (i = 0; dlist->dentries && dlist->dentries[i]; i++) {
 		dput(dlist->dentries[i]);
 	}
Signature · 1 line
2.40.1
maintainer Acked-by on v1 1/1
#1 lore raw
Quoted 7 lines · On Sat, 30 Sep 2023 09:01:06 -0400 Steven Rostedt <[email protected]> wrote:

From: "Steven Rostedt (Google)" <[email protected]>

The dcache_dir_open_wrapper() could be called when a dynamic event is being deleted leaving a dentry with no children. In this case the dlist->dentries array will never be allocated. This needs to be checked for in eventfs_release(), otherwise it will trigger a NULL pointer dereference.

Looks good to me.

Acked-by Masami Hiramatsu (Google) <[email protected]>

Thank you,

Quoted 23 lines
Fixes ef36b4f92868 ("eventfs: Remember what dentries were created on dir open")
Signed-off-by Steven Rostedt (Google) <[email protected]>
---
 fs/tracefs/event_inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
fs/tracefs/event_inode.c +1 -1
index 5f1714089884..8c8d64e76103 100644
@@ -421,7 +421,7 @@ static int eventfs_release(struct inode *inode, struct file *file)
 	if (WARN_ON_ONCE(!dlist))
 		return -EINVAL;
 
-	for (i = 0; dlist->dentries[i]; i++) {
+	for (i = 0; dlist->dentries && dlist->dentries[i]; i++) {
 		dput(dlist->dentries[i]);
 	}
Signature · 1 line
2.40.1
Signature · 1 line
Masami Hiramatsu (Google) <[email protected]>