Re: tracing: user events UAF crash report
From: Steven Rostedt <rostedt@goodmis.org>
Date: 2024-07-23 00:11:12
Also in:
lkml
On Fri, 19 Jul 2024 22:47:01 +0200 Mathias Krause [off-list ref] wrote:
Subject: [PATCH] eventfs: Don't return NULL in eventfs_create_dir()
Commit 77a06c33a22d ("eventfs: Test for ei->is_freed when accessing
ei->dentry") added another check, testing if the parent was freed after
we released the mutex. If so, the function returns NULL. However, all
callers expect it to either return a valid pointer or an error pointer,
at least since commit 5264a2f4bb3b ("tracing: Fix a NULL vs IS_ERR() bug
in event_subsystem_dir()"). Returning NULL will therefore fail the error
condition check in the caller.
Fix this by substituting the NULL return value with a fitting error
pointer.
Fixes: 77a06c33a22d ("eventfs: Test for ei->is_freed when accessing ei->dentry")
Cc: Dan Carpenter <redacted>
Signed-off-by: Mathias Krause <redacted>This will not get into the workflow without being sent as a normal patch. Please send it and Cc those listed in MAINTAINERS (see get_maintainers.pl). -- Steve
quoted hunk ↗ jump to hunk
--- fs/tracefs/event_inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c index 5d88c184f0fc..a9c28a1d5dc8 100644 --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c@@ -736,7 +736,7 @@ struct eventfs_inode *eventfs_create_dir(const char *name, struct eventfs_inode /* Was the parent freed? */ if (list_empty(&ei->list)) { cleanup_ei(ei); - ei = NULL; + ei = ERR_PTR(-EBUSY); } return ei;