linux-kernel - Re: [PATCH 2/8] eventfs: adding eventfs dir add functions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 23 Jan 2023 15:04:12 +0300
From:   Dan Carpenter <error27@...il.com>
To:     oe-kbuild@...ts.linux.dev, Ajay Kaher <akaher@...are.com>,
        rostedt@...dmis.org, mhiramat@...nel.org
Cc:     lkp@...el.com, oe-kbuild-all@...ts.linux.dev,
        linux-kernel@...r.kernel.org, linux-trace-kernel@...r.kernel.org,
        chinglinyu@...gle.com, namit@...are.com, srivatsab@...are.com,
        srivatsa@...il.mit.edu, amakhalov@...are.com,
        vsirnapalli@...are.com, tkundu@...are.com, er.ajay.kaher@...il.com,
        Ajay Kaher <akaher@...are.com>
Subject: Re: [PATCH 2/8] eventfs: adding eventfs dir add functions

Hi Ajay,

https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Ajay-Kaher/eventfs-adding-eventfs-dir-add-functions/20230123-010956
patch link:    https://lore.kernel.org/r/1674407228-49109-2-git-send-email-akaher%40vmware.com
patch subject: [PATCH 2/8] eventfs: adding eventfs dir add functions
config: x86_64-randconfig-m001 (https://download.01.org/0day-ci/archive/20230123/202301231023.0ix6JmVM-lkp@intel.com/config)
compiler: gcc-11 (Debian 11.3.0-8) 11.3.0

If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@...el.com>
| Reported-by: Dan Carpenter <error27@...il.com>

smatch warnings:
fs/tracefs/event_inode.c:114 eventfs_add_subsystem_dir() error: dereferencing freed memory 'ef'

vim +/ef +114 fs/tracefs/event_inode.c

db5e58a9349f39 Ajay Kaher 2023-01-22   87  struct eventfs_file *eventfs_add_subsystem_dir(const char *name, struct dentry *parent)
db5e58a9349f39 Ajay Kaher 2023-01-22   88  {
db5e58a9349f39 Ajay Kaher 2023-01-22   89  	struct eventfs_file *ef;
db5e58a9349f39 Ajay Kaher 2023-01-22   90  	struct tracefs_inode *ti_parent;
db5e58a9349f39 Ajay Kaher 2023-01-22   91  	struct eventfs_inode *ei_parent;
db5e58a9349f39 Ajay Kaher 2023-01-22   92  
db5e58a9349f39 Ajay Kaher 2023-01-22   93  	if (!parent)
db5e58a9349f39 Ajay Kaher 2023-01-22   94  		return ERR_PTR(-EINVAL);
db5e58a9349f39 Ajay Kaher 2023-01-22   95  
db5e58a9349f39 Ajay Kaher 2023-01-22   96  	ti_parent = get_tracefs(parent->d_inode);
db5e58a9349f39 Ajay Kaher 2023-01-22   97  	ei_parent = ti_parent->private;
db5e58a9349f39 Ajay Kaher 2023-01-22   98  
db5e58a9349f39 Ajay Kaher 2023-01-22   99  	ef = kzalloc(sizeof(*ef), GFP_KERNEL);
db5e58a9349f39 Ajay Kaher 2023-01-22  100  	if (!ef)
db5e58a9349f39 Ajay Kaher 2023-01-22  101  		return ERR_PTR(-ENOMEM);
db5e58a9349f39 Ajay Kaher 2023-01-22  102  
db5e58a9349f39 Ajay Kaher 2023-01-22  103  	ef->ei = kzalloc(sizeof(*ef->ei), GFP_KERNEL);
db5e58a9349f39 Ajay Kaher 2023-01-22  104  	if (!ef->ei) {
db5e58a9349f39 Ajay Kaher 2023-01-22  105  		kfree(ef);
db5e58a9349f39 Ajay Kaher 2023-01-22  106  		return ERR_PTR(-ENOMEM);
db5e58a9349f39 Ajay Kaher 2023-01-22  107  	}
db5e58a9349f39 Ajay Kaher 2023-01-22  108  
db5e58a9349f39 Ajay Kaher 2023-01-22  109  	INIT_LIST_HEAD(&ef->ei->e_top_files);
db5e58a9349f39 Ajay Kaher 2023-01-22  110  
db5e58a9349f39 Ajay Kaher 2023-01-22  111  	ef->name = kstrdup(name, GFP_KERNEL);
db5e58a9349f39 Ajay Kaher 2023-01-22  112  	if (!ef->name) {
db5e58a9349f39 Ajay Kaher 2023-01-22  113  		kfree(ef);
db5e58a9349f39 Ajay Kaher 2023-01-22 @114  		kfree(ef->ei);

kfree(ef->ei); first to avoid a use after free.

db5e58a9349f39 Ajay Kaher 2023-01-22  115  		return ERR_PTR(-ENOMEM);
db5e58a9349f39 Ajay Kaher 2023-01-22  116  	}
db5e58a9349f39 Ajay Kaher 2023-01-22  117  
db5e58a9349f39 Ajay Kaher 2023-01-22  118  	ef->mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
db5e58a9349f39 Ajay Kaher 2023-01-22  119  	ef->iop = &eventfs_root_dir_inode_operations;
db5e58a9349f39 Ajay Kaher 2023-01-22  120  	ef->fop =  &eventfs_file_operations;
db5e58a9349f39 Ajay Kaher 2023-01-22  121  	ef->dentry = NULL;
db5e58a9349f39 Ajay Kaher 2023-01-22  122  	ef->created = false;
db5e58a9349f39 Ajay Kaher 2023-01-22  123  	ef->d_parent = parent;
db5e58a9349f39 Ajay Kaher 2023-01-22  124  
db5e58a9349f39 Ajay Kaher 2023-01-22  125  	list_add_tail(&ef->list, &ei_parent->e_top_files);
db5e58a9349f39 Ajay Kaher 2023-01-22  126  	return ef;
db5e58a9349f39 Ajay Kaher 2023-01-22  127  }

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests