linux-kernel - [PATCH] debugfs: only clean up d_fsdata for d_is

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231109160639.514a2568f1e7.I64fe5615568e87f9ae2d7fb2ac4e5fa96924cb50@changeid>
Date:   Thu,  9 Nov 2023 16:06:40 +0100
From:   Johannes Berg <johannes@...solutions.net>
To:     linux-kernel@...r.kernel.org
Cc:     linux-fsdevel@...r.kernel.org,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "Rafael J. Wysocki" <rafael@...nel.org>,
        Nicolai Stange <nicstange@...il.com>,
        Johannes Berg <johannes.berg@...el.com>
Subject: [PATCH] debugfs: only clean up d_fsdata for d_is_reg()

From: Johannes Berg <johannes.berg@...el.com>

debugfs_create_automount() can store a function pointer in
d_fsdata, and for directories it may be NULL. The commit
7c8d469877b1 ("debugfs: add support for more elaborate
->d_fsdata") ignored that, and while freeing NULL is just
fine, if an automount is ever removed we'd attempt to
kfree() the function pointer. This currently never happens
since the only user (tracing) will never remove the
automount dir.

Later patches changed the logic here again to store the
real fops, and store the allocation only after a debugfs
file reference is obtained via debugfs_file_get().

Remove debugfs_release_dentry() so we won't attempt to
do anything common with the different uses of d_fsdata,
and put the freeing of the allocated data where it's last
possibly used, in __debugfs_file_removed(), which is only
called for regular files.

Also check in debugfs_file_get() that it gets only called
on regular files, just to make things clearer.

Signed-off-by: Johannes Berg <johannes.berg@...el.com>
---
 fs/debugfs/file.c  |  3 +++
 fs/debugfs/inode.c | 14 +++++---------
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index 1f971c880dde..1a20c7db8e11 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -84,6 +84,9 @@ int debugfs_file_get(struct dentry *dentry)
 	struct debugfs_fsdata *fsd;
 	void *d_fsd;
 
+	if (WARN_ON(!d_is_reg(dentry)))
+		return -EINVAL;
+
 	d_fsd = READ_ONCE(dentry->d_fsdata);
 	if (!((unsigned long)d_fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT)) {
 		fsd = d_fsd;
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index 3f81f73c241a..3f00cd40c81d 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -235,14 +235,6 @@ static const struct super_operations debugfs_super_operations = {
 	.free_inode	= debugfs_free_inode,
 };
 
-static void debugfs_release_dentry(struct dentry *dentry)
-{
-	void *fsd = dentry->d_fsdata;
-
-	if (!((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT))
-		kfree(dentry->d_fsdata);
-}
-
 static struct vfsmount *debugfs_automount(struct path *path)
 {
 	debugfs_automount_t f;
@@ -252,7 +244,6 @@ static struct vfsmount *debugfs_automount(struct path *path)
 
 static const struct dentry_operations debugfs_dops = {
 	.d_delete = always_delete_dentry,
-	.d_release = debugfs_release_dentry,
 	.d_automount = debugfs_automount,
 };
 
@@ -734,6 +725,11 @@ static void __debugfs_file_removed(struct dentry *dentry)
 		return;
 	if (!refcount_dec_and_test(&fsd->active_users))
 		wait_for_completion(&fsd->active_users_drained);
+
+	/* this no longer matters */
+	dentry->d_fsdata = NULL;
+
+	kfree(fsd);
 }
 
 static void remove_one(struct dentry *victim)
-- 
2.41.0