linux-kernel - [PATCH] relay: avoid relay_open_buf inproperly fails in buffer-only mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 20 Feb 2024 18:58:36 +0800
From: Philo Lu <lulie@...ux.alibaba.com>
To: linux-kernel@...r.kernel.org
Cc: akpm@...ux-foundation.org,
	zhou.kete@....com,
	zhao_lei1@...erun.com,
	nabijaczleweli@...ijaczleweli.xyz,
	kunyu@...china.com,
	zhang.zhengming@....com,
	gregkh@...uxfoundation.org,
	xuanzhuo@...ux.alibaba.com,
	dust.li@...ux.alibaba.com,
	alibuda@...ux.alibaba.com,
	guwen@...ux.alibaba.com,
	hengqi@...ux.alibaba.com
Subject: [PATCH] relay: avoid relay_open_buf inproperly fails in buffer-only mode

In buffer-only mode, relay_open(NULL, NULL, ...) is used to create the
buffer first, where chan->has_base_filename is not set. Though we still
need to call chan->cb->create_buf_file in relay_open_buf() to retrieve
global info for global buffer, the create_buf_file callback should
return NULL. However, with IS_ERR_OR_NULL() checking, relay_open fails
because the returned dentry == NULL.

This patch remove the IS_ERR_OR_NULL() for compatibility and update the
comment to explain the behavior.

Here is a create_buf_file callback example after fix:
```
struct dentry *my_create_buf_file(const char *filename,
            struct dentry *parent, umode_t mode,
            struct rchan_buf *buf, int *is_global)
{
    if (!filename)
        return NULL;

    return debugfs_create_file(filename, mode, parent, buf,
                &relay_file_operations);
}

relay_cb.create_buf_file = my_create_buf_file
relay_chan = relay_open(NULL, NULL,
                    subbuf_size, subbuf_num,
                    &relay_cb, NULL);
relay_late_setup_files(relay_chan, filename, parent);
```

But before fix, the callback must be something like:
```
struct dentry *my_create_buf_file(const char *filename,
            struct dentry *parent, umode_t mode,
            struct rchan_buf *buf, int *is_global)
{
    if (!filename)
        return ERR_PTR(1); // a valid ptr is necessary for relay_open

    return debugfs_create_file(filename, mode, parent, buf,
                &relay_file_operations);
}
```

Fixes: 2c1cf00eeacb ("relay: check return of create_buf_file() properly")
Signed-off-by: Philo Lu <lulie@...ux.alibaba.com>
---
 kernel/relay.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/kernel/relay.c b/kernel/relay.c
index a8e90e98bf2c..0d8b8325530a 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -391,12 +391,13 @@ static struct rchan_buf *relay_open_buf(struct rchan *chan, unsigned int cpu)
 			goto free_buf;
 		relay_set_buf_dentry(buf, dentry);
 	} else {
-		/* Only retrieve global info, nothing more, nothing less */
+		/* In buffer-only mode, relay_open_buf is called with
+		 * filename=NULL, but create_buf_file is still needed to
+		 * retrieve is_global info. So dentry should be NULL here.
+		 */
 		dentry = chan->cb->create_buf_file(NULL, NULL,
 						   S_IRUSR, buf,
 						   &chan->is_global);
-		if (IS_ERR_OR_NULL(dentry))
-			goto free_buf;
 	}
 
  	buf->cpu = cpu;
-- 
2.32.0.3.g01195cf9f