linux-kernel - Re: [PATCH 2/2] debugfs: Fix crash problem caused by accessing uninitialized nodes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2024083023-unblended-poise-ab28@gregkh>
Date: Fri, 30 Aug 2024 12:35:59 +0200
From: Greg KH <gregkh@...uxfoundation.org>
To: Yibin Ding <Yibin.Ding@...soc.com>
Cc: djakov@...nel.org, rafael@...nel.org, yibin.ding01@...il.com,
	niuzhiguo84@...il.com, linux-pm@...r.kernel.org,
	linux-kernel@...r.kernel.org, Hao_hao.Wang@...soc.com,
	Ke.Wang@...soc.com
Subject: Re: [PATCH 2/2] debugfs: Fix crash problem caused by accessing
 uninitialized nodes

On Fri, Aug 30, 2024 at 06:23:14PM +0800, Yibin Ding wrote:
> From: Yibin Ding <Yibin.ding@...soc.com>
> 
> For uninitialized nodes such as
> /sys/kernel/debug/interconnect/test_client/dst_node, if the cat operation
> is performed directly without writing content to the node, it will cause
> a crash due to accessing a null pointer. So it is necessary to add a null
> pointer check in the debugfs_read_file_str() function.
> 
> Signed-off-by: Yibin Ding <Yibin.ding@...soc.com>
> ---
>  fs/debugfs/file.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
> index c6f4a9a98b85..8bbe7df6dfd1 100644
> --- a/fs/debugfs/file.c
> +++ b/fs/debugfs/file.c
> @@ -970,6 +970,10 @@ ssize_t debugfs_read_file_str(struct file *file, char __user *user_buf,
>  		return ret;
>  
>  	str = *(char **)file->private_data;
> +	if (!str) {
> +		debugfs_file_put(dentry);
> +		return -EINVAL;
> +	}

How can private_data be NULL now with patch 1 in this series?  I guess
the allocation could fail, but really, how can it?

thanks,

greg k-h