| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202512111002.nWtkWQkS-lkp@intel.com>
Date: Thu, 11 Dec 2025 08:44:44 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: oe-kbuild@...ts.linux.dev, Marc Dionne <marc.dionne@...istor.com>
Cc: lkp@...el.com, oe-kbuild-all@...ts.linux.dev,
linux-kernel@...r.kernel.org,
Christian Brauner <brauner@...nel.org>
Subject: fs/cachefiles/namei.c:203 cachefiles_get_directory() warn: passing
zero to 'ERR_PTR'
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 8c8081cc599fcafa25371d50959c17e154f9fd08
commit: 406fad7698f5bf21ab6b5ca195bf4b9e0b3990ed cachefiles: Fix oops in vfs_mkdir from cachefiles_get_directory
config: sparc64-randconfig-r073-20251211 (https://download.01.org/0day-ci/archive/20251211/202512111002.nWtkWQkS-lkp@intel.com/config)
compiler: sparc64-linux-gcc (GCC) 14.3.0
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Reported-by: Dan Carpenter <dan.carpenter@...aro.org>
| Closes: https://lore.kernel.org/r/202512111002.nWtkWQkS-lkp@intel.com/
smatch warnings:
fs/cachefiles/namei.c:203 cachefiles_get_directory() warn: passing zero to 'ERR_PTR'
vim +/ERR_PTR +203 fs/cachefiles/namei.c
32759f7d7af545 David Howells 2021-10-21 84 struct dentry *cachefiles_get_directory(struct cachefiles_cache *cache,
32759f7d7af545 David Howells 2021-10-21 85 struct dentry *dir,
32759f7d7af545 David Howells 2021-10-21 86 const char *dirname,
32759f7d7af545 David Howells 2021-10-21 87 bool *_is_new)
32759f7d7af545 David Howells 2021-10-21 88 {
32759f7d7af545 David Howells 2021-10-21 89 struct dentry *subdir;
32759f7d7af545 David Howells 2021-10-21 90 struct path path;
32759f7d7af545 David Howells 2021-10-21 91 int ret;
32759f7d7af545 David Howells 2021-10-21 92
32759f7d7af545 David Howells 2021-10-21 93 _enter(",,%s", dirname);
32759f7d7af545 David Howells 2021-10-21 94
32759f7d7af545 David Howells 2021-10-21 95 /* search the current directory for the element name */
32759f7d7af545 David Howells 2021-10-21 96 inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
32759f7d7af545 David Howells 2021-10-21 97
32759f7d7af545 David Howells 2021-10-21 98 retry:
32759f7d7af545 David Howells 2021-10-21 99 ret = cachefiles_inject_read_error();
32759f7d7af545 David Howells 2021-10-21 100 if (ret == 0)
32759f7d7af545 David Howells 2021-10-21 101 subdir = lookup_one_len(dirname, dir, strlen(dirname));
32759f7d7af545 David Howells 2021-10-21 102 else
32759f7d7af545 David Howells 2021-10-21 103 subdir = ERR_PTR(ret);
8c39b8bc82aafc David Howells 2022-01-14 104 trace_cachefiles_lookup(NULL, dir, subdir);
32759f7d7af545 David Howells 2021-10-21 105 if (IS_ERR(subdir)) {
32759f7d7af545 David Howells 2021-10-21 106 trace_cachefiles_vfs_error(NULL, d_backing_inode(dir),
32759f7d7af545 David Howells 2021-10-21 107 PTR_ERR(subdir),
32759f7d7af545 David Howells 2021-10-21 108 cachefiles_trace_lookup_error);
32759f7d7af545 David Howells 2021-10-21 109 if (PTR_ERR(subdir) == -ENOMEM)
32759f7d7af545 David Howells 2021-10-21 110 goto nomem_d_alloc;
32759f7d7af545 David Howells 2021-10-21 111 goto lookup_error;
32759f7d7af545 David Howells 2021-10-21 112 }
32759f7d7af545 David Howells 2021-10-21 113
32759f7d7af545 David Howells 2021-10-21 114 _debug("subdir -> %pd %s",
32759f7d7af545 David Howells 2021-10-21 115 subdir, d_backing_inode(subdir) ? "positive" : "negative");
32759f7d7af545 David Howells 2021-10-21 116
32759f7d7af545 David Howells 2021-10-21 117 /* we need to create the subdir if it doesn't exist yet */
32759f7d7af545 David Howells 2021-10-21 118 if (d_is_negative(subdir)) {
3929eca769b5a2 David Howells 2021-10-21 119 ret = cachefiles_has_space(cache, 1, 0,
3929eca769b5a2 David Howells 2021-10-21 120 cachefiles_has_space_for_create);
32759f7d7af545 David Howells 2021-10-21 121 if (ret < 0)
32759f7d7af545 David Howells 2021-10-21 122 goto mkdir_error;
32759f7d7af545 David Howells 2021-10-21 123
32759f7d7af545 David Howells 2021-10-21 124 _debug("attempt mkdir");
32759f7d7af545 David Howells 2021-10-21 125
32759f7d7af545 David Howells 2021-10-21 126 path.mnt = cache->mnt;
32759f7d7af545 David Howells 2021-10-21 127 path.dentry = dir;
32759f7d7af545 David Howells 2021-10-21 128 ret = security_path_mkdir(&path, subdir, 0700);
32759f7d7af545 David Howells 2021-10-21 129 if (ret < 0)
32759f7d7af545 David Howells 2021-10-21 130 goto mkdir_error;
406fad7698f5bf Marc Dionne 2025-03-25 131 ret = cachefiles_inject_write_error();
406fad7698f5bf Marc Dionne 2025-03-25 132 if (ret == 0)
c54b386969a581 NeilBrown 2025-02-27 133 subdir = vfs_mkdir(&nop_mnt_idmap, d_inode(dir), subdir, 0700);
If this vfs_mkdir() fails then we don't set ret.
406fad7698f5bf Marc Dionne 2025-03-25 134 else
406fad7698f5bf Marc Dionne 2025-03-25 135 subdir = ERR_PTR(ret);
c54b386969a581 NeilBrown 2025-02-27 136 if (IS_ERR(subdir)) {
32759f7d7af545 David Howells 2021-10-21 137 trace_cachefiles_vfs_error(NULL, d_inode(dir), ret,
32759f7d7af545 David Howells 2021-10-21 138 cachefiles_trace_mkdir_error);
32759f7d7af545 David Howells 2021-10-21 139 goto mkdir_error;
32759f7d7af545 David Howells 2021-10-21 140 }
8c39b8bc82aafc David Howells 2022-01-14 141 trace_cachefiles_mkdir(dir, subdir);
32759f7d7af545 David Howells 2021-10-21 142
c54b386969a581 NeilBrown 2025-02-27 143 if (unlikely(d_unhashed(subdir) || d_is_negative(subdir))) {
c54b386969a581 NeilBrown 2025-02-27 144 dput(subdir);
32759f7d7af545 David Howells 2021-10-21 145 goto retry;
32759f7d7af545 David Howells 2021-10-21 146 }
32759f7d7af545 David Howells 2021-10-21 147 ASSERT(d_backing_inode(subdir));
32759f7d7af545 David Howells 2021-10-21 148
32759f7d7af545 David Howells 2021-10-21 149 _debug("mkdir -> %pd{ino=%lu}",
32759f7d7af545 David Howells 2021-10-21 150 subdir, d_backing_inode(subdir)->i_ino);
32759f7d7af545 David Howells 2021-10-21 151 if (_is_new)
32759f7d7af545 David Howells 2021-10-21 152 *_is_new = true;
32759f7d7af545 David Howells 2021-10-21 153 }
32759f7d7af545 David Howells 2021-10-21 154
32759f7d7af545 David Howells 2021-10-21 155 /* Tell rmdir() it's not allowed to delete the subdir */
32759f7d7af545 David Howells 2021-10-21 156 inode_lock(d_inode(subdir));
32759f7d7af545 David Howells 2021-10-21 157 inode_unlock(d_inode(dir));
32759f7d7af545 David Howells 2021-10-21 158
08d7a6fb7e44ae Miklos Szeredi 2022-09-24 159 if (!__cachefiles_mark_inode_in_use(NULL, d_inode(subdir))) {
08d7a6fb7e44ae Miklos Szeredi 2022-09-24 160 pr_notice("cachefiles: Inode already in use: %pd (B=%lx)\n",
08d7a6fb7e44ae Miklos Szeredi 2022-09-24 161 subdir, d_inode(subdir)->i_ino);
32759f7d7af545 David Howells 2021-10-21 162 goto mark_error;
08d7a6fb7e44ae Miklos Szeredi 2022-09-24 163 }
32759f7d7af545 David Howells 2021-10-21 164
32759f7d7af545 David Howells 2021-10-21 165 inode_unlock(d_inode(subdir));
32759f7d7af545 David Howells 2021-10-21 166
32759f7d7af545 David Howells 2021-10-21 167 /* we need to make sure the subdir is a directory */
32759f7d7af545 David Howells 2021-10-21 168 ASSERT(d_backing_inode(subdir));
32759f7d7af545 David Howells 2021-10-21 169
32759f7d7af545 David Howells 2021-10-21 170 if (!d_can_lookup(subdir)) {
32759f7d7af545 David Howells 2021-10-21 171 pr_err("%s is not a directory\n", dirname);
32759f7d7af545 David Howells 2021-10-21 172 ret = -EIO;
32759f7d7af545 David Howells 2021-10-21 173 goto check_error;
32759f7d7af545 David Howells 2021-10-21 174 }
32759f7d7af545 David Howells 2021-10-21 175
32759f7d7af545 David Howells 2021-10-21 176 ret = -EPERM;
32759f7d7af545 David Howells 2021-10-21 177 if (!(d_backing_inode(subdir)->i_opflags & IOP_XATTR) ||
32759f7d7af545 David Howells 2021-10-21 178 !d_backing_inode(subdir)->i_op->lookup ||
32759f7d7af545 David Howells 2021-10-21 179 !d_backing_inode(subdir)->i_op->mkdir ||
32759f7d7af545 David Howells 2021-10-21 180 !d_backing_inode(subdir)->i_op->rename ||
32759f7d7af545 David Howells 2021-10-21 181 !d_backing_inode(subdir)->i_op->rmdir ||
32759f7d7af545 David Howells 2021-10-21 182 !d_backing_inode(subdir)->i_op->unlink)
32759f7d7af545 David Howells 2021-10-21 183 goto check_error;
32759f7d7af545 David Howells 2021-10-21 184
32759f7d7af545 David Howells 2021-10-21 185 _leave(" = [%lu]", d_backing_inode(subdir)->i_ino);
32759f7d7af545 David Howells 2021-10-21 186 return subdir;
32759f7d7af545 David Howells 2021-10-21 187
32759f7d7af545 David Howells 2021-10-21 188 check_error:
32759f7d7af545 David Howells 2021-10-21 189 cachefiles_put_directory(subdir);
32759f7d7af545 David Howells 2021-10-21 190 _leave(" = %d [check]", ret);
32759f7d7af545 David Howells 2021-10-21 191 return ERR_PTR(ret);
32759f7d7af545 David Howells 2021-10-21 192
32759f7d7af545 David Howells 2021-10-21 193 mark_error:
32759f7d7af545 David Howells 2021-10-21 194 inode_unlock(d_inode(subdir));
32759f7d7af545 David Howells 2021-10-21 195 dput(subdir);
32759f7d7af545 David Howells 2021-10-21 196 return ERR_PTR(-EBUSY);
32759f7d7af545 David Howells 2021-10-21 197
32759f7d7af545 David Howells 2021-10-21 198 mkdir_error:
32759f7d7af545 David Howells 2021-10-21 199 inode_unlock(d_inode(dir));
c54b386969a581 NeilBrown 2025-02-27 200 if (!IS_ERR(subdir))
32759f7d7af545 David Howells 2021-10-21 201 dput(subdir);
32759f7d7af545 David Howells 2021-10-21 202 pr_err("mkdir %s failed with error %d\n", dirname, ret);
32759f7d7af545 David Howells 2021-10-21 @203 return ERR_PTR(ret);
^^^^^^^^^^^^
And we return NULL here. I looked at the callers and couldn't
see if it was a bug, but I'm guessing it is because the label has
"_error" in the name.
32759f7d7af545 David Howells 2021-10-21 204
32759f7d7af545 David Howells 2021-10-21 205 lookup_error:
32759f7d7af545 David Howells 2021-10-21 206 inode_unlock(d_inode(dir));
32759f7d7af545 David Howells 2021-10-21 207 ret = PTR_ERR(subdir);
32759f7d7af545 David Howells 2021-10-21 208 pr_err("Lookup %s failed with error %d\n", dirname, ret);
32759f7d7af545 David Howells 2021-10-21 209 return ERR_PTR(ret);
32759f7d7af545 David Howells 2021-10-21 210
32759f7d7af545 David Howells 2021-10-21 211 nomem_d_alloc:
32759f7d7af545 David Howells 2021-10-21 212 inode_unlock(d_inode(dir));
32759f7d7af545 David Howells 2021-10-21 213 _leave(" = -ENOMEM");
32759f7d7af545 David Howells 2021-10-21 214 return ERR_PTR(-ENOMEM);
32759f7d7af545 David Howells 2021-10-21 215 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists