linux-kernel - Re: [PATCH] debugfs: Fix NULL pointer dereference at debugfs_read_file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2025122234-crazy-remix-3098@gregkh>
Date: Mon, 22 Dec 2025 12:54:22 +0100
From: Greg KH <gregkh@...uxfoundation.org>
To: yangshiguang1011@....com
Cc: rafael@...nel.org, dakr@...nel.org, peterz@...radead.org,
	linux-kernel@...r.kernel.org, yangshiguang@...omi.com,
	stable@...r.kernel.org
Subject: Re: [PATCH] debugfs: Fix NULL pointer dereference at
 debugfs_read_file_str

On Mon, Dec 22, 2025 at 05:36:16PM +0800, yangshiguang1011@....com wrote:
> From: yangshiguang <yangshiguang@...omi.com>
> 
> Check in debugfs_read_file_str() if the string pointer is NULL.
> 
> When creating a node using debugfs_create_str(), the string parameter
> value can be NULL to indicate empty/unused/ignored.

Why would you create an empty debugfs string file?  That is not ok, we
should change that to not allow this.

> However, reading this node using debugfs_read_file_str() will cause a
> kernel panic.
> This should not be fatal, so return an invalid error.
> 
> Signed-off-by: yangshiguang <yangshiguang@...omi.com>
> Fixes: 9af0440ec86e ("debugfs: Implement debugfs_create_str()")
> Cc: stable@...r.kernel.org
> ---
>  fs/debugfs/file.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
> index 3ec3324c2060..a22ff0ceb230 100644
> --- a/fs/debugfs/file.c
> +++ b/fs/debugfs/file.c
> @@ -1026,6 +1026,9 @@ ssize_t debugfs_read_file_str(struct file *file, char __user *user_buf,
>  		return ret;
>  
>  	str = *(char **)file->private_data;
> +	if (!str)
> +		return -EINVAL;

What in kernel user causes this to happen?  Let's fix that up instead
please.

thanks,

greg k-h