kernel/linux.git/fs/sysfs/group.c, branch v6.18.21

sysfs: check visibility before changing group attribute ownership

2025-10-17T07:48:34+00:00

Since commit 0c17270f9b92 ("net: sysfs: Implement is_visible for phys_(port_id, port_name, switch_id)"), __dev_change_net_namespace() can hit WARN_ON() when trying to change owner of a file that isn't visible. See the trace below: WARNING: CPU: 6 PID: 2938 at net/core/dev.c:12410 __dev_change_net_namespace+0xb89/0xc30 CPU: 6 UID: 0 PID: 2938 Comm: incusd Not tainted 6.17.1-1-mainline #1 PREEMPT(full) 4b783b4a638669fb644857f484487d17cb45ed1f Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.07 02/19/2025 RIP: 0010:__dev_change_net_namespace+0xb89/0xc30 [...] Call Trace: ? if6_seq_show+0x30/0x50 do_setlink.isra.0+0xc7/0x1270 ? __nla_validate_parse+0x5c/0xcc0 ? security_capable+0x94/0x1a0 rtnl_newlink+0x858/0xc20 ? update_curr+0x8e/0x1c0 ? update_entity_lag+0x71/0x80 ? sched_balance_newidle+0x358/0x450 ? psi_task_switch+0x113/0x2a0 ? __pfx_rtnl_newlink+0x10/0x10 rtnetlink_rcv_msg+0x346/0x3e0 ? sched_clock+0x10/0x30 ? __pfx_rtnetlink_rcv_msg+0x10/0x10 netlink_rcv_skb+0x59/0x110 netlink_unicast+0x285/0x3c0 ? __alloc_skb+0xdb/0x1a0 netlink_sendmsg+0x20d/0x430 ____sys_sendmsg+0x39f/0x3d0 ? import_iovec+0x2f/0x40 ___sys_sendmsg+0x99/0xe0 __sys_sendmsg+0x8a/0xf0 do_syscall_64+0x81/0x970 ? __sys_bind+0xe3/0x110 ? syscall_exit_work+0x143/0x1b0 ? do_syscall_64+0x244/0x970 ? sock_alloc_file+0x63/0xc0 ? syscall_exit_work+0x143/0x1b0 ? do_syscall_64+0x244/0x970 ? alloc_fd+0x12e/0x190 ? put_unused_fd+0x2a/0x70 ? do_sys_openat2+0xa2/0xe0 ? syscall_exit_work+0x143/0x1b0 ? do_syscall_64+0x244/0x970 ? exc_page_fault+0x7e/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] Fix this by checking is_visible() before trying to touch the attribute. Fixes: 303a42769c4c ("sysfs: add sysfs_group{s}_change_owner()") Fixes: 0c17270f9b92 ("net: sysfs: Implement is_visible for phys_(port_id, port_name, switch_id)") Reported-by: Cynthia Closes: https://lore.kernel.org/netdev/01070199e22de7f8-28f711ab-d3f1-46d9-b9a0-048ab05eb09b-000000@eu-central-1.amazonses.com/ Signed-off-by: Fernando Fernandez Mancera Reviewed-by: Jakub Kicinski Link: https://lore.kernel.org/r/20251016101456.4087-1-fmancera@suse.de Signed-off-by: Greg Kroah-Hartman

sysfs: constify attribute_group::bin_attrs

2025-04-15T16:46:10+00:00

All users of this field have been migrated to bin_attrs_new. It can now be constified. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250313-sysfs-const-bin_attr-final-v2-2-96284e1e88ce@weissschuh.net Signed-off-by: Greg Kroah-Hartman

sysfs: introduce callback attribute_group::bin_size

2024-11-05T13:00:28+00:00

Several drivers need to dynamically calculate the size of an binary attribute. Currently this is done by assigning attr->size from the is_bin_visible() callback. This has drawbacks: * It is not documented. * A single attribute can be instantiated multiple times, overwriting the shared size field. * It prevents the structure to be moved to read-only memory. Introduce a new dedicated callback to calculate the size of the attribute. Signed-off-by: Thomas Weißschuh Acked-by: Krzysztof Wilczyński Link: https://lore.kernel.org/r/20241103-sysfs-const-bin_attr-v2-2-71110628844c@weissschuh.net Signed-off-by: Greg Kroah-Hartman

sysfs: explicitly pass size to sysfs_add_bin_file_mode_ns()

2024-11-05T13:00:28+00:00

Upcoming changes to the sysfs core require the size of the created file to be overridable by the caller. Add a parameter to enable this. For now keep using attr->size in all cases. Signed-off-by: Thomas Weißschuh Acked-by: Krzysztof Wilczyński Link: https://lore.kernel.org/r/20241103-sysfs-const-bin_attr-v2-1-71110628844c@weissschuh.net Signed-off-by: Greg Kroah-Hartman

sysfs:Addresses documentation in sysfs_merge_group and sysfs_unmerge_group.

2024-03-07T22:04:50+00:00

These functions take a struct attribute_group as an input which has an optional .name field. These functions rely on the .name field being populated and do not check if its null. They pass this name into other functions, eventually leading to a null pointer dereference. This change simply updates the documentation of the function to make this requirement clear. Signed-off-by: Rohan Kollambalath Link: https://lore.kernel.org/r/20240211223634.2103665-1-rohankollambalath@gmail.com Signed-off-by: Greg Kroah-Hartman

sysfs: Fix crash on empty group attributes array

2024-02-23T06:34:26+00:00

It turns out that arch/x86/events/intel/core.c makes use of "empty" attributes. static struct attribute *empty_attrs; __init int intel_pmu_init(void) { struct attribute **extra_skl_attr = &empty_attrs; struct attribute **extra_attr = &empty_attrs; struct attribute **td_attr = &empty_attrs; struct attribute **mem_attr = &empty_attrs; struct attribute **tsx_attr = &empty_attrs; ... That breaks the assumption __first_visible() that expects that if grp->attrs is set then grp->attrs[0] must also be set and results in backtraces like: BUG: kernel NULL pointer dereference, address: 00rnel mode #PF: error_code(0x0000) - not-present ] PREEMPT SMP NOPTI CPU: 1 PID: 1 Comm: swapper/IP: 0010:exra_is_visible+0x14/0x20 ? exc_page_fault+0x68/0x190 internal_create_groups+0x42/0xa0 pmu_dev_alloc+0xc0/0xe0 perf_event_sysfs_init+0x580000000000 ]--- RIP: 0010:exra_is_visible+0x14/0 Check for non-empty attributes array before calling is_visible(). Reported-by: Pierre-Louis Bossart Closes: https://github.com/thesofproject/linux/pull/4799#issuecomment-1958537212 Fixes: 70317fd24b41 ("sysfs: Introduce a mechanism to hide static attribute_groups") Cc: Marc Herbert Cc: Rafael J. Wysocki Signed-off-by: Dan Williams Tested-by: Marc Herbert Link: https://lore.kernel.org/r/170863445442.1479840.1818801787239831650.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Greg Kroah-Hartman

sysfs: Introduce a mechanism to hide static attribute_groups

2024-02-19T08:04:56+00:00

Add a mechanism for named attribute_groups to hide their directory at sysfs_update_group() time, or otherwise skip emitting the group directory when the group is first registered. It piggybacks on is_visible() in a similar manner as SYSFS_PREALLOC, i.e. special flags in the upper bits of the returned mode. To use it, specify a symbol prefix to DEFINE_SYSFS_GROUP_VISIBLE(), and then pass that same prefix to SYSFS_GROUP_VISIBLE() when assigning the @is_visible() callback: DEFINE_SYSFS_GROUP_VISIBLE($prefix) struct attribute_group $prefix_group = { .name = $name, .is_visible = SYSFS_GROUP_VISIBLE($prefix), }; SYSFS_GROUP_VISIBLE() expects a definition of $prefix_group_visible() and $prefix_attr_visible(), where $prefix_group_visible() just returns true / false and $prefix_attr_visible() behaves as normal. The motivation for this capability is to centralize PCI device authentication in the PCI core with a named sysfs group while keeping that group hidden for devices and platforms that do not meet the requirements. In a PCI topology, most devices will not support authentication, a small subset will support just PCI CMA (Component Measurement and Authentication), a smaller subset will support PCI CMA + PCIe IDE (Link Integrity and Encryption), and only next generation server hosts will start to include a platform TSM (TEE Security Manager). Without this capability the alternatives are: * Check if all attributes are invisible and if so, hide the directory. Beyond trouble getting this to work [1], this is an ABI change for scenarios if userspace happens to depend on group visibility absent any attributes. I.e. this new capability avoids regression since it does not retroactively apply to existing cases. * Publish an empty /sys/bus/pci/devices/$pdev/tsm/ directory for all PCI devices (i.e. for the case when TSM platform support is present, but device support is absent). Unfortunate that this will be a vestigial empty directory in the vast majority of cases. * Reintroduce usage of runtime calls to sysfs_{create,remove}_group() in the PCI core. Bjorn has already indicated that he does not want to see any growth of pci_sysfs_init() [2]. * Drop the named group and simulate a directory by prefixing all TSM-related attributes with "tsm_". Unfortunate to not use the naming capability of a sysfs group as intended. In comparison, there is a small potential for regression if for some reason an @is_visible() callback had dependencies on how many times it was called. Additionally, it is no longer an error to update a group that does not have its directory already present, and it is no longer a WARN() to remove a group that was never visible. Link: https://lore.kernel.org/all/2024012321-envious-procedure-4a58@gregkh/ [1] Link: https://lore.kernel.org/linux-pci/20231019200110.GA1410324@bhelgaas/ [2] Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/2024013028-deflator-flaring-ec62@gregkh Signed-off-by: Greg Kroah-Hartman

sysfs: Skip empty folders creation

2023-06-15T11:37:53+00:00

Most sysfs attributes are statically defined, the goal with this design being to be able to move all the filesystem description into read-only memory. Anyway, it may be relevant in some cases to populate attributes at run time. This leads to situation where an attribute may or may not be present depending on conditions which are not known at compile time, up to the point where no attribute at all gets added in a folder which then becomes "sometimes" empty. Problem is, providing an attribute group with a name and without .[bin_]attrs members will be loudly refused by the core, leading in most cases to a device registration failure. The simple way to support such situation right now is to dynamically allocate an empty attribute array, which is: * a (small) waste of space * a waste of time * disturbing, to say the least, as an empty sysfs folder will be created anyway. Another (even worse) possibility would be to dynamically overwrite a member of the attribute_group list, hopefully the last, which is also supposed to remain in the read-only section. In order to avoid these hackish situations, while still giving a little bit of flexibility, we might just check the validity of the .[bin_]attrs list and, if empty, just skip the attribute group creation instead of failing. This way, developers will not be tempted to workaround the core with useless allocations or strange writes on supposedly read-only structures. The content of the WARN() message is kept but turned into a debug message in order to help developers understanding why their sysfs folders might now silently fail to be created. Signed-off-by: Miquel Raynal Message-ID: <20230614063018.2419043-3-miquel.raynal@bootlin.com> Signed-off-by: Greg Kroah-Hartman

sysfs: Improve readability by following the kernel coding style

2023-06-15T11:37:50+00:00

The purpose of the if/else block is to select the right sysfs directory entry to be used for the files creation. At a first look when you have the file in front of you, it really seems like the "create_files()" lines right after the block are badly indented and the "else" does not guard. In practice the code is correct but lacks curly brackets to show where the big if/else block actually ends. Add these brackets to comply with the current kernel coding style and to ease the understanding of the whole logic. Signed-off-by: Miquel Raynal Message-ID: <20230614063018.2419043-2-miquel.raynal@bootlin.com> Signed-off-by: Greg Kroah-Hartman

sysfs: split out binary attribute handling from sysfs_add_file_mode_ns

2021-09-14T14:59:46+00:00

Split adding binary attributes into a separate handler instead of overloading sysfs_add_file_mode_ns. Acked-by: Christian Brauner Acked-by: Tejun Heo Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20210913054121.616001-5-hch@lst.de Signed-off-by: Greg Kroah-Hartman