diff options
| author | Steven Rostedt (Google) <rostedt@goodmis.org> | 2023-09-30 16:01:06 +0300 |
|---|---|---|
| committer | Steven Rostedt (Google) <rostedt@goodmis.org> | 2023-09-30 23:26:04 +0300 |
| commit | 2598bd3ca8dcf5bbca1161ee5b271b432398da37 (patch) | |
| tree | 28fe2255c4c570f938c573f4b4bda9c210b340a0 | |
| parent | 2de9ee94054263940122aee8720e902b30c27930 (diff) | |
| download | linux-2598bd3ca8dcf5bbca1161ee5b271b432398da37.tar.xz | |
eventfs: Test for dentries array allocated in eventfs_release()
The dcache_dir_open_wrapper() could be called when a dynamic event is
being deleted leaving a dentry with no children. In this case the
dlist->dentries array will never be allocated. This needs to be checked
for in eventfs_release(), otherwise it will trigger a NULL pointer
dereference.
Link: https://lore.kernel.org/linux-trace-kernel/20230930090106.1c3164e9@rorschach.local.home
Cc: Mark Rutland <mark.rutland@arm.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Fixes: ef36b4f92868 ("eventfs: Remember what dentries were created on dir open")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
| -rw-r--r-- | fs/tracefs/event_inode.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c index 5f1714089884..8c8d64e76103 100644 --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -421,7 +421,7 @@ static int eventfs_release(struct inode *inode, struct file *file) if (WARN_ON_ONCE(!dlist)) return -EINVAL; - for (i = 0; dlist->dentries[i]; i++) { + for (i = 0; dlist->dentries && dlist->dentries[i]; i++) { dput(dlist->dentries[i]); } |