From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 15818C169C4 for ; Thu, 31 Jan 2019 10:09:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D6AF3218D9 for ; Thu, 31 Jan 2019 10:09:33 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="NjqBS2E2" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732249AbfAaKJ2 (ORCPT ); Thu, 31 Jan 2019 05:09:28 -0500 Received: from mail-ua1-f68.google.com ([209.85.222.68]:43886 "EHLO mail-ua1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732048AbfAaKJ1 (ORCPT ); Thu, 31 Jan 2019 05:09:27 -0500 Received: by mail-ua1-f68.google.com with SMTP id z11so818308uaa.10 for ; Thu, 31 Jan 2019 02:09:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=TqfcER/WpG3pVm3Pf9Lr3V74srT8wVWkZMeoFRsH8cc=; b=NjqBS2E2dToPUfGhYJYq1Y/hMUpwrXDw6YR7RFfmUr0x4Fx7GecsCrGvG1ZO023P9O zah7tCLaj7qS1Ow/jKYZ6qM9WLcTK4gKTBMO9hNGjjXlCrZ7wWg1u5/6wA2MlxW9fB1d vf03gJuYTDIkzW9gHS1AZ9F+CVn4tTpTrlDB4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=TqfcER/WpG3pVm3Pf9Lr3V74srT8wVWkZMeoFRsH8cc=; b=njXLX/18Z3a1Kw00p+/DyahA20FmoPwJvjzTbwQ7c4/SR8EGteQSTAYvZNWCCmh5BJ Lah9hNjvIRt/mkPOh4moSq4gcn8afG5J+T8LzE542+9cBsuGwQJviaVSpdb2j84Tdjp3 myZKReAO58RFHZOri/lTt2QXDshoS5mTk3VDYFEL80nsmW9t0uomUw3faCOEfvXlJy1V 8TTnPocE+j4B/WJJ9tmrSAeQYH5vm3byqSkF4wTXGAKR8QCmAKjkq1Oeg8le0lI5Xf+K G3wvvWTHobBttBPK35h+6TKR+Ec+zxrItjmBGalir2d0/VD+d4NPtV0etnjEUn+NBZUy 3zAw== X-Gm-Message-State: AJcUukf5OP9zfiroZYFJvCylj88588xBKvl5sETjq3faECjrAY0oA0mi EthQaXU5J/eL7LW2vy58locM6a3cJzI= X-Google-Smtp-Source: ALg8bN7Z5T2Y3w5HaZ+ri77bsQdezvRKBu9Q55EvX/GOaANWzIwHy9vTm6IWrI9pPXPAJofQFi4IKw== X-Received: by 2002:ab0:20ab:: with SMTP id y11mr13903254ual.40.1548929365622; Thu, 31 Jan 2019 02:09:25 -0800 (PST) Received: from mail-vs1-f53.google.com (mail-vs1-f53.google.com. [209.85.217.53]) by smtp.gmail.com with ESMTPSA id y195sm5259277vkd.0.2019.01.31.02.09.24 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 31 Jan 2019 02:09:24 -0800 (PST) Received: by mail-vs1-f53.google.com with SMTP id p74so1649752vsc.0 for ; Thu, 31 Jan 2019 02:09:24 -0800 (PST) X-Received: by 2002:a67:7657:: with SMTP id r84mr14197755vsc.117.1548929363982; Thu, 31 Jan 2019 02:09:23 -0800 (PST) MIME-Version: 1.0 References: <00000000000081e6cc0580aa76a2@google.com> <80e90ecd-77f5-00a3-4e91-5e9eea2aa117@I-love.SAKURA.ne.jp> <27008e5f-9dfc-a09a-cdb9-824d470fb9dd@I-love.SAKURA.ne.jp> <20190130114052.GB30781@kroah.com> In-Reply-To: <20190130114052.GB30781@kroah.com> From: Kees Cook Date: Thu, 31 Jan 2019 23:09:11 +1300 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: BUG: unable to handle kernel paging request in dput (2) To: Greg Kroah-Hartman Cc: Tetsuo Handa , Omar Sandoval , syzbot , "linux-fsdevel@vger.kernel.org" , LKML , syzkaller-bugs , Al Viro , Jens Axboe Content-Type: text/plain; charset="UTF-8" Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org On Thu, Jan 31, 2019 at 12:41 AM Greg Kroah-Hartman wrote: > > On Wed, Jan 30, 2019 at 08:26:24PM +0900, Tetsuo Handa wrote: > > On 2019/01/30 20:11, Tetsuo Handa wrote: > > > Hello, Omar. > > > > > > syzbot is reporting a crash due to dput(-EINVAL) [1]. I think the location is > > > > > > dir = debugfs_lookup(buts->name, blk_debugfs_root); > > > if (!dir) > > > bt->dir = dir = debugfs_create_dir(buts->name, blk_debugfs_root); > > > > > > added by commit 6ac93117ab009d39 ("blktrace: use existing disk debugfs directory"). > > > > > > Currently, Greg Kroah-Hartman is posting patches: > > > > > > When calling debugfs functions, there is no need to ever check the > > > return value. The function can work or not, but the code logic should > > > never do something different based on this. > > > > > > Omar, what do you want to do for this case? > > > > > > [1] https://syzkaller.appspot.com/bug?extid=b382ba6a802a3d242790 > > > > > > > The function which returned -EINVAL instead of NULL seems to be debugfs_lookup() > > modified by commit ff9fb72bc07705c0 ("debugfs: return error values, not NULL"). > > Ok, the patch below should fix this up. > > thanks, > > greg k-h > > ------------------------- > > From: Greg Kroah-Hartman > Subject: [PATCH] debugfs: debugfs_lookup() should return NULL if not found > > Lots of callers of debugfs_lookup() were just checking NULL to see if > the file/directory was found or not. By changing this in ff9fb72bc077 > ("debugfs: return error values, not NULL") we caused some subsystems to > easily crash. > > Fixes: ff9fb72bc077 ("debugfs: return error values, not NULL") > Reported-by: syzbot+b382ba6a802a3d242790@syzkaller.appspotmail.com > Reported-by: Tetsuo Handa > Cc: Omar Sandoval > Cc: Jens Axboe > Signed-off-by: Greg Kroah-Hartman > --- > fs/debugfs/inode.c | 10 +++++----- > 1 file changed, 5 insertions(+), 5 deletions(-) > > diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c > index b16f8035b1af..29c68c5d44d5 100644 > --- a/fs/debugfs/inode.c > +++ b/fs/debugfs/inode.c > @@ -254,8 +254,8 @@ MODULE_ALIAS_FS("debugfs"); > * @parent: a pointer to the parent dentry of the file. > * > * This function will return a pointer to a dentry if it succeeds. If the file > - * doesn't exist or an error occurs, %ERR_PTR(-ERROR) will be returned. The > - * returned dentry must be passed to dput() when it is no longer needed. > + * doesn't exist or an error occurs, %NULL will be returned. The returned > + * dentry must be passed to dput() when it is no longer needed. > * > * If debugfs is not enabled in the kernel, the value -%ENODEV will be > * returned. > @@ -265,17 +265,17 @@ struct dentry *debugfs_lookup(const char *name, struct dentry *parent) > struct dentry *dentry; > > if (IS_ERR(parent)) > - return parent; > + return NULL; > > if (!parent) > parent = debugfs_mount->mnt_root; > > dentry = lookup_one_len_unlocked(name, parent, strlen(name)); > if (IS_ERR(dentry)) > - return dentry; > + return NULL; > if (!d_really_is_positive(dentry)) { > dput(dentry); > - return ERR_PTR(-EINVAL); > + return NULL; > } > return dentry; > } > -- > 2.20.1 > FYI, this patch does not fix the relay.c crash I bisected... I think more clean-up is needed? -Kees