From nobody Wed Jan 7 03:31:06 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 135E4E77373 for ; Sat, 30 Sep 2023 13:01:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234052AbjI3NBm (ORCPT ); Sat, 30 Sep 2023 09:01:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43892 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230516AbjI3NBm (ORCPT ); Sat, 30 Sep 2023 09:01:42 -0400 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D8EBCF9 for ; Sat, 30 Sep 2023 06:01:39 -0700 (PDT) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C6AA5C433C7; Sat, 30 Sep 2023 13:01:32 +0000 (UTC) Date: Sat, 30 Sep 2023 09:01:06 -0400 From: Steven Rostedt To: LKML Cc: Linux trace kernel , Masami Hiramatsu , Mark Rutland Subject: [PATCH] eventfs: Test for dentries array allocated in eventfs_release() Message-ID: <20230930090106.1c3164e9@rorschach.local.home> X-Mailer: Claws Mail 3.17.8 (GTK+ 2.24.33; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: "Steven Rostedt (Google)" The dcache_dir_open_wrapper() could be called when a dynamic event is being deleted leaving a dentry with no children. In this case the dlist->dentries array will never be allocated. This needs to be checked for in eventfs_release(), otherwise it will trigger a NULL pointer dereference. Fixes: ef36b4f92868 ("eventfs: Remember what dentries were created on dir o= pen") Signed-off-by: Steven Rostedt (Google) Acked-by: Masami Hiramatsu (Google) --- fs/tracefs/event_inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c index 5f1714089884..8c8d64e76103 100644 --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -421,7 +421,7 @@ static int eventfs_release(struct inode *inode, struct = file *file) if (WARN_ON_ONCE(!dlist)) return -EINVAL; =20 - for (i =3D 0; dlist->dentries[i]; i++) { + for (i =3D 0; dlist->dentries && dlist->dentries[i]; i++) { dput(dlist->dentries[i]); } =20 --=20 2.40.1