From nobody Fri Dec 26 17:27:34 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9D01617984; Wed, 3 Jan 2024 01:51:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 40330C433C7; Wed, 3 Jan 2024 01:51:26 +0000 (UTC) Received: from rostedt by gandalf with local (Exim 4.97) (envelope-from ) id 1rKqQm-00000000k5m-1xzs; Tue, 02 Jan 2024 20:52:28 -0500 Message-ID: <20240103015228.329181041@goodmis.org> User-Agent: quilt/0.67 Date: Tue, 02 Jan 2024 20:50:44 -0500 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, "Ubisectech Sirius" Subject: [for-linus][PATCH 1/2] tracefs: Check for dentry->d_inode exists in set_gid() References: <20240103015043.912131206@goodmis.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Steven Rostedt (Google)" If a getdents() is called on the tracefs directory but does not get all the files, it can leave a "cursor" dentry in the d_subdirs list of tracefs dentry. This cursor dentry does not have a d_inode for it. Before referencing tracefs_inode from the dentry, the d_inode must first be checked if it has content. If not, then it's not a tracefs_inode and can be ignored. The following caused a crash: #define getdents64(fd, dirp, count) syscall(SYS_getdents64, fd, dirp, coun= t) #define BUF_SIZE 256 #define TDIR "/tmp/file0" int main(void) { char buf[BUF_SIZE]; int fd; int n; mkdir(TDIR, 0777); mount(NULL, TDIR, "tracefs", 0, NULL); fd =3D openat(AT_FDCWD, TDIR, O_RDONLY); n =3D getdents64(fd, buf, BUF_SIZE); ret =3D mount(NULL, TDIR, NULL, MS_NOSUID|MS_REMOUNT|MS_RELATIME|MS= _LAZYTIME, "gid=3D1000"); return 0; } That's because the 256 BUF_SIZE was not big enough to read all the dentries of the tracefs file system and it left a "cursor" dentry in the subdirs of the tracefs root inode. Then on remounting with "gid=3D1000", it would cause an iteration of all dentries which hit: ti =3D get_tracefs(dentry->d_inode); if (ti && (ti->flags & TRACEFS_EVENT_INODE)) eventfs_update_gid(dentry, gid); Which crashed because of the dereference of the cursor dentry which had a N= ULL d_inode. In the subdir loop of the dentry lookup of set_gid(), if a child has a NULL d_inode, simply skip it. Link: https://lore.kernel.org/all/20240102135637.3a21fb10@gandalf.local.hom= e/ Link: https://lore.kernel.org/linux-trace-kernel/20240102151249.05da244d@ga= ndalf.local.home Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Fixes: 7e8358edf503e ("eventfs: Fix file and directory uid and gid ownershi= p") Reported-by: "Ubisectech Sirius" Signed-off-by: Steven Rostedt (Google) --- fs/tracefs/inode.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c index 62524b20964e..bc86ffdb103b 100644 --- a/fs/tracefs/inode.c +++ b/fs/tracefs/inode.c @@ -215,6 +215,10 @@ static void set_gid(struct dentry *parent, kgid_t gid) struct dentry *dentry =3D list_entry(tmp, struct dentry, d_child); next =3D tmp->next; =20 + /* Note, getdents() can add a cursor dentry with no inode */ + if (!dentry->d_inode) + continue; + spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); =20 change_gid(dentry, gid); --=20 2.42.0 From nobody Fri Dec 26 17:27:34 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C17231116; Wed, 3 Jan 2024 01:51:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 66BEEC433CA; Wed, 3 Jan 2024 01:51:26 +0000 (UTC) Received: from rostedt by gandalf with local (Exim 4.97) (envelope-from ) id 1rKqQm-00000000k6G-2cE0; Tue, 02 Jan 2024 20:52:28 -0500 Message-ID: <20240103015228.487061905@goodmis.org> User-Agent: quilt/0.67 Date: Tue, 02 Jan 2024 20:50:45 -0500 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org Subject: [for-linus][PATCH 2/2] eventfs: Fix bitwise fields for "is_events" References: <20240103015043.912131206@goodmis.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Steven Rostedt (Google)" A flag was needed to denote which eventfs_inode was the "events" directory, so a bit was taken from the "nr_entries" field, as there's not that many entries, and 2^30 is plenty. But the bit number for nr_entries was not updated to reflect the bit taken from it, which would add an unnecessary integer to the structure. Link: https://lore.kernel.org/linux-trace-kernel/20240102151832.7ca87275@ga= ndalf.local.home Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Fixes: 7e8358edf503e ("eventfs: Fix file and directory uid and gid ownershi= p") Signed-off-by: Steven Rostedt (Google) --- fs/tracefs/internal.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/tracefs/internal.h b/fs/tracefs/internal.h index 899e447778ac..42bdeb471a07 100644 --- a/fs/tracefs/internal.h +++ b/fs/tracefs/internal.h @@ -63,7 +63,7 @@ struct eventfs_inode { }; unsigned int is_freed:1; unsigned int is_events:1; - unsigned int nr_entries:31; + unsigned int nr_entries:30; }; =20 static inline struct tracefs_inode *get_tracefs(const struct inode *inode) --=20 2.42.0