Commit 85e8d18e authored by Hao Ge's avatar Hao Ge Committed by Yipeng Zou
Browse files

eventfs: Fix a possible null pointer dereference in eventfs_find_events() 

stable inclusion
from stable-v6.10.123
commit d4e9a968738bf66d3bb852dd5588d4c7afd6d7f4
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA8ADN
CVE: CVE-2024-39470

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d4e9a968738bf66d3bb852dd5588d4c7afd6d7f4

--------------------------------

In function eventfs_find_events,there is a potential null pointer
that may be caused by calling update_events_attr which will perform
some operations on the members of the ei struct when ei is NULL.

Hence,When ei->is_freed is set,return NULL directly.

Link: https://lore.kernel.org/linux-trace-kernel/20240513053338.63017-1-hao.ge@linux.dev



Cc: stable@vger.kernel.org
Fixes: 8186fff7ab64 ("tracefs/eventfs: Use root and instance inodes as default ownership")
Signed-off-by: default avatarHao Ge <gehao@kylinos.cn>
Signed-off-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: default avatarYipeng Zou <zouyipeng@huawei.com>
parent 660a8fc1

fs/tracefs/event_inode.c

+3 −4
Original line number Diff line number Diff line
@@ -295,10 +295,9 @@ static struct eventfs_inode *eventfs_find_events(struct dentry *dentry) 
		 * If the ei is being freed, the ownership of the children

		 * doesn't matter.

		 */

		if (ei->is_freed) {

			ei = NULL;

			break;

		}

		if (ei->is_freed)

			return NULL;



		// Walk upwards until you find the events inode

	} while (!ei->is_events);