| Message ID | 20250106033118.4640-1-songmuchun@bytedance.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | hugetlb: fix NULL pointer dereference in trace_hugetlbfs_alloc_inode | expand |
On 2025/1/6 11:31, Muchun Song wrote: > hugetlb_file_setup() will pass a NULL @dir to hugetlbfs_get_inode(), so > we will access a NULL pointer for @dir. Fix it and set __entry->dr to > 0 if @dir is NULL. Because ->i_ino cannot be 0 (see get_next_ino()), > there is no confusing if user sees a 0 inode number. > Thanks for fixing! Reviewed-by: Hongbo Li <lihongbo22@huawei.com> > Fixes: 318580ad7f28 ("hugetlbfs: support tracepoint") > Cc: stable@vger.kernel.org > Reported-by: Cheung Wall <zzqq0103.hey@gmail.com> > Closes: https://lore.kernel.org/linux-mm/02858D60-43C1-4863-A84F-3C76A8AF1F15@linux.dev/T/# > Signed-off-by: Muchun Song <songmuchun@bytedance.com> > --- > include/trace/events/hugetlbfs.h | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/include/trace/events/hugetlbfs.h b/include/trace/events/hugetlbfs.h > index 8331c904a9ba8..59605dfaeeb43 100644 > --- a/include/trace/events/hugetlbfs.h > +++ b/include/trace/events/hugetlbfs.h > @@ -23,7 +23,7 @@ TRACE_EVENT(hugetlbfs_alloc_inode, > TP_fast_assign( > __entry->dev = inode->i_sb->s_dev; > __entry->ino = inode->i_ino; > - __entry->dir = dir->i_ino; > + __entry->dir = dir ? dir->i_ino : 0; > __entry->mode = mode; > ), >
diff --git a/include/trace/events/hugetlbfs.h b/include/trace/events/hugetlbfs.h index 8331c904a9ba8..59605dfaeeb43 100644 --- a/include/trace/events/hugetlbfs.h +++ b/include/trace/events/hugetlbfs.h @@ -23,7 +23,7 @@ TRACE_EVENT(hugetlbfs_alloc_inode, TP_fast_assign( __entry->dev = inode->i_sb->s_dev; __entry->ino = inode->i_ino; - __entry->dir = dir->i_ino; + __entry->dir = dir ? dir->i_ino : 0; __entry->mode = mode; ),
hugetlb_file_setup() will pass a NULL @dir to hugetlbfs_get_inode(), so we will access a NULL pointer for @dir. Fix it and set __entry->dr to 0 if @dir is NULL. Because ->i_ino cannot be 0 (see get_next_ino()), there is no confusing if user sees a 0 inode number. Fixes: 318580ad7f28 ("hugetlbfs: support tracepoint") Cc: stable@vger.kernel.org Reported-by: Cheung Wall <zzqq0103.hey@gmail.com> Closes: https://lore.kernel.org/linux-mm/02858D60-43C1-4863-A84F-3C76A8AF1F15@linux.dev/T/# Signed-off-by: Muchun Song <songmuchun@bytedance.com> --- include/trace/events/hugetlbfs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)