diff mbox series

iwlwifi: properly check debugfs dentry before using it

Message ID 20190330093152.GB14300@kroah.com
State Accepted
Delegated to: Luca Coelho
Headers show
Series iwlwifi: properly check debugfs dentry before using it | expand

Commit Message

Greg KH March 30, 2019, 9:31 a.m. UTC
debugfs can now report an error code if something went wrong instead of
just NULL.  So if the return value is to be used as a "real" dentry, it
needs to be checked if it is an error before dereferencing it.

This is now happening because of ff9fb72bc077 ("debugfs: return error
values, not NULL").  If multiple iwlwifi devices are in the system, this
can cause problems when the driver attempts to create the main debugfs
directory again.  Later on in the code we fail horribly by trying to
dereference a pointer that is an error value.

Reported-by: Laura Abbott <labbott@redhat.com>
Cc: Johannes Berg <johannes.berg@intel.com>
Cc: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Cc: Luca Coelho <luciano.coelho@intel.com>
Cc: Intel Linux Wireless <linuxwifi@intel.com>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: stable <stable@vger.kernel.org> # 5.0
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Comments

Laura Abbott April 1, 2019, 3:39 p.m. UTC | #1
On 3/30/19 2:31 AM, Greg Kroah-Hartman wrote:
> debugfs can now report an error code if something went wrong instead of
> just NULL.  So if the return value is to be used as a "real" dentry, it
> needs to be checked if it is an error before dereferencing it.
> 
> This is now happening because of ff9fb72bc077 ("debugfs: return error
> values, not NULL").  If multiple iwlwifi devices are in the system, this
> can cause problems when the driver attempts to create the main debugfs
> directory again.  Later on in the code we fail horribly by trying to
> dereference a pointer that is an error value.
> 
> Reported-by: Laura Abbott <labbott@redhat.com>

Can you add

Reported-by:  Gabriel Ramirez <gabriello.ramirez@gmail.com>

for the bugzilla reporter who took the time to do the bisect?
I'll ask for testing as well.

> Cc: Johannes Berg <johannes.berg@intel.com>
> Cc: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
> Cc: Luca Coelho <luciano.coelho@intel.com>
> Cc: Intel Linux Wireless <linuxwifi@intel.com>
> Cc: Kalle Valo <kvalo@codeaurora.org>
> Cc: stable <stable@vger.kernel.org> # 5.0
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> 
> 
> diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
> index 2453ceabf00d..6925527d8457 100644
> --- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
> +++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
> @@ -774,8 +774,7 @@ void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
>   		return;
>   
>   	mvmvif->dbgfs_dir = debugfs_create_dir("iwlmvm", dbgfs_dir);
> -
> -	if (!mvmvif->dbgfs_dir) {
> +	if (IS_ERR_OR_NULL(mvmvif->dbgfs_dir)) {
>   		IWL_ERR(mvm, "Failed to create debugfs directory under %pd\n",
>   			dbgfs_dir);
>   		return;
>
Luca Coelho April 17, 2019, 7:02 a.m. UTC | #2
On Sat, 2019-03-30 at 10:31 +0100, Greg Kroah-Hartman wrote:
> debugfs can now report an error code if something went wrong instead
> of
> just NULL.  So if the return value is to be used as a "real" dentry,
> it
> needs to be checked if it is an error before dereferencing it.
> 
> This is now happening because of ff9fb72bc077 ("debugfs: return error
> values, not NULL").  If multiple iwlwifi devices are in the system,
> this
> can cause problems when the driver attempts to create the main
> debugfs
> directory again.  Later on in the code we fail horribly by trying to
> dereference a pointer that is an error value.
> 
> Reported-by: Laura Abbott <labbott@redhat.com>
> Cc: Johannes Berg <johannes.berg@intel.com>
> Cc: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
> Cc: Luca Coelho <luciano.coelho@intel.com>
> Cc: Intel Linux Wireless <linuxwifi@intel.com>
> Cc: Kalle Valo <kvalo@codeaurora.org>
> Cc: stable <stable@vger.kernel.org> # 5.0
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> 
> 
> diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
> b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
> index 2453ceabf00d..6925527d8457 100644
> --- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
> +++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
> @@ -774,8 +774,7 @@ void iwl_mvm_vif_dbgfs_register(struct iwl_mvm
> *mvm, struct ieee80211_vif *vif)
>  		return;
>  
>  	mvmvif->dbgfs_dir = debugfs_create_dir("iwlmvm", dbgfs_dir);
> -
> -	if (!mvmvif->dbgfs_dir) {
> +	if (IS_ERR_OR_NULL(mvmvif->dbgfs_dir)) {
>  		IWL_ERR(mvm, "Failed to create debugfs directory under
> %pd\n",
>  			dbgfs_dir);
>  		return;

Thanks! I've applied this internally and will send upstream for v5.1-
rc* following our normal upstreaming process.

I added the other Reported-by that Laura asked for and added "mvm:" to
the subject.

--
Cheers,
Luca.
diff mbox series

Patch

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
index 2453ceabf00d..6925527d8457 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
@@ -774,8 +774,7 @@  void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 		return;
 
 	mvmvif->dbgfs_dir = debugfs_create_dir("iwlmvm", dbgfs_dir);
-
-	if (!mvmvif->dbgfs_dir) {
+	if (IS_ERR_OR_NULL(mvmvif->dbgfs_dir)) {
 		IWL_ERR(mvm, "Failed to create debugfs directory under %pd\n",
 			dbgfs_dir);
 		return;