blk-mq: protect debugfs_create_files() from failures

gregkh · gregkh · commit 36991ca68db9 · 2019-01-31T14:07:59.000+01:00
If debugfs were to return a non-NULL error for a debugfs call, using
that pointer later in debugfs_create_files() would crash.

Fix that by properly checking the pointer before referencing it.

Reported-by: Michal Hocko &lt;mhocko@kernel.org&gt;
Reported-and-tested-by: syzbot+b382ba6a802a3d242790@syzkaller.appspotmail.com
Reported-by: Tetsuo Handa &lt;penguin-kernel@I-love.SAKURA.ne.jp&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
@@ -838,6 +838,9 @@ static const struct blk_mq_debugfs_attr blk_mq_debugfs_ctx_attrs[] = {
 static bool debugfs_create_files(struct dentry *parent, void *data,
 				 const struct blk_mq_debugfs_attr *attr)
 {
+	if (IS_ERR_OR_NULL(parent))
+		return false;
+
 	d_inode(parent)->i_private = data;
 
 	for (; attr->name; attr++) {

Original file line number	Diff line number	Diff line change
`@@ -838,6 +838,9 @@ static const struct blk_mq_debugfs_attr blk_mq_debugfs_ctx_attrs[] = {`
`838`	`838`	`static bool debugfs_create_files(struct dentry parent, void data,`
`839`	`839`	`const struct blk_mq_debugfs_attr *attr)`
`840`	`840`	`{`
	`841`	`+ if (IS_ERR_OR_NULL(parent))`
	`842`	`+ return false;`
	`843`	`+`
`841`	`844`	`d_inode(parent)->i_private = data;`
`842`	`845`
`843`	`846`	`for (; attr->name; attr++) {`