user/sven/linux.git/fs/debugfs, branch v5.1.14

debugfs: fix use-after-free on symlink traversal

2019-04-01T04:31:02Z

symlink body shouldn't be freed without an RCU delay. Switch debugfs to ->destroy_inode() and use of call_rcu(); free both the inode and symlink body in the callback. Similar to solution for bpf, only here it's even more obvious that ->evict_inode() can be dropped. Signed-off-by: Al Viro

Merge 5.0-rc6 into driver-core-next

2019-02-11T08:09:02Z

We need the debugfs fixes in here as well. Signed-off-by: Greg Kroah-Hartman

debugfs: debugfs_lookup() should return NULL if not found

2019-01-30T11:39:49Z

Lots of callers of debugfs_lookup() were just checking NULL to see if the file/directory was found or not. By changing this in ff9fb72bc077 ("debugfs: return error values, not NULL") we caused some subsystems to easily crash. Fixes: ff9fb72bc077 ("debugfs: return error values, not NULL") Reported-by: syzbot+b382ba6a802a3d242790@syzkaller.appspotmail.com Reported-by: Tetsuo Handa Cc: Omar Sandoval Cc: Jens Axboe Signed-off-by: Greg Kroah-Hartman

debugfs: return error values, not NULL

2019-01-29T20:28:35Z

When an error happens, debugfs should return an error pointer value, not NULL. This will prevent the totally theoretical error where a debugfs call fails due to lack of memory, returning NULL, and that dentry value is then passed to another debugfs call, which would end up succeeding, creating a file at the root of the debugfs tree, but would then be impossible to remove (because you can not remove the directory NULL). So, to make everyone happy, always return errors, this makes the users of debugfs much simpler (they do not have to ever check the return value), and everyone can rest easy. Reported-by: Gary R Hook Reported-by: Heiko Carstens Reported-by: Masami Hiramatsu Reported-by: Michal Hocko Reported-by: Sebastian Andrzej Siewior Reported-by: Ulf Hansson Reviewed-by: Masami Hiramatsu Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Greg Kroah-Hartman

debugfs: fix debugfs_rename parameter checking

2019-01-25T11:56:32Z

debugfs_rename() needs to check that the dentries passed into it really are valid, as sometimes they are not (i.e. if the return value of another debugfs call is passed into this one.) So fix this up by properly checking if the two parent directories are errors (they are allowed to be NULL), and if the dentry to rename is not NULL or an error. Cc: stable Signed-off-by: Greg Kroah-Hartman

debugfs: debugfs_use_start/finish do not exist anymore

2019-01-22T09:30:35Z

debugfs_use_file_start() and debugfs_use_file_finish() do not exist since commit c9afbec27089 ("debugfs: purge obsolete SRCU based removal protection"); tweak debugfs_create_file_unsafe() comment. Signed-off-by: Sergey Senozhatsky Reviewed-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman

Revert "debugfs: inode: debugfs_create_dir uses mode permission from parent"

2018-06-13T03:52:16Z

This reverts commit 95cde3c59966f6371b6bcd9e4e2da2ba64ee9775. The commit had good intentions, but it breaks kvm-tool and qemu-kvm. With it in place, "lkvm run" just fails with Error: KVM_CREATE_VM ioctl Warning: Failed init: kvm__init which isn't a wonderful error message, but bisection pinpointed the problematic commit. The problem is almost certainly due to the special kvm debugfs entries created dynamically by kvm under /sys/kernel/debug/kvm/. See kvm_create_vm_debugfs() Bisected-and-reported-by: Linus Torvalds Cc: Wanpeng Li Cc: Greg Kroah-Hartman Cc: Thomas Richter Cc: Kees Cook Signed-off-by: Linus Torvalds

debugfs: inode: debugfs_create_dir uses mode permission from parent

2018-05-14T14:48:18Z

Currently function debugfs_create_dir() creates a new directory in the debugfs (usually mounted /sys/kernel/debug) with permission rwxr-xr-x. This is hard coded. Change this to use the parent directory permission. Output before the patch: root@s8360047 ~]# tree -dp -L 1 /sys/kernel/debug/ /sys/kernel/debug/ ├── [drwxr-xr-x] bdi ├── [drwxr-xr-x] block ├── [drwxr-xr-x] dasd ├── [drwxr-xr-x] device_component ├── [drwxr-xr-x] extfrag ├── [drwxr-xr-x] hid ├── [drwxr-xr-x] kprobes ├── [drwxr-xr-x] kvm ├── [drwxr-xr-x] memblock ├── [drwxr-xr-x] pm_qos ├── [drwxr-xr-x] qdio ├── [drwxr-xr-x] s390 ├── [drwxr-xr-x] s390dbf └── [drwx------] tracing 14 directories [root@s8360047 linux]# Output after the patch: [root@s8360047 ~]# tree -dp -L 1 /sys/kernel/debug/ sys/kernel/debug/ ├── [drwx------] bdi ├── [drwx------] block ├── [drwx------] dasd ├── [drwx------] device_component ├── [drwx------] extfrag ├── [drwx------] hid ├── [drwx------] kprobes ├── [drwx------] kvm ├── [drwx------] memblock ├── [drwx------] pm_qos ├── [drwx------] qdio ├── [drwx------] s390 ├── [drwx------] s390dbf └── [drwx------] tracing 14 directories [root@s8360047 linux]# Here is the full diff output done with: [root@s8360047 ~]# diff -u treefull.before treefull.after | sed 's-^- # -' > treefull.diff # --- treefull.before 2018-04-27 13:22:04.532824564 +0200 # +++ treefull.after 2018-04-27 13:24:12.106182062 +0200 # @@ -1,55 +1,55 @@ # /sys/kernel/debug/ # -├── [drwxr-xr-x] bdi # -│ ├── [drwxr-xr-x] 1:0 # -│ ├── [drwxr-xr-x] 1:1 # -│ ├── [drwxr-xr-x] 1:10 # -│ ├── [drwxr-xr-x] 1:11 # -│ ├── [drwxr-xr-x] 1:12 # -│ ├── [drwxr-xr-x] 1:13 # -│ ├── [drwxr-xr-x] 1:14 # -│ ├── [drwxr-xr-x] 1:15 # -│ ├── [drwxr-xr-x] 1:2 # -│ ├── [drwxr-xr-x] 1:3 # -│ ├── [drwxr-xr-x] 1:4 # -│ ├── [drwxr-xr-x] 1:5 # -│ ├── [drwxr-xr-x] 1:6 # -│ ├── [drwxr-xr-x] 1:7 # -│ ├── [drwxr-xr-x] 1:8 # -│ ├── [drwxr-xr-x] 1:9 # -│ └── [drwxr-xr-x] 94:0 # -├── [drwxr-xr-x] block # -├── [drwxr-xr-x] dasd # -│ ├── [drwxr-xr-x] 0.0.e18a # -│ ├── [drwxr-xr-x] dasda # -│ └── [drwxr-xr-x] global # -├── [drwxr-xr-x] device_component # -├── [drwxr-xr-x] extfrag # -├── [drwxr-xr-x] hid # -├── [drwxr-xr-x] kprobes # -├── [drwxr-xr-x] kvm # -├── [drwxr-xr-x] memblock # -├── [drwxr-xr-x] pm_qos # -├── [drwxr-xr-x] qdio # -│ └── [drwxr-xr-x] 0.0.f5f2 # -├── [drwxr-xr-x] s390 # -│ └── [drwxr-xr-x] stsi # -├── [drwxr-xr-x] s390dbf # -│ ├── [drwxr-xr-x] 0.0.e18a # -│ ├── [drwxr-xr-x] cio_crw # -│ ├── [drwxr-xr-x] cio_msg # -│ ├── [drwxr-xr-x] cio_trace # -│ ├── [drwxr-xr-x] dasd # -│ ├── [drwxr-xr-x] kvm-trace # -│ ├── [drwxr-xr-x] lgr # -│ ├── [drwxr-xr-x] qdio_0.0.f5f2 # -│ ├── [drwxr-xr-x] qdio_error # -│ ├── [drwxr-xr-x] qdio_setup # -│ ├── [drwxr-xr-x] qeth_card_0.0.f5f0 # -│ ├── [drwxr-xr-x] qeth_control # -│ ├── [drwxr-xr-x] qeth_msg # -│ ├── [drwxr-xr-x] qeth_setup # -│ ├── [drwxr-xr-x] vmcp # -│ └── [drwxr-xr-x] vmur # +├── [drwx------] bdi # +│ ├── [drwx------] 1:0 # +│ ├── [drwx------] 1:1 # +│ ├── [drwx------] 1:10 # +│ ├── [drwx------] 1:11 # +│ ├── [drwx------] 1:12 # +│ ├── [drwx------] 1:13 # +│ ├── [drwx------] 1:14 # +│ ├── [drwx------] 1:15 # +│ ├── [drwx------] 1:2 # +│ ├── [drwx------] 1:3 # +│ ├── [drwx------] 1:4 # +│ ├── [drwx------] 1:5 # +│ ├── [drwx------] 1:6 # +│ ├── [drwx------] 1:7 # +│ ├── [drwx------] 1:8 # +│ ├── [drwx------] 1:9 # +│ └── [drwx------] 94:0 # +├── [drwx------] block # +├── [drwx------] dasd # +│ ├── [drwx------] 0.0.e18a # +│ ├── [drwx------] dasda # +│ └── [drwx------] global # +├── [drwx------] device_component # +├── [drwx------] extfrag # +├── [drwx------] hid # +├── [drwx------] kprobes # +├── [drwx------] kvm # +├── [drwx------] memblock # +├── [drwx------] pm_qos # +├── [drwx------] qdio # +│ └── [drwx------] 0.0.f5f2 # +├── [drwx------] s390 # +│ └── [drwx------] stsi # +├── [drwx------] s390dbf # +│ ├── [drwx------] 0.0.e18a # +│ ├── [drwx------] cio_crw # +│ ├── [drwx------] cio_msg # +│ ├── [drwx------] cio_trace # +│ ├── [drwx------] dasd # +│ ├── [drwx------] kvm-trace # +│ ├── [drwx------] lgr # +│ ├── [drwx------] qdio_0.0.f5f2 # +│ ├── [drwx------] qdio_error # +│ ├── [drwx------] qdio_setup # +│ ├── [drwx------] qeth_card_0.0.f5f0 # +│ ├── [drwx------] qeth_control # +│ ├── [drwx------] qeth_msg # +│ ├── [drwx------] qeth_setup # +│ ├── [drwx------] vmcp # +│ └── [drwx------] vmur # └── [drwx------] tracing # ├── [drwxr-xr-x] events # │ ├── [drwxr-xr-x] alarmtimer Fixes: edac65eaf8d5c ("debugfs: take mode-dependent parts of debugfs_get_inode() into callers") Signed-off-by: Thomas Richter Reviewed-by: Kees Cook Signed-off-by: Greg Kroah-Hartman

debugfs: Re-use kstrtobool_from_user()

2018-05-14T14:48:18Z

Re-use kstrtobool_from_user() instead of open coded variant. Signed-off-by: Andy Shevchenko Signed-off-by: Greg Kroah-Hartman

debugfs_lookup(): switch to lookup_one_len_unlocked()

2018-03-29T19:07:47Z

Signed-off-by: Al Viro