Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9c458dd1 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

kvm: properly check debugfs dentry before using it 



[ Upstream commit 8ed0579c12b2fe56a1fac2f712f58fc26c1dc49b ]

debugfs can now report an error code if something went wrong instead of
just NULL.  So if the return value is to be used as a "real" dentry, it
needs to be checked if it is an error before dereferencing it.

This is now happening because of ff9fb72bc077 ("debugfs: return error
values, not NULL").  syzbot has found a way to trigger multiple debugfs
files attempting to be created, which fails, and then the error code
gets passed to dentry_path_raw() which obviously does not like it.

Reported-by: default avatarEric Biggers <ebiggers@kernel.org>
Reported-and-tested-by: default avatar <syzbot+7857962b4d45e602b8ad@syzkaller.appspotmail.com>
Cc: "Radim Krčmář" <rkrcmar@redhat.com>
Cc: kvm@vger.kernel.org
Acked-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 4ccab178

virt/kvm/kvm_main.c

+1 −1
Original line number Diff line number Diff line
@@ -3990,7 +3990,7 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm) 
	}

	add_uevent_var(env, "PID=%d", kvm->userspace_pid);



	if (kvm->debugfs_dentry) {

	if (!IS_ERR_OR_NULL(kvm->debugfs_dentry)) {

		char *tmp, *p = kmalloc(PATH_MAX, GFP_KERNEL);



		if (p) {