2013-06-06 09:46:40

by Nick Dyer

Subject: [PATCH] Fix null pointer dereference caused by sysfs_notify on binary attribute

It would be nice to have this work as expected but for now this is a minimal
fix to prevent the kernel panic.

Signed-off-by: Nick Dyer <[email protected]>
---
fs/sysfs/file.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 602f56d..976819b 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -449,10 +449,12 @@ void sysfs_notify_dirent(struct sysfs_dirent *sd)

spin_lock_irqsave(&sysfs_open_dirent_lock, flags);

- od = sd->s_attr.open;
- if (od) {
- atomic_inc(&od->event);
- wake_up_interruptible(&od->poll);
+ if (sd->s_attr) {
+ od = sd->s_attr.open;
+ if (od) {
+ atomic_inc(&od->event);
+ wake_up_interruptible(&od->poll);
+ }
}

spin_unlock_irqrestore(&sysfs_open_dirent_lock, flags);
--
1.7.10.4

2013-06-06 15:26:14

by Greg Kroah-Hartman

Subject: Re: [PATCH] Fix null pointer dereference caused by sysfs_notify on binary attribute

On Thu, Jun 06, 2013 at 10:45:20AM +0100, Nick Dyer wrote:
> It would be nice to have this work as expected but for now this is a minimal
> fix to prevent the kernel panic.

Is anyone calling sysfs_notify on a binary attribute today? Or can this
go into 3.11?

thanks,

greg k-h

2013-06-06 15:36:49

by Nick Dyer

Subject: Re: [PATCH] Fix null pointer dereference caused by sysfs_notify on binary attribute

Greg KH wrote:
> On Thu, Jun 06, 2013 at 10:45:20AM +0100, Nick Dyer wrote:
>> It would be nice to have this work as expected but for now this is a minimal
>> fix to prevent the kernel panic.
>
> Is anyone calling sysfs_notify on a binary attribute today? Or can this
> go into 3.11?

Nope. I think I'm the first person to try it. So 3.11 is fine.

2013-06-06 19:37:55

by Greg Kroah-Hartman

Subject: Re: [PATCH] sysfs: Fix null pointer dereference caused by sysfs_notify on binary attribute

On Thu, Jun 06, 2013 at 10:45:20AM +0100, Nick Dyer wrote:
> If sysfs_notify is called on a binary attribute, bad things can
> happen, so prevent it.
>
> Note, no in-kernel usage of this is currently present, but in the
> future, it's good to be safe.
>
> Signed-off-by: Nick Dyer <[email protected]>
> ---
> fs/sysfs/file.c | 10 ++++++----
> 1 file changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
> index 602f56d..976819b 100644
> --- a/fs/sysfs/file.c
> +++ b/fs/sysfs/file.c
> @@ -449,10 +449,12 @@ void sysfs_notify_dirent(struct sysfs_dirent *sd)
>
> spin_lock_irqsave(&sysfs_open_dirent_lock, flags);
>
> - od = sd->s_attr.open;
> - if (od) {
> - atomic_inc(&od->event);
> - wake_up_interruptible(&od->poll);
> + if (sd->s_attr) {
> + od = sd->s_attr.open;
> + if (od) {
> + atomic_inc(&od->event);
> + wake_up_interruptible(&od->poll);
> + }

Please test build your patches, it makes kernel maintainers very grumpy
when you send them patches that are obviously broken :(

greg k-h

2013-06-07 14:45:19

by Nick Dyer

Subject: [PATCH V2] sysfs_notify is only possible on file attributes

If sysfs_notify is called on a binary attribute, bad things can
happen, so prevent it.

Note, no in-kernel usage of this is currently present, but in the
future, it's good to be safe.

Changes in V2:
- Also ignore sysfs_notify on dirs, links
- Use WARN_ON rather than silently failing
- Compiled and tested (huge apologies about first submission)

Signed-off-by: Nick Dyer <[email protected]>
---
fs/sysfs/file.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 602f56d..d2bb7ed 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -449,10 +449,12 @@ void sysfs_notify_dirent(struct sysfs_dirent *sd)

spin_lock_irqsave(&sysfs_open_dirent_lock, flags);

- od = sd->s_attr.open;
- if (od) {
- atomic_inc(&od->event);
- wake_up_interruptible(&od->poll);
+ if (!WARN_ON(sysfs_type(sd) != SYSFS_KOBJ_ATTR)) {
+ od = sd->s_attr.open;
+ if (od) {
+ atomic_inc(&od->event);
+ wake_up_interruptible(&od->poll);
+ }
}

spin_unlock_irqrestore(&sysfs_open_dirent_lock, flags);
--
1.7.10.4