The dcache_dir_open_wrapper() could be called when a dynamic event is being deleted leaving a dentry with no children. In this case the dlist->dentries array will never be allocated. This needs to be checked for in eventfs_release(), otherwise it will trigger a NULL pointer dereference. Link: https://lore.kernel.org/linux-trace-kernel/20230930090106.1c3164e9@rorschach.local.home
Unified · Split
| @@ -421,7 +421,7 @@ static int eventfs_release(struct inode *inode, struct file *file) · 420 unmodified lines | |||
| 421 | if (WARN_ON_ONCE(!dlist)) | 421 | if (WARN_ON_ONCE(!dlist)) |
| 422 | return -EINVAL; | 422 | return -EINVAL; |
| 423 | 423 | ||
| 424 | for (i = 0; dlist->dentries[i]; i++) { | 424 | for (i = 0; dlist->dentries && dlist->dentries[i]; i++) { |
| 425 | dput(dlist->dentries[i]); | 425 | dput(dlist->dentries[i]); |
| 426 | } | 426 | } |
| 427 | 427 | ||