From: Luis Chamberlain mcgrof@kernel.org
mainline inclusion from mainline-v5.9-rc1 commit b431ef837e3374da0db8ff6683170359aaa0859c category: bugfix bugzilla: 30213 CVE: CVE-2019-19770
---------------------------
We make an assumption that a debugfs directory exists, but since this can fail ensure it exists before allowing blktrace setup to complete. Otherwise we end up stuffing blktrace files on the debugfs root directory. In the worst case scenario this *in theory* can create an eventual panic *iff* in the future a similarly named file is created prior on the debugfs root directory. This theoretical crash can happen due to a recursive removal followed by a specific dentry removal.
This doesn't fix any known crash, however I have seen the files go into the main debugfs root directory in cases where the debugfs directory was not created due to other internal bugs with blktrace now fixed.
blktrace is also completely useless without this directory, so this ensures to userspace we only setup blktrace if the kernel can stuff files where they are supposed to go into.
debugfs directory creations typically aren't checked for, and we have maintainers doing sweep removals of these checks, but since we need this check to ensure proper userspace blktrace functionality we make sure to annotate the justification for the check.
Signed-off-by: Luis Chamberlain mcgrof@kernel.org Reviewed-by: Christoph Hellwig hch@lst.de Reviewed-by: Bart Van Assche bvanassche@acm.org Signed-off-by: Jens Axboe axboe@kernel.dk
Conflict: kernel/trace/blktrace.c Signed-off-by: Yu Kuai yukuai3@huawei.com Reviewed-by: Yufen Yu yuyufen@huawei.com Signed-off-by: Yang Yingliang yangyingliang@huawei.com --- kernel/trace/blktrace.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c index 04ec425b44f45..da0ee8cc15a72 100644 --- a/kernel/trace/blktrace.c +++ b/kernel/trace/blktrace.c @@ -534,8 +534,18 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev, else #endif bt->dir = dir = debugfs_create_dir(buts->name, blk_debugfs_root); - if (!dir) + + /* + * As blktrace relies on debugfs for its interface the debugfs directory + * is required, contrary to the usual mantra of not checking for debugfs + * files or directories. + */ + if (IS_ERR_OR_NULL(dir)) { + pr_warn("debugfs_dir not present for %s so skipping\n", + buts->name); + ret = -ENOENT; goto err; + }
bt->dev = dev; atomic_set(&bt->dropped, 0);