Skip to content

Commit a0e25f0

Browse files
DaveWysochanskiRHdhowells
authored andcommitted
cachefiles: Fix oops with cachefiles_cull() due to NULL object
When cachefiles_cull() calls cachefiles_bury_object(), it passes a NULL object. When this occurs, either trace_cachefiles_unlink() or trace_cachefiles_rename() may oops due to the NULL object. Check for NULL object in the tracepoint and if so, set debug_id to MAX_UINT as was done in 2908f5e. The following oops was seen with xfstests generic/100. BUG: kernel NULL pointer dereference, address: 0000000000000010 ... RIP: 0010:trace_event_raw_event_cachefiles_unlink+0x4e/0xa0 [cachefiles] ... Call Trace: cachefiles_bury_object+0x242/0x430 [cachefiles] ? __vfs_removexattr_locked+0x10f/0x150 ? vfs_removexattr+0x51/0xd0 cachefiles_cull+0x84/0x120 [cachefiles] cachefiles_daemon_cull+0xd1/0x120 [cachefiles] cachefiles_daemon_write+0x158/0x190 [cachefiles] vfs_write+0xbc/0x260 ksys_write+0x4f/0xc0 do_syscall_64+0x3b/0x90 The following oops was seen with xfstests generic/290. BUG: kernel NULL pointer dereference, address: 0000000000000010 ... RIP: 0010:trace_event_raw_event_cachefiles_rename+0x54/0xa0 [cachefiles] ... Call Trace: cachefiles_bury_object+0x35c/0x430 [cachefiles] cachefiles_cull+0x84/0x120 [cachefiles] cachefiles_daemon_cull+0xd1/0x120 [cachefiles] cachefiles_daemon_write+0x158/0x190 [cachefiles] vfs_write+0xbc/0x260 ksys_write+0x4f/0xc0 do_syscall_64+0x3b/0x90 Fixes: 2908f5e ("fscache: Add a cookie debug ID and use that in traces") Signed-off-by: Dave Wysochanski <[email protected]> Signed-off-by: David Howells <[email protected]> Link: https://listman.redhat.com/archives/linux-cachefs/2021-October/msg00009.html
1 parent 9e1ff30 commit a0e25f0

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

include/trace/events/cachefiles.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,7 @@ TRACE_EVENT(cachefiles_unlink,
178178
),
179179

180180
TP_fast_assign(
181-
__entry->obj = obj->fscache.debug_id;
181+
__entry->obj = obj ? obj->fscache.debug_id : UINT_MAX;
182182
__entry->de = de;
183183
__entry->why = why;
184184
),
@@ -205,7 +205,7 @@ TRACE_EVENT(cachefiles_rename,
205205
),
206206

207207
TP_fast_assign(
208-
__entry->obj = obj->fscache.debug_id;
208+
__entry->obj = obj ? obj->fscache.debug_id : UINT_MAX;
209209
__entry->de = de;
210210
__entry->to = to;
211211
__entry->why = why;

0 commit comments

Comments
 (0)