[PATCH] tracefs: Check for dentry->d_inode exists in set_gid()

[Steven Rostedt]

From: "Steven Rostedt (Google)" <rost...@goodmis.org>

If a getdents() is called on the tracefs directory but does not get all
the files, it can leave a "cursor" dentry in the d_subdirs list of tracefs
dentry. This cursor dentry does not have a d_inode for it. Before
referencing tracefs_inode from the dentry, the d_inode must first be
checked if it has content. If not, then it's not a tracefs_inode and can
be ignored.

The following caused a crash:

 #define getdents64(fd, dirp, count) syscall(SYS_getdents64, fd, dirp, count)
 #define BUF_SIZE 256
 #define TDIR "/tmp/file0"

 int main(void)
 {
        char buf[BUF_SIZE];
        int fd;
        int n;

        mkdir(TDIR, 0777);
        mount(NULL, TDIR, "tracefs", 0, NULL);
        fd = openat(AT_FDCWD, TDIR, O_RDONLY);
        n = getdents64(fd, buf, BUF_SIZE);
        ret = mount(NULL, TDIR, NULL, 
MS_NOSUID|MS_REMOUNT|MS_RELATIME|MS_LAZYTIME,
                    "gid=1000");
        return 0;
 }

That's because the 256 BUF_SIZE was not big enough to read all the
dentries of the tracefs file system and it left a "cursor" dentry in the
subdirs of the tracefs root inode. Then on remounting with "gid=1000",
it would cause an iteration of all dentries which hit:

        ti = get_tracefs(dentry->d_inode);
        if (ti && (ti->flags & TRACEFS_EVENT_INODE))
                eventfs_update_gid(dentry, gid);

Which crashed because of the dereference of the cursor dentry which had a NULL
d_inode.

Link: https://lore.kernel.org/all/20240102135637.3a21f...@gandalf.local.home/

Cc: sta...@vger.kernel.org
Fixes: 7e8358edf503e ("eventfs: Fix file and directory uid and gid ownership")
Reported-by: "Ubisectech Sirius" <bugrep...@ubisectech.com>
Signed-off-by: Steven Rostedt (Google) <rost...@goodmis.org>
---
 fs/tracefs/inode.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
index 62524b20964e..c29387a36bc8 100644
--- a/fs/tracefs/inode.c
+++ b/fs/tracefs/inode.c
@@ -219,10 +219,13 @@ static void set_gid(struct dentry *parent, kgid_t gid)
 
                change_gid(dentry, gid);
 
-               /* If this is the events directory, update that too */
-               ti = get_tracefs(dentry->d_inode);
-               if (ti && (ti->flags & TRACEFS_EVENT_INODE))
-                       eventfs_update_gid(dentry, gid);
+               /* Note, getdents() can add a cursor dentry with no inode */
+               if (dentry->d_inode) {
+                       /* If this is the events directory, update that too */
+                       ti = get_tracefs(dentry->d_inode);
+                       if (ti && (ti->flags & TRACEFS_EVENT_INODE))
+                               eventfs_update_gid(dentry, gid);
+               }
 
                if (!list_empty(&dentry->d_subdirs)) {
                        spin_unlock(&this_parent->d_lock);
-- 
2.42.0