On Wed, Jan 30, 2019 at 08:11:17PM +0900, Tetsuo Handa wrote:
> Hello, Omar.
>
> syzbot is reporting a crash due to dput(-EINVAL) [1]. I think the location is
>
> dir = debugfs_lookup(buts->name, blk_debugfs_root);
> if (!dir)
> bt->dir = dir = debugfs_create_dir(buts->name, blk_debugfs_root);
>
> added by commit 6ac93117ab009d39 ("blktrace: use existing disk debugfs directory").
>
> Currently, Greg Kroah-Hartman is posting patches:
>
> When calling debugfs functions, there is no need to ever check the
> return value. The function can work or not, but the code logic should
> never do something different based on this.
>
> Omar, what do you want to do for this case?
>
> [1] https://syzkaller.appspot.com/bug?extid=b382ba6a802a3d242790
>
Obviously debugfs_lookup() should have its return value checked, so
that's fine :)
But how are we getting an error with dput()? Are you sure this is a
debugfs issue and not a relayfs problem?
I'll send patches to clean up the tracing code's use of debugfs later,
as it is, I don't see anything obviously wrong with it.
thanks,
greg k-h
