On Sat, Dec 02, 2023 at 01:22:15PM -0800, Kees Cook wrote:
> static void *pstore_ftrace_seq_start(struct seq_file *s, loff_t *pos)
> {
> @@ -338,9 +339,8 @@ int pstore_mkfile(struct dentry *root, struct pstore_record *record)
> {
> struct dentry *dentry;
> struct inode *inode __free(iput) = NULL;
> - int rc = 0;
> char name[PSTORE_NAMELEN];
> - struct pstore_private *private, *pos;
> + struct pstore_private *private __free(pstore_private) = NULL, *pos;
> size_t size = record->size + record->ecc_notice_size;
>
> if (WARN_ON(!inode_is_locked(d_inode(root))))
> @@ -356,7 +356,6 @@ int pstore_mkfile(struct dentry *root, struct pstore_record *record)
> return -EEXIST;
> }
>
> - rc = -ENOMEM;
> inode = pstore_get_inode(root->d_sb);
> if (!inode)
> return -ENOMEM;
> @@ -373,7 +372,7 @@ int pstore_mkfile(struct dentry *root, struct pstore_record *record)
>
> dentry = d_alloc_name(root, name);
> if (!dentry)
> - goto fail_private;
> + return -ENOMEM;
>
> private->dentry = dentry;
> private->record = record;
> @@ -386,13 +385,9 @@ int pstore_mkfile(struct dentry *root, struct pstore_record *record)
>
> d_add(dentry, no_free_ptr(inode));
>
> - list_add(&private->list, &records_list);
> + list_add(&(no_free_ptr(private))->list, &records_list);
That's really brittle. It critically depends upon having no failure
exits past the assignment to ->i_private; once you've done that,
you have transferred the ownership of that thing to the inode
(look at your ->evict_inode()). But you can't say
inode->i_private = no_free_ptr(private);
since you are using private past that point.
