Re: general protection fault in relay_open_buf

[Greg KH]

On Thu, Jan 31, 2019 at 08:29:37PM +0900, Tetsuo Handa wrote:
> On 2019/01/31 19:51, Greg KH wrote:
> > Can you test the patch below?
> 
> You can ask syzbot to test the patch. But
> 
> > @@ -461,7 +463,7 @@ static struct rchan_buf *relay_open_buf(struct rchan *chan, unsigned int cpu)
> >  		dentry = chan->cb->create_buf_file(NULL, NULL,
> >  						   S_IRUSR, buf,
> >  						   &chan->is_global);
> > -		if (WARN_ON(dentry))
> > +		if (IS_ERR_OR_NULL(dentry))
> >  			goto free_buf;
> 
> are you trying to fix a different bug together that old code was by error bailing
> out when chan->cb->create_buf_file() returned a valid "struct dentry *" ?
> I don't know what WARN_ON() due to a valid "struct dentry *" means...

I don't either, I'm guessing that's a code path that has never been
taken, or everyone just ignores it :)

Anyway, I fixed it up to be safe.  And the reproducer shows it now works
properly too.

thanks,

greg k-h