On 8 September 2026 16:29:31 BST, Mathieu Desnoyers <[email protected]> wrote: >On 2026-09-08 11:24, Bradley Morgan wrote: >> On 8 September 2026 16:22:14 BST, Mathieu Desnoyers >> <[email protected]> wrote: >>> When hazptr_acquire loads a NULL pointer, it sets: >>> >>> - slot_item->slot.addr = NULL, >>> - slot_item->ctx.ctx = ctx >>> - ctx->slot = slot >>> >>> And it returns NULL. >>> >>> Then hazptr_detach is called on this ctx, it will act on the ctx as if >>> needed to be promoted to backup slot, even though it has a NULL addr. >>> >>> Looking at what hazptr_note_context_switch() does before promoting >>> to backup slot, it checks for a NULL slot->addr, which is exactly >>> what is missing from hazptr_detach. >>> >>> With this in place there would be no need to explicitly check the >>> hazptr_acquire() return value before calling hazptr_detach(). >>> >>> hazptr_release() has a early return check for NULL addr as well, so it >>> makes sense that detach does an early return (no-op) similarly. >>> >> >> You shall kill me for this!! >> >> Could you perhaps do a splat in ze commit description pls? > >The splat is available at the "Closes" URL below. I'm not sure whether >we should duplicate this verbose information ? > >Paul ? >
This is a example of what I did. >From 8861f6d5c0678a7c5089c7b272509fc5931b8437 Mon Sep 17 00:00:00 2001 From: Bradley Morgan <[email protected]> Date: Thu, 27 Aug 2026 17:43:38 +0000 Subject: ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() From: Bradley Morgan <[email protected]> commit 8861f6d5c0678a7c5089c7b272509fc5931b8437 upstream. dentry_path() returns ERR_PTR(-ENAMETOOLONG) when the path exceeds the buffer. validate_hash_algo() passes the result straight to integrity_audit_msg() without checking. ERR_PTR is not NULL, so integrity_audit_message() sees a valid pointer and calls strlen() on it, which faults: BUG: unable to handle page fault for address: ffffffffffffffdc RIP: 0010:strlen+0x30/0xa0 Call Trace: audit_log_untrustedstring+0x19/0x30 integrity_audit_message+0x366/0x4f0 ima_inode_setxattr+0x512/0x5f0 Check for IS_ERR() and use NULL instead, which makes the audit message skip the name= field instead of crashing. Fixes: 4f2946aa0c45 ("IMA: introduce a new policy option func=SETXATTR_CHECK") Cc: [email protected] Reported-by: [email protected] Link: https://lore.kernel.org/all/[email protected]/ Signed-off-by: Bradley Morgan <[email protected]> Signed-off-by: Mimi Zohar <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> security/integrity/ima/ima_appraise.c | 2 ++ 1 file changed, 2 insertions(+) --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -754,6 +754,8 @@ static int validate_hash_algo(struct den return -EACCES; path = dentry_path(dentry, pathbuf, PATH_MAX); + if (IS_ERR(path)) + path = NULL; integrity_audit_msg(AUDIT_INTEGRITY_DATA, d_inode(dentry), path, "set_data", errmsg, -EACCES, 0); >Thanks, > >Mathieu > >> >> >>> Fixes: 6357ec235c59 ("hazptrtorture: Fix hazptr ownership issue") >>> Reported-by: kernel test robot <[email protected]> >>> Closes: >https://lore.kernel.org/oe-lkp/[email protected] >>> Signed-off-by: Mathieu Desnoyers <[email protected]> >>> Reviewed-by: Bradley Morgan <[email protected]> >>> Cc: Paul E. McKenney <[email protected]> >>> Cc: Boqun Feng <[email protected]> >>> Cc: Bradley Morgan <[email protected]> >>> Cc: <[email protected]> >>> Cc: <[email protected]> >>> --- >>> include/linux/hazptr.h | 4 +++- >>> 1 file changed, 3 insertions(+), 1 deletion(-) >>> >>> diff --git a/include/linux/hazptr.h b/include/linux/hazptr.h >>> index 43122c5673bd..d1670121947a 100644 >>> --- a/include/linux/hazptr.h >>> +++ b/include/linux/hazptr.h >>> @@ -160,10 +160,12 @@ void hazptr_detach(struct hazptr_ctx *ctx) >>> struct hazptr_slot *slot; >>> >>> guard(preempt)(); >>> + slot = ctx->slot; >>> + if (!slot->addr) >>> + return; >>> #ifdef CONFIG_HAZPTR_DEBUG >>> ctx->detach_task = ctx->detach_cpu = true; >>> #endif >>> - slot = ctx->slot; >>> if (unlikely(hazptr_slot_is_backup(ctx, slot))) >>> return; >>> hazptr_promote_to_backup_slot(ctx, slot); >>> >> >> --- Thanks! >> >https://lore.kernel.org/all/[email protected]/ > > > --- Thanks! https://lore.kernel.org/all/[email protected]/
