From: Marc Dionne Date: Tue, 25 Mar 2025 12:59:05 +0000 (-0300) Subject: cachefiles: Fix oops in vfs_mkdir from cachefiles_get_directory X-Git-Tag: v6.15-rc1~53^2~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=406fad7698f5bf21ab6b5ca195bf4b9e0b3990ed;p=thirdparty%2Fkernel%2Flinux.git cachefiles: Fix oops in vfs_mkdir from cachefiles_get_directory Commit c54b386969a5 ("VFS: Change vfs_mkdir() to return the dentry.") changed cachefiles_get_directory, replacing "subdir" with a ERR_PTR from the result of cachefiles_inject_write_error, which is either 0 or some error code. This causes an oops when the resulting pointer is passed to vfs_mkdir. Use a similar pattern to what is used earlier in the function; replace subdir with either the return value from vfs_mkdir, or the ERR_PTR of the cachefiles_inject_write_error() return value, but only if it is non zero. Fixes: c54b386969a5 ("VFS: Change vfs_mkdir() to return the dentry.") cc: netfs@lists.linux.dev Signed-off-by: Marc Dionne Link: https://lore.kernel.org/r/20250325125905.395372-1-marc.dionne@auristor.com Signed-off-by: Christian Brauner --- diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c index 83a60126de0f4..14d0cc8940001 100644 --- a/fs/cachefiles/namei.c +++ b/fs/cachefiles/namei.c @@ -128,10 +128,11 @@ retry: ret = security_path_mkdir(&path, subdir, 0700); if (ret < 0) goto mkdir_error; - subdir = ERR_PTR(cachefiles_inject_write_error()); - if (!IS_ERR(subdir)) + ret = cachefiles_inject_write_error(); + if (ret == 0) subdir = vfs_mkdir(&nop_mnt_idmap, d_inode(dir), subdir, 0700); - ret = PTR_ERR(subdir); + else + subdir = ERR_PTR(ret); if (IS_ERR(subdir)) { trace_cachefiles_vfs_error(NULL, d_inode(dir), ret, cachefiles_trace_mkdir_error);