Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Low] proc: split __free(kvfree) declaration and initialization in pde_write_buf() --
commit e52627c4b4d80d32822781f143a8c1245bd64a2c Author: Christian Brauner <[email protected]> proc: let procfs copy in writes before pinning the entry This commit introduces a ->proc_write_buf() callback in struct proc_ops so that procfs can copy write data from userspace into a NUL-terminated kernel buffer before pinning the proc_dir_entry. This prevents userspace page faults during write copies from blocking remove_proc_entry(). > diff --git a/fs/proc/inode.c b/fs/proc/inode.c > index d51ab7548b117..df1caa0f238df 100644 > --- a/fs/proc/inode.c > +++ b/fs/proc/inode.c > @@ -417,11 +417,44 @@ static ssize_t pde_write(struct proc_dir_entry *pde, > struct file *file, const ch > return -EIO; > } > > +/* > + * procfs copies in what is written before it pins the entry. A writer that > + * faults on its buffer then doesn't hold up remove_proc_entry(). > + */ > +static ssize_t pde_write_buf(struct proc_dir_entry *pde, struct file *file, > + const char __user *ubuf, size_t count, loff_t > *ppos) > +{ > + char *buf __free(kvfree) = NULL; > + size_t size; > + ssize_t rv; > + > + size = pde->write_size; > + if (count > size) { > + if (!pde_has_short_writes(pde)) > + return -EINVAL; > + count = size; > + } > + buf = kvmalloc(count + 1, GFP_KERNEL); [Severity: Low] As reported by Sashiko on RFC [1], this isn't a bug, but in pde_write_buf() (called from proc_reg_write()), buf is declared with __free(kvfree) = NULL at the top of the function and assigned later with kvmalloc() after the count > size check. Per the Cleanup API conventions in include/linux/cleanup.h, should buf be defined and initialized in a single statement at the allocation site: char *buf __free(kvfree) = kvmalloc(count + 1, GFP_KERNEL); after validating count? [1] https://lore.kernel.org/r/[email protected] -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=14
