[PATCH v1] sysfs: fix sysfs_kf_seq_show null pointer dereference

[Will McVicker]

When the kobj->ktype is null, sysfs_file_ops() returns a NULL pointer
for the sysfs_ops. When this happens, we hit a kernel panic in
sysfs_kf_seq_show() by dereferencing ops to check if ->show is NULL.
Based on commit 820879ee1865 ("sysfs: simplify sysfs_kf_seq_show"), it
sounds like we won't hit this often, but I have randomly hit this on my
Pixel 6 with 5.19-rc1. Refer to the crash stack below:

   Unable to handle kernel paging request at virtual address ...
   Internal error: Oops: 96000004 [#1] PREEMPT SMP
   Hardware name: Oriole EVT 1.0 (DT)
   pc : sysfs_kf_seq_show+0x3c/0x160
   lr : kernfs_seq_show+0x54/0xa0
   Call trace:
    sysfs_kf_seq_show+0x3c/0x160
    kernfs_seq_show+0x54/0xa0
    seq_read_iter+0x17c/0x638
    kernfs_fop_read_iter+0x70/0x1f4
    vfs_read+0x240/0x36c
    ksys_read+0x7c/0xf0
    __arm64_sys_read+0x20/0x30
    invoke_syscall+0x60/0x150
    el0_svc_common+0xb8/0x100
    do_el0_svc+0x30/0xd4
    el0_svc+0x30/0xc0
    el0t_64_sync_handler+0x88/0xf8
    el0t_64_sync+0x1a0/0x1a4

Fixes: 820879ee1865 ("sysfs: simplify sysfs_kf_seq_show")
Signed-off-by: Will McVicker <willmcvicker@xxxxxxxxxx>
---
 fs/sysfs/file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index a12ac0356c69..f09f86f10410 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -45,7 +45,7 @@ static int sysfs_kf_seq_show(struct seq_file *sf, void *v)
 	ssize_t count;
 	char *buf;
 
-	if (WARN_ON_ONCE(!ops->show))
+	if (WARN_ON_ONCE(!ops || !ops->show))
 		return -EINVAL;
 
 	/* acquire buffer and ensure that it's >= PAGE_SIZE and clear */
-- 
2.36.1.476.g0c4daa206d-goog