lkml.org 
[lkml]   [2013]   [Apr]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[ 09/56] sysfs: handle failure path correctly for readdir()
    Date
    3.0-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Ming Lei <ming.lei@canonical.com>

    commit e5110f411d2ee35bf8d202ccca2e89c633060dca upstream.

    In case of 'if (filp->f_pos == 0 or 1)' of sysfs_readdir(),
    the failure from filldir() isn't handled, and the reference counter
    of the sysfs_dirent object pointed by filp->private_data will be
    released without clearing filp->private_data, so use after free
    bug will be triggered later.

    This patch returns immeadiately under the situation for fixing the bug,
    and it is reasonable to return from readdir() when filldir() fails.

    Reported-by: Dave Jones <davej@redhat.com>
    Tested-by: Sasha Levin <levinsasha928@gmail.com>
    Signed-off-by: Ming Lei <ming.lei@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/sysfs/dir.c | 4 ++++
    1 file changed, 4 insertions(+)

    --- a/fs/sysfs/dir.c
    +++ b/fs/sysfs/dir.c
    @@ -917,6 +917,8 @@ static int sysfs_readdir(struct file * f
    ino = parent_sd->s_ino;
    if (filldir(dirent, ".", 1, filp->f_pos, ino, DT_DIR) == 0)
    filp->f_pos++;
    + else
    + return 0;
    }
    if (filp->f_pos == 1) {
    if (parent_sd->s_parent)
    @@ -925,6 +927,8 @@ static int sysfs_readdir(struct file * f
    ino = parent_sd->s_ino;
    if (filldir(dirent, "..", 2, filp->f_pos, ino, DT_DIR) == 0)
    filp->f_pos++;
    + else
    + return 0;
    }
    mutex_lock(&sysfs_mutex);
    for (pos = sysfs_dir_pos(ns, parent_sd, filp->f_pos, pos);



    \
     
     \ /
      Last update: 2013-04-03 02:41    [W:4.024 / U:0.280 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site