From: Greg Kroah-Hartman <greg@kroah.com>
To: Sasha Levin <levinsasha928@gmail.com>
Cc: Ming Lei <tom.leiming@gmail.com>, Hillf Danton <dhillf@gmail.com>,
Dave Jones <davej@redhat.com>,
Linux Kernel <linux-kernel@vger.kernel.org>
Subject: Re: use after free in sysfs_find_dirent
Date: Wed, 20 Mar 2013 10:17:56 -0700 [thread overview]
Message-ID: <20130320171756.GA28605@kroah.com> (raw)
In-Reply-To: <5149C900.6020709@gmail.com>
On Wed, Mar 20, 2013 at 10:34:40AM -0400, Sasha Levin wrote:
> On 03/19/2013 09:02 PM, Ming Lei wrote:
> > Hi Sasha,
> >
> > On Wed, Mar 20, 2013 at 12:28 AM, Sasha Levin <levinsasha928@gmail.com> wrote:
> >> On 03/19/2013 07:54 AM, Ming Lei wrote:
> >>
> >> With v3 of the patch:
> >>
> >> [ 1275.665758] sysfs_dir_pos-973 sysfs_dirent use after free: tun(tun)-uevent, 2-1472641949
> >
> > Thanks again for your test.
> >
> > Looks it is caused by another bug in sysfs_readdir: if filldir() returns
> > failure(such as small buffer length passed from userspace, very probably
> > for trinity) in case of 'if (filp->f_pos == 0 or 1)',
> > filp->private_data still will
> > point to one refcount-balanced sysfs_dirent object.
> >
> > V4 adds fix for this situation, please test attachment v4 patch.
>
> With this one it didn't happen at all during overnight tests so looks like it did
> the job.
Thanks for testing, and thanks Ming, for finding and fixing this.
greg k-h
next prev parent reply other threads:[~2013-03-20 17:16 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-03-07 5:28 use after free in sysfs_find_dirent Dave Jones
2013-03-07 5:33 ` sysfs_dir_cache slab corruption Dave Jones
2013-03-07 6:03 ` Greg Kroah-Hartman
2013-03-07 6:02 ` use after free in sysfs_find_dirent Greg Kroah-Hartman
2013-03-07 6:26 ` Dave Jones
2013-03-13 11:47 ` Ming Lei
2013-03-15 4:03 ` Sasha Levin
2013-03-15 5:04 ` Sasha Levin
2013-03-15 7:38 ` Ming Lei
2013-03-15 16:27 ` Sasha Levin
2013-03-16 12:39 ` Hillf Danton
2013-03-16 13:30 ` Ming Lei
2013-03-16 15:07 ` Sasha Levin
2013-03-16 15:22 ` Ming Lei
2013-03-16 15:58 ` Ming Lei
2013-03-16 18:33 ` Sasha Levin
2013-03-17 1:02 ` Ming Lei
2013-03-17 14:24 ` Sasha Levin
2013-03-17 16:23 ` Ming Lei
2013-03-19 2:06 ` Sasha Levin
2013-03-19 3:40 ` Ming Lei
2013-03-19 11:54 ` Ming Lei
2013-03-19 16:28 ` Sasha Levin
2013-03-20 1:02 ` Ming Lei
2013-03-20 14:34 ` Sasha Levin
2013-03-20 17:17 ` Greg Kroah-Hartman [this message]
2013-03-16 15:59 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130320171756.GA28605@kroah.com \
--to=greg@kroah.com \
--cc=davej@redhat.com \
--cc=dhillf@gmail.com \
--cc=levinsasha928@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=tom.leiming@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.