From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Return-Path: Message-Id: <20130411202559.325937386@goodmis.org> Date: Thu, 11 Apr 2013 16:26:23 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Dave Jones , Sasha Levin , Ming Lei , Greg Kroah-Hartman Subject: [ 080/171 ] sysfs: handle failure path correctly for readdir() References: <20130411202503.783159048@goodmis.org> Content-Disposition: inline; filename=0080-sysfs-handle-failure-path-correctly-for-readdir.patch List-ID: 3.6.11.2 stable review patch. If anyone has any objections, please let me know. ------------------ From: Ming Lei [ Upstream commit e5110f411d2ee35bf8d202ccca2e89c633060dca ] In case of 'if (filp->f_pos == 0 or 1)' of sysfs_readdir(), the failure from filldir() isn't handled, and the reference counter of the sysfs_dirent object pointed by filp->private_data will be released without clearing filp->private_data, so use after free bug will be triggered later. This patch returns immeadiately under the situation for fixing the bug, and it is reasonable to return from readdir() when filldir() fails. Reported-by: Dave Jones Tested-by: Sasha Levin Cc: Signed-off-by: Ming Lei Signed-off-by: Greg Kroah-Hartman Signed-off-by: Steven Rostedt --- fs/sysfs/dir.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c index b65a354..4b93159 100644 --- a/fs/sysfs/dir.c +++ b/fs/sysfs/dir.c @@ -1020,6 +1020,8 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir) ino = parent_sd->s_ino; if (filldir(dirent, ".", 1, filp->f_pos, ino, DT_DIR) == 0) filp->f_pos++; + else + return 0; } if (filp->f_pos == 1) { if (parent_sd->s_parent) @@ -1028,6 +1030,8 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir) ino = parent_sd->s_ino; if (filldir(dirent, "..", 2, filp->f_pos, ino, DT_DIR) == 0) filp->f_pos++; + else + return 0; } mutex_lock(&sysfs_mutex); for (pos = sysfs_dir_pos(ns, parent_sd, filp->f_pos, pos); -- 1.7.10.4