author | Ming Lei <ming.lei@canonical.com> | |
Tue, 2 Apr 2013 02:12:26 +0000 (10:12 +0800) | ||
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
Wed, 8 May 2013 03:08:20 +0000 (20:08 -0700) | ||
commit | dda34083d85638e18a3d61701500c52405183e0c | |
tree | d0769d7e3e401d07f9e177ebcab0cb08386cc8b8 | tree | snapshot (tar.xz tar.gz zip) |
parent | 5d35a536a241865aeaf5f960783ce2c023fed2c3 | commit | diff |
sysfs: fix use after free in case of concurrent read/write and readdir
commit f7db5e7660b122142410dcf36ba903c73d473250 upstream.
The inode->i_mutex isn't hold when updating filp->f_pos
in read()/write(), so the filp->f_pos might be read as
0 or 1 in readdir() when there is concurrent read()/write()
on this same file, then may cause use after free in readdir().
The bug can be reproduced with Li Zefan's test code on the
link:
https://patchwork.kernel.org/patch/2160771/
This patch fixes the use after free under this situation.
Reported-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit f7db5e7660b122142410dcf36ba903c73d473250 upstream.
The inode->i_mutex isn't hold when updating filp->f_pos
in read()/write(), so the filp->f_pos might be read as
0 or 1 in readdir() when there is concurrent read()/write()
on this same file, then may cause use after free in readdir().
The bug can be reproduced with Li Zefan's test code on the
link:
https://patchwork.kernel.org/patch/2160771/
This patch fixes the use after free under this situation.
Reported-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/sysfs/dir.c | diff | blob | history |