linux-next

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2025-01-10 07:50:04 +00:00

History

Ming Lei f7db5e7660 sysfs: fix use after free in case of concurrent read/write and readdir

The inode->i_mutex isn't hold when updating filp->f_pos
in read()/write(), so the filp->f_pos might be read as
0 or 1 in readdir() when there is concurrent read()/write()
on this same file, then may cause use after free in readdir().

The bug can be reproduced with Li Zefan's test code on the
link:

	https://patchwork.kernel.org/patch/2160771/

This patch fixes the use after free under this situation.

Cc: stable <stable@vger.kernel.org>
Reported-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2013-04-03 11:09:02 -07:00

bin.c

hlist: drop the node parameter from iterators

2013-02-27 19:10:24 -08:00

dir.c

sysfs: fix use after free in case of concurrent read/write and readdir

2013-04-03 11:09:02 -07:00

file.c

Revert "sysfs: Convert print_symbol to %pSR"

2013-01-17 13:09:57 -08:00

group.c

sysfs: Functions for adding/removing symlinks to/from attribute groups