Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758052Ab3CTQ0s (ORCPT ); Wed, 20 Mar 2013 12:26:48 -0400 Received: from mail-la0-f47.google.com ([209.85.215.47]:54958 "EHLO mail-la0-f47.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752066Ab3CTQ0q (ORCPT ); Wed, 20 Mar 2013 12:26:46 -0400 MIME-Version: 1.0 In-Reply-To: <1363793126-11510-3-git-send-email-ming.lei@canonical.com> References: <1363793126-11510-1-git-send-email-ming.lei@canonical.com> <1363793126-11510-3-git-send-email-ming.lei@canonical.com> Date: Wed, 20 Mar 2013 10:26:43 -0600 Message-ID: Subject: Re: [PATCH 2/2] sysfs: handle failure path correctly for readdir() From: Shuah Khan To: Ming Lei Cc: Greg Kroah-Hartman , linux-kernel@vger.kernel.org, stable@vger.kernel.org Content-Type: text/plain; charset=ISO-8859-1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2068 Lines: 49 On Wed, Mar 20, 2013 at 9:25 AM, Ming Lei wrote: > In case of 'if (filp->f_pos == 0 or 1)' of sysfs_readdir(), > the failure from filldir() isn't handled, and the reference counter > of the sysfs_dirent object pointed by filp->private_data will be > released without clearing filp->private_data, so use after free > bug will be triggered later. > > This patch returns immeadiately under the situation for fixing the bug, > and it is reasonable to return from readdir() when filldir() fails. > > Reported-by: Dave Jones > Tested-by: Sasha Levin > Cc: > Signed-off-by: Ming Lei > --- > fs/sysfs/dir.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c > index c9e1660..e145126 100644 > --- a/fs/sysfs/dir.c > +++ b/fs/sysfs/dir.c > @@ -1020,6 +1020,8 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir) > ino = parent_sd->s_ino; > if (filldir(dirent, ".", 1, filp->f_pos, ino, DT_DIR) == 0) > filp->f_pos++; > + else > + return 0; > } > if (filp->f_pos == 1) { > if (parent_sd->s_parent) > @@ -1028,6 +1030,8 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir) > ino = parent_sd->s_ino; > if (filldir(dirent, "..", 2, filp->f_pos, ino, DT_DIR) == 0) > filp->f_pos++; > + else > + return 0; > } Looks good to me. This is just an observation. readdir callers are checking against NULL as opposed 0. Not a problem really probably since NULL is defined as 0. -- Shuah -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/