releases/3.4.39/sysfs-handle-failure-path-correctly-for-readdir.patch

   1 From e5110f411d2ee35bf8d202ccca2e89c633060dca Mon Sep 17 00:00:00 2001
   2 From: Ming Lei <ming.lei@canonical.com>
   3 Date: Wed, 20 Mar 2013 23:25:25 +0800
   4 Subject: sysfs: handle failure path correctly for readdir()
   5
   6 From: Ming Lei <ming.lei@canonical.com>
   7
   8 commit e5110f411d2ee35bf8d202ccca2e89c633060dca upstream.
   9
  10 In case of 'if (filp->f_pos ==  0 or 1)' of sysfs_readdir(),
  11 the failure from filldir() isn't handled, and the reference counter
  12 of the sysfs_dirent object pointed by filp->private_data will be
  13 released without clearing filp->private_data, so use after free
  14 bug will be triggered later.
  15
  16 This patch returns immeadiately under the situation for fixing the bug,
  17 and it is reasonable to return from readdir() when filldir() fails.
  18
  19 Reported-by: Dave Jones <davej@redhat.com>
  20 Tested-by: Sasha Levin <levinsasha928@gmail.com>
  21 Signed-off-by: Ming Lei <ming.lei@canonical.com>
  22 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  23
  24 ---
  25  fs/sysfs/dir.c |    4 ++++
  26  1 file changed, 4 insertions(+)
  27
  28 --- a/fs/sysfs/dir.c
  29 +++ b/fs/sysfs/dir.c
  30 @@ -1002,6 +1002,8 @@ static int sysfs_readdir(struct file * f
  31                 ino = parent_sd->s_ino;
  32                 if (filldir(dirent, ".", 1, filp->f_pos, ino, DT_DIR) == 0)
  33                         filp->f_pos++;
  34 +               else
  35 +                       return 0;
  36         }
  37         if (filp->f_pos == 1) {
  38                 if (parent_sd->s_parent)
  39 @@ -1010,6 +1012,8 @@ static int sysfs_readdir(struct file * f
  40                         ino = parent_sd->s_ino;
  41                 if (filldir(dirent, "..", 2, filp->f_pos, ino, DT_DIR) == 0)
  42                         filp->f_pos++;
  43 +               else
  44 +                       return 0;
  45         }
  46         mutex_lock(&sysfs_mutex);
  47         for (pos = sysfs_dir_pos(ns, parent_sd, filp->f_pos, pos);