Commit 991f76f8 authored Mar 20, 2013 by Ming Lei Committed by Greg Kroah-Hartman Mar 20, 2013

sysfs: fix race between readdir and lseek



While readdir() is running, lseek() may set filp->f_pos as zero,
then may leave filp->private_data pointing to one sysfs_dirent
object without holding its reference counter, so the sysfs_dirent
object may be used after free in next readdir().

This patch holds inode->i_mutex to avoid the problem since
the lock is always held in readdir path.

Reported-by: Dave Jones <davej@redhat.com>
Tested-by: Sasha Levin <levinsasha928@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent a937536b

fs/sysfs/dir.c

+12 −1

Original line number	Diff line number	Diff line
		@@ -1058,10 +1058,21 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
		return 0;
		}

		static loff_t sysfs_dir_llseek(struct file *file, loff_t offset, int whence)
		{
		struct inode *inode = file_inode(file);
		loff_t ret;

		mutex_lock(&inode->i_mutex);
		ret = generic_file_llseek(file, offset, whence);
		mutex_unlock(&inode->i_mutex);

		return ret;
		}

		const struct file_operations sysfs_dir_operations = {
		.read = generic_read_dir,
		.readdir = sysfs_readdir,
		.release = sysfs_dir_release,
		.llseek = generic_file_llseek,
		.llseek = sysfs_dir_llseek,
		};