linux-kernel - Re: [PATCH 2/2] sysfs: handle failure path correctly for readdir()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAKocOOP9wAiWSKhY-P6Yy7TvjTKfpek65WZB+TRpfd5FuDvGnw@mail.gmail.com>
Date:	Wed, 20 Mar 2013 10:26:43 -0600
From:	Shuah Khan <shuahkhan@...il.com>
To:	Ming Lei <ming.lei@...onical.com>
Cc:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH 2/2] sysfs: handle failure path correctly for readdir()

On Wed, Mar 20, 2013 at 9:25 AM, Ming Lei <ming.lei@...onical.com> wrote:
> In case of 'if (filp->f_pos ==  0 or 1)' of sysfs_readdir(),
> the failure from filldir() isn't handled, and the reference counter
> of the sysfs_dirent object pointed by filp->private_data will be
> released without clearing filp->private_data, so use after free
> bug will be triggered later.
>
> This patch returns immeadiately under the situation for fixing the bug,
> and it is reasonable to return from readdir() when filldir() fails.
>
> Reported-by: Dave Jones <davej@...hat.com>
> Tested-by: Sasha Levin <levinsasha928@...il.com>
> Cc: <stable@...r.kernel.org>
> Signed-off-by: Ming Lei <ming.lei@...onical.com>
> ---
>  fs/sysfs/dir.c |    4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
> index c9e1660..e145126 100644
> --- a/fs/sysfs/dir.c
> +++ b/fs/sysfs/dir.c
> @@ -1020,6 +1020,8 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
>                 ino = parent_sd->s_ino;
>                 if (filldir(dirent, ".", 1, filp->f_pos, ino, DT_DIR) == 0)
>                         filp->f_pos++;
> +               else
> +                       return 0;
>         }
>         if (filp->f_pos == 1) {
>                 if (parent_sd->s_parent)
> @@ -1028,6 +1030,8 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
>                         ino = parent_sd->s_ino;
>                 if (filldir(dirent, "..", 2, filp->f_pos, ino, DT_DIR) == 0)
>                         filp->f_pos++;
> +               else
> +                       return 0;
>         }

Looks good to me. This is just an observation. readdir callers are
checking against NULL as opposed 0. Not a problem really probably
since NULL is defined as 0.

-- Shuah
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/