Re: [PATCH 2/2] sysfs: handle failure path correctly for readdir()

[Shuah Khan]

On Wed, Mar 20, 2013 at 9:25 AM, Ming Lei <ming.lei@xxxxxxxxxxxxx> wrote:
> In case of 'if (filp->f_pos ==  0 or 1)' of sysfs_readdir(),
> the failure from filldir() isn't handled, and the reference counter
> of the sysfs_dirent object pointed by filp->private_data will be
> released without clearing filp->private_data, so use after free
> bug will be triggered later.
>
> This patch returns immeadiately under the situation for fixing the bug,
> and it is reasonable to return from readdir() when filldir() fails.
>
> Reported-by: Dave Jones <davej@xxxxxxxxxx>
> Tested-by: Sasha Levin <levinsasha928@xxxxxxxxx>
> Cc: <stable@xxxxxxxxxxxxxxx>
> Signed-off-by: Ming Lei <ming.lei@xxxxxxxxxxxxx>
> ---
>  fs/sysfs/dir.c |    4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
> index c9e1660..e145126 100644
> --- a/fs/sysfs/dir.c
> +++ b/fs/sysfs/dir.c
> @@ -1020,6 +1020,8 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
>                 ino = parent_sd->s_ino;
>                 if (filldir(dirent, ".", 1, filp->f_pos, ino, DT_DIR) == 0)
>                         filp->f_pos++;
> +               else
> +                       return 0;
>         }
>         if (filp->f_pos == 1) {
>                 if (parent_sd->s_parent)
> @@ -1028,6 +1030,8 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
>                         ino = parent_sd->s_ino;
>                 if (filldir(dirent, "..", 2, filp->f_pos, ino, DT_DIR) == 0)
>                         filp->f_pos++;
> +               else
> +                       return 0;
>         }

Looks good to me. This is just an observation. readdir callers are
checking against NULL as opposed 0. Not a problem really probably
since NULL is defined as 0.

-- Shuah
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/