Sahitya Tummala 79cb505ab2 configfs: Fix use-after-free when accessing sd->s_dentry ... [ Upstream commit f6122ed2a4 ] In the vfs_statx() context, during path lookup, the dentry gets added to sd->s_dentry via configfs_attach_attr(). In the end, vfs_statx() kills the dentry by calling path_put(), which invokes configfs_d_iput(). Ideally, this dentry must be removed from sd->s_dentry but it doesn't if the sd->s_count >= 3. As a result, sd->s_dentry is holding reference to a stale dentry pointer whose memory is already freed up. This results in use-after-free issue, when this stale sd->s_dentry is accessed later in configfs_readdir() path. This issue can be easily reproduced, by running the LTP test case - sh fs_racer_file_list.sh /config (https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/fs/racer/fs_racer_file_list.sh) Fixes: 76ae281f63 ('configfs: fix race between dentry put and lookup') Signed-off-by: Sahitya Tummala <stummala@codeaurora.org> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-06-22 08:17:23 +02:00
..
configfs_internal.h	configfs: implement binary attributes	2016-01-04 12:31:46 +01:00
dir.c	configfs: Fix use-after-free when accessing sd->s_dentry	2019-06-22 08:17:23 +02:00
file.c	configfs: Return -EFBIG from configfs_write_bin_file.	2016-09-16 12:58:28 +02:00
inode.c	fs: Replace current_fs_time() with current_time()	2016-09-27 21:06:22 -04:00
item.c	configfs: switch ->default groups to a linked list	2016-03-06 16:11:24 +01:00
Kconfig	configfs: change depends -> select SYSFS	2011-01-16 21:22:29 +00:00
Makefile
mount.c	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
symlink.c	configfs: replace strncpy with memcpy	2018-11-21 09:26:03 +01:00