linux-stable/fs/configfs
Sishuai Gong c709c7ca02 configfs: fix a race in configfs_lookup()
commit c42dd069be upstream.

When configfs_lookup() is executing list_for_each_entry(),
it is possible that configfs_dir_lseek() is calling list_del().
Some unfortunate interleavings of them can cause a kernel NULL
pointer dereference error

Thread 1                  Thread 2
//configfs_dir_lseek()    //configfs_lookup()
list_del(&cursor->s_sibling);
                         list_for_each_entry(sd, ...)

Fix this by grabbing configfs_dirent_lock in configfs_lookup()
while iterating ->s_children.

Signed-off-by: Sishuai Gong <sishuai@purdue.edu>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Kyle Zeng <zengyhkyle@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-09-19 12:20:03 +02:00
..
configfs_internal.h configfs: calculate the symlink target only once 2019-09-11 12:46:14 +02:00
dir.c configfs: fix a race in configfs_lookup() 2023-09-19 12:20:03 +02:00
file.c configfs: fix memleak in configfs_release_bin_file 2021-07-14 16:56:48 +02:00
inode.c docs: filesystems: convert configfs.txt to ReST 2020-05-05 09:23:25 -06:00
item.c docs: filesystems: convert configfs.txt to ReST 2020-05-05 09:23:25 -06:00
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
mount.c configfs: calculate the symlink target only once 2019-09-11 12:46:14 +02:00
symlink.c configfs: calculate the depth of parent item 2019-11-06 18:36:01 +01:00