Sahitya Tummala 015cf9c605 configfs: Fix use-after-free when accessing sd->s_dentry ... [ Upstream commit f6122ed2a4 ] In the vfs_statx() context, during path lookup, the dentry gets added to sd->s_dentry via configfs_attach_attr(). In the end, vfs_statx() kills the dentry by calling path_put(), which invokes configfs_d_iput(). Ideally, this dentry must be removed from sd->s_dentry but it doesn't if the sd->s_count >= 3. As a result, sd->s_dentry is holding reference to a stale dentry pointer whose memory is already freed up. This results in use-after-free issue, when this stale sd->s_dentry is accessed later in configfs_readdir() path. This issue can be easily reproduced, by running the LTP test case - sh fs_racer_file_list.sh /config (https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/fs/racer/fs_racer_file_list.sh) Fixes: 76ae281f63 ('configfs: fix race between dentry put and lookup') Signed-off-by: Sahitya Tummala <stummala@codeaurora.org> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-06-22 08:16:17 +02:00
..
configfs_internal.h	configfs: implement binary attributes	2016-01-04 12:31:46 +01:00
dir.c	configfs: Fix use-after-free when accessing sd->s_dentry	2019-06-22 08:16:17 +02:00
file.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
inode.c	fs: Replace current_fs_time() with current_time()	2016-09-27 21:06:22 -04:00
item.c	configfs: Introduce config_item_get_unless_zero()	2017-06-12 13:20:20 +02:00
Kconfig
Makefile
mount.c	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
symlink.c	configfs: replace strncpy with memcpy	2018-11-21 09:24:15 +01:00