Sahitya Tummala 432030b25b configfs: Fix use-after-free when accessing sd->s_dentry ... [ Upstream commit f6122ed2a4f9c9c1c073ddf6308d1b2ac10e0781 ] In the vfs_statx() context, during path lookup, the dentry gets added to sd->s_dentry via configfs_attach_attr(). In the end, vfs_statx() kills the dentry by calling path_put(), which invokes configfs_d_iput(). Ideally, this dentry must be removed from sd->s_dentry but it doesn't if the sd->s_count >= 3. As a result, sd->s_dentry is holding reference to a stale dentry pointer whose memory is already freed up. This results in use-after-free issue, when this stale sd->s_dentry is accessed later in configfs_readdir() path. This issue can be easily reproduced, by running the LTP test case - sh fs_racer_file_list.sh /config (https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/fs/racer/fs_racer_file_list.sh) Fixes: 76ae281f63 ('configfs: fix race between dentry put and lookup') Signed-off-by: Sahitya Tummala <stummala@codeaurora.org> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-06-22 08:18:26 +02:00
..
configfs_internal.h	configfs_add_file: fold into its sole caller	2015-02-17 22:16:46 -05:00
dir.c	configfs: Fix use-after-free when accessing sd->s_dentry	2019-06-22 08:18:26 +02:00
file.c	configfs: remove old API	2015-10-13 22:17:57 -07:00
inode.c	make simple_positive() public	2015-06-23 18:02:01 -04:00
item.c	configfs: fix kernel infoleak through user-controlled format string	2015-07-17 16:39:53 -07:00
Kconfig	configfs: change depends -> select SYSFS	2011-01-16 21:22:29 +00:00
Makefile
mount.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2015-07-03 15:20:57 -07:00
symlink.c	configfs: replace strncpy with memcpy	2018-11-21 09:27:44 +01:00