diff options
| author | Sahitya Tummala <stummala@codeaurora.org> | 2019-01-03 16:48:15 +0530 |
|---|---|---|
| committer | Christoph Hellwig <hch@lst.de> | 2019-05-28 08:11:58 +0200 |
| commit | f6122ed2a4f9c9c1c073ddf6308d1b2ac10e0781 (patch) | |
| tree | f0740d5387ddff7ad1251dcfb101864a729dce75 /fs/timerfd.c | |
| parent | cd6c84d8f0cdc911df435bb075ba22ce3c605b07 (diff) | |
| download | linux-f6122ed2a4f9c9c1c073ddf6308d1b2ac10e0781.tar.bz2 | |
configfs: Fix use-after-free when accessing sd->s_dentry
In the vfs_statx() context, during path lookup, the dentry gets
added to sd->s_dentry via configfs_attach_attr(). In the end,
vfs_statx() kills the dentry by calling path_put(), which invokes
configfs_d_iput(). Ideally, this dentry must be removed from
sd->s_dentry but it doesn't if the sd->s_count >= 3. As a result,
sd->s_dentry is holding reference to a stale dentry pointer whose
memory is already freed up. This results in use-after-free issue,
when this stale sd->s_dentry is accessed later in
configfs_readdir() path.
This issue can be easily reproduced, by running the LTP test case -
sh fs_racer_file_list.sh /config
(https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/fs/racer/fs_racer_file_list.sh)
Fixes: 76ae281f6307 ('configfs: fix race between dentry put and lookup')
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Diffstat (limited to 'fs/timerfd.c')
0 files changed, 0 insertions, 0 deletions