linux-sg2042/fs/configfs
Sahitya Tummala f6122ed2a4 configfs: Fix use-after-free when accessing sd->s_dentry
In the vfs_statx() context, during path lookup, the dentry gets
added to sd->s_dentry via configfs_attach_attr(). In the end,
vfs_statx() kills the dentry by calling path_put(), which invokes
configfs_d_iput(). Ideally, this dentry must be removed from
sd->s_dentry but it doesn't if the sd->s_count >= 3. As a result,
sd->s_dentry is holding reference to a stale dentry pointer whose
memory is already freed up. This results in use-after-free issue,
when this stale sd->s_dentry is accessed later in
configfs_readdir() path.

This issue can be easily reproduced, by running the LTP test case -
sh fs_racer_file_list.sh /config
(https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/fs/racer/fs_racer_file_list.sh)

Fixes: 76ae281f63 ('configfs: fix race between dentry put and lookup')
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Signed-off-by: Christoph Hellwig <hch@lst.de>
2019-05-28 08:11:58 +02:00
..
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
configfs_internal.h configfs: implement binary attributes 2016-01-04 12:31:46 +01:00
dir.c configfs: Fix use-after-free when accessing sd->s_dentry 2019-05-28 08:11:58 +02:00
file.c configfs: Fix bool initialization/comparison 2017-10-19 16:15:14 +02:00
inode.c vfs: change inode times to use struct timespec64 2018-06-05 16:57:31 -07:00
item.c configfs: use kvasprintf() instead of open-coding it 2018-06-19 07:08:12 +02:00
mount.c mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros 2016-04-04 10:41:08 -07:00
symlink.c configfs: replace strncpy with memcpy 2018-07-02 07:12:55 -06:00