lkml.org 
[lkml]   [2013]   [Mar]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 1/2] sysfs: fix race between readdir and lseek
On 2013/3/20 23:25, Ming Lei wrote:
> While readdir() is running, lseek() may set filp->f_pos as zero,
> then may leave filp->private_data pointing to one sysfs_dirent
> object without holding its reference counter, so the sysfs_dirent
> object may be used after free in next readdir().
>
> This patch holds inode->i_mutex to avoid the problem since
> the lock is always held in readdir path.
>

In fact the same race exists between readdir() and read()/write()...

> Reported-by: Dave Jones <davej@redhat.com>
> Tested-by: Sasha Levin <levinsasha928@gmail.com>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Ming Lei <ming.lei@canonical.com>
> ---
> fs/sysfs/dir.c | 13 ++++++++++++-
> 1 file changed, 12 insertions(+), 1 deletion(-)



\
 
 \ /
  Last update: 2013-03-21 04:21    [W:0.056 / U:1.404 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site