]> git.baikalelectronics.ru Git - kernel.git/commit
configfs: Fix use-after-free when accessing sd->s_dentry
authorSahitya Tummala <stummala@codeaurora.org>
Thu, 3 Jan 2019 11:18:15 +0000 (16:48 +0530)
committerChristoph Hellwig <hch@lst.de>
Tue, 28 May 2019 06:11:58 +0000 (08:11 +0200)
commitb8ab45f9ccc27045fa211327b485d5dae0a059e5
treef0740d5387ddff7ad1251dcfb101864a729dce75
parentd4af5abda2664f52c5d43457c52ea397f34be5cb
configfs: Fix use-after-free when accessing sd->s_dentry

In the vfs_statx() context, during path lookup, the dentry gets
added to sd->s_dentry via configfs_attach_attr(). In the end,
vfs_statx() kills the dentry by calling path_put(), which invokes
configfs_d_iput(). Ideally, this dentry must be removed from
sd->s_dentry but it doesn't if the sd->s_count >= 3. As a result,
sd->s_dentry is holding reference to a stale dentry pointer whose
memory is already freed up. This results in use-after-free issue,
when this stale sd->s_dentry is accessed later in
configfs_readdir() path.

This issue can be easily reproduced, by running the LTP test case -
sh fs_racer_file_list.sh /config
(https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/fs/racer/fs_racer_file_list.sh)

Fixes: 6d591178b478 ('configfs: fix race between dentry put and lookup')
Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
Signed-off-by: Christoph Hellwig <hch@lst.de>
fs/configfs/dir.c