Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Sahitya Tummala f6122ed2a4 configfs: Fix use-after-free when accessing sd->s_dentry ... In the vfs_statx() context, during path lookup, the dentry gets added to sd->s_dentry via configfs_attach_attr(). In the end, vfs_statx() kills the dentry by calling path_put(), which invokes configfs_d_iput(). Ideally, this dentry must be removed from sd->s_dentry but it doesn't if the sd->s_count >= 3. As a result, sd->s_dentry is holding reference to a stale dentry pointer whose memory is already freed up. This results in use-after-free issue, when this stale sd->s_dentry is accessed later in configfs_readdir() path. This issue can be easily reproduced, by running the LTP test case - sh fs_racer_file_list.sh /config (https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/fs/racer/fs_racer_file_list.sh) Fixes: 76ae281f63 ('configfs: fix race between dentry put and lookup') Signed-off-by: Sahitya Tummala <stummala@codeaurora.org> Signed-off-by: Christoph Hellwig <hch@lst.de>		2019-05-28 08:11:58 +02:00
..
configfs_internal.h
dir.c	configfs: Fix use-after-free when accessing sd->s_dentry	2019-05-28 08:11:58 +02:00
file.c	configfs: Fix bool initialization/comparison	2017-10-19 16:15:14 +02:00
inode.c	vfs: change inode times to use struct timespec64	2018-06-05 16:57:31 -07:00
item.c	configfs: use kvasprintf() instead of open-coding it	2018-06-19 07:08:12 +02:00
Kconfig	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
mount.c
symlink.c	configfs: replace strncpy with memcpy	2018-07-02 07:12:55 -06:00