mirror of
https://github.com/torvalds/linux.git
synced 2024-12-04 18:13:04 +00:00
605c912bb8
Al Viro pointed me to the fact that '->readdir()' and '->llseek()' have no mutual exclusion, which means the 'ubifs_dir_llseek()' can be run while we are in the middle of 'ubifs_readdir()'. This means that 'file->private_data' can be freed while 'ubifs_readdir()' uses it, and this is a very bad bug: not only 'ubifs_readdir()' can return garbage, but this may corrupt memory and lead to all kinds of problems like crashes an security holes. This patch fixes the problem by using the 'file->f_version' field, which '->llseek()' always unconditionally sets to zero. We set it to 1 in 'ubifs_readdir()' and whenever we detect that it became 0, we know there was a seek and it is time to clear the state saved in 'file->private_data'. I tested this patch by writing a user-space program which runds readdir and seek in parallell. I could easily crash the kernel without these patches, but could not crash it with these patches. Cc: stable@vger.kernel.org Reported-by: Al Viro <viro@zeniv.linux.org.uk> Tested-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com> Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> |
||
|---|---|---|
| .. | ||
| budget.c | ||
| commit.c | ||
| compress.c | ||
| debug.c | ||
| debug.h | ||
| dir.c | ||
| file.c | ||
| find.c | ||
| gc.c | ||
| io.c | ||
| ioctl.c | ||
| journal.c | ||
| Kconfig | ||
| key.h | ||
| log.c | ||
| lprops.c | ||
| lpt_commit.c | ||
| lpt.c | ||
| Makefile | ||
| master.c | ||
| misc.h | ||
| orphan.c | ||
| recovery.c | ||
| replay.c | ||
| sb.c | ||
| scan.c | ||
| shrinker.c | ||
| super.c | ||
| tnc_commit.c | ||
| tnc_misc.c | ||
| tnc.c | ||
| ubifs-media.h | ||
| ubifs.h | ||
| xattr.c | ||