From: Ming Lei Date: Tue, 2 Apr 2013 02:12:26 +0000 (+0800) Subject: sysfs: fix use after free in case of concurrent read/write and readdir X-Git-Tag: v3.2.45~105 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3a8aad02f417b5aecafdc785c39c0e2259995c69;p=pandora-kernel.git sysfs: fix use after free in case of concurrent read/write and readdir commit f7db5e7660b122142410dcf36ba903c73d473250 upstream. The inode->i_mutex isn't hold when updating filp->f_pos in read()/write(), so the filp->f_pos might be read as 0 or 1 in readdir() when there is concurrent read()/write() on this same file, then may cause use after free in readdir(). The bug can be reproduced with Li Zefan's test code on the link: https://patchwork.kernel.org/patch/2160771/ This patch fixes the use after free under this situation. Reported-by: Li Zefan Signed-off-by: Ming Lei Signed-off-by: Greg Kroah-Hartman [bwh: Backported to 3.2: file position is child inode number, not hash] Signed-off-by: Ben Hutchings --- Reading git-diff-tree failed