From: Ming Lei Date: Tue, 2 Apr 2013 02:12:26 +0000 (+0800) Subject: sysfs: fix use after free in case of concurrent read/write and readdir X-Git-Tag: omap-for-v3.10/dt-fixes-for-merge-window~138^2~8 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f7db5e7660b122142410dcf36ba903c73d473250;p=pandora-kernel.git sysfs: fix use after free in case of concurrent read/write and readdir The inode->i_mutex isn't hold when updating filp->f_pos in read()/write(), so the filp->f_pos might be read as 0 or 1 in readdir() when there is concurrent read()/write() on this same file, then may cause use after free in readdir(). The bug can be reproduced with Li Zefan's test code on the link: https://patchwork.kernel.org/patch/2160771/ This patch fixes the use after free under this situation. Cc: stable Reported-by: Li Zefan Signed-off-by: Ming Lei Signed-off-by: Greg Kroah-Hartman --- Reading git-diff-tree failed