sysfs: handle failure path correctly for readdir()
authorMing Lei <ming.lei@canonical.com>
Wed, 20 Mar 2013 15:25:25 +0000 (23:25 +0800)
committerBen Hutchings <ben@decadent.org.uk>
Wed, 10 Apr 2013 02:20:01 +0000 (03:20 +0100)
commit4f9347e4b59bdc29b17ff6c4b377195f208402b2
tree8b1bea9e1ff7215fb91868822be6b083537be7d7
parent76bfc5ab57137d351a9046a002ee39a220d0e012
sysfs: handle failure path correctly for readdir()

commit e5110f411d2ee35bf8d202ccca2e89c633060dca upstream.

In case of 'if (filp->f_pos ==  0 or 1)' of sysfs_readdir(),
the failure from filldir() isn't handled, and the reference counter
of the sysfs_dirent object pointed by filp->private_data will be
released without clearing filp->private_data, so use after free
bug will be triggered later.

This patch returns immeadiately under the situation for fixing the bug,
and it is reasonable to return from readdir() when filldir() fails.

Reported-by: Dave Jones <davej@redhat.com>
Tested-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
fs/sysfs/dir.c