Artem Bityutskiy 605c912bb8
UBIFS: fix a horrid bug ...
Al Viro pointed me to the fact that '->readdir()' and '->llseek()' have no
mutual exclusion, which means the 'ubifs_dir_llseek()' can be run while we are
in the middle of 'ubifs_readdir()'.
This means that 'file->private_data' can be freed while 'ubifs_readdir()' uses
it, and this is a very bad bug: not only 'ubifs_readdir()' can return garbage,
but this may corrupt memory and lead to all kinds of problems like crashes an
security holes.
This patch fixes the problem by using the 'file->f_version' field, which
'->llseek()' always unconditionally sets to zero. We set it to 1 in
'ubifs_readdir()' and whenever we detect that it became 0, we know there was a
seek and it is time to clear the state saved in 'file->private_data'.
I tested this patch by writing a user-space program which runds readdir and
seek in parallell. I could easily crash the kernel without these patches, but
could not crash it with these patches.
Cc: stable@vger.kernel.org
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Tested-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2013-06-29 12:45:37 +04:00
2013-05-07 20:16:25 -07:00
2013-03-03 19:36:31 -08:00
2013-03-03 19:36:31 -08:00
2013-05-07 20:16:25 -07:00
2013-05-06 13:06:59 -07:00
2013-05-31 15:17:56 -04:00
2013-03-03 19:36:31 -08:00
2013-06-13 22:34:14 -07:00
2013-04-09 14:12:56 -04:00
2013-06-12 08:28:19 -07:00
2013-05-31 16:23:35 -05:00
2013-04-09 14:12:56 -04:00
2013-03-03 19:36:31 -08:00
2013-03-03 19:36:31 -08:00
2013-03-03 19:36:31 -08:00
2013-03-07 01:08:55 -08:00
2013-05-01 14:08:52 -07:00
2013-06-04 23:53:31 -07:00
2013-05-13 20:12:10 +01:00
2013-03-03 19:36:31 -08:00
2013-03-23 14:26:28 -07:00
2013-02-27 19:10:24 -08:00
2013-05-07 20:16:25 -07:00
2013-05-07 20:49:51 -07:00
2013-05-14 09:30:54 -07:00
2013-05-08 15:11:48 -07:00
2013-05-24 16:22:50 -07:00
2013-03-12 18:55:21 -07:00
2013-04-29 15:54:27 -07:00
2013-06-03 15:15:42 +02:00
2013-06-03 16:40:22 +01:00
2013-05-24 16:22:51 -07:00
2013-05-07 20:16:25 -07:00
2013-05-04 15:48:45 -04:00
2013-06-08 17:39:40 -07:00
2013-04-29 15:41:42 -04:00
2013-05-07 18:38:27 -07:00
2013-03-12 18:55:21 -07:00
2013-05-03 09:56:25 -07:00
2013-05-01 17:51:54 -07:00
2013-03-03 19:36:31 -08:00
2013-05-24 16:03:47 -05:00
2013-04-21 18:08:42 -04:00
2013-03-23 14:15:31 -07:00
2013-03-03 19:36:31 -08:00
2013-06-07 12:15:38 -04:00
2013-05-30 16:31:34 -04:00
2013-02-13 06:15:14 -08:00
2013-05-10 09:28:55 -07:00
2013-05-24 16:22:52 -07:00
2013-05-09 13:46:38 -04:00
2013-05-07 20:16:25 -07:00
2013-06-12 16:29:46 -07:00
2013-03-03 19:36:31 -08:00
2013-03-03 19:36:31 -08:00
2013-06-12 16:29:44 -07:00
2013-05-09 16:42:10 -07:00
2013-03-03 19:36:31 -08:00
2013-05-31 15:17:31 -04:00
2013-03-11 22:05:56 +01:00
2013-02-26 20:16:07 -08:00
2013-05-31 23:14:20 +02:00
2013-04-29 09:17:57 +10:00
2013-03-11 07:09:48 -07:00
2013-04-05 15:35:52 -07:00
2013-03-12 18:55:21 -07:00
2013-06-29 12:45:37 +04:00
2013-05-07 20:16:25 -07:00
2013-04-30 09:36:50 -07:00
2013-06-14 15:59:45 -05:00
2013-06-12 16:29:46 -07:00
2013-02-26 02:46:11 -05:00
2012-11-20 04:17:24 -08:00
2012-12-17 17:15:12 -08:00
2013-05-01 17:51:54 -07:00
2013-05-02 10:16:16 -07:00
2013-05-02 10:16:16 -07:00
2012-12-17 17:15:23 -08:00
2013-04-29 15:40:23 -04:00
2013-04-30 17:04:03 -07:00
2012-12-20 17:40:19 -08:00
2012-11-28 21:53:38 -05:00
2013-03-23 14:26:34 -07:00
2013-05-08 10:13:35 -07:00
2013-05-08 10:13:35 -07:00
2013-05-08 10:13:35 -07:00
2012-10-22 08:50:37 +03:00
2012-10-06 03:05:17 +09:00
2013-05-04 15:03:05 -04:00
2013-05-07 20:16:25 -07:00
2013-05-04 14:45:54 -04:00
2012-10-06 03:05:15 +09:00
2013-05-04 15:43:02 -04:00
2013-03-03 23:00:23 -05:00
2013-05-08 10:13:35 -07:00
2012-12-17 17:15:27 -08:00
2013-05-01 07:21:43 -07:00
2013-05-01 17:51:54 -07:00
2013-02-22 23:31:31 -05:00
2012-12-20 14:04:11 -08:00
2013-06-15 05:39:08 +04:00
2013-05-01 17:31:42 -04:00
2013-03-03 19:36:31 -08:00
2013-03-01 23:51:07 -05:00
2013-05-08 10:13:35 -07:00
2012-09-18 01:01:35 -07:00
2013-05-01 17:51:54 -07:00
2013-06-20 19:02:45 +04:00
2013-02-22 23:31:31 -05:00
2013-04-17 13:25:09 +01:00
2013-04-30 17:04:04 -07:00
2012-12-20 18:46:29 -05:00
2013-02-22 23:31:31 -05:00
2013-05-01 17:51:54 -07:00
2013-04-09 14:12:52 -04:00
2013-06-15 05:41:45 +04:00
2013-05-04 15:18:53 -04:00
2013-03-03 22:58:33 -05:00
2013-05-07 20:16:25 -07:00
2013-05-31 15:16:33 -04:00
2013-05-01 17:51:54 -07:00
2012-09-18 01:01:35 -07:00
2012-07-14 16:32:48 +04:00
2013-06-20 19:02:45 +04:00
2013-02-22 23:31:31 -05:00
2013-02-07 20:51:08 +01:00
2013-04-09 14:13:29 -04:00
2013-03-03 22:58:46 -05:00
2013-06-20 19:02:45 +04:00
2013-02-26 02:46:08 -05:00
2012-12-20 18:50:07 -05:00
2013-02-27 19:10:24 -08:00
2013-03-03 22:46:22 -05:00
2013-03-02 09:35:13 -05:00
2012-12-20 18:50:08 -05:00
2012-10-12 13:16:48 -07:00
2012-12-20 18:50:11 -05:00
605c912bb8