Artem Bityutskiy 605c912bb8 UBIFS: fix a horrid bug ... Al Viro pointed me to the fact that '->readdir()' and '->llseek()' have no mutual exclusion, which means the 'ubifs_dir_llseek()' can be run while we are in the middle of 'ubifs_readdir()'. This means that 'file->private_data' can be freed while 'ubifs_readdir()' uses it, and this is a very bad bug: not only 'ubifs_readdir()' can return garbage, but this may corrupt memory and lead to all kinds of problems like crashes an security holes. This patch fixes the problem by using the 'file->f_version' field, which '->llseek()' always unconditionally sets to zero. We set it to 1 in 'ubifs_readdir()' and whenever we detect that it became 0, we know there was a seek and it is time to clear the state saved in 'file->private_data'. I tested this patch by writing a user-space program which runds readdir and seek in parallell. I could easily crash the kernel without these patches, but could not crash it with these patches. Cc: stable@vger.kernel.org Reported-by: Al Viro <viro@zeniv.linux.org.uk> Tested-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com> Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>		2013-06-29 12:45:37 +04:00
..
budget.c
commit.c
compress.c
debug.c
debug.h
dir.c	UBIFS: fix a horrid bug	2013-06-29 12:45:37 +04:00
file.c
find.c
gc.c
io.c
ioctl.c
journal.c
Kconfig
key.h
log.c
lprops.c
lpt_commit.c
lpt.c
Makefile
master.c
misc.h
orphan.c
recovery.c
replay.c
sb.c
scan.c
shrinker.c
super.c
tnc_commit.c
tnc_misc.c
tnc.c
ubifs-media.h
ubifs.h
xattr.c