diff options
| author | Ming Lei <[email protected]> | 2013-03-20 23:25:25 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <[email protected]> | 2013-03-20 16:53:42 -0700 |
| commit | e5110f411d2ee35bf8d202ccca2e89c633060dca (patch) | |
| tree | 9fe7297901679cca05b459f9e7e524e99c534a7d /include/linux/fpga | |
| parent | 991f76f837bf22c5bb07261cfd86525a0a96650c (diff) | |
sysfs: handle failure path correctly for readdir()
In case of 'if (filp->f_pos == 0 or 1)' of sysfs_readdir(),
the failure from filldir() isn't handled, and the reference counter
of the sysfs_dirent object pointed by filp->private_data will be
released without clearing filp->private_data, so use after free
bug will be triggered later.
This patch returns immeadiately under the situation for fixing the bug,
and it is reasonable to return from readdir() when filldir() fails.
Reported-by: Dave Jones <[email protected]>
Tested-by: Sasha Levin <[email protected]>
Cc: <[email protected]>
Signed-off-by: Ming Lei <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Diffstat (limited to 'include/linux/fpga')
0 files changed, 0 insertions, 0 deletions