-
由 Ming Lei 提交于
In case of 'if (filp->f_pos == 0 or 1)' of sysfs_readdir(), the failure from filldir() isn't handled, and the reference counter of the sysfs_dirent object pointed by filp->private_data will be released without clearing filp->private_data, so use after free bug will be triggered later. This patch returns immeadiately under the situation for fixing the bug, and it is reasonable to return from readdir() when filldir() fails. Reported-by: NDave Jones <davej@redhat.com> Tested-by: NSasha Levin <levinsasha928@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: NMing Lei <ming.lei@canonical.com> Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
e5110f41