Patch "sysfs: handle failure path correctly for readdir()" has been added to the 3.8-stable tree

This is a note to let you know that I've just added the patch titled

sysfs: handle failure path correctly for readdir()

to the 3.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
sysfs-handle-failure-path-correctly-for-readdir.patch
and it can be found in the queue-3.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Ming Lei <[email protected]>
Date: Wed, 20 Mar 2013 23:25:25 +0800
Subject: sysfs: handle failure path correctly for readdir()

From: Ming Lei <[email protected]>

commit e5110f411d2ee35bf8d202ccca2e89c633060dca upstream.

In case of 'if (filp->f_pos == 0 or 1)' of sysfs_readdir(), the failure from filldir() isn't handled, and the reference counter of the sysfs_dirent object pointed by filp->private_data will be released without clearing filp->private_data, so use after free bug will be triggered later.

This patch returns immeadiately under the situation for fixing the bug, and it is reasonable to return from readdir() when filldir() fails.

---
 fs/sysfs/dir.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -1020,6 +1020,8 @@ static int sysfs_readdir(struct file * f
 		ino = parent_sd->s_ino;
 		if (filldir(dirent, ".", 1, filp->f_pos, ino, DT_DIR) == 0)
 			filp->f_pos++;
+		else
+			return 0;
 	}
 	if (filp->f_pos == 1) {
 		if (parent_sd->s_parent)

@@ -1028,6 +1030,8 @@ static int sysfs_readdir(struct file * f
 			ino = parent_sd->s_ino;
 		if (filldir(dirent, "..", 2, filp->f_pos, ino, DT_DIR) == 0)
 			filp->f_pos++;
+		else
+			return 0;
 	}
 	mutex_lock(&sysfs_mutex);
 	for (pos = sysfs_dir_pos(ns, parent_sd, filp->f_pos, pos);

Patches currently in stable-queue which might be from [email protected] are

queue-3.8/bluetooth-add-support-for-dell.patch queue-3.8/sysfs-handle-failure-path-correctly-for-readdir.patch queue-3.8/bluetooth-add-support-for-dell_2.patch queue-3.8/sysfs-fix-race-between-readdir-and-lseek.patch