{"push_id":639517787,"size":1,"distinct_size":1,"ref":"refs/heads/lollipop","head":"1838f70054a6fd59eeee7539fb83dbf58292935e","before":"7d7f998aec12d225d5ec9209469a267ec6b53b44","commits":[{"sha":"1838f70054a6fd59eeee7539fb83dbf58292935e","author":{"email":"589a549dc9f982d9f46aeeb82a09ab6d87ccf1d8@suse.de","name":"David Disseldorp"},"message":"cifs: fix use-after-free bug in find_writable_file\n\ncommit e1e9bda22d7ddf88515e8fe401887e313922823e upstream.\n\nUnder intermittent network outages, find_writable_file() is susceptible\nto the following race condition, which results in a user-after-free in\nthe cifs_writepages code-path:\n\nThread 1                                        Thread 2\n========                                        ========\n\ninv_file = NULL\nrefind = 0\nspin_lock(&cifs_file_list_lock)\n\n// invalidHandle found on openFileList\n\ninv_file = open_file\n// inv_file->count currently 1\n\ncifsFileInfo_get(inv_file)\n// inv_file->count = 2\n\nspin_unlock(&cifs_file_list_lock);\n\ncifs_reopen_file()                            cifs_close()\n// fails (rc != 0)                            ->cifsFileInfo_put()\n                                       spin_lock(&cifs_file_list_lock)\n                                       // inv_file->count = 1\n                                       spin_unlock(&cifs_file_list_lock)\n\nspin_lock(&cifs_file_list_lock);\nlist_move_tail(&inv_file->flist,\n      &cifs_inode->openFileList);\nspin_unlock(&cifs_file_list_lock);\n\ncifsFileInfo_put(inv_file);\n->spin_lock(&cifs_file_list_lock)\n\n  // inv_file->count = 0\n  list_del(&cifs_file->flist);\n  // cleanup!!\n  kfree(cifs_file);\n\n  spin_unlock(&cifs_file_list_lock);\n\nspin_lock(&cifs_file_list_lock);\n++refind;\n// refind = 1\ngoto refind_writable;\n\nAt this point we loop back through with an invalid inv_file pointer\nand a refind value of 1. On second pass, inv_file is not overwritten on\nopenFileList traversal, and is subsequently dereferenced.\n\nChange-Id: I070e65c8b63898036e7451312cb8d03e8f24cab5\nSigned-off-by: David Disseldorp <ddiss@suse.de>\nReviewed-by: Jeff Layton <jlayton@samba.org>\nSigned-off-by: Steve French <smfrench@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/DirtyUnicorns/android_kernel_htc_flounder/commits/1838f70054a6fd59eeee7539fb83dbf58292935e"}]}