You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Hugh Dickins 35c2a7f490 tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking ... Fuzzing with trinity oopsed on the 1st instruction of shmem_fh_to_dentry(), u64 inum = fid->raw[2]; which is unhelpfully reported as at the end of shmem_alloc_inode(): BUG: unable to handle kernel paging request at ffff880061cd3000 IP: [<ffffffff812190d0>] shmem_alloc_inode+0x40/0x40 Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC Call Trace: [<ffffffff81488649>] ? exportfs_decode_fh+0x79/0x2d0 [<ffffffff812d77c3>] do_handle_open+0x163/0x2c0 [<ffffffff812d792c>] sys_open_by_handle_at+0xc/0x10 [<ffffffff83a5f3f8>] tracesys+0xe1/0xe6 Right, tmpfs is being stupid to access fid->raw[2] before validating that fh_len includes it: the buffer kmalloc'ed by do_sys_name_to_handle() may fall at the end of a page, and the next page not be present. But some other filesystems (ceph, gfs2, isofs, reiserfs, xfs) are being careless about fh_len too, in fh_to_dentry() and/or fh_to_parent(), and could oops in the same way: add the missing fh_len checks to those. Reported-by: Sasha Levin <levinsasha928@gmail.com> Signed-off-by: Hugh Dickins <hughd@google.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Sage Weil <sage@inktank.com> Cc: Steven Whitehouse <swhiteho@redhat.com> Cc: Christoph Hellwig <hch@infradead.org> Cc: stable@vger.kernel.org Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>		13 years ago
..
Kconfig	…
Makefile	xfs: move xfs_do_force_shutdown() and kill xfs_rw.c	13 years ago
kmem.c	xfs: switch to proper __bitwise type for KM_... flags	13 years ago
kmem.h	xfs: switch to proper __bitwise type for KM_... flags	13 years ago
mrlock.h	…
time.h	…
uuid.c	…
uuid.h	…
xfs.h	…
xfs_acl.c	userns: Pass a userns parameter into posix_acl_to_xattr and posix_acl_from_xattr	13 years ago
xfs_acl.h	…
xfs_ag.h	xfs: move busy extent handling to it's own file	13 years ago
xfs_alloc.c	xfs: don't defer metadata allocation to the workqueue	13 years ago
xfs_alloc.h	xfs: move busy extent handling to it's own file	13 years ago
xfs_alloc_btree.c	xfs: clean up xfs_bit.h includes	13 years ago
xfs_alloc_btree.h	xfs: struct xfs_buf_log_format isn't variable sized.	13 years ago
xfs_aops.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	13 years ago
xfs_aops.h	Prefix IO_XX flags with XFS_IO_XX to avoid namespace colision.	13 years ago
xfs_attr.c	xfs: remove struct xfs_dabuf and infrastructure	13 years ago
xfs_attr.h	…
xfs_attr_leaf.c	xfs: remove struct xfs_dabuf and infrastructure	13 years ago
xfs_attr_leaf.h	xfs: remove struct xfs_dabuf and infrastructure	13 years ago
xfs_attr_sf.h	…
xfs_bit.c	…
xfs_bit.h	…
xfs_bmap.c	xfs: make largest supported offset less shouty	13 years ago
xfs_bmap.h	xfs: move xfs_fsb_to_db to xfs_bmap.h	13 years ago
xfs_bmap_btree.c	xfs: move xfsagino_t to xfs_types.h	13 years ago
xfs_bmap_btree.h	…
xfs_btree.c	xfs: move xfsagino_t to xfs_types.h	13 years ago
xfs_btree.h	…
xfs_buf.c	xfs: fix race while discarding buffers [V4]	13 years ago
xfs_buf.h	xfs: fix race while discarding buffers [V4]	13 years ago
xfs_buf_item.c	xfs: do not call xfs_bdstrat_cb in xfs_buf_iodone_callbacks	13 years ago
xfs_buf_item.h	xfs: support discontiguous buffers in the xfs_buf_log_item	13 years ago
xfs_da_btree.c	xfs: remove struct xfs_dabuf and infrastructure	13 years ago
xfs_da_btree.h	xfs: fix comment typo of struct xfs_da_blkinfo.	13 years ago
xfs_dfrag.c	switch simple cases of fget_light to fdget	13 years ago
xfs_dfrag.h	…
xfs_dinode.h	xfs: fix typo in comment of xfs_dinode_t.	13 years ago
xfs_dir2.c	xfs: remove struct xfs_dabuf and infrastructure	13 years ago
xfs_dir2.h	…
xfs_dir2_block.c	xfs: remove struct xfs_dabuf and infrastructure	13 years ago
xfs_dir2_data.c	xfs: remove struct xfs_dabuf and infrastructure	13 years ago
xfs_dir2_format.h	…
xfs_dir2_leaf.c	xfs: factor buffer reading from xfs_dir2_leaf_getdents	13 years ago
xfs_dir2_node.c	xfs: remove struct xfs_dabuf and infrastructure	13 years ago
xfs_dir2_priv.h	xfs: remove struct xfs_dabuf and infrastructure	13 years ago
xfs_dir2_sf.c	xfs: remove struct xfs_dabuf and infrastructure	13 years ago
xfs_discard.c	xfs: check for possible overflow in xfs_ioc_trim	13 years ago
xfs_discard.h	…
xfs_dquot.c	xfs: move xfsagino_t to xfs_types.h	13 years ago
xfs_dquot.h	xfs: on-stack delayed write buffer lists	13 years ago
xfs_dquot_item.c	xfs: clean up xfs_bit.h includes	13 years ago
xfs_dquot_item.h	…
xfs_error.c	xfs: move xfsagino_t to xfs_types.h	13 years ago
xfs_error.h	…
xfs_export.c	tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking	13 years ago
xfs_export.h	…
xfs_extent_busy.c	xfs: make xfs_extent_busy_trim not static	13 years ago
xfs_extent_busy.h	xfs: make xfs_extent_busy_trim not static	13 years ago
xfs_extfree_item.c	xfs: move xfsagino_t to xfs_types.h	13 years ago
xfs_extfree_item.h	…
xfs_file.c	mm: kill vma flag VM_CAN_NONLINEAR	13 years ago
xfs_filestream.c	…
xfs_filestream.h	…
xfs_fs.h	…
xfs_fs_subr.c	…
xfs_fsops.c	xfs: make XBF_MAPPED the default behaviour	13 years ago
xfs_fsops.h	…
xfs_globals.c	…
xfs_ialloc.c	xfs: Fix m_agirotor reset during AG selection	13 years ago
xfs_ialloc.h	xfs: remove the alloc_done argument to xfs_dialloc	13 years ago
xfs_ialloc_btree.c	xfs: move xfsagino_t to xfs_types.h	13 years ago
xfs_ialloc_btree.h	…
xfs_iget.c	xfs: remove iolock lock classes	13 years ago
xfs_inode.c	xfs: do not take the iolock in xfs_inactive	13 years ago
xfs_inode.h	xfs: remove iolock lock classes	13 years ago
xfs_inode_item.c	xfs: check for stale inode before acquiring iflock on push	13 years ago
xfs_inode_item.h	xfs: pass shutdown method into xfs_trans_ail_delete_bulk	13 years ago
xfs_inum.h	xfs: move xfsagino_t to xfs_types.h	13 years ago
xfs_ioctl.c	switch simple cases of fget_light to fdget	13 years ago
xfs_ioctl.h	…
xfs_ioctl32.c	xfs: Convert to new freezing code	13 years ago
xfs_ioctl32.h	…
xfs_iomap.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	13 years ago
xfs_iomap.h	…
xfs_iops.c	xfs: update for 3.6-rc1	13 years ago
xfs_iops.h	…
xfs_itable.c	xfs: merge xfs_itobp into xfs_imap_to_bp	13 years ago
xfs_itable.h	…
xfs_linux.h	…
xfs_log.c	xfs: remove xlog_t typedef	13 years ago
xfs_log.h	…
xfs_log_cil.c	xfs: rename log structure to xlog	13 years ago
xfs_log_priv.h	xfs: remove xlog_t typedef	13 years ago
xfs_log_recover.c	xfs: merge xfs_itobp into xfs_imap_to_bp	13 years ago
xfs_log_recover.h	…
xfs_message.c	xfs: move xfsagino_t to xfs_types.h	13 years ago
xfs_message.h	…
xfs_mount.c	xfs: reduce code duplication handling inode32/64 options	13 years ago
xfs_mount.h	xfs: kill struct declarations in xfs_mount.h	13 years ago
xfs_mru_cache.c	…
xfs_mru_cache.h	…
xfs_qm.c	xfs: make largest supported offset less shouty	13 years ago
xfs_qm.h	…
xfs_qm_bhv.c	xfs: clean up xfs_bit.h includes	13 years ago
xfs_qm_syscalls.c	xfs: move xfsagino_t to xfs_types.h	13 years ago
xfs_quota.h	…
xfs_quota_priv.h	…
xfs_quotaops.c	userns: Convert qutoactl	13 years ago
xfs_rename.c	xfs: move xfsagino_t to xfs_types.h	13 years ago
xfs_rtalloc.c	xfs: fix uninitialised variable in xfs_rtbuf_get()	13 years ago
xfs_rtalloc.h	…
xfs_sb.h	…
xfs_stats.c	…
xfs_stats.h	…
xfs_super.c	xfs: update for 3.7-rc1	13 years ago
xfs_super.h	xfs: reduce code duplication handling inode32/64 options	13 years ago
xfs_sync.c	workqueue: deprecate flush[_delayed]_work_sync()	13 years ago
xfs_sync.h	…
xfs_sysctl.c	…
xfs_sysctl.h	…
xfs_trace.c	xfs: clean up xfs_bit.h includes	13 years ago
xfs_trace.h	xfs: kill struct declarations in xfs_mount.h	13 years ago
xfs_trans.c	xfs: Convert to new freezing code	13 years ago
xfs_trans.h	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	13 years ago
xfs_trans_ail.c	xfs: re-enable xfsaild idle mode and fix associated races	13 years ago
xfs_trans_buf.c	xfs: add discontiguous buffer support to transactions	13 years ago
xfs_trans_dquot.c	userns: Convert quota netlink aka quota_send_warning	13 years ago
xfs_trans_extfree.c	xfs: move xfsagino_t to xfs_types.h	13 years ago
xfs_trans_inode.c	xfs: clean up xfs_bit.h includes	13 years ago
xfs_trans_priv.h	xfs: re-enable xfsaild idle mode and fix associated races	13 years ago
xfs_trans_space.h	…
xfs_types.h	xfs: struct xfs_buf_log_format isn't variable sized.	13 years ago
xfs_utils.c	xfs: remove the alloc_done argument to xfs_dialloc	13 years ago
xfs_utils.h	…
xfs_vnode.h	…
xfs_vnodeops.c	xfs: avoid the iolock in xfs_free_eofblocks for evicted inodes	13 years ago
xfs_vnodeops.h	…
xfs_xattr.c	…