OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
linux/fs/xfs
History
Hugh Dickins 35c2a7f490 tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking 
Fuzzing with trinity oopsed on the 1st instruction of shmem_fh_to_dentry(),
	u64 inum = fid->raw[2];
which is unhelpfully reported as at the end of shmem_alloc_inode():

BUG: unable to handle kernel paging request at ffff880061cd3000
IP: [<ffffffff812190d0>] shmem_alloc_inode+0x40/0x40
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Call Trace:
 [<ffffffff81488649>] ? exportfs_decode_fh+0x79/0x2d0
 [<ffffffff812d77c3>] do_handle_open+0x163/0x2c0
 [<ffffffff812d792c>] sys_open_by_handle_at+0xc/0x10
 [<ffffffff83a5f3f8>] tracesys+0xe1/0xe6

Right, tmpfs is being stupid to access fid->raw[2] before validating that
fh_len includes it: the buffer kmalloc'ed by do_sys_name_to_handle() may
fall at the end of a page, and the next page not be present.

But some other filesystems (ceph, gfs2, isofs, reiserfs, xfs) are being
careless about fh_len too, in fh_to_dentry() and/or fh_to_parent(), and
could oops in the same way: add the missing fh_len checks to those.

Reported-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Sage Weil <sage@inktank.com>
Cc: Steven Whitehouse <swhiteho@redhat.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
 		2012-10-09 23:33:55 -04:00
..
Kconfig
…
Makefile xfs: move xfs_do_force_shutdown() and kill xfs_rw.c 2012-05-14 16:20:59 -05:00
kmem.c xfs: switch to proper __bitwise type for KM_... flags 2012-05-29 23:28:32 -04:00
kmem.h xfs: switch to proper __bitwise type for KM_... flags 2012-05-29 23:28:32 -04:00
mrlock.h
…
time.h
…
uuid.c
…
uuid.h
…
xfs.h
…
xfs_acl.c userns: Pass a userns parameter into posix_acl_to_xattr and posix_acl_from_xattr 2012-09-18 01:01:35 -07:00
xfs_acl.h
…
xfs_ag.h xfs: move busy extent handling to it's own file 2012-05-14 16:20:55 -05:00
xfs_alloc.c xfs: don't defer metadata allocation to the workqueue 2012-07-13 13:09:27 -05:00
xfs_alloc.h xfs: move busy extent handling to it's own file 2012-05-14 16:20:55 -05:00
xfs_alloc_btree.c xfs: clean up xfs_bit.h includes 2012-05-14 16:21:00 -05:00
xfs_alloc_btree.h xfs: struct xfs_buf_log_format isn't variable sized. 2012-07-01 14:50:04 -05:00
xfs_aops.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2012-08-01 10:26:23 -07:00
xfs_aops.h Prefix IO_XX flags with XFS_IO_XX to avoid namespace colision. 2012-07-22 11:00:55 -05:00
xfs_attr.c xfs: remove struct xfs_dabuf and infrastructure 2012-07-01 14:50:07 -05:00
xfs_attr.h
…
xfs_attr_leaf.c xfs: remove struct xfs_dabuf and infrastructure 2012-07-01 14:50:07 -05:00
xfs_attr_leaf.h xfs: remove struct xfs_dabuf and infrastructure 2012-07-01 14:50:07 -05:00
xfs_attr_sf.h
…
xfs_bit.c
…
xfs_bit.h
…
xfs_bmap.c xfs: make largest supported offset less shouty 2012-06-14 12:28:24 -05:00
xfs_bmap.h xfs: move xfs_fsb_to_db to xfs_bmap.h 2012-05-14 16:20:57 -05:00
xfs_bmap_btree.c xfs: move xfsagino_t to xfs_types.h 2012-05-14 16:20:54 -05:00
xfs_bmap_btree.h
…
xfs_btree.c xfs: move xfsagino_t to xfs_types.h 2012-05-14 16:20:54 -05:00
xfs_btree.h
…
xfs_buf.c xfs: fix race while discarding buffers [V4] 2012-08-29 15:01:11 -05:00
xfs_buf.h xfs: fix race while discarding buffers [V4] 2012-08-29 15:01:11 -05:00
xfs_buf_item.c xfs: do not call xfs_bdstrat_cb in xfs_buf_iodone_callbacks 2012-07-13 13:09:49 -05:00
xfs_buf_item.h xfs: support discontiguous buffers in the xfs_buf_log_item 2012-07-01 14:50:06 -05:00
xfs_da_btree.c xfs: remove struct xfs_dabuf and infrastructure 2012-07-01 14:50:07 -05:00
xfs_da_btree.h xfs: fix comment typo of struct xfs_da_blkinfo. 2012-07-22 10:34:42 -05:00
xfs_dfrag.c switch simple cases of fget_light to fdget 2012-09-26 22:20:08 -04:00
xfs_dfrag.h
…
xfs_dinode.h xfs: fix typo in comment of xfs_dinode_t. 2012-06-14 12:28:26 -05:00
xfs_dir2.c xfs: remove struct xfs_dabuf and infrastructure 2012-07-01 14:50:07 -05:00
xfs_dir2.h
…
xfs_dir2_block.c xfs: remove struct xfs_dabuf and infrastructure 2012-07-01 14:50:07 -05:00
xfs_dir2_data.c xfs: remove struct xfs_dabuf and infrastructure 2012-07-01 14:50:07 -05:00
xfs_dir2_format.h
…
xfs_dir2_leaf.c xfs: factor buffer reading from xfs_dir2_leaf_getdents 2012-07-01 14:50:08 -05:00
xfs_dir2_node.c xfs: remove struct xfs_dabuf and infrastructure 2012-07-01 14:50:07 -05:00
xfs_dir2_priv.h xfs: remove struct xfs_dabuf and infrastructure 2012-07-01 14:50:07 -05:00
xfs_dir2_sf.c xfs: remove struct xfs_dabuf and infrastructure 2012-07-01 14:50:07 -05:00
xfs_discard.c xfs: check for possible overflow in xfs_ioc_trim 2012-08-23 14:48:44 -05:00
xfs_discard.h
…
xfs_dquot.c xfs: move xfsagino_t to xfs_types.h 2012-05-14 16:20:54 -05:00
xfs_dquot.h xfs: on-stack delayed write buffer lists 2012-05-14 16:20:31 -05:00
xfs_dquot_item.c xfs: clean up xfs_bit.h includes 2012-05-14 16:21:00 -05:00
xfs_dquot_item.h
…
xfs_error.c xfs: move xfsagino_t to xfs_types.h 2012-05-14 16:20:54 -05:00
xfs_error.h
…
xfs_export.c tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking 2012-10-09 23:33:55 -04:00
xfs_export.h
…
xfs_extent_busy.c xfs: make xfs_extent_busy_trim not static 2012-05-14 16:21:04 -05:00
xfs_extent_busy.h xfs: make xfs_extent_busy_trim not static 2012-05-14 16:21:04 -05:00
xfs_extfree_item.c xfs: move xfsagino_t to xfs_types.h 2012-05-14 16:20:54 -05:00
xfs_extfree_item.h
…
xfs_file.c mm: kill vma flag VM_CAN_NONLINEAR 2012-10-09 16:22:17 +09:00
xfs_filestream.c
…
xfs_filestream.h
…
xfs_fs.h
…
xfs_fs_subr.c
…
xfs_fsops.c xfs: make XBF_MAPPED the default behaviour 2012-05-14 16:21:03 -05:00
xfs_fsops.h
…
xfs_globals.c
…
xfs_ialloc.c xfs: Fix m_agirotor reset during AG selection 2012-09-26 15:42:42 -05:00
xfs_ialloc.h xfs: remove the alloc_done argument to xfs_dialloc 2012-07-29 16:00:31 -05:00
xfs_ialloc_btree.c xfs: move xfsagino_t to xfs_types.h 2012-05-14 16:20:54 -05:00
xfs_ialloc_btree.h
…
xfs_iget.c xfs: remove iolock lock classes 2012-07-29 16:23:51 -05:00
xfs_inode.c xfs: do not take the iolock in xfs_inactive 2012-07-29 16:16:49 -05:00
xfs_inode.h xfs: remove iolock lock classes 2012-07-29 16:23:51 -05:00
xfs_inode_item.c xfs: check for stale inode before acquiring iflock on push 2012-06-21 14:20:06 -05:00
xfs_inode_item.h xfs: pass shutdown method into xfs_trans_ail_delete_bulk 2012-05-14 16:20:33 -05:00
xfs_inum.h xfs: move xfsagino_t to xfs_types.h 2012-05-14 16:20:54 -05:00
xfs_ioctl.c switch simple cases of fget_light to fdget 2012-09-26 22:20:08 -04:00
xfs_ioctl.h
…
xfs_ioctl32.c xfs: Convert to new freezing code 2012-07-31 09:45:48 +04:00
xfs_ioctl32.h
…
xfs_iomap.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2012-08-01 10:26:23 -07:00
xfs_iomap.h
…
xfs_iops.c xfs: update for 3.6-rc1 2012-07-30 13:37:53 -07:00
xfs_iops.h
…
xfs_itable.c xfs: merge xfs_itobp into xfs_imap_to_bp 2012-07-22 10:46:56 -05:00
xfs_itable.h
…
xfs_linux.h
…
xfs_log.c xfs: remove xlog_t typedef 2012-06-21 14:22:27 -05:00
xfs_log.h
…
xfs_log_cil.c xfs: rename log structure to xlog 2012-06-21 14:21:11 -05:00
xfs_log_priv.h xfs: remove xlog_t typedef 2012-06-21 14:22:27 -05:00
xfs_log_recover.c xfs: merge xfs_itobp into xfs_imap_to_bp 2012-07-22 10:46:56 -05:00
xfs_log_recover.h
…
xfs_message.c xfs: move xfsagino_t to xfs_types.h 2012-05-14 16:20:54 -05:00
xfs_message.h
…
xfs_mount.c xfs: reduce code duplication handling inode32/64 options 2012-09-26 15:56:33 -05:00
xfs_mount.h xfs: kill struct declarations in xfs_mount.h 2012-08-16 13:29:35 -05:00
xfs_mru_cache.c
…
xfs_mru_cache.h
…
xfs_qm.c xfs: make largest supported offset less shouty 2012-06-14 12:28:24 -05:00
xfs_qm.h
…
xfs_qm_bhv.c xfs: clean up xfs_bit.h includes 2012-05-14 16:21:00 -05:00
xfs_qm_syscalls.c xfs: move xfsagino_t to xfs_types.h 2012-05-14 16:20:54 -05:00
xfs_quota.h
…
xfs_quota_priv.h
…
xfs_quotaops.c userns: Convert qutoactl 2012-09-18 01:01:39 -07:00
xfs_rename.c xfs: move xfsagino_t to xfs_types.h 2012-05-14 16:20:54 -05:00
xfs_rtalloc.c xfs: fix uninitialised variable in xfs_rtbuf_get() 2012-08-23 14:48:16 -05:00
xfs_rtalloc.h
…
xfs_sb.h
…
xfs_stats.c
…
xfs_stats.h
…
xfs_super.c xfs: update for 3.7-rc1 2012-10-02 20:42:58 -07:00
xfs_super.h xfs: reduce code duplication handling inode32/64 options 2012-09-26 15:56:33 -05:00
xfs_sync.c workqueue: deprecate flush[_delayed]_work_sync() 2012-08-20 14:51:24 -07:00
xfs_sync.h
…
xfs_sysctl.c
…
xfs_sysctl.h
…
xfs_trace.c xfs: clean up xfs_bit.h includes 2012-05-14 16:21:00 -05:00
xfs_trace.h xfs: kill struct declarations in xfs_mount.h 2012-08-16 13:29:35 -05:00
xfs_trans.c xfs: Convert to new freezing code 2012-07-31 09:45:48 +04:00
xfs_trans.h Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2012-08-01 10:26:23 -07:00
xfs_trans_ail.c xfs: re-enable xfsaild idle mode and fix associated races 2012-07-29 16:27:57 -05:00
xfs_trans_buf.c xfs: add discontiguous buffer support to transactions 2012-07-01 14:50:06 -05:00
xfs_trans_dquot.c userns: Convert quota netlink aka quota_send_warning 2012-09-18 01:01:40 -07:00
xfs_trans_extfree.c xfs: move xfsagino_t to xfs_types.h 2012-05-14 16:20:54 -05:00
xfs_trans_inode.c xfs: clean up xfs_bit.h includes 2012-05-14 16:21:00 -05:00
xfs_trans_priv.h xfs: re-enable xfsaild idle mode and fix associated races 2012-07-29 16:27:57 -05:00
xfs_trans_space.h
…
xfs_types.h xfs: struct xfs_buf_log_format isn't variable sized. 2012-07-01 14:50:04 -05:00
xfs_utils.c xfs: remove the alloc_done argument to xfs_dialloc 2012-07-29 16:00:31 -05:00
xfs_utils.h
…
xfs_vnode.h
…
xfs_vnodeops.c xfs: avoid the iolock in xfs_free_eofblocks for evicted inodes 2012-07-29 16:22:20 -05:00
xfs_vnodeops.h
…
xfs_xattr.c
…