OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
linux/fs/xfs
History
David Chinner 99fa8cb3c5 [XFS] Prevent use-after-free caused by synchronous inode reclaim 
With the combined linux and XFS inode, we need to ensure that the combined
structure is not freed before the generic code is finished with the inode.
As it turns out, there is a case where the XFS inode is freed before the
linux inode - when xfs_reclaim() is called from ->clear_inode() on a clean
inode, the xfs inode is freed during that call. The generic code
references the inode after the ->clear_inode() call, so this is a use
after free situation.

Fix the problem by moving the xfs_reclaim() call to ->destroy_inode()
instead of in ->clear_inode(). This ensures the combined inode structure
is not freed until after the generic code has finished with it.

SGI-PV: 988141

SGI-Modid: xfs-linux-melb:xfs-kern:32324a

Signed-off-by: David Chinner <david@fromorbit.com>
Signed-off-by: Lachlan McIlroy <lachlan@sgi.com>
Signed-off-by: Christoph Hellwig <hch@infradead.org>
 		2008-10-30 17:36:40 +11:00
..
linux-2.6 [XFS] Prevent use-after-free caused by synchronous inode reclaim 2008-10-30 17:36:40 +11:00
quota [XFS] Kill xfs_sync() 2008-10-30 17:16:11 +11:00
support [XFS] Show buffer address with debug hexdump on corruption 2008-10-30 17:05:58 +11:00
Kconfig [XFS] allow enabling CONFIG_XFS_DEBUG 2008-04-29 16:07:48 +10:00
Makefile [XFS] move sync code to its own file 2008-10-30 17:06:08 +11:00
xfs.h [XFS] make btree tracing generic 2008-10-30 16:55:13 +11:00
xfs_acl.c [XFS] kill bhv_vnode_t 2008-08-13 16:22:40 +10:00
xfs_acl.h [XFS] kill bhv_vnode_t 2008-08-13 16:22:40 +10:00
xfs_ag.h [XFS] Sync up kernel and user-space headers 2008-10-30 17:05:38 +11:00
xfs_alloc.c [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_alloc.h [XFS] Sync up kernel and user-space headers 2008-10-30 17:05:38 +11:00
xfs_alloc_btree.c [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_alloc_btree.h [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_arch.h [XFS] Sync up kernel and user-space headers 2008-10-30 17:05:38 +11:00
xfs_attr.c [XFS] Move xfs_attr_rolltrans to xfs_trans_roll 2008-08-13 16:05:49 +10:00
xfs_attr.h [XFS] Move attr log alloc size calculator to another function. 2008-08-13 16:03:35 +10:00
xfs_attr_leaf.c [XFS] Move xfs_attr_rolltrans to xfs_trans_roll 2008-08-13 16:05:49 +10:00
xfs_attr_leaf.h [XFS] Move xfs_attr_rolltrans to xfs_trans_roll 2008-08-13 16:05:49 +10:00
xfs_attr_sf.h [XFS] 2008-07-28 16:58:35 +10:00
xfs_bit.c [XFS] Use the generic bitops rather than implementing them ourselves. 2008-08-13 15:41:12 +10:00
xfs_bit.h [XFS] Sync up kernel and user-space headers 2008-10-30 17:05:38 +11:00
xfs_bmap.c [XFS] Move XFS_BMAP_SANITY_CHECK out of line. 2008-10-30 17:14:43 +11:00
xfs_bmap.h [XFS] Sync up kernel and user-space headers 2008-10-30 17:05:38 +11:00
xfs_bmap_btree.c [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_bmap_btree.h [XFS] Move XFS_BMAP_SANITY_CHECK out of line. 2008-10-30 17:14:43 +11:00
xfs_btree.c [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_btree.h [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_btree_trace.c [XFS] make btree tracing generic 2008-10-30 16:58:50 +11:00
xfs_btree_trace.h [XFS] make btree tracing generic 2008-10-30 16:58:50 +11:00
xfs_buf_item.c [XFS] Fix use-after-free with buffers 2008-09-17 16:52:13 +10:00
xfs_buf_item.h [XFS] Fix up sparse warnings. 2008-02-07 18:14:38 +11:00
xfs_clnt.h [XFS] Fix up noattr2 so that it will properly update the versionnum and 2008-07-28 16:58:05 +10:00
xfs_da_btree.c [XFS] streamline init/exit path 2008-07-28 16:59:25 +10:00
xfs_da_btree.h [XFS] Sync up kernel and user-space headers 2008-10-30 17:05:38 +11:00
xfs_dfrag.c [XFS] Prevent lockdep false positives when locking two inodes. 2008-09-17 16:51:21 +10:00
xfs_dfrag.h
…
xfs_dinode.h [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_dir2.c [XFS] Zero uninitialised xfs_da_args structure in xfs_dir2.c 2008-07-28 16:58:46 +10:00
xfs_dir2.h [XFS] Return case-insensitive match for dentry cache 2008-07-28 16:58:40 +10:00
xfs_dir2_block.c [XFS] Return case-insensitive match for dentry cache 2008-07-28 16:58:40 +10:00
xfs_dir2_block.h
…
xfs_dir2_data.c [XFS] Name operation vector for hash and compare 2008-07-28 16:58:36 +10:00
xfs_dir2_data.h
…
xfs_dir2_leaf.c [XFS] Fix CI lookup in leaf-form directories 2008-07-28 16:59:06 +10:00
xfs_dir2_leaf.h
…
xfs_dir2_node.c [XFS] Fix returning case-preserved name with CI node form directories 2008-07-28 16:59:01 +10:00
xfs_dir2_node.h
…
xfs_dir2_sf.c [XFS] Return case-insensitive match for dentry cache 2008-07-28 16:58:40 +10:00
xfs_dir2_sf.h [XFS] Pack some shortform dir2 structures for the ARM old ABI 2008-07-28 16:58:50 +10:00
xfs_dir2_trace.c [XFS] Add op_flags field and helpers to xfs_da_args 2008-07-28 16:58:37 +10:00
xfs_dir2_trace.h
…
xfs_dmapi.h removed unused #include <linux/version.h>'s 2008-08-23 12:14:12 -07:00
xfs_dmops.c
…
xfs_error.c [XFS] kill INDUCE_IO_ERROR 2008-08-13 16:17:37 +10:00
xfs_error.h [XFS] kill INDUCE_IO_ERROR 2008-08-13 16:17:37 +10:00
xfs_extfree_item.c [XFS] Remove unused arg from kmem_free() 2008-07-28 16:58:07 +10:00
xfs_extfree_item.h
…
xfs_filestream.c [XFS] Use KM_NOFS for debug trace buffers 2008-08-13 16:51:57 +10:00
xfs_filestream.h
…
xfs_fs.h [XFS] attrmulti cleanup 2008-07-28 16:59:09 +10:00
xfs_fsops.c [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_fsops.h
…
xfs_ialloc.c [XFS] implement generic xfs_btree_get_rec 2008-10-30 16:58:11 +11:00
xfs_ialloc.h [XFS] Sync up kernel and user-space headers 2008-10-30 17:05:38 +11:00
xfs_ialloc_btree.c [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_ialloc_btree.h [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_iget.c [XFS] Combine the XFS and Linux inodes 2008-10-30 17:36:14 +11:00
xfs_imap.h [XFS] Sync up kernel and user-space headers 2008-10-30 17:05:38 +11:00
xfs_inode.c [XFS] Combine the XFS and Linux inodes 2008-10-30 17:36:14 +11:00
xfs_inode.h [XFS] Combine the XFS and Linux inodes 2008-10-30 17:36:14 +11:00
xfs_inode_item.c [XFS] replace inode flush semaphore with a completion 2008-08-13 16:41:16 +10:00
xfs_inode_item.h [XFS] Sync up kernel and user-space headers 2008-10-30 17:05:38 +11:00
xfs_inum.h
…
xfs_iomap.c [XFS] use minleft when allocating in xfs_bmbt_split() 2008-07-28 16:59:10 +10:00
xfs_iomap.h [XFS] kill unnessecary ioops indirection 2008-02-07 16:44:14 +11:00
xfs_itable.c [XFS] implement generic xfs_btree_increment 2008-10-30 16:55:45 +11:00
xfs_itable.h
…
xfs_log.c Fix barrier fail detection in XFS 2008-10-10 11:08:07 -07:00
xfs_log.h [XFS] cleanup xfs_mountfs 2008-08-13 16:49:32 +10:00
xfs_log_priv.h [XFS] Move memory allocations for log tracing out of the critical path 2008-09-17 16:45:37 +10:00
xfs_log_recover.c [XFS] Always use struct xfs_btree_block instead of short / longform 2008-10-30 17:14:34 +11:00
xfs_log_recover.h
…
xfs_mount.c [XFS] remove the mount inode list 2008-10-30 17:11:29 +11:00
xfs_mount.h [XFS] use xfs_sync_inodes rather than xfs_syncsub 2008-10-30 17:15:12 +11:00
xfs_mru_cache.c [XFS] streamline init/exit path 2008-07-28 16:59:25 +10:00
xfs_mru_cache.h
…
xfs_qmops.c [XFS] Unwrap XFS_SB_LOCK. 2008-02-07 16:47:15 +11:00
xfs_quota.h
…
xfs_refcache.h
…
xfs_rename.c [XFS] Don't update mtime on rename source 2008-07-28 16:59:14 +10:00
xfs_rtalloc.c [XFS] Use the generic bitops rather than implementing them ourselves. 2008-08-13 15:41:12 +10:00
xfs_rtalloc.h [XFS] optimize XFS_IS_REALTIME_INODE w/o realtime config 2008-02-07 18:16:43 +11:00
xfs_rw.c [XFS] replace the XFS buf iodone semaphore with a completion 2008-08-13 16:36:11 +10:00
xfs_rw.h [XFS] optimize XFS_IS_REALTIME_INODE w/o realtime config 2008-02-07 18:16:43 +11:00
xfs_sb.h [XFS] XFS: ASCII case-insensitive support 2008-07-28 16:58:42 +10:00
xfs_trans.c [XFS] remove shouting-indirection macros from xfs_trans.h 2008-08-13 16:10:52 +10:00
xfs_trans.h [XFS] Sync up kernel and user-space headers 2008-10-30 17:05:38 +11:00
xfs_trans_ail.c [XFS] replace remaining __FUNCTION__ occurrences 2008-04-18 11:51:26 +10:00
xfs_trans_buf.c [XFS] remove shouting-indirection macros from xfs_trans.h 2008-08-13 16:10:52 +10:00
xfs_trans_extfree.c
…
xfs_trans_inode.c [XFS] Remove unused arg from kmem_free() 2008-07-28 16:58:07 +10:00
xfs_trans_item.c [XFS] remove shouting-indirection macros from xfs_trans.h 2008-08-13 16:10:52 +10:00
xfs_trans_priv.h [XFS] Move AIL pushing into it's own thread 2008-02-07 18:22:51 +11:00
xfs_trans_space.h
…
xfs_types.h [XFS] remove bhv_vname_t and xfs_rename code 2008-04-18 12:00:12 +10:00
xfs_utils.c [XFS] Avoid directly referencing the VFS inode. 2008-08-13 15:45:15 +10:00
xfs_utils.h [XFS] implement IHOLD/IRELE directly 2008-08-13 16:13:45 +10:00
xfs_vfsops.c [XFS] Move remaining quiesce code. 2008-10-30 17:16:21 +11:00
xfs_vfsops.h [XFS] Move remaining quiesce code. 2008-10-30 17:16:21 +11:00
xfs_vnodeops.c [XFS] Combine the XFS and Linux inodes 2008-10-30 17:36:14 +11:00
xfs_vnodeops.h [XFS] Now that xfs_setattr is only used for attributes set from ->setattr 2008-07-28 16:59:37 +10:00