android/android_kernel_samsung_sm8650
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
android_kernel_samsung_sm8650/fs/xfs
History
Hugh Dickins 35c2a7f490 tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking 
Fuzzing with trinity oopsed on the 1st instruction of shmem_fh_to_dentry(),
	u64 inum = fid->raw[2];
which is unhelpfully reported as at the end of shmem_alloc_inode():

BUG: unable to handle kernel paging request at ffff880061cd3000
IP: [<ffffffff812190d0>] shmem_alloc_inode+0x40/0x40
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Call Trace:
 [<ffffffff81488649>] ? exportfs_decode_fh+0x79/0x2d0
 [<ffffffff812d77c3>] do_handle_open+0x163/0x2c0
 [<ffffffff812d792c>] sys_open_by_handle_at+0xc/0x10
 [<ffffffff83a5f3f8>] tracesys+0xe1/0xe6

Right, tmpfs is being stupid to access fid->raw[2] before validating that
fh_len includes it: the buffer kmalloc'ed by do_sys_name_to_handle() may
fall at the end of a page, and the next page not be present.

But some other filesystems (ceph, gfs2, isofs, reiserfs, xfs) are being
careless about fh_len too, in fh_to_dentry() and/or fh_to_parent(), and
could oops in the same way: add the missing fh_len checks to those.

Reported-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Sage Weil <sage@inktank.com>
Cc: Steven Whitehouse <swhiteho@redhat.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-10-09 23:33:55 -04:00
..
Kconfig
quota: Make QUOTACTL config be selected by its users
2010-10-05 12:16:37 +02:00
kmem.c
xfs: switch to proper __bitwise type for KM_... flags
2012-05-29 23:28:32 -04:00
kmem.h
xfs: switch to proper __bitwise type for KM_... flags
2012-05-29 23:28:32 -04:00
Makefile
xfs: move xfs_do_force_shutdown() and kill xfs_rw.c
2012-05-14 16:20:59 -05:00
mrlock.h
xfs: remove subdirectories
2011-08-12 16:21:35 -05:00
time.h
xfs: remove subdirectories
2011-08-12 16:21:35 -05:00
uuid.c
xfs: remove subdirectories
2011-08-12 16:21:35 -05:00
uuid.h
xfs: remove subdirectories
2011-08-12 16:21:35 -05:00
xfs_acl.c
userns: Pass a userns parameter into posix_acl_to_xattr and posix_acl_from_xattr
2012-09-18 01:01:35 -07:00
xfs_acl.h
xfs: Fix build breakage in xfs_iops.c when CONFIG_FS_POSIX_ACL is not set
2011-08-01 02:35:04 -04:00
xfs_ag.h
xfs: move busy extent handling to it's own file
2012-05-14 16:20:55 -05:00
xfs_alloc_btree.c
xfs: clean up xfs_bit.h includes
2012-05-14 16:21:00 -05:00
xfs_alloc_btree.h
xfs: struct xfs_buf_log_format isn't variable sized.
2012-07-01 14:50:04 -05:00
xfs_alloc.c
xfs: don't defer metadata allocation to the workqueue
2012-07-13 13:09:27 -05:00
xfs_alloc.h
xfs: move busy extent handling to it's own file
2012-05-14 16:20:55 -05:00
xfs_aops.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2012-08-01 10:26:23 -07:00
xfs_aops.h
Prefix IO_XX flags with XFS_IO_XX to avoid namespace colision.
2012-07-22 11:00:55 -05:00
xfs_attr_leaf.c
xfs: remove struct xfs_dabuf and infrastructure
2012-07-01 14:50:07 -05:00
xfs_attr_leaf.h
xfs: remove struct xfs_dabuf and infrastructure
2012-07-01 14:50:07 -05:00
xfs_attr_sf.h
xfs: convert attr to use unsigned names
2010-01-20 10:47:48 +11:00
xfs_attr.c
xfs: remove struct xfs_dabuf and infrastructure
2012-07-01 14:50:07 -05:00
xfs_attr.h
xfs: convert attr to use unsigned names
2010-01-20 10:47:48 +11:00
xfs_bit.c
…
xfs_bit.h
…
xfs_bmap_btree.c
xfs: move xfsagino_t to xfs_types.h
2012-05-14 16:20:54 -05:00
xfs_bmap_btree.h
xfs: make several more functions static
2010-01-15 15:31:38 -06:00
xfs_bmap.c
xfs: make largest supported offset less shouty
2012-06-14 12:28:24 -05:00
xfs_bmap.h
xfs: move xfs_fsb_to_db to xfs_bmap.h
2012-05-14 16:20:57 -05:00
xfs_btree.c
xfs: move xfsagino_t to xfs_types.h
2012-05-14 16:20:54 -05:00
xfs_btree.h
xfs: Remove the macro XFS_BUF_PTR
2011-07-25 15:03:13 -05:00
xfs_buf_item.c
xfs: do not call xfs_bdstrat_cb in xfs_buf_iodone_callbacks
2012-07-13 13:09:49 -05:00
xfs_buf_item.h
xfs: support discontiguous buffers in the xfs_buf_log_item
2012-07-01 14:50:06 -05:00
xfs_buf.c
xfs: fix race while discarding buffers [V4]
2012-08-29 15:01:11 -05:00
xfs_buf.h
xfs: fix race while discarding buffers [V4]
2012-08-29 15:01:11 -05:00
xfs_da_btree.c
xfs: remove struct xfs_dabuf and infrastructure
2012-07-01 14:50:07 -05:00
xfs_da_btree.h
xfs: fix comment typo of struct xfs_da_blkinfo.
2012-07-22 10:34:42 -05:00
xfs_dfrag.c
switch simple cases of fget_light to fdget
2012-09-26 22:20:08 -04:00
xfs_dfrag.h
xfs: clean up inconsistent variable naming in xfs_swap_extent
2010-01-15 15:31:23 -06:00
xfs_dinode.h
xfs: fix typo in comment of xfs_dinode_t.
2012-06-14 12:28:26 -05:00
xfs_dir2_block.c
xfs: remove struct xfs_dabuf and infrastructure
2012-07-01 14:50:07 -05:00
xfs_dir2_data.c
xfs: remove struct xfs_dabuf and infrastructure
2012-07-01 14:50:07 -05:00
xfs_dir2_format.h
xfs: cleanup struct xfs_dir2_free
2011-07-13 13:43:48 +02:00
xfs_dir2_leaf.c
xfs: factor buffer reading from xfs_dir2_leaf_getdents
2012-07-01 14:50:08 -05:00
xfs_dir2_node.c
xfs: remove struct xfs_dabuf and infrastructure
2012-07-01 14:50:07 -05:00
xfs_dir2_priv.h
xfs: remove struct xfs_dabuf and infrastructure
2012-07-01 14:50:07 -05:00
xfs_dir2_sf.c
xfs: remove struct xfs_dabuf and infrastructure
2012-07-01 14:50:07 -05:00
xfs_dir2.c
xfs: remove struct xfs_dabuf and infrastructure
2012-07-01 14:50:07 -05:00
xfs_dir2.h
xfs: reshuffle dir2 headers
2011-07-13 13:43:48 +02:00
xfs_discard.c
xfs: check for possible overflow in xfs_ioc_trim
2012-08-23 14:48:44 -05:00
xfs_discard.h
xfs: remove subdirectories
2011-08-12 16:21:35 -05:00
xfs_dquot_item.c
xfs: clean up xfs_bit.h includes
2012-05-14 16:21:00 -05:00
xfs_dquot_item.h
xfs: remove subdirectories
2011-08-12 16:21:35 -05:00
xfs_dquot.c
xfs: move xfsagino_t to xfs_types.h
2012-05-14 16:20:54 -05:00
xfs_dquot.h
xfs: on-stack delayed write buffer lists
2012-05-14 16:20:31 -05:00
xfs_error.c
xfs: move xfsagino_t to xfs_types.h
2012-05-14 16:20:54 -05:00
xfs_error.h
xfs: kill support/debug.[ch]
2011-03-07 10:09:35 +11:00
xfs_export.c
tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking
2012-10-09 23:33:55 -04:00
xfs_export.h
xfs: remove subdirectories
2011-08-12 16:21:35 -05:00
xfs_extent_busy.c
xfs: make xfs_extent_busy_trim not static
2012-05-14 16:21:04 -05:00
xfs_extent_busy.h
xfs: make xfs_extent_busy_trim not static
2012-05-14 16:21:04 -05:00
xfs_extfree_item.c
xfs: move xfsagino_t to xfs_types.h
2012-05-14 16:20:54 -05:00
xfs_extfree_item.h
xfs: Pull EFI/EFD handling out from under the AIL lock
2010-12-20 11:59:49 +11:00
xfs_file.c
mm: kill vma flag VM_CAN_NONLINEAR
2012-10-09 16:22:17 +09:00
xfs_filestream.c
xfs: rename allocation range fields in struct xfs_bmalloca
2011-10-11 21:15:06 -05:00
xfs_filestream.h
xfs: clean up filestreams helpers
2010-07-26 13:16:51 -05:00
xfs_fs_subr.c
xfs: remove the i_size field in struct xfs_inode
2012-01-17 15:08:53 -06:00
xfs_fs.h
xfs: consolidate & clarify mount sanity checks
2011-07-08 11:32:51 -05:00
xfs_fsops.c
xfs: make XBF_MAPPED the default behaviour
2012-05-14 16:21:03 -05:00
xfs_fsops.h
xfs: ensure log covering transactions are synchronous
2011-01-11 20:28:17 -06:00
xfs_globals.c
xfs: remove subdirectories
2011-08-12 16:21:35 -05:00
xfs_ialloc_btree.c
xfs: move xfsagino_t to xfs_types.h
2012-05-14 16:20:54 -05:00
xfs_ialloc_btree.h
xfs: remove superflous inobt macros
2009-02-09 08:37:14 +01:00
xfs_ialloc.c
xfs: Fix m_agirotor reset during AG selection
2012-09-26 15:42:42 -05:00
xfs_ialloc.h
xfs: remove the alloc_done argument to xfs_dialloc
2012-07-29 16:00:31 -05:00
xfs_iget.c
xfs: remove iolock lock classes
2012-07-29 16:23:51 -05:00
xfs_inode_item.c
xfs: check for stale inode before acquiring iflock on push
2012-06-21 14:20:06 -05:00
xfs_inode_item.h
xfs: pass shutdown method into xfs_trans_ail_delete_bulk
2012-05-14 16:20:33 -05:00
xfs_inode.c
xfs: do not take the iolock in xfs_inactive
2012-07-29 16:16:49 -05:00
xfs_inode.h
xfs: remove iolock lock classes
2012-07-29 16:23:51 -05:00
xfs_inum.h
xfs: move xfsagino_t to xfs_types.h
2012-05-14 16:20:54 -05:00
xfs_ioctl32.c
xfs: Convert to new freezing code
2012-07-31 09:45:48 +04:00
xfs_ioctl32.h
xfs: remove subdirectories
2011-08-12 16:21:35 -05:00
xfs_ioctl.c
switch simple cases of fget_light to fdget
2012-09-26 22:20:08 -04:00
xfs_ioctl.h
xfs: remove subdirectories
2011-08-12 16:21:35 -05:00
xfs_iomap.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2012-08-01 10:26:23 -07:00
xfs_iomap.h
xfs: kill xfs_iomap
2010-12-16 16:05:51 -06:00
xfs_iops.c
xfs: update for 3.6-rc1
2012-07-30 13:37:53 -07:00
xfs_iops.h
xfs: remove subdirectories
2011-08-12 16:21:35 -05:00
xfs_itable.c
xfs: merge xfs_itobp into xfs_imap_to_bp
2012-07-22 10:46:56 -05:00
xfs_itable.h
xfs: remove block number from inode lookup code
2010-06-24 11:35:17 +10:00
xfs_linux.h
xfs: revert to using a kthread for AIL pushing
2011-10-11 11:02:49 -05:00
xfs_log_cil.c
xfs: rename log structure to xlog
2012-06-21 14:21:11 -05:00
xfs_log_priv.h
xfs: remove xlog_t typedef
2012-06-21 14:22:27 -05:00
xfs_log_recover.c
xfs: merge xfs_itobp into xfs_imap_to_bp
2012-07-22 10:46:56 -05:00
xfs_log_recover.h
xfs: Clean up XFS_BLI_* flag namespace
2010-05-24 10:33:39 -05:00
xfs_log.c
xfs: remove xlog_t typedef
2012-06-21 14:22:27 -05:00
xfs_log.h
xfs: allow assigning the tail lsn with the AIL lock held
2012-05-14 16:20:26 -05:00
xfs_message.c
xfs: move xfsagino_t to xfs_types.h
2012-05-14 16:20:54 -05:00
xfs_message.h
treewide: use __printf not __attribute__((format(printf,...)))
2011-10-31 17:30:54 -07:00
xfs_mount.c
xfs: reduce code duplication handling inode32/64 options
2012-09-26 15:56:33 -05:00
xfs_mount.h
xfs: kill struct declarations in xfs_mount.h
2012-08-16 13:29:35 -05:00
xfs_mru_cache.c
xfs: convert to alloc_workqueue()
2011-02-01 11:42:43 +01:00
xfs_mru_cache.h
xfs: Kill filestreams cache flush
2010-01-15 15:34:22 -06:00
xfs_qm_bhv.c
xfs: clean up xfs_bit.h includes
2012-05-14 16:21:00 -05:00
xfs_qm_syscalls.c
xfs: move xfsagino_t to xfs_types.h
2012-05-14 16:20:54 -05:00
xfs_qm.c
xfs: make largest supported offset less shouty
2012-06-14 12:28:24 -05:00
xfs_qm.h
xfs: remove the global xfs_Gqm structure
2012-03-14 12:06:32 -05:00
xfs_quota_priv.h
xfs: use per-filesystem radix trees for dquot lookup
2012-03-14 11:09:06 -05:00
xfs_quota.h
Define new macro XFS_ALL_QUOTA_ACTIVE and simply some usage
2012-02-03 11:32:20 -06:00
xfs_quotaops.c
userns: Convert qutoactl
2012-09-18 01:01:39 -07:00
xfs_rename.c
xfs: move xfsagino_t to xfs_types.h
2012-05-14 16:20:54 -05:00
xfs_rtalloc.c
xfs: fix uninitialised variable in xfs_rtbuf_get()
2012-08-23 14:48:16 -05:00
xfs_rtalloc.h
xfs: Remove the macro XFS_BUF_PTR
2011-07-25 15:03:13 -05:00
xfs_sb.h
xfs: kill the unused XFS_BB_FSB_OFFSET macro
2012-02-02 17:08:04 -06:00
xfs_stats.c
xfs: use common code for quota statistics
2012-03-14 11:09:06 -05:00
xfs_stats.h
xfs: use common code for quota statistics
2012-03-14 11:09:06 -05:00
xfs_super.c
xfs: update for 3.7-rc1
2012-10-02 20:42:58 -07:00
xfs_super.h
xfs: reduce code duplication handling inode32/64 options
2012-09-26 15:56:33 -05:00
xfs_sync.c
workqueue: deprecate flush[_delayed]_work_sync()
2012-08-20 14:51:24 -07:00
xfs_sync.h
xfs: log timestamp updates
2012-03-13 17:01:15 -05:00
xfs_sysctl.c
xfs: remove subdirectories
2011-08-12 16:21:35 -05:00
xfs_sysctl.h
xfs: remove subdirectories
2011-08-12 16:21:35 -05:00
xfs_trace.c
xfs: clean up xfs_bit.h includes
2012-05-14 16:21:00 -05:00
xfs_trace.h
xfs: kill struct declarations in xfs_mount.h
2012-08-16 13:29:35 -05:00
xfs_trans_ail.c
xfs: re-enable xfsaild idle mode and fix associated races
2012-07-29 16:27:57 -05:00
xfs_trans_buf.c
xfs: add discontiguous buffer support to transactions
2012-07-01 14:50:06 -05:00
xfs_trans_dquot.c
userns: Convert quota netlink aka quota_send_warning
2012-09-18 01:01:40 -07:00
xfs_trans_extfree.c
xfs: move xfsagino_t to xfs_types.h
2012-05-14 16:20:54 -05:00
xfs_trans_inode.c
xfs: clean up xfs_bit.h includes
2012-05-14 16:21:00 -05:00
xfs_trans_priv.h
xfs: re-enable xfsaild idle mode and fix associated races
2012-07-29 16:27:57 -05:00
xfs_trans_space.h
xfs: remove superflous inobt macros
2009-02-09 08:37:14 +01:00
xfs_trans.c
xfs: Convert to new freezing code
2012-07-31 09:45:48 +04:00
xfs_trans.h
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2012-08-01 10:26:23 -07:00
xfs_types.h
xfs: struct xfs_buf_log_format isn't variable sized.
2012-07-01 14:50:04 -05:00
xfs_utils.c
xfs: remove the alloc_done argument to xfs_dialloc
2012-07-29 16:00:31 -05:00
xfs_utils.h
xfs: propagate umode_t
2012-01-03 22:55:00 -05:00
xfs_vnode.h
xfs: remove remaining scraps of struct xfs_iomap
2012-03-15 13:40:16 -05:00
xfs_vnodeops.c
xfs: avoid the iolock in xfs_free_eofblocks for evicted inodes
2012-07-29 16:22:20 -05:00
xfs_vnodeops.h
xfs: remove remaining scraps of struct xfs_iomap
2012-03-15 13:40:16 -05:00
xfs_xattr.c
xfs: remove subdirectories
2011-08-12 16:21:35 -05:00
xfs.h
xfs: don't expect xfs headers to be in subdirectories
2011-08-12 13:57:55 -05:00