iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
Jan Harkes 7b7a1c39e8 coda: fix 'kernel memory exposure attempt' in fsync 
commit d337b66a4c52c7b04eec661d86c2ef6e168965a2 upstream.

When an application called fsync on a file in Coda a small request with
just the file identifier was allocated, but the declared length was set
to the size of union of all possible upcall requests.

This bug has been around for a very long time and is now caught by the
extra checking in usercopy that was introduced in Linux-4.8.

The exposure happens when the Coda cache manager process reads the fsync
upcall request at which point it is killed. As a result there is nobody
servicing any further upcalls, trapping any processes that try to access
the mounted Coda filesystem.

Signed-off-by: Jan Harkes <jaharkes@cs.cmu.edu>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-11-24 08:32:25 +01:00
..
9p
9p: fix a potential acl leak
2017-05-14 13:32:54 +02:00
adfs
fs/adfs: remove unneeded cast
2015-06-30 19:44:57 -07:00
affs
affs: fix remount failure when there are no options changed
2016-06-07 18:14:32 -07:00
afs
…
autofs4
autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL
2017-06-29 12:48:50 +02:00
befs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2015-07-04 19:36:06 -07:00
bfs
…
btrfs
Btrfs: send, fix failure to rename top level inode due to name collision
2017-10-21 17:09:04 +02:00
cachefiles
FS-Cache: Add missing initialization of ret in cachefiles_write_page()
2015-11-16 20:38:43 -05:00
ceph
ceph: unlock dangling spinlock in try_flush_caps()
2017-11-02 09:40:49 +01:00
cifs
cifs: check MaxPathNameComponentLength != 0 before using it
2017-11-08 10:06:27 +01:00
coda
coda: fix 'kernel memory exposure attempt' in fsync
2017-11-24 08:32:25 +01:00
configfs
configfs: Fix race between create_link and configfs_rmdir
2017-06-26 07:13:08 +02:00
cramfs
…
debugfs
dentry name snapshots
2017-08-06 19:19:42 -07:00
devpts
devpts: clean up interface to pty drivers
2016-08-16 09:30:49 +02:00
dlm
dlm: avoid double-free on error path in dlm_device_{register,unregister}
2017-09-13 14:09:45 -07:00
ecryptfs
ecryptfs: fix dereference of NULL user_key_payload
2017-11-02 09:40:50 +01:00
efivarfs
efi: Make efivarfs entries immutable by default
2016-03-03 15:07:09 -08:00
efs
…
exofs
osd fs: __r4w_get_page rely on PageUptodate for uptodate
2015-12-12 10:15:34 -08:00
exportfs
…
ext2
posix_acl: Clear SGID bit when setting file permissions
2016-10-31 04:13:58 -06:00
ext4
ext4: fix data exposure after a crash
2017-11-21 09:21:17 +01:00
f2fs
fscrypto: require write access to mount to set encryption policy
2017-10-27 10:23:18 +02:00
fat
fat: fix using uninitialized fields of fat_inode/fsinfo_inode
2017-03-15 09:57:15 +08:00
freevxfs
freevxfs: Grammar s/an negative/a negative/
2015-08-07 13:59:24 +02:00
fscache
FS-Cache: fix dereference of NULL user_key_payload
2017-10-27 10:23:18 +02:00
fuse
fuse: fix READDIRPLUS skipping an entry
2017-11-02 09:40:49 +01:00
gfs2
GFS2: Fix reference to ERR_PTR in gfs2_glock_iter_next
2017-10-08 10:14:16 +02:00
hfs
hfs: fix B-tree corruption after insertion at position 0
2015-09-10 13:29:01 -07:00
hfsplus
posix_acl: Clear SGID bit when setting file permissions
2016-10-31 04:13:58 -06:00
hostfs
hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common()
2016-09-30 10:18:39 +02:00
hpfs
hpfs: implement the show_options method
2016-06-01 12:15:54 -07:00
hugetlbfs
mm: larger stack guard gap, between vmas
2017-06-26 07:13:11 +02:00
isofs
isofs: Do not return EACCES for unknown filesystems
2016-10-28 03:01:34 -04:00
jbd2
jbd2: don't leak modified metadata buffers on an aborted journal
2017-03-12 06:37:26 +01:00
jffs2
posix_acl: Clear SGID bit when setting file permissions
2016-10-31 04:13:58 -06:00
jfs
fs: add i_blocksize()
2017-06-14 13:16:24 +02:00
kernfs
kernfs: don't depend on d_find_any_alias() when generating notifications
2016-09-24 10:07:36 +02:00
lockd
Mainly smaller bugfixes and cleanup. We're still finding some bugs from
2015-11-11 20:11:28 -08:00
logfs
mm, fs: introduce mapping_gfp_constraint()
2015-11-06 17:50:42 -08:00
minix
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2015-07-04 19:36:06 -07:00
ncpfs
ncpfs: fix a braino in OOM handling in ncp_fill_cache()
2016-03-16 08:42:59 -07:00
nfs
NFS: Fix 2 use after free issues in the I/O code
2017-09-13 14:09:46 -07:00
nfs_common
lockd: NLM grace period shouldn't block NFSv4 opens
2015-08-13 10:22:06 -04:00
nfsd
nfsd/callback: Cleanup callback cred on shutdown
2017-10-21 17:09:06 +02:00
nilfs2
fs: add i_blocksize()
2017-06-14 13:16:24 +02:00
nls
…
notify
dentry name snapshots
2017-08-06 19:19:42 -07:00
ntfs
mm, fs: introduce mapping_gfp_constraint()
2015-11-06 17:50:42 -08:00
ocfs2
ocfs2: should wait dio before inode lock in ocfs2_setattr()
2017-11-24 08:32:25 +01:00
omfs
…
openpromfs
…
overlayfs
ovl: fsync after copy-up
2016-11-10 16:36:34 +01:00
proc
mm: larger stack guard gap, between vmas
2017-06-26 07:13:11 +02:00
pstore
pstore: Use dynamic spinlock initializer
2017-08-06 19:19:43 -07:00
qnx4
…
qnx6
…
quota
quota: Fix possible GPF due to uninitialised pointers
2016-04-12 09:08:56 -07:00
ramfs
mm, fs: obey gfp_mapping for add_to_page_cache()
2015-10-16 11:42:28 -07:00
reiserfs
fs: add i_blocksize()
2017-06-14 13:16:24 +02:00
romfs
romfs: use different way to generate fsid for BLOCK or MTD
2017-06-17 06:39:38 +02:00
squashfs
squashfs: xattr simplifications
2015-11-13 20:34:33 -05:00
sysfs
sysfs: be careful of error returns from ops->show()
2017-04-12 12:38:33 +02:00
sysv
fix sysvfs symlinks
2015-11-23 21:11:08 -05:00
tracefs
tracefs: Fix refcount imbalance in start_creating()
2015-11-04 22:13:45 -05:00
ubifs
ubifs: Fix journal replay wrt. xattr nodes
2017-01-26 08:23:48 +01:00
udf
udf: Fix deadlock between writeback and udf_setsize()
2017-07-27 15:06:09 -07:00
ufs
ufs_getfrag_block(): we only grab ->truncate_mutex on block creation path
2017-06-14 13:16:24 +02:00
xfs
xfs: remove kmem_zalloc_greedy
2017-10-08 10:14:20 +02:00
aio.c
aio: mark AIO pseudo-fs noexec
2016-10-07 15:23:47 +02:00
anon_inodes.c
…
attr.c
vfs: move permission checking into notify_change() for utimes(NULL)
2016-10-22 12:26:56 +02:00
bad_inode.c
…
binfmt_aout.c
…
binfmt_elf_fdpic.c
libnvdimm for 4.4:
2015-11-10 12:07:22 -08:00
binfmt_elf.c
binfmt_elf: use ELF_ET_DYN_BASE only for PIE
2017-07-21 07:44:57 +02:00
binfmt_em86.c
…
binfmt_flat.c
…
binfmt_misc.c
…
binfmt_script.c
…
block_dev.c
fs/block_dev: always invalidate cleancache in invalidate_bdev()
2017-05-20 14:27:01 +02:00
buffer.c
fs: add i_blocksize()
2017-06-14 13:16:24 +02:00
char_dev.c
fs/char_dev.c: fix incorrect documentation for unregister_chrdev_region
2015-08-05 13:49:35 -07:00
compat_binfmt_elf.c
…
compat_ioctl.c
i2c-dev: Fix typo in ioctl name reference
2015-10-23 23:26:43 +02:00
compat.c
…
coredump.c
coredump: Ensure proper size of sparse core files
2017-07-05 14:37:20 +02:00
dax.c
dax: disable pmd mappings
2015-11-16 23:54:45 -08:00
dcache.c
dentry name snapshots
2017-08-06 19:19:42 -07:00
dcookies.c
…
direct-io.c
direct-io: Prevent NULL pointer access in submit_page_section
2017-10-18 09:20:42 +02:00
drop_caches.c
inode: convert inode_sb_list_lock to per-sb
2015-08-17 18:39:46 -04:00
eventfd.c
…
eventpoll.c
epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove()
2017-09-07 08:34:10 +02:00
exec.c
exec: Limit arg stack to at most 75% of _STK_LIM
2017-07-21 07:44:57 +02:00
fcntl.c
fs: add a VALID_OPEN_FLAGS
2017-07-15 11:57:44 +02:00
fhandle.c
fs/coredump: prevent fsuid=0 dumps into user-controlled directories
2016-04-12 09:08:58 -07:00
file_table.c
fs, file table: reinit files_stat.max_files after deferred memory initialisation
2015-08-07 04:39:40 +03:00
file.c
vfs: clear remainder of 'full_fds_bits' in dup_fd()
2015-11-05 23:05:32 -08:00
filesystems.c
…
fs_pin.c
…
fs_struct.c
…
fs-writeback.c
writeback, cgroup: fix use of the wrong bdi_writeback which mismatches the inode
2016-04-12 09:09:04 -07:00
inode.c
vfs: fix deadlock in file_remove_privs() on overlayfs
2016-08-10 11:49:30 +02:00
internal.h
inode: rename i_wb_list to i_io_list
2015-08-17 23:38:10 -04:00
ioctl.c
…
Kconfig
dax: disable pmd mappings
2015-11-16 23:54:45 -08:00
Kconfig.binfmt
…
libfs.c
fs: Set the size of empty dirs to 0.
2015-08-12 15:28:45 -05:00
locks.c
locks: use file_inode()
2016-08-10 11:49:27 +02:00
Makefile
ext4: promote ext4 over ext2 in the default probe order
2015-10-15 10:33:21 -04:00
mbcache.c
…
mount.h
mnt: In propgate_umount handle visiting mounts in any order
2017-07-21 07:44:57 +02:00
mpage.c
fs: add i_blocksize()
2017-06-14 13:16:24 +02:00
namei.c
dentry name snapshots
2017-08-06 19:19:42 -07:00
namespace.c
mnt: In propgate_umount handle visiting mounts in any order
2017-07-21 07:44:57 +02:00
no-block.c
…
nsfs.c
fs/seq_file: convert int seq_vprint/seq_printf/etc... returns to void
2015-09-11 15:21:34 -07:00
open.c
fs: completely ignore unknown open flags
2017-07-15 11:57:44 +02:00
pipe.c
pipe: limit the per-user amount of pages allocated in pipes
2016-06-07 18:14:35 -07:00
pnode.c
mnt: Make propagate_umount less slow for overlapping mount propagation trees
2017-07-21 07:44:58 +02:00
pnode.h
mnt: Add a per mount namespace limit on the number of mounts
2017-04-30 05:49:28 +02:00
posix_acl.c
tmpfs: clear S_ISGID when setting posix ACLs
2017-01-26 08:23:47 +01:00
proc_namespace.c
vfs: show_vfsstat: do not ignore errors from show_devname method
2016-04-12 09:08:55 -07:00
read_write.c
vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets
2017-10-05 09:41:45 +02:00
readdir.c
…
select.c
…
seq_file.c
Make file credentials available to the seqfile interfaces
2017-08-06 19:19:42 -07:00
signalfd.c
signalfd: fix information leak in signalfd_copyinfo
2015-08-07 04:39:40 +03:00
splice.c
vfs: fix uninitialized flags in splice_to_pipe()
2017-02-23 17:43:09 +01:00
stack.c
…
stat.c
ufs: restore maintaining ->i_blocks
2017-06-14 13:16:24 +02:00
statfs.c
…
super.c
fs/super.c: fix race between freeze_super() and thaw_super()
2016-10-28 03:01:32 -04:00
sync.c
fs/sync.c: make sync_file_range(2) use WB_SYNC_NONE writeback
2015-11-06 17:50:42 -08:00
timerfd.c
timerfd: Protect the might cancel mechanism proper
2017-05-08 07:46:01 +02:00
userfaultfd.c
userfaultfd: don't block on the last VM updates at exit time
2016-03-16 08:43:01 -07:00
utimes.c
vfs: move permission checking into notify_change() for utimes(NULL)
2016-10-22 12:26:56 +02:00
xattr.c
lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
2017-10-12 11:27:32 +02:00