iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
b1302cbe530b26ce6ba4a1a4019513393a566f6f
linux/fs
History
Jeff Layton fdd0f3b0e9 ceph: hold extra reference to r_parent over life of request 
commit 9c1c2b35f1 upstream.

Currently, we just assume that it will stick around by virtue of the
submitter's reference, but later patches will allow the syscall to
return early and we can't rely on that reference at that point.

While I'm not aware of any reports of it, Xiubo pointed out that this
may fix a use-after-free.  If the wait for a reply times out or is
canceled via signal, and then the reply comes in after the syscall
returns, the client can end up trying to access r_parent without a
reference.

Take an extra reference to the inode when setting r_parent and release
it when releasing the request.

Cc: stable@vger.kernel.org
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-29 16:45:24 +01:00
..
9p
Merge tag '9p-for-5.4' of git://github.com/martinetd/linux
2019-09-27 15:10:34 -07:00
adfs
Merge branch 'work.adfs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-07-19 11:33:22 -07:00
affs
affs: fix a memory leak in affs_remount
2020-01-17 19:48:50 +01:00
afs
afs: Fix characters allowed into cell names
2020-01-29 16:45:24 +01:00
autofs
autofs: fix a leak in autofs_expire_indirect()
2019-10-25 00:03:11 -04:00
befs
fs: Fill in max and min timestamps in superblock
2019-08-30 07:27:17 -07:00
bfs
fs: Fill in max and min timestamps in superblock
2019-08-30 07:27:17 -07:00
btrfs
Btrfs: always copy scrub arguments back to user space
2020-01-23 08:22:41 +01:00
cachefiles
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36
2019-05-24 17:27:11 +02:00
ceph
ceph: hold extra reference to r_parent over life of request
2020-01-29 16:45:24 +01:00
cifs
cifs: Adjust indentation in smb2_open_file
2020-01-17 19:48:27 +01:00
coda
Merge tag 'y2038-vfs' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground
2019-09-19 09:42:37 -07:00
configfs
configfs: calculate the depth of parent item
2019-11-06 18:36:01 +01:00
cramfs
cramfs: fix usage on non-MTD device
2019-11-23 21:44:49 -05:00
crypto
fscrypt: require that key be added when setting a v2 encryption policy
2019-08-12 19:18:50 -07:00
debugfs
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-09-28 08:14:15 -07:00
devpts
devpts_pty_kill(): don't bother with d_delete()
2019-09-03 09:30:56 -04:00
dlm
Merge tag 'dlm-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm
2019-07-12 17:37:53 -07:00
ecryptfs
ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either
2019-11-10 11:57:45 -05:00
efivarfs
Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-07-19 10:42:02 -07:00
efs
fs: Fill in max and min timestamps in superblock
2019-08-30 07:27:17 -07:00
erofs
erofs: zero out when listxattr is called with no xattr
2019-12-17 19:56:23 +01:00
exportfs
exportfs_decode_fh(): negative pinned may become positive without the parent locked
2019-11-10 11:56:05 -05:00
ext2
ext2: check err when partial != NULL
2019-12-17 19:56:43 +01:00
ext4
ext4: iomap that extends beyond EOF should be marked dirty
2020-01-04 19:17:13 +01:00
f2fs
f2fs: fix potential overflow
2020-01-17 19:49:02 +01:00
fat
fat: delete an unnecessary check before brelse()
2019-09-25 17:51:40 -07:00
freevxfs
fs: Fill in max and min timestamps in superblock
2019-08-30 07:27:17 -07:00
fscache
Revert "Merge tag 'keys-acl-20190703' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs"
2019-07-10 18:43:43 -07:00
fuse
fuse: fix fuse_send_readpages() in the syncronous read case
2020-01-23 08:22:32 +01:00
gfs2
gfs2: add compat_ioctl support
2020-01-17 19:48:52 +01:00
hfs
treewide: Add SPDX license identifier - Makefile/Kconfig
2019-05-21 10:50:46 +02:00
hfsplus
fs/hfsplus/xattr.c: replace strncpy with memcpy
2019-07-16 19:23:23 -07:00
hostfs
Merge tag 'for-linus-5.2-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/rw/uml
2019-05-12 17:52:13 -04:00
hpfs
fs: hpfs: Initialize filesystem timestamp ranges
2019-08-30 08:11:25 -07:00
hugetlbfs
mm/hugetlbfs: fix for_each_hstate() loop in init_hugetlbfs_fs()
2020-01-04 19:19:19 +01:00
iomap
iomap: fix return value of iomap_dio_bio_actor on 32bit systems
2020-01-04 19:17:31 +01:00
isofs
Merge tag 'y2038-vfs' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground
2019-09-19 09:42:37 -07:00
jbd2
jbd2: Fix statistics for the number of logged blocks
2020-01-04 19:17:14 +01:00
jffs2
Revert "jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()"
2019-12-04 22:31:06 +01:00
jfs
Merge tag 'y2038-vfs' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground
2019-09-19 09:42:37 -07:00
kernfs
kernfs: fix ino wrap-around detection
2019-12-13 08:42:53 +01:00
lockd
lockd: Make two symbols static
2019-07-03 17:52:09 -04:00
minix
fs: Fill in max and min timestamps in superblock
2019-08-30 07:27:17 -07:00
nfs
NFSv4.x: Drop the slot if nfs4_delegreturn_prepare waits for layoutreturn
2020-01-17 19:48:48 +01:00
nfs_common
treewide: Add SPDX license identifier - Makefile/Kconfig
2019-05-21 10:50:46 +02:00
nfsd
nfsd: depend on CRYPTO_MD5 for legacy client tracking
2020-01-26 10:01:01 +01:00
nilfs2
vfs: create a generic checking and prep function for FS_IOC_SETFLAGS
2019-07-01 08:25:34 -07:00
nls
treewide: Add SPDX license identifier - Makefile/Kconfig
2019-05-21 10:50:46 +02:00
notify
fs: call fsnotify_sb_delete after evict_inodes
2020-01-12 12:21:38 +01:00
ntfs
ntfs: remove (un)?likely() from IS_ERR() conditions
2019-09-26 10:10:44 -07:00
ocfs2
ocfs2: call journal flush to mark journal as empty after journal recovery when mount
2020-01-17 19:49:08 +01:00
omfs
fs: omfs: Initialize filesystem timestamp ranges
2019-08-30 08:11:25 -07:00
openpromfs
Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-07-19 10:42:02 -07:00
orangefs
Merge tag 'for-linus-5.4-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux
2019-09-19 10:21:35 -07:00
overlayfs
ovl: relax WARN_ON() on rename to self
2019-12-17 19:56:11 +01:00
proc
proc/meminfo: fix output alignment
2019-10-19 06:32:32 -04:00
pstore
pstore/ram: Regularize prz label allocation lifetime
2020-01-14 20:08:28 +01:00
qnx4
fs: Fill in max and min timestamps in superblock
2019-08-30 07:27:17 -07:00
qnx6
fs: Fill in max and min timestamps in superblock
2019-08-30 07:27:17 -07:00
quota
fs: avoid softlockups in s_inodes iterators
2020-01-12 12:21:37 +01:00
ramfs
vfs: Convert ramfs, shmem, tmpfs, devtmpfs, rootfs to use the new mount API
2019-09-12 21:05:34 -04:00
reiserfs
reiserfs: fix handling of -EOPNOTSUPP in reiserfs_for_each_xattr
2020-01-23 08:22:57 +01:00
romfs
Merge branch 'work.mount2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-09-19 10:06:57 -07:00
squashfs
Merge branch 'work.mount2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-09-19 10:06:57 -07:00
sysfs
Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-07-19 10:42:02 -07:00
sysv
fs: sysv: Initialize filesystem timestamp ranges
2019-08-30 07:27:18 -07:00
tracefs
tracing: Do not create tracefs files if tracefs lockdown is in effect
2019-10-12 20:49:07 -04:00
ubifs
ubifs: do_kill_orphans: Fix a memory leak bug
2020-01-17 19:49:00 +01:00
udf
fs-udf: Delete an unnecessary check before brelse()
2019-09-04 18:19:43 +02:00
ufs
Merge tag 'y2038-vfs' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/playground
2019-09-19 09:42:37 -07:00
unicode
unicode: make array 'token' static const, makes object smaller
2019-09-17 11:48:24 -04:00
verity
fs-verity: support builtin file signatures
2019-08-12 19:33:50 -07:00
xfs
xfs: Sanity check flags of Q_XQUOTARM call
2020-01-26 10:00:59 +01:00
aio.c
aio: Fix io_pgetevents() struct __compat_aio_sigset layout
2019-10-21 19:12:19 -04:00
anon_inodes.c
Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-07-19 10:42:02 -07:00
attr.c
timestamp_truncate: Replace users of timespec64_trunc
2019-08-30 07:27:17 -07:00
bad_inode.c
…
binfmt_aout.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
binfmt_elf_fdpic.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
binfmt_elf.c
elf: don't use MAP_FIXED_NOREPLACE for elf executable mappings
2019-10-06 13:53:27 -07:00
binfmt_em86.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
binfmt_flat.c
fs/binfmt_flat.c: remove set but not used variable 'inode'
2019-07-16 19:23:22 -07:00
binfmt_misc.c
Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-07-19 10:42:02 -07:00
binfmt_script.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
block_dev.c
bdev: Refresh bdev size for disks without partitioning
2019-12-13 08:43:19 +01:00
buffer.c
fs: move guard_bio_eod() after bio_set_op_attrs
2020-01-17 19:48:21 +01:00
char_dev.c
chardev: Avoid potential use-after-free in 'chrdev_open()'
2020-01-14 20:08:18 +01:00
compat_binfmt_elf.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 193
2019-05-30 11:29:21 -07:00
compat_ioctl.c
fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP
2020-01-09 10:20:05 +01:00
compat.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
coredump.c
coredump: split pipe command whitespace before expanding template
2019-08-03 07:02:01 -07:00
d_path.c
[PATCH] fix d_absolute_path() interplay with fsmount()
2019-08-30 19:31:09 -04:00
dax.c
fs/dax: Fix pmd vs pte conflict detection
2019-10-22 22:53:02 -07:00
dcache.c
Merge branch 'work.dcache2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-07-20 09:15:51 -07:00
dcookies.c
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
direct-io.c
fs/direct-io.c: fix kernel-doc warning
2019-10-14 15:04:01 -07:00
drop_caches.c
fs: avoid softlockups in s_inodes iterators
2020-01-12 12:21:37 +01:00
eventfd.c
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
eventpoll.c
PM / wakeup: Show wakeup sources stats in sysfs
2019-08-21 00:20:40 +02:00
exec.c
exit/exec: Seperate mm_release()
2019-11-29 10:10:10 +01:00
fcntl.c
fs: mark expected switch fall-throughs
2019-04-08 18:21:02 -05:00
fhandle.c
fs/handle.c - fix up kerneldoc
2019-08-07 21:51:47 -04:00
file_table.c
vfs: Export flush_delayed_fput for use by knfsd.
2019-08-19 11:00:39 -04:00
file.c
Merge tag 'io_uring-2019-03-06' of git://git.kernel.dk/linux-block
2019-03-08 14:48:40 -08:00
filesystems.c
…
fs_context.c
vfs: subtype handling moved to fuse
2019-09-06 21:28:49 +02:00
fs_parser.c
vfs: Make fs_parse() handle fs_param_is_fd-type params better
2019-09-12 21:06:14 -04:00
fs_pin.c
switch the remnants of releasing the mountpoint away from fs_pin
2019-07-16 22:52:37 -04:00
fs_struct.c
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
fs_types.c
…
fs-writeback.c
cgroup,writeback: don't switch wbs immediately on dead wbs if the memcg is dead
2019-11-08 13:37:24 -07:00
fsopen.c
Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-07-19 10:42:02 -07:00
inode.c
fs: avoid softlockups in s_inodes iterators
2020-01-12 12:21:37 +01:00
internal.h
fs: move guard_bio_eod() after bio_set_op_attrs
2020-01-17 19:48:21 +01:00
io_uring.c
Revert "io_uring: only allow submit from owning task"
2020-01-29 16:45:24 +01:00
ioctl.c
compat_ioctl: add compat_ptr_ioctl()
2019-12-17 19:55:30 +01:00
Kconfig
Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt
2019-09-18 16:59:14 -07:00
Kconfig.binfmt
binfmt_flat: make support for old format binaries optional
2019-06-24 09:16:47 +10:00
libfs.c
fs/libfs.c: fix kernel-doc warning
2019-10-14 15:04:01 -07:00
locks.c
locks: print unsigned ino in /proc/locks
2020-01-09 10:19:57 +01:00
Makefile
Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/fscrypt
2019-09-18 16:59:14 -07:00
mbcache.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
mount.h
switch the remnants of releasing the mountpoint away from fs_pin
2019-07-16 22:52:37 -04:00
mpage.c
fs: move guard_bio_eod() after bio_set_op_attrs
2020-01-17 19:48:21 +01:00
namei.c
fs/namei.c: keep track of nd->root refcount status
2019-09-03 09:30:45 -04:00
namespace.c
fs/namespace.c: fix use-after-free of mount in mnt_warn_timestamp_expiry()
2019-10-16 23:15:09 -04:00
no-block.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
nsfs.c
vfs: Convert nsfs to use the new mount API
2019-05-25 18:00:06 -04:00
open.c
fs: remove unlikely() from WARN_ON() condition
2019-09-26 10:10:30 -07:00
pipe.c
vfs: Convert pipe to use the new mount API
2019-05-25 18:00:07 -04:00
pnode.c
fs/namespace: fix unprivileged mount propagation
2019-06-17 17:36:09 -04:00
pnode.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 209
2019-05-30 11:29:53 -07:00
posix_acl.c
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
proc_namespace.c
vfs: subtype handling moved to fuse
2019-09-06 21:28:49 +02:00
read_write.c
vfs: fix page locking deadlocks when deduping files
2019-08-16 18:43:24 -07:00
readdir.c
filldir[64]: remove WARN_ON_ONCE() for bad directory entries
2019-10-18 18:41:16 -04:00
select.c
fs/select.c: use struct_size() in kmalloc()
2019-07-16 19:23:25 -07:00
seq_file.c
seq_file: fix problem when seeking mid-record
2019-08-13 16:06:52 -07:00
signalfd.c
fs: mark expected switch fall-throughs
2019-04-08 18:21:02 -05:00
splice.c
splice: only read in as much information as there is pipe buffer space
2019-12-17 19:56:52 +01:00
stack.c
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
stat.c
…
statfs.c
vfs: Fix EOVERFLOW testing in put_compat_statfs64
2019-10-03 14:21:35 -07:00
super.c
fs: call fsnotify_sb_delete after evict_inodes
2020-01-12 12:21:38 +01:00
sync.c
fs/sync.c: sync_file_range(2) may use WB_SYNC_ALL writeback
2019-05-14 09:47:50 -07:00
timerfd.c
timerfd: Prepare for PREEMPT_RT
2019-08-01 20:51:23 +02:00
userfaultfd.c
userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK
2020-01-04 19:18:32 +01:00
utimes.c
utimes: Clamp the timestamps before update
2019-08-30 07:27:17 -07:00
xattr.c
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00