iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
Eric Biggers c9cc8d01fb devpts: fix error handling in devpts_mntget() 
If devpts_ptmx_path() returns an error code, then devpts_mntget()
dereferences an ERR_PTR():

    BUG: unable to handle kernel paging request at fffffffffffffff5
    IP: devpts_mntget+0x13f/0x280 fs/devpts/inode.c:173

Fix it by returning early in the error paths.

Reproducer:

    #define _GNU_SOURCE
    #include <fcntl.h>
    #include <sched.h>
    #include <sys/ioctl.h>
    #define TIOCGPTPEER _IO('T', 0x41)

    int main()
    {
        for (;;) {
            int fd = open("/dev/ptmx", 0);
            unshare(CLONE_NEWNS);
            ioctl(fd, TIOCGPTPEER, 0);
        }
    }

Fixes: 311fc65c9fb9 ("pty: Repair TIOCGPTPEER")
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: <stable@vger.kernel.org> # v4.13+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-01-31 08:48:37 -08:00
..
9p
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
adfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
affs
affs: convert to new i_version API
2018-01-29 06:42:20 -05:00
afs
inode->i_version rework for v4.16
2018-01-29 13:33:53 -08:00
autofs4
Merge branch 'userns-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2018-01-30 14:43:12 -08:00
befs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
bfs
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
btrfs
for-4.16-tag
2018-01-29 14:04:23 -08:00
cachefiles
fs: annotate ->poll() instances
2017-11-27 16:20:05 -05:00
ceph
ceph: drop negative child dentries before try pruning inode's alias
2017-12-08 11:07:12 +01:00
cifs
fs/cifs/cifsacl.c Fixes typo in a comment
2018-01-28 09:19:45 -06:00
coda
Merge branch 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-30 17:58:07 -08:00
configfs
configfs: make ci_type field, some pointers and function arguments const
2017-10-19 16:15:16 +02:00
cramfs
cramfs: fix MTD dependency
2017-12-17 12:20:58 -08:00
crypto
fscrypt: lots of cleanups, mostly courtesy by Eric Biggers
2017-11-14 11:35:15 -08:00
debugfs
fs: annotate ->poll() instances
2017-11-27 16:20:05 -05:00
devpts
devpts: fix error handling in devpts_mntget()
2018-01-31 08:48:37 -08:00
dlm
Merge branch 'work.sock_recvmsg' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-30 18:59:03 -08:00
ecryptfs
Merge branch 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-30 17:58:07 -08:00
efivarfs
VFS: Kill off s_options and helpers
2017-07-11 06:09:21 -04:00
efs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
exofs
exofs: switch to new i_version API
2018-01-29 06:42:20 -05:00
exportfs
Merge branch 'rebased-statx' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-03-03 11:38:56 -08:00
ext2
ext2: convert to new i_version API
2018-01-29 06:42:20 -05:00
ext4
inode->i_version rework for v4.16
2018-01-29 13:33:53 -08:00
f2fs
f2fs-for-4.16-rc1
2018-01-30 19:07:32 -08:00
fat
fat: convert to new i_version API
2018-01-29 06:42:20 -05:00
freevxfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
fscache
AFS development
2017-11-16 11:41:22 -08:00
fuse
Merge branch 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-30 17:58:07 -08:00
gfs2
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
hfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
hfsplus
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
hostfs
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
hpfs
hpfs: don't bother with the i_version counter or f_version
2017-12-10 12:58:18 -08:00
hugetlbfs
fs/hugetlbfs/inode.c: change put_page/unlock_page order in hugetlbfs_fallocate()
2017-11-29 18:40:43 -08:00
isofs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
jbd2
libnvdimm for 4.15
2017-11-17 09:51:57 -08:00
jffs2
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
jfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
kernfs
Merge branch 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-30 17:58:07 -08:00
lockd
lockd: Fix server refcounting
2018-01-24 17:33:57 -05:00
minix
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
ncpfs
Merge branch 'work.sock_recvmsg' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-30 18:59:03 -08:00
nfs
NFS client updates for Linux 4.16
2018-01-30 19:03:48 -08:00
nfs_common
lockd: fix "list_add double add" caused by legacy signal interface
2017-11-27 16:45:11 -05:00
nfsd
inode->i_version rework for v4.16
2018-01-29 13:33:53 -08:00
nilfs2
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
nls
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
notify
Merge branch 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-30 17:58:07 -08:00
ntfs
ntfs: remove i_version handling
2018-01-01 10:09:33 -05:00
ocfs2
Merge branch 'work.sock_recvmsg' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-30 18:59:03 -08:00
omfs
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
openpromfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
orangefs
Merge branch 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-30 17:58:07 -08:00
overlayfs
ovl: fix overlay: warning prefix
2017-12-14 11:14:52 +01:00
proc
Merge branch 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-30 17:58:07 -08:00
pstore
treewide: Switch DEFINE_TIMER callbacks to struct timer_list *
2017-11-21 15:57:05 -08:00
qnx4
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
qnx6
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
quota
quota: Check for register_shrinker() failure.
2017-11-29 16:46:48 +01:00
ramfs
mm: make pagevec_lookup() update index
2017-09-06 17:27:26 -07:00
reiserfs
Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
2017-11-30 18:38:47 -05:00
romfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
squashfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
sysfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
sysv
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
tracefs
VFS: Don't use save/replace_mount_options if not using generic_show_options
2017-07-06 03:31:46 -04:00
ubifs
ubifs: remove error message in ubifs_xattr_get
2018-01-18 00:18:49 +01:00
udf
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
ufs
ufs: use new i_version API
2018-01-29 06:42:21 -05:00
xfs
inode->i_version rework for v4.16
2018-01-29 13:33:53 -08:00
aio.c
Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 11:54:55 -08:00
anon_inodes.c
Replace <asm/uaccess.h> with <linux/uaccess.h> globally
2016-12-24 11:46:01 -08:00
attr.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
bad_inode.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
binfmt_aout.c
fs: fix kernel_read prototype
2017-09-04 19:05:15 -04:00
binfmt_elf_fdpic.c
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 12:54:01 -08:00
binfmt_elf.c
Merge branch 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm
2017-11-16 12:50:35 -08:00
binfmt_em86.c
…
binfmt_flat.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
binfmt_misc.c
fs/binfmt_misc.c: node could be NULL when evicting inode
2017-10-13 16:18:33 -07:00
binfmt_script.c
exec: load_script: kill the onstack interp[BINPRM_BUF_SIZE] array
2017-10-03 17:54:25 -07:00
block_dev.c
Merge branch 'for-4.15/block' of git://git.kernel.dk/linux-block
2017-11-14 15:32:19 -08:00
buffer.c
fs: convert to bio_last_bvec_all()
2018-01-06 09:18:00 -07:00
char_dev.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
compat_binfmt_elf.c
fs/binfmt: Convert obsolete cputime type to nsecs
2017-02-01 09:13:51 +01:00
compat_ioctl.c
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 12:54:01 -08:00
compat.c
fs/compat.c: trim unused includes
2017-04-17 12:52:27 -04:00
coredump.c
Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 11:54:55 -08:00
dax.c
Revert "mm: replace p??_write with pte_access_permitted in fault + gup paths"
2017-12-15 18:53:22 -08:00
dcache.c
fs/dcache: Use release-acquire for name/length update
2017-12-04 10:52:52 -08:00
dcookies.c
Replace <asm/uaccess.h> with <linux/uaccess.h> globally
2016-12-24 11:46:01 -08:00
direct-io.c
Merge branch 'for-4.15/block' of git://git.kernel.dk/linux-block
2017-11-14 15:32:19 -08:00
drop_caches.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
eventfd.c
fs: annotate ->poll() instances
2017-11-27 16:20:05 -05:00
eventpoll.c
eventpoll: no need to mask the result of epi_item_poll() again
2017-11-28 19:56:15 -05:00
exec.c
exec: Weaken dumpability for secureexec
2018-01-03 10:13:36 -08:00
fcntl.c
Merge branch 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-30 17:58:07 -08:00
fhandle.c
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 12:54:01 -08:00
file_table.c
fs, mm: account filp cache to kmemcg
2017-11-15 18:21:04 -08:00
file.c
fs: Eliminate cond_resched_rcu_qs() in favor of cond_resched()
2017-12-04 10:28:59 -08:00
filesystems.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
fs_pin.c
Merge branch 'linus' into locking/core, to resolve conflicts
2017-11-07 10:32:44 +01:00
fs_struct.c
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>
2017-03-02 08:42:35 +01:00
fs-writeback.c
writeback: update comment in inode_io_list_move_locked
2018-01-06 09:18:00 -07:00
inode.c
fs: only set S_VERSION when updating times if necessary
2018-01-29 06:42:21 -05:00
internal.h
fs: expose do_unlinkat for built-in callers
2017-11-10 08:48:46 -05:00
ioctl.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
iomap.c
Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 12:08:18 -08:00
Kconfig
fs/Kconfig: kill CONFIG_PERCPU_RWSEM some more
2017-07-12 16:26:00 -07:00
Kconfig.binfmt
ARM: enable elf_fdpic on systems with an MMU
2017-09-10 19:31:46 -04:00
libfs.c
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
locks.c
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
Makefile
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
mbcache.c
fs/mbcache.c: make count_objects() more robust
2017-11-29 18:40:43 -08:00
mount.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
mpage.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
namei.c
Merge branch 'work.mqueue' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-30 18:32:21 -08:00
namespace.c
VFS: Handle lazytime in do_mount()
2017-12-09 20:16:33 -05:00
no-block.c
…
nsfs.c
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
open.c
ovl: don't allow writing ioctl on lower layer
2017-09-05 12:53:12 +02:00
pipe.c
fs: annotate ->poll() instances
2017-11-27 16:20:05 -05:00
pnode.c
mnt: Make propagate_umount less slow for overlapping mount propagation trees
2017-05-23 08:41:17 -05:00
pnode.h
mnt: Tuck mounts under others instead of creating shadow/side mounts.
2017-02-04 00:01:06 +13:00
posix_acl.c
posix_acl: convert posix_acl.a_refcount from atomic_t to refcount_t
2018-01-02 19:27:28 -08:00
proc_namespace.c
Merge branch 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-30 17:58:07 -08:00
read_write.c
Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 12:08:18 -08:00
readdir.c
Merge branch 'linus' into locking/core, to resolve conflicts
2017-11-07 10:32:44 +01:00
select.c
make kernel-side POLL... arch-independent
2017-11-29 19:00:41 -05:00
seq_file.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
signalfd.c
fs: annotate ->poll() instances
2017-11-27 16:20:05 -05:00
splice.c
locking/atomics: COCCINELLE/treewide: Convert trivial ACCESS_ONCE() patterns to READ_ONCE()/WRITE_ONCE()
2017-10-25 11:01:08 +02:00
stack.c
…
stat.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
statfs.c
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
super.c
sget(): handle failures of register_shrinker()
2017-12-18 15:05:07 -05:00
sync.c
Merge branch 'for-4.15/block' of git://git.kernel.dk/linux-block
2017-11-14 15:32:19 -08:00
timerfd.c
fs: annotate ->poll() instances
2017-11-27 16:20:05 -05:00
userfaultfd.c
Merge branch 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-01-30 17:58:07 -08:00
utimes.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
xattr.c
lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
2017-10-04 18:03:15 +11:00