iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
Trond Myklebust e911b8158e NFSv4: Fix a use-after-free problem in open() 
If we interrupt the nfs4_wait_for_completion_rpc_task() call in
nfs4_run_open_task(), then we don't prevent the RPC call from
completing. So freeing up the opendata->f_attr.mdsthreshold
in the error path in _nfs4_do_open() leads to a use-after-free
when the XDR decoder tries to decode the mdsthreshold information
from the server.

Fixes: 82be417aa37c0 (NFSv4.1 cache mdsthreshold values on OPEN)
Tested-by: Steve Dickson <SteveD@redhat.com>
Cc: stable@vger.kernel.org # 3.5+
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
2014-03-28 20:12:10 -04:00
..
9p
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-01-28 08:38:04 -08:00
adfs
adfs: delayed freeing of sbi
2013-10-24 23:43:27 -04:00
affs
affs: use ->kill_sb() to simplify ->put_super() and failure exits of ->mount()
2014-01-25 03:13:01 -05:00
afs
afs: proc cells and rootcell are writeable
2014-02-01 10:59:39 -08:00
autofs4
autofs: fix symlinks aren't checked for expiry
2014-01-23 16:36:59 -08:00
befs
befs: iget_locked() doesn't return an ERR_PTR
2014-01-25 03:14:38 -05:00
bfs
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
btrfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs
2014-02-09 11:12:26 -08:00
cachefiles
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2013-11-13 15:34:18 +09:00
ceph
ceph: fix missing dput in ceph_set_acl
2014-01-31 08:14:06 -08:00
cifs
fix O_SYNC|O_APPEND syncing the wrong range on write()
2014-02-09 15:18:09 -05:00
coda
coda_revalidate_inode(): switch to passing inode...
2013-11-09 00:16:21 -05:00
configfs
configfs: fix race between dentry put and lookup
2013-11-21 16:42:27 -08:00
cramfs
cramfs: take headers to fs/cramfs
2014-01-25 03:13:02 -05:00
debugfs
debugfs: use list_next_entry() in debugfs_remove_recursive()
2013-11-13 12:09:24 +09:00
devpts
devpts: plug the memory leak in kill_sb
2013-11-13 12:09:36 +09:00
dlm
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2014-01-25 11:17:34 -08:00
ecryptfs
ecryptfs: fix failure handling in ->readlink()
2014-01-25 03:13:00 -05:00
efivarfs
consolidate simple ->d_delete() instances
2013-11-15 22:04:17 -05:00
efs
efs: get rid of ->put_super()
2014-01-25 03:13:02 -05:00
exofs
exofs: Print less in r4w
2014-01-23 18:54:14 +02:00
exportfs
exportfs: fix quadratic behavior in filehandle lookup
2013-11-09 00:16:38 -05:00
ext2
ext2/3/4: use generic posix ACL infrastructure
2014-01-25 23:58:19 -05:00
ext3
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-01-28 08:38:04 -08:00
ext4
fix O_SYNC|O_APPEND syncing the wrong range on write()
2014-02-09 15:18:09 -05:00
f2fs
Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block
2014-01-30 11:19:05 -08:00
fat
fat: rcu-delay unloading nls and freeing sbi
2013-10-24 23:43:28 -04:00
freevxfs
[readdir] convert freevxfs
2013-06-29 12:56:53 +04:00
fscache
Merge branch 'for-3.13/core' of git://git.kernel.dk/linux-block
2013-11-14 12:08:14 +09:00
fuse
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-01-28 08:38:04 -08:00
gfs2
Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block
2014-01-30 11:19:05 -08:00
hfs
fs/hfs/btree.h: remove duplicate defines
2013-11-13 12:09:32 +09:00
hfsplus
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-02-01 10:43:45 -08:00
hostfs
um: hostfs: make functions static
2014-01-26 11:51:09 +01:00
hpfs
hpfs: optimize quad buffer loading
2014-02-02 16:24:07 -08:00
hppfs
clean up scary strncpy(dst, src, strlen(src)) uses
2013-07-03 16:07:41 -07:00
hugetlbfs
cope with potentially long ->d_dname() output for shmem/hugetlb
2013-08-24 12:10:17 -04:00
isofs
isofs: don't pass dentry to isofs_hash{i,}_common()
2013-10-24 23:34:59 -04:00
jbd
jbd: Revise KERN_EMERG error messages
2013-12-04 12:27:46 +01:00
jbd2
jbd2: rename obsoleted msg JBD->JBD2
2013-12-08 21:14:59 -05:00
jffs2
MTD updates for 3.14:
2014-01-28 18:56:37 -08:00
jfs
jfs: fix generic posix ACL regression
2014-02-08 10:50:58 -06:00
kernfs
kernfs: make kernfs_deactivate() honor KERNFS_LOCKDEP flag
2014-02-05 11:44:04 -08:00
lockd
LOCKD: Don't call utsname()->nodename from nlmclnt_setlockargs
2013-08-05 15:03:46 -04:00
logfs
Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block
2014-01-30 11:19:05 -08:00
minix
fs/minix: Drop dependency on H8300
2013-09-16 18:20:25 -07:00
ncpfs
ncpfs: rcu-delay unload_nls() and freeing ncp_server
2013-10-24 23:43:28 -04:00
nfs
NFSv4: Fix a use-after-free problem in open()
2014-03-28 20:12:10 -04:00
nfs_common
…
nfsd
Merge branch 'for-3.14' of git://linux-nfs.org/~bfields/linux
2014-01-30 10:18:43 -08:00
nilfs2
Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block
2014-01-30 11:19:05 -08:00
nls
nls: have register_nls() set ->owner
2014-01-25 03:14:05 -05:00
notify
fanotify: Fix use after free for permission events
2014-01-29 13:57:17 +01:00
ntfs
fix O_SYNC|O_APPEND syncing the wrong range on write()
2014-02-09 15:18:09 -05:00
ocfs2
ocfs2: free allocated clusters if error occurs after ocfs2_claim_clusters
2014-02-06 13:48:51 -08:00
omfs
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
openpromfs
[readdir] convert openpromfs
2013-06-29 12:56:32 +04:00
proc
fs/proc/array.c: change do_task_stat() to use while_each_thread()
2014-01-23 16:37:02 -08:00
pstore
pstore: Don't allow high traffic options on fragile devices
2013-12-20 13:12:01 -08:00
qnx4
qnx4: clean qnx4_fill_super() up
2014-01-25 03:13:03 -05:00
qnx6
[readdir] convert qnx6
2013-06-29 12:56:39 +04:00
quota
genetlink: make multicast groups const, prevent abuse
2013-11-19 16:39:06 -05:00
ramfs
fs/ramfs: move ramfs_aops to inode.c
2014-01-23 16:36:58 -08:00
reiserfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-01-28 08:38:04 -08:00
romfs
romfs: fix returm err while getting inode in fill_super
2014-01-23 16:37:04 -08:00
squashfs
Squashfs: fix failure to unlock pages on decompress error
2013-11-24 01:02:50 +00:00
sysfs
Revert "kernfs, sysfs, driver-core: implement kernfs_remove_self() and its wrappers"
2014-01-13 14:05:13 -08:00
sysv
sysv: Add forgotten superblock lock init for v7 fs
2013-09-29 22:02:02 -04:00
ubifs
fs/ubifs: use rbtree postorder iteration helper instead of opencoding
2014-01-23 16:37:03 -08:00
udf
udf: Fix lockdep warning from udf_symlink()
2013-12-23 22:02:16 +01:00
ufs
truncate: drop 'oldsize' truncate_pagecache() parameter
2013-09-12 15:38:02 -07:00
xfs
fix O_SYNC|O_APPEND syncing the wrong range on write()
2014-02-09 15:18:09 -05:00
aio.c
Merge git://git.kvack.org/~bcrl/aio-next
2013-12-22 11:03:49 -08:00
anon_inodes.c
... and kill anon_inode_getfile_private()
2013-11-09 00:16:28 -05:00
attr.c
fs: fix iversion handling
2013-12-05 16:36:21 -06:00
bad_inode.c
[readdir] ->readdir() is gone
2013-06-29 12:57:04 +04:00
binfmt_aout.c
dump_skip(): dump_seek() replacement taking coredump_params
2013-11-09 00:16:26 -05:00
binfmt_elf_fdpic.c
elf{,_fdpic} coredump: get rid of pointless if (siginfo->si_signo)
2013-11-09 00:16:30 -05:00
binfmt_elf.c
fs: binfmt_elf: remove unused defines INTERPRETER_NONE and INTERPRETER_ELF
2014-01-23 16:36:58 -08:00
binfmt_em86.c
file->f_op is never NULL...
2013-10-24 23:34:54 -04:00
binfmt_flat.c
…
binfmt_misc.c
…
binfmt_script.c
…
binfmt_som.c
…
bio-integrity.c
bio-integrity: Fix bio_integrity_verify segment start bug
2014-01-21 20:32:05 -08:00
bio.c
Revert "block: Warn and free bio if bi_end_io is not set"
2014-01-08 14:14:22 -07:00
block_dev.c
a trivial writeback fix
2013-09-13 23:06:40 -04:00
buffer.c
mm: __set_page_dirty uses spin_lock_irqsave instead of spin_lock_irq
2014-02-06 13:48:51 -08:00
char_dev.c
Merge branch 'for-3.13/core' of git://git.kernel.dk/linux-block
2013-11-14 12:08:14 +09:00
compat_binfmt_elf.c
…
compat_ioctl.c
fs/compat_ioctl.c: fix an underflow issue (harmless)
2014-01-21 16:19:42 -08:00
compat.c
[readdir] constify ->actor
2013-06-29 12:57:05 +04:00
coredump.c
coredump: make __get_dumpable/get_dumpable inline, kill fs/coredump.h
2014-01-23 16:37:01 -08:00
dcache.c
__dentry_path() fixes
2014-01-26 12:37:55 -05:00
dcookies.c
fs/compat: fix lookup_dcookie() parameter handling
2014-01-29 16:22:40 -08:00
direct-io.c
block: Abstract out bvec iterator
2013-11-23 22:33:47 -08:00
drop_caches.c
shrinker: add node awareness
2013-09-10 18:56:31 -04:00
eventfd.c
eventfd_ctx_fdget(): use fdget() instead of fget()
2014-01-25 03:13:04 -05:00
eventpoll.c
epoll: do not take the nested ep->mtx on EPOLL_CTL_DEL
2014-01-02 14:40:30 -08:00
exec.c
execve: use 'struct filename *' for executable name passing
2014-02-05 12:54:53 -08:00
fcntl.c
file->f_op is never NULL...
2013-10-24 23:34:54 -04:00
fhandle.c
…
file_table.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2013-11-13 15:34:18 +09:00
file.c
fs: __fget_light() can use __fget() in slow path
2014-01-25 03:14:38 -05:00
filesystems.c
…
fs_struct.c
seqcount: Add lockdep functionality to seqcount/seqlock structures
2013-11-06 12:40:26 +01:00
fs-writeback.c
writeback: Fix data corruption on NFS
2013-12-14 04:21:26 +08:00
inode.c
locks: break delegations on any attribute modification
2013-11-09 00:16:44 -05:00
internal.h
get rid of s_files and files_lock
2013-11-09 00:16:20 -05:00
ioctl.c
file->f_op is never NULL...
2013-10-24 23:34:54 -04:00
ioprio.c
…
Kconfig
fs: remove generic_acl
2014-01-26 08:26:40 -05:00
Kconfig.binfmt
…
libfs.c
consolidate simple ->d_delete() instances
2013-11-15 22:04:17 -05:00
locks.c
locks: missing unlock on error in generic_add_lease()
2013-11-13 07:30:53 -05:00
Makefile
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-01-28 08:38:04 -08:00
mbcache.c
fs: convert fs shrinkers to new scan/count API
2013-09-10 18:56:31 -04:00
mount.h
vfs: Is mounted should be testing mnt_ns for NULL or error.
2014-01-26 08:26:42 -05:00
mpage.c
block: Abstract out bvec iterator
2013-11-23 22:33:47 -08:00
namei.c
execve: use 'struct filename *' for executable name passing
2014-02-05 12:54:53 -08:00
namespace.c
Driver core / sysfs patches for 3.14-rc1
2014-01-20 15:49:44 -08:00
no-block.c
…
open.c
locks: break delegations on any attribute modification
2013-11-09 00:16:44 -05:00
pipe.c
fs/pipe.c: skip file_update_time on frozen fs
2014-01-23 16:37:00 -08:00
pnode.c
split __lookup_mnt() in two functions
2013-10-24 23:35:00 -04:00
pnode.h
vfs: Don't copy mount bind mounts of /proc/<pid>/ns/mnt between namespaces
2013-08-26 18:42:15 -07:00
posix_acl.c
fs: get_acl() must be allowed to return EOPNOTSUPP
2014-02-03 17:12:37 -05:00
proc_namespace.c
fs/proc_namespace.c: simplify testing nsp and nsp->mnt_ns
2014-01-23 16:37:02 -08:00
read_write.c
fs/compat: fix parameter handling for compat readv/writev syscalls
2014-01-29 16:22:39 -08:00
readdir.c
file->f_op is never NULL...
2013-10-24 23:34:54 -04:00
select.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2013-11-13 15:34:18 +09:00
seq_file.c
seq_file: always clear m->count when we free m->buf
2013-11-18 19:07:53 -08:00
signalfd.c
…
splice.c
fuse: fix pipe_buf_operations
2014-01-22 19:36:57 +01:00
stack.c
…
stat.c
vfs: split out vfs_getattr_nosec
2013-11-09 00:16:31 -05:00
statfs.c
vfs: allow O_PATH file descriptors for fstatfs()
2013-10-12 13:12:31 -07:00
super.c
fs/super.c: sync ro remount after blocking writers
2014-01-31 14:29:36 -05:00
sync.c
fix O_SYNC|O_APPEND syncing the wrong range on write()
2014-02-09 15:18:09 -05:00
timerfd.c
…
utimes.c
locks: break delegations on any attribute modification
2013-11-09 00:16:44 -05:00
xattr.c
…