iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
Danilo Krummrich ea8a1f4a9a fs/proc/proc_sysctl.c: fix potential page fault while unregistering sysctl table 
[ Upstream commit a0b0d1c345d0317efe594df268feb5ccc99f651e ]

proc_sys_link_fill_cache() does not take currently unregistering sysctl
tables into account, which might result into a page fault in
sysctl_follow_link() - add a check to fix it.

This bug has been present since v3.4.

Link: http://lkml.kernel.org/r/20180228013506.4915-1-danilokrummrich@dk-develop.de
Fixes: 0e47c99d7fe25 ("sysctl: Replace root_list with links between sysctl_table_sets")
Signed-off-by: Danilo Krummrich <danilokrummrich@dk-develop.de>
Acked-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: "Luis R . Rodriguez" <mcgrof@kernel.org>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-30 07:49:07 +02:00
..
9p
fs/9p: Compare qid.path in v9fs_test_inode
2017-11-30 08:37:22 +00:00
adfs
…
affs
affs_lookup(): close a race with affs_remove_link()
2018-05-30 07:48:51 +02:00
afs
afs: Fix afs_kill_pages()
2017-12-20 10:04:56 +01:00
autofs4
autofs: mount point create should honour passed in mode
2018-04-24 09:32:11 +02:00
befs
…
bfs
…
btrfs
Btrfs: send, fix issuing write op when processing hole in no data mode
2018-05-30 07:49:03 +02:00
cachefiles
FS-Cache: Add missing initialization of ret in cachefiles_write_page()
2015-11-16 20:38:43 -05:00
ceph
ceph: drop negative child dentries before try pruning inode's alias
2017-12-20 10:04:52 +01:00
cifs
cifs: silence compiler warnings showing up with gcc-8.0.0
2018-05-30 07:48:56 +02:00
coda
coda: fix 'kernel memory exposure attempt' in fsync
2017-11-24 08:32:25 +01:00
configfs
configfs: Fix race between create_link and configfs_rmdir
2017-06-26 07:13:08 +02:00
cramfs
…
debugfs
dentry name snapshots
2017-08-06 19:19:42 -07:00
devpts
devpts: clean up interface to pty drivers
2016-08-16 09:30:49 +02:00
dlm
dlm: avoid double-free on error path in dlm_device_{register,unregister}
2017-09-13 14:09:45 -07:00
ecryptfs
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 07:48:52 +02:00
efivarfs
efi: Make efivarfs entries immutable by default
2016-03-03 15:07:09 -08:00
efs
…
exofs
osd fs: __r4w_get_page rely on PageUptodate for uptodate
2015-12-12 10:15:34 -08:00
exportfs
…
ext2
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 07:48:52 +02:00
ext4
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 07:48:52 +02:00
f2fs
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 07:48:52 +02:00
fat
fat: fix using uninitialized fields of fat_inode/fsinfo_inode
2017-03-15 09:57:15 +08:00
freevxfs
…
fscache
FS-Cache: fix dereference of NULL user_key_payload
2017-10-27 10:23:18 +02:00
fuse
fuse: fix READDIRPLUS skipping an entry
2017-11-02 09:40:49 +01:00
gfs2
GFS2: Take inode off order_write list when setting jdata flag
2017-12-20 10:04:59 +01:00
hfs
…
hfsplus
hfsplus: stop workqueue when fill_super() failed
2018-05-26 08:49:01 +02:00
hostfs
hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common()
2016-09-30 10:18:39 +02:00
hpfs
hpfs: implement the show_options method
2016-06-01 12:15:54 -07:00
hugetlbfs
mm: larger stack guard gap, between vmas
2017-06-26 07:13:11 +02:00
isofs
isofs: fix timestamps beyond 2027
2017-11-30 08:37:20 +00:00
jbd2
ext4: set h_journal if there is a failure starting a reserved handle
2018-05-02 07:53:38 -07:00
jffs2
jffs2: Fix use-after-free bug in jffs2_iget()'s error handling path
2018-05-30 07:48:54 +02:00
jfs
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 07:48:52 +02:00
kernfs
kernfs: fix regression in kernfs_fop_write caused by wrong type
2018-02-16 20:09:42 +01:00
lockd
lockd: lost rollback of set_grace_period() in lockd_down_net()
2018-05-26 08:48:50 +02:00
logfs
mm, fs: introduce mapping_gfp_constraint()
2015-11-06 17:50:42 -08:00
minix
…
ncpfs
staging: ncpfs: memory corruption in ncp_read_kernel()
2018-03-28 18:40:15 +02:00
nfs
nfs: Do not convert nfs_idmap_cache_timeout to jiffies
2018-05-30 07:48:53 +02:00
nfs_common
lockd: fix "list_add double add" caused by legacy signal interface
2018-02-03 17:04:28 +01:00
nfsd
nfsd4: permit layoutget of executable-only files
2018-03-24 10:58:48 +01:00
nilfs2
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 07:48:52 +02:00
nls
…
notify
fanotify: fix logic of events on child
2018-04-24 09:32:11 +02:00
ntfs
mm, fs: introduce mapping_gfp_constraint()
2015-11-06 17:50:42 -08:00
ocfs2
ocfs2: return error when we attempt to access a dirty bh in jbd2
2018-05-30 07:48:55 +02:00
omfs
…
openpromfs
…
overlayfs
ovl: filter trusted xattr for non-admin
2018-04-13 19:50:14 +02:00
proc
fs/proc/proc_sysctl.c: fix potential page fault while unregistering sysctl table
2018-05-30 07:49:07 +02:00
pstore
pstore: Use dynamic spinlock initializer
2017-08-06 19:19:43 -07:00
qnx4
…
qnx6
…
quota
quota: Check for register_shrinker() failure.
2018-02-03 17:04:28 +01:00
ramfs
mm, fs: obey gfp_mapping for add_to_page_cache()
2015-10-16 11:42:28 -07:00
reiserfs
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 07:48:52 +02:00
romfs
romfs: use different way to generate fsid for BLOCK or MTD
2017-06-17 06:39:38 +02:00
squashfs
squashfs: xattr simplifications
2015-11-13 20:34:33 -05:00
sysfs
sysfs: be careful of error returns from ops->show()
2017-04-12 12:38:33 +02:00
sysv
fix sysvfs symlinks
2015-11-23 21:11:08 -05:00
tracefs
tracefs: Fix refcount imbalance in start_creating()
2015-11-04 22:13:45 -05:00
ubifs
ubifs: Check ubifs_wbuf_sync() return code
2018-04-24 09:32:05 +02:00
udf
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 07:48:52 +02:00
ufs
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 07:48:52 +02:00
xfs
xfs: remove racy hasattr check from attr ops
2018-05-30 07:48:52 +02:00
aio.c
aio: fix io_destroy(2) vs. lookup_ioctx() race
2018-05-30 07:48:51 +02:00
anon_inodes.c
…
attr.c
vfs: move permission checking into notify_change() for utimes(NULL)
2016-10-22 12:26:56 +02:00
bad_inode.c
…
binfmt_aout.c
…
binfmt_elf_fdpic.c
libnvdimm for 4.4:
2015-11-10 12:07:22 -08:00
binfmt_elf.c
binfmt_elf: use ELF_ET_DYN_BASE only for PIE
2017-07-21 07:44:57 +02:00
binfmt_em86.c
…
binfmt_flat.c
…
binfmt_misc.c
…
binfmt_script.c
…
block_dev.c
fs/block_dev: always invalidate cleancache in invalidate_bdev()
2017-05-20 14:27:01 +02:00
buffer.c
fs: add i_blocksize()
2017-06-14 13:16:24 +02:00
char_dev.c
…
compat_binfmt_elf.c
binfmt_elf: compat: avoid unused function warning
2018-02-25 11:03:51 +01:00
compat_ioctl.c
fs: compat: Remove warning from COMPATIBLE_IOCTL
2018-04-08 11:51:57 +02:00
compat.c
…
coredump.c
coredump: Ensure proper size of sparse core files
2017-07-05 14:37:20 +02:00
dax.c
dax: disable pmd mappings
2015-11-16 23:54:45 -08:00
dcache.c
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 07:48:52 +02:00
dcookies.c
…
direct-io.c
direct-io: Prevent NULL pointer access in submit_page_section
2017-10-18 09:20:42 +02:00
drop_caches.c
…
eventfd.c
…
eventpoll.c
epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove()
2017-09-07 08:34:10 +02:00
exec.c
exec: Limit arg stack to at most 75% of _STK_LIM
2017-07-21 07:44:57 +02:00
fcntl.c
fs/fcntl: f_setown, avoid undefined behaviour
2018-01-31 12:06:11 +01:00
fhandle.c
fs/coredump: prevent fsuid=0 dumps into user-controlled directories
2016-04-12 09:08:58 -07:00
file_table.c
…
file.c
vfs: clear remainder of 'full_fds_bits' in dup_fd()
2015-11-05 23:05:32 -08:00
filesystems.c
…
fs_pin.c
…
fs_struct.c
…
fs-writeback.c
bdi: Fix oops in wb_workfn()
2018-05-16 10:06:51 +02:00
inode.c
don't put symlink bodies in pagecache into highmem
2018-02-16 20:09:38 +01:00
internal.h
…
ioctl.c
…
Kconfig
dax: disable pmd mappings
2015-11-16 23:54:45 -08:00
Kconfig.binfmt
…
libfs.c
…
locks.c
locks: don't check for race with close when setting OFD lock
2018-01-17 09:35:27 +01:00
Makefile
…
mbcache.c
…
mount.h
mnt: In propgate_umount handle visiting mounts in any order
2017-07-21 07:44:57 +02:00
mpage.c
fs: add i_blocksize()
2017-06-14 13:16:24 +02:00
namei.c
getname_kernel() needs to make sure that ->name != ->iname in long case
2018-04-24 09:32:04 +02:00
namespace.c
Don't leak MNT_INTERNAL away from internal mounts
2018-04-24 09:32:11 +02:00
no-block.c
…
nsfs.c
nsfs: mark dentry with DCACHE_RCUACCESS
2018-02-16 20:09:43 +01:00
open.c
fs: completely ignore unknown open flags
2017-07-15 11:57:44 +02:00
pipe.c
pipe: cap initial pipe capacity according to pipe-max-size limit
2018-05-26 08:48:51 +02:00
pnode.c
mnt: Make propagate_umount less slow for overlapping mount propagation trees
2017-07-21 07:44:58 +02:00
pnode.h
mnt: Add a per mount namespace limit on the number of mounts
2017-04-30 05:49:28 +02:00
posix_acl.c
tmpfs: clear S_ISGID when setting posix ACLs
2017-01-26 08:23:47 +01:00
proc_namespace.c
vfs: show_vfsstat: do not ignore errors from show_devname method
2016-04-12 09:08:55 -07:00
read_write.c
vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets
2017-10-05 09:41:45 +02:00
readdir.c
…
select.c
fs/select: add vmalloc fallback for select(2)
2018-01-31 12:06:09 +01:00
seq_file.c
Make file credentials available to the seqfile interfaces
2017-08-06 19:19:42 -07:00
signalfd.c
…
splice.c
vfs: fix uninitialized flags in splice_to_pipe()
2017-02-23 17:43:09 +01:00
stack.c
…
stat.c
ufs: restore maintaining ->i_blocks
2017-06-14 13:16:24 +02:00
statfs.c
…
super.c
sget(): handle failures of register_shrinker()
2018-03-03 10:19:41 +01:00
sync.c
fs/sync.c: make sync_file_range(2) use WB_SYNC_NONE writeback
2015-11-06 17:50:42 -08:00
timerfd.c
timerfd: Protect the might cancel mechanism proper
2017-05-08 07:46:01 +02:00
userfaultfd.c
userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE
2017-12-20 10:04:53 +01:00
utimes.c
vfs: move permission checking into notify_change() for utimes(NULL)
2016-10-22 12:26:56 +02:00
xattr.c
lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
2017-10-12 11:27:32 +02:00