iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
Theodore Ts'o f578cacd87 ext4: fix potential race between online resizing and write operations 
commit 1d0c3924a92e69bfa91163bda83c12a994b4d106 upstream.

During an online resize an array of pointers to buffer heads gets
replaced so it can get enlarged.  If there is a racing block
allocation or deallocation which uses the old array, and the old array
has gotten reused this can lead to a GPF or some other random kernel
memory getting modified.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=206443
Link: https://lore.kernel.org/r/20200221053458.730016-2-tytso@mit.edu
Reported-by: Suraj Jitindar Singh <surajjs@amazon.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org # 4.4.x
Cc: stable@kernel.org # 4.9.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-03-11 07:51:11 +01:00
..
9p
9p: avoid attaching writeback_fid on mmap with type PRIVATE
2019-10-17 13:40:54 -07:00
adfs
fs/adfs: super: fix use-after-free bug
2019-08-06 18:28:26 +02:00
affs
affs_lookup(): close a race with affs_remove_link()
2018-05-30 07:48:51 +02:00
afs
afs: Fix afs_kill_pages()
2017-12-20 10:04:56 +01:00
autofs4
autofs: fix a leak in autofs_expire_indirect()
2019-12-21 10:34:21 +01:00
befs
…
bfs
bfs: add sanity check at bfs_fill_super()
2018-12-01 09:46:33 +01:00
btrfs
Btrfs: fix btrfs_wait_ordered_range() so that it waits for all ordered extents
2020-02-28 15:39:17 +01:00
cachefiles
fscache, cachefiles: remove redundant variable 'cache'
2018-12-17 21:55:12 +01:00
ceph
ceph: fix dentry leak in ceph_readdir_prepopulate
2019-11-28 18:25:48 +01:00
cifs
cifs: fail i/o on soft mounts if sessionsetup errors out
2020-02-14 16:30:01 -05:00
coda
coda: add error handling for fget
2019-08-06 18:28:27 +02:00
configfs
configfs: fix a deadlock in configfs_symlink()
2019-11-12 19:13:24 +01:00
cramfs
Cramfs: fix abad comparison when wrap-arounds occur
2018-11-21 09:27:37 +01:00
debugfs
debugfs: fix use-after-free on symlink traversal
2019-05-16 19:45:01 +02:00
devpts
devpts: clean up interface to pty drivers
2016-08-16 09:30:49 +02:00
dlm
dlm: fix invalid cluster name warning
2019-12-21 10:34:44 +01:00
ecryptfs
ecryptfs: replace BUG_ON with error handling code
2020-02-28 15:39:17 +01:00
efivarfs
efi: Make efivarfs entries immutable by default
2016-03-03 15:07:09 -08:00
efs
…
exofs
fs/exofs: fix potential memory leak in mount option parsing
2018-11-27 16:08:00 +01:00
exportfs
exportfs: fix 'passing zero to ERR_PTR()' warning
2020-01-29 10:21:36 +01:00
ext2
ext2: Adjust indentation in ext2_fill_super
2020-02-14 16:29:58 -05:00
ext4
ext4: fix potential race between online resizing and write operations
2020-03-11 07:51:11 +01:00
f2fs
f2fs: return correct errno in f2fs_gc
2019-11-25 15:54:27 +01:00
fat
fat: work around race with userspace's read via blockdev while mounting
2019-10-07 21:01:02 +02:00
freevxfs
…
fscache
fscache: fix race between enablement and dropping of object
2018-12-17 21:55:11 +01:00
fuse
fuse: verify attributes
2019-12-21 10:34:49 +01:00
gfs2
gfs2: take jdata unstuff into account in do_grow
2019-12-05 15:26:52 +01:00
hfs
fs/hfs/extent.c: fix array out of bounds read of array extent
2019-11-28 18:25:57 +01:00
hfsplus
hfsplus: fix return value of hfsplus_get_block()
2019-11-28 18:25:56 +01:00
hostfs
hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common()
2016-09-30 10:18:39 +02:00
hpfs
hpfs: implement the show_options method
2016-06-01 12:15:54 -07:00
hugetlbfs
hugetlb: use same fault hash key for shared and private mappings
2019-06-11 12:23:52 +02:00
isofs
isofs: fix timestamps beyond 2027
2017-11-30 08:37:20 +00:00
jbd2
jbd2: switch to use jbd2_journal_abort() when failed to submit the commit record
2020-02-28 15:39:06 +01:00
jffs2
jffs2: fix use-after-free on symlink traversal
2019-05-16 19:45:01 +02:00
jfs
jfs: fix bogus variable self-initialization
2020-01-29 10:21:41 +01:00
kernfs
kernfs: Fix range checks in kernfs_get_target_path
2019-11-25 15:53:59 +01:00
lockd
lockd: fix access beyond unterminated strings in prints
2018-11-21 09:27:36 +01:00
logfs
mm, fs: introduce mapping_gfp_constraint()
2015-11-06 17:50:42 -08:00
minix
…
ncpfs
ncpfs: fix build warning of strncpy
2019-03-23 08:44:21 +01:00
nfs
nfs: NFS_SWAP should depend on SWAP
2020-02-28 15:38:54 +01:00
nfs_common
lockd: fix "list_add double add" caused by legacy signal interface
2018-02-03 17:04:28 +01:00
nfsd
nfsd: Return EPERM, not EACCES, in some SETATTR cases
2019-12-21 10:34:45 +01:00
nilfs2
do d_instantiate/unlock_new_inode combinations safely
2018-05-30 07:48:52 +02:00
nls
…
notify
fanotify: fix logic of events on child
2018-04-24 09:32:11 +02:00
ntfs
mm, fs: introduce mapping_gfp_constraint()
2015-11-06 17:50:42 -08:00
ocfs2
ocfs2: fix a NULL pointer dereference when call ocfs2_update_inode_fsync_trans()
2020-02-28 15:39:08 +01:00
omfs
…
openpromfs
…
overlayfs
Revert "ovl: modify ovl_permission() to do checks on two inodes"
2020-02-14 16:29:56 -05:00
proc
mm/page_alloc.c: calculate 'available' memory in a separate function
2020-01-23 08:18:35 +01:00
pstore
pstore/ram: Write new dumps to start of recycled zones
2020-01-12 11:22:46 +01:00
qnx4
…
qnx6
…
quota
fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long
2020-01-04 13:34:32 +01:00
ramfs
mm, fs: obey gfp_mapping for add_to_page_cache()
2015-10-16 11:42:28 -07:00
reiserfs
reiserfs: prevent NULL pointer dereference in reiserfs_insert_item()
2020-02-28 15:39:09 +01:00
romfs
romfs: use different way to generate fsid for BLOCK or MTD
2017-06-17 06:39:38 +02:00
squashfs
squashfs: more metadata hardenings
2018-08-06 16:24:42 +02:00
sysfs
scsi: sysfs: Introduce sysfs_{un,}break_active_protection()
2018-09-05 09:18:40 +02:00
sysv
sysv: return 'err' instead of 0 in __sysv_write_inode
2018-12-17 21:55:09 +01:00
tracefs
tracefs: Fix refcount imbalance in start_creating()
2015-11-04 22:13:45 -05:00
ubifs
ubifs: Fix deadlock in concurrent bulk-read and writepage
2020-02-28 15:38:48 +01:00
udf
udf: Fix incorrect final NOT_ALLOCATED (hole) extent length
2019-07-21 09:07:08 +02:00
ufs
ufs: fix braino in ufs_get_inode_gid() for solaris UFS flavour
2019-06-11 12:23:49 +02:00
xfs
xfs: Sanity check flags of Q_XQUOTARM call
2020-01-29 10:21:35 +01:00
aio.c
aio: fix spectre gadget in lookup_ioctx
2018-12-21 14:09:50 +01:00
anon_inodes.c
…
attr.c
vfs: move permission checking into notify_change() for utimes(NULL)
2016-10-22 12:26:56 +02:00
bad_inode.c
…
binfmt_aout.c
…
binfmt_elf_fdpic.c
libnvdimm for 4.4:
2015-11-10 12:07:22 -08:00
binfmt_elf.c
binfmt_elf: switch to new creds when switching to new mm
2019-04-27 09:33:53 +02:00
binfmt_em86.c
…
binfmt_flat.c
fs/binfmt_flat.c: make load_flat_shared_library() work
2019-07-10 09:56:30 +02:00
binfmt_misc.c
fs/binfmt_misc.c: do not allow offset overflow
2018-07-03 11:21:26 +02:00
binfmt_script.c
exec: load_script: Do not exec truncated interpreter path
2019-11-06 12:09:12 +01:00
block_dev.c
fs/block_dev: always invalidate cleancache in invalidate_bdev()
2017-05-20 14:27:01 +02:00
buffer.c
fs: fix guard_bio_eod to check for real EOD errors
2019-04-27 09:33:49 +02:00
char_dev.c
chardev: Avoid potential use-after-free in 'chrdev_open()'
2020-01-14 20:03:00 +01:00
compat_binfmt_elf.c
binfmt_elf: compat: avoid unused function warning
2018-02-25 11:03:51 +01:00
compat_ioctl.c
compat_ioctl: pppoe: fix PPPOEIOCSFWD handling
2019-08-11 12:20:46 +02:00
compat.c
…
coredump.c
coredump: Ensure proper size of sparse core files
2017-07-05 14:37:20 +02:00
dax.c
dax: disable pmd mappings
2015-11-16 23:54:45 -08:00
dcache.c
fs/dcache: move security_d_instantiate() behind attaching dentry to inode
2019-11-10 11:21:39 +01:00
dcookies.c
…
direct-io.c
direct-io: Prevent NULL pointer access in submit_page_section
2017-10-18 09:20:42 +02:00
drop_caches.c
fs/drop_caches.c: avoid softlockups in drop_pagecache_sb()
2019-03-23 08:44:26 +01:00
eventfd.c
…
eventpoll.c
fs/epoll: drop ovflist branch prediction
2019-02-20 10:13:14 +01:00
exec.c
sched/fair: Don't free p->numa_faults with concurrent readers
2019-08-04 09:35:02 +02:00
fcntl.c
fs/fcntl: f_setown, avoid undefined behaviour
2018-01-31 12:06:11 +01:00
fhandle.c
fs/coredump: prevent fsuid=0 dumps into user-controlled directories
2016-04-12 09:08:58 -07:00
file_table.c
…
file.c
fs/file.c: initialize init_files.resize_wait
2019-04-27 09:33:49 +02:00
filesystems.c
…
fs_pin.c
…
fs_struct.c
…
fs-writeback.c
cgroup,writeback: don't switch wbs immediately on dead wbs if the memcg is dead
2019-11-12 19:13:31 +01:00
inode.c
Abort file_remove_privs() for non-reg. files
2019-06-22 08:18:27 +02:00
internal.h
…
ioctl.c
…
Kconfig
dax: disable pmd mappings
2015-11-16 23:54:45 -08:00
Kconfig.binfmt
…
libfs.c
…
locks.c
locks: print unsigned ino in /proc/locks
2020-01-12 11:22:41 +01:00
Makefile
ext4: promote ext4 over ext2 in the default probe order
2015-10-15 10:33:21 -04:00
mbcache.c
…
mount.h
mnt: In propgate_umount handle visiting mounts in any order
2017-07-21 07:44:57 +02:00
mpage.c
fs: add i_blocksize()
2017-06-14 13:16:24 +02:00
namei.c
vfs: fix do_last() regression
2020-02-05 13:03:37 +00:00
namespace.c
mount: Prevent MNT_DETACH from disconnecting locked mounts
2018-11-21 09:27:44 +01:00
no-block.c
…
nsfs.c
nsfs: mark dentry with DCACHE_RCUACCESS
2018-02-16 20:09:43 +01:00
open.c
access: avoid the RCU grace period for the temporary subjective credentials
2019-08-04 09:35:01 +02:00
pipe.c
pipe: cap initial pipe capacity according to pipe-max-size limit
2018-05-26 08:48:51 +02:00
pnode.c
mnt: Make propagate_umount less slow for overlapping mount propagation trees
2017-07-21 07:44:58 +02:00
pnode.h
mnt: Add a per mount namespace limit on the number of mounts
2017-04-30 05:49:28 +02:00
posix_acl.c
tmpfs: clear S_ISGID when setting posix ACLs
2017-01-26 08:23:47 +01:00
proc_namespace.c
vfs: show_vfsstat: do not ignore errors from show_devname method
2016-04-12 09:08:55 -07:00
read_write.c
fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock
2019-06-11 12:24:13 +02:00
readdir.c
filldir[64]: remove WARN_ON_ONCE() for bad directory entries
2020-01-04 13:34:37 +01:00
select.c
fs/select: add vmalloc fallback for select(2)
2018-01-31 12:06:09 +01:00
seq_file.c
Make file credentials available to the seqfile interfaces
2017-08-06 19:19:42 -07:00
signalfd.c
…
splice.c
vfs: fix uninitialized flags in splice_to_pipe()
2017-02-23 17:43:09 +01:00
stack.c
…
stat.c
ufs: restore maintaining ->i_blocks
2017-06-14 13:16:24 +02:00
statfs.c
…
super.c
fs: don't scan the inode cache before SB_BORN is set
2019-02-06 19:43:08 +01:00
sync.c
fs/sync.c: make sync_file_range(2) use WB_SYNC_NONE writeback
2015-11-06 17:50:42 -08:00
timerfd.c
timerfd: Protect the might cancel mechanism proper
2017-05-08 07:46:01 +02:00
userfaultfd.c
userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx
2019-09-06 10:18:09 +02:00
utimes.c
vfs: move permission checking into notify_change() for utimes(NULL)
2016-10-22 12:26:56 +02:00
xattr.c
getxattr: use correct xattr length
2018-09-09 20:04:36 +02:00