AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity
6924d99fcd
kernel_optimize_test/fs/gfs2
History
Hugh Dickins 35c2a7f490 tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking 
Fuzzing with trinity oopsed on the 1st instruction of shmem_fh_to_dentry(),
	u64 inum = fid->raw[2];
which is unhelpfully reported as at the end of shmem_alloc_inode():

BUG: unable to handle kernel paging request at ffff880061cd3000
IP: [<ffffffff812190d0>] shmem_alloc_inode+0x40/0x40
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Call Trace:
 [<ffffffff81488649>] ? exportfs_decode_fh+0x79/0x2d0
 [<ffffffff812d77c3>] do_handle_open+0x163/0x2c0
 [<ffffffff812d792c>] sys_open_by_handle_at+0xc/0x10
 [<ffffffff83a5f3f8>] tracesys+0xe1/0xe6

Right, tmpfs is being stupid to access fid->raw[2] before validating that
fh_len includes it: the buffer kmalloc'ed by do_sys_name_to_handle() may
fall at the end of a page, and the next page not be present.

But some other filesystems (ceph, gfs2, isofs, reiserfs, xfs) are being
careless about fh_len too, in fh_to_dentry() and/or fh_to_parent(), and
could oops in the same way: add the missing fh_len checks to those.

Reported-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Sage Weil <sage@inktank.com>
Cc: Steven Whitehouse <swhiteho@redhat.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-10-09 23:33:55 -04:00
..
acl.c userns: Pass a userns parameter into posix_acl_to_xattr and posix_acl_from_xattr 2012-09-18 01:01:35 -07:00
acl.h
aops.c GFS2: change function gfs2_direct_IO to use a normal gfs2_glock_dq 2012-09-24 10:47:06 +01:00
bmap.c GFS2: Add structure to contain rgrp, bitmap, offset tuple 2012-09-24 10:46:56 +01:00
bmap.h
dentry.c stop passing nameidata * to ->d_revalidate() 2012-07-14 16:34:14 +04:00
dir.c GFS2: Fold quota data into the reservations struct 2012-06-06 11:20:22 +01:00
dir.h
export.c tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking 2012-10-09 23:33:55 -04:00
file.c mm: kill vma flag VM_CAN_NONLINEAR 2012-10-09 16:22:17 +09:00
gfs2.h
glock.c GFS2: Eliminate redundant calls to may_grant 2012-09-24 10:47:12 +01:00
glock.h
glops.c GFS2: fix s_writers.counter imbalance in gfs2_ail_empty_gl 2012-09-24 10:47:29 +01:00
glops.h
incore.h GFS2: Consolidate free block searching functions 2012-09-24 10:47:26 +01:00
inode.c GFS2: Consolidate free block searching functions 2012-09-24 10:47:26 +01:00
inode.h GFS2: Remove unused argument from gfs2_internal_read 2012-04-24 16:44:37 +01:00
Kconfig GFS2: use depends instead of select in kconfig 2012-03-26 09:18:02 +01:00
lock_dlm.c workqueue: deprecate flush[_delayed]_work_sync() 2012-08-20 14:51:24 -07:00
log.c GFS2: eliminate log elements and simplify 2012-05-02 09:14:36 +01:00
log.h GFS2: Clean up log write code path 2012-04-24 16:44:34 +01:00
lops.c GFS2: Fix error handling when reading an invalid block from the journal 2012-06-06 11:27:49 +01:00
lops.h GFS2: eliminate log elements and simplify 2012-05-02 09:14:36 +01:00
main.c GFS2: Fold quota data into the reservations struct 2012-06-06 11:20:22 +01:00
Makefile
meta_io.c gfs2: nuke pdflush from comments 2012-08-04 12:15:40 +04:00
meta_io.h GFS2: Eliminate unused "new" parameter to gfs2_meta_indirect_buffer 2012-05-11 10:19:23 +01:00
ops_fstype.c GFS2: Get rid of I_MUTEX_QUOTA usage 2012-09-24 10:47:24 +01:00
quota.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace 2012-10-02 11:11:09 -07:00
quota.h quota: Split dquot_quota_sync() to writeback and cache flushing part 2012-07-22 23:58:19 +04:00
recovery.c GFS2: fail mount if journal recovery fails 2012-01-11 09:24:48 +00:00
recovery.h
rgrp.c GFS2: Fix infinite loop in rbm_find 2012-09-24 10:47:27 +01:00
rgrp.h GFS2: Consolidate free block searching functions 2012-09-24 10:47:26 +01:00
super.c Merge branch 'for-3.7' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq 2012-10-02 09:54:49 -07:00
super.h
sys.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-3.0-nmw 2012-07-24 17:57:05 -07:00
sys.h
trace_gfs2.h GFS2: Improve block reservation tracing 2012-09-24 10:47:20 +01:00
trans.c gfs2: Convert to new freezing mechanism 2012-07-31 09:45:50 +04:00
trans.h GFS2: Remove rs_requested field from reservations 2012-09-24 10:46:54 +01:00
util.c GFS2: Clean up log write code path 2012-04-24 16:44:34 +01:00
util.h GFS2: Fix error handling when reading an invalid block from the journal 2012-06-06 11:27:49 +01:00
xattr.c GFS2: Remove rs_requested field from reservations 2012-09-24 10:46:54 +01:00
xattr.h