Trond Myklebust 17ead6c85c NFSv4: Fix memory corruption in nfs4_proc_open_confirm ...

nfs41_wake_and_assign_slot() relies on the task->tk_msg.rpc_argp and
task->tk_msg.rpc_resp always pointing to the session sequence arguments.

nfs4_proc_open_confirm tries to pull a fast one by reusing the open
sequence structure, thus causing corruption of the NFSv4 slot table.

Cc: stable@vger.kernel.org # 3.12+
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>

2014-02-01 15:13:39 -05:00

..

9p

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-01-28 08:38:04 -08:00

adfs

adfs: delayed freeing of sbi

2013-10-24 23:43:27 -04:00

affs

affs: use ->kill_sb() to simplify ->put_super() and failure exits of ->mount()

2014-01-25 03:13:01 -05:00

afs

afs: get rid of junk in fs/afs/proc.c

2014-01-25 03:14:06 -05:00

autofs4

autofs: fix symlinks aren't checked for expiry

2014-01-23 16:36:59 -08:00

befs

befs: iget_locked() doesn't return an ERR_PTR

2014-01-25 03:14:38 -05:00

bfs

truncate: drop 'oldsize' truncate_pagecache() parameter

2013-09-12 15:38:02 -07:00

btrfs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs

2014-01-30 20:08:20 -08:00

cachefiles

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2013-11-13 15:34:18 +09:00

ceph

ceph: fix missing dput in ceph_set_acl

2014-01-31 08:14:06 -08:00

cifs

cifs: set FILE_CREATED

2013-12-27 15:14:45 -06:00

coda

coda_revalidate_inode(): switch to passing inode...

2013-11-09 00:16:21 -05:00

configfs

configfs: fix race between dentry put and lookup

2013-11-21 16:42:27 -08:00

cramfs

cramfs: take headers to fs/cramfs

2014-01-25 03:13:02 -05:00

debugfs

debugfs: use list_next_entry() in debugfs_remove_recursive()

2013-11-13 12:09:24 +09:00

devpts

devpts: plug the memory leak in kill_sb

2013-11-13 12:09:36 +09:00

dlm

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2014-01-25 11:17:34 -08:00

ecryptfs

ecryptfs: fix failure handling in ->readlink()

2014-01-25 03:13:00 -05:00

efivarfs

consolidate simple ->d_delete() instances

2013-11-15 22:04:17 -05:00

efs

efs: get rid of ->put_super()

2014-01-25 03:13:02 -05:00

exofs

exofs: Print less in r4w

2014-01-23 18:54:14 +02:00

exportfs

exportfs: fix quadratic behavior in filehandle lookup

2013-11-09 00:16:38 -05:00

ext2

ext2/3/4: use generic posix ACL infrastructure

2014-01-25 23:58:19 -05:00

ext3

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-01-28 08:38:04 -08:00

ext4

Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block

2014-01-30 11:19:05 -08:00

f2fs

Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block

2014-01-30 11:19:05 -08:00

fat

fat: rcu-delay unloading nls and freeing sbi

2013-10-24 23:43:28 -04:00

freevxfs

[readdir] convert freevxfs

2013-06-29 12:56:53 +04:00

fscache

Merge branch 'for-3.13/core' of git://git.kernel.dk/linux-block

2013-11-14 12:08:14 +09:00

fuse

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-01-28 08:38:04 -08:00

gfs2

Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block

2014-01-30 11:19:05 -08:00

hfs

fs/hfs/btree.h: remove duplicate defines

2013-11-13 12:09:32 +09:00

hfsplus

Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block

2014-01-30 11:19:05 -08:00

hostfs

um: hostfs: make functions static

2014-01-26 11:51:09 +01:00

hpfs

locks: break delegations on any attribute modification

2013-11-09 00:16:44 -05:00

hppfs

clean up scary strncpy(dst, src, strlen(src)) uses

2013-07-03 16:07:41 -07:00

hugetlbfs

cope with potentially long ->d_dname() output for shmem/hugetlb

2013-08-24 12:10:17 -04:00

isofs

isofs: don't pass dentry to isofs_hash{i,}_common()

2013-10-24 23:34:59 -04:00

jbd

jbd: Revise KERN_EMERG error messages

2013-12-04 12:27:46 +01:00

jbd2

jbd2: rename obsoleted msg JBD->JBD2

2013-12-08 21:14:59 -05:00

jffs2

MTD updates for 3.14:

2014-01-28 18:56:37 -08:00

jfs

Minor bug fix for linux-3.14

2014-01-31 08:14:35 -08:00

kernfs

kernfs: associate a new kernfs_node with its parent on creation

2014-01-17 11:50:07 -08:00

lockd

LOCKD: Don't call utsname()->nodename from nlmclnt_setlockargs

2013-08-05 15:03:46 -04:00

logfs

Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block

2014-01-30 11:19:05 -08:00

minix

fs/minix: Drop dependency on H8300

2013-09-16 18:20:25 -07:00

ncpfs

ncpfs: rcu-delay unload_nls() and freeing ncp_server

2013-10-24 23:43:28 -04:00

nfs

NFSv4: Fix memory corruption in nfs4_proc_open_confirm

2014-02-01 15:13:39 -05:00

nfs_common

nfs_common: Update the translation between nfsv3 acls linux posix acls

2013-02-13 06:15:14 -08:00

nfsd

Merge branch 'for-3.14' of git://linux-nfs.org/~bfields/linux

2014-01-30 10:18:43 -08:00

nilfs2

Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block

2014-01-30 11:19:05 -08:00

nls

nls: have register_nls() set ->owner

2014-01-25 03:14:05 -05:00

notify

fanotify: Fix use after free for permission events

2014-01-29 13:57:17 +01:00

ntfs

iget/iget5: don't bother with ->i_lock until we find a match

2013-11-09 00:16:31 -05:00

ocfs2

Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block

2014-01-30 11:19:05 -08:00

omfs

truncate: drop 'oldsize' truncate_pagecache() parameter

2013-09-12 15:38:02 -07:00

openpromfs

[readdir] convert openpromfs

2013-06-29 12:56:32 +04:00

proc

fs/proc/array.c: change do_task_stat() to use while_each_thread()

2014-01-23 16:37:02 -08:00

pstore

pstore: Don't allow high traffic options on fragile devices

2013-12-20 13:12:01 -08:00

qnx4

qnx4: clean qnx4_fill_super() up

2014-01-25 03:13:03 -05:00

qnx6

[readdir] convert qnx6

2013-06-29 12:56:39 +04:00

quota

genetlink: make multicast groups const, prevent abuse

2013-11-19 16:39:06 -05:00

ramfs

fs/ramfs: move ramfs_aops to inode.c

2014-01-23 16:36:58 -08:00

reiserfs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-01-28 08:38:04 -08:00

romfs

romfs: fix returm err while getting inode in fill_super

2014-01-23 16:37:04 -08:00

squashfs

Squashfs: fix failure to unlock pages on decompress error

2013-11-24 01:02:50 +00:00

sysfs

Revert "kernfs, sysfs, driver-core: implement kernfs_remove_self() and its wrappers"

2014-01-13 14:05:13 -08:00

sysv

sysv: Add forgotten superblock lock init for v7 fs

2013-09-29 22:02:02 -04:00

ubifs

fs/ubifs: use rbtree postorder iteration helper instead of opencoding

2014-01-23 16:37:03 -08:00

udf

udf: Fix lockdep warning from udf_symlink()

2013-12-23 22:02:16 +01:00

ufs

truncate: drop 'oldsize' truncate_pagecache() parameter

2013-09-12 15:38:02 -07:00

xfs

Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block

2014-01-30 11:19:05 -08:00

aio.c

Merge git://git.kvack.org/~bcrl/aio-next

2013-12-22 11:03:49 -08:00

anon_inodes.c

... and kill anon_inode_getfile_private()

2013-11-09 00:16:28 -05:00

attr.c

fs: fix iversion handling

2013-12-05 16:36:21 -06:00

bad_inode.c

[readdir] ->readdir() is gone

2013-06-29 12:57:04 +04:00

binfmt_aout.c

dump_skip(): dump_seek() replacement taking coredump_params

2013-11-09 00:16:26 -05:00

binfmt_elf_fdpic.c

elf{,_fdpic} coredump: get rid of pointless if (siginfo->si_signo)

2013-11-09 00:16:30 -05:00

binfmt_elf.c

fs: binfmt_elf: remove unused defines INTERPRETER_NONE and INTERPRETER_ELF

2014-01-23 16:36:58 -08:00

binfmt_em86.c

file->f_op is never NULL...

2013-10-24 23:34:54 -04:00

binfmt_flat.c

new helper: read_code()

2013-04-29 15:40:23 -04:00

binfmt_misc.c

binfmt_misc: reuse string_unescape_inplace()

2013-04-30 17:04:03 -07:00

binfmt_script.c

exec: do not leave bprm->interp on stack

2012-12-20 17:40:19 -08:00

binfmt_som.c

get rid of pt_regs argument of ->load_binary()

2012-11-28 21:53:38 -05:00

bio-integrity.c

bio-integrity: Fix bio_integrity_verify segment start bug

2014-01-21 20:32:05 -08:00

bio.c

Revert "block: Warn and free bio if bi_end_io is not set"

2014-01-08 14:14:22 -07:00

block_dev.c

a trivial writeback fix

2013-09-13 23:06:40 -04:00

buffer.c

block: Replace __this_cpu_ptr with raw_cpu_ptr

2013-12-03 19:19:41 -07:00

char_dev.c

Merge branch 'for-3.13/core' of git://git.kernel.dk/linux-block

2013-11-14 12:08:14 +09:00

compat_binfmt_elf.c

coredump: extend core dump note section to contain file names of mapped files

2012-10-06 03:05:17 +09:00

compat_ioctl.c

fs/compat_ioctl.c: fix an underflow issue (harmless)

2014-01-21 16:19:42 -08:00

compat.c

[readdir] constify ->actor

2013-06-29 12:57:05 +04:00

coredump.c

coredump: make __get_dumpable/get_dumpable inline, kill fs/coredump.h

2014-01-23 16:37:01 -08:00

dcache.c

__dentry_path() fixes

2014-01-26 12:37:55 -05:00

dcookies.c

fs/compat: fix lookup_dcookie() parameter handling

2014-01-29 16:22:40 -08:00

direct-io.c

block: Abstract out bvec iterator

2013-11-23 22:33:47 -08:00

drop_caches.c

shrinker: add node awareness

2013-09-10 18:56:31 -04:00

eventfd.c

eventfd_ctx_fdget(): use fdget() instead of fget()

2014-01-25 03:13:04 -05:00

eventpoll.c

epoll: do not take the nested ep->mtx on EPOLL_CTL_DEL

2014-01-02 14:40:30 -08:00

exec.c

fs/exec.c: call arch_pick_mmap_layout() only once

2014-01-23 16:37:02 -08:00

fcntl.c

file->f_op is never NULL...

2013-10-24 23:34:54 -04:00

fhandle.c

Merge branch 'for-3.8' of git://linux-nfs.org/~bfields/linux

2012-12-20 14:04:11 -08:00

file_table.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2013-11-13 15:34:18 +09:00

file.c

fs: __fget_light() can use __fget() in slow path

2014-01-25 03:14:38 -05:00

filesystems.c

fs: Limit sys_mount to only request filesystem modules.

2013-03-03 19:36:31 -08:00

fs_struct.c

seqcount: Add lockdep functionality to seqcount/seqlock structures

2013-11-06 12:40:26 +01:00

fs-writeback.c

writeback: Fix data corruption on NFS

2013-12-14 04:21:26 +08:00

inode.c

locks: break delegations on any attribute modification

2013-11-09 00:16:44 -05:00

internal.h

get rid of s_files and files_lock

2013-11-09 00:16:20 -05:00

ioctl.c

file->f_op is never NULL...

2013-10-24 23:34:54 -04:00

ioprio.c

…

Kconfig

fs: remove generic_acl

2014-01-26 08:26:40 -05:00

Kconfig.binfmt

fs: make binfmt support for #! scripts modular and removable

2013-04-30 17:04:04 -07:00

libfs.c

consolidate simple ->d_delete() instances

2013-11-15 22:04:17 -05:00

locks.c

locks: missing unlock on error in generic_add_lease()

2013-11-13 07:30:53 -05:00

Makefile

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-01-28 08:38:04 -08:00

mbcache.c

fs: convert fs shrinkers to new scan/count API

2013-09-10 18:56:31 -04:00

mount.h

vfs: Is mounted should be testing mnt_ns for NULL or error.

2014-01-26 08:26:42 -05:00

mpage.c

block: Abstract out bvec iterator

2013-11-23 22:33:47 -08:00

namei.c

fs: add get_acl helper

2014-01-25 23:58:16 -05:00

namespace.c

Driver core / sysfs patches for 3.14-rc1

2014-01-20 15:49:44 -08:00

no-block.c

…

open.c

locks: break delegations on any attribute modification

2013-11-09 00:16:44 -05:00

pipe.c

fs/pipe.c: skip file_update_time on frozen fs

2014-01-23 16:37:00 -08:00

pnode.c

split __lookup_mnt() in two functions

2013-10-24 23:35:00 -04:00

pnode.h

vfs: Don't copy mount bind mounts of /proc/<pid>/ns/mnt between namespaces

2013-08-26 18:42:15 -07:00

posix_acl.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-01-28 08:38:04 -08:00

proc_namespace.c

fs/proc_namespace.c: simplify testing nsp and nsp->mnt_ns

2014-01-23 16:37:02 -08:00

read_write.c

fs/compat: fix parameter handling for compat readv/writev syscalls

2014-01-29 16:22:39 -08:00

readdir.c

file->f_op is never NULL...

2013-10-24 23:34:54 -04:00

select.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2013-11-13 15:34:18 +09:00

seq_file.c

seq_file: always clear m->count when we free m->buf

2013-11-18 19:07:53 -08:00

signalfd.c

switch signalfd{,4}() to COMPAT_SYSCALL_DEFINE

2013-03-03 22:58:46 -05:00

splice.c

fuse: fix pipe_buf_operations

2014-01-22 19:36:57 +01:00

stack.c

…

stat.c

vfs: split out vfs_getattr_nosec

2013-11-09 00:16:31 -05:00

statfs.c

vfs: allow O_PATH file descriptors for fstatfs()

2013-10-12 13:12:31 -07:00

super.c

fs/super.c: fix WARN on alloc_super() fail path

2014-01-21 16:19:42 -08:00

sync.c

Merge branch 'akpm' (patches from Andrew Morton)

2013-11-13 15:45:43 +09:00

timerfd.c

timerfd: Add alarm timers

2013-05-29 12:57:34 -07:00

utimes.c

locks: break delegations on any attribute modification

2013-11-09 00:16:44 -05:00

xattr.c

vfs: make lremovexattr retry once on ESTALE error

2012-12-20 18:50:11 -05:00