Chuck Lever fc788f64f1 nfsd: Limit end of page list when decoding NFSv4 WRITE ...

When processing an NFSv4 WRITE operation, argp->end should never
point past the end of the data in the final page of the page list.
Otherwise, nfsd4_decode_compound can walk into uninitialized memory.

More critical, nfsd4_decode_write is failing to increment argp->pagelen
when it increments argp->pagelist.  This can cause later xdr decoders
to assume more data is available than really is, which can cause server
crashes on malformed requests.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Cc: stable@vger.kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

2017-08-24 18:05:30 -04:00

..

9p

9p: Implement show_options

2017-07-11 06:08:58 -04:00

adfs

…

affs

affs: Implement show_options

2017-07-11 06:06:17 -04:00

afs

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-15 12:00:42 -07:00

autofs4

Fix up over-eager 'wait_queue_t' renaming

2017-07-10 11:40:19 -07:00

befs

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-15 12:00:42 -07:00

bfs

bfs: fix sanity checks for empty files

2017-07-12 16:26:00 -07:00

btrfs

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-15 12:00:42 -07:00

cachefiles

sched/wait: Disambiguate wq_entry->task_list and wq_head->task_list naming

2017-06-20 12:19:14 +02:00

ceph

ceph: update ceph_dentry_info::lease_session when necessary

2017-07-07 17:25:14 +02:00

cifs

Add wait_for_random_bytes() and get_random_*_wait() functions so that

2017-07-15 12:44:02 -07:00

coda

fs: implement vfs_iter_write using do_iter_write

2017-06-29 17:49:23 -04:00

configfs

configfs: Introduce config_item_get_unless_zero()

2017-06-12 13:20:20 +02:00

cramfs

…

crypto

The first major feature for ext4 this merge window is the largedir

2017-07-09 09:31:22 -07:00

debugfs

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-15 12:00:42 -07:00

devpts

…

dlm

net: Work around lockdep limitation in sockets that use sockets

2017-03-09 18:23:27 -08:00

ecryptfs

ecryptfs: Convert to separately allocated bdi

2017-04-20 12:09:55 -06:00

efivarfs

VFS: Kill off s_options and helpers

2017-07-11 06:09:21 -04:00

efs

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

exofs

mm: drop "wait" parameter from write_one_page()

2017-07-05 18:44:22 -04:00

exportfs

Merge branch 'rebased-statx' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-03-03 11:38:56 -08:00

ext2

Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

2017-07-13 13:53:54 -07:00

ext4

The first major feature for ext4 this merge window is the largedir

2017-07-09 09:31:22 -07:00

f2fs

for-f2fs-4.13

2017-07-10 14:29:45 -07:00

fat

fat: fix using uninitialized fields of fat_inode/fsinfo_inode

2017-03-09 17:01:10 -08:00

freevxfs

…

fscache

KEYS: Differentiate uses of rcu_dereference_key() and user_key_payload()

2017-03-02 10:09:00 +11:00

fuse

Merge branch 'for-linus' of git://git.kernel.dk/linux-block

2017-05-20 16:12:30 -07:00

gfs2

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-15 12:00:42 -07:00

hfs

fs: semove set but not checked AOP_FLAG_UNINTERRUPTIBLE flag

2017-05-08 17:15:14 -07:00

hfsplus

fs: semove set but not checked AOP_FLAG_UNINTERRUPTIBLE flag

2017-05-08 17:15:14 -07:00

hostfs

vfs: remove ".readlink = generic_readlink" assignments

2016-12-09 16:45:04 +01:00

hpfs

sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>

2017-03-02 08:42:32 +01:00

hugetlbfs

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-15 12:00:42 -07:00

isofs

isofs: Fix isofs_show_options()

2017-07-13 12:30:43 -04:00

jbd2

Writeback error handling fixes (pile #2)

2017-07-07 19:38:17 -07:00

jffs2

jffs2: fix spelling mistake: "requestied" -> "requested"

2017-04-19 11:35:55 -07:00

jfs

Writeback error handling fixes (pile #1)

2017-07-07 18:39:15 -07:00

kernfs

kernfs: Check KERNFS_HAS_RELEASE before calling kernfs_release_file()

2017-03-17 10:25:59 +09:00

lockd

sunrpc: mark all struct svc_version instances as const

2017-07-13 15:58:03 -04:00

minix

Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-08 10:50:54 -07:00

ncpfs

mm: per-cgroup memory reclaim stats

2017-07-06 16:24:35 -07:00

nfs

NFS client updates for Linux 4.13

2017-07-13 14:35:37 -07:00

nfs_common

…

nfsd

nfsd: Limit end of page list when decoding NFSv4 WRITE

2017-08-24 18:05:30 -04:00

nilfs2

Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-07-03 13:08:04 -07:00

nls

…

notify

dentry name snapshots

2017-07-07 20:09:10 -04:00

ntfs

ntfs: Use ERR_CAST() to avoid cross-structure cast

2017-05-28 10:11:48 -07:00

ocfs2

ocfs2: constify attribute_group structures

2017-07-06 16:24:30 -07:00

omfs

omfs: Implement show_options

2017-07-06 03:31:46 -04:00

openpromfs

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

orangefs

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-15 12:00:42 -07:00

overlayfs

ovl: mark parent impure and restore timestamp on ovl_link_up()

2017-07-04 22:08:15 +02:00

proc

fault-inject: add /proc/<pid>/fail-nth

2017-07-14 15:05:13 -07:00

pstore

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-15 12:00:42 -07:00

qnx4

…

qnx6

…

quota

quota: add get_inode_usage callback to transfer multi-inode charges

2017-06-22 11:46:48 -04:00

ramfs

ramfs: Implement show_options

2017-07-06 03:31:46 -04:00

reiserfs

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-15 12:00:42 -07:00

romfs

romfs: use different way to generate fsid for BLOCK or MTD

2017-01-24 16:26:14 -08:00

squashfs

fs/pstore: fs/squashfs: change usage of LZ4 to work with new LZ4 version

2017-02-24 17:46:57 -08:00

sysfs

sysfs: be careful of error returns from ops->show()

2017-04-08 17:33:32 +02:00

sysv

mm: drop "wait" parameter from write_one_page()

2017-07-05 18:44:22 -04:00

tracefs

VFS: Don't use save/replace_mount_options if not using generic_show_options

2017-07-06 03:31:46 -04:00

ubifs

ubifs: Set double hash cookie also for RENAME_EXCHANGE

2017-07-14 22:50:57 +02:00

udf

udf: Convert udf_disk_stamp_to_time() to use mktime64()

2017-06-14 11:21:02 +02:00

ufs

Writeback error handling fixes (pile #1)

2017-07-07 18:39:15 -07:00

xfs

Changes since last update:

2017-07-14 22:57:32 -07:00

aio.c

fs: add O_DIRECT and aio support for sending down write life time hints

2017-06-27 12:05:36 -06:00

anon_inodes.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

attr.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>

2017-03-02 08:42:29 +01:00

bad_inode.c

statx: Add a system call to make enhanced file info available

2017-03-02 20:51:15 -05:00

binfmt_aout.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task_stack.h>

2017-03-02 08:42:36 +01:00

binfmt_elf_fdpic.c

sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>

2017-03-02 08:42:39 +01:00

binfmt_elf.c

binfmt_elf: safely increment argv pointers

2017-07-10 16:32:36 -07:00

binfmt_em86.c

…

binfmt_flat.c

binfmt_flat: flat_{get,put}_addr_from_rp() should be able to fail

2017-07-03 18:44:02 -04:00

binfmt_misc.c

fs: constify tree_descr arrays passed to simple_fill_super()

2017-04-26 23:54:06 -04:00

binfmt_script.c

…

block_dev.c

Writeback error handling fixes (pile #2)

2017-07-07 19:38:17 -07:00

buffer.c

fs/buffer.c: make bh_lru_install() more efficient

2017-07-10 16:32:30 -07:00

char_dev.c

chardev: add helper function to register char devs with a struct device

2017-03-21 06:44:32 +01:00

compat_binfmt_elf.c

fs/binfmt: Convert obsolete cputime type to nsecs

2017-02-01 09:13:51 +01:00

compat_ioctl.c

Merge branch 'work.__copy_in_user' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-08 10:15:02 -07:00

compat.c

fs/compat.c: trim unused includes

2017-04-17 12:52:27 -04:00

coredump.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task_stack.h>

2017-03-02 08:42:36 +01:00

dax.c

Writeback error handling fixes (pile #2)

2017-07-07 19:38:17 -07:00

dcache.c

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-15 12:00:42 -07:00

dcookies.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

direct-io.c

fs: add O_DIRECT and aio support for sending down write life time hints

2017-06-27 12:05:36 -06:00

drop_caches.c

…

eventfd.c

There has been a fair amount of activity in the docs tree this time

2017-07-03 21:13:25 -07:00

eventpoll.c

kcmp: fs/epoll: wrap kcmp code with CONFIG_CHECKPOINT_RESTORE

2017-07-12 16:26:01 -07:00

exec.c

exec: Limit arg stack to at most 75% of _STK_LIM

2017-07-07 20:05:08 -07:00

fcntl.c

vfs: fix flock compat thinko

2017-07-07 13:48:18 -07:00

fhandle.c

fhandle: move compat syscalls from compat.c

2017-04-17 12:52:26 -04:00

file_table.c

fs: new infrastructure for writeback error handling and reporting

2017-07-06 07:02:25 -04:00

file.c

fs/file.c: replace alloc_fdmem() with kvmalloc() alternative

2017-07-06 16:24:30 -07:00

filesystems.c

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-15 12:00:42 -07:00

fs_pin.c

sched/wait: Disambiguate wq_entry->task_list and wq_head->task_list naming

2017-06-20 12:19:14 +02:00

fs_struct.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>

2017-03-02 08:42:35 +01:00

fs-writeback.c

writeback: rework wb_[dec|inc]_stat family of functions

2017-07-12 16:26:05 -07:00

inode.c

Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-08 10:50:54 -07:00

internal.h

Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-05-09 09:12:53 -07:00

ioctl.c

sched/headers: Prepare for the reduction of <linux/sched.h>'s signal API dependency

2017-03-02 08:42:37 +01:00

iomap.c

Changes since last update:

2017-07-14 22:57:32 -07:00

Kconfig

fs/Kconfig: kill CONFIG_PERCPU_RWSEM some more

2017-07-12 16:26:00 -07:00

Kconfig.binfmt

…

libfs.c

fs: convert __generic_file_fsync to use errseq_t based reporting

2017-07-06 07:02:29 -04:00

locks.c

fs/locks: pass kernel struct flock to fcntl_getlk/setlk

2017-05-27 06:07:19 -04:00

Makefile

logfs: remove from tree

2016-12-14 23:48:11 -05:00

mbcache.c

ext4: xattr inode deduplication

2017-06-22 11:44:55 -04:00

mount.h

mnt: In propgate_umount handle visiting mounts in any order

2017-05-23 08:41:16 -05:00

mpage.c

There has been a fair amount of activity in the docs tree this time

2017-07-03 21:13:25 -07:00

namei.c

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-15 12:00:42 -07:00

namespace.c

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-15 12:00:42 -07:00

no-block.c

…

nsfs.c

VFS: Provide empty name qstr

2017-07-06 03:27:09 -04:00

open.c

Writeback error handling fixes (pile #2)

2017-07-07 19:38:17 -07:00

pipe.c

VFS: Provide empty name qstr

2017-07-06 03:27:09 -04:00

pnode.c

mnt: Make propagate_umount less slow for overlapping mount propagation trees

2017-05-23 08:41:17 -05:00

pnode.h

mnt: Tuck mounts under others instead of creating shadow/side mounts.

2017-02-04 00:01:06 +13:00

posix_acl.c

sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>

2017-03-02 08:42:31 +01:00

proc_namespace.c

sched/headers: Prepare to move the task_lock()/unlock() APIs to <linux/sched/task.h>

2017-03-02 08:42:38 +01:00

read_write.c

Merge branch 'work.read_write' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-07 21:48:15 -07:00

readdir.c

readdir: move compat syscalls from compat.c

2017-04-17 12:52:24 -04:00

select.c

Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-06 20:57:13 -07:00

seq_file.c

mm: introduce kv[mz]alloc helpers

2017-05-08 17:15:12 -07:00

signalfd.c

sched/wait: Rename wait_queue_t => wait_queue_entry_t

2017-06-20 12:18:27 +02:00

splice.c

fs: implement vfs_iter_write using do_iter_write

2017-06-29 17:49:23 -04:00

stack.c

…

stat.c

ufs: restore maintaining ->i_blocks

2017-06-09 16:28:01 -04:00

statfs.c

Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-08 10:50:54 -07:00

super.c

VFS: Kill off s_options and helpers

2017-07-11 06:09:21 -04:00

sync.c

fs: remove call_fsync helper function

2017-07-05 18:44:23 -04:00

timerfd.c

timerfd: Use get_itimerspec64() and put_itimerspec64()

2017-06-30 04:14:38 -04:00

userfaultfd.c

mm/hugetlb: add size parameter to huge_pte_offset()

2017-07-06 16:24:34 -07:00

utimes.c

utimes: move compat syscalls from compat.c

2017-04-17 12:52:23 -04:00

xattr.c

treewide: use kv[mz]alloc* rather than opencoded variants

2017-05-08 17:15:13 -07:00