Hugh Dickins
35c2a7f490
tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking ...
Fuzzing with trinity oopsed on the 1st instruction of shmem_fh_to_dentry(),
u64 inum = fid->raw[2];
which is unhelpfully reported as at the end of shmem_alloc_inode():
BUG: unable to handle kernel paging request at ffff880061cd3000
IP: [<ffffffff812190d0>] shmem_alloc_inode+0x40/0x40
Oops: 0000 [#1 ] PREEMPT SMP DEBUG_PAGEALLOC
Call Trace:
[<ffffffff81488649>] ? exportfs_decode_fh+0x79/0x2d0
[<ffffffff812d77c3>] do_handle_open+0x163/0x2c0
[<ffffffff812d792c>] sys_open_by_handle_at+0xc/0x10
[<ffffffff83a5f3f8>] tracesys+0xe1/0xe6
Right, tmpfs is being stupid to access fid->raw[2] before validating that
fh_len includes it: the buffer kmalloc'ed by do_sys_name_to_handle() may
fall at the end of a page, and the next page not be present.
But some other filesystems (ceph, gfs2, isofs, reiserfs, xfs) are being
careless about fh_len too, in fh_to_dentry() and/or fh_to_parent(), and
could oops in the same way: add the missing fh_len checks to those.
Reported-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Sage Weil <sage@inktank.com>
Cc: Steven Whitehouse <swhiteho@redhat.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-10-09 23:33:55 -04:00
2010-10-05 12:16:37 +02:00
2012-05-29 23:28:32 -04:00
2012-05-29 23:28:32 -04:00
2012-05-14 16:20:59 -05:00
2011-08-12 16:21:35 -05:00
2011-08-12 16:21:35 -05:00
2011-08-12 16:21:35 -05:00
2011-08-12 16:21:35 -05:00
2012-09-18 01:01:35 -07:00
2011-08-01 02:35:04 -04:00
2012-05-14 16:20:55 -05:00
2012-05-14 16:21:00 -05:00
2012-07-01 14:50:04 -05:00
2012-07-13 13:09:27 -05:00
2012-05-14 16:20:55 -05:00
2012-08-01 10:26:23 -07:00
2012-07-22 11:00:55 -05:00
2012-07-01 14:50:07 -05:00
2012-07-01 14:50:07 -05:00
2010-01-20 10:47:48 +11:00
2012-07-01 14:50:07 -05:00
2010-01-20 10:47:48 +11:00
2009-01-09 15:53:54 +11:00
2012-05-14 16:20:54 -05:00
2010-01-15 15:31:38 -06:00
2012-06-14 12:28:24 -05:00
2012-05-14 16:20:57 -05:00
2012-05-14 16:20:54 -05:00
2011-07-25 15:03:13 -05:00
2012-07-13 13:09:49 -05:00
2012-07-01 14:50:06 -05:00
2012-08-29 15:01:11 -05:00
2012-08-29 15:01:11 -05:00
2012-07-01 14:50:07 -05:00
2012-07-22 10:34:42 -05:00
2012-09-26 22:20:08 -04:00
2010-01-15 15:31:23 -06:00
2012-06-14 12:28:26 -05:00
2012-07-01 14:50:07 -05:00
2012-07-01 14:50:07 -05:00
2011-07-13 13:43:48 +02:00
2012-07-01 14:50:08 -05:00
2012-07-01 14:50:07 -05:00
2012-07-01 14:50:07 -05:00
2012-07-01 14:50:07 -05:00
2012-07-01 14:50:07 -05:00
2011-07-13 13:43:48 +02:00
2012-08-23 14:48:44 -05:00
2011-08-12 16:21:35 -05:00
2012-05-14 16:21:00 -05:00
2011-08-12 16:21:35 -05:00
2012-05-14 16:20:54 -05:00
2012-05-14 16:20:31 -05:00
2012-05-14 16:20:54 -05:00
2011-03-07 10:09:35 +11:00
2012-10-09 23:33:55 -04:00
2011-08-12 16:21:35 -05:00
2012-05-14 16:21:04 -05:00
2012-05-14 16:21:04 -05:00
2012-05-14 16:20:54 -05:00
2010-12-20 11:59:49 +11:00
2012-10-09 16:22:17 +09:00
2011-10-11 21:15:06 -05:00
2010-07-26 13:16:51 -05:00
2012-01-17 15:08:53 -06:00
2011-07-08 11:32:51 -05:00
2012-05-14 16:21:03 -05:00
2011-01-11 20:28:17 -06:00
2011-08-12 16:21:35 -05:00
2012-05-14 16:20:54 -05:00
2009-02-09 08:37:14 +01:00
2012-09-26 15:42:42 -05:00
2012-07-29 16:00:31 -05:00
2012-07-29 16:23:51 -05:00
2012-06-21 14:20:06 -05:00
2012-05-14 16:20:33 -05:00
2012-07-29 16:16:49 -05:00
2012-07-29 16:23:51 -05:00
2012-05-14 16:20:54 -05:00
2012-07-31 09:45:48 +04:00
2011-08-12 16:21:35 -05:00
2012-09-26 22:20:08 -04:00
2011-08-12 16:21:35 -05:00
2012-08-01 10:26:23 -07:00
2010-12-16 16:05:51 -06:00
2012-07-30 13:37:53 -07:00
2011-08-12 16:21:35 -05:00
2012-07-22 10:46:56 -05:00
2010-06-24 11:35:17 +10:00
2011-10-11 11:02:49 -05:00
2012-06-21 14:21:11 -05:00
2012-06-21 14:22:27 -05:00
2012-07-22 10:46:56 -05:00
2010-05-24 10:33:39 -05:00
2012-06-21 14:22:27 -05:00
2012-05-14 16:20:26 -05:00
2012-05-14 16:20:54 -05:00
2011-10-31 17:30:54 -07:00
2012-09-26 15:56:33 -05:00
2012-08-16 13:29:35 -05:00
2011-02-01 11:42:43 +01:00
2010-01-15 15:34:22 -06:00
2012-05-14 16:21:00 -05:00
2012-05-14 16:20:54 -05:00
2012-06-14 12:28:24 -05:00
2012-03-14 12:06:32 -05:00
2012-03-14 11:09:06 -05:00
2012-02-03 11:32:20 -06:00
2012-09-18 01:01:39 -07:00
2012-05-14 16:20:54 -05:00
2012-08-23 14:48:16 -05:00
2011-07-25 15:03:13 -05:00
2012-02-02 17:08:04 -06:00
2012-03-14 11:09:06 -05:00
2012-03-14 11:09:06 -05:00
2012-10-02 20:42:58 -07:00
2012-09-26 15:56:33 -05:00
2012-08-20 14:51:24 -07:00
2012-03-13 17:01:15 -05:00
2011-08-12 16:21:35 -05:00
2011-08-12 16:21:35 -05:00
2012-05-14 16:21:00 -05:00
2012-08-16 13:29:35 -05:00
2012-07-29 16:27:57 -05:00
2012-07-01 14:50:06 -05:00
2012-09-18 01:01:40 -07:00
2012-05-14 16:20:54 -05:00
2012-05-14 16:21:00 -05:00
2012-07-29 16:27:57 -05:00
2009-02-09 08:37:14 +01:00
2012-07-31 09:45:48 +04:00
2012-08-01 10:26:23 -07:00
2012-07-01 14:50:04 -05:00
2012-07-29 16:00:31 -05:00
2012-01-03 22:55:00 -05:00
2012-03-15 13:40:16 -05:00
2012-07-29 16:22:20 -05:00
2012-03-15 13:40:16 -05:00
2011-08-12 16:21:35 -05:00
2011-08-12 13:57:55 -05:00
35c2a7f490