Kernel/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-09 14:50:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
linux/fs
History
Konstantin Khlebnikov ebe06187bf epoll: fix use-after-free in eventpoll_release_file 
This fixes use-after-free of epi->fllink.next inside list loop macro.
This loop actually releases elements in the body.  The list is
rcu-protected but here we cannot hold rcu_read_lock because we need to
lock mutex inside.

The obvious solution is to use list_for_each_entry_safe().  RCU-ness
isn't essential because nobody can change this list under us, it's final
fput for this file.

The bug was introduced by ae10b2b4eb01 ("epoll: optimize EPOLL_CTL_DEL
using rcu")

Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com>
Reported-by: Cyrill Gorcunov <gorcunov@openvz.org>
Cc: Stable <stable@vger.kernel.org> # 3.13+
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Jason Baron <jbaron@akamai.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-06-16 17:21:59 -10:00
..
9p
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
adfs
write_iter variants of {__,}generic_file_aio_write()
2014-05-06 17:38:00 -04:00
affs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
afs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
autofs4
fs/autofs4/dev-ioctl.c: add __init to autofs_dev_ioctl_init
2014-06-04 16:54:21 -07:00
befs
fs/befs: kernel-doc fixes
2014-06-06 16:08:09 -07:00
bfs
write_iter variants of {__,}generic_file_aio_write()
2014-05-06 17:38:00 -04:00
btrfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs
2014-06-14 19:48:43 -05:00
cachefiles
fs/cachefiles: replace kerror by pr_err
2014-06-06 16:08:14 -07:00
ceph
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client
2014-06-12 23:06:23 -07:00
cifs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
coda
coda: convert use of typedef ctl_table to struct ctl_table
2014-06-06 16:08:16 -07:00
configfs
fs/configfs: use pr_fmt
2014-06-04 16:53:53 -07:00
cramfs
Major changes for 3.14 include support for the newly added ZERO_RANGE
2014-04-04 15:39:39 -07:00
debugfs
Major changes for 3.14 include support for the newly added ZERO_RANGE
2014-04-04 15:39:39 -07:00
devpts
fs/devpts/inode.c: convert printk to pr_foo()
2014-06-06 16:08:14 -07:00
dlm
dlm: keep listening connection alive with sctp mode
2014-06-12 10:26:14 -05:00
ecryptfs
write_iter variants of {__,}generic_file_aio_write()
2014-05-06 17:38:00 -04:00
efivarfs
fs/efivarfs/super.c: use static const for dentry_operations
2014-06-04 16:54:14 -07:00
efs
fs/efs: convert printk(KERN_DEBUG to pr_debug
2014-06-04 16:54:21 -07:00
exofs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
exportfs
fs/exportfs/expfs.c: kernel-doc warning fixes
2014-06-04 16:54:14 -07:00
ext2
->splice_write() via ->write_iter()
2014-06-12 00:18:51 -04:00
ext3
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
ext4
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
f2fs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
fat
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
freevxfs
Major changes for 3.14 include support for the newly added ZERO_RANGE
2014-04-04 15:39:39 -07:00
fscache
fscache: convert use of typedef ctl_table to struct ctl_table
2014-06-06 16:08:16 -07:00
fuse
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
gfs2
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
hfs
write_iter variants of {__,}generic_file_aio_write()
2014-05-06 17:38:00 -04:00
hfsplus
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
hostfs
write_iter variants of {__,}generic_file_aio_write()
2014-05-06 17:38:00 -04:00
hpfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
hppfs
…
hugetlbfs
fs/hugetlbfs/inode.c: remove null test before kfree
2014-06-04 16:54:11 -07:00
isofs
Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
2014-04-07 17:59:17 -07:00
jbd
fs/jbd/revoke.c: replace shift loop by ilog2
2014-05-21 10:26:13 +02:00
jbd2
arch: Mass conversion of smp_mb__*()
2014-04-18 14:20:48 +02:00
jffs2
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
jfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
kernfs
kernfs: move the last knowledge of sysfs out from kernfs
2014-06-03 08:11:18 -07:00
lockd
Merge branch 'for-3.16' of git://linux-nfs.org/~bfields/linux
2014-06-10 11:50:57 -07:00
logfs
write_iter variants of {__,}generic_file_aio_write()
2014-05-06 17:38:00 -04:00
minix
write_iter variants of {__,}generic_file_aio_write()
2014-05-06 17:38:00 -04:00
ncpfs
fs/ncpfs/getopt.c: replace simple_strtoul by kstrtoul
2014-06-04 16:54:21 -07:00
nfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
nfs_common
…
nfsd
nfsd4: fix FREE_STATEID lockowner leak
2014-06-09 17:13:54 -04:00
nilfs2
write_iter variants of {__,}generic_file_aio_write()
2014-05-06 17:38:00 -04:00
nls
nls: have register_nls() set ->owner
2014-01-25 03:14:05 -05:00
notify
inotify: convert use of typedef ctl_table to struct ctl_table
2014-06-06 16:08:16 -07:00
ntfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
ocfs2
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
omfs
write_iter variants of {__,}generic_file_aio_write()
2014-05-06 17:38:00 -04:00
openpromfs
fs: push sync_filesystem() down to the file system's remount_fs()
2014-03-13 10:14:33 -04:00
proc
Merge branch 'next' (accumulated 3.16 merge window patches) into master
2014-06-08 11:31:16 -07:00
pstore
fs/pstore: logging clean-up
2014-06-06 16:08:13 -07:00
qnx4
fs: push sync_filesystem() down to the file system's remount_fs()
2014-03-13 10:14:33 -04:00
qnx6
fs: push sync_filesystem() down to the file system's remount_fs()
2014-03-13 10:14:33 -04:00
quota
xfs: fix Q_XQUOTARM ioctl
2014-05-05 17:25:50 +10:00
ramfs
->splice_write() via ->write_iter()
2014-06-12 00:18:51 -04:00
reiserfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
romfs
switch simple generic_file_aio_read() users to ->read_iter()
2014-05-06 17:37:55 -04:00
squashfs
fs/squashfs/squashfs.h: replace pr_warning by pr_warn
2014-06-04 16:53:52 -07:00
sysfs
kernfs: move the last knowledge of sysfs out from kernfs
2014-06-03 08:11:18 -07:00
sysv
write_iter variants of {__,}generic_file_aio_write()
2014-05-06 17:38:00 -04:00
ubifs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
udf
udf: switch to ->write_iter()
2014-05-06 17:39:36 -04:00
ufs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
xfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
aio.c
Merge git://git.kvack.org/~bcrl/aio-next
2014-06-14 19:43:27 -05:00
anon_inodes.c
vfs: Allocate anon_inode_inode in anon_inode_init()
2014-03-27 09:52:54 -07:00
attr.c
fs,userns: Change inode_capable to capable_wrt_inode_uidgid
2014-06-10 13:57:22 -07:00
bad_inode.c
…
binfmt_aout.c
dump_skip(): dump_seek() replacement taking coredump_params
2013-11-09 00:16:26 -05:00
binfmt_elf_fdpic.c
elf{,_fdpic} coredump: get rid of pointless if (siginfo->si_signo)
2013-11-09 00:16:30 -05:00
binfmt_elf.c
Merge branch 'x86/vdso' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next
2014-06-05 08:05:29 -07:00
binfmt_em86.c
file->f_op is never NULL...
2013-10-24 23:34:54 -04:00
binfmt_flat.c
fs/binfmt_flat.c: make old_reloc() static
2014-06-04 16:54:21 -07:00
binfmt_misc.c
binfmt_misc: add missing 'break' statement
2014-04-03 16:21:16 -07:00
binfmt_script.c
…
binfmt_som.c
…
block_dev.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
buffer.c
mm: non-atomically mark page accessed during page cache allocation where possible
2014-06-04 16:54:10 -07:00
char_dev.c
Merge branch 'for-3.13/core' of git://git.kernel.dk/linux-block
2013-11-14 12:08:14 +09:00
compat_binfmt_elf.c
binfmt_elf: add ELF_HWCAP2 to compat auxv entries
2014-03-04 08:05:21 +00:00
compat_ioctl.c
fs/compat: convert to COMPAT_SYSCALL_DEFINE with changing parameter types
2014-03-06 16:30:44 +01:00
compat.c
locks: rename file-private locks to "open file description locks"
2014-04-22 08:23:58 -04:00
coredump.c
coredump: fix va_list corruption
2014-04-19 13:23:31 -07:00
dcache.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
dcookies.c
fs/compat: fix lookup_dcookie() parameter handling
2014-01-29 16:22:40 -08:00
direct-io.c
new helper: iov_iter_npages()
2014-05-06 17:32:52 -04:00
drop_caches.c
fs: convert use of typedef ctl_table to struct ctl_table
2014-06-06 16:08:16 -07:00
eventfd.c
eventfd_ctx_fdget(): use fdget() instead of fget()
2014-01-25 03:13:04 -05:00
eventpoll.c
epoll: fix use-after-free in eventpoll_release_file
2014-06-16 17:21:59 -10:00
exec.c
perf: Differentiate exec() and non-exec() comm events
2014-06-06 07:56:22 +02:00
fcntl.c
locks: rename file-private locks to "open file description locks"
2014-04-22 08:23:58 -04:00
fhandle.c
…
file_table.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-06-12 10:30:18 -07:00
file.c
fs/file.c: don't open-code kvfree()
2014-05-06 17:31:10 -04:00
filesystems.c
sys_sysfs: Add CONFIG_SYSFS_SYSCALL
2014-04-03 16:21:05 -07:00
fs_struct.c
seqcount: Add lockdep functionality to seqcount/seqlock structures
2013-11-06 12:40:26 +01:00
fs-writeback.c
One of the main highlights this time, is not the patches themselves
2014-04-04 14:49:16 -07:00
inode.c
fs,userns: Change inode_capable to capable_wrt_inode_uidgid
2014-06-10 13:57:22 -07:00
internal.h
get rid of s_files and files_lock
2013-11-09 00:16:20 -05:00
ioctl.c
file->f_op is never NULL...
2013-10-24 23:34:54 -04:00
Kconfig
kernfs: add CONFIG_KERNFS
2014-02-07 16:08:57 -08:00
Kconfig.binfmt
…
libfs.c
fs/libfs.c: add generic data flush to fsync
2014-06-04 16:53:55 -07:00
locks.c
locks: add some tracepoints in the lease handling code
2014-06-02 08:09:30 -04:00
Makefile
block: move ioprio.c from fs/ to block/
2014-05-19 11:02:18 -06:00
mbcache.c
ext4: each filesystem creates and uses its own mb_cache
2014-03-18 19:24:49 -04:00
mount.h
reduce m_start() cost...
2014-04-01 23:19:09 -04:00
mpage.c
fs/block_dev.c: add bdev_read_page() and bdev_write_page()
2014-06-04 16:54:02 -07:00
namei.c
fs,userns: Change inode_capable to capable_wrt_inode_uidgid
2014-06-10 13:57:22 -07:00
namespace.c
VFS: Make delayed_free() call free_vfsmnt()
2014-04-01 23:19:18 -04:00
no-block.c
…
open.c
new methods: ->read_iter() and ->write_iter()
2014-05-06 17:36:00 -04:00
pipe.c
new helper: copy_page_from_iter()
2014-05-06 17:39:42 -04:00
pnode.c
smarter propagate_mnt()
2014-04-01 23:19:08 -04:00
pnode.h
smarter propagate_mnt()
2014-04-01 23:19:08 -04:00
posix_acl.c
posix_acl: handle NULL ACL in posix_acl_equiv_mode
2014-05-06 13:58:42 -04:00
proc_namespace.c
reduce m_start() cost...
2014-04-01 23:19:09 -04:00
read_write.c
switch simple generic_file_aio_read() users to ->read_iter()
2014-05-06 17:37:55 -04:00
readdir.c
fanotify: create FAN_ACCESS event for readdir
2014-06-04 16:53:52 -07:00
select.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2013-11-13 15:34:18 +09:00
seq_file.c
seq_file: always clear m->count when we free m->buf
2013-11-18 19:07:53 -08:00
signalfd.c
…
splice.c
Merge commit '9f12600fe425bc28f0ccba034a77783c09c15af4' into for-linus
2014-06-12 00:28:09 -04:00
stack.c
…
stat.c
vfs: split out vfs_getattr_nosec
2013-11-09 00:16:31 -05:00
statfs.c
vfs: allow O_PATH file descriptors for fstatfs()
2013-10-12 13:12:31 -07:00
super.c
fs/superblock: avoid locking counting inodes and dentries before reclaiming them
2014-06-04 16:54:11 -07:00
sync.c
Revert "writeback: do not sync data dirtied after sync start"
2014-02-22 02:02:28 +01:00
timerfd.c
timerfd: support CLOCK_BOOTTIME clock
2014-01-23 16:57:40 -08:00
utimes.c
locks: break delegations on any attribute modification
2013-11-09 00:16:44 -05:00
xattr.c
…