2019-05-31 01:09:56 -07:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
|
|
|
|
|
2006-05-18 15:09:15 -04:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2007-07-17 04:04:28 -07:00
|
|
|
|
2006-02-27 17:23:27 -05:00
|
|
|
|
2006-03-28 14:14:04 -05:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
|
|
|
|
|
2006-02-27 17:23:27 -05:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2008-10-14 16:05:55 +01:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
2006-03-20 12:30:04 -05:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
2007-06-01 14:11:58 +01:00
|
|
|
|
2007-06-27 17:07:53 -04:00
|
|
|
|
2007-07-10 12:28:27 +01:00
|
|
|
|
2007-06-01 14:11:58 +01:00
|
|
|
|
2012-04-02 14:34:06 -04:00
|
|
|
|
|
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
2006-10-14 10:46:30 -04:00
|
|
|
|
2006-03-01 15:31:02 -05:00
|
|
|
|
2006-06-14 15:32:57 -04:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
2012-04-02 14:34:06 -04:00
|
|
|
|
2011-01-29 18:43:25 +05:30
|
|
|
|
2013-02-17 15:48:11 +09:00
|
|
|
|
2011-01-29 18:43:25 +05:30
|
|
|
|
|
|
|
|
|
2013-02-17 15:48:11 +09:00
|
|
|
|
2011-01-29 18:43:25 +05:30
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
2007-05-15 15:37:50 +01:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2006-09-04 16:16:45 -04:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
2015-03-17 22:25:59 +00:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
|
|
|
|
|
2012-04-02 14:34:06 -04:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
2007-05-15 15:37:50 +01:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2006-09-04 16:16:45 -04:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2013-05-16 14:14:48 -04:00
|
|
|
|
2006-10-13 22:51:24 -04:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2022-08-16 11:57:56 -04:00
|
|
|
|
2014-10-30 17:37:34 +01:00
|
|
|
|
|
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
2014-10-30 17:37:34 +01:00
|
|
|
|
|
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
2007-01-17 15:09:20 +00:00
|
|
|
|
2022-08-16 11:57:56 -04:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2022-08-16 11:57:56 -04:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2015-03-17 22:25:59 +00:00
|
|
|
|
|
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
2013-05-22 22:22:04 -04:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
|
|
|
|
|
2011-10-27 12:16:06 -04:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2006-06-14 15:32:57 -04:00
|
|
|
|
|
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
|
|
|
|
|
2007-05-15 15:37:50 +01:00
|
|
|
|
|
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2013-05-16 14:14:48 -04:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2015-03-17 22:25:59 +00:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
|
|
|
|
|
2007-10-21 16:42:14 -07:00
|
|
|
|
2009-09-08 18:00:30 +01:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
2006-02-27 17:23:27 -05:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
|
|
|
|
|
2020-01-15 05:31:38 +01:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2010-11-03 20:01:07 +00:00
|
|
|
|
2010-12-18 12:06:56 -05:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
|
|
|
|
|
2007-10-21 16:42:14 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking
Fuzzing with trinity oopsed on the 1st instruction of shmem_fh_to_dentry(),
u64 inum = fid->raw[2];
which is unhelpfully reported as at the end of shmem_alloc_inode():
BUG: unable to handle kernel paging request at ffff880061cd3000
IP: [<ffffffff812190d0>] shmem_alloc_inode+0x40/0x40
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Call Trace:
[<ffffffff81488649>] ? exportfs_decode_fh+0x79/0x2d0
[<ffffffff812d77c3>] do_handle_open+0x163/0x2c0
[<ffffffff812d792c>] sys_open_by_handle_at+0xc/0x10
[<ffffffff83a5f3f8>] tracesys+0xe1/0xe6
Right, tmpfs is being stupid to access fid->raw[2] before validating that
fh_len includes it: the buffer kmalloc'ed by do_sys_name_to_handle() may
fall at the end of a page, and the next page not be present.
But some other filesystems (ceph, gfs2, isofs, reiserfs, xfs) are being
careless about fh_len too, in fh_to_dentry() and/or fh_to_parent(), and
could oops in the same way: add the missing fh_len checks to those.
Reported-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Sage Weil <sage@inktank.com>
Cc: Steven Whitehouse <swhiteho@redhat.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-10-07 20:32:51 -07:00
|
|
|
|
|
|
|
|
|
2007-10-21 16:42:14 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking
Fuzzing with trinity oopsed on the 1st instruction of shmem_fh_to_dentry(),
u64 inum = fid->raw[2];
which is unhelpfully reported as at the end of shmem_alloc_inode():
BUG: unable to handle kernel paging request at ffff880061cd3000
IP: [<ffffffff812190d0>] shmem_alloc_inode+0x40/0x40
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Call Trace:
[<ffffffff81488649>] ? exportfs_decode_fh+0x79/0x2d0
[<ffffffff812d77c3>] do_handle_open+0x163/0x2c0
[<ffffffff812d792c>] sys_open_by_handle_at+0xc/0x10
[<ffffffff83a5f3f8>] tracesys+0xe1/0xe6
Right, tmpfs is being stupid to access fid->raw[2] before validating that
fh_len includes it: the buffer kmalloc'ed by do_sys_name_to_handle() may
fall at the end of a page, and the next page not be present.
But some other filesystems (ceph, gfs2, isofs, reiserfs, xfs) are being
careless about fh_len too, in fh_to_dentry() and/or fh_to_parent(), and
could oops in the same way: add the missing fh_len checks to those.
Reported-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Sage Weil <sage@inktank.com>
Cc: Steven Whitehouse <swhiteho@redhat.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-10-07 20:32:51 -07:00
|
|
|
|
|
|
|
|
|
2007-10-21 16:42:14 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2007-10-21 16:42:17 -07:00
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
2007-10-21 16:42:14 -07:00
|
|
|
|
|
|
|
|
|
2006-01-16 16:50:04 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|