<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/fs/isofs/export.c, branch v3.7.4</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking</title>
<updated>2012-10-10T03:33:55+00:00</updated>
<author>
<name>Hugh Dickins</name>
<email>hughd@google.com</email>
</author>
<published>2012-10-08T03:32:51+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=35c2a7f4908d404c9124c2efc6ada4640ca4d5d5'/>
<id>35c2a7f4908d404c9124c2efc6ada4640ca4d5d5</id>
<content type='text'>
Fuzzing with trinity oopsed on the 1st instruction of shmem_fh_to_dentry(),
	u64 inum = fid-&gt;raw[2];
which is unhelpfully reported as at the end of shmem_alloc_inode():

BUG: unable to handle kernel paging request at ffff880061cd3000
IP: [&lt;ffffffff812190d0&gt;] shmem_alloc_inode+0x40/0x40
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Call Trace:
 [&lt;ffffffff81488649&gt;] ? exportfs_decode_fh+0x79/0x2d0
 [&lt;ffffffff812d77c3&gt;] do_handle_open+0x163/0x2c0
 [&lt;ffffffff812d792c&gt;] sys_open_by_handle_at+0xc/0x10
 [&lt;ffffffff83a5f3f8&gt;] tracesys+0xe1/0xe6

Right, tmpfs is being stupid to access fid-&gt;raw[2] before validating that
fh_len includes it: the buffer kmalloc'ed by do_sys_name_to_handle() may
fall at the end of a page, and the next page not be present.

But some other filesystems (ceph, gfs2, isofs, reiserfs, xfs) are being
careless about fh_len too, in fh_to_dentry() and/or fh_to_parent(), and
could oops in the same way: add the missing fh_len checks to those.

Reported-by: Sasha Levin &lt;levinsasha928@gmail.com&gt;
Signed-off-by: Hugh Dickins &lt;hughd@google.com&gt;
Cc: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Cc: Sage Weil &lt;sage@inktank.com&gt;
Cc: Steven Whitehouse &lt;swhiteho@redhat.com&gt;
Cc: Christoph Hellwig &lt;hch@infradead.org&gt;
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Fuzzing with trinity oopsed on the 1st instruction of shmem_fh_to_dentry(),
	u64 inum = fid-&gt;raw[2];
which is unhelpfully reported as at the end of shmem_alloc_inode():

BUG: unable to handle kernel paging request at ffff880061cd3000
IP: [&lt;ffffffff812190d0&gt;] shmem_alloc_inode+0x40/0x40
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Call Trace:
 [&lt;ffffffff81488649&gt;] ? exportfs_decode_fh+0x79/0x2d0
 [&lt;ffffffff812d77c3&gt;] do_handle_open+0x163/0x2c0
 [&lt;ffffffff812d792c&gt;] sys_open_by_handle_at+0xc/0x10
 [&lt;ffffffff83a5f3f8&gt;] tracesys+0xe1/0xe6

Right, tmpfs is being stupid to access fid-&gt;raw[2] before validating that
fh_len includes it: the buffer kmalloc'ed by do_sys_name_to_handle() may
fall at the end of a page, and the next page not be present.

But some other filesystems (ceph, gfs2, isofs, reiserfs, xfs) are being
careless about fh_len too, in fh_to_dentry() and/or fh_to_parent(), and
could oops in the same way: add the missing fh_len checks to those.

Reported-by: Sasha Levin &lt;levinsasha928@gmail.com&gt;
Signed-off-by: Hugh Dickins &lt;hughd@google.com&gt;
Cc: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Cc: Sage Weil &lt;sage@inktank.com&gt;
Cc: Steven Whitehouse &lt;swhiteho@redhat.com&gt;
Cc: Christoph Hellwig &lt;hch@infradead.org&gt;
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>isofs: avoid info leak on export</title>
<updated>2012-07-13T09:21:21+00:00</updated>
<author>
<name>Mathias Krause</name>
<email>minipli@googlemail.com</email>
</author>
<published>2012-07-12T06:46:54+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=fe685aabf7c8c9f138e5ea900954d295bf229175'/>
<id>fe685aabf7c8c9f138e5ea900954d295bf229175</id>
<content type='text'>
For type 1 the parent_offset member in struct isofs_fid gets copied
uninitialized to userland. Fix this by initializing it to 0.

Signed-off-by: Mathias Krause &lt;minipli@googlemail.com&gt;
Signed-off-by: Jan Kara &lt;jack@suse.cz&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
For type 1 the parent_offset member in struct isofs_fid gets copied
uninitialized to userland. Fix this by initializing it to 0.

Signed-off-by: Mathias Krause &lt;minipli@googlemail.com&gt;
Signed-off-by: Jan Kara &lt;jack@suse.cz&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>-&gt;encode_fh() API change</title>
<updated>2012-05-30T03:28:33+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@zeniv.linux.org.uk</email>
</author>
<published>2012-04-02T18:34:06+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=b0b0382bb4904965a9e9fca77ad87514dfda0d1c'/>
<id>b0b0382bb4904965a9e9fca77ad87514dfda0d1c</id>
<content type='text'>
pass inode + parent's inode or NULL instead of dentry + bool saying
whether we want the parent or not.

NOTE: that needs ceph fix folded in.

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
pass inode + parent's inode or NULL instead of dentry + bool saying
whether we want the parent or not.

NOTE: that needs ceph fix folded in.

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>exportfs: Return the minimum required handle size</title>
<updated>2011-03-14T13:15:28+00:00</updated>
<author>
<name>Aneesh Kumar K.V</name>
<email>aneesh.kumar@linux.vnet.ibm.com</email>
</author>
<published>2011-01-29T13:13:25+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=5fe0c2378884e68beb532f5890cc0e3539ac747b'/>
<id>5fe0c2378884e68beb532f5890cc0e3539ac747b</id>
<content type='text'>
The exportfs encode handle function should return the minimum required
handle size. This helps user to find out the handle size by passing 0
handle size in the first step and then redoing to the call again with
the returned handle size value.

Acked-by: Serge Hallyn &lt;serue@us.ibm.com&gt;
Signed-off-by: Aneesh Kumar K.V &lt;aneesh.kumar@linux.vnet.ibm.com&gt;
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The exportfs encode handle function should return the minimum required
handle size. This helps user to find out the handle size by passing 0
handle size in the first step and then redoing to the call again with
the returned handle size value.

Acked-by: Serge Hallyn &lt;serue@us.ibm.com&gt;
Signed-off-by: Aneesh Kumar K.V &lt;aneesh.kumar@linux.vnet.ibm.com&gt;
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>nfs: new subdir Documentation/filesystems/nfs</title>
<updated>2009-10-27T23:34:04+00:00</updated>
<author>
<name>J. Bruce Fields</name>
<email>bfields@citi.umich.edu</email>
</author>
<published>2009-10-27T18:41:35+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=dc7a08166f3a5f23e79e839a8a88849bd3397c32'/>
<id>dc7a08166f3a5f23e79e839a8a88849bd3397c32</id>
<content type='text'>
We're adding enough nfs documentation that it may as well have its own
subdirectory.

Acked-by: Randy Dunlap &lt;rdunlap@xenotime.net&gt;
Signed-off-by: J. Bruce Fields &lt;bfields@citi.umich.edu&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
We're adding enough nfs documentation that it may as well have its own
subdirectory.

Acked-by: Randy Dunlap &lt;rdunlap@xenotime.net&gt;
Signed-off-by: J. Bruce Fields &lt;bfields@citi.umich.edu&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[PATCH] switch all filesystems over to d_obtain_alias</title>
<updated>2008-10-23T09:13:01+00:00</updated>
<author>
<name>Christoph Hellwig</name>
<email>hch@lst.de</email>
</author>
<published>2008-08-11T13:49:04+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=440037287c5ebb07033ab927ca16bb68c291d309'/>
<id>440037287c5ebb07033ab927ca16bb68c291d309</id>
<content type='text'>
Switch all users of d_alloc_anon to d_obtain_alias.

Signed-off-by: Christoph Hellwig &lt;hch@lst.de&gt;
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Switch all users of d_alloc_anon to d_obtain_alias.

Signed-off-by: Christoph Hellwig &lt;hch@lst.de&gt;
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>iget: stop ISOFS from using read_inode()</title>
<updated>2008-02-07T16:42:28+00:00</updated>
<author>
<name>David Howells</name>
<email>dhowells@redhat.com</email>
</author>
<published>2008-02-07T08:15:41+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=c4386c83bf849c56b1f49951595aeb7c9a719d21'/>
<id>c4386c83bf849c56b1f49951595aeb7c9a719d21</id>
<content type='text'>
Stop the ISOFS filesystem from using read_inode().  Make isofs_read_inode()
return an error code, and make isofs_iget() pass it on.

Signed-off-by: David Howells &lt;dhowells@redhat.com&gt;
Cc: Jan Kara &lt;jack@ucw.cz&gt;
Acked-by: Christoph Hellwig &lt;hch@lst.de&gt;
Cc: "Dave Young" &lt;hidave.darkstar@gmail.com&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Stop the ISOFS filesystem from using read_inode().  Make isofs_read_inode()
return an error code, and make isofs_iget() pass it on.

Signed-off-by: David Howells &lt;dhowells@redhat.com&gt;
Cc: Jan Kara &lt;jack@ucw.cz&gt;
Acked-by: Christoph Hellwig &lt;hch@lst.de&gt;
Cc: "Dave Young" &lt;hidave.darkstar@gmail.com&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>exportfs: make struct export_operations const</title>
<updated>2007-10-22T15:13:21+00:00</updated>
<author>
<name>Christoph Hellwig</name>
<email>hch@lst.de</email>
</author>
<published>2007-10-21T23:42:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=39655164405940d4818224a085e35420e2f97aed'/>
<id>39655164405940d4818224a085e35420e2f97aed</id>
<content type='text'>
Now that nfsd has stopped writing to the find_exported_dentry member we an
mark the export_operations const

Signed-off-by: Christoph Hellwig &lt;hch@lst.de&gt;
Cc: Neil Brown &lt;neilb@suse.de&gt;
Cc: "J. Bruce Fields" &lt;bfields@fieldses.org&gt;
Cc: &lt;linux-ext4@vger.kernel.org&gt;
Cc: Dave Kleikamp &lt;shaggy@austin.ibm.com&gt;
Cc: Anton Altaparmakov &lt;aia21@cantab.net&gt;
Cc: David Chinner &lt;dgc@sgi.com&gt;
Cc: Timothy Shimmin &lt;tes@sgi.com&gt;
Cc: OGAWA Hirofumi &lt;hirofumi@mail.parknet.co.jp&gt;
Cc: Hugh Dickins &lt;hugh@veritas.com&gt;
Cc: Chris Mason &lt;mason@suse.com&gt;
Cc: Jeff Mahoney &lt;jeffm@suse.com&gt;
Cc: "Vladimir V. Saveliev" &lt;vs@namesys.com&gt;
Cc: Steven Whitehouse &lt;swhiteho@redhat.com&gt;
Cc: Mark Fasheh &lt;mark.fasheh@oracle.com&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Now that nfsd has stopped writing to the find_exported_dentry member we an
mark the export_operations const

Signed-off-by: Christoph Hellwig &lt;hch@lst.de&gt;
Cc: Neil Brown &lt;neilb@suse.de&gt;
Cc: "J. Bruce Fields" &lt;bfields@fieldses.org&gt;
Cc: &lt;linux-ext4@vger.kernel.org&gt;
Cc: Dave Kleikamp &lt;shaggy@austin.ibm.com&gt;
Cc: Anton Altaparmakov &lt;aia21@cantab.net&gt;
Cc: David Chinner &lt;dgc@sgi.com&gt;
Cc: Timothy Shimmin &lt;tes@sgi.com&gt;
Cc: OGAWA Hirofumi &lt;hirofumi@mail.parknet.co.jp&gt;
Cc: Hugh Dickins &lt;hugh@veritas.com&gt;
Cc: Chris Mason &lt;mason@suse.com&gt;
Cc: Jeff Mahoney &lt;jeffm@suse.com&gt;
Cc: "Vladimir V. Saveliev" &lt;vs@namesys.com&gt;
Cc: Steven Whitehouse &lt;swhiteho@redhat.com&gt;
Cc: Mark Fasheh &lt;mark.fasheh@oracle.com&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>isofs: new export ops</title>
<updated>2007-10-22T15:13:20+00:00</updated>
<author>
<name>Christoph Hellwig</name>
<email>hch@lst.de</email>
</author>
<published>2007-10-21T23:42:12+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=905251a02eeccc59f8e1d743679b8edadc5f738b'/>
<id>905251a02eeccc59f8e1d743679b8edadc5f738b</id>
<content type='text'>
Nice little cleanup by consolidating things a little and using a structure for
the special file handle format.

Signed-off-by: Christoph Hellwig &lt;hch@lst.de&gt;
Cc: Neil Brown &lt;neilb@suse.de&gt;
Cc: "J. Bruce Fields" &lt;bfields@fieldses.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Nice little cleanup by consolidating things a little and using a structure for
the special file handle format.

Signed-off-by: Christoph Hellwig &lt;hch@lst.de&gt;
Cc: Neil Brown &lt;neilb@suse.de&gt;
Cc: "J. Bruce Fields" &lt;bfields@fieldses.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[PATCH] isofs includes sanitized</title>
<updated>2005-04-26T01:32:12+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@www.linux.org.uk</email>
</author>
<published>2005-04-26T01:32:12+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=94f2f715771d0aa5554451d1e2a920f11b8be3fe'/>
<id>94f2f715771d0aa5554451d1e2a920f11b8be3fe</id>
<content type='text'>
fs/isofs includes trimmed down to something resembling sanity.

Kernel-only parts of linux/iso_fs.h and entire linux/iso_fs_{sb,i}.h
moved to fs/isofs/isofs.h.

A lot of useless #include in fs/isofs/*.c killed. 

Signed-off-by: Al Viro &lt;viro@parcelfarce.linux.theplanet.co.uk&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@osdl.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
fs/isofs includes trimmed down to something resembling sanity.

Kernel-only parts of linux/iso_fs.h and entire linux/iso_fs_{sb,i}.h
moved to fs/isofs/isofs.h.

A lot of useless #include in fs/isofs/*.c killed. 

Signed-off-by: Al Viro &lt;viro@parcelfarce.linux.theplanet.co.uk&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@osdl.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
