linux-toradex.git/fs/ubifs/dir.c, branch v3.13.5

ubifs: switch to %pd

2013-10-25T03:34:51+00:00

Signed-off-by: Al Viro

[readdir] convert ubifs

2013-06-29T08:56:25+00:00

Signed-off-by: Al Viro

UBIFS: fix a horrid bug

2013-06-29T08:45:37+00:00

Al Viro pointed me to the fact that '->readdir()' and '->llseek()' have no
mutual exclusion, which means the 'ubifs_dir_llseek()' can be run while we are
in the middle of 'ubifs_readdir()'.

This means that 'file->private_data' can be freed while 'ubifs_readdir()' uses
it, and this is a very bad bug: not only 'ubifs_readdir()' can return garbage,
but this may corrupt memory and lead to all kinds of problems like crashes an
security holes.

This patch fixes the problem by using the 'file->f_version' field, which
'->llseek()' always unconditionally sets to zero. We set it to 1 in
'ubifs_readdir()' and whenever we detect that it became 0, we know there was a
seek and it is time to clear the state saved in 'file->private_data'.

I tested this patch by writing a user-space program which runds readdir and
seek in parallell. I could easily crash the kernel without these patches, but
could not crash it with these patches.

Cc: stable@vger.kernel.org
Reported-by: Al Viro 
Tested-by: Artem Bityutskiy 
Signed-off-by: Artem Bityutskiy 
Signed-off-by: Al Viro

UBIFS: prepare to fix a horrid bug

2013-06-29T08:45:37+00:00

Al Viro pointed me to the fact that '->readdir()' and '->llseek()' have no
mutual exclusion, which means the 'ubifs_dir_llseek()' can be run while we are
in the middle of 'ubifs_readdir()'.

First of all, this means that 'file->private_data' can be freed while
'ubifs_readdir()' uses it.  But this particular patch does not fix the problem.
This patch is only a preparation, and the fix will follow next.

In this patch we make 'ubifs_readdir()' stop using 'file->f_pos' directly,
because 'file->f_pos' can be changed by '->llseek()' at any point. This may
lead 'ubifs_readdir()' to returning inconsistent data: directory entry names
may correspond to incorrect file positions.

So here we introduce a local variable 'pos', read 'file->f_pose' once at very
the beginning, and then stick to 'pos'. The result of this is that when
'ubifs_dir_llseek()' changes 'file->f_pos' while we are in the middle of
'ubifs_readdir()', the latter "wins".

Cc: stable@vger.kernel.org
Reported-by: Al Viro 
Tested-by: Artem Bityutskiy 
Signed-off-by: Artem Bityutskiy 
Signed-off-by: Al Viro

new helper: file_inode(file)

2013-02-23T04:31:31+00:00

Signed-off-by: Al Viro

lseek: the "whence" argument is called "whence"

2012-12-18T01:15:12+00:00

But the kernel decided to call it "origin" instead.  Fix most of the
sites.

Acked-by: Hugh Dickins 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

UBIFS: comply with coding style

2012-08-31T14:32:57+00:00

Join all the split printk lines in order to stop checkpatch complaining.

Signed-off-by: Artem Bityutskiy

Merge tag 'upstream-3.6-rc1' of git://git.infradead.org/linux-ubifs

2012-07-23T22:50:52+00:00

Pull UBIFS updates from Artem Bityutskiy:

 - Added another debugfs knob for forcing UBIFS R/O mode without
   flushing caches or finishing commit or any other I/O operation.  I've
   originally added this knob in order to reproduce the free space fixup
   bug (see commit c6727932cfdb: "UBIFS: fix a bug in empty space
   fix-up") on nandsim.

   Without this knob I would have to do real power-cuts, which would
   make debugging much harder.  Then I've decided to keep this knob
   because it is also useful for UBIFS power-cut recovery end
   error-paths testing.

 - Well-spotted fix from Julia.  This bug did not cause real troubles
   for UBIFS, but nevertheless it could cause issues for someone trying
   to modify the orphans handling code.  Kudos to coccinelle!

 - Minor cleanups.

* tag 'upstream-3.6-rc1' of git://git.infradead.org/linux-ubifs:
  UBIFS: remove invalid reference to list iterator variable
  UBIFS: simplify reply code a bit
  UBIFS: add debugfs knob to switch to R/O mode
  UBIFS: fix compilation warning

UBIFS: fix compilation warning

2012-07-20T07:27:25+00:00

Fix the following compilation warning:

fs/ubifs/dir.c: In function 'ubifs_rename':
fs/ubifs/dir.c:972:15: warning: 'saved_nlink' may be used uninitialized
in this function

Use the 'uninitialized_var()' macro to get rid of this false-positive.

Artem: massaged the patch a bit.

Signed-off-by: Alexandre Pereira da Silva 
Signed-off-by: Artem Bityutskiy

don't pass nameidata to ->create()

2012-07-14T12:34:47+00:00

boolean "does it have to be exclusive?" flag is passed instead;
Local filesystem should just ignore it - the object is guaranteed
not to be there yet.

Signed-off-by: Al Viro