linux-toradex.git/fs, branch v2.6.17.10

Fix possible UDF deadlock and memory corruption (CVE-2006-4145)

2006-08-22T19:04:55+00:00

UDF code is not really ready to handle extents larger that 1GB. This is
the easy way to forbid creating those.

Also truncation code did not count with the case when there are no
extents in the file and we are extending the file.

Signed-off-by: Jan Kara 
Signed-off-by: Greg Kroah-Hartman

ext3: avoid triggering ext3_error on bad NFS file handle

2006-08-07T03:52:15+00:00

The inode number out of an NFS file handle gets passed eventually to
ext3_get_inode_block() without any checking.  If ext3_get_inode_block()
allows it to trigger an error, then bad filehandles can have unpleasant
effect - ext3_error() will usually cause a forced read-only remount, or a
panic if `errors=panic' was used.

So remove the call to ext3_error there and put a matching check in
ext3/namei.c where inode numbers are read off storage.

[akpm@osdl.org: fix off-by-one error]
Signed-off-by: Neil Brown 
Signed-off-by: Jan Kara 
Cc: Marcel Holtmann 
Cc: "Stephen C. Tweedie" 
Cc: Eric Sandeen 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

ext3 -nobh option causes oops

2006-08-07T03:52:15+00:00

For files other than IFREG, nobh option doesn't make sense.  Modifications
to them are journalled and needs buffer heads to do that.  Without this
patch, we get kernel oops in page_buffers().

Signed-off-by: Badari Pulavarty 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

invalidate_bdev() speedup

2006-08-07T03:52:14+00:00

We can immediately bale from invalidate_bdev() if the blockdev has no
pagecache.

This solves the huge IPI storms which hald is causing on the big ia64
machines when it polls CDROM drives.

Acked-by: Jes Sorensen 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

Don't allow chmod() on the /proc// files

2006-08-07T03:52:13+00:00

Don't allow chmod() on the /proc// files

This just turns off chmod() on the /proc// files, since there is no
good reason to allow it, and had we disallowed it originally, the nasty
/proc race exploit wouldn't have been possible.

The other patches already fixed the problem chmod() could cause, so this
is really just some final mop-up..

This particular version is based off a patch by Eugene and Marcel which
had much better naming than my original equivalent one.

Signed-off-by: Eugene Teo 
Signed-off-by: Marcel Holtmann 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

struct file leakage

2006-07-25T03:35:28+00:00

2.6.16 leaks like hell. While testing, I found massive leakage
(reproduced in openvz) in:

*filp
*size-4096

And 1 object leaks in
*size-32
*size-64
*size-128

It is the fix for the first one.  filp leaks in the bowels of namei.c.

Seems, size-4096 is file table leaking in expand_fdtables.

I have no idea what are the rest and why they show only accompanying
another leaks.  Some debugging structs?

[akpm@osdl.org, Trond: remove the IS_ERR() check]
Signed-off-by: Alexey Kuznetsov 
Cc: Kirill Korotaev 
Cc: Trond Myklebust 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

fix fdset leakage

2006-07-25T03:35:27+00:00

When found, it is obvious.  nfds calculated when allocating fdsets is
rewritten by calculation of size of fdtable, and when we are unlucky, we
try to free fdsets of wrong size.

Found due to OpenVZ resource management (User Beancounters).

Signed-off-by: Alexey Kuznetsov 
Signed-off-by: Kirill Korotaev 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

splice: fix problems with sys_tee()

2006-07-25T03:35:24+00:00

Several issues noticed/fixed:

- We cannot reliably block in link_pipe() while holding both input and output
  mutexes. So do preparatory checks before locking down both mutexes and doing
  the link.

- The ipipe->nrbufs vs i check was bad, because we could have dropped the
  ipipe lock in-between. This causes us to potentially look at unknown
  buffers if we were racing with someone else reading this pipe.

Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

XFS: corruption fix

2006-07-25T03:35:19+00:00

Fix nused counter.  It's currently getting set to -1 rather than getting
decremented by 1.  Since nused never reaches 0, the "if (!free->hdr.nused)"
check in xfs_dir2_leafn_remove() fails every time and xfs_dir2_shrink_inode()
doesn't get called when it should.  This causes extra blocks to be left on
an empty directory and the directory in unable to be converted back to
inline extent mode.

Signed-off-by: Mandy Kirkconnell 
Signed-off-by: Nathan Scott 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Relax /proc fix a bit

2006-07-15T18:58:27+00:00

Relax /proc fix a bit

Clearign all of i_mode was a bit draconian. We only really care about
S_ISUID/ISGID, after all.

Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman