linux-toradex.git/fs, branch v2.6.34.11

befs: Validate length of long symbolic links.

2012-03-14T14:58:05+00:00

commit 338d0f0a6fbc82407864606f5b64b75aeb3c70f2 upstream.

Signed-off-by: Timo Warns 
Signed-off-by: Linus Torvalds 
Signed-off-by: Paul Gortmaker

fs/partitions/efi.c: corrupted GUID partition tables can cause kernel oops

2012-03-14T14:58:04+00:00

commit 3eb8e74ec72736b9b9d728bad30484ec89c91dde upstream.

The kernel automatically evaluates partition tables of storage devices.
The code for evaluating GUID partitions (in fs/partitions/efi.c) contains
a bug that causes a kernel oops on certain corrupted GUID partition
tables.

This bug has security impacts, because it allows, for example, to
prepare a storage device that crashes a kernel subsystem upon connecting
the device (e.g., a "USB Stick of (Partial) Death").

	crc = efi_crc32((const unsigned char *) (*gpt), le32_to_cpu((*gpt)->header_size));

computes a CRC32 checksum over gpt covering (*gpt)->header_size bytes.
There is no validation of (*gpt)->header_size before the efi_crc32 call.

A corrupted partition table may have large values for (*gpt)->header_size.
 In this case, the CRC32 computation access memory beyond the memory
allocated for gpt, which may cause a kernel heap overflow.

Validate value of GUID partition table header size.

[akpm@linux-foundation.org: fix layout and indenting]
[PG: replace state->bdev with bdev, since 1493bf217f7f isn't in 34]

Signed-off-by: Timo Warns 
Cc: Matt Domsch 
Cc: Eugene Teo 
Cc: Dave Jones 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Paul Gortmaker

cifs: add fallback in is_path_accessible for old servers

2012-03-14T14:57:58+00:00

commit 221d1d797202984cb874e3ed9f1388593d34ee22 upstream.

The is_path_accessible check uses a QPathInfo call, which isn't
supported by ancient win9x era servers. Fall back to an older
SMBQueryInfo call if it fails with the magic error codes.

Reported-and-Tested-by: Sandro Bonazzola 
Signed-off-by: Jeff Layton 
Signed-off-by: Steve French 
Signed-off-by: Paul Gortmaker

CIFS: Fix memory over bound bug in cifs_parse_mount_options

2012-03-14T14:57:55+00:00

commit 4906e50b37e6f6c264e7ee4237343eb2b7f8d16d upstream.

While password processing we can get out of options array bound if
the next character after array is delimiter. The patch adds a check
if we reach the end.

Signed-off-by: Pavel Shilovsky 
Reviewed-by: Jeff Layton 
Signed-off-by: Steve French 
Signed-off-by: Paul Gortmaker

Validate size of EFI GUID partition entries.

2012-03-14T14:57:55+00:00

commit fa039d5f6b126fbd65eefa05db2f67e44df8f121 upstream.

Otherwise corrupted EFI partition tables can cause total confusion.

Signed-off-by: Timo Warns 
Signed-off-by: Linus Torvalds 
Signed-off-by: Paul Gortmaker

cifs: check for bytes_remaining going to zero in CIFS_SessSetup

2012-03-14T14:57:55+00:00

commit fcda7f4578bbf9717444ca6da8a421d21489d078 upstream.

It's possible that when we go to decode the string area in the
SESSION_SETUP response, that bytes_remaining will be 0. Decrementing it at
that point will mean that it can go "negative" and wrap. Check for a
bytes_remaining value of 0, and don't try to decode the string area if
that's the case.

Reported-and-Acked-by: David Howells 
Signed-off-by: Jeff Layton 
Signed-off-by: Steve French 
Signed-off-by: Paul Gortmaker

btrfs: Require CAP_SYS_ADMIN for filesystem rebalance

2012-03-14T14:57:48+00:00

commit 6f88a4403def422bd8e276ddf6863d6ac71435d2 upstream.

Filesystem rebalancing (BTRFS_IOC_BALANCE) affects the entire
filesystem and may run uninterruptibly for a long time.  This does not
seem to be something that an unprivileged user should be able to do.

Reported-by: Aron Xu 
Signed-off-by: Ben Hutchings 
Signed-off-by: Chris Mason 
Signed-off-by: Paul Gortmaker

cifs: fix another memleak, in cifs_root_iget

2012-03-14T14:57:47+00:00

commit a7851ce73b9fdef53f251420e6883cf4f3766534 upstream.

cifs_root_iget allocates full_path through
cifs_build_path_to_root, but fails to kfree it upon
cifs_get_inode_info* failure.

Make all failure exit paths traverse clean up
handling at the end of the function.

Signed-off-by: Oskar Schirmer 
Reviewed-by: Jesper Juhl 
Signed-off-by: Steve French 
Signed-off-by: Paul Gortmaker

Increase OSF partition limit from 8 to 18

2012-03-14T14:57:37+00:00

commit 34d211a2d5df4984a35b18d8ccacbe1d10abb067 upstream.

It turns out that while a maximum of 8 partitions may be what people
"should" have had, you can actually fit up to 18 entries(*) in a sector.

And some people clearly were taking advantage of that, like Michael
Cree, who had ten partitions on one of his OSF disks.

(*) The OSF partition data starts at byte offset 64 in the first sector,
    and the array of 16-byte partition entries start at offset 148 in
    the on-disk partition structure.

Reported-by: Michael Cree 
Signed-off-by: Linus Torvalds 
Signed-off-by: Paul Gortmaker

Fix corrupted OSF partition table parsing

2012-03-14T14:57:37+00:00

commit 1eafbfeb7bdf59cfe173304c76188f3fd5f1fd05 upstream.

The kernel automatically evaluates partition tables of storage devices.
The code for evaluating OSF partitions contains a bug that leaks data
from kernel heap memory to userspace for certain corrupted OSF
partitions.

In more detail:

  for (i = 0 ; i < le16_to_cpu(label->d_npartitions); i++, partition++) {

iterates from 0 to d_npartitions - 1, where d_npartitions is read from
the partition table without validation and partition is a pointer to an
array of at most 8 d_partitions.

Add the proper and obvious validation.

Signed-off-by: Timo Warns 
[ Changed the patch trivially to not repeat the whole le16_to_cpu()
  thing, and to use an explicit constant for the magic value '8' ]
Signed-off-by: Linus Torvalds 

Signed-off-by: Paul Gortmaker