linux-toradex.git/fs, branch v2.6.34.8

pipe: fix failure to return error code on ->confirm()

2011-01-06T23:08:22+00:00

commit e5953cbdff26f7cbae7eff30cd9b18c4e19b7594 upstream.

The arguments were transposed, we want to assign the error code to
'ret', which is being returned.

Signed-off-by: Nicolas Kaiser 
Signed-off-by: Jens Axboe 
Signed-off-by: Paul Gortmaker

mm: Move vma_stack_continue into mm.h

2011-01-06T23:08:18+00:00

commit 39aa3cb3e8250db9188a6f1e3fb62ffa1a717678 upstream.

So it can be used by all that need to check for that.

Signed-off-by: Stefan Bader 
Signed-off-by: Linus Torvalds 
Signed-off-by: Paul Gortmaker

execve: make responsive to SIGKILL with large arguments

2011-01-06T23:08:18+00:00

commit 9aea5a65aa7a1af9a4236dfaeb0088f1624f9919 upstream.

An execve with a very large total of argument/environment strings
can take a really long time in the execve system call.  It runs
uninterruptibly to count and copy all the strings.  This change
makes it abort the exec quickly if sent a SIGKILL.

Note that this is the conservative change, to interrupt only for
SIGKILL, by using fatal_signal_pending().  It would be perfectly
correct semantics to let any signal interrupt the string-copying in
execve, i.e. use signal_pending() instead of fatal_signal_pending().
We'll save that change for later, since it could have user-visible
consequences, such as having a timer set too quickly make it so that
an execve can never complete, though it always happened to work before.

Signed-off-by: Roland McGrath 
Reviewed-by: KOSAKI Motohiro 
Signed-off-by: Linus Torvalds 
Signed-off-by: Paul Gortmaker

execve: improve interactivity with large arguments

2011-01-06T23:08:17+00:00

commit 7993bc1f4663c0db67bb8f0d98e6678145b387cd upstream.

This adds a preemption point during the copying of the argument and
environment strings for execve, in copy_strings().  There is already
a preemption point in the count() loop, so this doesn't add any new
points in the abstract sense.

When the total argument+environment strings are very large, the time
spent copying them can be much more than a normal user time slice.
So this change improves the interactivity of the rest of the system
when one process is doing an execve with very large arguments.

Signed-off-by: Roland McGrath 
Reviewed-by: KOSAKI Motohiro 
Signed-off-by: Linus Torvalds 
Signed-off-by: Paul Gortmaker

setup_arg_pages: diagnose excessive argument size

2011-01-06T23:08:17+00:00

commit 1b528181b2ffa14721fb28ad1bd539fe1732c583 upstream.

The CONFIG_STACK_GROWSDOWN variant of setup_arg_pages() does not
check the size of the argument/environment area on the stack.
When it is unworkably large, shift_arg_pages() hits its BUG_ON.
This is exploitable with a very large RLIMIT_STACK limit, to
create a crash pretty easily.

Check that the initial stack is not too large to make it possible
to map in any executable.  We're not checking that the actual
executable (or intepreter, for binfmt_elf) will fit.  So those
mappings might clobber part of the initial stack mapping.  But
that is just userland lossage that userland made happen, not a
kernel problem.

Signed-off-by: Roland McGrath 
Reviewed-by: KOSAKI Motohiro 
Signed-off-by: Linus Torvalds 
Signed-off-by: Paul Gortmaker

ocfs2: Don't walk off the end of fast symlinks.

2011-01-06T23:08:11+00:00

commit 1fc8a117865b54590acd773a55fbac9221b018f0 upstream.

ocfs2 fast symlinks are NUL terminated strings stored inline in the
inode data area.  However, disk corruption or a local attacker could, in
theory, remove that NUL.  Because we're using strlen() (my fault,
introduced in a731d1 when removing vfs_follow_link()), we could walk off
the end of that string.

Signed-off-by: Joel Becker 
Signed-off-by: Paul Gortmaker

inotify: fix inotify oneshot support

2011-01-06T23:08:04+00:00

commit ff311008ab8d2f2cfdbbefd407d1b05acc8164b2 upstream.

During the large inotify rewrite to fsnotify I completely dropped support
for IN_ONESHOT.  Reimplement that support.

Signed-off-by: Eric Paris 
Signed-off-by: Paul Gortmaker

dasd: use correct label location for diag fba disks

2011-01-06T23:08:04+00:00

commit cffab6bc5511cd6f67a60bf16b62de4267b68c4c upstream.

Partition boundary calculation fails for DASD FBA disks under the
following conditions:
- disk is formatted with CMS FORMAT with a blocksize of more than
  512 bytes
- all of the disk is reserved to a single CMS file using CMS RESERVE
- the disk is accessed using the DIAG mode of the DASD driver

Under these circumstances, the partition detection code tries to
read the CMS label block containing partition-relevant information
from logical block offset 1, while it is in fact located at physical
block offset 1.

Fix this problem by using the correct CMS label block location
depending on the device type as determined by the DASD SENSE ID
information.

Signed-off-by: Peter Oberparleiter 
Signed-off-by: Martin Schwidefsky 
Signed-off-by: Paul Gortmaker

xfs: prevent reading uninitialized stack memory

2011-01-06T23:08:02+00:00

commit a122eb2fdfd78b58c6dd992d6f4b1aaef667eef9 upstream.

The XFS_IOC_FSGETXATTR ioctl allows unprivileged users to read 12
bytes of uninitialized stack memory, because the fsxattr struct
declared on the stack in xfs_ioc_fsgetxattr() does not alter (or zero)
the 12-byte fsx_pad member before copying it back to the user.  This
patch takes care of it.

Signed-off-by: Dan Rosenberg 
Reviewed-by: Eric Sandeen 
Signed-off-by: Alex Elder 
Signed-off-by: Paul Gortmaker

ext4: Fix remaining racy updates of EXT4_I(inode)->i_flags

2011-01-06T23:08:01+00:00

commit 84a8dce2710cc425089a2b92acc354d4fbb5788d upstream.

A few functions were still modifying i_flags in a racy manner.

Signed-off-by: Dmitry Monakhov 
Signed-off-by: "Theodore Ts'o" 
Signed-off-by: Paul Gortmaker