linux-toradex.git/fs, branch v2.6.35.6

xfs: prevent reading uninitialized stack memory

2010-09-27T00:18:36+00:00

commit a122eb2fdfd78b58c6dd992d6f4b1aaef667eef9 upstream.

The XFS_IOC_FSGETXATTR ioctl allows unprivileged users to read 12
bytes of uninitialized stack memory, because the fsxattr struct
declared on the stack in xfs_ioc_fsgetxattr() does not alter (or zero)
the 12-byte fsx_pad member before copying it back to the user.  This
patch takes care of it.

Signed-off-by: Dan Rosenberg 
Reviewed-by: Eric Sandeen 
Signed-off-by: Alex Elder 
Cc: dann frazier 
Signed-off-by: Greg Kroah-Hartman

inotify: send IN_UNMOUNT events

2010-09-27T00:18:31+00:00

commit 611da04f7a31b2208e838be55a42c7a1310ae321 upstream.

Since the .31 or so notify rewrite inotify has not sent events about
inodes which are unmounted.  This patch restores those events.

Signed-off-by: Eric Paris 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

GFS2: gfs2_logd should be using interruptible waits

2010-09-27T00:18:31+00:00

commit 5f4874903df3562b9d5649fc1cf7b8c6bb238e42 upstream.

Looks like this crept in, in a recent update.

Reported-by: Krzysztof Urbaniak 
Signed-off-by: Steven Whitehouse 
Signed-off-by: Greg Kroah-Hartman

aio: check for multiplication overflow in do_io_submit

2010-09-27T00:18:30+00:00

commit 75e1c70fc31490ef8a373ea2a4bea2524099b478 upstream.

Tavis Ormandy pointed out that do_io_submit does not do proper bounds
checking on the passed-in iocb array:

       if (unlikely(nr < 0))
               return -EINVAL;

       if (unlikely(!access_ok(VERIFY_READ, iocbpp, (nr*sizeof(iocbpp)))))
               return -EFAULT;                      ^^^^^^^^^^^^^^^^^^

The attached patch checks for overflow, and if it is detected, the
number of iocbs submitted is scaled down to a number that will fit in
the long.  This is an ok thing to do, as sys_io_submit is documented as
returning the number of iocbs submitted, so callers should handle a
return value of less than the 'nr' argument passed in.

Reported-by: Tavis Ormandy 
Signed-off-by: Jeff Moyer 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

aio: do not return ERESTARTSYS as a result of AIO

2010-09-27T00:18:29+00:00

commit a0c42bac79731276c9b2f28d54f9e658fcf843a2 upstream.

OCFS2 can return ERESTARTSYS from its write function when the process is
signalled while waiting for a cluster lock (and the filesystem is mounted
with intr mount option).  Generally, it seems reasonable to allow
filesystems to return this error code from its IO functions.  As we must
not leak ERESTARTSYS (and similar error codes) to userspace as a result of
an AIO operation, we have to properly convert it to EINTR inside AIO code
(restarting the syscall isn't really an option because other AIO could
have been already submitted by the same io_submit syscall).

Signed-off-by: Jan Kara 
Reviewed-by: Jeff Moyer 
Cc: Christoph Hellwig 
Cc: Zach Brown 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

/proc/vmcore: fix seeking

2010-09-27T00:18:28+00:00

commit c227e69028473c7c7994a9b0a2cc0034f3f7e0fe upstream.

Commit 73296bc611 ("procfs: Use generic_file_llseek in /proc/vmcore")
broke seeking on /proc/vmcore.  This changes it back to use default_llseek
in order to restore the original behaviour.

The problem with generic_file_llseek is that it only allows seeks up to
inode->i_sb->s_maxbytes, which is zero on procfs and some other virtual
file systems.  We should merge generic_file_llseek and default_llseek some
day and clean this up in a proper way, but for 2.6.35/36, reverting vmcore
is the safer solution.

Signed-off-by: Arnd Bergmann 
Cc: Frederic Weisbecker 
Reported-by: CAI Qian 
Tested-by: CAI Qian 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

Prevent freeing uninitialized pointer in compat_do_readv_writev

2010-09-27T00:18:28+00:00

commit 767b68e96993e29e3480d7ecdd9c4b84667c5762 upstream.

In 32-bit compatibility mode, the error handling for
compat_do_readv_writev() may free an uninitialized pointer, potentially
leading to all sorts of ugly memory corruption.  This is reliably
triggerable by unprivileged users by invoking the readv()/writev()
syscalls with an invalid iovec pointer.  The below patch fixes this to
emulate the non-compat version.

Introduced by commit b83733639a49 ("compat: factor out
compat_rw_copy_check_uvector from compat_do_readv_writev")

Signed-off-by: Dan Rosenberg 
Cc: Al Viro 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

char: Mark /dev/zero and /dev/kmem as not capable of writeback

2010-09-27T00:18:24+00:00

commit 371d217ee1ff8b418b8f73fb2a34990f951ec2d4 upstream.

These devices don't do any writeback but their device inodes still can get
dirty so mark bdi appropriately so that bdi code does the right thing and files
inodes to lists of bdi carrying the device inodes.

Signed-off-by: Jan Kara 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

NFS: Fix a typo in nfs_sockaddr_match_ipaddr6

2010-09-20T20:36:46+00:00

commit b20d37ca9561711c6a3c4b859c2855f49565e061 upstream.

Reported-by: Ben Greear 
Signed-off-by: Trond Myklebust 
Signed-off-by: Greg Kroah-Hartman

cifs: fix potential double put of TCP session reference

2010-09-20T20:36:46+00:00

commit 460cf3411b858ad509d5255e0dfaf862a83c0299 upstream.

cifs_get_smb_ses must be called on a server pointer on which it holds an
active reference. It first does a search for an existing SMB session. If
it finds one, it'll put the server reference and then try to ensure that
the negprot is done, etc.

If it encounters an error at that point then it'll return an error.
There's a potential problem here though. When cifs_get_smb_ses returns
an error, the caller will also put the TCP server reference leading to a
double-put.

Fix this by having cifs_get_smb_ses only put the server reference if
it found an existing session that it could use and isn't returning an
error.

Reviewed-by: Suresh Jayaraman 
Signed-off-by: Jeff Layton 
Signed-off-by: Steve French 
Signed-off-by: Greg Kroah-Hartman