07 Apr, 2015

1 commit

  • …etooth/bluetooth-next

    Johan Hedberg says:

    ====================
    pull request: bluetooth-next 2015-04-04

    Here's what's probably the last bluetooth-next pull request for 4.1:

    - Fixes for LE advertising data & advertising parameters
    - Fix for race condition with HCI_RESET flag
    - New BNEPGETSUPPFEAT ioctl, needed for certification
    - New HCI request callback type to get the resulting skb
    - Cleanups to use BIT() macro wherever possible
    - Consolidate Broadcom device entries in the btusb HCI driver
    - Check for valid flags in CMTP, HIDP & BNEP
    - Disallow local privacy & OOB data combo to prevent a potential race
    - Expose SMP & ECDH selftest results through debugfs
    - Expose current Device ID info through debugfs

    Please let me know if there are any issues pulling. Thanks.
    ====================

    Signed-off-by: David S. Miller <davem@davemloft.net>

    David S. Miller
     

04 Apr, 2015

2 commits

  • This is needed if user space wants to know supported bnep features
    by kernel, e.g. if kernel supports sending response to bnep setup
    control message. By now there is no possibility to know supported
    features by kernel in case of bnep. Ioctls allows only to add connection,
    delete connection, get connection list, get connection info. Adding
    connection if it's possible (establishing network device connection) is
    equivalent to starting bnep session. Bnep session handles data queue of
    transmit, receive messages over bnep channel. It means that if we add
    connection the received/transmitted data will be parsed immediately. In
    case of get bnep features we want to know before session start, if we
    should leave setup data on socket queue and let kernel to handle with it,
    or in case of no setup handling support, if we should pull this message
    and handle setup response within user space.

    Signed-off-by: Grzegorz Kolodziejczyk
    Signed-off-by: Marcel Holtmann

    Grzegorz Kolodziejczyk
     
  • Pull CIFS fixes from Steve French:
    "A set of small cifs fixes fixing a memory leak, kernel oops, and
    infinite loop (and some spotted by Coverity)"

    * 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
    Fix warning
    Fix another dereference before null check warning
    CIFS: session servername can't be null
    Fix warning on impossible comparison
    Fix coverity warning
    Fix dereference before null check warning
    Don't ignore errors on encrypting password in SMBTcon
    Fix warning on uninitialized buftype
    cifs: potential memory leaks when parsing mnt opts
    cifs: fix use-after-free bug in find_writable_file
    cifs: smb2_clone_range() - exit on unhandled error

    Linus Torvalds
     

02 Apr, 2015

2 commits

  • Pull lazytime fixes from Ted Ts'o:
    "This fixes a problem in the lazy time patches, which can cause
    frequently updated inods to never have their timestamps updated.

    These changes guarantee that no timestamp on disk will be stale by
    more than 24 hours"

    * tag 'lazytime_fix' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
    fs: add dirtytime_expire_seconds sysctl
    fs: make sure the timestamps for lazytime inodes eventually get written

    Linus Torvalds
     
  • Pull nfsd fixes from Bruce Fields:
    "Two main issues:

    - We found that turning on pNFS by default (when it's configured at
    build time) was too aggressive, so we want to switch the default
    before the 4.0 release.

    - Recent client changes to increase open parallelism uncovered a
    serious bug lurking in the server's open code.

    Also fix a krb5/selinux regression.

    The rest is mainly smaller pNFS fixes"

    * 'for-4.0' of git://linux-nfs.org/~bfields/linux:
    sunrpc: make debugfs file creation failure non-fatal
    nfsd: require an explicit option to enable pNFS
    NFSD: Fix bad update of layout in nfsd4_return_file_layout
    NFSD: Take care the return value from nfsd4_encode_stateid
    NFSD: Printk blocklayout length and offset as format 0x%llx
    nfsd: return correct lockowner when there is a race on hash insert
    nfsd: return correct openowner when there is a race to put one in the hash
    NFSD: Put exports after nfsd4_layout_verify fail
    NFSD: Error out when register_shrinker() fail
    NFSD: Take care the return value from nfsd4_decode_stateid
    NFSD: Check layout type when returning client layouts
    NFSD: restore trace event lost in mismerge

    Linus Torvalds
     

01 Apr, 2015

8 commits

  • Coverity reports a warning due to unitialized attr structure in one
    code path.

    Reported by Coverity (CID 728535)

    Signed-off-by: Steve French
    Reviewed-by: Jeff Layton

    Steve French
     
  • null tcon is not possible in these paths so
    remove confusing null check

    Reported by Coverity (CID 728519)

    Signed-off-by: Steve French
    Reviewed-by: Jeff Layton

    Steve French
     
  • remove impossible check

    Pointed out by Coverity (CID 115422)

    Signed-off-by: Steve French
    Reviewed-by: Jeff Layton

    Steve French
     
  • workstation_RFC1001_name is part of the struct and can't be null,
    remove impossible comparison (array vs. null)

    Pointed out by Coverity (CID 140095)

    Signed-off-by: Steve French
    Reviewed-by: Jeff Layton

    Steve French
     
  • Coverity reports a warning for referencing the beginning of the
    SMB2/SMB3 frame using the ProtocolId field as an array. Although
    it works the same either way, this patch should quiet the warning
    and might be a little clearer.

    Reported by Coverity (CID 741269)

    Signed-off-by: Steve French
    Acked-by: Shirish Pargaonkar
    Acked-by: Sachin Prabhu
    Reviewed-by: Jeff Layton

    Steve French
     
  • null tcon is not likely in these paths in current
    code, but obviously it does clarify the code to
    check for null (if at all) before derefrencing
    rather than after.

    Reported by Coverity (CID 1042666)

    Signed-off-by: Steve French
    Acked-by: Shirish Pargaonkar
    Acked-by: Sachin Prabhu

    Steve French
     
  • Although unlikely to fail (and tree connect does not commonly send
    a password since SECMODE_USER is the default for most servers)
    do not ignore errors on SMBNTEncrypt in SMB Tree Connect.

    Reported by Coverity (CID 1226853)

    Signed-off-by: Steve French
    Acked-by: Shirish Pargaonkar
    Acked-by: Sachin Prabhu
    Reviewed-by: Jeff Layton

    Steve French
     
  • Pointed out by coverity analyzer. resp_buftype is
    not initialized in one path which can rarely log
    a spurious warning (buf is null so there will
    not be a problem with freeing data, but if buf_type
    were randomly set to wrong value could log a warning)

    Reported by Coverity (CID 1269144)

    Signed-off-by: Steve French
    Acked-by: Shirish Pargaonkar
    Acked-by: Sachin Prabhu
    Reviewed-by: Jeff Layton

    Steve French
     

31 Mar, 2015

1 commit


27 Mar, 2015

1 commit


26 Mar, 2015

7 commits

  • With return layout as, (seg is return layout, lo is record layout)
    seg->offset offset and layout_end(seg) < layout_end(lo),
    nfsd should update lo's offset to seg's end,
    and,
    seg->offset > lo->offset and layout_end(seg) >= layout_end(lo),
    nfsd should update lo's end to seg's offset.

    Fixes: 9cf514ccfa ("nfsd: implement pNFS operations")
    Signed-off-by: Kinglong Mee
    Reviewed-by: Christoph Hellwig
    Signed-off-by: J. Bruce Fields

    Kinglong Mee
     
  • Signed-off-by: Kinglong Mee
    Reviewed-by: Christoph Hellwig
    Signed-off-by: J. Bruce Fields

    Kinglong Mee
     
  • When testing pnfs with nfsd_debug on, nfsd print a negative number
    of layout length and foff in nfsd4_block_proc_layoutget as,
    "GET: -xxxx:-xxx 2"

    Signed-off-by: Kinglong Mee
    Reviewed-by: Christoph Hellwig
    Signed-off-by: J. Bruce Fields

    Kinglong Mee
     
  • alloc_init_lock_stateowner can return an already freed entry if there is
    a race to put openowners in the hashtable.

    Noticed by inspection after Jeff Layton fixed the same bug for open
    owners. Depending on client behavior, this one may be trickier to
    trigger in practice.

    Fixes: c58c6610ec24 "nfsd: Protect adding/removing lock owners using client_lock"
    Cc:
    Cc: Trond Myklebust
    Acked-by: Jeff Layton
    Signed-off-by: J. Bruce Fields

    J. Bruce Fields
     
  • alloc_init_open_stateowner can return an already freed entry if there is
    a race to put openowners in the hashtable.

    In commit 7ffb588086e9, we changed it so that we allocate and initialize
    an openowner, and then check to see if a matching one got stuffed into
    the hashtable in the meantime. If it did, then we free the one we just
    allocated and take a reference on the one already there. There is a bug
    here though. The code will then return the pointer to the one that was
    allocated (and has now been freed).

    This wasn't evident before as this race almost never occurred. The Linux
    kernel client used to serialize requests for a single openowner. That
    has changed now with v4.0 kernels, and this race can now easily occur.

    Fixes: 7ffb588086e9
    Cc: # v3.17+
    Cc: Trond Myklebust
    Reported-by: Christoph Hellwig
    Reviewed-by: Christoph Hellwig
    Signed-off-by: Jeff Layton
    Signed-off-by: J. Bruce Fields

    Jeff Layton
     
  • Fix B-tree corruption when a new record is inserted at position 0 in the
    node in hfs_brec_insert(). In this case a hfs_brec_update_parent() is
    called to update the parent index node (if exists) and it is passed
    hfs_find_data with a search_key containing a newly inserted key instead
    of the key to be updated. This results in an inconsistent index node.
    The bug reproduces on my machine after an extents overflow record for
    the catalog file (CNID=4) is inserted into the extents overflow B-tree.
    Because of a low (reserved) value of CNID=4, it has to become the first
    record in the first leaf node.

    The resulting first leaf node is correct:

    ----------------------------------------------------
    | key0.CNID=4 | key1.CNID=123 | key2.CNID=456, ... |
    ----------------------------------------------------

    But the parent index key0 still contains the previous key CNID=123:

    -----------------------
    | key0.CNID=123 | ... |
    -----------------------

    A change in hfs_brec_insert() makes hfs_brec_update_parent() work
    correctly by preventing it from getting fd->record=-1 value from
    __hfs_brec_find().

    Along the way, I removed duplicate code with unification of the if
    condition. The resulting code is equivalent to the original code
    because node is never 0.

    Also hfs_brec_update_parent() will now return an error after getting a
    negative fd->record value. However, the return value of
    hfs_brec_update_parent() is not checked anywhere in the file and I'm
    leaving it unchanged by this patch. brec.c lacks error checking after
    some other calls too, but this issue is of less importance than the one
    being fixed by this patch.

    Signed-off-by: Sergei Antonov
    Cc: Joe Perches
    Reviewed-by: Vyacheslav Dubeyko
    Acked-by: Hin-Tak Leung
    Cc: Anton Altaparmakov
    Cc: Al Viro
    Cc: Christoph Hellwig
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Sergei Antonov
     
  • When affs_bread_ino() fails, correctly unlock the page and release the
    page cache with proper error value. All write_end() should
    unlock/release the page that was locked by write_beg().

    Signed-off-by: Taesoo Kim
    Cc: Fabian Frederick
    Cc: Al Viro
    Cc: Geert Uytterhoeven
    Cc: Jan Kara
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Taesoo Kim
     

23 Mar, 2015

1 commit


22 Mar, 2015

3 commits

  • Pull btrfs fixes from Chris Mason:
    "Most of these are fixing extent reservation accounting, or corners
    with tree writeback during commit.

    Josef's set does add a test, which isn't strictly a fix, but it'll
    keep us from making this same mistake again"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
    Btrfs: fix outstanding_extents accounting in DIO
    Btrfs: add sanity test for outstanding_extents accounting
    Btrfs: just free dummy extent buffers
    Btrfs: account merges/splits properly
    Btrfs: prepare block group cache before writing
    Btrfs: fix ASSERT(list_empty(&cur_trans->dirty_bgs_list)
    Btrfs: account for the correct number of extents for delalloc reservations
    Btrfs: fix merge delalloc logic
    Btrfs: fix comp_oper to get right order
    Btrfs: catch transaction abortion after waiting for it
    btrfs: fix sizeof format specifier in btrfs_check_super_valid()

    Linus Torvalds
     
  • Pull nfsd bufix from Bruce Fields:
    "This is a fix for a crash easily triggered by 4.1 activity to a server
    built with CONFIG_NFSD_PNFS.

    There are some more bugfixes queued up that I intend to pass along
    next week, but this is the most critical"

    * 'for-4.0' of git://linux-nfs.org/~bfields/linux:
    Subject: nfsd: don't recursively call nfsd4_cb_layout_fail

    Linus Torvalds
     
  • For example, when mount opt is redundently specified
    (e.g., "user=A,user=B,user=C"), kernel kept allocating new key/val
    with kstrdup() and overwrite previous ptr (to be freed).

    Althouhg mount.cifs in userspace performs a bit of sanitization
    (e.g., forcing one user option), current implementation is not
    robust. Other options such as iocharset and domainanme are similarly
    vulnerable.

    Signed-off-by: Taesoo Kim
    Signed-off-by: Steve French

    Taesoo Kim
     

21 Mar, 2015

7 commits

  • Under intermittent network outages, find_writable_file() is susceptible
    to the following race condition, which results in a user-after-free in
    the cifs_writepages code-path:

    Thread 1 Thread 2
    ======== ========

    inv_file = NULL
    refind = 0
    spin_lock(&cifs_file_list_lock)

    // invalidHandle found on openFileList

    inv_file = open_file
    // inv_file->count currently 1

    cifsFileInfo_get(inv_file)
    // inv_file->count = 2

    spin_unlock(&cifs_file_list_lock);

    cifs_reopen_file() cifs_close()
    // fails (rc != 0) ->cifsFileInfo_put()
    spin_lock(&cifs_file_list_lock)
    // inv_file->count = 1
    spin_unlock(&cifs_file_list_lock)

    spin_lock(&cifs_file_list_lock);
    list_move_tail(&inv_file->flist,
    &cifs_inode->openFileList);
    spin_unlock(&cifs_file_list_lock);

    cifsFileInfo_put(inv_file);
    ->spin_lock(&cifs_file_list_lock)

    // inv_file->count = 0
    list_del(&cifs_file->flist);
    // cleanup!!
    kfree(cifs_file);

    spin_unlock(&cifs_file_list_lock);

    spin_lock(&cifs_file_list_lock);
    ++refind;
    // refind = 1
    goto refind_writable;

    At this point we loop back through with an invalid inv_file pointer
    and a refind value of 1. On second pass, inv_file is not overwritten on
    openFileList traversal, and is subsequently dereferenced.

    Signed-off-by: David Disseldorp
    Reviewed-by: Jeff Layton
    CC:
    Signed-off-by: Steve French

    David Disseldorp
     
  • While attempting to clone a file on a samba server, we receive a
    STATUS_INVALID_DEVICE_REQUEST. This is mapped to -EOPNOTSUPP which
    isn't handled in smb2_clone_range(). We end up looping in the while loop
    making same call to the samba server over and over again.

    The proposed fix is to exit and return the error value when encountered
    with an unhandled error.

    Cc:
    Signed-off-by: Sachin Prabhu
    Signed-off-by: Steve French
    Signed-off-by: Steve French

    Sachin Prabhu
     
  • Fix commit 9cf514ccfa (nfsd: implement pNFS operations).

    Signed-off-by: Kinglong Mee
    Reviewed-by: Christoph Hellwig
    Signed-off-by: J. Bruce Fields

    Kinglong Mee
     
  • If register_shrinker() failed, nfsd will cause a NULL pointer access as,

    [ 9250.875465] nfsd: last server has exited, flushing export cache
    [ 9251.427270] BUG: unable to handle kernel NULL pointer dereference at (null)
    [ 9251.427393] IP: [] __list_del_entry+0x29/0xd0
    [ 9251.427579] PGD 13e4d067 PUD 13e4c067 PMD 0
    [ 9251.427633] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
    [ 9251.427706] Modules linked in: ip6t_rpfilter ip6t_REJECT bnep bluetooth xt_conntrack cfg80211 rfkill ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw btrfs xfs microcode ppdev serio_raw pcspkr xor libcrc32c raid6_pq e1000 parport_pc parport i2c_piix4 i2c_core nfsd(OE-) auth_rpcgss nfs_acl lockd sunrpc(E) ata_generic pata_acpi
    [ 9251.428240] CPU: 0 PID: 1557 Comm: rmmod Tainted: G OE 3.16.0-rc2+ #22
    [ 9251.428366] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/31/2013
    [ 9251.428496] task: ffff880000849540 ti: ffff8800136f4000 task.ti: ffff8800136f4000
    [ 9251.428593] RIP: 0010:[] [] __list_del_entry+0x29/0xd0
    [ 9251.428696] RSP: 0018:ffff8800136f7ea0 EFLAGS: 00010207
    [ 9251.428751] RAX: 0000000000000000 RBX: ffffffffa0116d48 RCX: dead000000200200
    [ 9251.428814] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffa0116d48
    [ 9251.428876] RBP: ffff8800136f7ea0 R08: ffff8800136f4000 R09: 0000000000000001
    [ 9251.428939] R10: 8080808080808080 R11: 0000000000000000 R12: ffffffffa011a5a0
    [ 9251.429002] R13: 0000000000000800 R14: 0000000000000000 R15: 00000000018ac090
    [ 9251.429064] FS: 00007fb9acef0740(0000) GS:ffff88003fa00000(0000) knlGS:0000000000000000
    [ 9251.429164] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [ 9251.429221] CR2: 0000000000000000 CR3: 0000000031a17000 CR4: 00000000001407f0
    [ 9251.429306] Stack:
    [ 9251.429410] ffff8800136f7eb8 ffffffff8136fcdd ffffffffa0116d20 ffff8800136f7ed0
    [ 9251.429511] ffffffff8118a0f2 0000000000000000 ffff8800136f7ee0 ffffffffa00eb765
    [ 9251.429610] ffff8800136f7ef0 ffffffffa010e93c ffff8800136f7f78 ffffffff81104ac2
    [ 9251.429709] Call Trace:
    [ 9251.429755] [] list_del+0xd/0x30
    [ 9251.429896] [] unregister_shrinker+0x22/0x40
    [ 9251.430037] [] nfsd_reply_cache_shutdown+0x15/0x90 [nfsd]
    [ 9251.430106] [] exit_nfsd+0x9/0x6cd [nfsd]
    [ 9251.430192] [] SyS_delete_module+0x162/0x200
    [ 9251.430280] [] ? do_notify_resume+0x59/0x90
    [ 9251.430395] [] system_call_fastpath+0x16/0x1b
    [ 9251.430457] Code: 00 00 55 48 8b 17 48 b9 00 01 10 00 00 00 ad de 48 8b 47 08 48 89 e5 48 39 ca 74 29 48 b9 00 02 20 00 00 00 ad de 48 39 c8 74 7a 8b 00 4c 39 c7 75 53 4c 8b 42 08 4c 39 c7 75 2b 48 89 42 08
    [ 9251.430691] RIP [] __list_del_entry+0x29/0xd0
    [ 9251.430755] RSP
    [ 9251.430805] CR2: 0000000000000000
    [ 9251.431033] ---[ end trace 080f3050d082b4ea ]---

    Signed-off-by: Kinglong Mee
    Reviewed-by: Christoph Hellwig
    Signed-off-by: J. Bruce Fields

    Kinglong Mee
     
  • Return status after nfsd4_decode_stateid failed.

    Signed-off-by: Kinglong Mee
    Reviewed-by: Christoph Hellwig
    Signed-off-by: J. Bruce Fields

    Kinglong Mee
     
  • According to RFC5661:
    " When lr_returntype is LAYOUTRETURN4_FSID, the current filehandle is used
    to identify the file system and all layouts matching the client ID,
    the fsid of the file system, lora_layout_type, and lora_iomode are
    returned. When lr_returntype is LAYOUTRETURN4_ALL, all layouts
    matching the client ID, lora_layout_type, and lora_iomode are
    returned and the current filehandle is not used. "

    When returning client layouts, always check layout type.

    Signed-off-by: Kinglong Mee
    Reviewed-by: Christoph Hellwig
    Signed-off-by: J. Bruce Fields

    Kinglong Mee
     
  • 31ef83dc05 "nfsd: add trace events" had a typo that dropped a trace
    event and replaced it by an incorrect recursive call to
    nfsd4_cb_layout_fail. 133d558216d9 "Subject: nfsd: don't recursively
    call nfsd4_cb_layout_fail" fixed the crash, this restores the
    tracepoint.

    Reviewed-by: Christoph Hellwig
    Signed-off-by: Kinglong Mee
    Signed-off-by: J. Bruce Fields

    Kinglong Mee
     

20 Mar, 2015

3 commits

  • Pull fuse fixes from Miklos Szeredi:
    "This fixes bugs in zero-copy splice to the fuse device"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
    fuse: explicitly set /dev/fuse file's private_data
    fuse: set stolen page uptodate
    fuse: notify: don't move pages

    Linus Torvalds
     
  • Pull overlayfs fixes from Miklos Szeredi:
    "This fixes minor issues with the multi-layer update in v4.0"

    * 'overlayfs-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs:
    ovl: upper fs should not be R/O
    ovl: check lowerdir amount for non-upper mount
    ovl: print error message for invalid mount options

    Linus Torvalds
     
  • Due to a merge error when creating c5c707f9 ("nfsd: implement pNFS
    layout recalls"), we recursively call nfsd4_cb_layout_fail from itself,
    leading to stack overflows.

    Signed-off-by: Christoph Hellwig
    Fixes: c5c707f9 ("nfsd: implement pNFS layout recalls")
    Signed-off-by: J. Bruce Fields
    ---
    fs/nfsd/nfs4layouts.c | 2 --
    1 file changed, 2 deletions(-)

    diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
    index 3c1bfa1..1028a06 100644
    --- a/fs/nfsd/nfs4layouts.c
    +++ b/fs/nfsd/nfs4layouts.c
    @@ -587,8 +587,6 @@ nfsd4_cb_layout_fail(struct nfs4_layout_stateid *ls)

    rpc_ntop((struct sockaddr *)&clp->cl_addr, addr_str, sizeof(addr_str));

    - nfsd4_cb_layout_fail(ls);
    -
    printk(KERN_WARNING
    "nfsd: client %s failed to respond to layout recall. "
    " Fencing..\n", addr_str);
    --
    1.9.1

    Christoph Hellwig
     

19 Mar, 2015

1 commit

  • The misc subsystem (which is used for /dev/fuse) initializes private_data to
    point to the misc device when a driver has registered a custom open file
    operation, and initializes it to NULL when a custom open file operation has
    *not* been provided.

    This subtle quirk is confusing, to the point where kernel code registers
    *empty* file open operations to have private_data point to the misc device
    structure. And it leads to bugs, where the addition or removal of a custom open
    file operation surprisingly changes the initial contents of a file's
    private_data structure.

    So to simplify things in the misc subsystem, a patch [1] has been proposed to
    *always* set the private_data to point to the misc device, instead of only
    doing this when a custom open file operation has been registered.

    But before this patch can be applied we need to modify drivers that make the
    assumption that a misc device file's private_data is initialized to NULL
    because they didn't register a custom open file operation, so they don't rely
    on this assumption anymore. FUSE uses private_data to store the fuse_conn and
    errors out if this is not initialized to NULL at mount time.

    Hence, we now set a file's private_data to NULL explicitly, to be independent
    of whatever value the misc subsystem initializes it to by default.

    [1] https://lkml.org/lkml/2014/12/4/939

    Reported-by: Giedrius Statkevicius
    Reported-by: Thierry Reding
    Signed-off-by: Tom Van Braeckel
    Signed-off-by: Miklos Szeredi

    Tom Van Braeckel
     

18 Mar, 2015

3 commits

  • After importing multi-lower layer support, users could mount a r/o
    partition as the left most lowerdir instead of using it as upperdir.
    And a r/o upperdir may cause an error like

    overlayfs: failed to create directory ./workdir/work

    during mount.

    This patch check the *s_flags* of upper fs and return an error if
    it is a r/o partition. The checking of *upper_mnt->mnt_sb->s_flags*
    can be removed now.

    This patch also remove

    /* FIXME: workdir is not needed for a R/O mount */

    from ovl_fill_super() because:

    1) for upper fs r/o case
    Setting a r/o partition as upper is prevented, no need to care about
    workdir in this case.

    2) for "mount overlay -o ro" with a r/w upper fs case
    Users could remount overlayfs to r/w in this case, so workdir should
    not be omitted.

    Signed-off-by: hujianyang
    Signed-off-by: Miklos Szeredi

    hujianyang
     
  • Recently multi-lower layer mount support allow upperdir and workdir
    to be omitted, then cause overlayfs can be mount with only one
    lowerdir directory. This action make no sense and have potential risk.

    This patch check the total number of lower directories to prevent
    mounting overlayfs with only one directory.

    Also, an error message is added to indicate lower directories exceed
    OVL_MAX_STACK limit.

    Signed-off-by: hujianyang
    Signed-off-by: Miklos Szeredi

    hujianyang
     
  • Overlayfs should print an error message if an incorrect mount option
    is caught like other filesystems.

    After this patch, improper option input could be clearly known.

    Reported-by: Fabian Sturm
    Signed-off-by: hujianyang
    Signed-off-by: Miklos Szeredi

    hujianyang