22 Sep, 2015

1 commit

  • commit a068acf2ee77693e0bf39d6e07139ba704f461c3 upstream.

    Many file systems that implement the show_options hook fail to correctly
    escape their output which could lead to unescaped characters (e.g. new
    lines) leaking into /proc/mounts and /proc/[pid]/mountinfo files. This
    could lead to confusion, spoofed entries (resulting in things like
    systemd issuing false d-bus "mount" notifications), and who knows what
    else. This looks like it would only be the root user stepping on
    themselves, but it's possible weird things could happen in containers or
    in other situations with delegated mount privileges.

    Here's an example using overlay with setuid fusermount trusting the
    contents of /proc/mounts (via the /etc/mtab symlink). Imagine the use
    of "sudo" is something more sneaky:

    $ BASE="ovl"
    $ MNT="$BASE/mnt"
    $ LOW="$BASE/lower"
    $ UP="$BASE/upper"
    $ WORK="$BASE/work/ 0 0
    none /proc fuse.pwn user_id=1000"
    $ mkdir -p "$LOW" "$UP" "$WORK"
    $ sudo mount -t overlay -o "lowerdir=$LOW,upperdir=$UP,workdir=$WORK" none /mnt
    $ cat /proc/mounts
    none /root/ovl/mnt overlay rw,relatime,lowerdir=ovl/lower,upperdir=ovl/upper,workdir=ovl/work/ 0 0
    none /proc fuse.pwn user_id=1000 0 0
    $ fusermount -u /proc
    $ cat /proc/mounts
    cat: /proc/mounts: No such file or directory

    This fixes the problem by adding new seq_show_option and
    seq_show_option_n helpers, and updating the vulnerable show_option
    handlers to use them as needed. Some, like SELinux, need to be open
    coded due to unusual existing escape mechanisms.

    [akpm@linux-foundation.org: add lost chunk, per Kees]
    [keescook@chromium.org: seq_show_option should be using const parameters]
    Signed-off-by: Kees Cook
    Acked-by: Serge Hallyn
    Acked-by: Jan Kara
    Acked-by: Paul Moore
    Cc: J. R. Okajima
    Signed-off-by: Kees Cook
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds
    Signed-off-by: Greg Kroah-Hartman

    Kees Cook
     

27 Apr, 2015

1 commit

  • Pull fourth vfs update from Al Viro:
    "d_inode() annotations from David Howells (sat in for-next since before
    the beginning of merge window) + four assorted fixes"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
    RCU pathwalk breakage when running into a symlink overmounting something
    fix I_DIO_WAKEUP definition
    direct-io: only inc/dec inode->i_dio_count for file systems
    fs/9p: fix readdir()
    VFS: assorted d_backing_inode() annotations
    VFS: fs/inode.c helpers: d_inode() annotations
    VFS: fs/cachefiles: d_backing_inode() annotations
    VFS: fs library helpers: d_inode() annotations
    VFS: assorted weird filesystems: d_inode() annotations
    VFS: normal filesystems (and lustre): d_inode() annotations
    VFS: security/: d_inode() annotations
    VFS: security/: d_backing_inode() annotations
    VFS: net/: d_inode() annotations
    VFS: net/unix: d_backing_inode() annotations
    VFS: kernel/: d_inode() annotations
    VFS: audit: d_backing_inode() annotations
    VFS: Fix up some ->d_inode accesses in the chelsio driver
    VFS: Cachefiles should perform fs modifications on the top layer only
    VFS: AF_UNIX sockets should call mknod on the top layer only

    Linus Torvalds
     

17 Apr, 2015

2 commits

  • Pull third hunk of vfs changes from Al Viro:
    "This contains the ->direct_IO() changes from Omar + saner
    generic_write_checks() + dealing with fcntl()/{read,write}() races
    (mirroring O_APPEND/O_DIRECT into iocb->ki_flags and instead of
    repeatedly looking at ->f_flags, which can be changed by fcntl(2),
    check ->ki_flags - which cannot) + infrastructure bits for dhowells'
    d_inode annotations + Christophs switch of /dev/loop to
    vfs_iter_write()"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (30 commits)
    block: loop: switch to VFS ITER_BVEC
    configfs: Fix inconsistent use of file_inode() vs file->f_path.dentry->d_inode
    VFS: Make pathwalk use d_is_reg() rather than S_ISREG()
    VFS: Fix up debugfs to use d_is_dir() in place of S_ISDIR()
    VFS: Combine inode checks with d_is_negative() and d_is_positive() in pathwalk
    NFS: Don't use d_inode as a variable name
    VFS: Impose ordering on accesses of d_inode and d_flags
    VFS: Add owner-filesystem positive/negative dentry checks
    nfs: generic_write_checks() shouldn't be done on swapout...
    ocfs2: use __generic_file_write_iter()
    mirror O_APPEND and O_DIRECT into iocb->ki_flags
    switch generic_write_checks() to iocb and iter
    ocfs2: move generic_write_checks() before the alignment checks
    ocfs2_file_write_iter: stop messing with ppos
    udf_file_write_iter: reorder and simplify
    fuse: ->direct_IO() doesn't need generic_write_checks()
    ext4_file_write_iter: move generic_write_checks() up
    xfs_file_aio_write_checks: switch to iocb/iov_iter
    generic_write_checks(): drop isblk argument
    blkdev_write_iter: expand generic_file_checks() call in there
    ...

    Linus Torvalds
     
  • Pull quota and udf updates from Jan Kara:
    "The pull contains quota changes which complete unification of XFS and
    VFS quota interfaces (so tools can use either interface to manipulate
    any filesystem). There's also a patch to support project quotas in
    VFS quota subsystem from Li Xi.

    Finally there's a bunch of UDF fixes and cleanups and tiny cleanup in
    reiserfs & ext3"

    * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: (21 commits)
    udf: Update ctime and mtime when directory is modified
    udf: return correct errno for udf_update_inode()
    ext3: Remove useless condition in if statement.
    vfs: Add general support to enforce project quota limits
    reiserfs: fix __RASSERT format string
    udf: use int for allocated blocks instead of sector_t
    udf: remove redundant buffer_head.h includes
    udf: remove else after return in __load_block_bitmap()
    udf: remove unused variable in udf_table_free_blocks()
    quota: Fix maximum quota limit settings
    quota: reorder flags in quota state
    quota: paranoia: check quota tree root
    quota: optimize i_dquot access
    quota: Hook up Q_XSETQLIM for id 0 to ->set_info
    xfs: Add support for Q_SETINFO
    quota: Make ->set_info use structure with neccesary info to VFS and XFS
    quota: Remove ->get_xstate and ->get_xstatev callbacks
    gfs2: Convert to using ->get_state callback
    xfs: Convert to using ->get_state callback
    quota: Wire up Q_GETXSTATE and Q_GETXSTATV calls to work with ->get_state
    ...

    Linus Torvalds
     

16 Apr, 2015

1 commit


12 Apr, 2015

5 commits


26 Mar, 2015

1 commit


17 Mar, 2015

1 commit

  • __RASSERT format string does not use the PID argument. reiserfs_panic
    arguments are therefore formatted with the wrong format specifier (for
    example __LINE__ with %s). This bug was introduced when commit
    c3a9c2109f84 ("reiserfs: rework reiserfs_panic") removed a
    "reiserfs[%i]" prefix.

    This bug is only triggered when using CONFIG_REISERFS_CHECK, otherwise
    __RASSERT is never used.

    Signed-off-by: Nicolas Iooss
    Acked-by: Jeff Mahoney
    Signed-off-by: Jan Kara

    Nicolas Iooss
     

04 Mar, 2015

1 commit


23 Feb, 2015

1 commit

  • Convert the following where appropriate:

    (1) S_ISLNK(dentry->d_inode) to d_is_symlink(dentry).

    (2) S_ISREG(dentry->d_inode) to d_is_reg(dentry).

    (3) S_ISDIR(dentry->d_inode) to d_is_dir(dentry). This is actually more
    complicated than it appears as some calls should be converted to
    d_can_lookup() instead. The difference is whether the directory in
    question is a real dir with a ->lookup op or whether it's a fake dir with
    a ->d_automount op.

    In some circumstances, we can subsume checks for dentry->d_inode not being
    NULL into this, provided we the code isn't in a filesystem that expects
    d_inode to be NULL if the dirent really *is* negative (ie. if we're going to
    use d_inode() rather than d_backing_inode() to get the inode pointer).

    Note that the dentry type field may be set to something other than
    DCACHE_MISS_TYPE when d_inode is NULL in the case of unionmount, where the VFS
    manages the fall-through from a negative dentry to a lower layer. In such a
    case, the dentry type of the negative union dentry is set to the same as the
    type of the lower dentry.

    However, if you know d_inode is not NULL at the call site, then you can use
    the d_is_xxx() functions even in a filesystem.

    There is one further complication: a 0,0 chardev dentry may be labelled
    DCACHE_WHITEOUT_TYPE rather than DCACHE_SPECIAL_TYPE. Strictly, this was
    intended for special directory entry types that don't have attached inodes.

    The following perl+coccinelle script was used:

    use strict;

    my @callers;
    open($fd, 'git grep -l \'S_IS[A-Z].*->d_inode\' |') ||
    die "Can't grep for S_ISDIR and co. callers";
    @callers = ;
    close($fd);
    unless (@callers) {
    print "No matches\n";
    exit(0);
    }

    my @cocci = (
    '@@',
    'expression E;',
    '@@',
    '',
    '- S_ISLNK(E->d_inode->i_mode)',
    '+ d_is_symlink(E)',
    '',
    '@@',
    'expression E;',
    '@@',
    '',
    '- S_ISDIR(E->d_inode->i_mode)',
    '+ d_is_dir(E)',
    '',
    '@@',
    'expression E;',
    '@@',
    '',
    '- S_ISREG(E->d_inode->i_mode)',
    '+ d_is_reg(E)' );

    my $coccifile = "tmp.sp.cocci";
    open($fd, ">$coccifile") || die $coccifile;
    print($fd "$_\n") || die $coccifile foreach (@cocci);
    close($fd);

    foreach my $file (@callers) {
    chomp $file;
    print "Processing ", $file, "\n";
    system("spatch", "--sp-file", $coccifile, $file, "--in-place", "--no-show-diff") == 0 ||
    die "spatch failed";
    }

    [AV: overlayfs parts skipped]

    Signed-off-by: David Howells
    Signed-off-by: Al Viro

    David Howells
     

18 Feb, 2015

1 commit


17 Dec, 2014

1 commit


13 Dec, 2014

2 commits

  • When resirefs is trying to mount a partition, it creates a commit
    workqueue (sbi->commit_wq). But when mount fails later, the workqueue
    is not freed.

    Signed-off-by: Jiri Slaby
    Reported-by: auxsvr@gmail.com
    Reported-by: Benoît Monin
    Cc: Jan Kara
    Cc: stable@vger.kernel.org # >= 3.16
    Cc: reiserfs-devel@vger.kernel.org
    Fixes: 797d9016ceca69879bb273218810fa0beef46aac
    Signed-off-by: Jan Kara

    Jiri Slaby
     
  • Pull trivial tree update from Jiri Kosina:
    "Usual stuff: documentation updates, printk() fixes, etc"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (24 commits)
    intel_ips: fix a type in error message
    cpufreq: cpufreq-dt: Move newline to end of error message
    ps3rom: fix error return code
    treewide: fix typo in printk and Kconfig
    ARM: dts: bcm63138: change "interupts" to "interrupts"
    Replace mentions of "list_struct" to "list_head"
    kernel: trace: fix printk message
    scsi: mpt2sas: fix ioctl in comment
    zbud, zswap: change module author email
    clocksource: Fix 'clcoksource' typo in comment
    arm: fix wording of "Crotex" in CONFIG_ARCH_EXYNOS3 help
    gpio: msm-v1: make boolean argument more obvious
    usb: Fix typo in usb-serial-simple.c
    PCI: Fix comment typo 'COMFIG_PM_OPS'
    powerpc: Fix comment typo 'CONIFG_8xx'
    powerpc: Fix comment typos 'CONFiG_ALTIVEC'
    clk: st: Spelling s/stucture/structure/
    isci: Spelling s/stucture/structure/
    usb: gadget: zero: Spelling s/infrastucture/infrastructure/
    treewide: Fix company name in module descriptions
    ...

    Linus Torvalds
     

11 Dec, 2014

1 commit

  • Pull VFS changes from Al Viro:
    "First pile out of several (there _definitely_ will be more). Stuff in
    this one:

    - unification of d_splice_alias()/d_materialize_unique()

    - iov_iter rewrite

    - killing a bunch of ->f_path.dentry users (and f_dentry macro).

    Getting that completed will make life much simpler for
    unionmount/overlayfs, since then we'll be able to limit the places
    sensitive to file _dentry_ to reasonably few. Which allows to have
    file_inode(file) pointing to inode in a covered layer, with dentry
    pointing to (negative) dentry in union one.

    Still not complete, but much closer now.

    - crapectomy in lustre (dead code removal, mostly)

    - "let's make seq_printf return nothing" preparations

    - assorted cleanups and fixes

    There _definitely_ will be more piles"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (63 commits)
    copy_from_iter_nocache()
    new helper: iov_iter_kvec()
    csum_and_copy_..._iter()
    iov_iter.c: handle ITER_KVEC directly
    iov_iter.c: convert copy_to_iter() to iterate_and_advance
    iov_iter.c: convert copy_from_iter() to iterate_and_advance
    iov_iter.c: get rid of bvec_copy_page_{to,from}_iter()
    iov_iter.c: convert iov_iter_zero() to iterate_and_advance
    iov_iter.c: convert iov_iter_get_pages_alloc() to iterate_all_kinds
    iov_iter.c: convert iov_iter_get_pages() to iterate_all_kinds
    iov_iter.c: convert iov_iter_npages() to iterate_all_kinds
    iov_iter.c: iterate_and_advance
    iov_iter.c: macros for iterating over iov_iter
    kill f_dentry macro
    dcache: fix kmemcheck warning in switch_names
    new helper: audit_file()
    nfsd_vfs_write(): use file_inode()
    ncpfs: use file_inode()
    kill f_dentry uses
    lockd: get rid of ->f_path.dentry->d_sb
    ...

    Linus Torvalds
     

20 Nov, 2014

2 commits


10 Nov, 2014

1 commit


01 Nov, 2014

1 commit


14 Oct, 2014

1 commit


13 Oct, 2014

2 commits

  • Pull vfs updates from Al Viro:
    "The big thing in this pile is Eric's unmount-on-rmdir series; we
    finally have everything we need for that. The final piece of prereqs
    is delayed mntput() - now filesystem shutdown always happens on
    shallow stack.

    Other than that, we have several new primitives for iov_iter (Matt
    Wilcox, culled from his XIP-related series) pushing the conversion to
    ->read_iter()/ ->write_iter() a bit more, a bunch of fs/dcache.c
    cleanups and fixes (including the external name refcounting, which
    gives consistent behaviour of d_move() wrt procfs symlinks for long
    and short names alike) and assorted cleanups and fixes all over the
    place.

    This is just the first pile; there's a lot of stuff from various
    people that ought to go in this window. Starting with
    unionmount/overlayfs mess... ;-/"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (60 commits)
    fs/file_table.c: Update alloc_file() comment
    vfs: Deduplicate code shared by xattr system calls operating on paths
    reiserfs: remove pointless forward declaration of struct nameidata
    don't need that forward declaration of struct nameidata in dcache.h anymore
    take dname_external() into fs/dcache.c
    let path_init() failures treated the same way as subsequent link_path_walk()
    fix misuses of f_count() in ppp and netlink
    ncpfs: use list_for_each_entry() for d_subdirs walk
    vfs: move getname() from callers to do_mount()
    gfs2_atomic_open(): skip lookups on hashed dentry
    [infiniband] remove pointless assignments
    gadgetfs: saner API for gadgetfs_create_file()
    f_fs: saner API for ffs_sb_create_file()
    jfs: don't hash direct inode
    [s390] remove pointless assignment of ->f_op in vmlogrdr ->open()
    ecryptfs: ->f_op is never NULL
    android: ->f_op is never NULL
    nouveau: __iomem misannotations
    missing annotation in fs/file.c
    fs: namespace: suppress 'may be used uninitialized' warnings
    ...

    Linus Torvalds
     
  • Signed-off-by: Al Viro

    Al Viro
     

17 Sep, 2014

1 commit

  • MAXQUOTAS value defines maximum number of quota types VFS supports.
    This isn't necessarily the number of types reiserfs supports and with
    addition of project quotas these two numbers stop matching. So make
    reiserfs use its private definition.

    CC: reiserfs-devel@vger.kernel.org
    CC: Jeff Mahoney
    Signed-off-by: Jan Kara

    Jan Kara
     

14 Aug, 2014

1 commit

  • Pull quota, reiserfs, UDF updates from Jan Kara:
    "Scalability improvements for quota, a few reiserfs fixes, and couple
    of misc cleanups (udf, ext2)"

    * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
    reiserfs: Fix use after free in journal teardown
    reiserfs: fix corruption introduced by balance_leaf refactor
    udf: avoid redundant memcpy when writing data in ICB
    fs/udf: re-use hex_asc_upper_{hi,lo} macros
    fs/quota: kernel-doc warning fixes
    udf: use linux/uaccess.h
    fs/ext2/super.c: Drop memory allocation cast
    quota: remove dqptr_sem
    quota: simplify remove_inode_dquot_ref()
    quota: avoid unnecessary dqget()/dqput() calls
    quota: protect Q_GETFMT by dqonoff_mutex

    Linus Torvalds
     

12 Aug, 2014

1 commit

  • If do_journal_release() races with do_journal_end() which requeues
    delayed works for transaction flushing, we can leave work items for
    flushing outstanding transactions queued while freeing them. That
    results in use after free and possible crash in run_timers_softirq().

    Fix the problem by not requeueing works if superblock is being shut down
    (MS_ACTIVE not set) and using cancel_delayed_work_sync() in
    do_journal_release().

    CC: stable@vger.kernel.org
    Signed-off-by: Jan Kara

    Jan Kara
     

09 Aug, 2014

3 commits


06 Aug, 2014

1 commit

  • Commits f1f007c308e (reiserfs: balance_leaf refactor, pull out
    balance_leaf_insert_left) and cf22df182bf (reiserfs: balance_leaf
    refactor, pull out balance_leaf_paste_left) missed that the `body'
    pointer was getting repositioned. Subsequent users of the pointer
    would expect it to be repositioned, and as a result, parts of the
    tree would get overwritten. The most common observed corruption
    is indirect block pointers being overwritten.

    Since the body value isn't actually used anymore in the called routines,
    we can pass back the offset it should be shifted. We constify the body
    and ih pointers in the balance_leaf as a mostly-free preventative measure.

    Cc: # 3.16
    Reported-and-tested-by: Jeff Chua
    Signed-off-by: Jeff Mahoney
    Signed-off-by: Jan Kara

    Jeff Mahoney
     

13 Jun, 2014

1 commit

  • Pull vfs updates from Al Viro:
    "This the bunch that sat in -next + lock_parent() fix. This is the
    minimal set; there's more pending stuff.

    In particular, I really hope to get acct.c fixes merged this cycle -
    we need that to deal sanely with delayed-mntput stuff. In the next
    pile, hopefully - that series is fairly short and localized
    (kernel/acct.c, fs/super.c and fs/namespace.c). In this pile: more
    iov_iter work. Most of prereqs for ->splice_write with sane locking
    order are there and Kent's dio rewrite would also fit nicely on top of
    this pile"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (70 commits)
    lock_parent: don't step on stale ->d_parent of all-but-freed one
    kill generic_file_splice_write()
    ceph: switch to iter_file_splice_write()
    shmem: switch to iter_file_splice_write()
    nfs: switch to iter_splice_write_file()
    fs/splice.c: remove unneeded exports
    ocfs2: switch to iter_file_splice_write()
    ->splice_write() via ->write_iter()
    bio_vec-backed iov_iter
    optimize copy_page_{to,from}_iter()
    bury generic_file_aio_{read,write}
    lustre: get rid of messing with iovecs
    ceph: switch to ->write_iter()
    ceph_sync_direct_write: stop poking into iov_iter guts
    ceph_sync_read: stop poking into iov_iter guts
    new helper: copy_page_from_iter()
    fuse: switch to ->write_iter()
    btrfs: switch to ->write_iter()
    ocfs2: switch to ->write_iter()
    xfs: switch to ->write_iter()
    ...

    Linus Torvalds
     

12 Jun, 2014

2 commits

  • iter_file_splice_write() - a ->splice_write() instance that gathers the
    pipe buffers, builds a bio_vec-based iov_iter covering those and feeds
    it to ->write_iter(). A bunch of simple cases coverted to that...

    [AV: fixed the braino spotted by Cyrill]

    Signed-off-by: Al Viro

    Al Viro
     
  • Pull reiserfs and ext3 changes from Jan Kara:
    "Big reiserfs cleanup from Jeff, an ext3 deadlock fix, and some small
    cleanups"

    * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: (34 commits)
    reiserfs: Fix compilation breakage with CONFIG_REISERFS_CHECK
    ext3: Fix deadlock in data=journal mode when fs is frozen
    reiserfs: call truncate_setsize under tailpack mutex
    fs/jbd/revoke.c: replace shift loop by ilog2
    reiserfs: remove obsolete __constant_cpu_to_le32
    reiserfs: balance_leaf refactor, split up balance_leaf_when_delete
    reiserfs: balance_leaf refactor, format balance_leaf_finish_node
    reiserfs: balance_leaf refactor, format balance_leaf_new_nodes_paste
    reiserfs: balance_leaf refactor, format balance_leaf_paste_right
    reiserfs: balance_leaf refactor, format balance_leaf_insert_right
    reiserfs: balance_leaf refactor, format balance_leaf_paste_left
    reiserfs: balance_leaf refactor, format balance_leaf_insert_left
    reiserfs: balance_leaf refactor, pull out balance_leaf{left, right, new_nodes, finish_node}
    reiserfs: balance_leaf refactor, pull out balance_leaf_finish_node_paste
    reiserfs: balance_leaf refactor pull out balance_leaf_finish_node_insert
    reiserfs: balance_leaf refactor, pull out balance_leaf_new_nodes_paste
    reiserfs: balance_leaf refactor, pull out balance_leaf_new_nodes_insert
    reiserfs: balance_leaf refactor, pull out balance_leaf_paste_right
    reiserfs: balance_leaf refactor, pull out balance_leaf_insert_right
    reiserfs: balance_leaf refactor, pull out balance_leaf_paste_left
    ...

    Linus Torvalds
     

11 Jun, 2014

1 commit


07 Jun, 2014

2 commits


22 May, 2014

1 commit

  • Prior to commit 0e4f6a791b1e (Fix reiserfs_file_release()), reiserfs
    truncates serialized on i_mutex. They mostly still do, with the exception
    of reiserfs_file_release. That blocks out other writers via the tailpack
    mutex and the inode openers counter adjusted in reiserfs_file_open.

    However, NFS will call reiserfs_setattr without having called ->open, so
    we end up with a race when nfs is calling ->setattr while another
    process is releasing the file. Ultimately, it triggers the
    BUG_ON(inode->i_size != new_file_size) check in maybe_indirect_to_direct.

    The solution is to pull the lock into reiserfs_setattr to encompass the
    truncate_setsize call as well.

    Signed-off-by: Jeff Mahoney
    Cc:
    Signed-off-by: Jan Kara

    Jeff Mahoney