30 Sep, 2015

1 commit

  • commit 5556e7e6d30e8e9b5ee51b0e5edd526ee80e5e36 upstream.

    Consider eCryptfs dcache entries to be stale when the corresponding
    lower inode's i_nlink count is zero. This solves a problem caused by the
    lower inode being directly modified, without going through the eCryptfs
    mount, leaving stale eCryptfs dentries cached and the eCryptfs inode's
    i_nlink count not being cleared.

    Signed-off-by: Tyler Hicks
    Reported-by: Richard Weinberger
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman

    Tyler Hicks
     

16 Apr, 2015

1 commit


12 Apr, 2015

2 commits


26 Mar, 2015

1 commit


14 Mar, 2015

1 commit

  • The AIO interface is fairly complex because it tries to allow
    filesystems to always work async and then wakeup a synchronous
    caller through aio_complete. It turns out that basically no one
    was doing this to avoid the complexity and context switches,
    and we've already fixed up the remaining users and can now
    get rid of this case.

    Signed-off-by: Christoph Hellwig
    Signed-off-by: Al Viro

    Christoph Hellwig
     

03 Mar, 2015

1 commit

  • eCryptfs can't be aware of what to expect when after passing an
    arbitrary ioctl command through to the lower filesystem. The ioctl
    command may trigger an action in the lower filesystem that is
    incompatible with eCryptfs.

    One specific example is when one attempts to use the Btrfs clone
    ioctl command when the source file is in the Btrfs filesystem that
    eCryptfs is mounted on top of and the destination fd is from a new file
    created in the eCryptfs mount. The ioctl syscall incorrectly returns
    success because the command is passed down to Btrfs which thinks that it
    was able to do the clone operation. However, the result is an empty
    eCryptfs file.

    This patch allows the trim, {g,s}etflags, and {g,s}etversion ioctl
    commands through and then copies up the inode metadata from the lower
    inode to the eCryptfs inode to catch any changes made to the lower
    inode's metadata. Those five ioctl commands are mostly common across all
    filesystems but the whitelist may need to be further pruned in the
    future.

    https://bugzilla.kernel.org/show_bug.cgi?id=93691
    https://launchpad.net/bugs/1305335

    Signed-off-by: Tyler Hicks
    Cc: Rocko
    Cc: Colin Ian King
    Cc: stable@vger.kernel.org # v2.6.36+: c43f7b8 eCryptfs: Handle ioctl calls with unlocked and compat functions

    Tyler Hicks
     

25 Feb, 2015

1 commit

  • The patch 237fead61998: "[PATCH] ecryptfs: fs/Makefile and
    fs/Kconfig" from Oct 4, 2006, leads to the following static checker
    warning:

    fs/ecryptfs/crypto.c:846 ecryptfs_new_file_context()
    error: off-by-one overflow 'crypt_stat->cipher' size 32. rl = '0-32'

    There is a mismatch between the size of ecryptfs_crypt_stat.cipher
    and ecryptfs_mount_crypt_stat.global_default_cipher_name causing the
    copy of the cipher name to cause a off-by-one string copy error. This
    fix ensures the space reserved for this string is the same size including
    the trailing zero at the end throughout ecryptfs.

    This fix avoids increasing the size of ecryptfs_crypt_stat.cipher
    and also ecryptfs_parse_tag_70_packet_silly_stack.cipher_string and instead
    reduces the of ECRYPTFS_MAX_CIPHER_NAME_SIZE to 31 and includes the + 1 for
    the end of string terminator.

    NOTE: An overflow is not possible in practice since the value copied
    into global_default_cipher_name is validated by
    ecryptfs_code_for_cipher_string() at mount time. None of the allowed
    cipher strings are long enough to cause the potential buffer overflow
    fixed by this patch.

    Signed-off-by: Colin Ian King
    Reported-by: Dan Carpenter
    [tyhicks: Added the NOTE about the overflow not being triggerable]
    Signed-off-by: Tyler Hicks

    Colin Ian King
     

23 Feb, 2015

1 commit

  • Convert the following where appropriate:

    (1) S_ISLNK(dentry->d_inode) to d_is_symlink(dentry).

    (2) S_ISREG(dentry->d_inode) to d_is_reg(dentry).

    (3) S_ISDIR(dentry->d_inode) to d_is_dir(dentry). This is actually more
    complicated than it appears as some calls should be converted to
    d_can_lookup() instead. The difference is whether the directory in
    question is a real dir with a ->lookup op or whether it's a fake dir with
    a ->d_automount op.

    In some circumstances, we can subsume checks for dentry->d_inode not being
    NULL into this, provided we the code isn't in a filesystem that expects
    d_inode to be NULL if the dirent really *is* negative (ie. if we're going to
    use d_inode() rather than d_backing_inode() to get the inode pointer).

    Note that the dentry type field may be set to something other than
    DCACHE_MISS_TYPE when d_inode is NULL in the case of unionmount, where the VFS
    manages the fall-through from a negative dentry to a lower layer. In such a
    case, the dentry type of the negative union dentry is set to the same as the
    type of the lower dentry.

    However, if you know d_inode is not NULL at the call site, then you can use
    the d_is_xxx() functions even in a filesystem.

    There is one further complication: a 0,0 chardev dentry may be labelled
    DCACHE_WHITEOUT_TYPE rather than DCACHE_SPECIAL_TYPE. Strictly, this was
    intended for special directory entry types that don't have attached inodes.

    The following perl+coccinelle script was used:

    use strict;

    my @callers;
    open($fd, 'git grep -l \'S_IS[A-Z].*->d_inode\' |') ||
    die "Can't grep for S_ISDIR and co. callers";
    @callers = ;
    close($fd);
    unless (@callers) {
    print "No matches\n";
    exit(0);
    }

    my @cocci = (
    '@@',
    'expression E;',
    '@@',
    '',
    '- S_ISLNK(E->d_inode->i_mode)',
    '+ d_is_symlink(E)',
    '',
    '@@',
    'expression E;',
    '@@',
    '',
    '- S_ISDIR(E->d_inode->i_mode)',
    '+ d_is_dir(E)',
    '',
    '@@',
    'expression E;',
    '@@',
    '',
    '- S_ISREG(E->d_inode->i_mode)',
    '+ d_is_reg(E)' );

    my $coccifile = "tmp.sp.cocci";
    open($fd, ">$coccifile") || die $coccifile;
    print($fd "$_\n") || die $coccifile foreach (@cocci);
    close($fd);

    foreach my $file (@callers) {
    chomp $file;
    print "Processing ", $file, "\n";
    system("spatch", "--sp-file", $coccifile, $file, "--in-place", "--no-show-diff") == 0 ||
    die "spatch failed";
    }

    [AV: overlayfs parts skipped]

    Signed-off-by: David Howells
    Signed-off-by: Al Viro

    David Howells
     

21 Jan, 2015

2 commits

  • Now that we never use the backing_dev_info pointer in struct address_space
    we can simply remove it and save 4 to 8 bytes in every inode.

    Signed-off-by: Christoph Hellwig
    Acked-by: Ryusuke Konishi
    Reviewed-by: Tejun Heo
    Reviewed-by: Jan Kara
    Signed-off-by: Jens Axboe

    Christoph Hellwig
     
  • Since "BDI: Provide backing device capability information [try #3]" the
    backing_dev_info structure also provides flags for the kind of mmap
    operation available in a nommu environment, which is entirely unrelated
    to it's original purpose.

    Introduce a new nommu-only file operation to provide this information to
    the nommu mmap code instead. Splitting this from the backing_dev_info
    structure allows to remove lots of backing_dev_info instance that aren't
    otherwise needed, and entirely gets rid of the concept of providing a
    backing_dev_info for a character device. It also removes the need for
    the mtd_inodefs filesystem.

    Signed-off-by: Christoph Hellwig
    Reviewed-by: Tejun Heo
    Acked-by: Brian Norris
    Signed-off-by: Jens Axboe

    Christoph Hellwig
     

20 Dec, 2014

1 commit

  • …/git/tyhicks/ecryptfs

    Pull eCryptfs fixes from Tyler Hicks:
    "Fixes for filename decryption and encrypted view plus a cleanup

    - The filename decryption routines were, at times, writing a zero
    byte one character past the end of the filename buffer

    - The encrypted view feature attempted, and failed, to roll its own
    form of enforcing a read-only mount instead of letting the VFS
    enforce it"

    * tag 'ecryptfs-3.19-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs:
    eCryptfs: Remove buggy and unnecessary write in file name decode routine
    eCryptfs: Remove unnecessary casts when parsing packet lengths
    eCryptfs: Force RO mount when encrypted view is enabled

    Linus Torvalds
     

27 Nov, 2014

1 commit

  • Dmitry Chernenkov used KASAN to discover that eCryptfs writes past the
    end of the allocated buffer during encrypted filename decoding. This
    fix corrects the issue by getting rid of the unnecessary 0 write when
    the current bit offset is 2.

    Signed-off-by: Michael Halcrow
    Reported-by: Dmitry Chernenkov
    Suggested-by: Kees Cook
    Cc: stable@vger.kernel.org # v2.6.29+: 51ca58d eCryptfs: Filename Encryption: Encoding and encryption functions
    Signed-off-by: Tyler Hicks

    Michael Halcrow
     

20 Nov, 2014

1 commit


01 Nov, 2014

1 commit


30 Oct, 2014

1 commit


24 Oct, 2014

1 commit

  • Add a simple read-only counter to super_block that indicates how deep this
    is in the stack of filesystems. Previously ecryptfs was the only stackable
    filesystem and it explicitly disallowed multiple layers of itself.

    Overlayfs, however, can be stacked recursively and also may be stacked
    on top of ecryptfs or vice versa.

    To limit the kernel stack usage we must limit the depth of the
    filesystem stack. Initially the limit is set to 2.

    Signed-off-by: Miklos Szeredi

    Miklos Szeredi
     

23 Oct, 2014

1 commit

  • The ecryptfs_encrypted_view mount option greatly changes the
    functionality of an eCryptfs mount. Instead of encrypting and decrypting
    lower files, it provides a unified view of the encrypted files in the
    lower filesystem. The presence of the ecryptfs_encrypted_view mount
    option is intended to force a read-only mount and modifying files is not
    supported when the feature is in use. See the following commit for more
    information:

    e77a56d [PATCH] eCryptfs: Encrypted passthrough

    This patch forces the mount to be read-only when the
    ecryptfs_encrypted_view mount option is specified by setting the
    MS_RDONLY flag on the superblock. Additionally, this patch removes some
    broken logic in ecryptfs_open() that attempted to prevent modifications
    of files when the encrypted view feature was in use. The check in
    ecryptfs_open() was not sufficient to prevent file modifications using
    system calls that do not operate on a file descriptor.

    Signed-off-by: Tyler Hicks
    Reported-by: Priya Bansal
    Cc: stable@vger.kernel.org # v2.6.21+: e77a56d [PATCH] eCryptfs: Encrypted passthrough

    Tyler Hicks
     

13 Oct, 2014

1 commit

  • Pull vfs updates from Al Viro:
    "The big thing in this pile is Eric's unmount-on-rmdir series; we
    finally have everything we need for that. The final piece of prereqs
    is delayed mntput() - now filesystem shutdown always happens on
    shallow stack.

    Other than that, we have several new primitives for iov_iter (Matt
    Wilcox, culled from his XIP-related series) pushing the conversion to
    ->read_iter()/ ->write_iter() a bit more, a bunch of fs/dcache.c
    cleanups and fixes (including the external name refcounting, which
    gives consistent behaviour of d_move() wrt procfs symlinks for long
    and short names alike) and assorted cleanups and fixes all over the
    place.

    This is just the first pile; there's a lot of stuff from various
    people that ought to go in this window. Starting with
    unionmount/overlayfs mess... ;-/"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (60 commits)
    fs/file_table.c: Update alloc_file() comment
    vfs: Deduplicate code shared by xattr system calls operating on paths
    reiserfs: remove pointless forward declaration of struct nameidata
    don't need that forward declaration of struct nameidata in dcache.h anymore
    take dname_external() into fs/dcache.c
    let path_init() failures treated the same way as subsequent link_path_walk()
    fix misuses of f_count() in ppp and netlink
    ncpfs: use list_for_each_entry() for d_subdirs walk
    vfs: move getname() from callers to do_mount()
    gfs2_atomic_open(): skip lookups on hashed dentry
    [infiniband] remove pointless assignments
    gadgetfs: saner API for gadgetfs_create_file()
    f_fs: saner API for ffs_sb_create_file()
    jfs: don't hash direct inode
    [s390] remove pointless assignment of ->f_op in vmlogrdr ->open()
    ecryptfs: ->f_op is never NULL
    android: ->f_op is never NULL
    nouveau: __iomem misannotations
    missing annotation in fs/file.c
    fs: namespace: suppress 'may be used uninitialized' warnings
    ...

    Linus Torvalds
     

11 Oct, 2014

1 commit

  • Pull eCryptfs updates from Tyler Hicks:
    "Minor code cleanups and a fix for when eCryptfs metadata is stored in
    xattrs"

    * tag 'ecryptfs-3.18-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs:
    ecryptfs: remove unneeded buggy code in ecryptfs_do_create()
    ecryptfs: avoid to access NULL pointer when write metadata in xattr
    ecryptfs: remove unnecessary break after goto
    ecryptfs: Remove unnecessary include of syscall.h in keystore.c
    fs/ecryptfs/messaging.c: remove null test before kfree
    ecryptfs: Drop cast
    Use %pd in eCryptFS

    Linus Torvalds
     

09 Oct, 2014

1 commit


07 Oct, 2014

1 commit

  • There is a bug in error handling of lock_parent() in ecryptfs_do_create():
    lock_parent() acquries mutex even if dget_parent() fails, so mutex should be unlocked anyway.

    But dget_parent() does not fail, so the patch just removes unneeded buggy code.

    Found by Linux Driver Verification project (linuxtesting.org).

    Signed-off-by: Alexey Khoroshilov
    Signed-off-by: Tyler Hicks

    Alexey Khoroshilov
     

06 Oct, 2014

1 commit

  • Christopher Head 2014-06-28 05:26:20 UTC described:
    "I tried to reproduce this on 3.12.21. Instead, when I do "echo hello > foo"
    in an ecryptfs mount with ecryptfs_xattr specified, I get a kernel crash:

    BUG: unable to handle kernel NULL pointer dereference at (null)
    IP: [] fsstack_copy_attr_all+0x2/0x61
    PGD d7840067 PUD b2c3c067 PMD 0
    Oops: 0002 [#1] SMP
    Modules linked in: nvidia(PO)
    CPU: 3 PID: 3566 Comm: bash Tainted: P O 3.12.21-gentoo-r1 #2
    Hardware name: ASUSTek Computer Inc. G60JX/G60JX, BIOS 206 03/15/2010
    task: ffff8801948944c0 ti: ffff8800bad70000 task.ti: ffff8800bad70000
    RIP: 0010:[] [] fsstack_copy_attr_all+0x2/0x61
    RSP: 0018:ffff8800bad71c10 EFLAGS: 00010246
    RAX: 00000000000181a4 RBX: ffff880198648480 RCX: 0000000000000000
    RDX: 0000000000000004 RSI: ffff880172010450 RDI: 0000000000000000
    RBP: ffff880198490e40 R08: 0000000000000000 R09: 0000000000000000
    R10: ffff880172010450 R11: ffffea0002c51e80 R12: 0000000000002000
    R13: 000000000000001a R14: 0000000000000000 R15: ffff880198490e40
    FS: 00007ff224caa700(0000) GS:ffff88019fcc0000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000000000 CR3: 00000000bb07f000 CR4: 00000000000007e0
    Stack:
    ffffffff811826e8 ffff8800a39d8000 0000000000000000 000000000000001a
    ffff8800a01d0000 ffff8800a39d8000 ffffffff81185fd5 ffffffff81082c2c
    00000001a39d8000 53d0abbc98490e40 0000000000000037 ffff8800a39d8220
    Call Trace:
    [] ? ecryptfs_setxattr+0x40/0x52
    [] ? ecryptfs_write_metadata+0x1b3/0x223
    [] ? should_resched+0x5/0x23
    [] ? ecryptfs_initialize_file+0xaf/0xd4
    [] ? ecryptfs_create+0xf4/0x142
    [] ? vfs_create+0x48/0x71
    [] ? do_last.isra.68+0x559/0x952
    [] ? link_path_walk+0xbd/0x458
    [] ? path_openat+0x224/0x472
    [] ? do_filp_open+0x2b/0x6f
    [] ? __alloc_fd+0xd6/0xe7
    [] ? do_sys_open+0x65/0xe9
    [] ? system_call_fastpath+0x16/0x1b
    RIP [] fsstack_copy_attr_all+0x2/0x61
    RSP
    CR2: 0000000000000000
    ---[ end trace df9dba5f1ddb8565 ]---"

    If we create a file when we mount with ecryptfs_xattr_metadata option, we will
    encounter a crash in this path:
    ->ecryptfs_create
    ->ecryptfs_initialize_file
    ->ecryptfs_write_metadata
    ->ecryptfs_write_metadata_to_xattr
    ->ecryptfs_setxattr
    ->fsstack_copy_attr_all
    It's because our dentry->d_inode used in fsstack_copy_attr_all is NULL, and it
    will be initialized when ecryptfs_initialize_file finish.

    So we should skip copying attr from lower inode when the value of ->d_inode is
    invalid.

    Signed-off-by: Chao Yu
    Cc: stable@vger.kernel.org # v3.2+: b59db43 eCryptfs: Prevent file create race condition
    Signed-off-by: Tyler Hicks

    Chao Yu
     

15 Jul, 2014

1 commit


04 Jul, 2014

3 commits


07 May, 2014

2 commits


05 Apr, 2014

1 commit

  • Pull renameat2 system call from Miklos Szeredi:
    "This adds a new syscall, renameat2(), which is the same as renameat()
    but with a flags argument.

    The purpose of extending rename is to add cross-rename, a symmetric
    variant of rename, which exchanges the two files. This allows
    interesting things, which were not possible before, for example
    atomically replacing a directory tree with a symlink, etc... This
    also allows overlayfs and friends to operate on whiteouts atomically.

    Andy Lutomirski also suggested a "noreplace" flag, which disables the
    overwriting behavior of rename.

    These two flags, RENAME_EXCHANGE and RENAME_NOREPLACE are only
    implemented for ext4 as an example and for testing"

    * 'cross-rename' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs:
    ext4: add cross rename support
    ext4: rename: split out helper functions
    ext4: rename: move EMLINK check up
    ext4: rename: create ext4_renament structure for local vars
    vfs: add cross-rename
    vfs: lock_two_nondirectories: allow directory args
    security: add flags to rename hooks
    vfs: add RENAME_NOREPLACE flag
    vfs: add renameat2 syscall
    vfs: rename: use common code for dir and non-dir
    vfs: rename: move d_move() up
    vfs: add d_is_dir()

    Linus Torvalds
     

04 Apr, 2014

1 commit

  • Reclaim will be leaving shadow entries in the page cache radix tree upon
    evicting the real page. As those pages are found from the LRU, an
    iput() can lead to the inode being freed concurrently. At this point,
    reclaim must no longer install shadow pages because the inode freeing
    code needs to ensure the page tree is really empty.

    Add an address_space flag, AS_EXITING, that the inode freeing code sets
    under the tree lock before doing the final truncate. Reclaim will check
    for this flag before installing shadow pages.

    Signed-off-by: Johannes Weiner
    Reviewed-by: Rik van Riel
    Reviewed-by: Minchan Kim
    Cc: Andrea Arcangeli
    Cc: Bob Liu
    Cc: Christoph Hellwig
    Cc: Dave Chinner
    Cc: Greg Thelen
    Cc: Hugh Dickins
    Cc: Jan Kara
    Cc: KOSAKI Motohiro
    Cc: Luigi Semenzato
    Cc: Mel Gorman
    Cc: Metin Doslu
    Cc: Michel Lespinasse
    Cc: Ozgun Erdogan
    Cc: Peter Zijlstra
    Cc: Roman Gushchin
    Cc: Ryan Mallon
    Cc: Tejun Heo
    Cc: Vlastimil Babka
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Johannes Weiner
     

01 Apr, 2014

1 commit

  • Add new renameat2 syscall, which is the same as renameat with an added
    flags argument.

    Pass flags to vfs_rename() and to i_op->rename() as well.

    Signed-off-by: Miklos Szeredi
    Reviewed-by: J. Bruce Fields

    Miklos Szeredi
     

25 Jan, 2014

1 commit

  • If ecryptfs_readlink_lower() fails, buf remains an uninitialized
    pointer and passing it nd_set_link() won't do anything good.

    Fixed by switching ecryptfs_readlink_lower() to saner API - make it
    return buf or ERR_PTR(...) and update callers.

    Signed-off-by: Al Viro

    Al Viro
     

18 Dec, 2013

1 commit

  • Use the new %pd printk() specifier in eCryptFS to replace passing of dentry
    name or dentry name and name length * 2 with just passing the dentry.

    Signed-off-by: David Howells
    cc: ecryptfs@vger.kernel.org
    Signed-off-by: Tyler Hicks

    David Howells
     

23 Nov, 2013

1 commit


15 Nov, 2013

2 commits

  • Use this new function to make code more comprehensible, since we are
    reinitialzing the completion, not initializing.

    [akpm@linux-foundation.org: linux-next resyncs]
    Signed-off-by: Wolfram Sang
    Acked-by: Linus Walleij (personally at LCE13)
    Cc: Ingo Molnar
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Wolfram Sang
     
  • When accessing the lower_file pointer located in private_data of
    eCryptfs files, there is no need to check to see if the private_data
    pointer has been initialized to a non-NULL value. The file->private_data
    and file->private_data->lower_file pointers are always initialized to
    non-NULL values in ecryptfs_open().

    This change quiets a Smatch warning:

    CHECK /var/scm/kernel/linux/fs/ecryptfs/file.c
    fs/ecryptfs/file.c:321 ecryptfs_unlocked_ioctl() error: potential NULL dereference 'lower_file'.
    fs/ecryptfs/file.c:335 ecryptfs_compat_ioctl() error: potential NULL dereference 'lower_file'.

    Signed-off-by: Tyler Hicks
    Reported-by: Dan Carpenter
    Reviewed-by: Geyslan G. Bem
    Cc: Al Viro

    Tyler Hicks
     

13 Nov, 2013

1 commit

  • Pull vfs updates from Al Viro:
    "All kinds of stuff this time around; some more notable parts:

    - RCU'd vfsmounts handling
    - new primitives for coredump handling
    - files_lock is gone
    - Bruce's delegations handling series
    - exportfs fixes

    plus misc stuff all over the place"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (101 commits)
    ecryptfs: ->f_op is never NULL
    locks: break delegations on any attribute modification
    locks: break delegations on link
    locks: break delegations on rename
    locks: helper functions for delegation breaking
    locks: break delegations on unlink
    namei: minor vfs_unlink cleanup
    locks: implement delegations
    locks: introduce new FL_DELEG lock flag
    vfs: take i_mutex on renamed file
    vfs: rename I_MUTEX_QUOTA now that it's not used for quotas
    vfs: don't use PARENT/CHILD lock classes for non-directories
    vfs: pull ext4's double-i_mutex-locking into common code
    exportfs: fix quadratic behavior in filehandle lookup
    exportfs: better variable name
    exportfs: move most of reconnect_path to helper function
    exportfs: eliminate unused "noprogress" counter
    exportfs: stop retrying once we race with rename/remove
    exportfs: clear DISCONNECTED on all parents sooner
    exportfs: more detailed comment for path_reconnect
    ...

    Linus Torvalds
     

10 Nov, 2013

1 commit


09 Nov, 2013

1 commit