linux/fs/ceph
Hugh Dickins 35c2a7f490 tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking
Fuzzing with trinity oopsed on the 1st instruction of shmem_fh_to_dentry(),
	u64 inum = fid->raw[2];
which is unhelpfully reported as at the end of shmem_alloc_inode():

BUG: unable to handle kernel paging request at ffff880061cd3000
IP: [<ffffffff812190d0>] shmem_alloc_inode+0x40/0x40
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Call Trace:
 [<ffffffff81488649>] ? exportfs_decode_fh+0x79/0x2d0
 [<ffffffff812d77c3>] do_handle_open+0x163/0x2c0
 [<ffffffff812d792c>] sys_open_by_handle_at+0xc/0x10
 [<ffffffff83a5f3f8>] tracesys+0xe1/0xe6

Right, tmpfs is being stupid to access fid->raw[2] before validating that
fh_len includes it: the buffer kmalloc'ed by do_sys_name_to_handle() may
fall at the end of a page, and the next page not be present.

But some other filesystems (ceph, gfs2, isofs, reiserfs, xfs) are being
careless about fh_len too, in fh_to_dentry() and/or fh_to_parent(), and
could oops in the same way: add the missing fh_len checks to those.

Reported-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Sage Weil <sage@inktank.com>
Cc: Steven Whitehouse <swhiteho@redhat.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-10-09 23:33:55 -04:00
..
Kconfig ceph: factor out libceph from Ceph file system 2010-10-20 15:37:28 -07:00
Makefile ceph: Makefile: Remove unnessary code 2011-01-12 15:15:13 -08:00
addr.c mm: kill vma flag VM_CAN_NONLINEAR 2012-10-09 16:22:17 +09:00
caps.c ceph: convert to use le32_add_cpu() 2012-10-01 14:30:54 -05:00
ceph_frag.c ceph: factor out libceph from Ceph file system 2010-10-20 15:37:28 -07:00
debugfs.c libceph: delay debugfs initialization until we learn global_id 2012-08-20 10:03:15 -07:00
dir.c ceph: simplify+fix atomic_open 2012-08-02 09:11:19 -07:00
export.c tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking 2012-10-09 23:33:55 -04:00
file.c ceph: propagate layout error on osd request creation 2012-10-01 17:20:00 -05:00
inode.c ceph: don't abuse d_delete() on failure exits 2012-09-26 22:20:20 -04:00
ioctl.c ceph: return EIO on invalid layout on GET_DATALOC ioctl 2012-10-03 10:51:17 -05:00
ioctl.h ceph: fully initialize new layout 2012-05-16 14:28:27 -05:00
locks.c ceph: unwind canceled flock state 2011-06-07 21:36:45 -07:00
mds_client.c ceph: Fix oops when handling mdsmap that decreases max_mds 2012-10-01 14:30:54 -05:00
mds_client.h ceph: define ceph_auth_handshake type 2012-05-17 08:18:12 -05:00
mdsmap.c ceph: factor out libceph from Ceph file system 2010-10-20 15:37:28 -07:00
snap.c ceph: define snap counts as u32 everywhere 2012-07-30 18:15:47 -07:00
strings.c ceph: factor out libceph from Ceph file system 2010-10-20 15:37:28 -07:00
super.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client 2012-10-08 06:38:18 +09:00
super.h ceph: simplify+fix atomic_open 2012-08-02 09:11:19 -07:00
xattr.c ceph: fix potential double free 2012-07-30 18:15:35 -07:00