TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
4533f7e1785faab49c867ae19bf00840fe351b0c
twx-linux/fs
T
History
Theodore Ts'o 990251318b ext4: fail ext4_iget for root directory if unallocated 
commit 8e4b5eae5d upstream.

If the root directory has an i_links_count of zero, then when the file
system is mounted, then when ext4_fill_super() notices the problem and
tries to call iput() the root directory in the error return path,
ext4_evict_inode() will try to free the inode on disk, before all of
the file system structures are set up, and this will result in an OOPS
caused by a NULL pointer dereference.

This issue has been assigned CVE-2018-1092.

https://bugzilla.kernel.org/show_bug.cgi?id=199179
https://bugzilla.redhat.com/show_bug.cgi?id=1560777

Reported-by: Wen Xu <wen.xu@gatech.edu>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-24 09:32:07 +02:00
..
9p
fs/9p: Compare qid.path in v9fs_test_inode
2017-11-30 08:37:22 +00:00
adfs
…
affs
affs: fix remount failure when there are no options changed
2016-06-07 18:14:32 -07:00
afs
afs: Fix afs_kill_pages()
2017-12-20 10:04:56 +01:00
autofs4
autofs: fix careless error in recent commit
2017-12-20 10:04:51 +01:00
befs
…
bfs
…
btrfs
btrfs: fix incorrect error return ret being passed to mapping_set_error
2018-04-13 19:50:06 +02:00
cachefiles
…
ceph
ceph: drop negative child dentries before try pruning inode's alias
2017-12-20 10:04:52 +01:00
cifs
SMB2: Fix share type handling
2018-04-13 19:50:04 +02:00
coda
coda: fix 'kernel memory exposure attempt' in fsync
2017-11-24 08:32:25 +01:00
configfs
configfs: Fix race between create_link and configfs_rmdir
2017-06-26 07:13:08 +02:00
cramfs
…
debugfs
dentry name snapshots
2017-08-06 19:19:42 -07:00
devpts
devpts: clean up interface to pty drivers
2016-08-16 09:30:49 +02:00
dlm
dlm: avoid double-free on error path in dlm_device_{register,unregister}
2017-09-13 14:09:45 -07:00
ecryptfs
eCryptfs: use after free in ecryptfs_release_messaging()
2017-11-30 08:37:20 +00:00
efivarfs
…
efs
…
exofs
…
exportfs
…
ext2
ext2: Don't clear SGID when inheriting ACLs
2018-01-31 12:06:11 +01:00
ext4
ext4: fail ext4_iget for root directory if unallocated
2018-04-24 09:32:07 +02:00
f2fs
f2fs: relax node version check for victim data in gc
2018-03-22 09:23:22 +01:00
fat
fat: fix using uninitialized fields of fat_inode/fsinfo_inode
2017-03-15 09:57:15 +08:00
freevxfs
…
fscache
FS-Cache: fix dereference of NULL user_key_payload
2017-10-27 10:23:18 +02:00
fuse
fuse: fix READDIRPLUS skipping an entry
2017-11-02 09:40:49 +01:00
gfs2
GFS2: Take inode off order_write list when setting jdata flag
2017-12-20 10:04:59 +01:00
hfs
…
hfsplus
posix_acl: Clear SGID bit when setting file permissions
2016-10-31 04:13:58 -06:00
hostfs
hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common()
2016-09-30 10:18:39 +02:00
hpfs
hpfs: implement the show_options method
2016-06-01 12:15:54 -07:00
hugetlbfs
mm: larger stack guard gap, between vmas
2017-06-26 07:13:11 +02:00
isofs
isofs: fix timestamps beyond 2027
2017-11-30 08:37:20 +00:00
jbd2
jbd2: if the journal is aborted then don't allow update of the log tail
2018-04-24 09:32:07 +02:00
jffs2
posix_acl: Clear SGID bit when setting file permissions
2016-10-31 04:13:58 -06:00
jfs
fs: add i_blocksize()
2017-06-14 13:16:24 +02:00
kernfs
kernfs: fix regression in kernfs_fop_write caused by wrong type
2018-02-16 20:09:42 +01:00
lockd
lockd: fix lockd shutdown race
2018-04-13 19:50:02 +02:00
logfs
…
minix
…
ncpfs
staging: ncpfs: memory corruption in ncp_read_kernel()
2018-03-28 18:40:15 +02:00
nfs
pNFS/flexfiles: missing error code in ff_layout_alloc_lseg()
2018-04-13 19:50:10 +02:00
nfs_common
lockd: fix "list_add double add" caused by legacy signal interface
2018-02-03 17:04:28 +01:00
nfsd
nfsd4: permit layoutget of executable-only files
2018-03-24 10:58:48 +01:00
nilfs2
nilfs2: fix race condition that causes file system corruption
2017-11-30 08:37:20 +00:00
nls
…
notify
dentry name snapshots
2017-08-06 19:19:42 -07:00
ntfs
…
ocfs2
Revert "ocfs2: should wait dio before inode lock in ocfs2_setattr()"
2017-12-09 18:42:43 +01:00
omfs
…
openpromfs
…
overlayfs
ovl: filter trusted xattr for non-admin
2018-04-13 19:50:14 +02:00
proc
fs/proc: Stop trying to report thread stacks
2018-04-08 11:52:00 +02:00
pstore
pstore: Use dynamic spinlock initializer
2017-08-06 19:19:43 -07:00
qnx4
…
qnx6
…
quota
quota: Check for register_shrinker() failure.
2018-02-03 17:04:28 +01:00
ramfs
…
reiserfs
fs/reiserfs/journal.c: add missing resierfs_warning() arg
2018-04-24 09:32:05 +02:00
romfs
romfs: use different way to generate fsid for BLOCK or MTD
2017-06-17 06:39:38 +02:00
squashfs
…
sysfs
sysfs: be careful of error returns from ops->show()
2017-04-12 12:38:33 +02:00
sysv
…
tracefs
…
ubifs
ubifs: Check ubifs_wbuf_sync() return code
2018-04-24 09:32:05 +02:00
udf
udf: Avoid overflow when session starts at large offset
2017-12-20 10:05:01 +01:00
ufs
ufs_getfrag_block(): we only grab ->truncate_mutex on block creation path
2017-06-14 13:16:24 +02:00
xfs
xfs: quota: check result of register_shrinker()
2018-03-03 10:19:44 +01:00
aio.c
fs/aio: Use RCU accessors for kioctx_table->table[]
2018-03-22 09:23:31 +01:00
anon_inodes.c
…
attr.c
vfs: move permission checking into notify_change() for utimes(NULL)
2016-10-22 12:26:56 +02:00
bad_inode.c
…
binfmt_aout.c
…
binfmt_elf_fdpic.c
…
binfmt_elf.c
binfmt_elf: use ELF_ET_DYN_BASE only for PIE
2017-07-21 07:44:57 +02:00
binfmt_em86.c
…
binfmt_flat.c
…
binfmt_misc.c
…
binfmt_script.c
…
block_dev.c
fs/block_dev: always invalidate cleancache in invalidate_bdev()
2017-05-20 14:27:01 +02:00
buffer.c
fs: add i_blocksize()
2017-06-14 13:16:24 +02:00
char_dev.c
…
compat_binfmt_elf.c
binfmt_elf: compat: avoid unused function warning
2018-02-25 11:03:51 +01:00
compat_ioctl.c
fs: compat: Remove warning from COMPATIBLE_IOCTL
2018-04-08 11:51:57 +02:00
compat.c
…
coredump.c
coredump: Ensure proper size of sparse core files
2017-07-05 14:37:20 +02:00
dax.c
…
dcache.c
lock_parent() needs to recheck if dentry got __dentry_kill'ed under it
2018-03-22 09:23:31 +01:00
dcookies.c
…
direct-io.c
direct-io: Prevent NULL pointer access in submit_page_section
2017-10-18 09:20:42 +02:00
drop_caches.c
…
eventfd.c
…
eventpoll.c
epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove()
2017-09-07 08:34:10 +02:00
exec.c
exec: Limit arg stack to at most 75% of _STK_LIM
2017-07-21 07:44:57 +02:00
fcntl.c
fs/fcntl: f_setown, avoid undefined behaviour
2018-01-31 12:06:11 +01:00
fhandle.c
…
file_table.c
…
file.c
…
filesystems.c
…
fs_pin.c
…
fs_struct.c
…
fs-writeback.c
writeback: fix memory leak in wb_queue_work()
2017-12-20 10:04:54 +01:00
inode.c
don't put symlink bodies in pagecache into highmem
2018-02-16 20:09:38 +01:00
internal.h
…
ioctl.c
…
Kconfig
…
Kconfig.binfmt
…
libfs.c
…
locks.c
locks: don't check for race with close when setting OFD lock
2018-01-17 09:35:27 +01:00
Makefile
…
mbcache.c
…
mount.h
mnt: In propgate_umount handle visiting mounts in any order
2017-07-21 07:44:57 +02:00
mpage.c
fs: add i_blocksize()
2017-06-14 13:16:24 +02:00
namei.c
getname_kernel() needs to make sure that ->name != ->iname in long case
2018-04-24 09:32:04 +02:00
namespace.c
mnt: In propgate_umount handle visiting mounts in any order
2017-07-21 07:44:57 +02:00
no-block.c
…
nsfs.c
nsfs: mark dentry with DCACHE_RCUACCESS
2018-02-16 20:09:43 +01:00
open.c
fs: completely ignore unknown open flags
2017-07-15 11:57:44 +02:00
pipe.c
pipe: avoid round_pipe_size() nr_pages overflow on 32-bit
2018-01-23 19:50:15 +01:00
pnode.c
mnt: Make propagate_umount less slow for overlapping mount propagation trees
2017-07-21 07:44:58 +02:00
pnode.h
mnt: Add a per mount namespace limit on the number of mounts
2017-04-30 05:49:28 +02:00
posix_acl.c
tmpfs: clear S_ISGID when setting posix ACLs
2017-01-26 08:23:47 +01:00
proc_namespace.c
…
read_write.c
vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets
2017-10-05 09:41:45 +02:00
readdir.c
…
select.c
fs/select: add vmalloc fallback for select(2)
2018-01-31 12:06:09 +01:00
seq_file.c
Make file credentials available to the seqfile interfaces
2017-08-06 19:19:42 -07:00
signalfd.c
…
splice.c
vfs: fix uninitialized flags in splice_to_pipe()
2017-02-23 17:43:09 +01:00
stack.c
…
stat.c
ufs: restore maintaining ->i_blocks
2017-06-14 13:16:24 +02:00
statfs.c
…
super.c
sget(): handle failures of register_shrinker()
2018-03-03 10:19:41 +01:00
sync.c
…
timerfd.c
timerfd: Protect the might cancel mechanism proper
2017-05-08 07:46:01 +02:00
userfaultfd.c
userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE
2017-12-20 10:04:53 +01:00
utimes.c
vfs: move permission checking into notify_change() for utimes(NULL)
2016-10-22 12:26:56 +02:00
xattr.c
lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
2017-10-12 11:27:32 +02:00