Theodore Ts'o 990251318b ext4: fail ext4_iget for root directory if unallocated ...

commit 8e4b5eae5d upstream.

If the root directory has an i_links_count of zero, then when the file
system is mounted, then when ext4_fill_super() notices the problem and
tries to call iput() the root directory in the error return path,
ext4_evict_inode() will try to free the inode on disk, before all of
the file system structures are set up, and this will result in an OOPS
caused by a NULL pointer dereference.

This issue has been assigned CVE-2018-1092.

https://bugzilla.kernel.org/show_bug.cgi?id=199179
https://bugzilla.redhat.com/show_bug.cgi?id=1560777

Reported-by: Wen Xu <wen.xu@gatech.edu>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-04-24 09:32:07 +02:00

..

9p

fs/9p: Compare qid.path in v9fs_test_inode

2017-11-30 08:37:22 +00:00

adfs

…

affs

…

afs

afs: Fix afs_kill_pages()

2017-12-20 10:04:56 +01:00

autofs4

autofs: fix careless error in recent commit

2017-12-20 10:04:51 +01:00

befs

…

bfs

…

btrfs

btrfs: fix incorrect error return ret being passed to mapping_set_error

2018-04-13 19:50:06 +02:00

cachefiles

…

ceph

ceph: drop negative child dentries before try pruning inode's alias

2017-12-20 10:04:52 +01:00

cifs

SMB2: Fix share type handling

2018-04-13 19:50:04 +02:00

coda

coda: fix 'kernel memory exposure attempt' in fsync

2017-11-24 08:32:25 +01:00

configfs

…

cramfs

…

debugfs

…

devpts

…

dlm

…

ecryptfs

eCryptfs: use after free in ecryptfs_release_messaging()

2017-11-30 08:37:20 +00:00

efivarfs

…

efs

…

exofs

…

exportfs

…

ext2

ext2: Don't clear SGID when inheriting ACLs

2018-01-31 12:06:11 +01:00

ext4

ext4: fail ext4_iget for root directory if unallocated

2018-04-24 09:32:07 +02:00

f2fs

f2fs: relax node version check for victim data in gc

2018-03-22 09:23:22 +01:00

fat

…

freevxfs

…

fscache

…

fuse

…

gfs2

GFS2: Take inode off order_write list when setting jdata flag

2017-12-20 10:04:59 +01:00

hfs

…

hfsplus

…

hostfs

…

hpfs

…

hugetlbfs

…

isofs

isofs: fix timestamps beyond 2027

2017-11-30 08:37:20 +00:00

jbd2

jbd2: if the journal is aborted then don't allow update of the log tail

2018-04-24 09:32:07 +02:00

jffs2

…

jfs

…

kernfs

kernfs: fix regression in kernfs_fop_write caused by wrong type

2018-02-16 20:09:42 +01:00

lockd

lockd: fix lockd shutdown race

2018-04-13 19:50:02 +02:00

logfs

…

minix

…

ncpfs

staging: ncpfs: memory corruption in ncp_read_kernel()

2018-03-28 18:40:15 +02:00

nfs

pNFS/flexfiles: missing error code in ff_layout_alloc_lseg()

2018-04-13 19:50:10 +02:00

nfs_common

lockd: fix "list_add double add" caused by legacy signal interface

2018-02-03 17:04:28 +01:00

nfsd

nfsd4: permit layoutget of executable-only files

2018-03-24 10:58:48 +01:00

nilfs2

nilfs2: fix race condition that causes file system corruption

2017-11-30 08:37:20 +00:00

nls

…

notify

…

ntfs

…

ocfs2

Revert "ocfs2: should wait dio before inode lock in ocfs2_setattr()"

2017-12-09 18:42:43 +01:00

omfs

…

openpromfs

…

overlayfs

ovl: filter trusted xattr for non-admin

2018-04-13 19:50:14 +02:00

proc

fs/proc: Stop trying to report thread stacks

2018-04-08 11:52:00 +02:00

pstore

…

qnx4

…

qnx6

…

quota

quota: Check for register_shrinker() failure.

2018-02-03 17:04:28 +01:00

ramfs

…

reiserfs

fs/reiserfs/journal.c: add missing resierfs_warning() arg

2018-04-24 09:32:05 +02:00

romfs

…

squashfs

…

sysfs

…

sysv

…

tracefs

…

ubifs

ubifs: Check ubifs_wbuf_sync() return code

2018-04-24 09:32:05 +02:00

udf

udf: Avoid overflow when session starts at large offset

2017-12-20 10:05:01 +01:00

ufs

…

xfs

xfs: quota: check result of register_shrinker()

2018-03-03 10:19:44 +01:00

aio.c

fs/aio: Use RCU accessors for kioctx_table->table[]

2018-03-22 09:23:31 +01:00

anon_inodes.c

…

attr.c

…

bad_inode.c

…

binfmt_aout.c

…

binfmt_elf_fdpic.c

…

binfmt_elf.c

…

binfmt_em86.c

…

binfmt_flat.c

…

binfmt_misc.c

…

binfmt_script.c

…

block_dev.c

…

buffer.c

…

char_dev.c

…

compat_binfmt_elf.c

binfmt_elf: compat: avoid unused function warning

2018-02-25 11:03:51 +01:00

compat_ioctl.c

fs: compat: Remove warning from COMPATIBLE_IOCTL

2018-04-08 11:51:57 +02:00

compat.c

…

coredump.c

…

dax.c

…

dcache.c

lock_parent() needs to recheck if dentry got __dentry_kill'ed under it

2018-03-22 09:23:31 +01:00

dcookies.c

…

direct-io.c

…

drop_caches.c

…

eventfd.c

…

eventpoll.c

…

exec.c

…

fcntl.c

fs/fcntl: f_setown, avoid undefined behaviour

2018-01-31 12:06:11 +01:00

fhandle.c

…

file_table.c

…

file.c

…

filesystems.c

…

fs_pin.c

…

fs_struct.c

…

fs-writeback.c

writeback: fix memory leak in wb_queue_work()

2017-12-20 10:04:54 +01:00

inode.c

don't put symlink bodies in pagecache into highmem

2018-02-16 20:09:38 +01:00

internal.h

…

ioctl.c

…

Kconfig

…

Kconfig.binfmt

…

libfs.c

…

locks.c

locks: don't check for race with close when setting OFD lock

2018-01-17 09:35:27 +01:00

Makefile

…

mbcache.c

…

mount.h

…

mpage.c

…

namei.c

getname_kernel() needs to make sure that ->name != ->iname in long case

2018-04-24 09:32:04 +02:00

namespace.c

…

no-block.c

…

nsfs.c

nsfs: mark dentry with DCACHE_RCUACCESS

2018-02-16 20:09:43 +01:00

open.c

…

pipe.c

pipe: avoid round_pipe_size() nr_pages overflow on 32-bit

2018-01-23 19:50:15 +01:00

pnode.c

…

pnode.h

…

posix_acl.c

…

proc_namespace.c

…

read_write.c

…

readdir.c

…

select.c

fs/select: add vmalloc fallback for select(2)

2018-01-31 12:06:09 +01:00

seq_file.c

…

signalfd.c

…

splice.c

…

stack.c

…

stat.c

…

statfs.c

…

super.c

sget(): handle failures of register_shrinker()

2018-03-03 10:19:41 +01:00

sync.c

…

timerfd.c

…

userfaultfd.c

userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE

2017-12-20 10:04:53 +01:00

utimes.c

…

xattr.c

…