forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
linux-uconsole/fs
History
Al Viro 664ec2db3b Fix the locking in dcache_readdir() and friends 
commit d4f4de5e5e upstream.

There are two problems in dcache_readdir() - one is that lockless traversal
of the list needs non-trivial cooperation of d_alloc() (at least a switch
to list_add_rcu(), and probably more than just that) and another is that
it assumes that no removal will happen without the directory locked exclusive.
Said assumption had always been there, never had been stated explicitly and
is violated by several places in the kernel (devpts and selinuxfs).

        * replacement of next_positive() with different calling conventions:
it returns struct list_head * instead of struct dentry *; the latter is
passed in and out by reference, grabbing the result and dropping the original
value.
        * scan is under ->d_lock.  If we run out of timeslice, cursor is moved
after the last position we'd reached and we reschedule; then the scan continues
from that place.  To avoid livelocks between multiple lseek() (with cursors
getting moved past each other, never reaching the real entries) we always
skip the cursors, need_resched() or not.
        * returned list_head * is either ->d_child of dentry we'd found or
->d_subdirs of parent (if we got to the end of the list).
        * dcache_readdir() and dcache_dir_lseek() switched to new helper.
dcache_readdir() always holds a reference to dentry passed to dir_emit() now.
Cursor is moved to just before the entry where dir_emit() has failed or into
the very end of the list, if we'd run out.
        * move_cursor() eliminated - it had sucky calling conventions and
after fixing that it became simply list_move() (in lseek and scan_positives)
or list_move_tail() (in readdir).

        All operations with the list are under ->d_lock now, and we do not
depend upon having all file removals done with parent locked exclusive
anymore.

Cc: stable@vger.kernel.org
Reported-by: "zhengbin (A)" <zhengbin13@huawei.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-17 13:45:35 -07:00
..
9p 9p: avoid attaching writeback_fid on mmap with type PRIVATE 2019-10-11 18:21:13 +02:00
adfs fs/adfs: super: fix use-after-free bug 2019-08-06 19:06:49 +02:00
affs
afs afs: Fix leak in afs_lookup_cell_rcu() 2019-09-10 10:33:52 +01:00
autofs autofs: fix error return in autofs_fill_super() 2019-03-13 14:02:32 -07:00
befs
bfs bfs: add sanity check at bfs_fill_super() 2018-12-01 09:37:27 +01:00
btrfs btrfs: fix uninitialized ret in ref-verify 2019-10-17 13:45:27 -07:00
cachefiles fscache, cachefiles: remove redundant variable 'cache' 2018-12-17 09:24:40 +01:00
ceph ceph: reconnect connection if session hang in opening state 2019-10-11 18:21:15 +02:00
cifs cifs: use cifsInodeInfo->open_file_lock while iterating to avoid a panic 2019-10-17 13:45:24 -07:00
coda coda: add error handling for fget 2019-08-06 19:06:51 +02:00
configfs configfs: Fix use-after-free when accessing sd->s_dentry 2019-06-22 08:15:17 +02:00
cramfs Cramfs: fix abad comparison when wrap-arounds occur 2018-11-13 11:08:55 -08:00
crypto fscrypt: clean up some BUG_ON()s in block encryption/decryption 2019-07-26 09:14:02 +02:00
debugfs debugfs: fix use-after-free on symlink traversal 2019-05-08 07:21:48 +02:00
devpts fs/devpts: always delete dcache dentry-s in dput() 2019-03-23 20:09:59 +01:00
dlm dlm: check if workqueues are NULL before flushing/destroying 2019-07-31 07:27:07 +02:00
ecryptfs eCryptfs: fix a couple type promotion bugs 2019-07-26 09:14:29 +02:00
efivarfs efivars: Call guid_parse() against guid_t type of variable 2018-07-22 14:13:44 +02:00
efs
exofs fs/exofs: fix potential memory leak in mount option parsing 2018-11-27 16:13:00 +01:00
exportfs exportfs: do not read dentry after free 2018-12-17 09:24:35 +01:00
ext2 ext2: Fix underflow in ext2_max_size() 2019-03-23 20:10:03 +01:00
ext4 ext4: fix potential use after free after remounting with noblock_validity 2019-10-07 18:57:05 +02:00
f2fs f2fs: use EINVAL for superblock with invalid magic 2019-10-17 13:44:47 -07:00
fat fat: work around race with userspace's read via blockdev while mounting 2019-10-07 18:57:14 +02:00
freevxfs
fscache fscache: fix race between enablement and dropping of object 2018-12-17 09:24:40 +01:00
fuse fuse: fix memleak in cuse_channel_open 2019-10-11 18:21:20 +02:00
gfs2 gfs2: clear buf_in_tr when ending a transaction in sweep_bh_for_rgrps 2019-10-05 13:10:07 +02:00
hfs hfs: do not free node before using 2018-12-17 09:24:41 +01:00
hfsplus hfsplus: do not free node before using 2018-12-17 09:24:41 +01:00
hostfs vfs: discard ATTR_ATTR_FLAG 2018-08-17 16:20:28 -07:00
hpfs hpfs: remove unnecessary checks on the value of r when assigning error code 2018-08-25 12:42:33 -07:00
hugetlbfs hugetlb: use same fault hash key for shared and private mappings 2019-05-22 07:37:40 +02:00
isofs isofs: reject hardware sector size > 2048 bytes 2018-08-21 11:37:41 +02:00
jbd2 jbd2: introduce jbd2_inode dirty range scoping 2019-07-28 08:29:29 +02:00
jffs2 jffs2: fix use-after-free on symlink traversal 2019-05-08 07:21:48 +02:00
jfs Just one jfs patch for 4.19 2018-08-15 22:47:23 -07:00
kernfs kernfs: fix barrier usage in __kernfs_new_node() 2019-05-16 19:41:18 +02:00
lockd Revert "lockd: Show pid of lockd for remote locks" 2019-06-09 09:17:22 +02:00
minix
nfs NFS: Fix O_DIRECT accounting of number of bytes read/written 2019-10-17 13:45:30 -07:00
nfs_common
nfsd nfsd: Fix overflow causing non-working mounts on 1 TB machines 2019-07-10 09:53:47 +02:00
nilfs2 nilfs2: convert to SPDX license tags 2018-09-04 16:45:02 -07:00
nls
notify memcg, fsnotify: no oom-kill for remote memcg charging 2019-07-31 07:27:08 +02:00
ntfs ntfs: mft: remove VLA usage 2018-08-17 16:20:27 -07:00
ocfs2 ocfs2: wait for recovering done after direct unlock request 2019-10-07 18:57:16 +02:00
omfs
openpromfs
orangefs orangefs: remove redundant pointer orangefs_inode 2018-08-14 12:07:14 -04:00
overlayfs ovl: filter of trusted xattr results in audit 2019-10-05 13:10:08 +02:00
proc /proc/<pid>/cmdline: add back the setproctitle() special case 2019-08-04 09:30:56 +02:00
pstore pstore: fs superblock limits 2019-10-07 18:56:59 +02:00
qnx4
qnx6
quota quota: fix a problem about transfer quota 2019-07-14 08:11:15 +02:00
ramfs
reiserfs reiserfs: propagate errors from fill_with_dentries() properly 2018-11-27 16:12:59 +01:00
romfs
squashfs Squashfs: Compute expected length from inode size rather than block length 2018-08-02 09:34:02 -07:00
sysfs Driver core patches for 4.19-rc1 2018-08-18 11:44:53 -07:00
sysv sysv: return 'err' instead of 0 in __sysv_write_inode 2018-12-17 09:24:30 +01:00
tracefs tracefs: Annotate tracefs_ops with __ro_after_init 2018-07-31 11:32:44 -04:00
ubifs ubifs: Correctly use tnc_next() in search_dh_cookie() 2019-09-19 09:09:37 +02:00
udf udf: Fix incorrect final NOT_ALLOCATED (hole) extent length 2019-07-14 08:11:16 +02:00
ufs ufs: fix braino in ufs_get_inode_gid() for solaris UFS flavour 2019-05-25 18:23:46 +02:00
xfs xfs: don't crash on null attr fork xfs_bmapi_read 2019-10-01 08:26:12 +02:00
aio.c Fix aio_poll() races 2019-05-02 09:58:59 +02:00
anon_inodes.c anon_inode_getfile(): switch to alloc_file_pseudo() 2018-07-12 10:04:27 -04:00
attr.c
bad_inode.c get rid of 'opened' argument of ->atomic_open() - part 3 2018-07-12 10:04:20 -04:00
binfmt_aout.c
binfmt_elf.c binfmt_elf: Do not move brk for INTERP-less ET_EXEC 2019-10-05 13:10:06 +02:00
binfmt_elf_fdpic.c
binfmt_em86.c
binfmt_flat.c fs/binfmt_flat.c: make load_flat_shared_library() work 2019-07-03 13:14:44 +02:00
binfmt_misc.c
binfmt_script.c Revert "exec: load_script: don't blindly truncate shebang string" 2019-02-15 09:09:54 +01:00
block_dev.c block: fix the return errno for direct IO 2019-04-17 08:38:52 +02:00
buffer.c fs: fix guard_bio_eod to check for real EOD errors 2019-04-05 22:33:00 +02:00
char_dev.c chardev: add additional check for minor range overlap 2019-05-31 06:46:27 -07:00
compat.c
compat_binfmt_elf.c
compat_ioctl.c compat_ioctl: pppoe: fix PPPOEIOCSFWD handling 2019-08-09 17:52:34 +02:00
coredump.c
d_path.c
dax.c dax: dax_layout_busy_page() should not unmap cow pages 2019-08-16 10:12:52 +02:00
dcache.c dcache: sort the freeing-without-RCU-delay mess for good. 2019-05-25 18:23:26 +02:00
dcookies.c
direct-io.c direct-io: allow direct writes to empty inodes 2019-03-05 17:58:50 +01:00
drop_caches.c fs/drop_caches.c: avoid softlockups in drop_pagecache_sb() 2019-03-13 14:02:32 -07:00
eventfd.c
eventpoll.c fs/epoll: drop ovflist branch prediction 2019-02-12 19:47:19 +01:00
exec.c sched/fair: Don't free p->numa_faults with concurrent readers 2019-08-04 09:30:56 +02:00
fcntl.c signal: Don't send signals to tasks that don't exist 2018-08-15 23:03:20 -05:00
fhandle.c
file.c fs/file.c: initialize init_files.resize_wait 2019-04-05 22:32:59 +02:00
file_table.c overlayfs update for 4.19 2018-08-21 18:19:09 -07:00
filesystems.c
fs-writeback.c blkcg, writeback: dead memcgs shouldn't contribute to writeback ownership arbitration 2019-07-26 09:14:08 +02:00
fs_pin.c
fs_struct.c
inode.c Abort file_remove_privs() for non-reg. files 2019-06-22 08:15:21 +02:00
internal.h acct_on(): don't mess with freeze protection 2019-05-31 06:46:05 -07:00
ioctl.c vfs: fix FIGETBSZ ioctl on an overlayfs file 2018-11-21 09:19:14 +01:00
iomap.c iomap: fix a use after free in iomap_dio_rw 2019-03-13 14:02:29 -07:00
Kconfig
Kconfig.binfmt kconfig: move the "Executable file formats" menu to fs/Kconfig.binfmt 2018-08-02 08:06:55 +09:00
libfs.c Fix the locking in dcache_readdir() and friends 2019-10-17 13:45:35 -07:00
locks.c overlayfs update for 4.19 2018-08-21 18:19:09 -07:00
Makefile
mbcache.c
mount.h
mpage.c mpage: mpage_readpages() should submit IO as read-ahead 2018-08-17 16:20:29 -07:00
namei.c Revert "vfs: Allow userns root to call mknod on owned filesystems." 2018-12-29 13:37:54 +01:00
namespace.c mnt: fix __detach_mounts infinite loop 2018-11-21 09:19:22 +01:00
no-block.c
nsfs.c dcache: sort the freeing-without-RCU-delay mess for good. 2019-05-25 18:23:26 +02:00
open.c access: avoid the RCU grace period for the temporary subjective credentials 2019-07-31 07:27:11 +02:00
pipe.c fs: prevent page refcount overflow in pipe_buf_get 2019-05-04 09:20:11 +02:00
pnode.c
pnode.h
posix_acl.c
proc_namespace.c
read_write.c vfs: fix page locking deadlocks when deduping files 2019-09-10 10:33:47 +01:00
readdir.c
select.c
seq_file.c seq_file: fix problem when seeking mid-record 2019-08-25 10:47:43 +02:00
signalfd.c
splice.c fs: prevent page refcount overflow in pipe_buf_get 2019-05-04 09:20:11 +02:00
stack.c
stat.c
statfs.c vfs: Fix EOVERFLOW testing in put_compat_statfs64 2019-10-11 18:21:39 +02:00
super.c Merge branch 'ida-4.19' of git://git.infradead.org/users/willy/linux-dax 2018-08-26 11:48:42 -07:00
sync.c
timerfd.c Merge branch 'work.aio' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2018-08-13 20:56:23 -07:00
userfaultfd.c userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx 2019-08-29 08:28:52 +02:00
utimes.c
xattr.c sysfs: Do not return POSIX ACL xattrs via listxattr 2018-09-18 07:30:48 -04:00