No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Al Viro 2c38e61401 vfs: fix do_last() regression
commit 6404674acd596de41fd3ad5f267b4525494a891a upstream.

Brown paperbag time: fetching ->i_uid/->i_mode really should've been
done from nd->inode.  I even suggested that, but the reason for that has
slipped through the cracks and I went for dir->d_inode instead - made
for more "obvious" patch.

Analysis:

 - at the entry into do_last() and all the way to step_into(): dir (aka
   nd->path.dentry) is known not to have been freed; so's nd->inode and
   it's equal to dir->d_inode unless we are already doomed to -ECHILD.
   inode of the file to get opened is not known.

 - after step_into(): inode of the file to get opened is known; dir
   might be pointing to freed memory/be negative/etc.

 - at the call of may_create_in_sticky(): guaranteed to be out of RCU
   mode; inode of the file to get opened is known and pinned; dir might
   be garbage.

The last was the reason for the original patch.  Except that at the
do_last() entry we can be in RCU mode and it is possible that
nd->path.dentry->d_inode has already changed under us.

In that case we are going to fail with -ECHILD, but we need to be
careful; nd->inode is pointing to valid struct inode and it's the same
as nd->path.dentry->d_inode in "won't fail with -ECHILD" case, so we
should use that.

Reported-by: "Rantala, Tommi T. (Nokia - FI/Espoo)" <tommi.t.rantala@nokia.com>
Reported-by: syzbot+190005201ced78a74ad6@syzkaller.appspotmail.com
Wearing-brown-paperbag: Al Viro <viro@zeniv.linux.org.uk>
Cc: stable@kernel.org
Fixes: d0cb50185ae9 ("do_last(): fetch directory ->i_mode and ->i_uid before it's too late")
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-05 21:22:39 +00:00
arch Revert "um: Enable CONFIG_CONSTRUCTORS" 2020-02-01 09:34:53 +00:00
block block: fix memleak of bio integrity data 2020-01-26 10:01:09 +01:00
certs
crypto crypto: pcrypt - Fix user-after-free on module unload 2020-02-01 09:34:52 +00:00
Documentation hwrng: omap3-rom - Fix missing clock by probing with device tree 2020-01-26 10:01:03 +01:00
drivers power/supply: ingenic-battery: Don't change scale if there's only one 2020-02-01 09:34:53 +00:00
fs vfs: fix do_last() regression 2020-02-05 21:22:39 +00:00
include bus: ti-sysc: Fix missing force mstandby quirk handling 2020-02-01 09:34:51 +00:00
init Revert "um: Enable CONFIG_CONSTRUCTORS" 2020-02-01 09:34:53 +00:00
ipc ipc/sem.c: convert to use built-in RCU list checking 2019-09-25 17:51:41 -07:00
kernel Revert "um: Enable CONFIG_CONSTRUCTORS" 2020-02-01 09:34:53 +00:00
lib lib: Reduce user_access_begin() boundaries in strncpy_from_user() and strnlen_user() 2020-01-29 16:45:29 +01:00
LICENSES
mm mm/page-writeback.c: avoid potential division by zero in wb_min_max_ratio() 2020-01-23 08:22:41 +01:00
net Bluetooth: Allow combination of BDADDR_PROPERTY and INVALID_BDADDR quirks 2020-02-01 09:34:50 +00:00
samples samples/bpf: Fix broken xdp_rxq_info due to map order assumptions 2020-01-26 10:00:58 +01:00
scripts ARM: 8950/1: ftrace/recordmcount: filter relocation types 2020-01-29 16:45:27 +01:00
security tomoyo: Suppress RCU warning at list_for_each_entry_rcu(). 2020-01-17 19:49:05 +01:00
sound ALSA: hda/realtek - Move some alc236 pintbls to fallback table 2020-02-01 09:34:50 +00:00
tools libbpf: Fix BTF-defined map's __type macro handling of arrays 2020-02-01 09:34:47 +00:00
usr gen_initramfs_list.sh: fix 'bad variable name' error 2020-01-09 10:20:00 +01:00
virt KVM: arm/arm64: Properly handle faulting of device mappings 2019-12-31 16:46:24 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap ARM: SoC fixes 2019-11-10 13:41:59 -08:00
COPYING
CREDITS MAINTAINERS: Remove Simon as Renesas SoC Co-Maintainer 2019-10-10 08:12:51 -07:00
Kbuild
Kconfig
MAINTAINERS MAINTAINERS: Append missed file to the database 2020-01-17 19:48:28 +01:00
Makefile Linux 5.4.17 2020-02-01 09:34:53 +00:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.