A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-06 03:45:24 -04:00
Code Issues Projects Releases Packages Wiki Activity
android_kernel_motorola_sm6375/fs
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Miklos Szeredi 4177a169eb BACKPORT: fuse: fix pipe buffer lifetime for direct_io 
commit 0c4bcfdecb1ac0967619ee7ff44871d93c08c909 upstream.

In FOPEN_DIRECT_IO mode, fuse_file_write_iter() calls
fuse_direct_write_iter(), which normally calls fuse_direct_io(), which then
imports the write buffer with fuse_get_user_pages(), which uses
iov_iter_get_pages() to grab references to userspace pages instead of
actually copying memory.

On the filesystem device side, these pages can then either be read to
userspace (via fuse_dev_read()), or splice()d over into a pipe using
fuse_dev_splice_read() as pipe buffers with &nosteal_pipe_buf_ops.

This is wrong because after fuse_dev_do_read() unlocks the FUSE request,
the userspace filesystem can mark the request as completed, causing write()
to return. At that point, the userspace filesystem should no longer have
access to the pipe buffer.

Fix by copying pages coming from the user address space to new pipe
buffers.

Bug: 226679409
Reported-by: Jann Horn <jannh@google.com>
Fixes: c3021629a0 ("fuse: support splice() reading from fuse device")
Cc: <stable@vger.kernel.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I57a98e96e36bb97ce3e7b1ebf88917c6c8b0247d
2022-04-27 07:44:36 +00:00
..
9p This is the 5.4.75 stable release 2020-11-05 13:27:24 +01:00
adfs
affs fs/affs: release old buffer head on error path 2021-03-04 10:26:48 +01:00
afs This is the 5.4.150 stable release 2021-10-01 14:08:40 +02:00
autofs
befs
bfs bfs: don't use WARNING: string when it's just info. 2021-01-06 14:48:39 +01:00
btrfs This is the 5.4.178 stable release 2022-02-09 14:02:29 +01:00
cachefiles cachefiles: Handle readpage error correctly 2020-11-05 11:43:36 +01:00
ceph Merge 5.4.156 into android11-5.4-lts 2021-11-02 18:15:00 +01:00
cifs This is the 5.4.163 stable release 2021-12-01 09:41:48 +01:00
coda
configfs fsnotify: fix fsnotify hooks in pseudo filesystems 2022-02-01 17:24:34 +01:00
cramfs
crypto This is the 5.4.145 stable release 2021-09-12 09:54:40 +02:00
debugfs debugfs: lockdown: Allow reading debugfs files that are not world readable 2022-01-27 09:19:36 +01:00
devpts fsnotify: fix fsnotify hooks in pseudo filesystems 2022-02-01 17:24:34 +01:00
dlm fs: dlm: filter user dlm messages for kernel locks 2022-01-27 09:19:40 +01:00
ecryptfs This is the 5.4.122 stable release 2021-05-28 13:26:18 +02:00
efivarfs efivarfs: revert "fix memory leak in efivarfs_create()" 2020-12-02 08:49:53 +01:00
efs
erofs This is the 5.4.161 stable release 2021-11-21 15:34:05 +01:00
exportfs
ext2 This is the 5.4.152 stable release 2021-10-09 14:57:08 +02:00
ext4 BACKPORT: ext4: don't BUG if someone dirty pages without asking ext4 first 2022-04-20 12:17:22 +01:00
f2fs Merge tag 'android11-5.4.180_r00' into android11-5.4 2022-03-21 12:44:03 +01:00
fat
freevxfs
fscache fscache: Fix cookie key hashing 2021-09-22 12:26:25 +02:00
fuse BACKPORT: fuse: fix pipe buffer lifetime for direct_io 2022-04-27 07:44:36 +00:00
gfs2 This is the 5.4.164 stable release 2021-12-08 09:19:28 +01:00
hfs This is the 5.4.137 stable release 2021-07-31 09:04:18 +02:00
hfsplus This is the 5.4.120 stable release 2021-05-19 10:41:47 +02:00
hostfs hostfs: fix memory handling in follow_link() 2021-04-14 08:24:14 +02:00
hpfs
hugetlbfs hugetlbfs: fix mount mode command line processing 2021-07-28 13:31:01 +02:00
incfs ANDROID: incremental-fs: limit mount stack depth 2022-04-07 13:52:27 -07:00
iomap This is the 5.4.146 stable release 2021-09-15 14:01:16 +02:00
isofs isofs: Fix out of bound access for corrupted isofs image 2021-11-12 14:43:03 +01:00
jbd2 jbd2: fix up sparse warnings in checkpoint code 2020-11-18 19:20:30 +01:00
jffs2 This is the 5.4.174 stable release 2022-01-31 15:14:13 +01:00
jfs This is the 5.4.160 stable release 2021-11-17 10:19:21 +01:00
kernfs This is the 5.4.59 stable release 2020-08-19 08:40:57 +02:00
lockd lockd: lockd server-side shouldn't set fl_ops 2021-09-22 12:26:34 +02:00
minix Revert "ANDROID: Revert: Merge 5.4.60 into android11-5.4" 2020-08-23 13:12:51 +02:00
nfs This is the 5.4.180 stable release 2022-02-16 17:17:22 +01:00
nfs_common nfs_common: need lock during iterate through the list 2020-12-30 11:51:22 +01:00
nfsd NFSD: Fix offset type in I/O trace points 2022-02-16 12:52:47 +01:00
nilfs2 nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group 2021-09-26 14:07:13 +02:00
nls
notify ANDROID: vfs: add d_canonical_path for stacked filesystem support 2020-10-30 10:02:25 +01:00
ntfs ntfs: fix ntfs_test_inode and ntfs_init_locked_inode function type 2021-12-14 14:48:58 +01:00
ocfs2 This is the 5.4.160 stable release 2021-11-17 10:19:21 +01:00
omfs
openpromfs
orangefs This is the 5.4.173 stable release 2022-01-20 09:36:50 +01:00
overlayfs This is the 5.4.168 stable release 2021-12-22 10:08:44 +01:00
proc This is the 5.4.163 stable release 2021-12-01 09:41:48 +01:00
pstore pstore: Fix typo in compression option name 2021-03-04 10:26:45 +01:00
qnx4 qnx4: work around gcc false positive warning bug 2021-09-30 10:09:26 +02:00
qnx6
quota quota: correct error number in free_dqentry() 2021-11-17 09:48:26 +01:00
ramfs ramfs: fix nommu mmap with gaps in the page cache 2020-10-29 09:57:53 +01:00
reiserfs This is the 5.4.140 stable release 2021-08-12 14:00:44 +02:00
romfs romfs: fix uninitialized memory leak in romfs_dev_read() 2020-08-26 10:40:51 +02:00
squashfs This is the 5.4.120 stable release 2021-05-19 10:41:47 +02:00
sysfs ANDROID: GKI: hack up fs/sysfs/file.c to prevent GENKSYMS change 2021-03-08 10:09:14 +01:00
sysv
tracefs Merge tag 'android11-5.4.180_r00' into android11-5.4 2022-03-21 12:44:03 +01:00
ubifs This is the 5.4.174 stable release 2022-01-31 15:14:13 +01:00
udf udf: Fix NULL ptr deref when converting from inline format 2022-02-01 17:24:34 +01:00
ufs Revert "ANDROID: Revert: Merge 5.4.60 into android11-5.4" 2020-08-23 13:12:51 +02:00
unicode
verity This is the 5.4.151 stable release 2021-10-06 15:51:50 +02:00
xfs This is the 5.4.171 stable release 2022-01-11 15:44:37 +01:00
aio.c aio: fix use-after-free due to missing POLLFREE handling 2021-12-14 14:49:02 +01:00
anon_inodes.c
attr.c
bad_inode.c
binfmt_aout.c
binfmt_elf.c elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings 2021-10-06 15:42:35 +02:00
binfmt_elf_fdpic.c
binfmt_em86.c
binfmt_flat.c binfmt_flat: revert "binfmt_flat: don't offset the data start" 2020-09-03 11:26:39 +02:00
binfmt_misc.c binfmt_misc: fix possible deadlock in bm_register_write 2021-03-17 17:03:57 +01:00
binfmt_script.c
block_dev.c block: reexpand iov_iter after read/write 2021-05-22 11:38:29 +02:00
buffer.c This is the 5.4.75 stable release 2020-11-05 13:27:24 +01:00
char_dev.c
compat.c
compat_binfmt_elf.c
compat_ioctl.c
coredump.c coredump: fix core_pattern parse error 2020-12-11 13:23:30 +01:00
d_path.c fs: fix NULL dereference due to data race in prepend_path() 2020-10-29 09:57:45 +01:00
dax.c dax: fix ENOMEM handling in grab_mapping_entry() 2021-07-14 16:53:25 +02:00
dcache.c fix dget_parent() fastpath race 2020-10-01 13:17:19 +02:00
dcookies.c
direct-io.c This is the 5.4.112 stable release 2021-04-14 12:07:53 +02:00
drop_caches.c
eventfd.c
eventpoll.c This is the 5.4.70 stable release 2020-10-07 08:50:29 +02:00
exec.c Merge 5.4.156 into android11-5.4-lts 2021-11-02 18:15:00 +01:00
fcntl.c fcntl: fix potential deadlock for &fasync_struct.fa_lock 2021-09-15 09:47:28 +02:00
fhandle.c
file.c fget: check that the fd still exists after getting a ref to it 2021-12-08 09:01:11 +01:00
file_table.c
filesystems.c
fs-writeback.c writeback: fix obtain a reference to a freeing memcg css 2021-07-14 16:53:35 +02:00
fs_context.c memcg: charge fs_context and legacy_fs_context 2022-02-08 18:24:29 +01:00
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fsopen.c
inode.c
internal.h cgroup1: fix leaked context root causing sporadic NULL deref in LTP 2021-07-31 08:19:37 +02:00
io_uring.c UPSTREAM: io_uring: Fix current->fs handling in io_sq_wq_submit_work() 2021-08-17 17:05:36 +00:00
ioctl.c
Kconfig
Kconfig.binfmt
libfs.c This is the 5.4.80 stable release 2020-11-25 12:46:13 +01:00
locks.c
Makefile ANDROID: GKI: set vfs-only exports into their own namespace 2020-07-07 18:07:10 +02:00
mbcache.c
mount.h
mpage.c
namei.c This is the 5.4.176 stable release 2022-02-01 17:48:27 +01:00
namespace.c Linux 5.4.143 2021-08-27 22:38:57 +02:00
no-block.c
nsfs.c
open.c ANDROID: GKI: set vfs-only exports into their own namespace 2020-07-07 18:07:10 +02:00
OWNERS ANDROID: Add OWNERS files referring to the respective android-mainline OWNERS 2021-04-01 13:45:14 +00:00
pipe.c pipe: increase minimum default pipe size to 2 pages 2021-08-12 13:21:02 +02:00
pnode.c
pnode.h This is the 5.4.106 stable release 2021-03-17 17:55:32 +01:00
posix_acl.c
proc_namespace.c
read_write.c ANDROID: GKI: set vfs-only exports into their own namespace 2020-07-07 18:07:10 +02:00
readdir.c readdir: make sure to verify directory entry for legacy interfaces too 2021-04-21 12:56:16 +02:00
select.c select: Fix indefinitely sleeping task in poll_schedule_timeout() 2022-01-29 10:25:11 +01:00
seq_file.c seq_file: disallow extremely large seq buffer allocations 2021-07-20 16:10:54 +02:00
signalfd.c signalfd: use wake_up_pollfree() 2021-12-14 14:49:02 +01:00
splice.c
stack.c
stat.c ANDROID: GKI: set vfs-only exports into their own namespace 2020-07-07 18:07:10 +02:00
statfs.c
super.c devtmpfs regression fix: reconfigure on each mount 2022-01-20 09:19:17 +01:00
sync.c
timerfd.c
userfaultfd.c This is the 5.4.148 stable release 2021-09-25 14:41:58 +02:00
utimes.c
xattr.c This is the 5.4.58 stable release 2020-08-11 18:37:58 +02:00