Filipe Manana
b85c64a716
btrfs: fix wrong address when faulting in pages in the search ioctl ...
commit 1c78544eaa4660096aeb6a57ec82b42cdb3bfe5a upstream.
When faulting in the pages for the user supplied buffer for the search
ioctl, we are passing only the base address of the buffer to the function
fault_in_pages_writeable(). This means that after the first iteration of
the while loop that searches for leaves, when we have a non-zero offset,
stored in 'sk_offset', we try to fault in a wrong page range.
So fix this by adding the offset in 'sk_offset' to the base address of the
user supplied buffer when calling fault_in_pages_writeable().
Several users have reported that the applications compsize and bees have
started to operate incorrectly since commit a48b73eca4ceb9 ("btrfs: fix
potential deadlock in the search ioctl") was added to stable trees, and
these applications make heavy use of the search ioctls. This fixes their
issues.
Link: https://lore.kernel.org/linux-btrfs/632b888d-a3c3-b085-cdf5-f9bb61017d92@lechevalier.se/
Link: https://github.com/kilobyte/compsize/issues/34
Fixes: a48b73eca4ceb9 ("btrfs: fix potential deadlock in the search ioctl")
CC: stable@vger.kernel.org # 4.4+
Tested-by: A L <mail@lechevalier.se>
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-17 13:47:52 +02:00
9p: Fix memory leak in v9fs_mount
2020-08-19 08:16:24 +02:00
affs: fix basic permission bits to actually work
2020-09-09 19:12:34 +02:00
rxrpc: Make rxrpc_kernel_get_srtt() indicate validity
2020-09-09 19:12:23 +02:00
btrfs: fix wrong address when faulting in pages in the search ioctl
2020-09-17 13:47:52 +02:00
cachefiles: Fix race between read_waiter and read_copier involving op->to_do
2020-06-03 08:21:11 +02:00
ceph: don't allow setlease on cephfs
2020-09-09 19:12:21 +02:00
cifs: Fix leak when handling lease break for cached root fid
2020-08-21 13:05:24 +02:00
configfs: fix config_item refcnt leak in configfs_rmdir()
2020-05-27 17:46:30 +02:00
fscrypt: don't evict dirty inodes after removing key
2020-03-18 07:17:53 +01:00
debugfs: Check module state before warning in {full/open}_proxy_open()
2020-04-17 10:50:02 +02:00
dlm: Fix kobject memleak
2020-08-19 08:16:21 +02:00
ecryptfs: replace BUG_ON with error handling code
2020-02-28 17:22:26 +01:00
erofs: fix extended inode could cross boundary
2020-08-19 08:16:26 +02:00
ext2: don't update mtime on COW faults
2020-09-09 19:12:30 +02:00
fs: prevent BUG_ON in submit_bh_wbc()
2020-09-03 11:26:57 +02:00
f2fs: fix use-after-free issue
2020-09-03 11:26:46 +02:00
fat: don't allow to mount if the FAT length == 0
2020-06-17 16:40:36 +02:00
fuse: fix weird page warning
2020-07-29 10:18:28 +02:00
gfs2: Never call gfs2_block_zero_range with an open transaction
2020-08-26 10:40:48 +02:00
hfsplus: fix crash and filesystem corruption when deleting files
2020-04-17 10:50:22 +02:00
hugetlbfs: prevent filesystem stacking of hugetlbfs
2020-09-03 11:26:48 +02:00
jbd2: abort journal if free a async write error metadata buffer
2020-09-03 11:26:56 +02:00
jffs2: fix UAF problem
2020-08-26 10:40:56 +02:00
kernfs: do not call fsnotify() with name without a parent
2020-08-19 08:16:12 +02:00
fs/minix: remove expected error message in block_to_path()
2020-08-21 13:05:37 +02:00
nfs: Fix getxattr kernel panic and memory overflow
2020-08-21 13:05:37 +02:00
nfsd: Fix NFSv4 READ on RDMA when using readv
2020-08-11 15:33:42 +02:00
nilfs2: fix null pointer dereference at nilfs_segctor_do_construct()
2020-06-17 16:40:29 +02:00
fanotify: fix ignore mask logic for events on child and on dir
2020-06-17 16:40:24 +02:00
utimes: Clamp the timestamps in notify_change()
2020-02-11 04:35:12 -08:00
ocfs2: change slot number type s16 to u16
2020-08-21 13:05:26 +02:00
orangefs: get rid of knob code...
2020-08-21 13:05:29 +02:00
ovl: fix unneeded call to ovl_change_flags()
2020-07-22 09:33:12 +02:00
proc: Use new_inode not new_inode_pseudo
2020-06-17 16:40:33 +02:00
pstore: Fix linking when crypto API disabled
2020-08-19 08:16:27 +02:00
reiserfs: prevent NULL pointer dereference in reiserfs_insert_item()
2020-02-24 08:37:00 +01:00
romfs: fix uninitialized memory leak in romfs_dev_read()
2020-08-26 10:40:51 +02:00
ubifs: Fix wrong orphan node deletion in ubifs_jnl_update|rename
2020-08-21 13:05:35 +02:00
udf: Fix free space reporting for metadata and virtual partitions
2020-02-24 08:36:44 +01:00
fs/ufs: avoid potential u32 multiplication overflow
2020-08-21 13:05:37 +02:00
xfs: initialize the shortform attr header padding entry
2020-09-17 13:47:46 +02:00
aio: fix async fsync creds
2020-06-17 16:40:24 +02:00
utimes: Clamp the timestamps in notify_change()
2020-02-11 04:35:12 -08:00
fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
2020-06-03 08:21:27 +02:00
binfmt_flat: revert "binfmt_flat: don't offset the data start"
2020-09-03 11:26:39 +02:00
block: Fix use-after-free in blkdev_get()
2020-06-24 17:50:47 +02:00
fs: prevent BUG_ON in submit_bh_wbc()
2020-09-03 11:26:57 +02:00
coredump: fix crash when umh is disabled
2020-05-14 07:58:27 +02:00
dax: pass NOWAIT flag to iomap_apply
2020-03-05 16:43:36 +01:00
eventfd: track eventfd_signal() recursion depth
2020-02-11 04:35:37 -08:00
fix regression in "epoll: Keep a reference on files added to the check list"
2020-09-09 19:12:28 +02:00
exec: Move would_dump into flush_old_exec
2020-05-20 08:20:34 +02:00
fix multiplication overflow in copy_fdtable()
2020-05-27 17:46:12 +02:00
fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()
2020-04-17 10:50:21 +02:00
writeback: Fix sync livelock due to b_dirty_time processing
2020-09-03 11:27:04 +02:00
futex: Fix inode life-time issue
2020-03-25 08:25:58 +01:00
io_uring: Fix NULL pointer dereference in io_sq_wq_submit_work()
2020-09-03 11:27:11 +02:00
libfs: fix infoleak in simple_attr_read()
2020-04-01 11:02:17 +02:00
locks: reinstate locks_delete_block optimization
2020-03-25 08:25:41 +01:00
namei: only return -ECHILD from follow_dotdot_rcu()
2020-03-05 16:43:48 +01:00
cifs_atomic_open(): fix double-put on late allocation failure
2020-03-18 07:17:51 +01:00
propagate_one(): mnt_set_mountpoint() needs mount_lock
2020-05-02 08:48:44 +02:00
fs: allow deduplication of eof block into the end of the destination file
2020-02-11 04:35:23 -08:00
fs/signalfd.c: fix inconsistent return codes for signalfd4
2020-08-26 10:40:58 +02:00
Fix use after free in get_tree_bdev()
2020-05-06 08:15:15 +02:00
utimes: Clamp the timestamps in notify_change()
2020-02-11 04:35:12 -08:00
xattr: break delegations in {set,remove}xattr
2020-08-11 15:33:39 +02:00
b85c64a716