Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1599091

[PATCH 4.4 35/36] fat: fix using uninitialized fields of fat_inode/fsinfo_inode

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>

commit c0d0e351285161a515396b7b1ee53ec9ffd97e3c upstream.

Recently fallocate patch was merged and it uses
MSDOS_I(inode)->mmu_private at fat_evict_inode().  However,
fat_inode/fsinfo_inode that was introduced in past didn't initialize
MSDOS_I(inode) properly.

With those combinations, it became the cause of accessing random entry
in FAT area.

Link: http://lkml.kernel.org/r/87pohrj4i8.fsf@mail.parknet.co.jp
Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Reported-by: Moreno Bartalucci <moreno.bartalucci@tecnorama.it>
Tested-by: Moreno Bartalucci <moreno.bartalucci@tecnorama.it>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/fat/inode.c |   13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -1269,6 +1269,16 @@ out:
 	return 0;
 }
 
+static void fat_dummy_inode_init(struct inode *inode)
+{
+	/* Initialize this dummy inode to work as no-op. */
+	MSDOS_I(inode)->mmu_private = 0;
+	MSDOS_I(inode)->i_start = 0;
+	MSDOS_I(inode)->i_logstart = 0;
+	MSDOS_I(inode)->i_attrs = 0;
+	MSDOS_I(inode)->i_pos = 0;
+}
+
 static int fat_read_root(struct inode *inode)
 {
 	struct msdos_sb_info *sbi = MSDOS_SB(inode->i_sb);
@@ -1713,12 +1723,13 @@ int fat_fill_super(struct super_block *s
 	fat_inode = new_inode(sb);
 	if (!fat_inode)
 		goto out_fail;
-	MSDOS_I(fat_inode)->i_pos = 0;
+	fat_dummy_inode_init(fat_inode);
 	sbi->fat_inode = fat_inode;
 
 	fsinfo_inode = new_inode(sb);
 	if (!fsinfo_inode)
 		goto out_fail;
+	fat_dummy_inode_init(fsinfo_inode);
 	fsinfo_inode->i_ino = MSDOS_FSINFO_INO;
 	sbi->fsinfo_inode = fsinfo_inode;
 	insert_inode_hash(fsinfo_inode);

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/36] 4.4.54-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 09:50 +0100
  [PATCH 4.4 18/36] ktest: Fix child exit code processing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 09:50 +0100
  [PATCH 4.4 11/36] s390: use correct input data address for setup_randomness Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 09:50 +0100
  [PATCH 4.4 27/36] drm/ast: Call open_key before enable_mmio in POST code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 09:50 +0100
  [PATCH 4.4 05/36] KVM: VMX: use correct vmcs_read/write for guest segment selector/base Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 09:50 +0100
  [PATCH 4.4 31/36] drm/atomic: fix an error code in mode_fixup() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:20 +0100
  [PATCH 4.4 35/36] fat: fix using uninitialized fields of fat_inode/fsinfo_inode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:20 +0100
  [PATCH 4.4 08/36] s390/dcssblk: fix device size calculation in dcssblk_direct_access() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:20 +0100
  [PATCH 4.4 07/36] s390/qdio: clear DSCI prior to scanning multiple input queues Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:20 +0100
  [PATCH 4.4 04/36] KVM: s390: Disable dirty log retrieval for UCONTROL guests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:20 +0100
  [PATCH 4.4 36/36] drivers: hv: Turn off write permission on the hypercall page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:20 +0100
  [PATCH 4.4 34/36] libceph: use BUG() instead of BUG_ON(1) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:20 +0100
  [PATCH 4.4 23/36] xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:30 +0100
  [PATCH 4.4 22/36] pwm: pca9685: Fix period change with same duty cycle Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:30 +0100
  [PATCH 4.4 19/36] ceph: remove req from unsafe list when unregistering it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:30 +0100
  [PATCH 4.4 26/36] drm/ast: Fix test for VGA enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:30 +0100
  [PATCH 4.4 17/36] IB/srp: Fix race conditions related to task management Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:30 +0100
  [PATCH 4.4 15/36] IB/IPoIB: Add destination address when re-queue packet Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:30 +0100
  [PATCH 4.4 32/36] fakelb: fix schedule while atomic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:30 +0100
  [PATCH 4.4 21/36] nlm: Ensure callback code also checks that the files match Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:30 +0100
  [PATCH 4.4 13/36] mnt: Tuck mounts under others instead of creating shadow/side mounts. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:30 +0100
  [PATCH 4.4 20/36] target: Fix NULL dereference during LUN lookup + active I/O shutdown Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:30 +0100
  [PATCH 4.4 24/36] mac80211: flush delayed work when entering suspend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:30 +0100
  [PATCH 4.4 12/36] net: mvpp2: fix DMA address calculation in mvpp2_txq_inc_put() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:30 +0100
  [PATCH 4.4 10/36] s390: make setup_randomness work Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-13 10:30 +0100
  Re: [PATCH 4.4 00/36] 4.4.54-stable review Guenter Roeck <linux@roeck-us.net> - 2017-03-13 23:40 +0100

csiph-web