Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1505716 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2016-10-21 11:40 +0200 |
| Last post | 2016-10-23 02:00 +0200 |
| Articles | 12 — 4 participants |
Back to article view | Back to linux.kernel
[PATCH 4.8 00/57] 4.8.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:40 +0200
[PATCH 4.8 07/57] debugfs: introduce a public file_operations accessor Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:40 +0200
[PATCH 4.8 17/57] IB/hfi1: Fix defered ack race with qp destroy Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:40 +0200
[PATCH 4.8 16/57] drivers: base: dma-mapping: page align the size when unmap_kernel_range Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:40 +0200
[PATCH 4.8 22/57] fuse: fix killing s[ug]id in setattr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-21 11:40 +0200
Re: [PATCH 4.8 00/57] 4.8.4-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-10-21 17:50 +0200
Re: [PATCH 4.8 00/57] 4.8.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-22 12:00 +0200
Re: [PATCH 4.8 00/57] 4.8.4-stable review Guenter Roeck <linux@roeck-us.net> - 2016-10-21 21:20 +0200
Re: [PATCH 4.8 00/57] 4.8.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-22 12:00 +0200
Re: [PATCH 4.8 00/57] 4.8.4-stable review "Rafael J. Wysocki" <rjw@rjwysocki.net> - 2016-10-21 23:00 +0200
Re: [PATCH 4.8 00/57] 4.8.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-22 12:00 +0200
Re: [PATCH 4.8 00/57] 4.8.4-stable review "Rafael J. Wysocki" <rjw@rjwysocki.net> - 2016-10-23 02:00 +0200
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-10-21 11:40 +0200 |
| Subject | [PATCH 4.8 00/57] 4.8.4-stable review |
| Message-ID | <suEjf-3AW-3@gated-at.bofh.it> |
This is the start of the stable review cycle for the 4.8.4 release.
There are 57 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun Oct 23 09:14:19 UTC 2016.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.8.4-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.8.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 4.8.4-rc1
Glauber Costa <glauber@scylladb.com>
cfq: fix starvation of asynchronous writes
Vishal Verma <vishal.l.verma@intel.com>
acpi, nfit: check for the correct event code in notifications
Laszlo Ersek <lersek@redhat.com>
drm: virtio: reinstate drm_virtio_set_busid()
David Howells <dhowells@redhat.com>
cachefiles: Fix attempt to read i_blocks after deleting file [ver #2]
Miklos Szeredi <mszeredi@redhat.com>
vfs: move permission checking into notify_change() for utimes(NULL)
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
dlm: free workqueues after the connections
Marcelo Cerri <marcelo.cerri@canonical.com>
crypto: vmx - Fix memory corruption caused by p8_ghash
Marcelo Cerri <marcelo.cerri@canonical.com>
crypto: ghash-generic - move common definitions to a new header file
Jan Kara <jack@suse.cz>
ext4: unmap metadata when zeroing blocks
gmail <yngsion@gmail.com>
ext4: release bh in make_indexed_dir
Ross Zwisler <ross.zwisler@linux.intel.com>
ext4: allow DAX writeback for hole punch
Eric Biggers <ebiggers@google.com>
ext4: fix memory leak when symlink decryption fails
Fabian Frederick <fabf@skynet.be>
ext4: fix memory leak in ext4_insert_range()
wangguang <wang.guang55@zte.com.cn>
ext4: bugfix for mmaped pages in mpage_release_unused_pages()
Daeho Jeong <daeho.jeong@samsung.com>
ext4: reinforce check of i_dtime when clearing high fields of uid and gid
Eric Whitney <enwlinux@gmail.com>
ext4: enforce online defrag restriction for encrypted files
Jan Kara <jack@suse.cz>
jbd2: fix lockdep annotation in add_transaction_credits()
Wei Fang <fangwei1@huawei.com>
vfs,mm: fix a dead loop in truncate_inode_pages_range()
Gerald Schaefer <gerald.schaefer@de.ibm.com>
mm/hugetlb: fix memory offline with hugepage size > memory block size
Manfred Spraul <manfred@colorfullife.com>
ipc/sem.c: fix complex_count vs. simple op race
Brian King <brking@linux.vnet.ibm.com>
scsi: ibmvfc: Fix I/O hang when port is not mapped
Borislav Petkov <bp@alien8.de>
scsi: arcmsr: Simplify user_len checking
Dan Carpenter <dan.carpenter@oracle.com>
scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer()
Eric W. Biederman <ebiederm@xmission.com>
autofs: Fix automounts by using current_real_cred()->uid
Justin Maggard <jmaggard10@gmail.com>
async_pq_val: fix DMA memory leak
Mike Galbraith <efault@gmx.de>
reiserfs: Unlock superblock before calling reiserfs_quota_on_mount()
Nicolas Iooss <nicolas.iooss_linux@m4x.org>
ASoC: Intel: Atom: add a missing star in a memcpy call
John Hsu <KCHSU0@nuvoton.com>
ASoC: nau8825: fix bug in FLL parameter
Rafał Miłecki <rafal@milecki.pl>
brcmfmac: use correct skb freeing helper when deleting flowring
Rafał Miłecki <rafal@milecki.pl>
brcmfmac: fix memory leak in brcmf_fill_bss_param
Nicolas Iooss <nicolas.iooss_linux@m4x.org>
brcmfmac: fix pmksa->bssid usage
Johannes Weiner <hannes@cmpxchg.org>
mm: filemap: don't plant shadow entries without radix tree node
Dave Chinner <david@fromorbit.com>
xfs: change mailing list address
Guilherme G Piccoli <gpiccoli@linux.vnet.ibm.com>
i40e: avoid NULL pointer dereference and recursive errors on early PCI error
Johannes Weiner <hannes@cmpxchg.org>
mm: filemap: fix mapping->nrpages double accounting in fuse
Miklos Szeredi <mszeredi@redhat.com>
fuse: fix killing s[ug]id in setattr
Miklos Szeredi <mszeredi@redhat.com>
fuse: invalidate dir dentry after chmod
Miklos Szeredi <mszeredi@redhat.com>
fuse: listxattr: verify xattr list
Marcin Wojtas <mw@semihalf.com>
clk: mvebu: dynamically allocate resources in Armada CP110 system controller
Marcin Wojtas <mw@semihalf.com>
clk: mvebu: fix setting unwanted flags in CP110 gate clock
Mike Marciniszyn <mike.marciniszyn@intel.com>
IB/hfi1: Fix defered ack race with qp destroy
Peng Fan <van.freenix@gmail.com>
drivers: base: dma-mapping: page align the size when unmap_kernel_range
Alexander Usyskin <alexander.usyskin@intel.com>
mei: amthif: fix deadlock in initialization during a reset
Junjie Mao <junjie.mao@enight.me>
btrfs: assign error values to the correct bio structs
Omar Sandoval <osandov@fb.com>
Btrfs: catch invalid free space trees
Omar Sandoval <osandov@fb.com>
Btrfs: fix mount -o clear_cache,space_cache=v2
Omar Sandoval <osandov@fb.com>
Btrfs: fix free space tree bitmaps on big-endian systems
Christian Lamparter <chunkeey@googlemail.com>
carl9170: fix debugfs crashes
Christian Lamparter <chunkeey@googlemail.com>
b43legacy: fix debugfs crash
Christian Lamparter <chunkeey@googlemail.com>
b43: fix debugfs crash
Christian Lamparter <chunkeey@googlemail.com>
debugfs: introduce a public file_operations accessor
Vineet Gupta <vgupta@synopsys.com>
ARCv2: fix local_save_flags
Yuriy Kolerov <yuriy.kolerov@synopsys.com>
ARCv2: intc: Use kflag if STATUS32.IE must be reset
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
serial: 8250_port: fix runtime PM use in __do_stop_tx_rs485()
Kefeng Wang <wangkefeng.wang@huawei.com>
serial: 8250_dw: Check the data->pclk when get apb_pclk
Richard Genoud <richard.genoud@gmail.com>
BUG: atmel_serial: Interrupts not disabled on close
Sascha Hauer <s.hauer@pengutronix.de>
serial: imx: Fix DCD reading
-------------
Diffstat:
MAINTAINERS | 7 +-
Makefile | 4 +-
arch/arc/include/asm/irqflags-arcv2.h | 2 +-
arch/arc/kernel/intc-arcv2.c | 2 +-
block/cfq-iosched.c | 13 +-
crypto/async_tx/async_pq.c | 8 +-
crypto/ghash-generic.c | 13 +-
drivers/acpi/nfit/core.c | 3 +
drivers/acpi/nfit/nfit.h | 4 +
drivers/base/dma-mapping.c | 2 +-
drivers/clk/mvebu/cp110-system-controller.c | 31 +++--
drivers/crypto/vmx/ghash.c | 31 ++---
drivers/gpu/drm/virtio/virtgpu_drm_bus.c | 10 ++
drivers/gpu/drm/virtio/virtgpu_drv.c | 1 +
drivers/gpu/drm/virtio/virtgpu_drv.h | 1 +
drivers/infiniband/hw/hfi1/rc.c | 5 +-
drivers/misc/mei/amthif.c | 12 +-
drivers/misc/mei/bus.c | 2 -
drivers/net/ethernet/intel/i40e/i40e_main.c | 6 +
drivers/net/wireless/ath/carl9170/debug.c | 6 +-
drivers/net/wireless/broadcom/b43/debugfs.c | 6 +-
drivers/net/wireless/broadcom/b43legacy/debugfs.c | 6 +-
.../broadcom/brcm80211/brcmfmac/cfg80211.c | 9 +-
.../broadcom/brcm80211/brcmfmac/flowring.c | 9 +-
drivers/scsi/arcmsr/arcmsr_hba.c | 12 +-
drivers/scsi/ibmvscsi/ibmvfc.c | 1 -
drivers/tty/serial/8250/8250_dw.c | 2 +-
drivers/tty/serial/8250/8250_port.c | 11 +-
drivers/tty/serial/atmel_serial.c | 5 +-
drivers/tty/serial/imx.c | 3 +-
fs/attr.c | 15 +++
fs/autofs4/waitq.c | 4 +-
fs/btrfs/compression.c | 4 +-
fs/btrfs/ctree.h | 3 +-
fs/btrfs/disk-io.c | 33 +++--
fs/btrfs/extent_io.c | 64 +++++++---
fs/btrfs/extent_io.h | 22 ++++
fs/btrfs/free-space-tree.c | 19 +--
fs/cachefiles/interface.c | 8 +-
fs/cachefiles/internal.h | 3 +-
fs/cachefiles/namei.c | 8 +-
fs/debugfs/file.c | 13 +-
fs/dlm/lowcomms.c | 8 +-
fs/ext4/extents.c | 3 +
fs/ext4/inode.c | 24 ++--
fs/ext4/move_extent.c | 7 ++
fs/ext4/namei.c | 14 +--
fs/ext4/symlink.c | 3 +-
fs/fuse/dir.c | 59 ++++++++-
fs/jbd2/transaction.c | 6 +-
fs/reiserfs/super.c | 12 +-
fs/utimes.c | 17 +--
include/crypto/ghash.h | 23 ++++
include/linux/debugfs.h | 17 +++
include/linux/fs.h | 1 +
include/linux/radix-tree.h | 6 +-
include/linux/sem.h | 1 +
include/uapi/linux/btrfs.h | 12 +-
ipc/sem.c | 138 +++++++++++++--------
lib/radix-tree.c | 14 +--
mm/filemap.c | 51 +++++---
mm/hugetlb.c | 13 +-
sound/soc/codecs/nau8825.c | 2 +-
sound/soc/intel/atom/sst/sst_pvt.c | 14 +--
64 files changed, 581 insertions(+), 287 deletions(-)
[toc] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-10-21 11:40 +0200 |
| Subject | [PATCH 4.8 07/57] debugfs: introduce a public file_operations accessor |
| Message-ID | <suEsX-3Ew-63@gated-at.bofh.it> |
| In reply to | #1505716 |
4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Lamparter <chunkeey@googlemail.com>
commit 86f0e06767dda7863d6d2a8f0b3b857e6ea876a0 upstream.
This patch introduces an accessor which can be used
by the users of debugfs (drivers, fs, ...) to get the
original file_operations struct. It also removes the
REAL_FOPS_DEREF macro in file.c and converts the code
to use the public version.
Previously, REAL_FOPS_DEREF was only available within
the file.c of debugfs. But having a public getter
available for debugfs users is important as some
drivers (carl9170 and b43) use the pointer of the
original file_operations in conjunction with container_of()
within their debugfs implementations.
Reviewed-by: Nicolai Stange <nicstange@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/debugfs/file.c | 13 +++++--------
include/linux/debugfs.h | 17 +++++++++++++++++
2 files changed, 22 insertions(+), 8 deletions(-)
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -97,9 +97,6 @@ EXPORT_SYMBOL_GPL(debugfs_use_file_finis
#define F_DENTRY(filp) ((filp)->f_path.dentry)
-#define REAL_FOPS_DEREF(dentry) \
- ((const struct file_operations *)(dentry)->d_fsdata)
-
static int open_proxy_open(struct inode *inode, struct file *filp)
{
const struct dentry *dentry = F_DENTRY(filp);
@@ -112,7 +109,7 @@ static int open_proxy_open(struct inode
goto out;
}
- real_fops = REAL_FOPS_DEREF(dentry);
+ real_fops = debugfs_real_fops(filp);
real_fops = fops_get(real_fops);
if (!real_fops) {
/* Huh? Module did not clean up after itself at exit? */
@@ -143,7 +140,7 @@ static ret_type full_proxy_ ## name(prot
{ \
const struct dentry *dentry = F_DENTRY(filp); \
const struct file_operations *real_fops = \
- REAL_FOPS_DEREF(dentry); \
+ debugfs_real_fops(filp); \
int srcu_idx; \
ret_type r; \
\
@@ -176,7 +173,7 @@ static unsigned int full_proxy_poll(stru
struct poll_table_struct *wait)
{
const struct dentry *dentry = F_DENTRY(filp);
- const struct file_operations *real_fops = REAL_FOPS_DEREF(dentry);
+ const struct file_operations *real_fops = debugfs_real_fops(filp);
int srcu_idx;
unsigned int r = 0;
@@ -193,7 +190,7 @@ static unsigned int full_proxy_poll(stru
static int full_proxy_release(struct inode *inode, struct file *filp)
{
const struct dentry *dentry = F_DENTRY(filp);
- const struct file_operations *real_fops = REAL_FOPS_DEREF(dentry);
+ const struct file_operations *real_fops = debugfs_real_fops(filp);
const struct file_operations *proxy_fops = filp->f_op;
int r = 0;
@@ -241,7 +238,7 @@ static int full_proxy_open(struct inode
goto out;
}
- real_fops = REAL_FOPS_DEREF(dentry);
+ real_fops = debugfs_real_fops(filp);
real_fops = fops_get(real_fops);
if (!real_fops) {
/* Huh? Module did not cleanup after itself at exit? */
--- a/include/linux/debugfs.h
+++ b/include/linux/debugfs.h
@@ -45,6 +45,23 @@ extern struct dentry *arch_debugfs_dir;
extern struct srcu_struct debugfs_srcu;
+/**
+ * debugfs_real_fops - getter for the real file operation
+ * @filp: a pointer to a struct file
+ *
+ * Must only be called under the protection established by
+ * debugfs_use_file_start().
+ */
+static inline const struct file_operations *debugfs_real_fops(struct file *filp)
+ __must_hold(&debugfs_srcu)
+{
+ /*
+ * Neither the pointer to the struct file_operations, nor its
+ * contents ever change -- srcu_dereference() is not needed here.
+ */
+ return filp->f_path.dentry->d_fsdata;
+}
+
#if defined(CONFIG_DEBUG_FS)
struct dentry *debugfs_create_file(const char *name, umode_t mode,
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-10-21 11:40 +0200 |
| Subject | [PATCH 4.8 17/57] IB/hfi1: Fix defered ack race with qp destroy |
| Message-ID | <suEsX-3Ew-67@gated-at.bofh.it> |
| In reply to | #1505716 |
4.8-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mike Marciniszyn <mike.marciniszyn@intel.com> commit 72f53af2651957b0b9d6dead72a393eaf9a2c3be upstream. There is a a bug in defered ack stuff that causes a race with the destroy of a QP. A packet causes a defered ack to be pended by putting the QP into an rcd queue. A return from the driver interrupt processing will process that rcd queue of QPs and attempt to do a direct send of the ack. At this point no locks are held and the above QP could now be put in the reset state in the qp destroy logic. A refcount protects the QP while it is in the rcd queue so it isn't going anywhere yet. If the direct send fails to allocate a pio buffer, hfi1_schedule_send() is called to trigger sending an ack from the send engine. There is no state test in that code path. The refcount is then dropped from the driver.c caller potentially allowing the qp destroy to continue from its refcount wait in parallel with the workqueue scheduling of the qp. Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/infiniband/hw/hfi1/rc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/drivers/infiniband/hw/hfi1/rc.c +++ b/drivers/infiniband/hw/hfi1/rc.c @@ -932,8 +932,10 @@ void hfi1_send_rc_ack(struct hfi1_ctxtda return; queue_ack: - this_cpu_inc(*ibp->rvp.rc_qacks); spin_lock_irqsave(&qp->s_lock, flags); + if (!(ib_rvt_state_ops[qp->state] & RVT_PROCESS_RECV_OK)) + goto unlock; + this_cpu_inc(*ibp->rvp.rc_qacks); qp->s_flags |= RVT_S_ACK_PENDING | RVT_S_RESP_PENDING; qp->s_nak_state = qp->r_nak_state; qp->s_ack_psn = qp->r_ack_psn; @@ -942,6 +944,7 @@ queue_ack: /* Schedule the send tasklet. */ hfi1_schedule_send(qp); +unlock: spin_unlock_irqrestore(&qp->s_lock, flags); }
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-10-21 11:40 +0200 |
| Subject | [PATCH 4.8 16/57] drivers: base: dma-mapping: page align the size when unmap_kernel_range |
| Message-ID | <suEsX-3Ew-69@gated-at.bofh.it> |
| In reply to | #1505716 |
4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <van.freenix@gmail.com>
commit 85714108e673cdebf1b96abfd50fb02a29e37577 upstream.
When dma_common_free_remap, the input parameter 'size' may not
be page aligned. And, met kernel warning when doing iommu dma
for usb on i.MX8 platform:
"
WARNING: CPU: 0 PID: 869 at mm/vmalloc.c:70 vunmap_page_range+0x1cc/0x1d0()
Modules linked in:
CPU: 0 PID: 869 Comm: kworker/u8:2 Not tainted 4.1.12-00444-gc5f9d1d-dirty #147
Hardware name: Freescale i.MX8DV Sabreauto (DT)
Workqueue: ci_otg ci_otg_work
Call trace:
[<ffffffc000089920>] dump_backtrace+0x0/0x124
[<ffffffc000089a54>] show_stack+0x10/0x1c
[<ffffffc0006d1e6c>] dump_stack+0x84/0xc8
[<ffffffc0000b4568>] warn_slowpath_common+0x98/0xd0
[<ffffffc0000b4664>] warn_slowpath_null+0x14/0x20
[<ffffffc000170348>] vunmap_page_range+0x1c8/0x1d0
[<ffffffc000170388>] unmap_kernel_range+0x20/0x88
[<ffffffc000460ad0>] dma_common_free_remap+0x74/0x84
[<ffffffc0000940d8>] __iommu_free_attrs+0x9c/0x178
[<ffffffc0005032bc>] ehci_mem_cleanup+0x140/0x194
[<ffffffc000503548>] ehci_stop+0x8c/0xdc
[<ffffffc0004e8258>] usb_remove_hcd+0xf0/0x1cc
[<ffffffc000516bc0>] host_stop+0x1c/0x58
[<ffffffc000514240>] ci_otg_work+0xdc/0x120
[<ffffffc0000c9c34>] process_one_work+0x134/0x33c
[<ffffffc0000c9f78>] worker_thread+0x13c/0x47c
[<ffffffc0000cf43c>] kthread+0xd8/0xf0
"
For dma_common_pages_remap:
dma_common_pages_remap
|->get_vm_area_caller
|->__get_vm_area_node
|->size = PAGE_ALIGN(size); Round up to page aligned
So, in dma_common_free_remap, we also need a page aligned size,
pass 'PAGE_ALIGN(size)' to unmap_kernel_range.
Signed-off-by: Peng Fan <van.freenix@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/dma-mapping.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/base/dma-mapping.c
+++ b/drivers/base/dma-mapping.c
@@ -334,7 +334,7 @@ void dma_common_free_remap(void *cpu_add
return;
}
- unmap_kernel_range((unsigned long)cpu_addr, size);
+ unmap_kernel_range((unsigned long)cpu_addr, PAGE_ALIGN(size));
vunmap(cpu_addr);
}
#endif
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-10-21 11:40 +0200 |
| Subject | [PATCH 4.8 22/57] fuse: fix killing s[ug]id in setattr |
| Message-ID | <suEsX-3Ew-71@gated-at.bofh.it> |
| In reply to | #1505716 |
4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@redhat.com>
commit a09f99eddef44035ec764075a37bace8181bec38 upstream.
Fuse allowed VFS to set mode in setattr in order to clear suid/sgid on
chown and truncate, and (since writeback_cache) write. The problem with
this is that it'll potentially restore a stale mode.
The poper fix would be to let the filesystems do the suid/sgid clearing on
the relevant operations. Possibly some are already doing it but there's no
way we can detect this.
So fix this by refreshing and recalculating the mode. Do this only if
ATTR_KILL_S[UG]ID is set to not destroy performance for writes. This is
still racy but the size of the window is reduced.
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/dir.c | 32 ++++++++++++++++++++++++++++----
1 file changed, 28 insertions(+), 4 deletions(-)
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -1702,16 +1702,40 @@ error:
static int fuse_setattr(struct dentry *entry, struct iattr *attr)
{
struct inode *inode = d_inode(entry);
+ struct file *file = (attr->ia_valid & ATTR_FILE) ? attr->ia_file : NULL;
int ret;
if (!fuse_allow_current_process(get_fuse_conn(inode)))
return -EACCES;
- if (attr->ia_valid & ATTR_FILE)
- ret = fuse_do_setattr(inode, attr, attr->ia_file);
- else
- ret = fuse_do_setattr(inode, attr, NULL);
+ if (attr->ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID)) {
+ int kill;
+ attr->ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID |
+ ATTR_MODE);
+ /*
+ * ia_mode calculation may have used stale i_mode. Refresh and
+ * recalculate.
+ */
+ ret = fuse_do_getattr(inode, NULL, file);
+ if (ret)
+ return ret;
+
+ attr->ia_mode = inode->i_mode;
+ kill = should_remove_suid(entry);
+ if (kill & ATTR_KILL_SUID) {
+ attr->ia_valid |= ATTR_MODE;
+ attr->ia_mode &= ~S_ISUID;
+ }
+ if (kill & ATTR_KILL_SGID) {
+ attr->ia_valid |= ATTR_MODE;
+ attr->ia_mode &= ~S_ISGID;
+ }
+ }
+ if (!attr->ia_valid)
+ return 0;
+
+ ret = fuse_do_setattr(inode, attr, file);
if (!ret) {
/* Directory mode changed, may need to revalidate access */
if (d_is_dir(entry) && (attr->ia_valid & ATTR_MODE))
[toc] | [prev] | [next] | [standalone]
| From | Shuah Khan <shuah.kh@samsung.com> |
|---|---|
| Date | 2016-10-21 17:50 +0200 |
| Message-ID | <suKeZ-7AT-7@gated-at.bofh.it> |
| In reply to | #1505716 |
On 10/21/2016 03:17 AM, Greg Kroah-Hartman wrote: > This is the start of the stable review cycle for the 4.8.4 release. > There are 57 patches in this series, all will be posted as a response > to this one. If anyone has any issues with these being applied, please > let me know. > > Responses should be made by Sun Oct 23 09:14:19 UTC 2016. > Anything received after that time might be too late. > > The whole patch series can be found in one patch at: > kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.8.4-rc1.gz > or in the git tree and branch at: > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.8.y > and the diffstat can be found below. > > thanks, > > greg k-h > Compiled and booted on my test system. No dmesg regressions. thanks, -- Shuah -- Shuah Khan Sr. Linux Kernel Developer Open Source Innovation Group Samsung Research America(Silicon Valley) shuah.kh@samsung.com
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-10-22 12:00 +0200 |
| Message-ID | <sv1fP-1I3-15@gated-at.bofh.it> |
| In reply to | #1506091 |
On Fri, Oct 21, 2016 at 09:46:15AM -0600, Shuah Khan wrote: > On 10/21/2016 03:17 AM, Greg Kroah-Hartman wrote: > > This is the start of the stable review cycle for the 4.8.4 release. > > There are 57 patches in this series, all will be posted as a response > > to this one. If anyone has any issues with these being applied, please > > let me know. > > > > Responses should be made by Sun Oct 23 09:14:19 UTC 2016. > > Anything received after that time might be too late. > > > > The whole patch series can be found in one patch at: > > kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.8.4-rc1.gz > > or in the git tree and branch at: > > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.8.y > > and the diffstat can be found below. > > > > thanks, > > > > greg k-h > > > > Compiled and booted on my test system. No dmesg regressions. Thanks again for testing all of these kernels and letting me know. greg k-h
[toc] | [prev] | [next] | [standalone]
| From | Guenter Roeck <linux@roeck-us.net> |
|---|---|
| Date | 2016-10-21 21:20 +0200 |
| Message-ID | <suNwe-1sv-23@gated-at.bofh.it> |
| In reply to | #1505716 |
On Fri, Oct 21, 2016 at 11:17:23AM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.8.4 release.
> There are 57 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Oct 23 09:14:19 UTC 2016.
> Anything received after that time might be too late.
>
Build results:
total: 149 pass: 149 fail: 0
Qemu test results:
total: 110 pass: 110 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-10-22 12:00 +0200 |
| Message-ID | <sv1fP-1I3-7@gated-at.bofh.it> |
| In reply to | #1506245 |
On Fri, Oct 21, 2016 at 12:17:48PM -0700, Guenter Roeck wrote: > On Fri, Oct 21, 2016 at 11:17:23AM +0200, Greg Kroah-Hartman wrote: > > This is the start of the stable review cycle for the 4.8.4 release. > > There are 57 patches in this series, all will be posted as a response > > to this one. If anyone has any issues with these being applied, please > > let me know. > > > > Responses should be made by Sun Oct 23 09:14:19 UTC 2016. > > Anything received after that time might be too late. > > > Build results: > total: 149 pass: 149 fail: 0 > Qemu test results: > total: 110 pass: 110 fail: 0 > > Details are available at http://kerneltests.org/builders. Thanks for testing all of these and letting me know. greg k-h
[toc] | [prev] | [next] | [standalone]
| From | "Rafael J. Wysocki" <rjw@rjwysocki.net> |
|---|---|
| Date | 2016-10-21 23:00 +0200 |
| Message-ID | <suP50-2kf-11@gated-at.bofh.it> |
| In reply to | #1505716 |
On Friday, October 21, 2016 11:17:23 AM Greg Kroah-Hartman wrote: > This is the start of the stable review cycle for the 4.8.4 release. > There are 57 patches in this series, all will be posted as a response > to this one. If anyone has any issues with these being applied, please > let me know. > > Responses should be made by Sun Oct 23 09:14:19 UTC 2016. > Anything received after that time might be too late. Please also add commit c6fe46a79ecd "cpufreq: fix overflow in cpufreq_table_find_index_dl()" to this series. This is needed to fix a regression in an earlier somewhat broken fix that went into previous 4.8.y unfortunately. Thanks, Rafael
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-10-22 12:00 +0200 |
| Message-ID | <sv1fP-1I3-17@gated-at.bofh.it> |
| In reply to | #1506284 |
On Fri, Oct 21, 2016 at 11:02:13PM +0200, Rafael J. Wysocki wrote: > On Friday, October 21, 2016 11:17:23 AM Greg Kroah-Hartman wrote: > > This is the start of the stable review cycle for the 4.8.4 release. > > There are 57 patches in this series, all will be posted as a response > > to this one. If anyone has any issues with these being applied, please > > let me know. > > > > Responses should be made by Sun Oct 23 09:14:19 UTC 2016. > > Anything received after that time might be too late. > > Please also add commit c6fe46a79ecd "cpufreq: fix overflow in > cpufreq_table_find_index_dl()" to this series. > > This is needed to fix a regression in an earlier somewhat broken fix that went > into previous 4.8.y unfortunately. Really? It doesn't apply to 4.8-stable at all. I haven't applied 899bb6642f2a2f2cd3f77abd6c5a14550e3b37e6 to the 4.8-stable tree yet, so why should I add it at this point in time? confused, greg k-h
[toc] | [prev] | [next] | [standalone]
| From | "Rafael J. Wysocki" <rjw@rjwysocki.net> |
|---|---|
| Date | 2016-10-23 02:00 +0200 |
| Message-ID | <svemJ-1CH-21@gated-at.bofh.it> |
| In reply to | #1506483 |
On Saturday, October 22, 2016 11:58:51 AM Greg Kroah-Hartman wrote: > On Fri, Oct 21, 2016 at 11:02:13PM +0200, Rafael J. Wysocki wrote: > > On Friday, October 21, 2016 11:17:23 AM Greg Kroah-Hartman wrote: > > > This is the start of the stable review cycle for the 4.8.4 release. > > > There are 57 patches in this series, all will be posted as a response > > > to this one. If anyone has any issues with these being applied, please > > > let me know. > > > > > > Responses should be made by Sun Oct 23 09:14:19 UTC 2016. > > > Anything received after that time might be too late. > > > > Please also add commit c6fe46a79ecd "cpufreq: fix overflow in > > cpufreq_table_find_index_dl()" to this series. > > > > This is needed to fix a regression in an earlier somewhat broken fix that went > > into previous 4.8.y unfortunately. > > Really? It doesn't apply to 4.8-stable at all. I haven't applied > 899bb6642f2a2f2cd3f77abd6c5a14550e3b37e6 to the 4.8-stable tree yet, OK In that case please make sure that it doesn't go in without c6fe46a79ecd. > so why should I add it at this point in time? Clearly, no need. :-) Thanks, Rafael
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web