1. 23 Jan, 2020 28 commits
  2. 22 Jan, 2020 10 commits
  3. 21 Jan, 2020 2 commits
    • Jeff Layton's avatar
      ceph: hold extra reference to r_parent over life of request · 9c1c2b35
      Jeff Layton authored
      Currently, we just assume that it will stick around by virtue of the
      submitter's reference, but later patches will allow the syscall to
      return early and we can't rely on that reference at that point.
      
      While I'm not aware of any reports of it, Xiubo pointed out that this
      may fix a use-after-free.  If the wait for a reply times out or is
      canceled via signal, and then the reply comes in after the syscall
      returns, the client can end up trying to access r_parent without a
      reference.
      
      Take an extra reference to the inode when setting r_parent and release
      it when releasing the request.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJeff Layton <jlayton@kernel.org>
      Reviewed-by: default avatar"Yan, Zheng" <zyan@redhat.com>
      Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
      9c1c2b35
    • Eugene Syromiatnikov's avatar
      io_uring: fix compat for IORING_REGISTER_FILES_UPDATE · 1292e972
      Eugene Syromiatnikov authored
      fds field of struct io_uring_files_update is problematic with regards
      to compat user space, as pointer size is different in 32-bit, 32-on-64-bit,
      and 64-bit user space.  In order to avoid custom handling of compat in
      the syscall implementation, make fds __u64 and use u64_to_user_ptr in
      order to retrieve it.  Also, align the field naturally and check that
      no garbage is passed there.
      
      Fixes: c3a31e60 ("io_uring: add support for IORING_REGISTER_FILES_UPDATE")
      Signed-off-by: default avatarEugene Syromiatnikov <esyr@redhat.com>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      1292e972