kernel/git/stable/linux-stable.git/fs, branch linux-2.6.15.y

[PATCH] Fix ext2 readdir f_pos re-validation logic

2006-03-28T07:00:23+00:00

This fixes not one, but _two_, silly (but admittedly hard to hit) bugs in the ext2 filesystem "readdir()" function. It also cleans up the code to avoid the unnecessary goto mess. The bugs were related to re-valiating the f_pos value after somebody had either done an "lseek()" on the directory to an invalid offset, or when the offset had become invalid due to a file being unlinked in the directory. The code would not only set the f_version too eagerly, it would also not update f_pos appropriately for when the offset fixup took place. When that happened, we'd occasionally subsequently fail the readdir() even when we shouldn't (no real harm done, but an ugly printk, and obviously you would end up not necessarily seeing all entries). Thanks to Masoud Sharbiani who noticed the problem and had a test-case for it, and also fixed up a thinko in the first version of this patch. Signed-off-by: Al Viro Acked-by: Masoud Sharbiani Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

[PATCH] cramfs mounts provide corrupted content since 2.6.15

2006-03-28T07:00:22+00:00

Fix handling of cramfs images created by util-linux containing empty regular files. Images created by cramfstools 1.x were ok. Fill out inode contents in cramfs_iget5_set() instead of get_cramfs_inode() to prevent issues if cramfs_iget5_test() is called with I_LOCK|I_NEW still set. Signed-off-by: Dave Johnson Cc: Olaf Hering Cc: Chris Mason Cc: Andreas Gruenbacher Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

[PATCH] compat ifconf: fix limits

2006-03-28T07:00:22+00:00

A recent change to compat. dev_ifconf() in fs/compat_ioctl.c causes ifconf data to be truncated 1 entry too early when copying it to userspace. The correct amount of data (length) is returned, but the final entry is empty (zero, not filled in). The for-loop 'i' check should use <= to allow the final struct ifreq32 to be copied. I also used the ifconf-corruption program in kernel bugzilla #4746 to make sure that this change does not re-introduce the corruption. Signed-off-by: Randy Dunlap Signed-off-by: David S. Miller Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

[PATCH] fs/nfs/direct.c compile fix

2006-03-05T19:07:18+00:00

Compile fix: fs/nfs/direct.c: In function 'nfs_get_user_pages': fs/nfs/direct.c:110: warning: implicit declaration of function 'nfs_free_user_pages' fs/nfs/direct.c: At top level: fs/nfs/direct.c:127: warning: conflicting types for 'nfs_free_user_pages' fs/nfs/direct.c:127: error: static declaration of 'nfs_free_user_pages' follows non-static declaration fs/nfs/direct.c:110: error: previous implicit declaration of 'nfs_free_user_pages' was here This should now be the same as fix that's going upstream. Signed-off-by: Chris Wright Acked-by: Trond Myklebust

[PATCH] Normal user can panic NFS client with direct I/O (CVE-2006-0555)

2006-03-01T22:36:38+00:00

This is CVE-2006-0555 and SGI bug 946529. A normal user can panic an NFS client and cause a local DoS with 'judicious'(?) use of O_DIRECT. Signed-off-by: Chris Wright

[PATCH] XFS ftruncate() bug could expose stale data (CVE-2006-0554)

2006-03-01T22:36:38+00:00

This is CVE-2006-0554 and SGI bug 942658. With certain types of ftruncate() activity on 2.6 kernels, XFS can end up exposing stale data off disk to a user, putting extents where holes should be. Signed-off-by: Chris Wright

[PATCH] x86_64: Check for bad elf entry address (CVE-2006-0741)

2006-03-01T22:36:37+00:00

Fixes a local DOS on Intel systems that lead to an endless recursive fault. AMD machines don't seem to be affected. Signed-off-by: Suresh Siddha Signed-off-by: Andi Kleen Signed-off-by: Chris Wright

[PATCH] ramfs: update dir mtime and ctime

2006-03-01T22:36:36+00:00

Phil Marek points out that ramfs forgets to update a directory's mtime and ctime when it is modified. Cc: Signed-off-by: Andrew Morton Signed-off-by: Chris Wright

[PATCH] fix deadlock in ext2

2006-03-01T22:36:35+00:00

Fix a deadlock possible in the ext2 file system implementation. This deadlock occurs when a file is removed from an ext2 file system which was mounted with the "sync" mount option. The problem is that ext2_xattr_delete_inode() was invoking the routine, sync_dirty_buffer(), using a buffer head which was previously locked via lock_buffer(). The first thing that sync_dirty_buffer() does is to lock the buffer head that it was passed. It does this via lock_buffer(). Oops. The solution is to unlock the buffer head in ext2_xattr_delete_inode() before invoking sync_dirty_buffer(). This makes the code in ext2_xattr_delete_inode() obey the same locking rules as all other callers of sync_dirty_buffer() in the ext2 file system implementation. Signed-off-by: Peter Staubach Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman

[PATCH] fix zap_thread's ptrace related problems

2006-03-01T22:36:35+00:00

1. The tracee can go from ptrace_stop() to do_signal_stop() after __ptrace_unlink(p). 2. It is unsafe to __ptrace_unlink(p) while p->parent may wait for tasklist_lock in ptrace_detach(). Signed-off-by: Oleg Nesterov Cc: Roland McGrath Cc: Ingo Molnar Cc: Christoph Hellwig Cc: Eric W. Biederman Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman