linux-stable.git/fs/fuse, branch v3.18.76

fuse: initialize the flock flag in fuse_file on allocation

2017-08-16T20:35:30+00:00

commit 68227c03cba84a24faf8a7277d2b1a03c8959c2c upstream.

Before the patch, the flock flag could remain uninitialized for the
lifespan of the fuse_file allocation. Unless set to true in
fuse_file_flock(), it would remain in an indeterminate state until read in
an if statement in fuse_release_common(). This could consequently lead to
taking an unexpected branch in the code.

The bug was discovered by a runtime instrumentation designed to detect use
of uninitialized memory in the kernel.

Signed-off-by: Mateusz Jurczyk 
Fixes: 37fb3a30b462 ("fuse: fix flock")
Signed-off-by: Miklos Szeredi 
Signed-off-by: Greg Kroah-Hartman

fuse: Propagate dentry down to inode_change_ok()

2016-12-23T14:42:19+00:00

[ Upstream commit 62490330769c1ce5dcba3f1f3e8f4005e9b797e6 ]

To avoid clearing of capabilities or security related extended
attributes too early, inode_change_ok() will need to take dentry instead
of inode. Propagate it down to fuse_do_setattr().

Acked-by: Miklos Szeredi 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Jan Kara 
Signed-off-by: Sasha Levin

fuse: fix wrong assignment of ->flags in fuse_send_init()

2016-08-22T16:23:23+00:00

[ Upstream commit 9446385f05c9af25fed53dbed3cc75763730be52 ]

FUSE_HAS_IOCTL_DIR should be assigned to ->flags, it may be a typo.

Signed-off-by: Wei Fang 
Signed-off-by: Miklos Szeredi 
Fixes: 69fe05c90ed5 ("fuse: add missing INIT flags")
Cc: 
Signed-off-by: Sasha Levin

fuse: fuse_flush must check mapping->flags for errors

2016-08-22T16:23:23+00:00

[ Upstream commit 9ebce595f63a407c5cec98f98f9da8459b73740a ]

fuse_flush() calls write_inode_now() that triggers writeback, but actual
writeback will happen later, on fuse_sync_writes(). If an error happens,
fuse_writepage_end() will set error bit in mapping->flags. So, we have to
check mapping->flags after fuse_sync_writes().

Signed-off-by: Maxim Patlasov 
Signed-off-by: Miklos Szeredi 
Fixes: 4d99ff8f12eb ("fuse: Turn writeback cache on")
Cc:  # v3.15+
Signed-off-by: Sasha Levin

fuse: fsync() did not return IO errors

2016-08-22T16:23:22+00:00

[ Upstream commit ac7f052b9e1534c8248f814b6f0068ad8d4a06d2 ]

Due to implementation of fuse writeback filemap_write_and_wait_range() does
not catch errors. We have to do this directly after fuse_sync_writes()

Signed-off-by: Alexey Kuznetsov 
Signed-off-by: Maxim Patlasov 
Signed-off-by: Miklos Szeredi 
Fixes: 4d99ff8f12eb ("fuse: Turn writeback cache on")
Cc:  # v3.15+
Signed-off-by: Sasha Levin

fuse: break infinite loop in fuse_fill_write_pages()

2016-04-12T13:09:42+00:00

[ Upstream commit 3ca8138f014a913f98e6ef40e939868e1e9ea876 ]

I got a report about unkillable task eating CPU. Further
investigation shows, that the problem is in the fuse_fill_write_pages()
function. If iov's first segment has zero length, we get an infinite
loop, because we never reach iov_iter_advance() call.

Fix this by calling iov_iter_advance() before repeating an attempt to
copy data from userspace.

A similar problem is described in 124d3b7041f ("fix writev regression:
pan hanging unkillable and un-straceable"). If zero-length segmend
is followed by segment with invalid address,
iov_iter_fault_in_readable() checks only first segment (zero-length),
iov_iter_copy_from_user_atomic() skips it, fails at second and
returns zero -> goto again without skipping zero-length segment.

Patch calls iov_iter_advance() before goto again: we'll skip zero-length
segment at second iteraction and iov_iter_fault_in_readable() will detect
invalid address.

Special thanks to Konstantin Khlebnikov, who helped a lot with the commit
description.

Cc: Andrew Morton 
Cc: Maxim Patlasov 
Cc: Konstantin Khlebnikov 
Signed-off-by: Roman Gushchin 
Signed-off-by: Miklos Szeredi 
Fixes: ea9b9907b82a ("fuse: implement perform_write")
Cc: 
Signed-off-by: Sasha Levin

fuse: initialize fc->release before calling it

2015-07-05T14:12:55+00:00

[ Upstream commit 0ad0b3255a08020eaf50e34ef0d6df5bdf5e09ed ]

fc->release is called from fuse_conn_put() which was used in the error
cleanup before fc->release was initialized.

[Jeremiah Mahler : assign fc->release after calling
fuse_conn_init(fc) instead of before.]

Signed-off-by: Miklos Szeredi 
Fixes: a325f9b92273 ("fuse: update fuse_conn_init() and separate out fuse_conn_kill()")
Cc:  #v2.6.31+
Signed-off-by: Sasha Levin

fuse: notify: don't move pages

2015-03-28T13:33:41+00:00

[ Upstream commit 0d2783626a53d4c922f82d51fa675cb5d13f0d36 ]

fuse_try_move_page() is not prepared for replacing pages that have already
been read.

Reported-by: Al Viro 
Signed-off-by: Miklos Szeredi 
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin

fuse: set stolen page uptodate

2015-03-28T13:33:33+00:00

[ Upstream commit aa991b3b267e24f578bac7b09cc57579b660304b ]

Regular pipe buffers' ->steal method (generic_pipe_buf_steal()) doesn't set
PG_uptodate.

Don't warn on this condition, just set the uptodate flag.

Signed-off-by: Miklos Szeredi 
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin

vfs: Make d_invalidate return void

2014-10-09T06:38:57+00:00

Now that d_invalidate can no longer fail, stop returning a useless
return code.  For the few callers that checked the return code update
remove the handling of d_invalidate failure.

Reviewed-by: Miklos Szeredi 
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Al Viro