linux-stable.git/fs, branch linux-2.6.19.y

Fix oops when Windows server sent bad domain name null terminator

2007-03-03T00:32:45+00:00

[CIFS] Fix oops when Windows server sent bad domain name null terminator

Fixes RedHat bug 211672

Windows sends one byte (instead of two) of null to terminate final Unicode
string (domain name) in session setup response in some cases - this caused
cifs to misalign some informational strings (making it hard to convert
from UCS16 to UTF8).

Thanks to Shaggy for his help and Akemi Yagi for debugging/testing

Signed-off-by: Shirish Pargaonkar 
Signed-off-by: Steve French 
Signed-off-by: Greg Kroah-Hartman

fix memory corruption from misinterpreted bad_inode_ops return values (CVE-2006-5753)

2007-03-03T00:32:45+00:00

CVE-2006-5753 is for a case where an inode can be marked bad, switching
the ops to bad_inode_ops, which are all connected as:

static int return_EIO(void)
{
        return -EIO;
}

#define EIO_ERROR ((void *) (return_EIO))

static struct inode_operations bad_inode_ops =
{
        .create         = bad_inode_create
...etc...

The problem here is that the void cast causes return types to not be
promoted, and for ops such as listxattr which expect more than 32 bits of
return value, the 32-bit -EIO is interpreted as a large positive 64-bit
number, i.e. 0x00000000fffffffa instead of 0xfffffffa.

This goes particularly badly when the return value is taken as a number of
bytes to copy into, say, a user's buffer for example...

I originally had coded up the fix by creating a return_EIO_ macro
for each return type, like this:

static int return_EIO_int(void)
{
	return -EIO;
}
#define EIO_ERROR_INT ((void *) (return_EIO_int))

static struct inode_operations bad_inode_ops =
{
	.create		= EIO_ERROR_INT,
...etc...

but Al felt that it was probably better to create an EIO-returner for each
actual op signature.  Since so few ops share a signature, I just went ahead
& created an EIO function for each individual file & inode op that returns
a value.

Signed-off-by: Eric Sandeen 
Cc: Al Viro 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

fix umask when noACL kernel meets extN tuned for ACLs

2007-03-03T00:32:45+00:00

Fix insecure default behaviour reported by Tigran Aivazian: if an ext2
or ext3 or ext4 filesystem is tuned to mount with "acl", but mounted by
a kernel built without ACL support, then umask was ignored when creating
inodes - though root or user has umask 022, touch creates files as 0666,
and mkdir creates directories as 0777.

This appears to have worked right until 2.6.11, when a fix to the default
mode on symlinks (always 0777) assumed VFS applies umask: which it does,
unless the mount is marked for ACLs; but ext[234] set MS_POSIXACL in
s_flags according to s_mount_opt set according to def_mount_opts.

We could revert to the 2.6.10 ext[234]_init_acl (adding an S_ISLNK test);
but other filesystems only set MS_POSIXACL when ACLs are configured.  We
could fix this at another level; but it seems most robust to avoid setting
the s_mount_opt flag in the first place (at the expense of more ifdefs).

Likewise don't set the XATTR_USER flag when built without XATTR support.

Signed-off-by: Hugh Dickins 
Acked-by: Andreas Gruenbacher 
Cc: Tigran Aivazian 
Signed-off-by: Greg Kroah-Hartman

aio: fix buggy put_ioctx call in aio_complete - v2

2007-02-24T00:24:25+00:00

An AIO bug was reported that sleeping function is being called in softirq
context:

BUG: warning at kernel/mutex.c:132/__mutex_lock_common()
Call Trace:
     [] __mutex_lock_slowpath+0x640/0x6c0
     [] mutex_lock+0x20/0x40
     [] flush_workqueue+0xb0/0x1a0
     [] __put_ioctx+0xc0/0x240
     [] aio_complete+0x2f0/0x420
     [] finished_one_bio+0x200/0x2a0
     [] dio_bio_complete+0x1c0/0x200
     [] dio_bio_end_aio+0x60/0x80
     [] bio_endio+0x110/0x1c0
     [] __end_that_request_first+0x180/0xba0
     [] end_that_request_chunk+0x30/0x60
     [] scsi_end_request+0x50/0x300 [scsi_mod]
     [] scsi_io_completion+0x200/0x8a0 [scsi_mod]
     [] sd_rw_intr+0x330/0x860 [sd_mod]
     [] scsi_finish_command+0x100/0x1c0 [scsi_mod]
     [] scsi_softirq_done+0x230/0x300 [scsi_mod]
     [] blk_done_softirq+0x160/0x1c0
     [] __do_softirq+0x200/0x240
     [] do_softirq+0x70/0xc0

See report: http://marc.theaimsgroup.com/?l=linux-kernel&m=116599593200888&w=2

flush_workqueue() is not allowed to be called in the softirq context.
However, aio_complete() called from I/O interrupt can potentially call
put_ioctx with last ref count on ioctx and triggers bug.  It is simply
incorrect to perform ioctx freeing from aio_complete.

The bug is trigger-able from a race between io_destroy() and aio_complete().
A possible scenario:

cpu0                               cpu1
io_destroy                         aio_complete
  wait_for_all_aios {                __aio_put_req
     ...                                 ctx->reqs_active--;
     if (!ctx->reqs_active)
        return;
  }
  ...
  put_ioctx(ioctx)

                                     put_ioctx(ctx);
                                        __put_ioctx
                                          bam! Bug trigger!

The real problem is that the condition check of ctx->reqs_active in
wait_for_all_aios() is incorrect that access to reqs_active is not
being properly protected by spin lock.

This patch adds that protective spin lock, and at the same time removes
all duplicate ref counting for each kiocb as reqs_active is already used
as a ref count for each active ioctx.  This also ensures that buggy call
to flush_workqueue() in softirq context is eliminated.

Signed-off-by: "Ken Chen" 
Cc: Zach Brown 
Cc: Suparna Bhattacharya 
Cc: Benjamin LaHaise 
Cc: Badari Pulavarty 
Acked-by: Jeff Moyer 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix a free-wrong-pointer bug in nfs/acl server (CVE-2007-0772)

2007-02-20T06:30:55+00:00

Due to type confusion, when an nfsacl verison 2 'ACCESS' request
finishes and tries to clean up, it calls fh_put on entiredly the
wrong thing and this can cause an oops.

Signed-off-by: Neil Brown 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

[PATCH] knfsd: fix up some bit-rot in exp_export

2007-02-05T16:31:43+00:00

The nfsservctl systemcall isn't used but recent nfs-utils releases for
exporting filesystems, and consequently the code that is uses -
exp_export - has suffered some bitrot.

Particular:
  - some newly added fields in 'struct svc_export' are being initialised
    properly.
  - the return value is now always -ENOMEM ...

This patch fixes both these problems.

Signed-off-by: Neil Brown 
Signed-off-by: Chris Wright

[PATCH] knfsd: fix type mismatch with filldir_t used by nfsd.

2007-02-05T16:31:43+00:00

nfsd defines a type 'encode_dent_fn' which is much like 'filldir_t'
except that the first pointer is 'struct readdir_cd *' rather than
'void *'.  It then casts encode_dent_fn points to 'filldir_t' as
needed.  This hides any other type mismatches between the two such as
the fact that the 'ino' arg recently changed from ino_t to u64.

So: get rid of 'encode_dent_fn', get rid of the cast of the function
type, change the first arg of various functions from 'struct readdir_cd *'
to 'void *', and live with the fact that we have a little less type
checking on the calling of these functions now.
Less internal (to nfsd) checking offset by more external checking, which
is more important.

Thanks to Gabriel Paubert  for discovering this and
providing an initial patch.

Signed-off-by: Gabriel Paubert 
Signed-off-by: Neil Brown 
Signed-off-by: Chris Wright

[PATCH] knfsd: fix an NFSD bug with full sized, non-page-aligned reads.

2007-02-05T16:31:43+00:00

NFSd assumes that largest number of pages that will be needed
for a request+response is 2+N where N pages is the size of the largest
permitted read/write request.  The '2' are 1 for the non-data part of
the request, and 1 for the non-data part of the reply.

However, when a read request is not page-aligned, and we choose to use
->sendfile to send it directly from the page cache, we may need N+1
pages to hold the whole reply.  This can overflow and array and cause
an Oops.

This patch increases size of the array for holding pages by one and
makes sure that entry is NULL when it is not in use.

Signed-off-by: Neil Brown 
Signed-off-by: Chris Wright

[PATCH] knfsd: fix setting of ACL server versions.

2007-02-05T16:31:43+00:00

Due to silly typos, if the nfs versions are explicitly set,
no NFSACL versions get enabled.

Also improve an error message that would have made this bug
a little easier to find.

Signed-off-by: Neil Brown 
Signed-off-by: Chris Wright

[PATCH] Fix up CIFS for "test_clear_page_dirty()" removal

2007-02-05T16:31:41+00:00

Fix up CIFS for "test_clear_page_dirty()" removal

This also adds he required page "writeback" flag handling, that cifs
hasn't been doing and that the page dirty flag changes made obvious.

Acked-by: Steve French 
Acked-by: Dave Kleikamp 
Signed-off-by: Linus Torvalds 
Signed-off-by: Chris Wright