linux-stable.git/fs, branch v3.18.22

hpfs: hpfs_error: Remove static buffer, use vsprintf extension %pV instead

2015-08-27T17:26:07+00:00

[ Upstream commit a28e4b2b18ccb90df402da3f21e1a83c9d4f8ec1 ]

Removing unnecessary static buffers is good.
Use the vsprintf %pV extension instead.

Signed-off-by: Joe Perches 
Signed-off-by: Mikulas Patocka 
Cc: stable@vger.kernel.org      # v2.6.36+
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin

btrfs: cleanup orphans while looking up default subvolume

2015-08-27T17:25:56+00:00

[ Upstream commit 727b9784b6085c99c2f836bf4fcc2848dc9cf904 ]

Orphans in the fs tree are cleaned up via open_ctree and subvolume
orphans are cleaned via btrfs_lookup_dentry -- except when a default
subvolume is in use.  The name for the default subvolume uses a manual
lookup that doesn't trigger orphan cleanup and needs to trigger it
manually as well. This doesn't apply to the remount case since the
subvolumes are cleaned up by walking the root radix tree.

Signed-off-by: Jeff Mahoney 
Reviewed-by: David Sterba 
Signed-off-by: Chris Mason 
Signed-off-by: Sasha Levin

btrfs: incorrect handling for fiemap_fill_next_extent return

2015-08-27T17:25:56+00:00

[ Upstream commit 26e726afe01c1c82072cf23a5ed89ce25f39d9f2 ]

fiemap_fill_next_extent returns 0 on success, -errno on error, 1 if this was
the last extent that will fit in user array. If 1 is returned, the return
value may eventually returned to user space, which should not happen, according
to manpage of ioctl.

Signed-off-by: Chengyu Song 
Reviewed-by: David Sterba 
Reviewed-by: Liu Bo 
Signed-off-by: Chris Mason 
Signed-off-by: Sasha Levin

freeing unlinked file indefinitely delayed

2015-08-27T17:25:40+00:00

[ Upstream commit 75a6f82a0d10ef8f13cd8fe7212911a0252ab99e ]

	Normally opening a file, unlinking it and then closing will have
the inode freed upon close() (provided that it's not otherwise busy and
has no remaining links, of course).  However, there's one case where that
does *not* happen.  Namely, if you open it by fhandle with cold dcache,
then unlink() and close().

	In normal case you get d_delete() in unlink(2) notice that dentry
is busy and unhash it; on the final dput() it will be forcibly evicted from
dcache, triggering iput() and inode removal.  In this case, though, we end
up with *two* dentries - disconnected (created by open-by-fhandle) and
regular one (used by unlink()).  The latter will have its reference to inode
dropped just fine, but the former will not - it's considered hashed (it
is on the ->s_anon list), so it will stay around until the memory pressure
will finally do it in.  As the result, we have the final iput() delayed
indefinitely.  It's trivial to reproduce -

void flush_dcache(void)
{
        system("mount -o remount,rw /");
}

static char buf[20 * 1024 * 1024];

main()
{
        int fd;
        union {
                struct file_handle f;
                char buf[MAX_HANDLE_SZ];
        } x;
        int m;

        x.f.handle_bytes = sizeof(x);
        chdir("/root");
        mkdir("foo", 0700);
        fd = open("foo/bar", O_CREAT | O_RDWR, 0600);
        close(fd);
        name_to_handle_at(AT_FDCWD, "foo/bar", &x.f, &m, 0);
        flush_dcache();
        fd = open_by_handle_at(AT_FDCWD, &x.f, O_RDWR);
        unlink("foo/bar");
        write(fd, buf, sizeof(buf));
        system("df .");			/* 20Mb eaten */
        close(fd);
        system("df .");			/* should've freed those 20Mb */
        flush_dcache();
        system("df .");			/* should be the same as #2 */
}

will spit out something like
Filesystem     1K-blocks   Used Available Use% Mounted on
/dev/root         322023 303843      1131 100% /
Filesystem     1K-blocks   Used Available Use% Mounted on
/dev/root         322023 303843      1131 100% /
Filesystem     1K-blocks   Used Available Use% Mounted on
/dev/root         322023 283282     21692  93% /
- inode gets freed only when dentry is finally evicted (here we trigger
than by remount; normally it would've happened in response to memory
pressure hell knows when).

Cc: stable@vger.kernel.org # v2.6.38+; earlier ones need s/kill_it/unhash_it/
Acked-by: J. Bruce Fields 
Signed-off-by: Al Viro 
Signed-off-by: Sasha Levin

nfsd: do nfs4_check_fh in nfs4_check_file instead of nfs4_check_olstateid

2015-08-27T17:25:38+00:00

[ Upstream commit 1ccdd6c6e9a342c2ed4ced38faa67303226a2a6a ]

commit 8fcd461db7c09337b6d2e22d25eb411123f379e3 upstream.

Currently, preprocess_stateid_op calls nfs4_check_olstateid which
verifies that the open stateid corresponds to the current filehandle in the
call by calling nfs4_check_fh.

If the stateid is a NFS4_DELEG_STID however, then no such check is done.
This could cause incorrect enforcement of permissions, because the
nfsd_permission() call in nfs4_check_file uses current the current
filehandle, but any subsequent IO operation will use the file descriptor
in the stateid.

Move the call to nfs4_check_fh into nfs4_check_file instead so that it
can be done for all stateid types.

Signed-off-by: Jeff Layton 
[bfields: moved fh check to avoid NULL deref in special stateid case]
Signed-off-by: J. Bruce Fields 
Signed-off-by: Greg Kroah-Hartman 

Signed-off-by: Sasha Levin

nfsd: refactor nfs4_preprocess_stateid_op

2015-08-27T17:25:38+00:00

[ Upstream commit 3b5c2aed0e5557c6bc4a305e7627a16a764b4cdb ]

commit a0649b2d3fffb1cde8745568c767f3a55a3462bc upstream.

Split out two self contained helpers to make the function more readable.

Signed-off-by: Christoph Hellwig 
Signed-off-by: J. Bruce Fields 
Cc: Jeff Layton 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

signalfd: fix information leak in signalfd_copyinfo

2015-08-27T17:25:36+00:00

[ Upstream commit 3ead7c52bdb0ab44f4bb1feed505a8323cc12ba7 ]

This function may copy the si_addr_lsb field to user mode when it hasn't
been initialized, which can leak kernel stack data to user mode.

Just checking the value of si_code is insufficient because the same
si_code value is shared between multiple signals.  This is solved by
checking the value of si_signo in addition to si_code.

Signed-off-by: Amanieu d'Antras 
Cc: Oleg Nesterov 
Cc: Ingo Molnar 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin

nfsd: Drop BUG_ON and ignore SECLABEL on absent filesystem

2015-08-27T17:25:31+00:00

[ Upstream commit c7e6f05156402364f34669e0fa6fd69b834f994b ]

commit c2227a39a078473115910512aa0f8d53bd915e60 upstream.

On an absent filesystem (one served by another server), we need to be
able to handle requests for certain attributest (like fs_locations, so
the client can find out which server does have the filesystem), but
others we can't.

We forgot to take that into account when adding another attribute
bitmask work for the SECURITY_LABEL attribute.

There an export entry with the "refer" option can result in:

[   88.414272] kernel BUG at fs/nfsd/nfs4xdr.c:2249!
[   88.414828] invalid opcode: 0000 [#1] SMP
[   88.415368] Modules linked in: rpcsec_gss_krb5 nfsv4 dns_resolver nfs fscache nfsd xfs libcrc32c iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi iosf_mbi ppdev btrfs coretemp crct10dif_pclmul crc32_pclmul crc32c_intel xor ghash_clmulni_intel raid6_pq vmw_balloon parport_pc parport i2c_piix4 shpchp vmw_vmci acpi_cpufreq auth_rpcgss nfs_acl lockd grace sunrpc vmwgfx drm_kms_helper ttm drm mptspi mptscsih serio_raw mptbase e1000 scsi_transport_spi ata_generic pata_acpi [last unloaded: nfsd]
[   88.417827] CPU: 0 PID: 2116 Comm: nfsd Not tainted 4.0.7-300.fc22.x86_64 #1
[   88.418448] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/20/2014
[   88.419093] task: ffff880079146d50 ti: ffff8800785d8000 task.ti: ffff8800785d8000
[   88.419729] RIP: 0010:[]  [] nfsd4_encode_fattr+0x820/0x1f00 [nfsd]
[   88.420376] RSP: 0000:ffff8800785db998  EFLAGS: 00010206
[   88.421027] RAX: 0000000000000001 RBX: 000000000018091a RCX: ffff88006668b980
[   88.421676] RDX: 00000000fffef7fc RSI: 0000000000000000 RDI: ffff880078d05000
[   88.422315] RBP: ffff8800785dbb58 R08: ffff880078d043f8 R09: ffff880078d4a000
[   88.422968] R10: 0000000000010000 R11: 0000000000000002 R12: 0000000000b0a23a
[   88.423612] R13: ffff880078d05000 R14: ffff880078683100 R15: ffff88006668b980
[   88.424295] FS:  0000000000000000(0000) GS:ffff88007c600000(0000) knlGS:0000000000000000
[   88.424944] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   88.425597] CR2: 00007f40bc370f90 CR3: 0000000035af5000 CR4: 00000000001407f0
[   88.426285] Stack:
[   88.426921]  ffff8800785dbaa8 ffffffffa049e4af ffff8800785dba08 ffffffff813298f0
[   88.427585]  ffff880078683300 ffff8800769b0de8 0000089d00000001 0000000087f805e0
[   88.428228]  ffff880000000000 ffff880079434a00 0000000000000000 ffff88006668b980
[   88.428877] Call Trace:
[   88.429527]  [] ? exp_get_by_name+0x7f/0xb0 [nfsd]
[   88.430168]  [] ? inode_doinit_with_dentry+0x210/0x6a0
[   88.430807]  [] ? d_lookup+0x2e/0x60
[   88.431449]  [] ? dput+0x33/0x230
[   88.432097]  [] ? mntput+0x24/0x40
[   88.432719]  [] ? path_put+0x22/0x30
[   88.433340]  [] ? nfsd_cross_mnt+0xb7/0x1c0 [nfsd]
[   88.433954]  [] nfsd4_encode_dirent+0x1b0/0x3d0 [nfsd]
[   88.434601]  [] ? nfsd4_encode_getattr+0x40/0x40 [nfsd]
[   88.435172]  [] nfsd_readdir+0x1c1/0x2a0 [nfsd]
[   88.435710]  [] ? nfsd_direct_splice_actor+0x20/0x20 [nfsd]
[   88.436447]  [] nfsd4_encode_readdir+0x120/0x220 [nfsd]
[   88.437011]  [] nfsd4_encode_operation+0x7d/0x190 [nfsd]
[   88.437566]  [] nfsd4_proc_compound+0x24d/0x6f0 [nfsd]
[   88.438157]  [] nfsd_dispatch+0xc3/0x220 [nfsd]
[   88.438680]  [] svc_process_common+0x43b/0x690 [sunrpc]
[   88.439192]  [] svc_process+0x103/0x1b0 [sunrpc]
[   88.439694]  [] nfsd+0x117/0x190 [nfsd]
[   88.440194]  [] ? nfsd_destroy+0x90/0x90 [nfsd]
[   88.440697]  [] kthread+0xd8/0xf0
[   88.441260]  [] ? kthread_worker_fn+0x180/0x180
[   88.441762]  [] ret_from_fork+0x58/0x90
[   88.442322]  [] ? kthread_worker_fn+0x180/0x180
[   88.442879] Code: 0f 84 93 05 00 00 83 f8 ea c7 85 a0 fe ff ff 00 00 27 30 0f 84 ba fe ff ff 85 c0 0f 85 a5 fe ff ff e9 e3 f9 ff ff 0f 1f 44 00 00 <0f> 0b 66 0f 1f 44 00 00 be 04 00 00 00 4c 89 ef 4c 89 8d 68 fe
[   88.444052] RIP  [] nfsd4_encode_fattr+0x820/0x1f00 [nfsd]
[   88.444658]  RSP 
[   88.445232] ---[ end trace 6cb9d0487d94a29f ]---

Signed-off-by: Kinglong Mee 
Signed-off-by: J. Bruce Fields 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

ocfs2: fix BUG in ocfs2_downconvert_thread_do_work()

2015-08-27T17:25:31+00:00

[ Upstream commit 209f7512d007980fd111a74a064d70a3656079cf ]

The "BUG_ON(list_empty(&osb->blocked_lock_list))" in
ocfs2_downconvert_thread_do_work can be triggered in the following case:

ocfs2dc has firstly saved osb->blocked_lock_count to local varibale
processed, and then processes the dentry lockres.  During the dentry
put, it calls iput and then deletes rw, inode and open lockres from
blocked list in ocfs2_mark_lockres_freeing.  And this causes the
variable `processed' to not reflect the number of blocked lockres to be
processed, which triggers the BUG.

Signed-off-by: Joseph Qi 
Cc: Mark Fasheh 
Cc: Joel Becker 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin

fsnotify: fix oops in fsnotify_clear_marks_by_group_flags()

2015-08-19T17:16:07+00:00

[ Upstream commit 8f2f3eb59dff4ec538de55f2e0592fec85966aab ]

fsnotify_clear_marks_by_group_flags() can race with
fsnotify_destroy_marks() so that when fsnotify_destroy_mark_locked()
drops mark_mutex, a mark from the list iterated by
fsnotify_clear_marks_by_group_flags() can be freed and thus the next
entry pointer we have cached may become stale and we dereference free
memory.

Fix the problem by first moving marks to free to a special private list
and then always free the first entry in the special list.  This method
is safe even when entries from the list can disappear once we drop the
lock.

Signed-off-by: Jan Kara 
Reported-by: Ashish Sangwan 
Reviewed-by: Ashish Sangwan 
Cc: Lino Sanfilippo 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Sasha Levin