<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux.git/fs/hfsplus, branch v2.6.28</title>
<subtitle>Linux kernel source tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/'/>
<entry>
<title>[PATCH] move executable checking into -&gt;permission()</title>
<updated>2008-10-23T09:13:25+00:00</updated>
<author>
<name>Miklos Szeredi</name>
<email>miklos@szeredi.hu</email>
</author>
<published>2008-07-31T11:41:58+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=f696a3659fc4b3a3bf4bc83d9dbec5e5a2ffd929'/>
<id>f696a3659fc4b3a3bf4bc83d9dbec5e5a2ffd929</id>
<content type='text'>
For execute permission on a regular files we need to check if file has
any execute bits at all, regardless of capabilites.

This check is normally performed by generic_permission() but was also
added to the case when the filesystem defines its own -&gt;permission()
method.  In the latter case the filesystem should be responsible for
performing this check.

Move the check from inode_permission() inside filesystems which are
not calling generic_permission().

Create a helper function execute_ok() that returns true if the inode
is a directory or if any execute bits are present in i_mode.

Also fix up the following code:

 - coda control file is never executable
 - sysctl files are never executable
 - hfs_permission seems broken on MAY_EXEC, remove
 - hfsplus_permission is eqivalent to generic_permission(), remove

Signed-off-by: Miklos Szeredi &lt;mszeredi@suse.cz&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
For execute permission on a regular files we need to check if file has
any execute bits at all, regardless of capabilites.

This check is normally performed by generic_permission() but was also
added to the case when the filesystem defines its own -&gt;permission()
method.  In the latter case the filesystem should be responsible for
performing this check.

Move the check from inode_permission() inside filesystems which are
not calling generic_permission().

Create a helper function execute_ok() that returns true if the inode
is a directory or if any execute bits are present in i_mode.

Also fix up the following code:

 - coda control file is never executable
 - sysctl files are never executable
 - hfs_permission seems broken on MAY_EXEC, remove
 - hfsplus_permission is eqivalent to generic_permission(), remove

Signed-off-by: Miklos Szeredi &lt;mszeredi@suse.cz&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>hfsplus: fix possible deadlock when handling corrupted extents</title>
<updated>2008-10-20T15:52:38+00:00</updated>
<author>
<name>Eric Sesterhenn</name>
<email>snakebyte@gmx.de</email>
</author>
<published>2008-10-19T03:28:02+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=248736c2a57206388c86f8cdd3392ee986e84f9f'/>
<id>248736c2a57206388c86f8cdd3392ee986e84f9f</id>
<content type='text'>
A corrupted extent for the extent file itself may try to get an impossible
extent, causing a deadlock if I see it correctly.

Check the inode number after the first_blocks checks and fail if it's the
extent file, as according to the spec the extent file should have no
extent for itself.

Signed-off-by: Eric Sesterhenn &lt;snakebyte@gmx.de&gt;
Cc: Roman Zippel &lt;zippel@linux-m68k.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
A corrupted extent for the extent file itself may try to get an impossible
extent, causing a deadlock if I see it correctly.

Check the inode number after the first_blocks checks and fail if it's the
extent file, as according to the spec the extent file should have no
extent for itself.

Signed-off-by: Eric Sesterhenn &lt;snakebyte@gmx.de&gt;
Cc: Roman Zippel &lt;zippel@linux-m68k.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>hfsplus: missing O_LARGEFILE check</title>
<updated>2008-10-20T15:52:38+00:00</updated>
<author>
<name>Alan Cox</name>
<email>alan@lxorguk.ukuu.org.uk</email>
</author>
<published>2008-10-19T03:28:01+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=6e7152944426be786c6c232990914e4565290d35'/>
<id>6e7152944426be786c6c232990914e4565290d35</id>
<content type='text'>
hfsplus: O_LARGEFILE checking is missing

Addresses http://bugzilla.kernel.org/show_bug.cgi?id=8490

From: Alan Cox &lt;alan@redhat.com&gt;
Reported-by: didier &lt;did447@gmail.com&gt;
Cc: Roman Zippel &lt;zippel@linux-m68k.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
hfsplus: O_LARGEFILE checking is missing

Addresses http://bugzilla.kernel.org/show_bug.cgi?id=8490

From: Alan Cox &lt;alan@redhat.com&gt;
Reported-by: didier &lt;did447@gmail.com&gt;
Cc: Roman Zippel &lt;zippel@linux-m68k.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>hfsplus: check read_mapping_page() return value</title>
<updated>2008-10-16T18:21:46+00:00</updated>
<author>
<name>Eric Sesterhenn</name>
<email>snakebyte@gmx.de</email>
</author>
<published>2008-10-16T05:04:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=649f1ee6c705aab644035a7998d7b574193a598a'/>
<id>649f1ee6c705aab644035a7998d7b574193a598a</id>
<content type='text'>
While testing more corrupted images with hfsplus, i came across
one which triggered the following bug:

[15840.675016] BUG: unable to handle kernel paging request at fffffffb
[15840.675016] IP: [&lt;c0116a4f&gt;] kmap+0x15/0x56
[15840.675016] *pde = 00008067 *pte = 00000000
[15840.675016] Oops: 0000 [#1] PREEMPT DEBUG_PAGEALLOC
[15840.675016] Modules linked in:
[15840.675016]
[15840.675016] Pid: 11575, comm: ln Not tainted (2.6.27-rc4-00123-gd3ee1b4-dirty #29)
[15840.675016] EIP: 0060:[&lt;c0116a4f&gt;] EFLAGS: 00010202 CPU: 0
[15840.675016] EIP is at kmap+0x15/0x56
[15840.675016] EAX: 00000246 EBX: fffffffb ECX: 00000000 EDX: cab919c0
[15840.675016] ESI: 000007dd EDI: cab0bcf4 EBP: cab0bc98 ESP: cab0bc94
[15840.675016]  DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
[15840.675016] Process ln (pid: 11575, ti=cab0b000 task=cab919c0 task.ti=cab0b000)
[15840.675016] Stack: 00000000 cab0bcdc c0231cfb 00000000 cab0bce0 00000800 ca9290c0 fffffffb
[15840.675016]        cab145d0 cab919c0 cab15998 22222222 22222222 22222222 00000001 cab15960
[15840.675016]        000007dd cab0bcf4 cab0bd04 c022cb3a cab0bcf4 cab15a6c ca9290c0 00000000
[15840.675016] Call Trace:
[15840.675016]  [&lt;c0231cfb&gt;] ? hfsplus_block_allocate+0x6f/0x2d3
[15840.675016]  [&lt;c022cb3a&gt;] ? hfsplus_file_extend+0xc4/0x1db
[15840.675016]  [&lt;c022ce41&gt;] ? hfsplus_get_block+0x8c/0x19d
[15840.675016]  [&lt;c06adde4&gt;] ? sub_preempt_count+0x9d/0xab
[15840.675016]  [&lt;c019ece6&gt;] ? __block_prepare_write+0x147/0x311
[15840.675016]  [&lt;c0161934&gt;] ? __grab_cache_page+0x52/0x73
[15840.675016]  [&lt;c019ef4f&gt;] ? block_write_begin+0x79/0xd5
[15840.675016]  [&lt;c022cdb5&gt;] ? hfsplus_get_block+0x0/0x19d
[15840.675016]  [&lt;c019f22a&gt;] ? cont_write_begin+0x27f/0x2af
[15840.675016]  [&lt;c022cdb5&gt;] ? hfsplus_get_block+0x0/0x19d
[15840.675016]  [&lt;c0139ebe&gt;] ? tick_program_event+0x28/0x4c
[15840.675016]  [&lt;c013bd35&gt;] ? trace_hardirqs_off+0xb/0xd
[15840.675016]  [&lt;c022b723&gt;] ? hfsplus_write_begin+0x2d/0x32
[15840.675016]  [&lt;c022cdb5&gt;] ? hfsplus_get_block+0x0/0x19d
[15840.675016]  [&lt;c0161988&gt;] ? pagecache_write_begin+0x33/0x107
[15840.675016]  [&lt;c01879e5&gt;] ? __page_symlink+0x3c/0xae
[15840.675016]  [&lt;c019ad34&gt;] ? __mark_inode_dirty+0x12f/0x137
[15840.675016]  [&lt;c0187a70&gt;] ? page_symlink+0x19/0x1e
[15840.675016]  [&lt;c022e6eb&gt;] ? hfsplus_symlink+0x41/0xa6
[15840.675016]  [&lt;c01886a9&gt;] ? vfs_symlink+0x99/0x101
[15840.675016]  [&lt;c018a2f6&gt;] ? sys_symlinkat+0x6b/0xad
[15840.675016]  [&lt;c018a348&gt;] ? sys_symlink+0x10/0x12
[15840.675016]  [&lt;c01038bd&gt;] ? sysenter_do_call+0x12/0x31
[15840.675016]  =======================
[15840.675016] Code: 00 00 75 10 83 3d 88 2f ec c0 02 75 07 89 d0 e8 12 56 05 00 5d c3 55 ba 06 00 00 00 89 e5 53 89 c3 b8 3d eb 7e c0 e8 16 74 00 00 &lt;8b&gt; 03 c1 e8 1e 69 c0 d8 02 00 00 05 b8 69 8e c0 2b 80 c4 02 00
[15840.675016] EIP: [&lt;c0116a4f&gt;] kmap+0x15/0x56 SS:ESP 0068:cab0bc94
[15840.675016] ---[ end trace 4fea40dad6b70e5f ]---

This happens because the return value of read_mapping_page() is passed on
to kmap unchecked.  The bug is triggered after the first
read_mapping_page() in hfsplus_block_allocate(), this patch fixes all
three usages in this functions but leaves the ones further down in the
file unchanged.

Signed-off-by: Eric Sesterhenn &lt;snakebyte@gmx.de&gt;
Cc: Roman Zippel &lt;zippel@linux-m68k.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
While testing more corrupted images with hfsplus, i came across
one which triggered the following bug:

[15840.675016] BUG: unable to handle kernel paging request at fffffffb
[15840.675016] IP: [&lt;c0116a4f&gt;] kmap+0x15/0x56
[15840.675016] *pde = 00008067 *pte = 00000000
[15840.675016] Oops: 0000 [#1] PREEMPT DEBUG_PAGEALLOC
[15840.675016] Modules linked in:
[15840.675016]
[15840.675016] Pid: 11575, comm: ln Not tainted (2.6.27-rc4-00123-gd3ee1b4-dirty #29)
[15840.675016] EIP: 0060:[&lt;c0116a4f&gt;] EFLAGS: 00010202 CPU: 0
[15840.675016] EIP is at kmap+0x15/0x56
[15840.675016] EAX: 00000246 EBX: fffffffb ECX: 00000000 EDX: cab919c0
[15840.675016] ESI: 000007dd EDI: cab0bcf4 EBP: cab0bc98 ESP: cab0bc94
[15840.675016]  DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
[15840.675016] Process ln (pid: 11575, ti=cab0b000 task=cab919c0 task.ti=cab0b000)
[15840.675016] Stack: 00000000 cab0bcdc c0231cfb 00000000 cab0bce0 00000800 ca9290c0 fffffffb
[15840.675016]        cab145d0 cab919c0 cab15998 22222222 22222222 22222222 00000001 cab15960
[15840.675016]        000007dd cab0bcf4 cab0bd04 c022cb3a cab0bcf4 cab15a6c ca9290c0 00000000
[15840.675016] Call Trace:
[15840.675016]  [&lt;c0231cfb&gt;] ? hfsplus_block_allocate+0x6f/0x2d3
[15840.675016]  [&lt;c022cb3a&gt;] ? hfsplus_file_extend+0xc4/0x1db
[15840.675016]  [&lt;c022ce41&gt;] ? hfsplus_get_block+0x8c/0x19d
[15840.675016]  [&lt;c06adde4&gt;] ? sub_preempt_count+0x9d/0xab
[15840.675016]  [&lt;c019ece6&gt;] ? __block_prepare_write+0x147/0x311
[15840.675016]  [&lt;c0161934&gt;] ? __grab_cache_page+0x52/0x73
[15840.675016]  [&lt;c019ef4f&gt;] ? block_write_begin+0x79/0xd5
[15840.675016]  [&lt;c022cdb5&gt;] ? hfsplus_get_block+0x0/0x19d
[15840.675016]  [&lt;c019f22a&gt;] ? cont_write_begin+0x27f/0x2af
[15840.675016]  [&lt;c022cdb5&gt;] ? hfsplus_get_block+0x0/0x19d
[15840.675016]  [&lt;c0139ebe&gt;] ? tick_program_event+0x28/0x4c
[15840.675016]  [&lt;c013bd35&gt;] ? trace_hardirqs_off+0xb/0xd
[15840.675016]  [&lt;c022b723&gt;] ? hfsplus_write_begin+0x2d/0x32
[15840.675016]  [&lt;c022cdb5&gt;] ? hfsplus_get_block+0x0/0x19d
[15840.675016]  [&lt;c0161988&gt;] ? pagecache_write_begin+0x33/0x107
[15840.675016]  [&lt;c01879e5&gt;] ? __page_symlink+0x3c/0xae
[15840.675016]  [&lt;c019ad34&gt;] ? __mark_inode_dirty+0x12f/0x137
[15840.675016]  [&lt;c0187a70&gt;] ? page_symlink+0x19/0x1e
[15840.675016]  [&lt;c022e6eb&gt;] ? hfsplus_symlink+0x41/0xa6
[15840.675016]  [&lt;c01886a9&gt;] ? vfs_symlink+0x99/0x101
[15840.675016]  [&lt;c018a2f6&gt;] ? sys_symlinkat+0x6b/0xad
[15840.675016]  [&lt;c018a348&gt;] ? sys_symlink+0x10/0x12
[15840.675016]  [&lt;c01038bd&gt;] ? sysenter_do_call+0x12/0x31
[15840.675016]  =======================
[15840.675016] Code: 00 00 75 10 83 3d 88 2f ec c0 02 75 07 89 d0 e8 12 56 05 00 5d c3 55 ba 06 00 00 00 89 e5 53 89 c3 b8 3d eb 7e c0 e8 16 74 00 00 &lt;8b&gt; 03 c1 e8 1e 69 c0 d8 02 00 00 05 b8 69 8e c0 2b 80 c4 02 00
[15840.675016] EIP: [&lt;c0116a4f&gt;] kmap+0x15/0x56 SS:ESP 0068:cab0bc94
[15840.675016] ---[ end trace 4fea40dad6b70e5f ]---

This happens because the return value of read_mapping_page() is passed on
to kmap unchecked.  The bug is triggered after the first
read_mapping_page() in hfsplus_block_allocate(), this patch fixes all
three usages in this functions but leaves the ones further down in the
file unchanged.

Signed-off-by: Eric Sesterhenn &lt;snakebyte@gmx.de&gt;
Cc: Roman Zippel &lt;zippel@linux-m68k.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>hfsplus: fix Buffer overflow with a corrupted image</title>
<updated>2008-10-16T18:21:46+00:00</updated>
<author>
<name>Eric Sesterhenn</name>
<email>snakebyte@gmx.de</email>
</author>
<published>2008-10-16T05:04:08+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=efc7ffcb4237f8cb9938909041c4ed38f6e1bf40'/>
<id>efc7ffcb4237f8cb9938909041c4ed38f6e1bf40</id>
<content type='text'>
When an hfsplus image gets corrupted it might happen that the catalog
namelength field gets b0rked.  If we mount such an image the memcpy() in
hfsplus_cat_build_key_uni() writes more than the 255 that fit in the name
field.  Depending on the size of the overwritten data, we either only get
memory corruption or also trigger an oops like this:

[  221.628020] BUG: unable to handle kernel paging request at c82b0000
[  221.629066] IP: [&lt;c022d4b1&gt;] hfsplus_find_cat+0x10d/0x151
[  221.629066] *pde = 0ea29163 *pte = 082b0160
[  221.629066] Oops: 0002 [#1] PREEMPT DEBUG_PAGEALLOC
[  221.629066] Modules linked in:
[  221.629066]
[  221.629066] Pid: 4845, comm: mount Not tainted (2.6.27-rc4-00123-gd3ee1b4-dirty #28)
[  221.629066] EIP: 0060:[&lt;c022d4b1&gt;] EFLAGS: 00010206 CPU: 0
[  221.629066] EIP is at hfsplus_find_cat+0x10d/0x151
[  221.629066] EAX: 00000029 EBX: 00016210 ECX: 000042c2 EDX: 00000002
[  221.629066] ESI: c82d70ca EDI: c82b0000 EBP: c82d1bcc ESP: c82d199c
[  221.629066]  DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
[  221.629066] Process mount (pid: 4845, ti=c82d1000 task=c8224060 task.ti=c82d1000)
[  221.629066] Stack: c080b3c4 c82aa8f8 c82d19c2 00016210 c080b3be c82d1bd4 c82aa8f0 00000300
[  221.629066]        01000000 750008b1 74006e00 74006900 65006c00 c82d6400 c013bd35 c8224060
[  221.629066]        00000036 00000046 c82d19f0 00000082 c8224548 c8224060 00000036 c0d653cc
[  221.629066] Call Trace:
[  221.629066]  [&lt;c013bd35&gt;] ? trace_hardirqs_off+0xb/0xd
[  221.629066]  [&lt;c013bca3&gt;] ? trace_hardirqs_off_caller+0x14/0x9b
[  221.629066]  [&lt;c013bd35&gt;] ? trace_hardirqs_off+0xb/0xd
[  221.629066]  [&lt;c013bca3&gt;] ? trace_hardirqs_off_caller+0x14/0x9b
[  221.629066]  [&lt;c013bd35&gt;] ? trace_hardirqs_off+0xb/0xd
[  221.629066]  [&lt;c0107aa3&gt;] ? native_sched_clock+0x82/0x96
[  221.629066]  [&lt;c01302d2&gt;] ? __kernel_text_address+0x1b/0x27
[  221.629066]  [&lt;c010487a&gt;] ? dump_trace+0xca/0xd6
[  221.629066]  [&lt;c0109e32&gt;] ? save_stack_address+0x0/0x2c
[  221.629066]  [&lt;c0109eaf&gt;] ? save_stack_trace+0x1c/0x3a
[  221.629066]  [&lt;c013b571&gt;] ? save_trace+0x37/0x8d
[  221.629066]  [&lt;c013b62e&gt;] ? add_lock_to_list+0x67/0x8d
[  221.629066]  [&lt;c013ea1c&gt;] ? validate_chain+0x8a4/0x9f4
[  221.629066]  [&lt;c013553d&gt;] ? down+0xc/0x2f
[  221.629066]  [&lt;c013f1f6&gt;] ? __lock_acquire+0x68a/0x6e0
[  221.629066]  [&lt;c013bd35&gt;] ? trace_hardirqs_off+0xb/0xd
[  221.629066]  [&lt;c013bca3&gt;] ? trace_hardirqs_off_caller+0x14/0x9b
[  221.629066]  [&lt;c013bd35&gt;] ? trace_hardirqs_off+0xb/0xd
[  221.629066]  [&lt;c0107aa3&gt;] ? native_sched_clock+0x82/0x96
[  221.629066]  [&lt;c013da5d&gt;] ? mark_held_locks+0x43/0x5a
[  221.629066]  [&lt;c013dc3a&gt;] ? trace_hardirqs_on+0xb/0xd
[  221.629066]  [&lt;c013dbf4&gt;] ? trace_hardirqs_on_caller+0xf4/0x12f
[  221.629066]  [&lt;c06abec8&gt;] ? _spin_unlock_irqrestore+0x42/0x58
[  221.629066]  [&lt;c013555c&gt;] ? down+0x2b/0x2f
[  221.629066]  [&lt;c022aa68&gt;] ? hfsplus_iget+0xa0/0x154
[  221.629066]  [&lt;c022b0b9&gt;] ? hfsplus_fill_super+0x280/0x447
[  221.629066]  [&lt;c0107aa3&gt;] ? native_sched_clock+0x82/0x96
[  221.629066]  [&lt;c013bca3&gt;] ? trace_hardirqs_off_caller+0x14/0x9b
[  221.629066]  [&lt;c013bca3&gt;] ? trace_hardirqs_off_caller+0x14/0x9b
[  221.629066]  [&lt;c013f1f6&gt;] ? __lock_acquire+0x68a/0x6e0
[  221.629066]  [&lt;c041c9e4&gt;] ? string+0x2b/0x74
[  221.629066]  [&lt;c041cd16&gt;] ? vsnprintf+0x2e9/0x512
[  221.629066]  [&lt;c010487a&gt;] ? dump_trace+0xca/0xd6
[  221.629066]  [&lt;c0109eaf&gt;] ? save_stack_trace+0x1c/0x3a
[  221.629066]  [&lt;c0109eaf&gt;] ? save_stack_trace+0x1c/0x3a
[  221.629066]  [&lt;c013b571&gt;] ? save_trace+0x37/0x8d
[  221.629066]  [&lt;c013b62e&gt;] ? add_lock_to_list+0x67/0x8d
[  221.629066]  [&lt;c013ea1c&gt;] ? validate_chain+0x8a4/0x9f4
[  221.629066]  [&lt;c01354d3&gt;] ? up+0xc/0x2f
[  221.629066]  [&lt;c013f1f6&gt;] ? __lock_acquire+0x68a/0x6e0
[  221.629066]  [&lt;c013bd35&gt;] ? trace_hardirqs_off+0xb/0xd
[  221.629066]  [&lt;c013bca3&gt;] ? trace_hardirqs_off_caller+0x14/0x9b
[  221.629066]  [&lt;c013bd35&gt;] ? trace_hardirqs_off+0xb/0xd
[  221.629066]  [&lt;c0107aa3&gt;] ? native_sched_clock+0x82/0x96
[  221.629066]  [&lt;c041cfb7&gt;] ? snprintf+0x1b/0x1d
[  221.629066]  [&lt;c01ba466&gt;] ? disk_name+0x25/0x67
[  221.629066]  [&lt;c0183960&gt;] ? get_sb_bdev+0xcd/0x10b
[  221.629066]  [&lt;c016ad92&gt;] ? kstrdup+0x2a/0x4c
[  221.629066]  [&lt;c022a7b3&gt;] ? hfsplus_get_sb+0x13/0x15
[  221.629066]  [&lt;c022ae39&gt;] ? hfsplus_fill_super+0x0/0x447
[  221.629066]  [&lt;c0183583&gt;] ? vfs_kern_mount+0x3b/0x76
[  221.629066]  [&lt;c0183602&gt;] ? do_kern_mount+0x32/0xba
[  221.629066]  [&lt;c01960d4&gt;] ? do_new_mount+0x46/0x74
[  221.629066]  [&lt;c0196277&gt;] ? do_mount+0x175/0x193
[  221.629066]  [&lt;c013dbf4&gt;] ? trace_hardirqs_on_caller+0xf4/0x12f
[  221.629066]  [&lt;c01663b2&gt;] ? __get_free_pages+0x1e/0x24
[  221.629066]  [&lt;c06ac07b&gt;] ? lock_kernel+0x19/0x8c
[  221.629066]  [&lt;c01962e6&gt;] ? sys_mount+0x51/0x9b
[  221.629066]  [&lt;c01962f9&gt;] ? sys_mount+0x64/0x9b
[  221.629066]  [&lt;c01038bd&gt;] ? sysenter_do_call+0x12/0x31
[  221.629066]  =======================
[  221.629066] Code: 89 c2 c1 e2 08 c1 e8 08 09 c2 8b 85 e8 fd ff ff 66 89 50 06 89 c7 53 83 c7 08 56 57 68 c4 b3 80 c0 e8 8c 5c ef ff 89 d9 c1 e9 02 &lt;f3&gt; a5 89 d9 83 e1 03 74 02 f3 a4 83 c3 06 8b 95 e8 fd ff ff 0f
[  221.629066] EIP: [&lt;c022d4b1&gt;] hfsplus_find_cat+0x10d/0x151 SS:ESP 0068:c82d199c
[  221.629066] ---[ end trace e417a1d67f0d0066 ]---

Since hfsplus_cat_build_key_uni() returns void and only has one callsite,
the check is performed at the callsite.

Signed-off-by: Eric Sesterhenn &lt;snakebyte@gmx.de&gt;
Reviewed-by: Pekka Enberg &lt;penberg@cs.helsinki.fi&gt;
Cc: Roman Zippel &lt;zippel@linux-m68k.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
When an hfsplus image gets corrupted it might happen that the catalog
namelength field gets b0rked.  If we mount such an image the memcpy() in
hfsplus_cat_build_key_uni() writes more than the 255 that fit in the name
field.  Depending on the size of the overwritten data, we either only get
memory corruption or also trigger an oops like this:

[  221.628020] BUG: unable to handle kernel paging request at c82b0000
[  221.629066] IP: [&lt;c022d4b1&gt;] hfsplus_find_cat+0x10d/0x151
[  221.629066] *pde = 0ea29163 *pte = 082b0160
[  221.629066] Oops: 0002 [#1] PREEMPT DEBUG_PAGEALLOC
[  221.629066] Modules linked in:
[  221.629066]
[  221.629066] Pid: 4845, comm: mount Not tainted (2.6.27-rc4-00123-gd3ee1b4-dirty #28)
[  221.629066] EIP: 0060:[&lt;c022d4b1&gt;] EFLAGS: 00010206 CPU: 0
[  221.629066] EIP is at hfsplus_find_cat+0x10d/0x151
[  221.629066] EAX: 00000029 EBX: 00016210 ECX: 000042c2 EDX: 00000002
[  221.629066] ESI: c82d70ca EDI: c82b0000 EBP: c82d1bcc ESP: c82d199c
[  221.629066]  DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
[  221.629066] Process mount (pid: 4845, ti=c82d1000 task=c8224060 task.ti=c82d1000)
[  221.629066] Stack: c080b3c4 c82aa8f8 c82d19c2 00016210 c080b3be c82d1bd4 c82aa8f0 00000300
[  221.629066]        01000000 750008b1 74006e00 74006900 65006c00 c82d6400 c013bd35 c8224060
[  221.629066]        00000036 00000046 c82d19f0 00000082 c8224548 c8224060 00000036 c0d653cc
[  221.629066] Call Trace:
[  221.629066]  [&lt;c013bd35&gt;] ? trace_hardirqs_off+0xb/0xd
[  221.629066]  [&lt;c013bca3&gt;] ? trace_hardirqs_off_caller+0x14/0x9b
[  221.629066]  [&lt;c013bd35&gt;] ? trace_hardirqs_off+0xb/0xd
[  221.629066]  [&lt;c013bca3&gt;] ? trace_hardirqs_off_caller+0x14/0x9b
[  221.629066]  [&lt;c013bd35&gt;] ? trace_hardirqs_off+0xb/0xd
[  221.629066]  [&lt;c0107aa3&gt;] ? native_sched_clock+0x82/0x96
[  221.629066]  [&lt;c01302d2&gt;] ? __kernel_text_address+0x1b/0x27
[  221.629066]  [&lt;c010487a&gt;] ? dump_trace+0xca/0xd6
[  221.629066]  [&lt;c0109e32&gt;] ? save_stack_address+0x0/0x2c
[  221.629066]  [&lt;c0109eaf&gt;] ? save_stack_trace+0x1c/0x3a
[  221.629066]  [&lt;c013b571&gt;] ? save_trace+0x37/0x8d
[  221.629066]  [&lt;c013b62e&gt;] ? add_lock_to_list+0x67/0x8d
[  221.629066]  [&lt;c013ea1c&gt;] ? validate_chain+0x8a4/0x9f4
[  221.629066]  [&lt;c013553d&gt;] ? down+0xc/0x2f
[  221.629066]  [&lt;c013f1f6&gt;] ? __lock_acquire+0x68a/0x6e0
[  221.629066]  [&lt;c013bd35&gt;] ? trace_hardirqs_off+0xb/0xd
[  221.629066]  [&lt;c013bca3&gt;] ? trace_hardirqs_off_caller+0x14/0x9b
[  221.629066]  [&lt;c013bd35&gt;] ? trace_hardirqs_off+0xb/0xd
[  221.629066]  [&lt;c0107aa3&gt;] ? native_sched_clock+0x82/0x96
[  221.629066]  [&lt;c013da5d&gt;] ? mark_held_locks+0x43/0x5a
[  221.629066]  [&lt;c013dc3a&gt;] ? trace_hardirqs_on+0xb/0xd
[  221.629066]  [&lt;c013dbf4&gt;] ? trace_hardirqs_on_caller+0xf4/0x12f
[  221.629066]  [&lt;c06abec8&gt;] ? _spin_unlock_irqrestore+0x42/0x58
[  221.629066]  [&lt;c013555c&gt;] ? down+0x2b/0x2f
[  221.629066]  [&lt;c022aa68&gt;] ? hfsplus_iget+0xa0/0x154
[  221.629066]  [&lt;c022b0b9&gt;] ? hfsplus_fill_super+0x280/0x447
[  221.629066]  [&lt;c0107aa3&gt;] ? native_sched_clock+0x82/0x96
[  221.629066]  [&lt;c013bca3&gt;] ? trace_hardirqs_off_caller+0x14/0x9b
[  221.629066]  [&lt;c013bca3&gt;] ? trace_hardirqs_off_caller+0x14/0x9b
[  221.629066]  [&lt;c013f1f6&gt;] ? __lock_acquire+0x68a/0x6e0
[  221.629066]  [&lt;c041c9e4&gt;] ? string+0x2b/0x74
[  221.629066]  [&lt;c041cd16&gt;] ? vsnprintf+0x2e9/0x512
[  221.629066]  [&lt;c010487a&gt;] ? dump_trace+0xca/0xd6
[  221.629066]  [&lt;c0109eaf&gt;] ? save_stack_trace+0x1c/0x3a
[  221.629066]  [&lt;c0109eaf&gt;] ? save_stack_trace+0x1c/0x3a
[  221.629066]  [&lt;c013b571&gt;] ? save_trace+0x37/0x8d
[  221.629066]  [&lt;c013b62e&gt;] ? add_lock_to_list+0x67/0x8d
[  221.629066]  [&lt;c013ea1c&gt;] ? validate_chain+0x8a4/0x9f4
[  221.629066]  [&lt;c01354d3&gt;] ? up+0xc/0x2f
[  221.629066]  [&lt;c013f1f6&gt;] ? __lock_acquire+0x68a/0x6e0
[  221.629066]  [&lt;c013bd35&gt;] ? trace_hardirqs_off+0xb/0xd
[  221.629066]  [&lt;c013bca3&gt;] ? trace_hardirqs_off_caller+0x14/0x9b
[  221.629066]  [&lt;c013bd35&gt;] ? trace_hardirqs_off+0xb/0xd
[  221.629066]  [&lt;c0107aa3&gt;] ? native_sched_clock+0x82/0x96
[  221.629066]  [&lt;c041cfb7&gt;] ? snprintf+0x1b/0x1d
[  221.629066]  [&lt;c01ba466&gt;] ? disk_name+0x25/0x67
[  221.629066]  [&lt;c0183960&gt;] ? get_sb_bdev+0xcd/0x10b
[  221.629066]  [&lt;c016ad92&gt;] ? kstrdup+0x2a/0x4c
[  221.629066]  [&lt;c022a7b3&gt;] ? hfsplus_get_sb+0x13/0x15
[  221.629066]  [&lt;c022ae39&gt;] ? hfsplus_fill_super+0x0/0x447
[  221.629066]  [&lt;c0183583&gt;] ? vfs_kern_mount+0x3b/0x76
[  221.629066]  [&lt;c0183602&gt;] ? do_kern_mount+0x32/0xba
[  221.629066]  [&lt;c01960d4&gt;] ? do_new_mount+0x46/0x74
[  221.629066]  [&lt;c0196277&gt;] ? do_mount+0x175/0x193
[  221.629066]  [&lt;c013dbf4&gt;] ? trace_hardirqs_on_caller+0xf4/0x12f
[  221.629066]  [&lt;c01663b2&gt;] ? __get_free_pages+0x1e/0x24
[  221.629066]  [&lt;c06ac07b&gt;] ? lock_kernel+0x19/0x8c
[  221.629066]  [&lt;c01962e6&gt;] ? sys_mount+0x51/0x9b
[  221.629066]  [&lt;c01962f9&gt;] ? sys_mount+0x64/0x9b
[  221.629066]  [&lt;c01038bd&gt;] ? sysenter_do_call+0x12/0x31
[  221.629066]  =======================
[  221.629066] Code: 89 c2 c1 e2 08 c1 e8 08 09 c2 8b 85 e8 fd ff ff 66 89 50 06 89 c7 53 83 c7 08 56 57 68 c4 b3 80 c0 e8 8c 5c ef ff 89 d9 c1 e9 02 &lt;f3&gt; a5 89 d9 83 e1 03 74 02 f3 a4 83 c3 06 8b 95 e8 fd ff ff 0f
[  221.629066] EIP: [&lt;c022d4b1&gt;] hfsplus_find_cat+0x10d/0x151 SS:ESP 0068:c82d199c
[  221.629066] ---[ end trace e417a1d67f0d0066 ]---

Since hfsplus_cat_build_key_uni() returns void and only has one callsite,
the check is performed at the callsite.

Signed-off-by: Eric Sesterhenn &lt;snakebyte@gmx.de&gt;
Reviewed-by: Pekka Enberg &lt;penberg@cs.helsinki.fi&gt;
Cc: Roman Zippel &lt;zippel@linux-m68k.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>hfsplus: quieten down mounting hfsplus journaled fs read only</title>
<updated>2008-10-16T18:21:46+00:00</updated>
<author>
<name>Mike Crowe</name>
<email>mac@mcrowe.com</email>
</author>
<published>2008-10-16T05:04:05+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=81a73719d1bc77774f6ac91e2476f22c56f18baf'/>
<id>81a73719d1bc77774f6ac91e2476f22c56f18baf</id>
<content type='text'>
Check whether the file system was to be mounted read only anyway before
warning about changing the mount to read only.

Signed-off-by: Mike Crowe &lt;mac@mcrowe.com&gt;
Cc: Roman Zippel &lt;zippel@linux-m68k.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Check whether the file system was to be mounted read only anyway before
warning about changing the mount to read only.

Signed-off-by: Mike Crowe &lt;mac@mcrowe.com&gt;
Cc: Roman Zippel &lt;zippel@linux-m68k.org&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>vfs: Use const for kernel parser table</title>
<updated>2008-10-13T17:10:37+00:00</updated>
<author>
<name>Steven Whitehouse</name>
<email>swhiteho@redhat.com</email>
</author>
<published>2008-10-13T09:46:57+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=a447c0932445f92ce6f4c1bd020f62c5097a7842'/>
<id>a447c0932445f92ce6f4c1bd020f62c5097a7842</id>
<content type='text'>
This is a much better version of a previous patch to make the parser
tables constant. Rather than changing the typedef, we put the "const" in
all the various places where its required, allowing the __initconst
exception for nfsroot which was the cause of the previous trouble.

This was posted for review some time ago and I believe its been in -mm
since then.

Signed-off-by: Steven Whitehouse &lt;swhiteho@redhat.com&gt;
Cc: Alexander Viro &lt;aviro@redhat.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This is a much better version of a previous patch to make the parser
tables constant. Rather than changing the typedef, we put the "const" in
all the various places where its required, allowing the __initconst
exception for nfsroot which was the cause of the previous trouble.

This was posted for review some time ago and I believe its been in -mm
since then.

Signed-off-by: Steven Whitehouse &lt;swhiteho@redhat.com&gt;
Cc: Alexander Viro &lt;aviro@redhat.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[PATCH] f_count may wrap around</title>
<updated>2008-07-27T00:53:40+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@zeniv.linux.org.uk</email>
</author>
<published>2008-07-26T04:39:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=516e0cc5646f377ab80fcc2ee639892eccb99853'/>
<id>516e0cc5646f377ab80fcc2ee639892eccb99853</id>
<content type='text'>
make it atomic_long_t; while we are at it, get rid of useless checks in affs,
hfs and hpfs - -&gt;open() always has it equal to 1, -&gt;release() - to 0.

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
make it atomic_long_t; while we are at it, get rid of useless checks in affs,
hfs and hpfs - -&gt;open() always has it equal to 1, -&gt;release() - to 0.

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[PATCH] sanitize -&gt;permission() prototype</title>
<updated>2008-07-27T00:53:14+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@zeniv.linux.org.uk</email>
</author>
<published>2008-07-16T01:03:57+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=e6305c43eda10ebfd2ad9e35d6e172ccc7bb3695'/>
<id>e6305c43eda10ebfd2ad9e35d6e172ccc7bb3695</id>
<content type='text'>
* kill nameidata * argument; map the 3 bits in -&gt;flags anybody cares
  about to new MAY_... ones and pass with the mask.
* kill redundant gfs2_iop_permission()
* sanitize ecryptfs_permission()
* fix remaining places where -&gt;permission() instances might barf on new
  MAY_... found in mask.

The obvious next target in that direction is permission(9)

folded fix for nfs_permission() breakage from Miklos Szeredi &lt;mszeredi@suse.cz&gt;

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
* kill nameidata * argument; map the 3 bits in -&gt;flags anybody cares
  about to new MAY_... ones and pass with the mask.
* kill redundant gfs2_iop_permission()
* sanitize ecryptfs_permission()
* fix remaining places where -&gt;permission() instances might barf on new
  MAY_... found in mask.

The obvious next target in that direction is permission(9)

folded fix for nfs_permission() breakage from Miklos Szeredi &lt;mszeredi@suse.cz&gt;

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>SL*B: drop kmem cache argument from constructor</title>
<updated>2008-07-26T19:00:07+00:00</updated>
<author>
<name>Alexey Dobriyan</name>
<email>adobriyan@gmail.com</email>
</author>
<published>2008-07-26T02:45:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=51cc50685a4275c6a02653670af9f108a64e01cf'/>
<id>51cc50685a4275c6a02653670af9f108a64e01cf</id>
<content type='text'>
Kmem cache passed to constructor is only needed for constructors that are
themselves multiplexeres.  Nobody uses this "feature", nor does anybody uses
passed kmem cache in non-trivial way, so pass only pointer to object.

Non-trivial places are:
	arch/powerpc/mm/init_64.c
	arch/powerpc/mm/hugetlbpage.c

This is flag day, yes.

Signed-off-by: Alexey Dobriyan &lt;adobriyan@gmail.com&gt;
Acked-by: Pekka Enberg &lt;penberg@cs.helsinki.fi&gt;
Acked-by: Christoph Lameter &lt;cl@linux-foundation.org&gt;
Cc: Jon Tollefson &lt;kniht@linux.vnet.ibm.com&gt;
Cc: Nick Piggin &lt;nickpiggin@yahoo.com.au&gt;
Cc: Matt Mackall &lt;mpm@selenic.com&gt;
[akpm@linux-foundation.org: fix arch/powerpc/mm/hugetlbpage.c]
[akpm@linux-foundation.org: fix mm/slab.c]
[akpm@linux-foundation.org: fix ubifs]
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Kmem cache passed to constructor is only needed for constructors that are
themselves multiplexeres.  Nobody uses this "feature", nor does anybody uses
passed kmem cache in non-trivial way, so pass only pointer to object.

Non-trivial places are:
	arch/powerpc/mm/init_64.c
	arch/powerpc/mm/hugetlbpage.c

This is flag day, yes.

Signed-off-by: Alexey Dobriyan &lt;adobriyan@gmail.com&gt;
Acked-by: Pekka Enberg &lt;penberg@cs.helsinki.fi&gt;
Acked-by: Christoph Lameter &lt;cl@linux-foundation.org&gt;
Cc: Jon Tollefson &lt;kniht@linux.vnet.ibm.com&gt;
Cc: Nick Piggin &lt;nickpiggin@yahoo.com.au&gt;
Cc: Matt Mackall &lt;mpm@selenic.com&gt;
[akpm@linux-foundation.org: fix arch/powerpc/mm/hugetlbpage.c]
[akpm@linux-foundation.org: fix mm/slab.c]
[akpm@linux-foundation.org: fix ubifs]
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
</pre>
</div>
</content>
</entry>
</feed>
