Skip to content

Commit 3618002

Browse files
torvaldstorvalds
committed
Merge tag 'vfs-6.15-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner: - Fix NULL pointer dereference in virtiofs - Fix slab OOB access in hfs/hfsplus - Only create /proc/fs/netfs when CONFIG_PROC_FS is set - Fix getname_flags() to initialize pointer correctly - Convert dentry flags to enum - Don't allow datadir without lowerdir in overlayfs - Use namespace_{lock,unlock} helpers in dissolve_on_fput() instead of plain namespace_sem so unmounted mounts are properly cleaned up - Skip unnecessary ifs_block_is_uptodate check in iomap - Remove an unused forward declaration in overlayfs - Fix devpts uid/gid handling after converting to the new mount api - Fix afs_dynroot_readdir() to not use the RCU read lock - Fix mount_setattr() and open_tree_attr() to not pointlessly do path lookup or walk the mount tree if no mount option change has been requested * tag 'vfs-6.15-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: use namespace_{lock,unlock} in dissolve_on_fput() iomap: skip unnecessary ifs_block_is_uptodate check fs: Fix filename init after recent refactoring netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS mount: ensure we don't pointlessly walk the mount tree dcache: convert dentry flag macros to enum afs: Fix afs_dynroot_readdir() to not use the RCU read lock hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key virtiofs: add filesystem context source name check devpts: Fix type for uid and gid params ovl: remove unused forward declaration ovl: don't allow datadir only
2 parents 10e66f2 + e2aef86 commit 3618002

File tree

12 files changed

+104
-80
lines changed

12 files changed

+104
-80
lines changed

‎fs/afs/dynroot.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -348,9 +348,9 @@ static int afs_dynroot_readdir(struct file *file, struct dir_context *ctx)
348348
}
349349

350350
if ((unsigned long long)ctx->pos <= AFS_MAX_DYNROOT_CELL_INO) {
351-
rcu_read_lock();
351+
down_read(&net->cells_lock);
352352
ret = afs_dynroot_readdir_cells(net, ctx);
353-
rcu_read_unlock();
353+
up_read(&net->cells_lock);
354354
}
355355
return ret;
356356
}

‎fs/devpts/inode.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -89,12 +89,12 @@ enum {
8989
};
9090

9191
static const struct fs_parameter_spec devpts_param_specs[] = {
92-
fsparam_u32 ("gid", Opt_gid),
92+
fsparam_gid ("gid", Opt_gid),
9393
fsparam_s32 ("max", Opt_max),
9494
fsparam_u32oct ("mode", Opt_mode),
9595
fsparam_flag ("newinstance", Opt_newinstance),
9696
fsparam_u32oct ("ptmxmode", Opt_ptmxmode),
97-
fsparam_u32 ("uid", Opt_uid),
97+
fsparam_uid ("uid", Opt_uid),
9898
{}
9999
};
100100

‎fs/fuse/virtio_fs.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1669,6 +1669,9 @@ static int virtio_fs_get_tree(struct fs_context *fsc)
16691669
unsigned int virtqueue_size;
16701670
int err = -EIO;
16711671

1672+
if (!fsc->source)
1673+
return invalf(fsc, "No source specified");
1674+
16721675
/* This gets a reference on virtio_fs object. This ptr gets installed
16731676
* in fc->iq->priv. Once fuse_conn is going away, it calls ->put()
16741677
* to drop the reference to this object.

‎fs/hfs/bnode.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,12 @@ void hfs_bnode_read_key(struct hfs_bnode *node, void *key, int off)
6767
else
6868
key_len = tree->max_key_len + 1;
6969

70+
if (key_len > sizeof(hfs_btree_key) || key_len < 1) {
71+
memset(key, 0, sizeof(hfs_btree_key));
72+
pr_err("hfs: Invalid key length: %d\n", key_len);
73+
return;
74+
}
75+
7076
hfs_bnode_read(node, key, off, key_len);
7177
}
7278

‎fs/hfsplus/bnode.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,12 @@ void hfs_bnode_read_key(struct hfs_bnode *node, void *key, int off)
6767
else
6868
key_len = tree->max_key_len + 2;
6969

70+
if (key_len > sizeof(hfsplus_btree_key) || key_len < 1) {
71+
memset(key, 0, sizeof(hfsplus_btree_key));
72+
pr_err("hfsplus: Invalid key length: %d\n", key_len);
73+
return;
74+
}
75+
7076
hfs_bnode_read(node, key, off, key_len);
7177
}
7278

‎fs/iomap/buffered-io.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,7 @@ static void iomap_adjust_read_range(struct inode *inode, struct folio *folio,
259259
}
260260

261261
/* truncate len if we find any trailing uptodate block(s) */
262-
for ( ; i <= last; i++) {
262+
while (++i <= last) {
263263
if (ifs_block_is_uptodate(ifs, i)) {
264264
plen -= (last - i + 1) * block_size;
265265
last = i - 1;

‎fs/namei.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -125,9 +125,9 @@
125125

126126
#define EMBEDDED_NAME_MAX (PATH_MAX - offsetof(struct filename, iname))
127127

128-
static inline void initname(struct filename *name)
128+
static inline void initname(struct filename *name, const char __user *uptr)
129129
{
130-
name->uptr = NULL;
130+
name->uptr = uptr;
131131
name->aname = NULL;
132132
atomic_set(&name->refcnt, 1);
133133
}
@@ -210,7 +210,7 @@ getname_flags(const char __user *filename, int flags)
210210
return ERR_PTR(-ENAMETOOLONG);
211211
}
212212
}
213-
initname(result);
213+
initname(result, filename);
214214
audit_getname(result);
215215
return result;
216216
}
@@ -268,7 +268,7 @@ struct filename *getname_kernel(const char * filename)
268268
return ERR_PTR(-ENAMETOOLONG);
269269
}
270270
memcpy((char *)result->name, filename, len);
271-
initname(result);
271+
initname(result, NULL);
272272
audit_getname(result);
273273
return result;
274274
}

‎fs/namespace.c

Lines changed: 21 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1830,6 +1830,8 @@ static inline void namespace_lock(void)
18301830
down_write(&namespace_sem);
18311831
}
18321832

1833+
DEFINE_GUARD(namespace_lock, struct rw_semaphore *, namespace_lock(), namespace_unlock())
1834+
18331835
enum umount_tree_flags {
18341836
UMOUNT_SYNC = 1,
18351837
UMOUNT_PROPAGATE = 2,
@@ -2383,7 +2385,7 @@ void dissolve_on_fput(struct vfsmount *mnt)
23832385
return;
23842386
}
23852387

2386-
scoped_guard(rwsem_write, &namespace_sem) {
2388+
scoped_guard(namespace_lock, &namespace_sem) {
23872389
ns = m->mnt_ns;
23882390
if (!must_dissolve(ns))
23892391
return;
@@ -5189,8 +5191,8 @@ static void finish_mount_kattr(struct mount_kattr *kattr)
51895191
mnt_idmap_put(kattr->mnt_idmap);
51905192
}
51915193

5192-
static int copy_mount_setattr(struct mount_attr __user *uattr, size_t usize,
5193-
struct mount_kattr *kattr)
5194+
static int wants_mount_setattr(struct mount_attr __user *uattr, size_t usize,
5195+
struct mount_kattr *kattr)
51945196
{
51955197
int ret;
51965198
struct mount_attr attr;
@@ -5213,9 +5215,13 @@ static int copy_mount_setattr(struct mount_attr __user *uattr, size_t usize,
52135215
if (attr.attr_set == 0 &&
52145216
attr.attr_clr == 0 &&
52155217
attr.propagation == 0)
5216-
return 0;
5218+
return 0; /* Tell caller to not bother. */
5219+
5220+
ret = build_mount_kattr(&attr, usize, kattr);
5221+
if (ret < 0)
5222+
return ret;
52175223

5218-
return build_mount_kattr(&attr, usize, kattr);
5224+
return 1;
52195225
}
52205226

52215227
SYSCALL_DEFINE5(mount_setattr, int, dfd, const char __user *, path,
@@ -5247,8 +5253,8 @@ SYSCALL_DEFINE5(mount_setattr, int, dfd, const char __user *, path,
52475253
if (flags & AT_RECURSIVE)
52485254
kattr.kflags |= MOUNT_KATTR_RECURSE;
52495255

5250-
err = copy_mount_setattr(uattr, usize, &kattr);
5251-
if (err)
5256+
err = wants_mount_setattr(uattr, usize, &kattr);
5257+
if (err <= 0)
52525258
return err;
52535259

52545260
err = user_path_at(dfd, path, kattr.lookup_flags, &target);
@@ -5282,15 +5288,17 @@ SYSCALL_DEFINE5(open_tree_attr, int, dfd, const char __user *, filename,
52825288
if (flags & AT_RECURSIVE)
52835289
kattr.kflags |= MOUNT_KATTR_RECURSE;
52845290

5285-
ret = copy_mount_setattr(uattr, usize, &kattr);
5286-
if (ret)
5291+
ret = wants_mount_setattr(uattr, usize, &kattr);
5292+
if (ret < 0)
52875293
return ret;
52885294

5289-
ret = do_mount_setattr(&file->f_path, &kattr);
5290-
if (ret)
5291-
return ret;
5295+
if (ret) {
5296+
ret = do_mount_setattr(&file->f_path, &kattr);
5297+
if (ret)
5298+
return ret;
52925299

5293-
finish_mount_kattr(&kattr);
5300+
finish_mount_kattr(&kattr);
5301+
}
52945302
}
52955303

52965304
fd = get_unused_fd_flags(flags & O_CLOEXEC);

‎fs/netfs/main.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,11 +127,13 @@ static int __init netfs_init(void)
127127
if (mempool_init_slab_pool(&netfs_subrequest_pool, 100, netfs_subrequest_slab) < 0)
128128
goto error_subreqpool;
129129

130+
#ifdef CONFIG_PROC_FS
130131
if (!proc_mkdir("fs/netfs", NULL))
131132
goto error_proc;
132133
if (!proc_create_seq("fs/netfs/requests", S_IFREG | 0444, NULL,
133134
&netfs_requests_seq_ops))
134135
goto error_procfile;
136+
#endif
135137
#ifdef CONFIG_FSCACHE_STATS
136138
if (!proc_create_single("fs/netfs/stats", S_IFREG | 0444, NULL,
137139
netfs_stats_show))
@@ -144,9 +146,11 @@ static int __init netfs_init(void)
144146
return 0;
145147

146148
error_fscache:
149+
#ifdef CONFIG_PROC_FS
147150
error_procfile:
148151
remove_proc_subtree("fs/netfs", NULL);
149152
error_proc:
153+
#endif
150154
mempool_exit(&netfs_subrequest_pool);
151155
error_subreqpool:
152156
kmem_cache_destroy(netfs_subrequest_slab);

‎fs/overlayfs/overlayfs.h

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -541,8 +541,6 @@ int ovl_set_metacopy_xattr(struct ovl_fs *ofs, struct dentry *d,
541541
bool ovl_is_metacopy_dentry(struct dentry *dentry);
542542
char *ovl_get_redirect_xattr(struct ovl_fs *ofs, const struct path *path, int padding);
543543
int ovl_ensure_verity_loaded(struct path *path);
544-
int ovl_get_verity_xattr(struct ovl_fs *ofs, const struct path *path,
545-
u8 *digest_buf, int *buf_length);
546544
int ovl_validate_verity(struct ovl_fs *ofs,
547545
struct path *metapath,
548546
struct path *datapath);

0 commit comments

Comments
 (0)