Jan Kara 34820fc89c udf: Check length of extended attributes and allocation descriptors ...

commit 23b133bdc4 upstream.

Check length of extended attributes and allocation descriptors when
loading inodes from disk. Otherwise corrupted filesystems could confuse
the code and make the kernel oops.

This fixes CVE-2015-4167.

Reported-by: Carl Henrik Lunde <chlunde@ping.uio.no>
Signed-off-by: Jan Kara <jack@suse.cz>
[Use make_bad_inode() instead of branching due to older implementation.]
Signed-off-by: Chas Williams <3chas3@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2015-10-01 11:36:26 +02:00

..

9p

9p: don't leave a half-initialized inode sitting around

2015-08-03 09:29:59 -07:00

adfs

adfs: delayed freeing of sbi

2013-10-24 23:43:27 -04:00

affs

move d_rcu from overlapping d_child to overlapping d_alias

2015-04-29 10:31:54 +02:00

afs

afs: proc cells and rootcell are writeable

2014-02-01 10:59:39 -08:00

autofs4

move d_rcu from overlapping d_child to overlapping d_alias

2015-04-29 10:31:54 +02:00

befs

befs: iget_locked() doesn't return an ERR_PTR

2014-01-25 03:14:38 -05:00

bfs

truncate: drop 'oldsize' truncate_pagecache() parameter

2013-09-12 15:38:02 -07:00

btrfs

Btrfs: check if previous transaction aborted to avoid fs corruption

2015-10-01 11:36:12 +02:00

cachefiles

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2013-11-13 15:34:18 +09:00

ceph

move d_rcu from overlapping d_child to overlapping d_alias

2015-04-29 10:31:54 +02:00

cifs

CIFS: fix type confusion in copy offload ioctl

2015-10-01 11:36:11 +02:00

coda

move d_rcu from overlapping d_child to overlapping d_alias

2015-04-29 10:31:54 +02:00

configfs

configfs: fix race between dentry put and lookup

2013-11-21 16:42:27 -08:00

cramfs

mm: remove read_cache_page_async()

2014-11-21 09:23:06 -08:00

debugfs

move d_rcu from overlapping d_child to overlapping d_alias

2015-04-29 10:31:54 +02:00

devpts

devpts: plug the memory leak in kill_sb

2013-11-13 12:09:36 +09:00

dlm

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2014-01-25 11:17:34 -08:00

ecryptfs

eCryptfs: Remove buggy and unnecessary write in file name decode routine

2015-01-08 10:00:51 -08:00

efivarfs

consolidate simple ->d_delete() instances

2013-11-15 22:04:17 -05:00

efs

efs: get rid of ->put_super()

2014-01-25 03:13:02 -05:00

exofs

exofs: Print less in r4w

2014-01-23 18:54:14 +02:00

exportfs

move d_rcu from overlapping d_child to overlapping d_alias

2015-04-29 10:31:54 +02:00

ext2

ext2/3/4: use generic posix ACL infrastructure

2014-01-25 23:58:19 -05:00

ext3

ext3: Don't check quota format when there are no quota files

2014-11-14 09:00:09 -08:00

ext4

ext4: replace open coded nofail allocation in ext4_free_blocks()

2015-08-03 09:29:53 -07:00

f2fs

mm: non-atomically mark page accessed during page cache allocation where possible

2015-01-29 17:40:52 -08:00

fat

fat: rcu-delay unloading nls and freeing sbi

2013-10-24 23:43:28 -04:00

freevxfs

[readdir] convert freevxfs

2013-06-29 12:56:53 +04:00

fscache

FS-Cache: Handle removal of unadded object to the fscache_object_list rb tree

2014-02-17 13:47:35 -08:00

fuse

fuse: initialize fc->release before calling it

2015-08-03 09:29:57 -07:00

gfs2

mm: non-atomically mark page accessed during page cache allocation where possible

2015-01-29 17:40:52 -08:00

hfs

hfs,hfsplus: cache pages correctly between bnode_create and bnode_free

2015-10-01 11:36:18 +02:00

hfsplus

hfs,hfsplus: cache pages correctly between bnode_create and bnode_free

2015-10-01 11:36:18 +02:00

hostfs

um: hostfs: make functions static

2014-01-26 11:51:09 +01:00

hpfs

hpfs: update ctime and mtime on directory modification

2015-09-21 10:02:21 -07:00

hppfs

clean up scary strncpy(dst, src, strlen(src)) uses

2013-07-03 16:07:41 -07:00

hugetlbfs

hugetlb: ensure hugepage access is denied if hugepages are not supported

2014-10-09 12:21:27 -07:00

isofs

isofs: Fix unchecked printing of ER records

2015-01-08 10:00:49 -08:00

jbd

jbd: Revise KERN_EMERG error messages

2013-12-04 12:27:46 +01:00

jbd2

jbd2: fix ocfs2 corrupt when updating journal superblock fails

2015-08-03 09:29:53 -07:00

jffs2

jffs2: fix handling of corrupted summary length

2015-03-06 14:43:32 -08:00

jfs

jfs: set i_ctime when setting ACL

2014-02-13 15:56:05 -06:00

kernfs

kernfs: add back missing error check in kernfs_fop_mmap()

2014-06-07 10:28:08 -07:00

lockd

LOCKD: Fix a race when initialising nlmsvc_timeout

2015-01-27 08:18:58 -08:00

logfs

Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block

2014-01-30 11:19:05 -08:00

minix

fs/minix: Drop dependency on H8300

2013-09-16 18:20:25 -07:00

ncpfs

move d_rcu from overlapping d_child to overlapping d_alias

2015-04-29 10:31:54 +02:00

nfs

NFS: nfs_set_pgio_error sometimes misses errors

2015-10-01 11:36:13 +02:00

nfs_common

nfs_common: Update the translation between nfsv3 acls linux posix acls

2013-02-13 06:15:14 -08:00

nfsd

nfsd4: fix xdr4 inclusion of escaped char

2015-01-16 06:59:33 -08:00

nilfs2

nilfs2: fix sanity check of btree level in nilfs_btree_root_broken()

2015-05-17 09:53:49 -07:00

nls

nls: have register_nls() set ->owner

2014-01-25 03:14:05 -05:00

notify

fsnotify: fix oops in fsnotify_clear_marks_by_group_flags()

2015-08-16 20:51:45 -07:00

ntfs

mm: non-atomically mark page accessed during page cache allocation where possible

2015-01-29 17:40:52 -08:00

ocfs2

ocfs2: fix BUG in ocfs2_downconvert_thread_do_work()

2015-08-16 20:51:50 -07:00

omfs

fs, omfs: add NULL terminator in the end up the token list

2015-06-06 08:19:31 -07:00

openpromfs

[readdir] convert openpromfs

2013-06-29 12:56:32 +04:00

proc

proc/pagemap: walk page tables under pte lock

2015-04-29 10:31:56 +02:00

pstore

pstore: Fix NULL pointer fault if get NULL prz in ramoops_get_next_prz

2015-02-05 22:35:52 -08:00

qnx4

qnx4: clean qnx4_fill_super() up

2014-01-25 03:13:03 -05:00

qnx6

[readdir] convert qnx6

2013-06-29 12:56:39 +04:00

quota

quota: Properly return errors from dquot_writeback_dquots()

2014-11-14 09:00:09 -08:00

ramfs

fs/ramfs: move ramfs_aops to inode.c

2014-01-23 16:36:58 -08:00

reiserfs

reiserfs: call truncate_setsize under tailpack mutex

2014-07-06 18:57:29 -07:00

romfs

romfs: fix returm err while getting inode in fill_super

2014-01-23 16:37:04 -08:00

squashfs

Squashfs: fix failure to unlock pages on decompress error

2013-11-24 01:02:50 +00:00

sysfs

sysfs: make sure read buffer is zeroed

2014-06-07 10:28:24 -07:00

sysv

sysv: Add forgotten superblock lock init for v7 fs

2013-09-29 22:02:02 -04:00

ubifs

UBIFS: fix free log space calculation

2014-11-14 08:59:46 -08:00

udf

udf: Check length of extended attributes and allocation descriptors

2015-10-01 11:36:26 +02:00

ufs

truncate: drop 'oldsize' truncate_pagecache() parameter

2013-09-12 15:38:02 -07:00

xfs

xfs: fix remote symlinks on V5/CRC filesystems

2015-08-03 09:29:56 -07:00

aio.c

ioctx_alloc(): fix vma (and file) leak on failure

2015-04-19 10:11:09 +02:00

anon_inodes.c

vfs: Allocate anon_inode_inode in anon_inode_init()

2014-03-27 09:52:54 -07:00

attr.c

fs,userns: Change inode_capable to capable_wrt_inode_uidgid

2014-06-16 13:40:32 -07:00

bad_inode.c

[readdir] ->readdir() is gone

2013-06-29 12:57:04 +04:00

binfmt_aout.c

dump_skip(): dump_seek() replacement taking coredump_params

2013-11-09 00:16:26 -05:00

binfmt_elf_fdpic.c

elf{,_fdpic} coredump: get rid of pointless if (siginfo->si_signo)

2013-11-09 00:16:30 -05:00

binfmt_elf.c

fs/binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings

2015-06-06 08:19:40 -07:00

binfmt_em86.c

file->f_op is never NULL...

2013-10-24 23:34:54 -04:00

binfmt_flat.c

new helper: read_code()

2013-04-29 15:40:23 -04:00

binfmt_misc.c

binfmt_misc: reuse string_unescape_inplace()

2013-04-30 17:04:03 -07:00

binfmt_script.c

…

binfmt_som.c

…

bio-integrity.c

bio-integrity: Drop bio_integrity_verify BUG_ON in post bip->bip_iter world

2014-02-21 15:56:36 -08:00

bio.c

block: Do a full clone when splitting discard bios

2015-08-03 09:29:58 -07:00

block_dev.c

Merge tag 'writeback-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/wfg/linux

2013-09-13 23:06:40 -04:00

buffer.c

mm: non-atomically mark page accessed during page cache allocation where possible

2015-01-29 17:40:52 -08:00

char_dev.c

Merge branch 'for-3.13/core' of git://git.kernel.dk/linux-block

2013-11-14 12:08:14 +09:00

compat_binfmt_elf.c

…

compat_ioctl.c

fs/compat_ioctl.c: fix an underflow issue (harmless)

2014-01-21 16:19:42 -08:00

compat.c

[readdir] constify ->actor

2013-06-29 12:57:05 +04:00

coredump.c

fs: if a coredump already exists, unlink and recreate with O_EXCL

2015-10-01 11:36:14 +02:00

dcache.c

dcache: don't need rcu in shrink_dentry_list()

2015-08-16 20:51:54 -07:00

dcookies.c

fs/compat: fix lookup_dcookie() parameter handling

2014-01-29 16:22:40 -08:00

direct-io.c

block: Abstract out bvec iterator

2013-11-23 22:33:47 -08:00

drop_caches.c

shrinker: add node awareness

2013-09-10 18:56:31 -04:00

eventfd.c

eventfd_ctx_fdget(): use fdget() instead of fget()

2014-01-25 03:13:04 -05:00

eventpoll.c

eventpoll: fix uninitialized variable in epoll_ctl

2014-10-05 14:52:20 -07:00

exec.c

fs: take i_mutex during prepare_binprm for set[ug]id executables

2015-05-06 21:59:21 +02:00

fcntl.c

file->f_op is never NULL...

2013-10-24 23:34:54 -04:00

fhandle.c

vfs: read file_handle only once in handle_to_path

2015-06-06 08:19:40 -07:00

file_table.c

don't bother with {get,put}_write_access() on non-regular files

2014-05-31 13:20:29 -07:00

file.c

vfs: Don't let __fdget_pos() get FMODE_PATH files

2014-03-23 00:03:12 -04:00

filesystems.c

fs: Limit sys_mount to only request filesystem modules.

2013-03-03 19:36:31 -08:00

fs_struct.c

seqcount: Add lockdep functionality to seqcount/seqlock structures

2013-11-06 12:40:26 +01:00

fs-writeback.c

writeback: fix a subtle race condition in I_DIRTY clearing

2015-01-16 06:59:32 -08:00

inode.c

fs: Fix S_NOSEC handling

2015-07-10 10:37:59 -07:00

internal.h

get rid of s_files and files_lock

2013-11-09 00:16:20 -05:00

ioctl.c

file->f_op is never NULL...

2013-10-24 23:34:54 -04:00

ioprio.c

block: Fix computation of merged request priority

2014-11-21 09:23:03 -08:00

Kconfig

fs: remove generic_acl

2014-01-26 08:26:40 -05:00

Kconfig.binfmt

fs: make binfmt support for #! scripts modular and removable

2013-04-30 17:04:04 -07:00

libfs.c

move d_rcu from overlapping d_child to overlapping d_alias

2015-04-29 10:31:54 +02:00

locks.c

locks: eliminate BUG() call when there's an unexpected lock on file close

2014-12-06 15:55:39 -08:00

Makefile

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-01-28 08:38:04 -08:00

mbcache.c

fs: convert fs shrinkers to new scan/count API

2013-09-10 18:56:31 -04:00

mount.h

switch mnt_hash to hlist

2014-03-30 19:18:51 -04:00

mpage.c

block: Abstract out bvec iterator

2013-11-23 22:33:47 -08:00

namei.c

path_openat(): fix double fput()

2015-08-16 20:51:54 -07:00

namespace.c

vfs: Ignore unlocked mounts in fs_fully_visible

2015-07-10 10:37:59 -07:00

no-block.c

…

open.c

NFS: fix BUG() crash in notify_change() with patch to chown_common()

2015-05-06 21:59:11 +02:00

pipe.c

pipe: iovec: Fix memory corruption when retrying atomic copy as non-atomic

2015-06-29 12:25:37 -07:00

pnode.c

get rid of propagate_umount() mistakenly treating slaves as busy.

2014-09-17 09:19:22 -07:00

pnode.h

smarter propagate_mnt()

2014-05-06 07:59:36 -07:00

posix_acl.c

posix_acl: handle NULL ACL in posix_acl_equiv_mode

2014-06-07 10:28:16 -07:00

proc_namespace.c

fs/proc_namespace.c: simplify testing nsp and nsp->mnt_ns

2014-01-23 16:37:02 -08:00

read_write.c

vfs: atomic f_pos access in llseek()

2014-03-23 00:03:12 -04:00

readdir.c

file->f_op is never NULL...

2013-10-24 23:34:54 -04:00

select.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2013-11-13 15:34:18 +09:00

seq_file.c

seq_file: always clear m->count when we free m->buf

2013-11-18 19:07:53 -08:00

signalfd.c

signalfd: fix information leak in signalfd_copyinfo

2015-08-16 20:51:51 -07:00

splice.c

splice: Apply generic position and size checks to each write

2015-07-03 19:49:05 -07:00

stack.c

…

stat.c

vfs: split out vfs_getattr_nosec

2013-11-09 00:16:31 -05:00

statfs.c

vfs: allow O_PATH file descriptors for fstatfs()

2013-10-12 13:12:31 -07:00

super.c

fs/superblock: avoid locking counting inodes and dentries before reclaiming them

2014-11-21 09:23:07 -08:00

sync.c

Revert "writeback: do not sync data dirtied after sync start"

2014-02-22 02:02:28 +01:00

timerfd.c

timerfd: Add alarm timers

2013-05-29 12:57:34 -07:00

utimes.c

locks: break delegations on any attribute modification

2013-11-09 00:16:44 -05:00

xattr.c

…