Eric Biggers aa3a0a70bd FS-Cache: fix dereference of NULL user_key_payload ...

commit d124b2c53c upstream.

When the file /proc/fs/fscache/objects (available with
CONFIG_FSCACHE_OBJECT_LIST=y) is opened, we request a user key with
description "fscache:objlist", then access its payload.  However, a
revoked key has a NULL payload, and we failed to check for this.
request_key() *does* skip revoked keys, but there is still a window
where the key can be revoked before we access its payload.

Fix it by checking for a NULL payload, treating it like a key which was
already revoked at the time it was requested.

Fixes: 4fbf4291aa ("FS-Cache: Allow the current state of all objects to be dumped")
Reviewed-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-10-27 10:23:18 +02:00

..

9p

9p: fix a potential acl leak

2017-05-14 13:32:54 +02:00

adfs

fs/adfs: remove unneeded cast

2015-06-30 19:44:57 -07:00

affs

affs: fix remount failure when there are no options changed

2016-06-07 18:14:32 -07:00

afs

net: Add a struct net parameter to sock_create_kern

2015-05-11 10:50:17 -04:00

autofs4

autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL

2017-06-29 12:48:50 +02:00

befs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

bfs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-04-26 17:22:07 -07:00

btrfs

Btrfs: send, fix failure to rename top level inode due to name collision

2017-10-21 17:09:04 +02:00

cachefiles

FS-Cache: Add missing initialization of ret in cachefiles_write_page()

2015-11-16 20:38:43 -05:00

ceph

ceph: clean up unsafe d_parent accesses in build_dentry_path

2017-10-21 17:09:06 +02:00

cifs

CIFS: Reconnect expired SMB sessions

2017-10-18 09:20:40 +02:00

coda

fs/coda: fix readlink buffer overflow

2015-09-10 13:29:01 -07:00

configfs

configfs: Fix race between create_link and configfs_rmdir

2017-06-26 07:13:08 +02:00

cramfs

…

debugfs

dentry name snapshots

2017-08-06 19:19:42 -07:00

devpts

devpts: clean up interface to pty drivers

2016-08-16 09:30:49 +02:00

dlm

dlm: avoid double-free on error path in dlm_device_{register,unregister}

2017-09-13 14:09:45 -07:00

ecryptfs

ecryptfs: fix handling of directory opening

2016-09-15 08:27:47 +02:00

efivarfs

efi: Make efivarfs entries immutable by default

2016-03-03 15:07:09 -08:00

efs

fs/efs: femove unneeded cast

2015-06-25 17:00:42 -07:00

exofs

osd fs: __r4w_get_page rely on PageUptodate for uptodate

2015-12-12 10:15:34 -08:00

exportfs

…

ext2

posix_acl: Clear SGID bit when setting file permissions

2016-10-31 04:13:58 -06:00

ext4

fscrypt: fix dereference of NULL user_key_payload

2017-10-27 10:23:18 +02:00

f2fs

fscrypto: require write access to mount to set encryption policy

2017-10-27 10:23:18 +02:00

fat

fat: fix using uninitialized fields of fat_inode/fsinfo_inode

2017-03-15 09:57:15 +08:00

freevxfs

freevxfs: Grammar s/an negative/a negative/

2015-08-07 13:59:24 +02:00

fscache

FS-Cache: fix dereference of NULL user_key_payload

2017-10-27 10:23:18 +02:00

fuse

fuse: initialize the flock flag in fuse_file on allocation

2017-08-16 13:40:28 -07:00

gfs2

GFS2: Fix reference to ERR_PTR in gfs2_glock_iter_next

2017-10-08 10:14:16 +02:00

hfs

hfs: fix B-tree corruption after insertion at position 0

2015-09-10 13:29:01 -07:00

hfsplus

posix_acl: Clear SGID bit when setting file permissions

2016-10-31 04:13:58 -06:00

hostfs

hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common()

2016-09-30 10:18:39 +02:00

hpfs

hpfs: implement the show_options method

2016-06-01 12:15:54 -07:00

hugetlbfs

mm: larger stack guard gap, between vmas

2017-06-26 07:13:11 +02:00

isofs

isofs: Do not return EACCES for unknown filesystems

2016-10-28 03:01:34 -04:00

jbd2

jbd2: don't leak modified metadata buffers on an aborted journal

2017-03-12 06:37:26 +01:00

jffs2

posix_acl: Clear SGID bit when setting file permissions

2016-10-31 04:13:58 -06:00

jfs

fs: add i_blocksize()

2017-06-14 13:16:24 +02:00

kernfs

kernfs: don't depend on d_find_any_alias() when generating notifications

2016-09-24 10:07:36 +02:00

lockd

Merge tag 'nfsd-4.4' of git://linux-nfs.org/~bfields/linux

2015-11-11 20:11:28 -08:00

logfs

mm, fs: introduce mapping_gfp_constraint()

2015-11-06 17:50:42 -08:00

minix

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

ncpfs

ncpfs: fix a braino in OOM handling in ncp_fill_cache()

2016-03-16 08:42:59 -07:00

nfs

NFS: Fix 2 use after free issues in the I/O code

2017-09-13 14:09:46 -07:00

nfs_common

lockd: NLM grace period shouldn't block NFSv4 opens

2015-08-13 10:22:06 -04:00

nfsd

nfsd/callback: Cleanup callback cred on shutdown

2017-10-21 17:09:06 +02:00

nilfs2

fs: add i_blocksize()

2017-06-14 13:16:24 +02:00

nls

…

notify

dentry name snapshots

2017-08-06 19:19:42 -07:00

ntfs

mm, fs: introduce mapping_gfp_constraint()

2015-11-06 17:50:42 -08:00

ocfs2

ocfs2/dlmglue: prepare tracking logic to avoid recursive cluster lock

2017-10-21 17:09:05 +02:00

omfs

omfs: fix potential integer overflow in allocator

2015-05-28 18:25:19 -07:00

openpromfs

…

overlayfs

ovl: fsync after copy-up

2016-11-10 16:36:34 +01:00

proc

mm: larger stack guard gap, between vmas

2017-06-26 07:13:11 +02:00

pstore

pstore: Use dynamic spinlock initializer

2017-08-06 19:19:43 -07:00

qnx4

…

qnx6

pagemap.h: move dir_pages() over there

2015-06-23 18:02:00 -04:00

quota

quota: Fix possible GPF due to uninitialised pointers

2016-04-12 09:08:56 -07:00

ramfs

mm, fs: obey gfp_mapping for add_to_page_cache()

2015-10-16 11:42:28 -07:00

reiserfs

fs: add i_blocksize()

2017-06-14 13:16:24 +02:00

romfs

romfs: use different way to generate fsid for BLOCK or MTD

2017-06-17 06:39:38 +02:00

squashfs

squashfs: xattr simplifications

2015-11-13 20:34:33 -05:00

sysfs

sysfs: be careful of error returns from ops->show()

2017-04-12 12:38:33 +02:00

sysv

fix sysvfs symlinks

2015-11-23 21:11:08 -05:00

tracefs

tracefs: Fix refcount imbalance in start_creating()

2015-11-04 22:13:45 -05:00

ubifs

ubifs: Fix journal replay wrt. xattr nodes

2017-01-26 08:23:48 +01:00

udf

udf: Fix deadlock between writeback and udf_setsize()

2017-07-27 15:06:09 -07:00

ufs

ufs_getfrag_block(): we only grab ->truncate_mutex on block creation path

2017-06-14 13:16:24 +02:00

xfs

xfs: remove kmem_zalloc_greedy

2017-10-08 10:14:20 +02:00

aio.c

aio: mark AIO pseudo-fs noexec

2016-10-07 15:23:47 +02:00

anon_inodes.c

…

attr.c

vfs: move permission checking into notify_change() for utimes(NULL)

2016-10-22 12:26:56 +02:00

bad_inode.c

…

binfmt_aout.c

…

binfmt_elf_fdpic.c

Merge tag 'libnvdimm-for-4.4' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm

2015-11-10 12:07:22 -08:00

binfmt_elf.c

binfmt_elf: use ELF_ET_DYN_BASE only for PIE

2017-07-21 07:44:57 +02:00

binfmt_em86.c

…

binfmt_flat.c

…

binfmt_misc.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-04-26 17:22:07 -07:00

binfmt_script.c

…

block_dev.c

fs/block_dev: always invalidate cleancache in invalidate_bdev()

2017-05-20 14:27:01 +02:00

buffer.c

fs: add i_blocksize()

2017-06-14 13:16:24 +02:00

char_dev.c

fs/char_dev.c: fix incorrect documentation for unregister_chrdev_region

2015-08-05 13:49:35 -07:00

compat_binfmt_elf.c

…

compat_ioctl.c

i2c-dev: Fix typo in ioctl name reference

2015-10-23 23:26:43 +02:00

compat.c

…

coredump.c

coredump: Ensure proper size of sparse core files

2017-07-05 14:37:20 +02:00

dax.c

dax: disable pmd mappings

2015-11-16 23:54:45 -08:00

dcache.c

dentry name snapshots

2017-08-06 19:19:42 -07:00

dcookies.c

…

direct-io.c

direct-io: Prevent NULL pointer access in submit_page_section

2017-10-18 09:20:42 +02:00

drop_caches.c

inode: convert inode_sb_list_lock to per-sb

2015-08-17 18:39:46 -04:00

eventfd.c

…

eventpoll.c

epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove()

2017-09-07 08:34:10 +02:00

exec.c

exec: Limit arg stack to at most 75% of _STK_LIM

2017-07-21 07:44:57 +02:00

fcntl.c

fs: add a VALID_OPEN_FLAGS

2017-07-15 11:57:44 +02:00

fhandle.c

fs/coredump: prevent fsuid=0 dumps into user-controlled directories

2016-04-12 09:08:58 -07:00

file_table.c

fs, file table: reinit files_stat.max_files after deferred memory initialisation

2015-08-07 04:39:40 +03:00

file.c

vfs: clear remainder of 'full_fds_bits' in dup_fd()

2015-11-05 23:05:32 -08:00

filesystems.c

…

fs_pin.c

…

fs_struct.c

…

fs-writeback.c

writeback, cgroup: fix use of the wrong bdi_writeback which mismatches the inode

2016-04-12 09:09:04 -07:00

inode.c

vfs: fix deadlock in file_remove_privs() on overlayfs

2016-08-10 11:49:30 +02:00

internal.h

inode: rename i_wb_list to i_io_list

2015-08-17 23:38:10 -04:00

ioctl.c

…

Kconfig

dax: disable pmd mappings

2015-11-16 23:54:45 -08:00

Kconfig.binfmt

mm: split ET_DYN ASLR from mmap ASLR

2015-04-14 16:49:05 -07:00

libfs.c

fs: Set the size of empty dirs to 0.

2015-08-12 15:28:45 -05:00

locks.c

locks: use file_inode()

2016-08-10 11:49:27 +02:00

Makefile

ext4: promote ext4 over ext2 in the default probe order

2015-10-15 10:33:21 -04:00

mbcache.c

…

mount.h

mnt: In propgate_umount handle visiting mounts in any order

2017-07-21 07:44:57 +02:00

mpage.c

fs: add i_blocksize()

2017-06-14 13:16:24 +02:00

namei.c

dentry name snapshots

2017-08-06 19:19:42 -07:00

namespace.c

mnt: In propgate_umount handle visiting mounts in any order

2017-07-21 07:44:57 +02:00

no-block.c

…

nsfs.c

fs/seq_file: convert int seq_vprint/seq_printf/etc... returns to void

2015-09-11 15:21:34 -07:00

open.c

fs: completely ignore unknown open flags

2017-07-15 11:57:44 +02:00

pipe.c

pipe: limit the per-user amount of pages allocated in pipes

2016-06-07 18:14:35 -07:00

pnode.c

mnt: Make propagate_umount less slow for overlapping mount propagation trees

2017-07-21 07:44:58 +02:00

pnode.h

mnt: Add a per mount namespace limit on the number of mounts

2017-04-30 05:49:28 +02:00

posix_acl.c

tmpfs: clear S_ISGID when setting posix ACLs

2017-01-26 08:23:47 +01:00

proc_namespace.c

vfs: show_vfsstat: do not ignore errors from show_devname method

2016-04-12 09:08:55 -07:00

read_write.c

vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets

2017-10-05 09:41:45 +02:00

readdir.c

…

select.c

locking/arch: Rename set_mb() to smp_store_mb()

2015-05-19 08:32:00 +02:00

seq_file.c

Make file credentials available to the seqfile interfaces

2017-08-06 19:19:42 -07:00

signalfd.c

signalfd: fix information leak in signalfd_copyinfo

2015-08-07 04:39:40 +03:00

splice.c

vfs: fix uninitialized flags in splice_to_pipe()

2017-02-23 17:43:09 +01:00

stack.c

…

stat.c

ufs: restore maintaining ->i_blocks

2017-06-14 13:16:24 +02:00

statfs.c

…

super.c

fs/super.c: fix race between freeze_super() and thaw_super()

2016-10-28 03:01:32 -04:00

sync.c

fs/sync.c: make sync_file_range(2) use WB_SYNC_NONE writeback

2015-11-06 17:50:42 -08:00

timerfd.c

timerfd: Protect the might cancel mechanism proper

2017-05-08 07:46:01 +02:00

userfaultfd.c

userfaultfd: don't block on the last VM updates at exit time

2016-03-16 08:43:01 -07:00

utimes.c

vfs: move permission checking into notify_change() for utimes(NULL)

2016-10-22 12:26:56 +02:00

xattr.c

lsm: fix smack_inode_removexattr and xattr_getsecurity memleak

2017-10-12 11:27:32 +02:00