Jan Harkes fae5947129 coda: fix 'kernel memory exposure attempt' in fsync ... commit d337b66a4c upstream. When an application called fsync on a file in Coda a small request with just the file identifier was allocated, but the declared length was set to the size of union of all possible upcall requests. This bug has been around for a very long time and is now caught by the extra checking in usercopy that was introduced in Linux-4.8. The exposure happens when the Coda cache manager process reads the fsync upcall request at which point it is killed. As a result there is nobody servicing any further upcalls, trapping any processes that try to access the mounted Coda filesystem. Signed-off-by: Jan Harkes <jaharkes@cs.cmu.edu> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-11-24 08:33:42 +01:00
..
Kconfig	fs/Kconfig: move coda out	2009-01-22 13:16:01 +03:00
Makefile	fs: change to new flag variable	2011-03-17 14:02:57 +01:00
cache.c	VFS: normal filesystems (and lustre): d_inode() annotations	2015-04-15 15:06:57 -04:00
cnode.c	switch ->get_link() to delayed_call, kill ->put_link()	2015-12-30 13:01:03 -05:00
coda_cache.h	take coda-private headers out of include/linux	2011-01-12 20:02:48 -05:00
coda_fs_i.h	coda: Cache permisions in struct coda_inode_info in a kuid_t.	2013-02-13 06:00:54 -08:00
coda_int.h	fs/coda/inode.c: add __init to init_inodecache()	2014-04-03 16:21:25 -07:00
coda_linux.c	new helper: is_root_inode()	2014-10-31 17:48:54 -04:00
coda_linux.h	tree wide: use kvfree() than conditional kfree()/vfree()	2016-01-22 17:02:18 -08:00
dir.c	Merge remote-tracking branch 'ovl/rename2' into for-linus	2016-10-10 23:02:51 -04:00
file.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2016-10-10 20:16:43 -07:00
inode.c	fs: Replace CURRENT_TIME_SEC with current_time() for inode timestamps	2016-09-27 21:06:22 -04:00
pioctl.c	drop redundant ->owner initializations	2016-05-29 19:08:00 -04:00
psdev.c	fs/coda: use linux/uaccess.h	2014-08-08 15:57:20 -07:00
symlink.c	don't put symlink bodies in pagecache into highmem	2015-12-08 22:41:36 -05:00
sysctl.c	coda: convert use of typedef ctl_table to struct ctl_table	2014-06-06 16:08:16 -07:00
upcall.c	coda: fix 'kernel memory exposure attempt' in fsync	2017-11-24 08:33:42 +01:00