kernel/fs, branch linux-2.6.14.y

[PATCH] UFS: inode->i_sem is not released in error path

2006-01-08T02:15:09Z

Signed-off-by: Evgeniy Polyakov Cc: akpm: obviously correct, OK for -stable immediately. Signed-off-by: Andrew Morton Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

[PATCH] Insanity avoidance in /proc (CVE-2005-4605)

2006-01-08T02:15:08Z

Insanity avoidance in /proc The old /proc interfaces were never updated to use loff_t, and are just generally broken. Now, we should be using the seq_file interface for all of the proc files, but converting the legacy functions is more work than most people care for and has little upside.. But at least we can make the non-LFS rules explicit, rather than just insanely wrapping the offset or something. Signed-off-by: Linus Torvalds Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

[PATCH] setting ACLs on readonly mounted NFS filesystems (CVE-2005-3623)

2005-12-27T00:08:59Z

We must check for MAY_SATTR before setting acls, which includes checking for read-only exports: the lower-level setxattr operation that eventually sets the acl cannot check export-level restrictions. Bug reported by Martin Walter . Signed-off-by: Andreas Gruenbacher Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix listxattr() for generic security attributes

2005-12-14T23:42:55Z

Commit f549d6c18c0e8e6cf1bf0e7a47acc1daf7e2cec1 introduced a generic fallback for security xattrs, but appears to include a subtle bug. Gentoo users with kernels with selinux compiled in, and coreutils compiled with acl support, noticed that they could not copy files on tmpfs using 'cp'. cp (compiled with acl support) copies the file, lists the extended attributes on the old file, copies them all to the new file, and then exits. However the listxattr() calls were failing with this odd behaviour: llistxattr("a.out", (nil), 0) = 17 llistxattr("a.out", 0x7fffff8c6cb0, 17) = -1 ERANGE (Numerical result out of range) I believe this is a simple problem in the logic used to check the buffer sizes; if the user sends a buffer the exact size of the data, then its ok :) This change solves the problem. More info can be found at http://bugs.gentoo.org/113138 Signed-off-by: Daniel Drake Acked-by: James Morris Acked-by: Stephen Smalley Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

[PATCH] VFS: Fix memory leak with file leases

2005-11-24T22:10:08Z

The patch http://linux.bkbits.net:8080/linux-2.6/diffs/fs/locks.c@1.70??nav=index.html introduced a pretty nasty memory leak in the lease code. When freeing the lease, the code in locks_delete_lock() will correctly clean up the fasync queue, but when we return to fcntl_setlease(), the freed fasync entry will be reinstated. This patch ensures that we skip the call to fasync_helper() when we're freeing up the lease. Signed-off-by: J. Bruce Fields Signed-off-by: Trond Myklebust Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

[PATCH] fix de_thread() vs send_group_sigqueue() race

2005-11-11T05:18:55Z

When non-leader thread does exec, de_thread calls release_task(leader) before calling exit_itimers(). If local timer interrupt happens in between, it can oops in send_group_sigqueue() while taking ->sighand->siglock == NULL. However, we can't change send_group_sigqueue() to check p->signal != NULL, because sys_timer_create() does get_task_struct() only in SIGEV_THREAD_ID case. So it is possible that this task_struct was already freed and we can't trust p->signal. This patch changes de_thread() so that leader released after exit_itimers() call. Signed-off-by: Oleg Nesterov Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

[PATCH] fix XFS_QUOTA for modular XFS

2005-11-11T05:18:54Z

This patch by Dimitri Puzin submitted through kernel Bugzilla #5514 fixes the following issue: Cannot build XFS filesystem support as module with quota support. It works only when the XFS filesystem support is compiled into the kernel. Menuconfig prevents from setting CONFIG_XFS_FS=m and CONFIG_XFS_QUOTA=y. How to reproduce: configure the XFS filesystem with quota support as module. The resulting kernel won't have quota support compiled into xfs.ko. Fix: Changing the fs/xfs/Kconfig file from tristate to bool lets you configure the quota support to be compiled into the XFS module. The Makefile-linux-2.6 checks only for CONFIG_XFS_QUOTA=y. Signed-off-by: Adrian Bunk Signed-off-by: Nathan Scott Signed-off-by: Chris Wright Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix HFS+ to free up the space when a file is deleted.

2005-10-26T17:39:43Z

fsck_hfs reveals lots of temporary files accumulating in the hidden directory "\000\000\000HFS+ Private Data". According to the HFS+ documentation these are files which are unlinked while in use. However, there may be a bug in the Linux hfsplus implementation which causes this to happen even when the files are not in use. It looks like the "opencnt" field is never initialized as (I think) it should be in hfsplus_read_inode. This means that a file can appear to be still in use when in fact it has been closed. This patch seems to fix it for me. Signed-off-by: Anton Altaparmakov Cc: Roman Zippel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] inotify/idr leak fix

2005-10-23T23:38:39Z

Fix a bug which was reported and diagnosed by Stefan Jones IDR trees include a cache of idr_layer objects. There's no way to destroy this cache, so when we discard an overall idr tree we end up leaking some memory. Add and use idr_destroy() for this. v9fs and infiniband also need to use idr_destroy() to avoid leaks. Or, we make the cache global, like radix_tree_preload(). Which is probably better. Later. Cc: Eric Van Hensbergen Cc: Roland Dreier Cc: Robert Love Cc: John McCutchan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] aio syscalls are not checked by lsm

2005-10-23T23:38:38Z

Another case of missing call to security_file_permission: aio functions (namely, io_submit) does not check credentials with security modules. Below is the simple patch to the problem. It seems that it is enough to check for rights at the request submission time. Signed-off-by: Kostik Belousov Signed-off-by: Chris Wright Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds