Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-30 16:11:38 +00:00
Code Issues Packages Projects Releases Wiki Activity
9ea2c7c9da
linux/fs
History
Nikolay Borisov 9ea2c7c9da btrfs: Fix out of bounds access in btrfs_search_slot 
When modifying a tree where the root is at BTRFS_MAX_LEVEL - 1 then
the level variable is going to be 7 (this is the max height of the
tree). On the other hand btrfs_cow_block is always called with
"level + 1" as an index into the nodes and slots arrays. This leads to
an out of bounds access. Admittdely this will be benign since an OOB
access of the nodes array will likely read the 0th element from the
slots array, which in this case is going to be 0 (since we start CoW at
the top of the tree). The OOB access into the slots array in turn will
read the 0th and 1st values of the locks array, which would both be 0
at the time. However, this benign behavior relies on the fact that the
path being passed hasn't been initialised, if it has already been used to
query a btree then it could potentially have populated the nodes/slots arrays.

Fix it by explicitly checking if we are at level 7 (the maximum allowed
index in nodes/slots arrays) and explicitly call the CoW routine with
NULL for parent's node/slot.

Signed-off-by: Nikolay Borisov <nborisov@suse.com>
Fixes-coverity-id: 711515
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
2018-01-22 16:08:16 +01:00
..
9p Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
adfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
affs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
afs afs: Fix missing error handling in afs_write_end() 2018-01-02 10:02:19 +00:00
autofs4 autofs: fix careless error in recent commit 2017-12-14 16:00:48 -08:00
befs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
bfs License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
btrfs btrfs: Fix out of bounds access in btrfs_search_slot 2018-01-22 16:08:16 +01:00
cachefiles mm: remove __GFP_COLD 2017-11-15 18:21:06 -08:00
ceph ceph: drop negative child dentries before try pruning inode's alias 2017-12-08 11:07:12 +01:00
cifs CIFS: don't log STATUS_NOT_FOUND errors for DFS 2017-12-06 12:48:01 -06:00
coda Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
configfs configfs: make ci_type field, some pointers and function arguments const 2017-10-19 16:15:16 +02:00
cramfs cramfs: fix MTD dependency 2017-12-17 12:20:58 -08:00
crypto fscrypt: lots of cleanups, mostly courtesy by Eric Biggers 2017-11-14 11:35:15 -08:00
debugfs debugfs: Remove redundant license text 2017-11-07 20:25:03 +01:00
devpts pty: Repair TIOCGPTPEER 2017-08-24 13:23:03 -07:00
dlm A couple of configfs cleanups: 2017-11-14 14:44:04 -08:00
ecryptfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
efivarfs VFS: Kill off s_options and helpers 2017-07-11 06:09:21 -04:00
efs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
exofs Merge branch 'for-4.14/block' of git://git.kernel.dk/linux-block 2017-09-07 11:59:42 -07:00
exportfs
ext2 Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
ext4 ext4: fix crash when a directory's i_size is too small 2017-12-11 15:00:57 -05:00
f2fs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
fat fs/fat/inode.c: fix sb_rdonly() change 2017-11-29 18:40:43 -08:00
freevxfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
fscache AFS development 2017-11-16 11:41:22 -08:00
fuse Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
gfs2 Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
hfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
hfsplus Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
hostfs License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
hpfs hpfs: don't bother with the i_version counter or f_version 2017-12-10 12:58:18 -08:00
hugetlbfs fs/hugetlbfs/inode.c: change put_page/unlock_page order in hugetlbfs_fallocate() 2017-11-29 18:40:43 -08:00
isofs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
jbd2 libnvdimm for 4.15 2017-11-17 09:51:57 -08:00
jffs2 Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
jfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
kernfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
lockd nlm_shutdown_hosts_net() cleanup 2017-11-27 16:45:11 -05:00
minix Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
ncpfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
nfs NFS client fixes for Linux 4.15-rc4 2017-12-16 13:12:53 -08:00
nfs_common lockd: fix "list_add double add" caused by legacy signal interface 2017-11-27 16:45:11 -05:00
nfsd kernel: make groups_sort calling a responsibility group_info allocators 2017-12-14 16:00:49 -08:00
nilfs2 Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
nls License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
notify Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
ntfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
ocfs2 Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
omfs License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
openpromfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
orangefs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
overlayfs ovl: fix overlay: warning prefix 2017-12-14 11:14:52 +01:00
proc proc: fix coredump vs read /proc/*/stat race 2018-01-19 10:09:41 -08:00
pstore treewide: Switch DEFINE_TIMER callbacks to struct timer_list * 2017-11-21 15:57:05 -08:00
qnx4 Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
qnx6 Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
quota quota: Check for register_shrinker() failure. 2017-11-29 16:46:48 +01:00
ramfs mm: make pagevec_lookup() update index 2017-09-06 17:27:26 -07:00
reiserfs Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs 2017-11-30 18:38:47 -05:00
romfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
squashfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
sysfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
sysv Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
tracefs VFS: Don't use save/replace_mount_options if not using generic_show_options 2017-07-06 03:31:46 -04:00
ubifs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
udf Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
ufs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
xfs Changes since last update: 2018-01-05 12:59:32 -08:00
aio.c Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 11:54:55 -08:00
anon_inodes.c
attr.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
bad_inode.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
binfmt_aout.c fs: fix kernel_read prototype 2017-09-04 19:05:15 -04:00
binfmt_elf_fdpic.c Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 12:54:01 -08:00
binfmt_elf.c Merge branch 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm 2017-11-16 12:50:35 -08:00
binfmt_em86.c
binfmt_flat.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
binfmt_misc.c fs/binfmt_misc.c: node could be NULL when evicting inode 2017-10-13 16:18:33 -07:00
binfmt_script.c exec: load_script: kill the onstack interp[BINPRM_BUF_SIZE] array 2017-10-03 17:54:25 -07:00
block_dev.c Merge branch 'for-4.15/block' of git://git.kernel.dk/linux-block 2017-11-14 15:32:19 -08:00
buffer.c mm, pagevec: remove cold parameter for pagevecs 2017-11-15 18:21:06 -08:00
char_dev.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
compat_binfmt_elf.c
compat_ioctl.c Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 12:54:01 -08:00
compat.c
coredump.c Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 11:54:55 -08:00
dax.c Revert "mm: replace p??_write with pte_access_permitted in fault + gup paths" 2017-12-15 18:53:22 -08:00
dcache.c kmemcheck: remove annotations 2017-11-15 18:21:04 -08:00
dcookies.c
direct-io.c Merge branch 'for-4.15/block' of git://git.kernel.dk/linux-block 2017-11-14 15:32:19 -08:00
drop_caches.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
eventfd.c There has been a fair amount of activity in the docs tree this time 2017-07-03 21:13:25 -07:00
eventpoll.c Merge branch 'akpm' (patches from Andrew) 2017-11-17 16:56:17 -08:00
exec.c exec: Weaken dumpability for secureexec 2018-01-03 10:13:36 -08:00
fcntl.c fcntl: don't cap l_start and l_end values for F_GETLK64 in compat syscall 2017-11-15 08:08:36 -05:00
fhandle.c Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 12:54:01 -08:00
file_table.c fs, mm: account filp cache to kmemcg 2017-11-15 18:21:04 -08:00
file.c Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 12:54:01 -08:00
filesystems.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
fs_pin.c Merge branch 'linus' into locking/core, to resolve conflicts 2017-11-07 10:32:44 +01:00
fs_struct.c
fs-writeback.c Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
inode.c Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
internal.h fs: expose do_unlinkat for built-in callers 2017-11-10 08:48:46 -05:00
ioctl.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
iomap.c Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 12:08:18 -08:00
Kconfig fs/Kconfig: kill CONFIG_PERCPU_RWSEM some more 2017-07-12 16:26:00 -07:00
Kconfig.binfmt ARM: enable elf_fdpic on systems with an MMU 2017-09-10 19:31:46 -04:00
libfs.c Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
locks.c Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mbcache.c fs/mbcache.c: make count_objects() more robust 2017-11-29 18:40:43 -08:00
mount.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mpage.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
namei.c autofs: revert "autofs: fix AT_NO_AUTOMOUNT not being honored" 2017-11-29 18:40:43 -08:00
namespace.c VFS: Handle lazytime in do_mount() 2017-12-09 20:16:33 -05:00
no-block.c
nsfs.c Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
open.c ovl: don't allow writing ioctl on lower layer 2017-09-05 12:53:12 +02:00
pipe.c pipe: add proc_dopipe_max_size() to safely assign pipe_max_size 2017-11-17 16:10:03 -08:00
pnode.c
pnode.h
posix_acl.c
proc_namespace.c Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
read_write.c Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 12:08:18 -08:00
readdir.c Merge branch 'linus' into locking/core, to resolve conflicts 2017-11-07 10:32:44 +01:00
select.c Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 11:54:55 -08:00
seq_file.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
signalfd.c Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 11:54:55 -08:00
splice.c locking/atomics: COCCINELLE/treewide: Convert trivial ACCESS_ONCE() patterns to READ_ONCE()/WRITE_ONCE() 2017-10-25 11:01:08 +02:00
stack.c
stat.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
statfs.c Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
super.c sget(): handle failures of register_shrinker() 2017-12-18 15:05:07 -05:00
sync.c Merge branch 'for-4.15/block' of git://git.kernel.dk/linux-block 2017-11-14 15:32:19 -08:00
timerfd.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
userfaultfd.c userfaultfd: clear the vma->vm_userfaultfd_ctx if UFFD_EVENT_FORK fails 2018-01-04 16:45:09 -08:00
utimes.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
xattr.c lsm: fix smack_inode_removexattr and xattr_getsecurity memleak 2017-10-04 18:03:15 +11:00