Chuck Lever 53b1119a6e NFSD: Fix READDIR buffer overflow ... If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. Also, we have no unit tests that exercise the behavior of READDIR at the lower bound of @count values. Thus this case was missed during testing. Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com> Fixes: f5dcccd647 ("NFSD: Update the NFSv2 READDIR entry encoder to use struct xdr_stream") Fixes: 7f87fc2d34 ("NFSD: Update NFSv3 READDIR entry encoders to use struct xdr_stream") Signed-off-by: Chuck Lever <chuck.lever@oracle.com>		2021-12-18 17:11:06 -05:00
..
9p	netfs, 9p, afs, ceph: Use folios	2021-11-10 21:16:56 +00:00
adfs	mm: require ->set_page_dirty to be explicitly wired up	2021-06-29 10:53:48 -07:00
affs	affs: use bdev_nr_sectors instead of open coding it	2021-10-18 14:43:22 -06:00
afs	afs: Use folios in directory handling	2021-11-10 21:17:09 +00:00
autofs	autofs: fix wait name hash calculation in autofs_wait()	2021-10-20 21:09:02 -04:00
befs	isystem: ship and use stdarg.h	2021-08-19 09:02:55 +09:00
bfs	mm: require ->set_page_dirty to be explicitly wired up	2021-06-29 10:53:48 -07:00
btrfs	for-5.16-rc4-tag	2021-12-10 17:28:02 -08:00
cachefiles	for-5.16/ki_complete-2021-10-29	2021-11-01 10:17:11 -07:00
ceph	One notable change here is that async creates and unlinks introduced	2021-11-13 11:31:07 -08:00
cifs	cifs: fix ntlmssp auth when there is no key exchange	2021-12-08 16:48:43 -06:00
coda	coda: bump module version to 7.2	2021-11-09 10:02:51 -08:00
configfs	configfs: fix a race in configfs_lookup()	2021-08-25 07:58:49 +02:00
cramfs	cramfs: use bdev_nr_bytes instead of open coding it	2021-10-18 14:43:22 -06:00
crypto	fscrypt: improve a few comments	2021-10-25 19:11:50 -07:00
debugfs	debugfs: debugfs_create_file_size(): use IS_ERR to check for error	2021-09-21 09:09:06 +02:00
devpts
dlm	fs: dlm: avoid comms shutdown delay in release_lockspace	2021-09-01 11:29:14 -05:00
ecryptfs	mm: require ->set_page_dirty to be explicitly wired up	2021-06-29 10:53:48 -07:00
efivarfs	efivars: convert to fileattr	2021-04-12 15:04:29 +02:00
efs
erofs	erofs: fix deadlock when shrink erofs slab	2021-11-23 14:58:16 +08:00
exfat	exfat: fix incorrect loading of i_blocks for large files	2021-11-01 07:49:21 +09:00
exportfs
ext2	ext2: fix sleeping in atomic bugs on error	2021-09-22 13:05:23 +02:00
ext4	Only bug fixes and cleanups for ext4 this merge window. Of note are	2021-11-10 17:05:37 -08:00
f2fs	Update to zstd-1.4.10	2021-11-13 15:32:30 -08:00
fat	for-5.16/inode-sync-2021-10-29	2021-11-01 10:25:27 -07:00
freevxfs
fscache	fscache: Remove an unused static variable	2021-10-04 22:13:12 +01:00
fuse	fuse: release pipe buf after last use	2021-11-25 14:05:18 +01:00
gfs2	gfs2: gfs2_create_inode rework	2021-12-02 12:41:10 +01:00
hfs	Merge branch 'akpm' (patches from Andrew)	2021-11-09 10:11:53 -08:00
hfsplus	Merge branch 'akpm' (patches from Andrew)	2021-11-09 10:11:53 -08:00
hostfs	hostfs: support splice_write	2021-08-26 22:28:02 +02:00
hpfs	treewide: Replace open-coded flex arrays in unions	2021-10-18 12:28:53 -07:00
hugetlbfs	mm,hugetlb: remove mlock ulimit for SHM_HUGETLB	2021-11-09 10:02:48 -08:00
iomap	iomap: iomap_read_inline_data cleanup	2021-11-24 10:15:47 -08:00
isofs	isofs: Fix out of bound access for corrupted isofs image	2021-10-19 12:51:02 +02:00
jbd2	jbd2: add sparse annotations for add_transaction_credits()	2021-08-30 23:36:50 -04:00
jffs2	vfs: add rcu argument to ->get_acl() callback	2021-08-18 22:08:24 +02:00
jfs	Just one JFS patch	2021-11-03 09:23:25 -07:00
kernfs	Merge 5.15-rc6 into driver-core-next	2021-10-18 09:43:37 +02:00
ksmbd	ksmbd: fix memleak in get_file_stream_info()	2021-11-25 00:09:26 -06:00
lockd	A slow cycle for nfsd: mainly cleanup, including Neil's patch dropping	2021-11-10 16:45:54 -08:00
minix	mm: require ->set_page_dirty to be explicitly wired up	2021-06-29 10:53:48 -07:00
netfs	netfs: fix parameter of cleanup()	2021-12-07 15:47:09 +00:00
nfs	NFS client bugfixes for Linux 5.16	2021-11-27 10:33:55 -08:00
nfs_common	nfs: Fix kerneldoc warning shown up by W=1	2021-10-04 22:02:17 +01:00
nfsd	NFSD: Fix READDIR buffer overflow	2021-12-18 17:11:06 -05:00
nilfs2	Merge branch 'akpm' (patches from Andrew)	2021-11-09 10:11:53 -08:00
nls
notify	fanotify: Allow users to request FAN_FS_ERROR events	2021-10-27 12:53:45 +02:00
ntfs	fs: ntfs: Limit NTFS_RW to page sizes smaller than 64k	2021-11-27 14:34:41 -08:00
ntfs3	gfs2: Fix mmap + page fault deadlocks	2021-11-02 12:25:03 -07:00
ocfs2	Merge branch 'exit-cleanups-for-v5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2021-11-10 16:15:54 -08:00
omfs	mm: require ->set_page_dirty to be explicitly wired up	2021-06-29 10:53:48 -07:00
openpromfs
orangefs	orangefs: three fixes from other folks...	2021-11-09 10:34:06 -08:00
overlayfs	overlayfs update for 5.16	2021-11-09 10:51:12 -08:00
proc	proc/vmcore: fix clearing user buffer by properly using clear_user()	2021-11-20 10:35:55 -08:00
pstore	pstore/blk: Use "%lu" to format unsigned long	2021-11-21 09:44:19 -08:00
qnx4	qnx4: work around gcc false positive warning bug	2021-09-21 08:36:48 -07:00
qnx6
quota	\n	2021-11-06 16:40:48 -07:00
ramfs	Merge branch 'akpm' (patches from Andrew)	2021-11-09 10:11:53 -08:00
reiserfs	\n	2021-11-06 16:40:48 -07:00
romfs
smbfs_common	cifs: Fix crash on unload of cifs_arc4.ko	2021-12-07 22:38:03 -06:00
squashfs	lib: zstd: Add kernel-specific API	2021-11-08 16:55:21 -08:00
sysfs	fs/sysfs/dir.c: replace S_IRWXU|S_IRUGO|S_IXUGO with 0755 sysfs_create_dir_ns()	2021-10-05 16:35:05 +02:00
sysv	sysv: use BUILD_BUG_ON instead of runtime check	2021-11-09 10:02:52 -08:00
tracefs	tracefs: Set all files to the same group ownership as the mount option	2021-12-08 08:06:40 -05:00
ubifs	fscrypt: remove fscrypt_operations::max_namelen	2021-09-20 19:32:33 -07:00
udf	udf: Fix crash after seekdir	2021-11-09 12:53:58 +01:00
ufs	isystem: ship and use stdarg.h	2021-08-19 09:02:55 +09:00
unicode	.gitignore: prefix local generated files with a slash	2021-05-02 00:43:35 +09:00
vboxsf	vboxfs: fix broken legacy mount signature checking	2021-09-27 11:26:21 -07:00
verity	fs-verity: fix signed integer overflow with i_size near S64_MAX	2021-09-22 10:56:34 -07:00
xfs	xfs: remove all COW fork extents when remounting readonly	2021-12-07 10:17:29 -08:00
zonefs	gfs2: Fix mmap + page fault deadlocks	2021-11-02 12:25:03 -07:00
aio.c	aio: Fix incorrect usage of eventfd_signal_allowed()	2021-12-09 10:52:55 -08:00
anon_inodes.c	fs: add anon_inode_getfile_secure() similar to anon_inode_getfd_secure()	2021-09-19 22:35:37 -04:00
attr.c	fs: handle circular mappings correctly	2021-11-17 09:26:09 +01:00
bad_inode.c	vfs: add rcu argument to ->get_acl() callback	2021-08-18 22:08:24 +02:00
binfmt_aout.c	binfmt: a.out: Fix bogus semicolon	2021-09-05 10:15:05 -07:00
binfmt_elf_fdpic.c	coredump: Limit coredumps to a single thread group	2021-10-08 12:06:02 -05:00
binfmt_elf.c	Merge branch 'akpm' (patches from Andrew)	2021-11-09 10:11:53 -08:00
binfmt_flat.c	binfmt: remove in-tree usage of MAP_EXECUTABLE	2021-06-29 10:53:50 -07:00
binfmt_misc.c
binfmt_script.c
buffer.c	fs: simplify init_page_buffers	2021-10-18 14:43:22 -06:00
char_dev.c
compat_binfmt_elf.c
coredump.c	coredump: Limit coredumps to a single thread group	2021-10-08 12:06:02 -05:00
d_path.c	d_path: fix Kernel doc validator complaining	2021-11-06 13:30:32 -07:00
dax.c	New code for 5.15:	2021-08-31 11:13:35 -07:00
dcache.c	useful constants: struct qstr for ".."	2021-04-15 22:36:45 -04:00
direct-io.c	fs: get rid of the res2 iocb->ki_complete argument	2021-10-25 10:36:24 -06:00
drop_caches.c	fs: drop_caches: fix skipping over shadow cache inodes	2021-09-03 09:58:10 -07:00
eventfd.c	eventfd: Export eventfd_wake_count to modules	2021-09-06 07:20:56 -04:00
eventpoll.c	ARM development updates for 5.15:	2021-09-09 13:25:49 -07:00
exec.c	Merge branch 'exit-cleanups-for-v5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2021-11-10 16:15:54 -08:00
fcntl.c	Merge branch 'akpm' (patches from Andrew)	2021-09-03 10:08:28 -07:00
fhandle.c	switch file_open_root() to struct path	2021-04-07 13:56:43 -04:00
file_table.c
file.c	fget: check that the fd still exists after getting a ref to it	2021-12-03 10:06:58 -08:00
filesystems.c	fs: simplify get_filesystem_list / get_all_fs_names	2021-08-23 01:25:40 -04:00
fs_context.c	memcg: charge fs_context and legacy_fs_context	2021-09-03 09:58:12 -07:00
fs_parser.c	namei: Standardize callers of filename_lookup()	2021-09-07 16:07:47 -04:00
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c	Various hardening fixes and cleanups for 5.16-rc1	2021-11-01 17:29:10 -07:00
fsopen.c
init.c
inode.c	fs: Remove FS_THP_SUPPORT	2021-11-17 10:36:35 -05:00
internal.h	Merge branch 'akpm' (patches from Andrew)	2021-11-09 10:11:53 -08:00
io_uring.c	io_uring: ensure task_work gets run as part of cancelations	2021-12-10 13:56:28 -07:00
io-wq.c	io-wq: check for wq exit after adding new worker task_work	2021-12-10 13:56:28 -07:00
io-wq.h	io_uring: optimise INIT_WQ_LIST	2021-10-19 05:49:54 -06:00
ioctl.c	New code for 5.15:	2021-08-31 11:06:32 -07:00
Kconfig	4 cifs/smb3 fixes, one for DFS reconnect, and one to begin creating common headers for server and client and the other two to rename the cifs_common directory to smbfs_common to be more consistent ie change use of the name cifs to smb which is more accurate	2021-09-12 10:10:21 -07:00
Kconfig.binfmt	binfmt: remove support for em86 (alpha only)	2021-07-25 22:33:03 -07:00
kernel_read_file.c	vfs: check fd has read access in kernel_read_file_from_fd()	2021-10-18 20:22:03 -10:00
libfs.c	libfs: Support RENAME_EXCHANGE in simple_rename()	2021-11-03 15:43:08 +01:00
locks.c	locks: remove changelog comments	2021-10-19 14:11:39 -04:00
Makefile	4 cifs/smb3 fixes, one for DFS reconnect, and one to begin creating common headers for server and client and the other two to rename the cifs_common directory to smbfs_common to be more consistent ie change use of the name cifs to smb which is more accurate	2021-09-12 10:10:21 -07:00
mbcache.c
mount.h
mpage.c
namei.c	File locking changes for v5.16	2021-11-01 09:06:53 -07:00
namespace.c	Merge branch 'akpm' (patches from Andrew)	2021-09-03 10:08:28 -07:00
no-block.c
nsfs.c
open.c	Merge branch 'akpm' (patches from Andrew)	2021-11-06 14:08:17 -07:00
pipe.c	Revert "mm/gup: remove try_get_page(), call try_get_compound_head() directly"	2021-09-07 11:03:45 -07:00
pnode.c
pnode.h
posix_acl.c	fs/posix_acl.c: avoid -Wempty-body warning	2021-11-06 13:30:32 -07:00
proc_namespace.c
read_write.c	fs: remove leftover comments from mandatory locking removal	2021-10-26 12:20:50 -04:00
readdir.c	readdir: make sure to verify directory entry for legacy interfaces too	2021-04-17 11:39:49 -07:00
remap_range.c	fs: remove mandatory file locking support	2021-08-23 06:15:36 -04:00
select.c	Revert "memcg: enable accounting for pollfd and select bits arrays"	2021-09-07 11:26:23 -07:00
seq_file.c	seq_file: move seq_escape() to a header	2021-11-09 10:02:52 -08:00
signalfd.c	signalfd: use wake_up_pollfree()	2021-12-09 10:49:56 -08:00
splice.c
stack.c
stat.c	fs: add generic helper for filling statx attribute flags	2021-08-17 11:47:43 +02:00
statfs.c
super.c	fs: explicitly unregister per-superblock BDIs	2021-11-06 13:30:34 -07:00
sync.c	block: simplify the block device syncing code	2021-10-22 08:36:55 -06:00
timerfd.c	timerfd: Provide timerfd_resume()	2021-08-10 17:57:22 +02:00
userfaultfd.c	userfaultfd: fix a race between writeprotect and exit_mmap()	2021-10-18 20:22:02 -10:00
utimes.c
xattr.c