Update to 4.19.102
Drop "vfs: fix do_last() regression" Cleanup debian/changelog file
This commit is contained in:
Salvatore Bonaccorso
parent
f003f0dba9
commit
ffc4ceb049
|
|
@ -1,4 +1,4 @@
|
|||
linux (4.19.101-1) UNRELEASED; urgency=medium
|
||||
linux (4.19.102-1) UNRELEASED; urgency=medium
|
||||
|
||||
* New upstream stable update:
|
||||
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.99
|
||||
|
|
@ -564,9 +564,64 @@ linux (4.19.101-1) UNRELEASED; urgency=medium
|
|||
- block: cleanup __blkdev_issue_discard()
|
||||
- block: fix 32 bit overflow in __blkdev_issue_discard()
|
||||
- [arm64] KVM: Write arch.mdcr_el2 changes since last vcpu_load on VHE
|
||||
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.102
|
||||
- vfs: fix do_last() regression
|
||||
- crypto: pcrypt - Fix user-after-free on module unload
|
||||
- perf c2c: Fix return type for histogram sorting comparision functions
|
||||
- PM / devfreq: Add new name attribute for sysfs
|
||||
- tools lib: Fix builds when glibc contains strlcpy()
|
||||
- ext4: validate the debug_want_extra_isize mount option at parse time
|
||||
- mm/mempolicy.c: fix out of bounds write in mpol_parse_str()
|
||||
- reiserfs: Fix memory leak of journal device string
|
||||
- media: digitv: don't continue if remote control state can't be read
|
||||
- media: af9005: uninitialized variable printked
|
||||
- media: vp7045: do not read uninitialized values if usb transfer fails
|
||||
- media: gspca: zero usb_buf
|
||||
- media: dvb-usb/dvb-usb-urb.c: initialize actlen to 0
|
||||
- tomoyo: Use atomic_t for statistics counter
|
||||
- ttyprintk: fix a potential deadlock in interrupt context issue
|
||||
- Bluetooth: Fix race condition in hci_release_sock()
|
||||
- cgroup: Prevent double killing of css when enabling threaded cgroup
|
||||
- [armhf] dts: sun8i: a83t: Correct USB3503 GPIOs polarity
|
||||
- [armhf] dts: am57xx-beagle-x15/am57xx-idk: Remove "gpios" for endpoint
|
||||
dt nodes
|
||||
- [armhf] dts: beagle-x15-common: Model 5V0 regulator
|
||||
- [arm64] clk: sunxi-ng: h6-r: Fix AR100/R_APB2 parent order
|
||||
- mac80211: mesh: restrict airtime metric to peered established plinks
|
||||
- ASoC: rt5640: Fix NULL dereference on module unload
|
||||
- ixgbevf: Remove limit of 10 entries for unicast filter list
|
||||
- ixgbe: Fix calculation of queue with VFs and flow director on interface
|
||||
flap
|
||||
- igb: Fix SGMII SFP module discovery for 100FX/LX.
|
||||
- [x86] platform/x86: GPD pocket fan: Allow somewhat lower/higher
|
||||
temperature limits
|
||||
- qmi_wwan: Add support for Quectel RM500Q
|
||||
- wireless: fix enabling channel 12 for custom regulatory domain
|
||||
- cfg80211: Fix radar event during another phy CAC
|
||||
- mac80211: Fix TKIP replay protection immediately after key setup
|
||||
- netfilter: nft_tunnel: ERSPAN_VERSION must not be null
|
||||
- [armhf] net: dsa: bcm_sf2: Configure IMP port for 2Gb/sec
|
||||
- bnxt_en: Fix ipv6 RFS filter matching logic.
|
||||
- iwlwifi: Don't ignore the cap field upon mcc update
|
||||
- [armhf] dts: am335x-boneblack-common: fix memory size
|
||||
- vti[6]: fix packet tx through bpf_redirect()
|
||||
- xfrm interface: fix packet tx through bpf_redirect()
|
||||
- xfrm: interface: do not confirm neighbor when do pmtu update
|
||||
- scsi: fnic: do not queue commands during fwreset
|
||||
- [armhf] 8955/1: virt: Relax arch timer version check during early boot
|
||||
- [arm64] tee: optee: Fix compilation issue with nommu
|
||||
- airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE
|
||||
- airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE
|
||||
- r8152: get default setting of WOL before initializing
|
||||
- qlcnic: Fix CPU soft lockup while collecting firmware dump
|
||||
- seq_tab_next() should increase position index
|
||||
- l2t_seq_next should increase position index
|
||||
- net: Fix skb->csum update in inet_proto_csum_replace16().
|
||||
- btrfs: do not zero f_bavail if we have available space
|
||||
- perf report: Fix no libunwind compiled warning break s390 issue
|
||||
- mm/migrate.c: also overwrite error when it is bigger than zero
|
||||
|
||||
[ Salvatore Bonaccorso ]
|
||||
* vfs: fix do_last() regression
|
||||
* Refresh "Revert "objtool: Fix CONFIG_STACK_VALIDATION=y warning for
|
||||
out-of-tree modules"" for context changes in 4.19.99
|
||||
* Refresh "ARM: dts: bcm283x: Correct vchiq compatible string" for context
|
||||
|
|
|
|||
|
|
@ -1,57 +0,0 @@
|
|||
From: Al Viro <viro@zeniv.linux.org.uk>
|
||||
Date: Sat, 1 Feb 2020 16:26:45 +0000
|
||||
Subject: vfs: fix do_last() regression
|
||||
Origin: https://git.kernel.org/linus/6404674acd596de41fd3ad5f267b4525494a891a
|
||||
|
||||
Brown paperbag time: fetching ->i_uid/->i_mode really should've been
|
||||
done from nd->inode. I even suggested that, but the reason for that has
|
||||
slipped through the cracks and I went for dir->d_inode instead - made
|
||||
for more "obvious" patch.
|
||||
|
||||
Analysis:
|
||||
|
||||
- at the entry into do_last() and all the way to step_into(): dir (aka
|
||||
nd->path.dentry) is known not to have been freed; so's nd->inode and
|
||||
it's equal to dir->d_inode unless we are already doomed to -ECHILD.
|
||||
inode of the file to get opened is not known.
|
||||
|
||||
- after step_into(): inode of the file to get opened is known; dir
|
||||
might be pointing to freed memory/be negative/etc.
|
||||
|
||||
- at the call of may_create_in_sticky(): guaranteed to be out of RCU
|
||||
mode; inode of the file to get opened is known and pinned; dir might
|
||||
be garbage.
|
||||
|
||||
The last was the reason for the original patch. Except that at the
|
||||
do_last() entry we can be in RCU mode and it is possible that
|
||||
nd->path.dentry->d_inode has already changed under us.
|
||||
|
||||
In that case we are going to fail with -ECHILD, but we need to be
|
||||
careful; nd->inode is pointing to valid struct inode and it's the same
|
||||
as nd->path.dentry->d_inode in "won't fail with -ECHILD" case, so we
|
||||
should use that.
|
||||
|
||||
Reported-by: "Rantala, Tommi T. (Nokia - FI/Espoo)" <tommi.t.rantala@nokia.com>
|
||||
Reported-by: syzbot+190005201ced78a74ad6@syzkaller.appspotmail.com
|
||||
Wearing-brown-paperbag: Al Viro <viro@zeniv.linux.org.uk>
|
||||
Cc: stable@kernel.org
|
||||
Fixes: d0cb50185ae9 ("do_last(): fetch directory ->i_mode and ->i_uid before it's too late")
|
||||
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
|
||||
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
---
|
||||
fs/namei.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/fs/namei.c
|
||||
+++ b/fs/namei.c
|
||||
@@ -3259,8 +3259,8 @@ static int do_last(struct nameidata *nd,
|
||||
struct file *file, const struct open_flags *op)
|
||||
{
|
||||
struct dentry *dir = nd->path.dentry;
|
||||
- kuid_t dir_uid = dir->d_inode->i_uid;
|
||||
- umode_t dir_mode = dir->d_inode->i_mode;
|
||||
+ kuid_t dir_uid = nd->inode->i_uid;
|
||||
+ umode_t dir_mode = nd->inode->i_mode;
|
||||
int open_flag = op->open_flag;
|
||||
bool will_truncate = (open_flag & O_TRUNC) != 0;
|
||||
bool got_write = false;
|
||||
|
|
@ -297,6 +297,5 @@ debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
|
|||
debian/ntfs-mark-it-as-broken.patch
|
||||
bugfix/all/wimax-i2400-fix-memory-leak.patch
|
||||
bugfix/all/wimax-i2400-fix-memory-leak-in-i2400m_op_rfkill_sw_toggle.patch
|
||||
bugfix/all/vfs-fix-do_last-regression.patch
|
||||
|
||||
# ABI maintenance
|
||||
|
|
|
|||
Loading…
Reference in New Issue