Update to 4.19.102
Drop "vfs: fix do_last() regression" Cleanup debian/changelog file
This commit is contained in:
parent
f003f0dba9
commit
ffc4ceb049
|
@ -1,4 +1,4 @@
|
||||||
linux (4.19.101-1) UNRELEASED; urgency=medium
|
linux (4.19.102-1) UNRELEASED; urgency=medium
|
||||||
|
|
||||||
* New upstream stable update:
|
* New upstream stable update:
|
||||||
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.99
|
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.99
|
||||||
|
@ -564,9 +564,64 @@ linux (4.19.101-1) UNRELEASED; urgency=medium
|
||||||
- block: cleanup __blkdev_issue_discard()
|
- block: cleanup __blkdev_issue_discard()
|
||||||
- block: fix 32 bit overflow in __blkdev_issue_discard()
|
- block: fix 32 bit overflow in __blkdev_issue_discard()
|
||||||
- [arm64] KVM: Write arch.mdcr_el2 changes since last vcpu_load on VHE
|
- [arm64] KVM: Write arch.mdcr_el2 changes since last vcpu_load on VHE
|
||||||
|
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.102
|
||||||
|
- vfs: fix do_last() regression
|
||||||
|
- crypto: pcrypt - Fix user-after-free on module unload
|
||||||
|
- perf c2c: Fix return type for histogram sorting comparision functions
|
||||||
|
- PM / devfreq: Add new name attribute for sysfs
|
||||||
|
- tools lib: Fix builds when glibc contains strlcpy()
|
||||||
|
- ext4: validate the debug_want_extra_isize mount option at parse time
|
||||||
|
- mm/mempolicy.c: fix out of bounds write in mpol_parse_str()
|
||||||
|
- reiserfs: Fix memory leak of journal device string
|
||||||
|
- media: digitv: don't continue if remote control state can't be read
|
||||||
|
- media: af9005: uninitialized variable printked
|
||||||
|
- media: vp7045: do not read uninitialized values if usb transfer fails
|
||||||
|
- media: gspca: zero usb_buf
|
||||||
|
- media: dvb-usb/dvb-usb-urb.c: initialize actlen to 0
|
||||||
|
- tomoyo: Use atomic_t for statistics counter
|
||||||
|
- ttyprintk: fix a potential deadlock in interrupt context issue
|
||||||
|
- Bluetooth: Fix race condition in hci_release_sock()
|
||||||
|
- cgroup: Prevent double killing of css when enabling threaded cgroup
|
||||||
|
- [armhf] dts: sun8i: a83t: Correct USB3503 GPIOs polarity
|
||||||
|
- [armhf] dts: am57xx-beagle-x15/am57xx-idk: Remove "gpios" for endpoint
|
||||||
|
dt nodes
|
||||||
|
- [armhf] dts: beagle-x15-common: Model 5V0 regulator
|
||||||
|
- [arm64] clk: sunxi-ng: h6-r: Fix AR100/R_APB2 parent order
|
||||||
|
- mac80211: mesh: restrict airtime metric to peered established plinks
|
||||||
|
- ASoC: rt5640: Fix NULL dereference on module unload
|
||||||
|
- ixgbevf: Remove limit of 10 entries for unicast filter list
|
||||||
|
- ixgbe: Fix calculation of queue with VFs and flow director on interface
|
||||||
|
flap
|
||||||
|
- igb: Fix SGMII SFP module discovery for 100FX/LX.
|
||||||
|
- [x86] platform/x86: GPD pocket fan: Allow somewhat lower/higher
|
||||||
|
temperature limits
|
||||||
|
- qmi_wwan: Add support for Quectel RM500Q
|
||||||
|
- wireless: fix enabling channel 12 for custom regulatory domain
|
||||||
|
- cfg80211: Fix radar event during another phy CAC
|
||||||
|
- mac80211: Fix TKIP replay protection immediately after key setup
|
||||||
|
- netfilter: nft_tunnel: ERSPAN_VERSION must not be null
|
||||||
|
- [armhf] net: dsa: bcm_sf2: Configure IMP port for 2Gb/sec
|
||||||
|
- bnxt_en: Fix ipv6 RFS filter matching logic.
|
||||||
|
- iwlwifi: Don't ignore the cap field upon mcc update
|
||||||
|
- [armhf] dts: am335x-boneblack-common: fix memory size
|
||||||
|
- vti[6]: fix packet tx through bpf_redirect()
|
||||||
|
- xfrm interface: fix packet tx through bpf_redirect()
|
||||||
|
- xfrm: interface: do not confirm neighbor when do pmtu update
|
||||||
|
- scsi: fnic: do not queue commands during fwreset
|
||||||
|
- [armhf] 8955/1: virt: Relax arch timer version check during early boot
|
||||||
|
- [arm64] tee: optee: Fix compilation issue with nommu
|
||||||
|
- airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE
|
||||||
|
- airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE
|
||||||
|
- r8152: get default setting of WOL before initializing
|
||||||
|
- qlcnic: Fix CPU soft lockup while collecting firmware dump
|
||||||
|
- seq_tab_next() should increase position index
|
||||||
|
- l2t_seq_next should increase position index
|
||||||
|
- net: Fix skb->csum update in inet_proto_csum_replace16().
|
||||||
|
- btrfs: do not zero f_bavail if we have available space
|
||||||
|
- perf report: Fix no libunwind compiled warning break s390 issue
|
||||||
|
- mm/migrate.c: also overwrite error when it is bigger than zero
|
||||||
|
|
||||||
[ Salvatore Bonaccorso ]
|
[ Salvatore Bonaccorso ]
|
||||||
* vfs: fix do_last() regression
|
|
||||||
* Refresh "Revert "objtool: Fix CONFIG_STACK_VALIDATION=y warning for
|
* Refresh "Revert "objtool: Fix CONFIG_STACK_VALIDATION=y warning for
|
||||||
out-of-tree modules"" for context changes in 4.19.99
|
out-of-tree modules"" for context changes in 4.19.99
|
||||||
* Refresh "ARM: dts: bcm283x: Correct vchiq compatible string" for context
|
* Refresh "ARM: dts: bcm283x: Correct vchiq compatible string" for context
|
||||||
|
|
|
@ -1,57 +0,0 @@
|
||||||
From: Al Viro <viro@zeniv.linux.org.uk>
|
|
||||||
Date: Sat, 1 Feb 2020 16:26:45 +0000
|
|
||||||
Subject: vfs: fix do_last() regression
|
|
||||||
Origin: https://git.kernel.org/linus/6404674acd596de41fd3ad5f267b4525494a891a
|
|
||||||
|
|
||||||
Brown paperbag time: fetching ->i_uid/->i_mode really should've been
|
|
||||||
done from nd->inode. I even suggested that, but the reason for that has
|
|
||||||
slipped through the cracks and I went for dir->d_inode instead - made
|
|
||||||
for more "obvious" patch.
|
|
||||||
|
|
||||||
Analysis:
|
|
||||||
|
|
||||||
- at the entry into do_last() and all the way to step_into(): dir (aka
|
|
||||||
nd->path.dentry) is known not to have been freed; so's nd->inode and
|
|
||||||
it's equal to dir->d_inode unless we are already doomed to -ECHILD.
|
|
||||||
inode of the file to get opened is not known.
|
|
||||||
|
|
||||||
- after step_into(): inode of the file to get opened is known; dir
|
|
||||||
might be pointing to freed memory/be negative/etc.
|
|
||||||
|
|
||||||
- at the call of may_create_in_sticky(): guaranteed to be out of RCU
|
|
||||||
mode; inode of the file to get opened is known and pinned; dir might
|
|
||||||
be garbage.
|
|
||||||
|
|
||||||
The last was the reason for the original patch. Except that at the
|
|
||||||
do_last() entry we can be in RCU mode and it is possible that
|
|
||||||
nd->path.dentry->d_inode has already changed under us.
|
|
||||||
|
|
||||||
In that case we are going to fail with -ECHILD, but we need to be
|
|
||||||
careful; nd->inode is pointing to valid struct inode and it's the same
|
|
||||||
as nd->path.dentry->d_inode in "won't fail with -ECHILD" case, so we
|
|
||||||
should use that.
|
|
||||||
|
|
||||||
Reported-by: "Rantala, Tommi T. (Nokia - FI/Espoo)" <tommi.t.rantala@nokia.com>
|
|
||||||
Reported-by: syzbot+190005201ced78a74ad6@syzkaller.appspotmail.com
|
|
||||||
Wearing-brown-paperbag: Al Viro <viro@zeniv.linux.org.uk>
|
|
||||||
Cc: stable@kernel.org
|
|
||||||
Fixes: d0cb50185ae9 ("do_last(): fetch directory ->i_mode and ->i_uid before it's too late")
|
|
||||||
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
|
|
||||||
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
||||||
---
|
|
||||||
fs/namei.c | 4 ++--
|
|
||||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
||||||
|
|
||||||
--- a/fs/namei.c
|
|
||||||
+++ b/fs/namei.c
|
|
||||||
@@ -3259,8 +3259,8 @@ static int do_last(struct nameidata *nd,
|
|
||||||
struct file *file, const struct open_flags *op)
|
|
||||||
{
|
|
||||||
struct dentry *dir = nd->path.dentry;
|
|
||||||
- kuid_t dir_uid = dir->d_inode->i_uid;
|
|
||||||
- umode_t dir_mode = dir->d_inode->i_mode;
|
|
||||||
+ kuid_t dir_uid = nd->inode->i_uid;
|
|
||||||
+ umode_t dir_mode = nd->inode->i_mode;
|
|
||||||
int open_flag = op->open_flag;
|
|
||||||
bool will_truncate = (open_flag & O_TRUNC) != 0;
|
|
||||||
bool got_write = false;
|
|
|
@ -297,6 +297,5 @@ debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
|
||||||
debian/ntfs-mark-it-as-broken.patch
|
debian/ntfs-mark-it-as-broken.patch
|
||||||
bugfix/all/wimax-i2400-fix-memory-leak.patch
|
bugfix/all/wimax-i2400-fix-memory-leak.patch
|
||||||
bugfix/all/wimax-i2400-fix-memory-leak-in-i2400m_op_rfkill_sw_toggle.patch
|
bugfix/all/wimax-i2400-fix-memory-leak-in-i2400m_op_rfkill_sw_toggle.patch
|
||||||
bugfix/all/vfs-fix-do_last-regression.patch
|
|
||||||
|
|
||||||
# ABI maintenance
|
# ABI maintenance
|
||||||
|
|
Loading…
Reference in New Issue