mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-29 23:53:32 +00:00
Code Issues Releases Wiki Activity
linux-stable/fs/9p
History
Will Deacon 50192abe02 fs/9p: avoid accessing utsname after namespace has been torn down 
During trinity fuzzing in a kvmtool guest, I stumbled across the
following:

Unable to handle kernel NULL pointer dereference at virtual address 00000004
PC is at v9fs_file_do_lock+0xc8/0x1a0
LR is at v9fs_file_do_lock+0x48/0x1a0
[<c01e2ed0>] (v9fs_file_do_lock+0xc8/0x1a0) from [<c0119154>] (locks_remove_flock+0x8c/0x124)
[<c0119154>] (locks_remove_flock+0x8c/0x124) from [<c00d9bf0>] (__fput+0x58/0x1e4)
[<c00d9bf0>] (__fput+0x58/0x1e4) from [<c0044340>] (task_work_run+0xac/0xe8)
[<c0044340>] (task_work_run+0xac/0xe8) from [<c002e36c>] (do_exit+0x6bc/0x8d8)
[<c002e36c>] (do_exit+0x6bc/0x8d8) from [<c002e674>] (do_group_exit+0x3c/0xb0)
[<c002e674>] (do_group_exit+0x3c/0xb0) from [<c002e6f8>] (__wake_up_parent+0x0/0x18)

I believe this is due to an attempt to access utsname()->nodename, after
exit_task_namespaces() has been called, leaving current->nsproxy->uts_ns
as NULL and causing the above dereference.

A similar issue was fixed for lockd in 9a1b6bf818 ("LOCKD: Don't call
utsname()->nodename from nlmclnt_setlockargs"), so this patch attempts
something similar for 9pfs.

Cc: Eric Van Hensbergen <ericvh@gmail.com>
Cc: Ron Minnich <rminnich@sandia.gov>
Cc: Latchesar Ionkov <lucho@ionkov.net>
Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
2013-08-26 10:28:46 -05:00
..
acl.c 9p: switch v9fs_set_create_acl() to inode+fid, do it before d_instantiate() 2013-02-26 02:46:07 -05:00
acl.h 9p: switch v9fs_set_create_acl() to inode+fid, do it before d_instantiate() 2013-02-26 02:46:07 -05:00
cache.c 9p: Reduce object size with CONFIG_NET_9P_DEBUG 2012-01-05 10:51:44 -06:00
cache.h fs/9p: When doing inode lookup compare qid details and inode mode bits. 2011-07-23 09:32:48 -05:00
fid.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-03-03 13:23:03 -08:00
fid.h 9p: v9fs_fid_add() can't fail now 2013-02-28 01:18:14 -05:00
Kconfig fs/9p: xattr: add trusted and security namespaces 2013-07-07 22:02:18 -05:00
Makefile fs/9p: xattr: add trusted and security namespaces 2013-07-07 22:02:18 -05:00
v9fs.c 9p: Modify struct v9fs_session_info to use a kuids and kgids 2013-02-12 03:19:33 -08:00
v9fs.h 9p: Modify struct v9fs_session_info to use a kuids and kgids 2013-02-12 03:19:33 -08:00
v9fs_vfs.h 9p: propagate umode_t 2012-01-03 22:55:01 -05:00
vfs_addr.c mm: change invalidatepage prototype to accept length 2013-05-21 23:17:23 -04:00
vfs_dentry.c v9fs: get rid of v9fs_dentry 2013-02-28 01:13:19 -05:00
vfs_dir.c [readdir] convert 9p 2013-06-29 12:56:45 +04:00
vfs_file.c fs/9p: avoid accessing utsname after namespace has been torn down 2013-08-26 10:28:46 -05:00
vfs_inode.c fs: 9p: use strlcpy instead of strncpy 2013-07-30 10:42:56 -05:00
vfs_inode_dotl.c 9p: v9fs_fid_add() can't fail now 2013-02-28 01:18:14 -05:00
vfs_super.c fs: Limit sys_mount to only request filesystem modules. 2013-03-03 19:36:31 -08:00
xattr.c fs/9p: xattr: add trusted and security namespaces 2013-07-07 22:02:18 -05:00
xattr.h fs/9p: xattr: add trusted and security namespaces 2013-07-07 22:02:18 -05:00
xattr_security.c fs/9p: xattr: add trusted and security namespaces 2013-07-07 22:02:18 -05:00
xattr_trusted.c fs/9p: xattr: add trusted and security namespaces 2013-07-07 22:02:18 -05:00
xattr_user.c fs/9p: Add support user. xattr 2010-08-02 14:28:35 -05:00