Frank Sorenson 4d9d47c7e5 sunrpc: correct the computation for page_ptr when truncating ... commit 5d7a5bcb67 upstream. When truncating the encode buffer, the page_ptr is getting advanced, causing the next page to be skipped while encoding. The page is still included in the response, so the response contains a page of bogus data. We need to adjust the page_ptr backwards to ensure we encode the next page into the correct place. We saw this triggered when concurrent directory modifications caused nfsd4_encode_direct_fattr() to return nfserr_noent, and the resulting call to xdr_truncate_encode() corrupted the READDIR reply. Signed-off-by: Frank Sorenson <sorenson@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields <bfields@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-11-21 09:26:03 +01:00
..
6lowpan	6lowpan: iphc: reset mac_header after decompress to fix panic	2018-10-03 17:01:42 -07:00
9p	9p: clear dangling pointers in p9stat_free	2018-11-21 09:25:57 +01:00
802
8021q	vlan: also check phy_driver ts_info for vlan's real device	2018-04-13 19:48:34 +02:00
appletalk
atm	net: atm: Fix potential Spectre v1	2018-05-16 10:08:44 +02:00
ax25	ax25: Fix segfault after sock connection timeout	2017-02-04 09:47:09 +01:00
batman-adv	batman-adv: fix hardif_neigh refcount on queue_work() failure	2018-10-20 09:51:30 +02:00
bluetooth	Bluetooth: SMP: fix crash in unpairing	2018-11-10 07:42:42 -08:00
bridge	net: bridge: remove ipv6 zero address check in mcast queries	2018-11-10 07:42:57 -08:00
caif	net: caif: Add a missing rcu_read_unlock() in caif_flow_cb	2018-09-05 09:20:00 +02:00
can	can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once	2018-01-31 12:55:50 +01:00
ceph	libceph: validate con->state at the top of try_write()	2018-05-01 15:13:09 -07:00
core	cgroup, netclassid: add a preemption point to write_classid	2018-11-13 11:16:51 -08:00
dcb	net: dcb: For wild-card lookups, use priority -1, not 0	2018-09-19 22:47:15 +02:00
dccp	inet: make sure to grab rcu_read_lock before using ireq->ireq_opt	2018-10-18 09:13:23 +02:00
decnet	dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock	2018-02-25 11:05:44 +01:00
dns_resolver	KEYS: DNS: fix parsing multiple options	2018-07-22 14:27:39 +02:00
dsa	net: dsa: Do not suspend/resume closed slave_dev	2018-08-06 16:23:03 +02:00
ethernet	net: introduce device min_header_len	2017-02-18 15:11:43 +01:00
hsr	hsr: fix incorrect warning	2018-04-13 19:48:29 +02:00
ieee802154	inet: frags: fix ip6frag_low_thresh boundary	2018-10-18 09:13:25 +02:00
ipv4	net/ipv4: defensive cipso option parsing	2018-11-13 11:16:55 -08:00
ipv6	ip6_tunnel: Fix encapsulation layout	2018-11-10 07:42:59 -08:00
ipx	ipx: call ipxitf_put() in ioctl error path	2017-05-25 15:44:41 +02:00
irda	irda: Only insert new objects into the global database via setsockopt	2018-09-15 09:43:01 +02:00
iucv	net/iucv: Free memory obtained by kzalloc	2018-03-31 18:11:34 +02:00
kcm	kcm: Fix use-after-free caused by clonned sockets	2018-06-13 16:16:42 +02:00
key	af_key: Always verify length of provided sadb_key	2018-06-16 09:52:32 +02:00
l2tp	l2tp: remove configurable payload offset	2018-11-10 07:42:54 -08:00
l3mdev
lapb
llc	llc: set SOCK_RCU_FREE in llc_sap_add_socket()	2018-11-10 07:42:57 -08:00
mac80211	mac80211: fix TX aggregation start/stop callback race	2018-11-10 07:42:47 -08:00
mac802154	net: mac802154: tx: expand tailroom if necessary	2018-09-09 20:01:19 +02:00
mpls	mpls, nospec: Sanitize array index in mpls_label_ok()	2018-03-11 16:21:34 +01:00
ncsi	net/ncsi: Improve HNCDSC AEN handler	2016-10-20 11:23:08 -04:00
netfilter	netfilter: conntrack: fix calculation of next bucket number in early_drop	2018-11-21 09:26:00 +01:00
netlabel	netlabel: check for IPV4MASK in addrinfo_get	2018-10-18 09:13:22 +02:00
netlink	netlink: Don't shift on 64 for ngroups	2018-08-09 12:17:59 +02:00
netrom
nfc	NFC: Fix possible memory corruption when handling SHDLC I-Frame commands	2018-09-29 03:07:30 -07:00
openvswitch	openvswitch: Remove padding from packet before L3+ conntrack processing	2018-05-30 07:50:23 +02:00
packet	packet: refine ring v3 block size test to hold one frame	2018-08-24 13:12:41 +02:00
phonet
qrtr	net: qrtr: Broadcast messages only from control port	2018-08-24 13:12:36 +02:00
rds	rds: ib: Fix missing call to rds_ib_dev_put in rds_ib_setup_qp	2018-11-10 07:42:50 -08:00
rfkill	rfkill: gpio: fix memory leak in probe error path	2018-05-16 10:08:43 +02:00
rose
rxrpc	rxrpc: Only take the rwind and mtu values from latest ACK	2018-11-10 07:42:56 -08:00
sched	net: sched: gred: pass the right attribute to gred_change_table_def()	2018-11-10 07:42:58 -08:00
sctp	sctp: fix race on sctp_id2asoc	2018-11-10 07:42:58 -08:00
strparser	strparser: Fix incorrect strp->need_bytes value.	2018-04-29 11:32:02 +02:00
sunrpc	sunrpc: correct the computation for page_ptr when truncating	2018-11-21 09:26:03 +01:00
switchdev	switchdev: Execute bridge ndos only for bridge ports	2016-10-19 10:58:04 -04:00
tipc	tipc: fix a race condition of releasing subscriber object	2018-11-10 07:42:46 -08:00
unix	net/unix: don't show information about sockets from other namespaces	2017-11-18 11:22:22 +01:00
vmw_vsock	vsock: split dwork to avoid reinitializations	2018-08-22 07:47:13 +02:00
wimax
wireless	nl80211: Fix possible Spectre-v1 for NL80211_TXRATE_HT	2018-11-10 07:42:42 -08:00
x25	net: x25: fix one potential use-after-free issue	2018-04-13 19:48:00 +02:00
xfrm	xfrm: policy: use hlist rcu variants on insert	2018-11-13 11:16:47 -08:00
compat.c	net: support compat 64-bit time in {s,g}etsockopt	2018-05-19 10:26:58 +02:00
Kconfig
Makefile
socket.c	net: socket: fix a missing-check bug	2018-11-10 07:42:58 -08:00
sysctl_net.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2016-10-06 09:52:23 -07:00