1. 22 Mar, 2016 1 commit
  2. 18 Mar, 2016 5 commits
  3. 17 Mar, 2016 3 commits
  4. 16 Mar, 2016 1 commit
    • J. Bruce Fields's avatar
      nfsd: fix deadlock secinfo+readdir compound · 2f6fc056
      J. Bruce Fields authored
      nfsd_lookup_dentry exits with the parent filehandle locked.  fh_put also
      unlocks if necessary (nfsd filehandle locking is probably too lenient),
      so it gets unlocked eventually, but if the following op in the compound
      needs to lock it again, we can deadlock.
      
      A fuzzer ran into this; normal clients don't send a secinfo followed by
      a readdir in the same compound.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
      2f6fc056
  5. 02 Mar, 2016 1 commit
  6. 01 Mar, 2016 16 commits
  7. 23 Feb, 2016 1 commit
    • Stefan Hajnoczi's avatar
      sunrpc/cache: fix off-by-one in qword_get() · b7052cd7
      Stefan Hajnoczi authored
      The qword_get() function NUL-terminates its output buffer.  If the input
      string is in hex format \xXXXX... and the same length as the output
      buffer, there is an off-by-one:
      
        int qword_get(char **bpp, char *dest, int bufsize)
        {
            ...
            while (len < bufsize) {
                ...
                *dest++ = (h << 4) | l;
                len++;
            }
            ...
            *dest = '\0';
            return len;
        }
      
      This patch ensures the NUL terminator doesn't fall outside the output
      buffer.
      Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
      b7052cd7
  8. 14 Feb, 2016 12 commits