android_kernel_motorola_sm6225/fs
Jan Kara 1dc71eeb19 udf: Detect system inodes linked into directory hierarchy
[ Upstream commit 85a37983ec69cc9fcd188bc37c4de15ee326355a ]

When UDF filesystem is corrupted, hidden system inodes can be linked
into directory hierarchy which is an avenue for further serious
corruption of the filesystem and kernel confusion as noticed by syzbot
fuzzed images. Refuse to access system inodes linked into directory
hierarchy and vice versa.

CC: stable@vger.kernel.org
Reported-by: syzbot+38695a20b8addcbc1084@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-17 08:31:42 +01:00
..
9p 9p: missing chunk of "fs/9p: Don't update file type when updating file attributes" 2022-06-25 11:48:57 +02:00
adfs fs/adfs: super: fix use-after-free bug 2019-08-06 19:06:49 +02:00
affs affs: initialize fsdata in affs_truncate() 2023-02-06 07:49:38 +01:00
afs afs: Fix dynamic root getattr 2022-07-02 16:27:33 +02:00
autofs autofs: fix a leak in autofs_expire_indirect() 2019-12-13 08:51:01 +01:00
befs
bfs
btrfs btrfs: send: limit number of clones and allocated memory size 2023-03-03 11:40:07 +01:00
cachefiles cachefiles: Handle readpage error correctly 2020-11-05 11:08:54 +01:00
ceph ceph: avoid putting the realm twice when decoding snaps fails 2022-12-08 11:18:31 +01:00
cifs cifs: Fix warning and UAF when destroy the MR list 2023-03-11 16:31:42 +01:00
coda coda: add error handling for fget 2019-08-06 19:06:51 +02:00
configfs configfs: fix a race in configfs_{,un}register_subsystem() 2022-03-02 11:38:13 +01:00
cramfs
crypto fscrypt: add fscrypt_symlink_getattr() for computing st_size 2021-09-22 11:47:56 +02:00
debugfs debugfs: fix error when writing negative value to atomic_t debugfs file 2023-01-18 11:30:06 +01:00
devpts fs/devpts: always delete dcache dentry-s in dput() 2019-03-23 20:09:59 +01:00
dlm fs: dlm: handle -EBUSY first in lock arg validation 2022-10-26 13:19:21 +02:00
ecryptfs Revert "ecryptfs: replace BUG_ON with error handling code" 2021-05-26 11:48:34 +02:00
efivarfs efivarfs: revert "fix memory leak in efivarfs_create()" 2020-12-02 08:48:12 +01:00
efs
exofs exofs_mount(): fix leaks on failure exits 2019-12-05 09:20:32 +01:00
exportfs exportfs: fix 'passing zero to ERR_PTR()' warning 2020-01-27 14:50:02 +01:00
ext2 ext2: Add more validity checks for inode counts 2022-08-25 11:14:58 +02:00
ext4 ext4: zero i_disksize when initializing the bootloader inode 2023-03-17 08:31:42 +01:00
f2fs f2fs: fix cgroup writeback accounting with fs-layer encryption 2023-03-11 16:32:02 +01:00
fat fat: add ratelimit to fat*_ent_bread() 2022-06-14 16:59:18 +02:00
freevxfs
fscache fscache: Fix cookie key hashing 2021-09-22 11:48:02 +02:00
fuse fuse: limit nsec 2022-08-25 11:14:55 +02:00
gfs2 gfs2: jdata writepage fix 2023-03-11 16:31:42 +01:00
hfs hfs: fix missing hfs_bnode_get() in __hfs_bnode_create 2023-03-11 16:31:49 +01:00
hfsplus fs: hfsplus: fix UAF issue in hfsplus_put_super 2023-03-11 16:31:49 +01:00
hostfs
hpfs
hugetlbfs hugetlbfs: hugetlb_fault_mutex_hash() cleanup 2021-06-03 08:38:12 +02:00
isofs isofs: Fix out of bound access for corrupted isofs image 2021-11-12 14:40:50 +01:00
jbd2 jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted 2022-08-25 11:15:19 +02:00
jffs2 jffs2: fix memory leak in jffs2_do_fill_super 2022-06-14 16:59:33 +02:00
jfs fs/jfs: fix shift exponent db_agl2size negative 2023-03-11 16:31:55 +01:00
kernfs kernfs: fix use-after-free in __kernfs_remove 2022-11-03 23:52:29 +09:00
lockd lockd: don't use interval-based rebinding over TCP 2020-12-30 11:25:59 +01:00
minix minix: fix bug when opening a file with O_DIRECT 2022-04-15 14:15:03 +02:00
nfs pNFS/filelayout: Fix coalescing test for single DS 2023-01-24 07:11:49 +01:00
nfs_common nfs_common: need lock during iterate through the list 2020-12-30 11:26:02 +01:00
nfsd nfsd: fix race to check ls_layouts 2023-03-11 16:31:42 +01:00
nilfs2 nilfs2: fix underflow in second superblock position calculations 2023-02-22 12:47:22 +01:00
nls
notify fsnotify: fix wrong lockdep annotations 2022-06-14 16:59:20 +02:00
ntfs ntfs: check overflow when iterating ATTR_RECORDs 2022-11-25 17:40:30 +01:00
ocfs2 ocfs2: fix non-auto defrag path not working issue 2023-03-11 16:31:49 +01:00
omfs
openpromfs
orangefs orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() 2023-01-18 11:30:37 +01:00
overlayfs ovl: Use ovl mounter's fsuid and fsgid in ovl_link() 2023-01-18 11:30:40 +01:00
proc mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps 2023-02-22 12:47:15 +01:00
pstore pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES 2023-01-18 11:30:38 +01:00
qnx4 qnx4: work around gcc false positive warning bug 2021-10-06 15:31:20 +02:00
qnx6
quota ext4: fix bug_on in __es_tree_search caused by bad quota inode 2023-01-18 11:30:53 +01:00
ramfs ramfs: fix nommu mmap with gaps in the page cache 2020-10-30 10:38:21 +01:00
reiserfs fs: reiserfs: remove useless new_opts in reiserfs_remount 2023-02-06 07:49:41 +01:00
romfs romfs: fix uninitialized memory leak in romfs_dev_read() 2020-08-26 10:30:59 +02:00
squashfs revert "squashfs: harden sanity check in squashfs_read_xattr_id_table" 2023-02-22 12:47:20 +01:00
sysfs fs: sysfs_emit: Remove PAGE_SIZE alignment check 2022-03-23 09:10:42 +01:00
sysv fs: sysv: Fix sysv_nblocks() returns wrong value 2023-01-18 11:30:08 +01:00
tracefs tracefs: Only clobber mode/uid/gid on remount if asked 2022-09-20 12:26:48 +02:00
ubifs ubifs: ubifs_writepage: Mark page dirty after writing inode failed 2023-03-11 16:31:57 +01:00
udf udf: Detect system inodes linked into directory hierarchy 2023-03-17 08:31:42 +01:00
ufs fs/ufs: avoid potential u32 multiplication overflow 2020-08-21 11:05:38 +02:00
xfs xfs: remove incorrect ASSERT in xfs_rename 2022-07-12 16:29:02 +02:00
aio.c aio: fix mremap after fork null-deref 2023-02-22 12:47:19 +01:00
anon_inodes.c
attr.c vfs: Check the truncate maximum size in inode_newsize_ok() 2022-08-25 11:14:53 +02:00
bad_inode.c
binfmt_aout.c binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf 2023-01-18 11:30:42 +01:00
binfmt_elf.c elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings 2021-10-06 15:31:24 +02:00
binfmt_elf_fdpic.c binfmt: Fix error return code in load_elf_fdpic_binary() 2023-01-18 11:30:42 +01:00
binfmt_em86.c
binfmt_flat.c binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf 2023-01-18 11:30:42 +01:00
binfmt_misc.c binfmt_misc: fix shift-out-of-bounds in check_special_flags 2023-01-18 11:30:33 +01:00
binfmt_script.c exec: load_script: Do not exec truncated interpreter path 2019-11-06 13:05:37 +01:00
block_dev.c block: reexpand iov_iter after read/write 2021-05-22 10:59:49 +02:00
buffer.c mm: fs: initialize fsdata passed to write_begin/write_end interface 2022-11-25 17:40:29 +01:00
char_dev.c chardev: fix error handling in cdev_device_add() 2023-01-18 11:30:27 +01:00
compat.c
compat_binfmt_elf.c
compat_ioctl.c fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP 2020-01-09 10:19:07 +01:00
coredump.c coredump: fix crash when umh is disabled 2020-05-14 07:57:21 +02:00
d_path.c
dax.c dax: fix cache flush on PMD-mapped pages 2022-06-14 16:59:24 +02:00
dcache.c fs, fscrypt: clear DCACHE_ENCRYPTED_NAME when unaliasing directory 2020-11-05 11:08:35 +01:00
dcookies.c
direct-io.c fs: direct-io: fix missing sdio->boundary 2021-04-14 08:22:32 +02:00
drop_caches.c fs: avoid softlockups in s_inodes iterators 2020-01-12 12:17:20 +01:00
eventfd.c eventfd: track eventfd_signal() recursion depth 2020-02-11 04:34:08 -08:00
eventpoll.c ep_create_wakeup_source(): dentry name can change under you... 2020-10-07 08:00:09 +02:00
exec.c exec: Force single empty string when argv is empty 2022-06-06 08:24:21 +02:00
fcntl.c fcntl: fix potential deadlock for &fasync_struct.fa_lock 2021-09-22 11:47:50 +02:00
fhandle.c
file.c fs: prevent out-of-bounds array speculation when closing a file descriptor 2023-03-17 08:31:41 +01:00
file_table.c fs: add fget_many() and fput_many() 2021-12-08 08:50:13 +01:00
filesystems.c fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once() 2020-04-17 10:48:51 +02:00
fs-writeback.c fs-writeback: writeback_sb_inodes:Recalculate 'wrote' according skipped pages 2022-06-14 16:59:27 +02:00
fs_pin.c
fs_struct.c
inode.c fs: fix UAF/GPF bug in nilfs_mdt_destroy 2022-10-26 13:19:16 +02:00
internal.h acct_on(): don't mess with freeze protection 2019-05-31 06:46:05 -07:00
ioctl.c
iomap.c iomap: fix sub-page uptodate handling 2021-05-22 10:59:50 +02:00
Kconfig
Kconfig.binfmt
libfs.c libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value 2023-01-18 11:30:06 +01:00
locks.c locks: print unsigned ino in /proc/locks 2020-01-09 10:19:00 +01:00
Makefile
mbcache.c mbcache: Avoid nesting of cache->c_list_lock under bit locks 2023-01-18 11:30:51 +01:00
mount.h
mpage.c
namei.c mm: fs: initialize fsdata passed to write_begin/write_end interface 2022-11-25 17:40:29 +01:00
namespace.c VFS: Fix memory leak caused by concurrently mounting fs with subtype 2022-05-15 19:41:59 +02:00
no-block.c
nsfs.c dcache: sort the freeing-without-RCU-delay mess for good. 2019-05-25 18:23:26 +02:00
open.c cifs_atomic_open(): fix double-put on late allocation failure 2020-03-18 07:14:21 +01:00
pipe.c pipe: increase minimum default pipe size to 2 pages 2021-08-12 13:19:43 +02:00
pnode.c pnode: terminate at peers of source 2023-01-18 11:30:40 +01:00
pnode.h
posix_acl.c
proc_namespace.c
read_write.c vfs: avoid problematic remapping requests into partial EOF block 2019-12-01 09:17:04 +01:00
readdir.c readdir: make sure to verify directory entry for legacy interfaces too 2021-04-28 13:16:50 +02:00
select.c select: Fix indefinitely sleeping task in poll_schedule_timeout() 2022-01-29 10:19:18 +01:00
seq_file.c seq_file: disallow extremely large seq buffer allocations 2021-07-20 16:16:16 +02:00
signalfd.c signalfd: use wake_up_pollfree() 2021-12-14 10:18:07 +01:00
splice.c Revert "fs: check FMODE_LSEEK to control internal pipe splicing" 2022-10-26 13:19:21 +02:00
stack.c
stat.c stat: fix inconsistency between struct stat and struct compat_stat 2022-04-27 13:39:44 +02:00
statfs.c vfs: Fix EOVERFLOW testing in put_compat_statfs64 2019-10-11 18:21:39 +02:00
super.c vfs: make freeze_super abort when sync_filesystem returns error 2022-02-23 11:58:38 +01:00
sync.c
timerfd.c
userfaultfd.c userfaultfd: prevent concurrent API initialization 2021-09-22 11:48:02 +02:00
utimes.c
xattr.c fs: don't audit the capability check in simple_xattr_list() 2023-01-18 11:30:04 +01:00