user/sven/linux.git/fs/debugfs, branch v4.19.225

debugfs: fix use-after-free on symlink traversal

2019-05-08T05:21:48Z

[ Upstream commit 93b919da64c15b90953f96a536e5e61df896ca57 ] symlink body shouldn't be freed without an RCU delay. Switch debugfs to ->destroy_inode() and use of call_rcu(); free both the inode and symlink body in the callback. Similar to solution for bpf, only here it's even more obvious that ->evict_inode() can be dropped. Signed-off-by: Al Viro Signed-off-by: Sasha Levin

debugfs: fix debugfs_rename parameter checking

2019-02-15T07:10:11Z

commit d88c93f090f708c18195553b352b9f205e65418f upstream. debugfs_rename() needs to check that the dentries passed into it really are valid, as sometimes they are not (i.e. if the return value of another debugfs call is passed into this one.) So fix this up by properly checking if the two parent directories are errors (they are allowed to be NULL), and if the dentry to rename is not NULL or an error. Cc: stable Signed-off-by: Greg Kroah-Hartman

Revert "debugfs: inode: debugfs_create_dir uses mode permission from parent"

2018-06-13T03:52:16Z

This reverts commit 95cde3c59966f6371b6bcd9e4e2da2ba64ee9775. The commit had good intentions, but it breaks kvm-tool and qemu-kvm. With it in place, "lkvm run" just fails with Error: KVM_CREATE_VM ioctl Warning: Failed init: kvm__init which isn't a wonderful error message, but bisection pinpointed the problematic commit. The problem is almost certainly due to the special kvm debugfs entries created dynamically by kvm under /sys/kernel/debug/kvm/. See kvm_create_vm_debugfs() Bisected-and-reported-by: Linus Torvalds Cc: Wanpeng Li Cc: Greg Kroah-Hartman Cc: Thomas Richter Cc: Kees Cook Signed-off-by: Linus Torvalds

debugfs: inode: debugfs_create_dir uses mode permission from parent

2018-05-14T14:48:18Z

Currently function debugfs_create_dir() creates a new directory in the debugfs (usually mounted /sys/kernel/debug) with permission rwxr-xr-x. This is hard coded. Change this to use the parent directory permission. Output before the patch: root@s8360047 ~]# tree -dp -L 1 /sys/kernel/debug/ /sys/kernel/debug/ ├── [drwxr-xr-x] bdi ├── [drwxr-xr-x] block ├── [drwxr-xr-x] dasd ├── [drwxr-xr-x] device_component ├── [drwxr-xr-x] extfrag ├── [drwxr-xr-x] hid ├── [drwxr-xr-x] kprobes ├── [drwxr-xr-x] kvm ├── [drwxr-xr-x] memblock ├── [drwxr-xr-x] pm_qos ├── [drwxr-xr-x] qdio ├── [drwxr-xr-x] s390 ├── [drwxr-xr-x] s390dbf └── [drwx------] tracing 14 directories [root@s8360047 linux]# Output after the patch: [root@s8360047 ~]# tree -dp -L 1 /sys/kernel/debug/ sys/kernel/debug/ ├── [drwx------] bdi ├── [drwx------] block ├── [drwx------] dasd ├── [drwx------] device_component ├── [drwx------] extfrag ├── [drwx------] hid ├── [drwx------] kprobes ├── [drwx------] kvm ├── [drwx------] memblock ├── [drwx------] pm_qos ├── [drwx------] qdio ├── [drwx------] s390 ├── [drwx------] s390dbf └── [drwx------] tracing 14 directories [root@s8360047 linux]# Here is the full diff output done with: [root@s8360047 ~]# diff -u treefull.before treefull.after | sed 's-^- # -' > treefull.diff # --- treefull.before 2018-04-27 13:22:04.532824564 +0200 # +++ treefull.after 2018-04-27 13:24:12.106182062 +0200 # @@ -1,55 +1,55 @@ # /sys/kernel/debug/ # -├── [drwxr-xr-x] bdi # -│ ├── [drwxr-xr-x] 1:0 # -│ ├── [drwxr-xr-x] 1:1 # -│ ├── [drwxr-xr-x] 1:10 # -│ ├── [drwxr-xr-x] 1:11 # -│ ├── [drwxr-xr-x] 1:12 # -│ ├── [drwxr-xr-x] 1:13 # -│ ├── [drwxr-xr-x] 1:14 # -│ ├── [drwxr-xr-x] 1:15 # -│ ├── [drwxr-xr-x] 1:2 # -│ ├── [drwxr-xr-x] 1:3 # -│ ├── [drwxr-xr-x] 1:4 # -│ ├── [drwxr-xr-x] 1:5 # -│ ├── [drwxr-xr-x] 1:6 # -│ ├── [drwxr-xr-x] 1:7 # -│ ├── [drwxr-xr-x] 1:8 # -│ ├── [drwxr-xr-x] 1:9 # -│ └── [drwxr-xr-x] 94:0 # -├── [drwxr-xr-x] block # -├── [drwxr-xr-x] dasd # -│ ├── [drwxr-xr-x] 0.0.e18a # -│ ├── [drwxr-xr-x] dasda # -│ └── [drwxr-xr-x] global # -├── [drwxr-xr-x] device_component # -├── [drwxr-xr-x] extfrag # -├── [drwxr-xr-x] hid # -├── [drwxr-xr-x] kprobes # -├── [drwxr-xr-x] kvm # -├── [drwxr-xr-x] memblock # -├── [drwxr-xr-x] pm_qos # -├── [drwxr-xr-x] qdio # -│ └── [drwxr-xr-x] 0.0.f5f2 # -├── [drwxr-xr-x] s390 # -│ └── [drwxr-xr-x] stsi # -├── [drwxr-xr-x] s390dbf # -│ ├── [drwxr-xr-x] 0.0.e18a # -│ ├── [drwxr-xr-x] cio_crw # -│ ├── [drwxr-xr-x] cio_msg # -│ ├── [drwxr-xr-x] cio_trace # -│ ├── [drwxr-xr-x] dasd # -│ ├── [drwxr-xr-x] kvm-trace # -│ ├── [drwxr-xr-x] lgr # -│ ├── [drwxr-xr-x] qdio_0.0.f5f2 # -│ ├── [drwxr-xr-x] qdio_error # -│ ├── [drwxr-xr-x] qdio_setup # -│ ├── [drwxr-xr-x] qeth_card_0.0.f5f0 # -│ ├── [drwxr-xr-x] qeth_control # -│ ├── [drwxr-xr-x] qeth_msg # -│ ├── [drwxr-xr-x] qeth_setup # -│ ├── [drwxr-xr-x] vmcp # -│ └── [drwxr-xr-x] vmur # +├── [drwx------] bdi # +│ ├── [drwx------] 1:0 # +│ ├── [drwx------] 1:1 # +│ ├── [drwx------] 1:10 # +│ ├── [drwx------] 1:11 # +│ ├── [drwx------] 1:12 # +│ ├── [drwx------] 1:13 # +│ ├── [drwx------] 1:14 # +│ ├── [drwx------] 1:15 # +│ ├── [drwx------] 1:2 # +│ ├── [drwx------] 1:3 # +│ ├── [drwx------] 1:4 # +│ ├── [drwx------] 1:5 # +│ ├── [drwx------] 1:6 # +│ ├── [drwx------] 1:7 # +│ ├── [drwx------] 1:8 # +│ ├── [drwx------] 1:9 # +│ └── [drwx------] 94:0 # +├── [drwx------] block # +├── [drwx------] dasd # +│ ├── [drwx------] 0.0.e18a # +│ ├── [drwx------] dasda # +│ └── [drwx------] global # +├── [drwx------] device_component # +├── [drwx------] extfrag # +├── [drwx------] hid # +├── [drwx------] kprobes # +├── [drwx------] kvm # +├── [drwx------] memblock # +├── [drwx------] pm_qos # +├── [drwx------] qdio # +│ └── [drwx------] 0.0.f5f2 # +├── [drwx------] s390 # +│ └── [drwx------] stsi # +├── [drwx------] s390dbf # +│ ├── [drwx------] 0.0.e18a # +│ ├── [drwx------] cio_crw # +│ ├── [drwx------] cio_msg # +│ ├── [drwx------] cio_trace # +│ ├── [drwx------] dasd # +│ ├── [drwx------] kvm-trace # +│ ├── [drwx------] lgr # +│ ├── [drwx------] qdio_0.0.f5f2 # +│ ├── [drwx------] qdio_error # +│ ├── [drwx------] qdio_setup # +│ ├── [drwx------] qeth_card_0.0.f5f0 # +│ ├── [drwx------] qeth_control # +│ ├── [drwx------] qeth_msg # +│ ├── [drwx------] qeth_setup # +│ ├── [drwx------] vmcp # +│ └── [drwx------] vmur # └── [drwx------] tracing # ├── [drwxr-xr-x] events # │ ├── [drwxr-xr-x] alarmtimer Fixes: edac65eaf8d5c ("debugfs: take mode-dependent parts of debugfs_get_inode() into callers") Signed-off-by: Thomas Richter Reviewed-by: Kees Cook Signed-off-by: Greg Kroah-Hartman

debugfs: Re-use kstrtobool_from_user()

2018-05-14T14:48:18Z

Re-use kstrtobool_from_user() instead of open coded variant. Signed-off-by: Andy Shevchenko Signed-off-by: Greg Kroah-Hartman

debugfs_lookup(): switch to lookup_one_len_unlocked()

2018-03-29T19:07:47Z

Signed-off-by: Al Viro

vfs: do bulk POLL* -> EPOLL* replacement

2018-02-11T22:34:03Z

This is the mindless scripted replacement of kernel use of POLL* variables as described by Al, done by this script: for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'` for f in $L; do sed -i "-es/^$[^\"]*$$\$/\\1E\\2/" $f; done done with de-mangling cleanups yet to come. NOTE! On almost all architectures, the EPOLL* constants have the same values as the POLL* constants do. But they keyword here is "almost". For various bad reasons they aren't the same, and epoll() doesn't actually work quite correctly in some cases due to this on Sparc et al. The next patch from Al will sort out the final differences, and we should be all done. Scripted-by: Al Viro Signed-off-by: Linus Torvalds

use linux/poll.h instead of asm/poll.h

2018-02-01T21:23:11Z

The only place that has any business including asm/poll.h is linux/poll.h. Fortunately, asm/poll.h had only been included in 3 places beyond that one, and all of them are trivial to switch to using linux/poll.h. Signed-off-by: Al Viro

fs: annotate ->poll() instances

2017-11-27T21:20:05Z

Signed-off-by: Al Viro

anntotate the places where ->poll() return values go

2017-11-27T21:19:53Z

Signed-off-by: Al Viro