Eric W. Biederman fa6ef73586 vfs: Test for and handle paths that are unreachable from their mnt_root ... commit 397d425dc26da728396e66d392d5dcb8dac30c37 upstream. In rare cases a directory can be renamed out from under a bind mount. In those cases without special handling it becomes possible to walk up the directory tree to the root dentry of the filesystem and down from the root dentry to every other file or directory on the filesystem. Like division by zero .. from an unconnected path can not be given a useful semantic as there is no predicting at which path component the code will realize it is unconnected. We certainly can not match the current behavior as the current behavior is a security hole. Therefore when encounting .. when following an unconnected path return -ENOENT. - Add a function path_connected to verify path->dentry is reachable from path->mnt.mnt_root. AKA to validate that rename did not do something nasty to the bind mount. To avoid races path_connected must be called after following a path component to it's next path component. Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2015-10-22 14:37:52 -07:00
..
9p	9p: don't leave a half-initialized inode sitting around	2015-08-03 09:29:47 -07:00
adfs
affs	move d_rcu from overlapping d_child to overlapping d_alias	2015-04-29 10:34:00 +02:00
afs
autofs4	move d_rcu from overlapping d_child to overlapping d_alias	2015-04-29 10:34:00 +02:00
befs
bfs
btrfs	btrfs: skip waiting on ordered range for special files	2015-10-22 14:37:50 -07:00
cachefiles
ceph	move d_rcu from overlapping d_child to overlapping d_alias	2015-04-29 10:34:00 +02:00
cifs	disabling oplocks/leases via module parm enable_oplocks broken for SMB3	2015-10-22 14:37:51 -07:00
coda	move d_rcu from overlapping d_child to overlapping d_alias	2015-04-29 10:34:00 +02:00
configfs	configfs: fix race between dentry put and lookup	2013-11-29 11:11:53 -08:00
cramfs
debugfs	move d_rcu from overlapping d_child to overlapping d_alias	2015-04-29 10:34:00 +02:00
devpts	devpts: plug the memory leak in kill_sb	2013-12-04 10:55:49 -08:00
dlm
ecryptfs	eCryptfs: Remove buggy and unnecessary write in file name decode routine	2015-01-08 09:58:17 -08:00
efivarfs
efs
exofs	ore: Fix wrong math in allocation of per device BIO	2014-02-13 13:48:00 -08:00
exportfs	move d_rcu from overlapping d_child to overlapping d_alias	2015-04-29 10:34:00 +02:00
ext2	ext2: Fix oops in ext2_get_block() called from ext2_quota_write()	2014-12-16 09:09:43 -08:00
ext3	ext3: Don't check quota format when there are no quota files	2014-11-14 08:48:00 -08:00
ext4	ext4: replace open coded nofail allocation in ext4_free_blocks()	2015-08-03 09:29:43 -07:00
f2fs
fat
freevxfs
fscache
fuse	fuse: initialize fc->release before calling it	2015-08-03 09:29:46 -07:00
gfs2	GFS2: Increase i_writecount during gfs2_setattr_chown	2014-01-25 08:27:11 -08:00
hfs	hfs,hfsplus: cache pages correctly between bnode_create and bnode_free	2015-10-01 12:07:34 +02:00
hfsplus	hfs,hfsplus: cache pages correctly between bnode_create and bnode_free	2015-10-01 12:07:34 +02:00
hostfs
hpfs	hpfs: update ctime and mtime on directory modification	2015-09-21 10:00:10 -07:00
hppfs
hugetlbfs	cope with potentially long ->d_dname() output for shmem/hugetlb	2013-10-18 07:45:45 -07:00
isofs	isofs: Fix unchecked printing of ER records	2015-01-08 09:58:15 -08:00
jbd
jbd2	jbd2: fix ocfs2 corrupt when updating journal superblock fails	2015-08-03 09:29:43 -07:00
jffs2	jffs2: fix handling of corrupted summary length	2015-03-06 14:40:53 -08:00
jfs	jfs: fix readdir regression	2015-04-29 10:33:57 +02:00
lockd	LOCKD: Fix a race when initialising nlmsvc_timeout	2015-01-27 07:52:33 -08:00
logfs
minix
ncpfs	move d_rcu from overlapping d_child to overlapping d_alias	2015-04-29 10:34:00 +02:00
nfs	NFS: nfs_set_pgio_error sometimes misses errors	2015-10-01 12:07:31 +02:00
nfs_common
nfsd	nfsd4: fix xdr4 inclusion of escaped char	2015-01-16 06:59:02 -08:00
nilfs2	nilfs2: fix sanity check of btree level in nilfs_btree_root_broken()	2015-05-17 09:51:32 -07:00
nls
notify	fsnotify: fix oops in fsnotify_clear_marks_by_group_flags()	2015-08-16 20:51:35 -07:00
ntfs
ocfs2	ocfs2: fix BUG in ocfs2_downconvert_thread_do_work()	2015-08-16 20:51:40 -07:00
omfs	fs, omfs: add NULL terminator in the end up the token list	2015-06-05 23:19:54 -07:00
openpromfs
proc	pagemap: do not leak physical addresses to non-privileged userspace	2015-04-19 10:10:51 +02:00
pstore	pstore/ram: avoid atomic accesses for ioremapped regions	2015-02-05 22:35:40 -08:00
qnx4
qnx6
quota	quota: provide interface for readding allocated space into reserved space	2015-01-29 17:40:57 -08:00
ramfs
reiserfs	remove extra definitions of U32_MAX	2015-04-29 10:33:54 +02:00
romfs
squashfs
sysfs
sysv	sysv: Add forgotten superblock lock init for v7 fs	2013-10-05 07:13:09 -07:00
ubifs	UBIFS: fix free log space calculation	2014-11-14 08:47:54 -08:00
udf	udf: Check length of extended attributes and allocation descriptors	2015-10-22 14:37:51 -07:00
ufs
xfs	xfs: fix remote symlinks on V5/CRC filesystems	2015-08-03 09:29:45 -07:00
aio.c	aio: fix kernel memory disclosure in io_getevents() introduced in v3.10	2014-06-30 20:09:45 -07:00
anon_inodes.c
attr.c	fs,userns: Change inode_capable to capable_wrt_inode_uidgid	2014-06-16 13:42:52 -07:00
bad_inode.c
binfmt_aout.c
binfmt_elf.c	fs/binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings	2015-06-05 23:20:00 -07:00
binfmt_elf_fdpic.c
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
binfmt_som.c
bio-integrity.c	bio-integrity: Fix bio_integrity_verify segment start bug	2014-03-23 21:38:21 -07:00
bio.c	block: Fix bio_copy_data()	2013-10-05 07:13:09 -07:00
block_dev.c	writeback: Fix periodic writeback after fs mount	2013-07-28 16:29:40 -07:00
buffer.c	vfs: fix data corruption when blocksize < pagesize for mmaped data	2014-11-14 08:47:54 -08:00
char_dev.c
compat.c
compat_binfmt_elf.c
compat_ioctl.c
coredump.c	fs: if a coredump already exists, unlink and recreate with O_EXCL	2015-10-01 12:07:32 +02:00
coredump.h
dcache.c	dcache: Handle escaped paths in prepend_path	2015-10-22 14:37:52 -07:00
dcookies.c	fs/compat: fix lookup_dcookie() parameter handling	2014-02-13 13:48:00 -08:00
direct-io.c
drop_caches.c
eventfd.c
eventpoll.c
exec.c	fs: take i_mutex during prepare_binprm for set[ug]id executables	2015-07-03 19:48:09 -07:00
fcntl.c
fhandle.c	vfs: read file_handle only once in handle_to_path	2015-06-05 23:20:00 -07:00
file.c	fs/file.c:fdtable: avoid triggering OOMs from alloc_fdmem	2014-02-22 12:41:25 -08:00
file_table.c	get rid of s_files and files_lock	2015-07-03 19:48:08 -07:00
filesystems.c
fs-writeback.c	writeback: fix a subtle race condition in I_DIRTY clearing	2015-01-16 06:59:02 -08:00
fs_struct.c
generic_acl.c
inode.c	fs: Fix S_NOSEC handling	2015-07-10 10:40:22 -07:00
internal.h	get rid of s_files and files_lock	2015-07-03 19:48:08 -07:00
ioctl.c
ioprio.c	block: Fix computation of merged request priority	2014-11-21 09:22:53 -08:00
Kconfig
Kconfig.binfmt
libfs.c	move d_rcu from overlapping d_child to overlapping d_alias	2015-04-29 10:34:00 +02:00
locks.c	locks: allow __break_lease to sleep even when break_time is 0	2014-05-13 13:59:44 +02:00
Makefile
mbcache.c
mount.h	vfs: Is mounted should be testing mnt_ns for NULL or error.	2014-02-06 11:08:16 -08:00
mpage.c
namei.c	vfs: Test for and handle paths that are unreachable from their mnt_root	2015-10-22 14:37:52 -07:00
namespace.c	umount: Disallow unprivileged mount force	2015-01-08 09:58:16 -08:00
no-block.c
open.c	get rid of s_files and files_lock	2015-07-03 19:48:08 -07:00
pipe.c	pipe: iovec: Fix memory corruption when retrying atomic copy as non-atomic	2015-06-29 12:08:34 -07:00
pnode.c
pnode.h
posix_acl.c	posix_acl: handle NULL ACL in posix_acl_equiv_mode	2014-06-07 13:25:33 -07:00
proc_namespace.c
read_write.c	fs/compat: fix parameter handling for compat readv/writev syscalls	2014-02-13 13:48:00 -08:00
readdir.c
select.c
seq_file.c	seq_file: always update file->f_pos in seq_lseek()	2013-11-13 12:05:34 +09:00
signalfd.c	signalfd: fix information leak in signalfd_copyinfo	2015-08-16 20:51:42 -07:00
splice.c	splice: Apply generic position and size checks to each write	2015-04-29 10:33:57 +02:00
stack.c
stat.c	quota: provide interface for readding allocated space into reserved space	2015-01-29 17:40:57 -08:00
statfs.c	vfs: allow O_PATH file descriptors for fstatfs()	2013-10-18 07:45:44 -07:00
super.c	get rid of s_files and files_lock	2015-07-03 19:48:08 -07:00
sync.c
timerfd.c
utimes.c
xattr.c
xattr_acl.c