4.4-stable patches

added patches:
	coda-fix-kernel-memory-exposure-attempt-in-fsync.patch

diff --git a/queue-4.4/coda-fix-kernel-memory-exposure-attempt-in-fsync.patch b/queue-4.4/coda-fix-kernel-memory-exposure-attempt-in-fsync.patch
new file mode 100644 (file)
index 0000000..adf3024
--- /dev/null
+++ b/queue-4.4/coda-fix-kernel-memory-exposure-attempt-in-fsync.patch
@@ -0,0 +1,41 @@
+From d337b66a4c52c7b04eec661d86c2ef6e168965a2 Mon Sep 17 00:00:00 2001
+From: Jan Harkes <jaharkes@cs.cmu.edu>
+Date: Wed, 27 Sep 2017 15:52:12 -0400
+Subject: coda: fix 'kernel memory exposure attempt' in fsync
+
+From: Jan Harkes <jaharkes@cs.cmu.edu>
+
+commit d337b66a4c52c7b04eec661d86c2ef6e168965a2 upstream.
+
+When an application called fsync on a file in Coda a small request with
+just the file identifier was allocated, but the declared length was set
+to the size of union of all possible upcall requests.
+
+This bug has been around for a very long time and is now caught by the
+extra checking in usercopy that was introduced in Linux-4.8.
+
+The exposure happens when the Coda cache manager process reads the fsync
+upcall request at which point it is killed. As a result there is nobody
+servicing any further upcalls, trapping any processes that try to access
+the mounted Coda filesystem.
+
+Signed-off-by: Jan Harkes <jaharkes@cs.cmu.edu>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/coda/upcall.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/fs/coda/upcall.c
++++ b/fs/coda/upcall.c
+@@ -446,8 +446,7 @@ int venus_fsync(struct super_block *sb,
+       UPARG(CODA_FSYNC);
+ 
+       inp->coda_fsync.VFid = *fid;
+-      error = coda_upcall(coda_vcp(sb), sizeof(union inputArgs),
+-                          &outsize, inp);
++      error = coda_upcall(coda_vcp(sb), insize, &outsize, inp);
+ 
+       CODA_FREE(inp, insize);
+       return error;

diff --git a/queue-4.4/series b/queue-4.4/series
index cabe8e05da6e92f20f08cb36a59e61c2726d7a0c..ba9a72c0beedaad696ac64116bab3f3d53e466ce 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -13,3 +13,4 @@ nvme-fix-memory-order-on-async-queue-deletion.patch
 ocfs2-should-wait-dio-before-inode-lock-in-ocfs2_setattr.patch
 ipmi-fix-unsigned-long-underflow.patch
 mm-page_alloc.c-broken-deferred-calculation.patch
+coda-fix-kernel-memory-exposure-attempt-in-fsync.patch