diff for duplicates of <20111220220901.GA1770@thunk.org> diff --git a/a/1.txt b/N1/1.txt index c43090f..42eadda 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -42,57 +42,3 @@ to play tricks on us), the conditional shouldn't be necessary. P.S. Maybe it would be a good idea to add a mention of the fact that file_remove_suid() needs i_mutex, either in mm/filemap.c as a comment, or in Documentation/filesystems/vfs.txt, or both? - - ->From 5e8af306ef8025a4c98bcc51b6b2ed63e1df31c4 Mon Sep 17 00:00:00 2001 -From: Theodore Ts'o <tytso@mit.edu> -Date: Tue, 20 Dec 2011 17:06:08 -0500 -Subject: [PATCH] ext4: fix potential deadlock with setuid files and EXT4_IOC_MOVE_EXT - -file_remove_suid() must be called with i_mutex down, since it calls -notify_change(). In addition, we really want to remove the suid file -*before* we modify the donor file, to avoid someone from trying to -exploit a race. - -Signed-off-by: "Theodore Ts'o" <tytso@mit.edu> -Cc: stable@vger.kernel.org ---- - fs/ext4/ioctl.c | 2 -- - fs/ext4/move_extent.c | 2 ++ - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c -index a567968..ff1aab7 100644 ---- a/fs/ext4/ioctl.c -+++ b/fs/ext4/ioctl.c -@@ -247,8 +247,6 @@ setversion_out: - err = ext4_move_extents(filp, donor_filp, me.orig_start, - me.donor_start, me.len, &me.moved_len); - mnt_drop_write(filp->f_path.mnt); -- if (me.moved_len > 0) -- file_remove_suid(donor_filp); - - if (copy_to_user((struct move_extent __user *)arg, - &me, sizeof(me))) -diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c -index c5826c6..7403e1b 100644 ---- a/fs/ext4/move_extent.c -+++ b/fs/ext4/move_extent.c -@@ -1222,6 +1222,8 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, - if (ret1) - goto out; - -+ file_remove_suid(d_filp); -+ - file_end = (i_size_read(orig_inode) - 1) >> orig_inode->i_blkbits; - block_end = block_start + len - 1; - if (file_end < block_end) --- -1.7.8.11.gefc1f.dirty - --- -To unsubscribe, send a message with 'unsubscribe linux-mm' in -the body to majordomo@kvack.org. For more info on Linux MM, -see: http://www.linux-mm.org/ . -Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/ -Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> diff --git a/a/content_digest b/N1/content_digest index c7d3738..dfd64ec 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -64,60 +64,6 @@ "\n" "P.S. Maybe it would be a good idea to add a mention of the fact that\n" "file_remove_suid() needs i_mutex, either in mm/filemap.c as a comment,\n" - "or in Documentation/filesystems/vfs.txt, or both?\n" - "\n" - "\n" - ">From 5e8af306ef8025a4c98bcc51b6b2ed63e1df31c4 Mon Sep 17 00:00:00 2001\n" - "From: Theodore Ts'o <tytso@mit.edu>\n" - "Date: Tue, 20 Dec 2011 17:06:08 -0500\n" - "Subject: [PATCH] ext4: fix potential deadlock with setuid files and EXT4_IOC_MOVE_EXT\n" - "\n" - "file_remove_suid() must be called with i_mutex down, since it calls\n" - "notify_change(). In addition, we really want to remove the suid file\n" - "*before* we modify the donor file, to avoid someone from trying to\n" - "exploit a race.\n" - "\n" - "Signed-off-by: \"Theodore Ts'o\" <tytso@mit.edu>\n" - "Cc: stable@vger.kernel.org\n" - "---\n" - " fs/ext4/ioctl.c | 2 --\n" - " fs/ext4/move_extent.c | 2 ++\n" - " 2 files changed, 2 insertions(+), 2 deletions(-)\n" - "\n" - "diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c\n" - "index a567968..ff1aab7 100644\n" - "--- a/fs/ext4/ioctl.c\n" - "+++ b/fs/ext4/ioctl.c\n" - "@@ -247,8 +247,6 @@ setversion_out:\n" - " \t\terr = ext4_move_extents(filp, donor_filp, me.orig_start,\n" - " \t\t\t\t\tme.donor_start, me.len, &me.moved_len);\n" - " \t\tmnt_drop_write(filp->f_path.mnt);\n" - "-\t\tif (me.moved_len > 0)\n" - "-\t\t\tfile_remove_suid(donor_filp);\n" - " \n" - " \t\tif (copy_to_user((struct move_extent __user *)arg,\n" - " \t\t\t\t &me, sizeof(me)))\n" - "diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c\n" - "index c5826c6..7403e1b 100644\n" - "--- a/fs/ext4/move_extent.c\n" - "+++ b/fs/ext4/move_extent.c\n" - "@@ -1222,6 +1222,8 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp,\n" - " \tif (ret1)\n" - " \t\tgoto out;\n" - " \n" - "+\tfile_remove_suid(d_filp);\n" - "+\n" - " \tfile_end = (i_size_read(orig_inode) - 1) >> orig_inode->i_blkbits;\n" - " \tblock_end = block_start + len - 1;\n" - " \tif (file_end < block_end)\n" - "-- \n" - "1.7.8.11.gefc1f.dirty\n" - "\n" - "--\n" - "To unsubscribe, send a message with 'unsubscribe linux-mm' in\n" - "the body to majordomo@kvack.org. For more info on Linux MM,\n" - "see: http://www.linux-mm.org/ .\n" - "Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/\n" - "Don't email: <a href=mailto:\"dont@kvack.org\"> email@kvack.org </a>" + or in Documentation/filesystems/vfs.txt, or both? -7fbdbde4c71d34382f33201829d425ca6314dd6b8144f06d9b14e471f764ef2b +f0e20a032f2a8f6a7b87f56617a784d3ecc8785335ea764b03d8f702e6441926
diff --git a/a/1.txt b/N2/1.txt index c43090f..4cbf33e 100644 --- a/a/1.txt +++ b/N2/1.txt @@ -89,10 +89,3 @@ index c5826c6..7403e1b 100644 if (file_end < block_end) -- 1.7.8.11.gefc1f.dirty - --- -To unsubscribe, send a message with 'unsubscribe linux-mm' in -the body to majordomo@kvack.org. For more info on Linux MM, -see: http://www.linux-mm.org/ . -Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/ -Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> diff --git a/a/content_digest b/N2/content_digest index c7d3738..fd2b3b3 100644 --- a/a/content_digest +++ b/N2/content_digest @@ -111,13 +111,6 @@ " \tblock_end = block_start + len - 1;\n" " \tif (file_end < block_end)\n" "-- \n" - "1.7.8.11.gefc1f.dirty\n" - "\n" - "--\n" - "To unsubscribe, send a message with 'unsubscribe linux-mm' in\n" - "the body to majordomo@kvack.org. For more info on Linux MM,\n" - "see: http://www.linux-mm.org/ .\n" - "Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/\n" - "Don't email: <a href=mailto:\"dont@kvack.org\"> email@kvack.org </a>" + 1.7.8.11.gefc1f.dirty -7fbdbde4c71d34382f33201829d425ca6314dd6b8144f06d9b14e471f764ef2b +7cf37b97685f13276a45d08b95f70fee86b47e5f38a549f799d0baca87e3f500
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.