Patch "xfs: in _attrlist_by_handle, copy the cursor back to userspace" has been added to the 4.4-stable tree

Patch "xfs: in _attrlist_by_handle, copy the cursor back to userspace" has been added to the 4.4-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    xfs: in _attrlist_by_handle, copy the cursor back to userspace

to the 4.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     xfs-in-_attrlist_by_handle-copy-the-cursor-back-to-userspace.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 0facef7fb053be4353c0a48c2f48c9dbee91cb19 Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <darrick.wong@oracle.com>
Date: Wed, 3 Aug 2016 10:58:53 +1000
Subject: xfs: in _attrlist_by_handle, copy the cursor back to userspace

From: Darrick J. Wong <darrick.wong@oracle.com>

commit 0facef7fb053be4353c0a48c2f48c9dbee91cb19 upstream.

When we're iterating inode xattrs by handle, we have to copy the
cursor back to userspace so that a subsequent invocation actually
retrieves subsequent contents.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Cc: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/xfs/xfs_ioctl.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -403,6 +403,7 @@ xfs_attrlist_by_handle(
 {
 	int			error = -ENOMEM;
 	attrlist_cursor_kern_t	*cursor;
+	struct xfs_fsop_attrlist_handlereq __user	*p = arg;
 	xfs_fsop_attrlist_handlereq_t al_hreq;
 	struct dentry		*dentry;
 	char			*kbuf;
@@ -435,6 +436,11 @@ xfs_attrlist_by_handle(
 	if (error)
 		goto out_kfree;
 
+	if (copy_to_user(&p->pos, cursor, sizeof(attrlist_cursor_kern_t))) {
+		error = -EFAULT;
+		goto out_kfree;
+	}
+
 	if (copy_to_user(al_hreq.buffer, kbuf, al_hreq.buflen))
 		error = -EFAULT;
 


Patches currently in stable-queue which might be from darrick.wong@oracle.com are

queue-4.4/xfs-fix-missed-holes-in-seek_hole-implementation.patch
queue-4.4/xfs-fix-indlen-accounting-error-on-partial-delalloc-conversion.patch
queue-4.4/xfs-fix-over-copying-of-getbmap-parameters-from-userspace.patch
queue-4.4/xfs-bad-assertion-for-delalloc-an-extent-that-start-at-i_size.patch
queue-4.4/xfs-fix-off-by-one-on-max-nr_pages-in-xfs_find_get_desired_pgoff.patch
queue-4.4/xfs-update-ag-iterator-to-support-wait-on-new-inodes.patch
queue-4.4/xfs-fix-up-quotacheck-buffer-list-error-handling.patch
queue-4.4/xfs-wait-on-new-inodes-during-quotaoff-dquot-release.patch
queue-4.4/xfs-in-_attrlist_by_handle-copy-the-cursor-back-to-userspace.patch
queue-4.4/xfs-support-ability-to-wait-on-new-inodes.patch
queue-4.4/xfs-prevent-multi-fsb-dir-readahead-from-reading-random-blocks.patch
queue-4.4/xfs-fix-unaligned-access-in-xfs_btree_visit_blocks.patch
queue-4.4/xfs-handle-array-index-overrun-in-xfs_dir2_leaf_readbuf.patch