From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Dave Jones <davej@redhat.com>,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: [ 17/21] vfs: fix pipe counter breakage
Date: Tue, 12 Mar 2013 15:44:19 -0700 [thread overview]
Message-ID: <20130312223247.097458622@linuxfoundation.org> (raw)
In-Reply-To: <20130312223245.109098379@linuxfoundation.org>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@ZenIV.linux.org.uk>
commit a930d8790552658140d7d0d2e316af4f0d76a512 upstream.
If you open a pipe for neither read nor write, the pipe code will not
add any usage counters to the pipe, causing the 'struct pipe_inode_info"
to be potentially released early.
That doesn't normally matter, since you cannot actually use the pipe,
but the pipe release code - particularly fasync handling - still expects
the actual pipe infrastructure to all be there. And rather than adding
NULL pointer checks, let's just disallow this case, the same way we
already do for the named pipe ("fifo") case.
This is ancient going back to pre-2.4 days, and until trinity, nobody
naver noticed.
Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/pipe.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -859,6 +859,9 @@ pipe_rdwr_open(struct inode *inode, stru
{
int ret = -ENOENT;
+ if (!(filp->f_mode & (FMODE_READ|FMODE_WRITE)))
+ return -EINVAL;
+
mutex_lock(&inode->i_mutex);
if (inode->i_pipe) {
next prev parent reply other threads:[~2013-03-12 22:44 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-03-12 22:44 [ 00/21] 3.0.69-stable review Greg Kroah-Hartman
2013-03-12 22:44 ` [ 01/21] ARM: VFP: fix emulation of second VFP instruction Greg Kroah-Hartman
2013-03-12 22:44 ` [ 02/21] ARM: fix scheduling while atomic warning in alignment handling code Greg Kroah-Hartman
2013-03-12 22:44 ` [ 03/21] SCSI: dc395x: uninitialized variable in device_alloc() Greg Kroah-Hartman
2013-03-12 22:44 ` [ 04/21] target/pscsi: Fix page increment Greg Kroah-Hartman
2013-03-16 2:10 ` Ben Hutchings
2013-03-18 5:35 ` Asias He
2013-03-18 21:00 ` Nicholas A. Bellinger
2013-03-18 23:30 ` Ben Hutchings
2013-03-19 0:56 ` Asias He
2013-03-19 1:18 ` Ben Hutchings
2013-03-19 3:18 ` Nicholas A. Bellinger
2013-03-12 22:44 ` [ 05/21] btrfs: Init io_lock after cloning btrfs device struct Greg Kroah-Hartman
2013-03-12 22:44 ` [ 06/21] cifs: ensure that cifs_get_root() only traverses directories Greg Kroah-Hartman
2013-03-12 22:44 ` [ 07/21] SUNRPC: Dont start the retransmission timer when out of socket space Greg Kroah-Hartman
2013-03-12 22:44 ` [ 08/21] hw_random: make buffer usable in scatterlist Greg Kroah-Hartman
2013-03-12 22:44 ` [ 09/21] ath9k: fix RSSI dummy marker value Greg Kroah-Hartman
2013-03-12 22:44 ` [ 10/21] md: raid0: fix error return from create_stripe_zones Greg Kroah-Hartman
2013-03-12 22:44 ` [ 11/21] hwmon: (sht15) Check return value of regulator_enable() Greg Kroah-Hartman
2013-03-16 4:15 ` Ben Hutchings
2013-03-16 13:33 ` Guenter Roeck
2013-03-12 22:44 ` [ 12/21] drm/radeon: add primary dac adj quirk for R200 board Greg Kroah-Hartman
2013-03-12 22:44 ` [ 13/21] ALSA: ice1712: Initialize card->private_data properly Greg Kroah-Hartman
2013-03-12 22:44 ` [ 14/21] ALSA: vmaster: Fix slave change notification Greg Kroah-Hartman
2013-03-12 22:44 ` [ 15/21] e1000e: fix pci-device enable-counter balance Greg Kroah-Hartman
2013-03-12 22:44 ` [ 16/21] keys: fix race with concurrent install_user_keyrings() Greg Kroah-Hartman
2013-03-12 22:44 ` Greg Kroah-Hartman [this message]
2013-03-12 22:44 ` [ 18/21] Fix memory leak in cpufreq stats Greg Kroah-Hartman
2013-03-12 22:44 ` [ 19/21] ftrace: Update the kconfig for DYNAMIC_FTRACE Greg Kroah-Hartman
2013-03-12 22:44 ` [ 20/21] decnet: Fix disappearing sysctl entries Greg Kroah-Hartman
[not found] ` <B401117D-23F6-4911-8D72-344EE1A022F6@usgs.gov>
2013-03-12 23:04 ` Eric W. Biederman
[not found] ` <3EDA829E-3898-4626-9C17-CCE31E8C0554@usgs.gov>
2013-03-13 20:05 ` Eric W. Biederman
2013-03-12 23:06 ` Greg Kroah-Hartman
2013-03-12 22:44 ` [ 21/21] dmi_scan: fix missing check for _DMI_ signature in smbios_present() Greg Kroah-Hartman
2013-03-13 3:56 ` [ 00/21] 3.0.69-stable review Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130312223247.097458622@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davej@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).