stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Al Viro <viro@zeniv.linux.org.uk>
Subject: [PATCH 3.18 40/45] ext2: fix a block leak
Date: Thu, 24 May 2018 11:38:48 +0200	[thread overview]
Message-ID: <20180524093126.021804958@linuxfoundation.org> (raw)
In-Reply-To: <20180524093120.599252450@linuxfoundation.org>

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Al Viro <viro@zeniv.linux.org.uk>

commit 5aa1437d2d9a068c0334bd7c9dafa8ec4f97f13b upstream.

open file, unlink it, then use ioctl(2) to make it immutable or
append only.  Now close it and watch the blocks *not* freed...

Immutable/append-only checks belong in ->setattr().
Note: the bug is old and backport to anything prior to 737f2e93b972
("ext2: convert to use the new truncate convention") will need
these checks lifted into ext2_setattr().

Cc: stable@kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext2/inode.c |   10 ----------
 1 file changed, 10 deletions(-)

--- a/fs/ext2/inode.c
+++ b/fs/ext2/inode.c
@@ -1169,21 +1169,11 @@ do_indirects:
 
 static void ext2_truncate_blocks(struct inode *inode, loff_t offset)
 {
-	/*
-	 * XXX: it seems like a bug here that we don't allow
-	 * IS_APPEND inode to have blocks-past-i_size trimmed off.
-	 * review and fix this.
-	 *
-	 * Also would be nice to be able to handle IO errors and such,
-	 * but that's probably too much to ask.
-	 */
 	if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
 	    S_ISLNK(inode->i_mode)))
 		return;
 	if (ext2_inode_is_fast_symlink(inode))
 		return;
-	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
-		return;
 	__ext2_truncate_blocks(inode, offset);
 }
 

  parent reply	other threads:[~2018-05-24  9:38 UTC|newest]

Thread overview: 50+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-05-24  9:38 [PATCH 3.18 00/45] 3.18.110-stable review Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 01/45] 8139too: Use disable_irq_nosync() in rtl8139_poll_controller() Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 02/45] bridge: check iface upper dev when setting master via ioctl Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 03/45] dccp: fix tasklet usage Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 04/45] ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 05/45] llc: better deal with too small mtu Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 06/45] net: ethernet: sun: niu set correct packet size in skb Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 07/45] net/mlx4_en: Verify coalescing parameters are in range Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 08/45] net_sched: fq: take care of throttled flows before reuse Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 09/45] net: support compat 64-bit time in {s,g}etsockopt Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 10/45] r8169: fix powering up RTL8168h Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 11/45] sctp: use the old asoc when making the cookie-ack chunk in dupcook_d Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 12/45] tg3: Fix vunmap() BUG_ON() triggered from tg3_free_consistent() Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 13/45] bonding: do not allow rlb updates to invalid mac Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 14/45] tcp: ignore Fast Open on repair mode Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 15/45] sctp: fix the issue that the cookie-ack with auth cant get processed Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 16/45] sctp: delay the authentication for the duplicated cookie-echo chunk Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 18/45] lockd: lost rollback of set_grace_period() in lockd_down_net() Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 19/45] Revert "ARM: dts: imx6qdl-wandboard: Fix audio channel swap" Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 20/45] l2tp: revert "l2tp: fix missing print session offset info" Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 21/45] pipe: cap initial pipe capacity according to pipe-max-size limit Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 22/45] kernel/exit.c: avoid undefined behaviour when calling wait4() Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 23/45] usbip: usbip_host: refine probe and disconnect debug msgs to be useful Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 24/45] usbip: usbip_host: delete device from busid_table after rebind Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 25/45] usbip: usbip_host: run rebind from exit when module is removed Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 26/45] usbip: fix error handling in stub_probe() Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 27/45] usbip: usbip_host: fix NULL-ptr deref and use-after-free errors Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 28/45] usbip: usbip_host: fix bad unlock balance during stub_probe() Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 29/45] ALSA: usb: mixer: volume quirk for CM102-A+/102S+ Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 30/45] ALSA: control: fix a redundant-copy issue Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 31/45] powerpc: Dont preempt_disable() in show_cpuinfo() Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 32/45] tracing/x86/xen: Remove zero data size trace events trace_xen_mmu_flush_tlb{_all} Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 33/45] powerpc/powernv: Fix NVRAM sleep in invalid context when crashing Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 34/45] efi: Avoid potential crashes, fix the struct efi_pci_io_protocol_32 definition for mixed mode Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 35/45] ARM: 8771/1: kprobes: Prohibit kprobes on do_undefinstr Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 36/45] tick/broadcast: Use for_each_cpu() specially on UP kernels Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 37/45] ARM: 8772/1: kprobes: Prohibit kprobes on get_user functions Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 38/45] net: test tailroom before appending to linear skb Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 39/45] tcp: purge write queue in tcp_connect_init() Greg Kroah-Hartman
2018-05-24  9:38 ` Greg Kroah-Hartman [this message]
2018-05-24  9:38 ` [PATCH 3.18 41/45] scsi: libsas: defer ata device eh commands to libata Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 42/45] scsi: sg: allocate with __GFP_ZERO in sg_build_indirect() Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 43/45] cfg80211: limit wiphy names to 128 bytes Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 44/45] hfsplus: stop workqueue when fill_super() failed Greg Kroah-Hartman
2018-05-24  9:38 ` [PATCH 3.18 45/45] x86/kexec: Avoid double free_page() upon do_kexec_load() failure Greg Kroah-Hartman
2018-05-24 14:42 ` [PATCH 3.18 00/45] 3.18.110-stable review Nathan Chancellor
2018-05-24 14:44 ` Harsh Shandilya
2018-05-24 19:46   ` Greg Kroah-Hartman
2018-05-24 17:30 ` Guenter Roeck
2018-05-24 19:31 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180524093126.021804958@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).