diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2023-04-10 23:25:08 +0300 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2023-04-10 23:25:08 +0300 |
| commit | c118b59e71d2a910ee300f8be40fa864a91bb6ca (patch) | |
| tree | c6200c5449e1802a2c7ef66373d6185468051139 | |
| parent | 411eb014108594d160a20381e8738de6c62e2e5b (diff) | |
| parent | 347dca97f75d461ac2ac256b68e495dfc6f14d61 (diff) | |
| download | linux-c118b59e71d2a910ee300f8be40fa864a91bb6ca.tar.xz | |
Merge tag '9p-6.3-fixes-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs
Pull 9p fixes from Eric Van Hensbergen:
"These are some collected fixes for the 6.3-rc series that have been
passed our 9p regression tests and been in for-next for at least a
week.
They include a fix for a KASAN reported problem in the extended
attribute handling code and a use after free in the xen transport.
This also includes some updates for the MAINTAINERS file including the
transition of our development mailing list from sourceforge.net to
lists.linux.dev"
* tag '9p-6.3-fixes-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
Update email address and mailing list for v9fs
9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
9P FS: Fix wild-memory-access write in v9fs_get_acl
| -rw-r--r-- | MAINTAINERS | 6 | ||||
| -rw-r--r-- | fs/9p/xattr.c | 8 | ||||
| -rw-r--r-- | net/9p/trans_xen.c | 4 |
3 files changed, 12 insertions, 6 deletions
diff --git a/MAINTAINERS b/MAINTAINERS index 90abe83c02f3..4485969f58f1 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -224,13 +224,13 @@ S: Orphan / Obsolete F: drivers/net/ethernet/8390/ 9P FILE SYSTEM -M: Eric Van Hensbergen <ericvh@gmail.com> +M: Eric Van Hensbergen <ericvh@kernel.org> M: Latchesar Ionkov <lucho@ionkov.net> M: Dominique Martinet <asmadeus@codewreck.org> R: Christian Schoenebeck <linux_oss@crudebyte.com> -L: v9fs-developer@lists.sourceforge.net +L: v9fs@lists.linux.dev S: Maintained -W: http://swik.net/v9fs +W: http://github.com/v9fs Q: http://patchwork.kernel.org/project/v9fs-devel/list/ T: git git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs.git T: git git://github.com/martinetd/linux.git diff --git a/fs/9p/xattr.c b/fs/9p/xattr.c index 50f7f3f6b55e..1974a38bce20 100644 --- a/fs/9p/xattr.c +++ b/fs/9p/xattr.c @@ -35,10 +35,12 @@ ssize_t v9fs_fid_xattr_get(struct p9_fid *fid, const char *name, return retval; } if (attr_size > buffer_size) { - if (!buffer_size) /* request to get the attr_size */ - retval = attr_size; - else + if (buffer_size) retval = -ERANGE; + else if (attr_size > SSIZE_MAX) + retval = -EOVERFLOW; + else /* request to get the attr_size */ + retval = attr_size; } else { iov_iter_truncate(&to, attr_size); retval = p9_client_read(attr_fid, 0, &to, &err); diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c index c64050e839ac..1fffe2bed5b0 100644 --- a/net/9p/trans_xen.c +++ b/net/9p/trans_xen.c @@ -280,6 +280,10 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv) write_unlock(&xen_9pfs_lock); for (i = 0; i < priv->num_rings; i++) { + struct xen_9pfs_dataring *ring = &priv->rings[i]; + + cancel_work_sync(&ring->work); + if (!priv->rings[i].intf) break; if (priv->rings[i].irq > 0) |