J. Bruce Fields 15b23ef5d3 nfsd4: fix corruption of NFSv4 read data ... The calculation of page_ptr here is wrong in the case the read doesn't start at an offset that is a multiple of a page. The result is that nfs4svc_encode_compoundres sets rq_next_page to a value one too small, and then the loop in svc_free_res_pages may incorrectly fail to clear a page pointer in rq_respages[]. Pages left in rq_respages[] are available for the next rpc request to use, so xdr data may be written to that page, which may hold data still waiting to be transmitted to the client or data in the page cache. The observed result was silent data corruption seen on an NFSv4 client. We tag this as "fixing" 05638dc73a because that commit exposed this bug, though the incorrect calculation predates it. Particular thanks to Andrea Arcangeli and David Gilbert for analysis and testing. Fixes: 05638dc73a "nfsd4: simplify server xdr->next_page use" Cc: stable@vger.kernel.org Reported-by: Andrea Arcangeli <aarcange@redhat.com> Tested-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Signed-off-by: J. Bruce Fields <bfields@redhat.com>		2014-09-30 15:57:04 -04:00
..
9p	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
adfs	adfs: add __printf verification, fix format/argument mismatches	2014-08-08 15:57:24 -07:00
affs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
afs	AFS: Correctly assemble the client UUID	2014-07-29 10:14:36 -07:00
autofs4	autofs4: comment typo: remove a a doubled word	2014-08-08 15:57:19 -07:00
befs	fs/befs/linuxvfs.c: check superblock before dump operation	2014-08-08 15:57:20 -07:00
bfs	fs/bfs: use bfs prefix for dump_imap	2014-08-08 15:57:24 -07:00
btrfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs	2014-09-19 13:10:53 -07:00
cachefiles	fs/cachefiles: add missing \n to kerror conversions	2014-09-26 08:10:35 -07:00
ceph	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client	2014-08-13 17:43:29 -06:00
cifs	Fix mfsymlinks file size check	2014-09-16 06:48:20 -05:00
coda	fs/coda: use linux/uaccess.h	2014-08-08 15:57:20 -07:00
configfs	fs/configfs: use pr_fmt	2014-06-04 16:53:53 -07:00
cramfs	fs/cramfs/inode.c: use linux/uaccess.h	2014-08-08 15:57:25 -07:00
debugfs	fs: debugfs: remove trailing whitespace	2014-07-09 16:58:21 -07:00
devpts	fs/devpts/inode.c: convert printk to pr_foo()	2014-06-06 16:08:14 -07:00
dlm	fs/dlm/debug_fs.c: remove unnecessary null test before debugfs_remove	2014-08-08 15:57:27 -07:00
ecryptfs	write_iter variants of {__,}generic_file_aio_write()	2014-05-06 17:38:00 -04:00
efivarfs	fs/efivarfs/super.c: use static const for dentry_operations	2014-06-04 16:54:14 -07:00
efs	fs/efs/namei.c: return is not a function	2014-08-08 15:57:18 -07:00
exofs	fs/exofs/ore_raid.c: replace count*size kzalloc by kcalloc	2014-08-08 15:57:24 -07:00
exportfs	fs/exportfs/expfs.c: kernel-doc warning fixes	2014-06-04 16:54:14 -07:00
ext2	fs/ext2/super.c: Drop memory allocation cast	2014-07-15 22:40:22 +02:00
ext3	ext3: Count internal journal as bsddf overhead in ext3_statfs	2014-08-19 23:16:51 +02:00
ext4	ext4: avoid trying to kfree an ERR_PTR pointer	2014-09-03 09:37:30 -04:00
f2fs	f2fs: reposition unlock_new_inode to prevent accessing invalid inode	2014-09-02 00:22:24 -07:00
fat	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
freevxfs
fscache	FS-Cache: refcount becomes corrupt under vma pressure.	2014-09-17 22:41:40 +01:00
fuse	fuse: honour max_read and max_write in direct_io mode	2014-09-26 21:16:51 -04:00
gfs2	GFS2: fix d_splice_alias() misuses	2014-09-12 20:58:55 +01:00
hfs	write_iter variants of {__,}generic_file_aio_write()	2014-05-06 17:38:00 -04:00
hfsplus	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
hostfs	hostfs: support rename flags	2014-08-07 14:40:09 -04:00
hpfs	fs/hpfs/dnode.c: fix suspect code indent	2014-08-08 15:57:22 -07:00
hppfs
hugetlbfs	fs/hugetlbfs/inode.c: remove null test before kfree	2014-06-04 16:54:11 -07:00
isofs	isofs: Fix unbounded recursion when processing relocated directories	2014-08-19 18:29:30 +02:00
jbd	fs/jbd/revoke.c: replace shift loop by ilog2	2014-05-21 10:26:13 +02:00
jbd2	jbd2: fix descriptor block size handling errors with journal_csum	2014-08-28 22:22:29 -04:00
jffs2	MTD updates for 3.17-rc1	2014-08-08 18:13:21 -07:00
jfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
kernfs	Merge 3.16-rc6 into driver-core-next	2014-07-21 10:07:25 -07:00
lockd	lockd: fix rpcbind crash on lockd startup failure	2014-09-08 12:03:32 -04:00
logfs	fs/logfs/readwrite.c: kernel-doc warning fixes	2014-08-06 18:01:12 -07:00
minix	minix zmap block counts calculation fix	2014-08-08 15:57:20 -07:00
ncpfs	fs/ncpfs/getopt.c: replace simple_strtoul by kstrtoul	2014-06-04 16:54:21 -07:00
nfs	NFSv4: Fix another bug in the close/open_downgrade code	2014-09-18 13:04:22 -04:00
nfs_common	fs/nfs_common/nfsacl.c: move EXPORT symbol after functions	2014-07-12 18:43:42 -04:00
nfsd	nfsd4: fix corruption of NFSv4 read data	2014-09-30 15:57:04 -04:00
nilfs2	nilfs2: fix data loss with mmap()	2014-09-26 08:10:34 -07:00
nls
notify	fs/notify: don't show f_handle if exportfs_encode_inode_fh failed	2014-09-10 15:42:12 -07:00
ntfs	ntfs: kernel-doc warning fixes	2014-08-06 18:01:12 -07:00
ocfs2	ocfs2/dlm: do not get resource spinlock if lockres is new	2014-09-26 08:10:34 -07:00
omfs	fs/omfs/inode.c: replace count*size kzalloc by kcalloc	2014-08-08 15:57:25 -07:00
openpromfs
proc	mm: softdirty: addresses before VMAs in PTE holes aren't softdirty	2014-09-26 08:10:35 -07:00
pstore	fs/pstore/ram_core.c: replace count*size kmalloc by kmalloc_array	2014-08-08 15:57:25 -07:00
qnx4
qnx6	fs/qnx6: update debugging to current functions	2014-08-08 15:57:26 -07:00
quota	fs/quota: kernel-doc warning fixes	2014-07-15 22:40:23 +02:00
ramfs	fs/ramfs/file-nommu.c: replace count*size kzalloc by kcalloc	2014-08-08 15:57:18 -07:00
reiserfs	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs	2014-08-13 17:45:40 -06:00
romfs	fs/romfs/super.c: add blank line after declarations	2014-08-08 15:57:25 -07:00
squashfs	fs/squashfs/super.c: logging cleanup	2014-08-06 18:01:13 -07:00
sysfs	kernfs: move the last knowledge of sysfs out from kernfs	2014-06-03 08:11:18 -07:00
sysv	write_iter variants of {__,}generic_file_aio_write()	2014-05-06 17:38:00 -04:00
ubifs	UBIFS: Add log overlap assertions	2014-07-31 15:52:51 +03:00
udf	udf: saner calling conventions for udf_new_inode()	2014-09-04 21:37:41 +02:00
ufs	ufs: deal with nfsd/iget races	2014-09-26 21:17:52 -04:00
xfs	xfs: trim eofblocks before collapse range	2014-09-02 12:12:53 +10:00
aio.c	aio: block exit_aio() until all context requests are completed	2014-09-04 16:54:47 -04:00
anon_inodes.c
attr.c	fs,userns: Change inode_capable to capable_wrt_inode_uidgid	2014-06-10 13:57:22 -07:00
bad_inode.c	bad_inode: add ->rename2()	2014-08-07 14:40:09 -04:00
binfmt_aout.c
binfmt_elf_fdpic.c
binfmt_elf.c	Merge branch 'x86/vdso' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next	2014-06-05 08:05:29 -07:00
binfmt_em86.c
binfmt_flat.c	fs/binfmt_flat.c: make old_reloc() static	2014-06-04 16:54:21 -07:00
binfmt_misc.c
binfmt_script.c
binfmt_som.c
block_dev.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
buffer.c	Fix nasty 32-bit overflow bug in buffer i/o code.	2014-09-22 08:41:16 -07:00
char_dev.c
compat_binfmt_elf.c
compat_ioctl.c	Bluetooth: Move HCI socket definitions into its own header file	2014-07-11 13:53:04 +03:00
compat.c	locks: rename file-private locks to "open file description locks"	2014-04-22 08:23:58 -04:00
coredump.c	coredump: fix the setting of PF_DUMPCORE	2014-07-23 15:10:54 -07:00
dcache.c	vfs: Don't exchange "short" filenames unconditionally.	2014-09-27 15:59:39 -04:00
dcookies.c
direct-io.c	fuse: honour max_read and max_write in direct_io mode	2014-09-26 21:16:51 -04:00
drop_caches.c	fs: convert use of typedef ctl_table to struct ctl_table	2014-06-06 16:08:16 -07:00
eventfd.c
eventpoll.c	eventpoll: fix uninitialized variable in epoll_ctl	2014-09-10 15:42:12 -07:00
exec.c	fork/exec: cleanup mm initialization	2014-08-08 15:57:23 -07:00
fcntl.c	shm: add sealing API	2014-08-08 15:57:31 -07:00
fhandle.c
file_table.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
file.c	fs/file.c: don't open-code kvfree()	2014-05-06 17:31:10 -04:00
filesystems.c
fs_pin.c	make fs/{namespace,super}.c forget about acct.h	2014-08-07 14:40:09 -04:00
fs_struct.c
fs-writeback.c	sched: Remove proliferation of wait_on_bit() action functions	2014-07-16 15:10:39 +02:00
inode.c	mm: allow drivers to prevent new writable mappings	2014-08-08 15:57:31 -07:00
internal.h	make fs/{namespace,super}.c forget about acct.h	2014-08-07 14:40:09 -04:00
ioctl.c
Kconfig
Kconfig.binfmt
libfs.c	fs/libfs.c: add generic data flush to fsync	2014-06-04 16:53:55 -07:00
locks.c	locks: pass correct "before" pointer to locks_unlink_lock in generic_add_lease	2014-08-22 09:58:22 -04:00
Makefile	take fs_pin stuff to fs/*	2014-08-07 14:40:08 -04:00
mbcache.c	fs/mbcache: replace __builtin_log2() with ilog2()	2014-06-25 22:08:29 -04:00
mount.h	death to mnt_pinned	2014-08-07 14:40:09 -04:00
mpage.c	fs/block_dev.c: add bdev_read_page() and bdev_write_page()	2014-06-04 16:54:02 -07:00
namei.c	vfs: workaround gcc <4.6 build error in link_path_walk()	2014-09-16 07:44:54 -07:00
namespace.c	fix EBUSY on umount() from MNT_SHRINKABLE	2014-08-30 18:32:05 -04:00
no-block.c
open.c	vfs: fix check for fallocate on active swapfile	2014-08-01 02:36:04 -04:00
pipe.c	new helper: copy_page_from_iter()	2014-05-06 17:39:42 -04:00
pnode.c	get rid of propagate_umount() mistakenly treating slaves as busy.	2014-08-30 18:31:41 -04:00
pnode.h
posix_acl.c	posix_acl: handle NULL ACL in posix_acl_equiv_mode	2014-05-06 13:58:42 -04:00
proc_namespace.c	namespaces: Use task_lock and not rcu to protect nsproxy	2014-07-29 18:08:50 -07:00
read_write.c	switch simple generic_file_aio_read() users to ->read_iter()	2014-05-06 17:37:55 -04:00
readdir.c	fanotify: create FAN_ACCESS event for readdir	2014-06-04 16:53:52 -07:00
select.c
seq_file.c	fs/seq_file: fallback to vmalloc allocation	2014-07-03 09:21:54 -07:00
signalfd.c
splice.c	Merge commit '9f12600fe425bc28f0ccba034a77783c09c15af4' into for-linus	2014-06-12 00:28:09 -04:00
stack.c
stat.c
statfs.c
super.c	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs	2014-08-13 17:45:40 -06:00
sync.c	Export sync_filesystem() for modular ->remount_fs() use	2014-09-05 08:16:21 -07:00
timerfd.c	timerfd: Use ktime_mono_to_real()	2014-07-23 10:18:02 -07:00
utimes.c
xattr.c	simple_xattr: permit 0-size extended attributes	2014-07-23 15:10:55 -07:00