Pull 9p fixes from Eric Van Hensbergen: "These are some collected fixes for the 6.3-rc series that have been passed our 9p regression tests and been in for-next for at least a week. They include a fix for a KASAN reported problem in the extended attribute handling code and a use after free in the xen transport. This also includes some updates for the MAINTAINERS file including the transition of our development mailing list from sourceforge.net to lists.linux.dev" * tag '9p-6.3-fixes-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs: Update email address and mailing list for v9fs 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition 9P FS: Fix wild-memory-access write in v9fs_get_acl
Unified · Split
| @@ -224,13 +224,13 @@ S: Orphan / Obsolete · 223 unmodified lines | ||
| 224 | 224 | F: drivers/net/ethernet/8390/ |
| 225 | 225 | |
| 226 | 226 | 9P FILE SYSTEM |
| 227 | −M: Eric Van Hensbergen <ericvh@gmail.com> | |
| 227 | +M: Eric Van Hensbergen <ericvh@kernel.org> | |
| 228 | 228 | M: Latchesar Ionkov <lucho@ionkov.net> |
| 229 | 229 | M: Dominique Martinet <asmadeus@codewreck.org> |
| 230 | 230 | R: Christian Schoenebeck <linux_oss@crudebyte.com> |
| 231 | −L: v9fs-developer@lists.sourceforge.net | |
| 231 | +L: v9fs@lists.linux.dev | |
| 232 | 232 | S: Maintained |
| 233 | −W: http://swik.net/v9fs | |
| 233 | +W: http://github.com/v9fs | |
| 234 | 234 | Q: http://patchwork.kernel.org/project/v9fs-devel/list/ |
| 235 | 235 | T: git git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs.git |
| 236 | 236 | T: git git://github.com/martinetd/linux.git |
| @@ -35,10 +35,12 @@ ssize_t v9fs_fid_xattr_get(struct p9_fid *fid, const char *name, · 34 unmodified lines | ||
| 35 | 35 | return retval; |
| 36 | 36 | } |
| 37 | 37 | if (attr_size > buffer_size) { |
| 38 | − if (!buffer_size) /* request to get the attr_size */ | |
| 39 | − retval = attr_size; | |
| 40 | − else | |
| 38 | + if (buffer_size) | |
| 41 | 39 | retval = -ERANGE; |
| 40 | + else if (attr_size > SSIZE_MAX) | |
| 41 | + retval = -EOVERFLOW; | |
| 42 | + else /* request to get the attr_size */ | |
| 43 | + retval = attr_size; | |
| 42 | 44 | } else { |
| 43 | 45 | iov_iter_truncate(&to, attr_size); |
| 44 | 46 | retval = p9_client_read(attr_fid, 0, &to, &err); |
| @@ -280,6 +280,10 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv) · 279 unmodified lines | ||
| 280 | 280 | write_unlock(&xen_9pfs_lock); |
| 281 | 281 | |
| 282 | 282 | for (i = 0; i < priv->num_rings; i++) { |
| 283 | + struct xen_9pfs_dataring *ring = &priv->rings[i]; | |
| 284 | + | |
| 285 | + cancel_work_sync(&ring->work); | |
| 286 | + | |
| 283 | 287 | if (!priv->rings[i].intf) |
| 284 | 288 | break; |
| 285 | 289 | if (priv->rings[i].irq > 0) |