{"push_id":2733236390,"size":738,"distinct_size":362,"ref":"refs/heads/master","head":"5038e620411451af634c76c293a37d89073008df","before":"d2b858f2b17598745bf82f0165bc0aab0aba2175","commits":[{"sha":"327eaf738ff97d19491362e30497954105d60414","author":{"name":"Theodore Ts'o","email":"4ed386e0495d3e109932df055831d9ec2f824927@mit.edu"},"message":"ext4: add warn_on_error mount option\n\nThis is very handy when debugging bugs handling maliciously corrupted\nfile systems.\n\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>","distinct":false,"url":"https://api.github.com/repos/checle/linux/commits/327eaf738ff97d19491362e30497954105d60414"},{"sha":"5369a762c882c0b6e9599e4ebbb3a9ba9eee7e2d","author":{"name":"Theodore Ts'o","email":"4ed386e0495d3e109932df055831d9ec2f824927@mit.edu"},"message":"ext4: add corruption check in ext4_xattr_set_entry()\n\nIn theory this should have been caught earlier when the xattr list was\nverified, but in case it got missed, it's simple enough to add check\nto make sure we don't overrun the xattr buffer.\n\nThis addresses CVE-2018-10879.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=200001\n\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nReviewed-by: Andreas Dilger <adilger@dilger.ca>\nCc: stable@kernel.org","distinct":false,"url":"https://api.github.com/repos/checle/linux/commits/5369a762c882c0b6e9599e4ebbb3a9ba9eee7e2d"},{"sha":"513f86d73855ce556ea9522b6bfd79f87356dc3a","author":{"name":"Theodore Ts'o","email":"4ed386e0495d3e109932df055831d9ec2f824927@mit.edu"},"message":"ext4: always verify the magic number in xattr blocks\n\nIf there an inode points to a block which is also some other type of\nmetadata block (such as a block allocation bitmap), the\nbuffer_verified flag can be set when it was validated as that other\nmetadata block type; however, it would make a really terrible external\nattribute block.  The reason why we use the verified flag is to avoid\nconstantly reverifying the block.  However, it doesn't take much\noverhead to make sure the magic number of the xattr block is correct,\nand this will avoid potential crashes.\n\nThis addresses CVE-2018-10879.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=200001\n\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nReviewed-by: Andreas Dilger <adilger@dilger.ca>\nCc: stable@kernel.org","distinct":false,"url":"https://api.github.com/repos/checle/linux/commits/513f86d73855ce556ea9522b6bfd79f87356dc3a"},{"sha":"819b23f1c501b17b9694325471789e6b5cc2d0d2","author":{"name":"Theodore Ts'o","email":"4ed386e0495d3e109932df055831d9ec2f824927@mit.edu"},"message":"ext4: always check block group bounds in ext4_init_block_bitmap()\n\nRegardless of whether the flex_bg feature is set, we should always\ncheck to make sure the bits we are setting in the block bitmap are\nwithin the block group bounds.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=199865\n\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nCc: stable@kernel.org","distinct":false,"url":"https://api.github.com/repos/checle/linux/commits/819b23f1c501b17b9694325471789e6b5cc2d0d2"},{"sha":"77260807d1170a8cf35dbb06e07461a655f67eee","author":{"name":"Theodore Ts'o","email":"4ed386e0495d3e109932df055831d9ec2f824927@mit.edu"},"message":"ext4: make sure bitmaps and the inode table don't overlap with bg descriptors\n\nIt's really bad when the allocation bitmaps and the inode table\noverlap with the block group descriptors, since it causes random\ncorruption of the bg descriptors.  So we really want to head those off\nat the pass.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=199865\n\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nCc: stable@kernel.org","distinct":false,"url":"https://api.github.com/repos/checle/linux/commits/77260807d1170a8cf35dbb06e07461a655f67eee"},{"sha":"8844618d8aa7a9973e7b527d038a2a589665002c","author":{"name":"Theodore Ts'o","email":"4ed386e0495d3e109932df055831d9ec2f824927@mit.edu"},"message":"ext4: only look at the bg_flags field if it is valid\n\nThe bg_flags field in the block group descripts is only valid if the\nuninit_bg or metadata_csum feature is enabled.  We were not\nconsistently looking at this field; fix this.\n\nAlso block group #0 must never have uninitialized allocation bitmaps,\nor need to be zeroed, since that's where the root inode, and other\nspecial inodes are set up.  Check for these conditions and mark the\nfile system as corrupted if they are detected.\n\nThis addresses CVE-2018-10876.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=199403\n\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nCc: stable@kernel.org","distinct":false,"url":"https://api.github.com/repos/checle/linux/commits/8844618d8aa7a9973e7b527d038a2a589665002c"},{"sha":"bc890a60247171294acc0bd67d211fa4b88d40ba","author":{"name":"Theodore Ts'o","email":"4ed386e0495d3e109932df055831d9ec2f824927@mit.edu"},"message":"ext4: verify the depth of extent tree in ext4_find_extent()\n\nIf there is a corupted file system where the claimed depth of the\nextent tree is -1, this can cause a massive buffer overrun leading to\nsadness.\n\nThis addresses CVE-2018-10877.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=199417\n\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nCc: stable@kernel.org","distinct":false,"url":"https://api.github.com/repos/checle/linux/commits/bc890a60247171294acc0bd67d211fa4b88d40ba"},{"sha":"bdbd6ce01a70f02e9373a584d0ae9538dcf0a121","author":{"name":"Theodore Ts'o","email":"4ed386e0495d3e109932df055831d9ec2f824927@mit.edu"},"message":"ext4: include the illegal physical block in the bad map ext4_error msg\n\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nCc: stable@kernel.org","distinct":false,"url":"https://api.github.com/repos/checle/linux/commits/bdbd6ce01a70f02e9373a584d0ae9538dcf0a121"},{"sha":"6e8ab72a812396996035a37e5ca4b3b99b5d214b","author":{"name":"Theodore Ts'o","email":"4ed386e0495d3e109932df055831d9ec2f824927@mit.edu"},"message":"ext4: clear i_data in ext4_inode_info when removing inline data\n\nWhen converting from an inode from storing the data in-line to a data\nblock, ext4_destroy_inline_data_nolock() was only clearing the on-disk\ncopy of the i_blocks[] array.  It was not clearing copy of the\ni_blocks[] in ext4_inode_info, in i_data[], which is the copy actually\nused by ext4_map_blocks().\n\nThis didn't matter much if we are using extents, since the extents\nheader would be invalid and thus the extents could would re-initialize\nthe extents tree.  But if we are using indirect blocks, the previous\ncontents of the i_blocks array will be treated as block numbers, with\npotentially catastrophic results to the file system integrity and/or\nuser data.\n\nThis gets worse if the file system is using a 1k block size and\ns_first_data is zero, but even without this, the file system can get\nquite badly corrupted.\n\nThis addresses CVE-2018-10881.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=200015\n\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nCc: stable@kernel.org","distinct":false,"url":"https://api.github.com/repos/checle/linux/commits/6e8ab72a812396996035a37e5ca4b3b99b5d214b"},{"sha":"8cdb5240ec5928b20490a2bb34cb87e9a5f40226","author":{"name":"Theodore Ts'o","email":"4ed386e0495d3e109932df055831d9ec2f824927@mit.edu"},"message":"ext4: never move the system.data xattr out of the inode body\n\nWhen expanding the extra isize space, we must never move the\nsystem.data xattr out of the inode body.  For performance reasons, it\ndoesn't make any sense, and the inline data implementation assumes\nthat system.data xattr is never in the external xattr block.\n\nThis addresses CVE-2018-10880\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=200005\n\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nCc: stable@kernel.org","distinct":false,"url":"https://api.github.com/repos/checle/linux/commits/8cdb5240ec5928b20490a2bb34cb87e9a5f40226"},{"sha":"e09463f220ca9a1a1ecfda84fcda658f99a1f12a","author":{"name":"Theodore Ts'o","email":"4ed386e0495d3e109932df055831d9ec2f824927@mit.edu"},"message":"jbd2: don't mark block as modified if the handle is out of credits\n\nDo not set the b_modified flag in block's journal head should not\nuntil after we're sure that jbd2_journal_dirty_metadat() will not\nabort with an error due to there not being enough space reserved in\nthe jbd2 handle.\n\nOtherwise, future attempts to modify the buffer may lead a large\nnumber of spurious errors and warnings.\n\nThis addresses CVE-2018-10883.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=200071\n\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nCc: stable@kernel.org","distinct":false,"url":"https://api.github.com/repos/checle/linux/commits/e09463f220ca9a1a1ecfda84fcda658f99a1f12a"},{"sha":"8bc1379b82b8e809eef77a9fedbb75c6c297be19","author":{"name":"Theodore Ts'o","email":"4ed386e0495d3e109932df055831d9ec2f824927@mit.edu"},"message":"ext4: avoid running out of journal credits when appending to an inline file\n\nUse a separate journal transaction if it turns out that we need to\nconvert an inline file to use an data block.  Otherwise we could end\nup failing due to not having journal credits.\n\nThis addresses CVE-2018-10883.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=200071\n\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nCc: stable@kernel.org","distinct":false,"url":"https://api.github.com/repos/checle/linux/commits/8bc1379b82b8e809eef77a9fedbb75c6c297be19"},{"sha":"c37e9e013469521d9adb932d17a1795c139b36db","author":{"name":"Theodore Ts'o","email":"4ed386e0495d3e109932df055831d9ec2f824927@mit.edu"},"message":"ext4: add more inode number paranoia checks\n\nIf there is a directory entry pointing to a system inode (such as a\njournal inode), complain and declare the file system to be corrupted.\n\nAlso, if the superblock's first inode number field is too small,\nrefuse to mount the file system.\n\nThis addresses CVE-2018-10882.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=200069\n\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nCc: stable@kernel.org","distinct":false,"url":"https://api.github.com/repos/checle/linux/commits/c37e9e013469521d9adb932d17a1795c139b36db"},{"sha":"bfe0a5f47ada40d7984de67e59a7d3390b9b9ecc","author":{"name":"Theodore Ts'o","email":"4ed386e0495d3e109932df055831d9ec2f824927@mit.edu"},"message":"ext4: add more mount time checks of the superblock\n\nThe kernel's ext4 mount-time checks were more permissive than\ne2fsprogs's libext2fs checks when opening a file system.  The\nsuperblock is considered too insane for debugfs or e2fsck to operate\non it, the kernel has no business trying to mount it.\n\nThis will make file system fuzzing tools work harder, but the failure\ncases that they find will be more useful and be easier to evaluate.\n\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nCc: stable@kernel.org","distinct":false,"url":"https://api.github.com/repos/checle/linux/commits/bfe0a5f47ada40d7984de67e59a7d3390b9b9ecc"},{"sha":"c1e3f64f87381ed3768b9247ab0cd08b41927da6","author":{"name":"Gustavo A. R. Silva","email":"beac5f8171fcde5e2ec734cc5d25d03e7362e8de@embeddedor.com"},"message":"qtnfmac: fix NULL pointer dereference\n\nIn case *vif* is NULL at 655: if (!vif), the execution path jumps to\nlabel out, where *vif* is dereferenced at 679:\n\nif (vif->sta_state == QTNF_STA_CONNECTING)\n\nFix this by immediately returning when *vif* is NULL instead of\njumping to label out.\n\nAddresses-Coverity-ID: 1469567 (\"Dereference after null check\")\nFixes: 480daa9cb62c (\"qtnfmac: fix invalid STA state on EAPOL failure\")\nSigned-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>\nReviewed-by: Sergey Matyukevich <sergey.matyukevich.os@quanenna.com>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/checle/linux/commits/c1e3f64f87381ed3768b9247ab0cd08b41927da6"},{"sha":"755abd247a3da273af3b90d1dd31bc61794ae7d7","author":{"name":"Xinming Hu","email":"8b9c60c177136f4289bffc27dc182e6e6ad5798f@marvell.com"},"message":"MAINTAINERS: update Xinming's email address\n\nI'd like to use this new gmail from now on.\n\nCc: Ganapathi Bhat <gbhat@marvell.com>\nSigned-off-by: Xinming Hu <huxm@marvell.com>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/checle/linux/commits/755abd247a3da273af3b90d1dd31bc61794ae7d7"},{"sha":"ba062ebb2cd561d404e0fba8ee4b3f5ebce7cbfc","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"netfilter: nf_queue: augment nfqa_cfg_policy\n\nThree attributes are currently not verified, thus can trigger KMSAN\nwarnings such as :\n\nBUG: KMSAN: uninit-value in __arch_swab32 arch/x86/include/uapi/asm/swab.h:10 [inline]\nBUG: KMSAN: uninit-value in __fswab32 include/uapi/linux/swab.h:59 [inline]\nBUG: KMSAN: uninit-value in nfqnl_recv_config+0x939/0x17d0 net/netfilter/nfnetlink_queue.c:1268\nCPU: 1 PID: 4521 Comm: syz-executor120 Not tainted 4.17.0+ #5\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x185/0x1d0 lib/dump_stack.c:113\n kmsan_report+0x188/0x2a0 mm/kmsan/kmsan.c:1117\n __msan_warning_32+0x70/0xc0 mm/kmsan/kmsan_instr.c:620\n __arch_swab32 arch/x86/include/uapi/asm/swab.h:10 [inline]\n __fswab32 include/uapi/linux/swab.h:59 [inline]\n nfqnl_recv_config+0x939/0x17d0 net/netfilter/nfnetlink_queue.c:1268\n nfnetlink_rcv_msg+0xb2e/0xc80 net/netfilter/nfnetlink.c:212\n netlink_rcv_skb+0x37e/0x600 net/netlink/af_netlink.c:2448\n nfnetlink_rcv+0x2fe/0x680 net/netfilter/nfnetlink.c:513\n netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]\n netlink_unicast+0x1680/0x1750 net/netlink/af_netlink.c:1336\n netlink_sendmsg+0x104f/0x1350 net/netlink/af_netlink.c:1901\n sock_sendmsg_nosec net/socket.c:629 [inline]\n sock_sendmsg net/socket.c:639 [inline]\n ___sys_sendmsg+0xec8/0x1320 net/socket.c:2117\n __sys_sendmsg net/socket.c:2155 [inline]\n __do_sys_sendmsg net/socket.c:2164 [inline]\n __se_sys_sendmsg net/socket.c:2162 [inline]\n __x64_sys_sendmsg+0x331/0x460 net/socket.c:2162\n do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\nRIP: 0033:0x43fd59\nRSP: 002b:00007ffde0e30d28 EFLAGS: 00000213 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fd59\nRDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003\nRBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8\nR10: 00000000004002c8 R11: 0000000000000213 R12: 0000000000401680\nR13: 0000000000401710 R14: 0000000000000000 R15: 0000000000000000\n\nUninit was created at:\n kmsan_save_stack_with_flags mm/kmsan/kmsan.c:279 [inline]\n kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:189\n kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:315\n kmsan_slab_alloc+0x10/0x20 mm/kmsan/kmsan.c:322\n slab_post_alloc_hook mm/slab.h:446 [inline]\n slab_alloc_node mm/slub.c:2753 [inline]\n __kmalloc_node_track_caller+0xb35/0x11b0 mm/slub.c:4395\n __kmalloc_reserve net/core/skbuff.c:138 [inline]\n __alloc_skb+0x2cb/0x9e0 net/core/skbuff.c:206\n alloc_skb include/linux/skbuff.h:988 [inline]\n netlink_alloc_large_skb net/netlink/af_netlink.c:1182 [inline]\n netlink_sendmsg+0x76e/0x1350 net/netlink/af_netlink.c:1876\n sock_sendmsg_nosec net/socket.c:629 [inline]\n sock_sendmsg net/socket.c:639 [inline]\n ___sys_sendmsg+0xec8/0x1320 net/socket.c:2117\n __sys_sendmsg net/socket.c:2155 [inline]\n __do_sys_sendmsg net/socket.c:2164 [inline]\n __se_sys_sendmsg net/socket.c:2162 [inline]\n __x64_sys_sendmsg+0x331/0x460 net/socket.c:2162\n do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nFixes: fdb694a01f1f (\"netfilter: Add fail-open support\")\nFixes: 829e17a1a602 (\"[NETFILTER]: nfnetlink_queue: allow changing queue length through netlink\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/checle/linux/commits/ba062ebb2cd561d404e0fba8ee4b3f5ebce7cbfc"},{"sha":"9ce7bc036ae4cfe3393232c86e9e1fea2153c237","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"netfilter: ipv6: nf_defrag: reduce struct net memory waste\n\nIt is a waste of memory to use a full \"struct netns_sysctl_ipv6\"\nwhile only one pointer is really used, considering netns_sysctl_ipv6\nkeeps growing.\n\nAlso, since \"struct netns_frags\" has cache line alignment,\nit is better to move the frags_hdr pointer outside, otherwise\nwe spend a full cache line for this pointer.\n\nThis saves 192 bytes of memory per netns.\n\nFixes: c038a767cd69 (\"ipv6: add a new namespace for nf_conntrack_reasm\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/checle/linux/commits/9ce7bc036ae4cfe3393232c86e9e1fea2153c237"},{"sha":"ad9852af97587b8abe8102f9ddcb05c9769656f6","author":{"name":"Gao Feng","email":"69545a04d4ba61a2fccae87aa2c6e3e0a450b8e4@vip.163.com"},"message":"netfilter: nf_ct_helper: Fix possible panic after nf_conntrack_helper_unregister\n\nThe helper module would be unloaded after nf_conntrack_helper_unregister,\nso it may cause a possible panic caused by race.\n\nnf_ct_iterate_destroy(unhelp, me) reset the helper of conntrack as NULL,\nbut maybe someone has gotten the helper pointer during this period. Then\nit would panic, when it accesses the helper and the module was unloaded.\n\nTake an example as following:\nCPU0                                                   CPU1\nctnetlink_dump_helpinfo\nhelper = rcu_dereference(help->helper);\n                                                       unhelp\n                                                       set helper as NULL\n                                                       unload helper module\nhelper->to_nlattr(skb, ct);\n\nAs above, the cpu0 tries to access the helper and its module is unloaded,\nthen the panic happens.\n\nSigned-off-by: Gao Feng <gfree.wind@vip.163.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/checle/linux/commits/ad9852af97587b8abe8102f9ddcb05c9769656f6"},{"sha":"bfc9dfdcb6e9493de5d4fe0d3ed3ce57672f8d07","author":{"name":"Shaohua Li","email":"c0c0c8857ed6ec93282de3ee9d47e224acf995af@fb.com"},"message":"MD: cleanup resources in failure\n\nWe need destroy the memory pool in failure\n\nSigned-off-by: Shaohua Li <shli@fb.com>","distinct":false,"url":"https://api.github.com/repos/checle/linux/commits/bfc9dfdcb6e9493de5d4fe0d3ed3ce57672f8d07"}]}
{"actor":{"display_login":"daluege"}}