All of lore.kernel.org
 help / color / mirror / Atom feed
From: Luis Henriques <luis.henriques@canonical.com>
To: Greg KH <gregkh@linuxfoundation.org>
Cc: Josh Boyer <jwboyer@fedoraproject.org>,
	Brian Foster <bfoster@redhat.com>,
	Dave Chinner <dchinner@redhat.com>,
	Dwight Engen <dwight.engen@oracle.com>,
	LKML <linux-kernel@vger.kernel.org>,
	stable@vger.kernel.org, xfs@oss.sgi.com, Ben Myers <bpm@sgi.com>,
	Gao feng <gaofeng@cn.fujitsu.com>,
	Kees Cook <keescook@google.com>
Subject: Re: XFS security fix never sent to -stable?
Date: Tue, 17 Dec 2013 13:58:44 +0000	[thread overview]
Message-ID: <20131217135844.GD5044@hercules> (raw)
In-Reply-To: <20131210075621.GA30135@kroah.com>

On Mon, Dec 09, 2013 at 11:56:21PM -0800, Greg Kroah-Hartman wrote:
> On Tue, Dec 10, 2013 at 10:55:23AM +1100, Dave Chinner wrote:
> > [cc xfs list, cc stable@vger.kernel.org]
> > 
> > On Mon, Dec 09, 2013 at 08:17:09AM -0500, Josh Boyer wrote:
> > > On Mon, Dec 9, 2013 at 7:15 AM, Luis Henriques
> > > <luis.henriques@canonical.com> wrote:
> > > > On Thu, Dec 05, 2013 at 04:35:50PM -0800, Kees Cook wrote:
> > > >> Hi,
> > > >>
> > > >> It looks like 8c567a7fab6e086a0284eee2db82348521e7120c ("xfs: add
> > > >> capability check to free eofblocks ioctl") is a security fix that was
> > > >> never sent to -stable? From what I can see, it was introduced in 3.8
> > > >> by 8ca149de80478441352a8622ea15fae7de703ced ("xfs: add
> > > >> XFS_IOC_FREE_EOFBLOCKS ioctl").
> > > >>
> > > >> I don't see this in the 3.8.y tree. Should it be added there and newer?
> > > >
> > > > Thanks Kees, I'm queuing it for the 3.11 kernel.
> > > 
> > > There's also this one:
> > > 
> > > http://thread.gmane.org/gmane.comp.file-systems.xfs.general/57654
> > > 
> > > It fixes CVE-2013-6382
> > 
> > First I've heard about it there being a CVE for that bug. Since when
> > has it been considered best practice to publish CVEs without first
> > (or ever) directly contacting the relevant upstream developers?
> > 
> > But, regardless of how broken I think the CVE process is, commit
> > 071c529 ("xfs: underflow bug in xfs_attrlist_by_handle()") should be
> > picked up by the stable kernels.
> 
> I don't see that commit in Linus's tree, is it not there yet?

This commit is now in Linus's:

31978b5 xfs: underflow bug in xfs_attrlist_by_handle()

Cheers,
--
Luis

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

WARNING: multiple messages have this Message-ID (diff)
From: Luis Henriques <luis.henriques@canonical.com>
To: Greg KH <gregkh@linuxfoundation.org>
Cc: Dave Chinner <david@fromorbit.com>,
	Josh Boyer <jwboyer@fedoraproject.org>,
	Kees Cook <keescook@google.com>,
	Dwight Engen <dwight.engen@oracle.com>,
	LKML <linux-kernel@vger.kernel.org>,
	Brian Foster <bfoster@redhat.com>,
	Dave Chinner <dchinner@redhat.com>,
	Gao feng <gaofeng@cn.fujitsu.com>, Ben Myers <bpm@sgi.com>,
	xfs@oss.sgi.com, stable@vger.kernel.org
Subject: Re: XFS security fix never sent to -stable?
Date: Tue, 17 Dec 2013 13:58:44 +0000	[thread overview]
Message-ID: <20131217135844.GD5044@hercules> (raw)
In-Reply-To: <20131210075621.GA30135@kroah.com>

On Mon, Dec 09, 2013 at 11:56:21PM -0800, Greg Kroah-Hartman wrote:
> On Tue, Dec 10, 2013 at 10:55:23AM +1100, Dave Chinner wrote:
> > [cc xfs list, cc stable@vger.kernel.org]
> > 
> > On Mon, Dec 09, 2013 at 08:17:09AM -0500, Josh Boyer wrote:
> > > On Mon, Dec 9, 2013 at 7:15 AM, Luis Henriques
> > > <luis.henriques@canonical.com> wrote:
> > > > On Thu, Dec 05, 2013 at 04:35:50PM -0800, Kees Cook wrote:
> > > >> Hi,
> > > >>
> > > >> It looks like 8c567a7fab6e086a0284eee2db82348521e7120c ("xfs: add
> > > >> capability check to free eofblocks ioctl") is a security fix that was
> > > >> never sent to -stable? From what I can see, it was introduced in 3.8
> > > >> by 8ca149de80478441352a8622ea15fae7de703ced ("xfs: add
> > > >> XFS_IOC_FREE_EOFBLOCKS ioctl").
> > > >>
> > > >> I don't see this in the 3.8.y tree. Should it be added there and newer?
> > > >
> > > > Thanks Kees, I'm queuing it for the 3.11 kernel.
> > > 
> > > There's also this one:
> > > 
> > > http://thread.gmane.org/gmane.comp.file-systems.xfs.general/57654
> > > 
> > > It fixes CVE-2013-6382
> > 
> > First I've heard about it there being a CVE for that bug. Since when
> > has it been considered best practice to publish CVEs without first
> > (or ever) directly contacting the relevant upstream developers?
> > 
> > But, regardless of how broken I think the CVE process is, commit
> > 071c529 ("xfs: underflow bug in xfs_attrlist_by_handle()") should be
> > picked up by the stable kernels.
> 
> I don't see that commit in Linus's tree, is it not there yet?

This commit is now in Linus's:

31978b5 xfs: underflow bug in xfs_attrlist_by_handle()

Cheers,
--
Luis

  parent reply	other threads:[~2013-12-17 13:59 UTC|newest]

Thread overview: 37+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-12-06  0:35 XFS security fix never sent to -stable? Kees Cook
2013-12-06 14:43 ` Dwight Engen
2013-12-06 15:06   ` Brian Foster
2013-12-09 12:15 ` Luis Henriques
2013-12-09 13:17   ` Josh Boyer
2013-12-09 23:55     ` Dave Chinner
2013-12-09 23:55       ` Dave Chinner
2013-12-10  7:56       ` Greg KH
2013-12-10  7:56         ` Greg KH
2013-12-10 13:15         ` Josh Boyer
2013-12-10 13:15           ` Josh Boyer
2013-12-10 14:31           ` Eric Sandeen
2013-12-10 14:31             ` Eric Sandeen
2013-12-10 15:57             ` Ben Myers
2013-12-10 15:57               ` Ben Myers
2013-12-17 13:58         ` Luis Henriques [this message]
2013-12-17 13:58           ` Luis Henriques
2013-12-10 13:20       ` Josh Boyer
2013-12-10 13:20         ` Josh Boyer
2013-12-11  1:03         ` Dave Chinner
2013-12-11  1:03           ` Dave Chinner
2013-12-11  1:10           ` Josh Boyer
2013-12-11  1:10             ` Josh Boyer
2013-12-11  2:00             ` Dave Chinner
2013-12-11  2:00               ` Dave Chinner
2013-12-11  2:12               ` Greg KH
2013-12-11  2:12                 ` Greg KH
2013-12-11  2:45               ` Kees Cook
2013-12-11  2:45                 ` Kees Cook
2013-12-11  4:17                 ` Dave Chinner
2013-12-11  4:17                   ` Dave Chinner
2013-12-11  8:27                   ` Dan Carpenter
2013-12-11  8:27                     ` Dan Carpenter
2013-12-09 23:30 ` Dave Chinner
2013-12-09 23:30   ` Dave Chinner
2013-12-11  2:36   ` Kees Cook
2013-12-11  2:36     ` Kees Cook

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20131217135844.GD5044@hercules \
    --to=luis.henriques@canonical.com \
    --cc=bfoster@redhat.com \
    --cc=bpm@sgi.com \
    --cc=dchinner@redhat.com \
    --cc=dwight.engen@oracle.com \
    --cc=gaofeng@cn.fujitsu.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=jwboyer@fedoraproject.org \
    --cc=keescook@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=xfs@oss.sgi.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.