linux-ext4 - Re: [PATCH] debugfs: fix check for out-of-bound xattr value

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 10 Aug 2016 18:02:23 -0400
From:	Theodore Ts'o <tytso@....edu>
To:	Andreas Dilger <andreas.dilger@...el.com>
Cc:	linux-ext4@...r.kernel.org
Subject: Re: [PATCH] debugfs: fix check for out-of-bound xattr value

On Tue, Aug 09, 2016 at 02:42:51PM -0600, Andreas Dilger wrote:
> Since commit v1.42.12-1-g8a546777119c, the check for in-inode
> xattrs in internal_dump_inode_extra() has been incorrectly checking
> the value size.  The value can go right to the end of the inode.
> 
> Signed-off-by: Andreas Dilger <andreas.dilger@...el.com>

This looks like it's another 1.42 related patch.  I wasn't planning on
putting out another 1.42 maintenance branch, mainly because I just
don't have the time.  So what I've been doing is trying to see if
fixes can apply to the maint branch --- and if they can, I'll apply
them there and then merge them into the next / master branches.

But for patches where the code in question has changed radically
between 1.42 and 1.43, I haven't been bothering to try to apply them
into the maint branch, mainly because that just causes patch conflicts
lately.

I'm planning on retiring the 1.42 maint branch, and merging the maint
branch to 1.43, probably after 1.43.2, and then we can start using
putting more development related changes to the master/next branches.

Any objections to that plan?  Is there anyone who needs a 1.42 based
maintenance branch for some reason?

	    				- Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html