)]}' { "log": [ { "commit": "3632dee2f8b8a9720329f29eeaa4ec4669a3aff8", "tree": "602fc5cc96145472210a4254680d539c81cb02e7", "parents": [ "aeb565dfc3ac4c8b47c5049085b4c7bfb2c7d5d7" ], "author": { "name": "Vegard Nossum", "email": "vegard.nossum@gmail.com", "time": "Thu Jan 22 15:29:45 2009 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Jan 26 10:08:05 2009 -0800" }, "message": "inotify: clean up inotify_read and fix locking problems\n\nIf userspace supplies an invalid pointer to a read() of an inotify\ninstance, the inotify device\u0027s event list mutex is unlocked twice.\nThis causes an unbalance which effectively leaves the data structure\nunprotected, and we can trigger oopses by accessing the inotify\ninstance from different tasks concurrently.\n\nThe best fix (contributed largely by Linus) is a total rewrite\nof the function in question:\n\nOn Thu, Jan 22, 2009 at 7:05 AM, Linus Torvalds wrote:\n\u003e The thing to notice is that:\n\u003e\n\u003e - locking is done in just one place, and there is no question about it\n\u003e not having an unlock.\n\u003e\n\u003e - that whole double-while(1)-loop thing is gone.\n\u003e\n\u003e - use multiple functions to make nesting and error handling sane\n\u003e\n\u003e - do error testing after doing the things you always need to do, ie do\n\u003e this:\n\u003e\n\u003e mutex_lock(..)\n\u003e ret \u003d function_call();\n\u003e mutex_unlock(..)\n\u003e\n\u003e .. test ret here ..\n\u003e\n\u003e instead of doing conditional exits with unlocking or freeing.\n\u003e\n\u003e So if the code is written in this way, it may still be buggy, but at least\n\u003e it\u0027s not buggy because of subtle \"forgot to unlock\" or \"forgot to free\"\n\u003e issues.\n\u003e\n\u003e This _always_ unlocks if it locked, and it always frees if it got a\n\u003e non-error kevent.\n\nCc: John McCutchan \u003cttb@tentacle.dhs.org\u003e\nCc: Robert Love \u003crlove@google.com\u003e\nCc: \u003cstable@kernel.org\u003e\nSigned-off-by: Vegard Nossum \u003cvegard.nossum@gmail.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "2e4d0924eb0c403ce4014fa139d1d61bf2c44fee", "tree": "58249b615c3a7a77154d4c9d006ea9acd04bbef9", "parents": [ "938bb9f5e840eddbf54e4f62f6c5ba9b3ae12c9d" ], "author": { "name": "Heiko Carstens", "email": "heiko.carstens@de.ibm.com", "time": "Wed Jan 14 14:14:31 2009 +0100" }, "committer": { "name": "Heiko Carstens", "email": "heiko.carstens@de.ibm.com", "time": "Wed Jan 14 14:15:30 2009 +0100" }, "message": "[CVE-2009-0029] System call wrappers part 29\n\nSigned-off-by: Heiko Carstens \u003cheiko.carstens@de.ibm.com\u003e\n" }, { "commit": "938bb9f5e840eddbf54e4f62f6c5ba9b3ae12c9d", "tree": "a25324159ed8cc96b97a4d39aaf228bbd07e3824", "parents": [ "1e7bfb2134dfec37ce04fb3a4ca89299e892d10c" ], "author": { "name": "Heiko Carstens", "email": "heiko.carstens@de.ibm.com", "time": "Wed Jan 14 14:14:30 2009 +0100" }, "committer": { "name": "Heiko Carstens", "email": "heiko.carstens@de.ibm.com", "time": "Wed Jan 14 14:15:30 2009 +0100" }, "message": "[CVE-2009-0029] System call wrappers part 28\n\nSigned-off-by: Heiko Carstens \u003cheiko.carstens@de.ibm.com\u003e\n" }, { "commit": "4ae8978cf92a96257cd8998a49e781be83571d64", "tree": "5c5e2719c17093309b4e22bfbf4deb7bd3e91ac8", "parents": [ "2f1169e2dc0c70e213f79ada88a10912cc2fbe94" ], "author": { "name": "Michael Kerrisk", "email": "mtk.manpages@googlemail.com", "time": "Mon Jan 05 07:19:16 2009 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Jan 05 11:54:29 2009 -0500" }, "message": "inotify: fix type errors in interfaces\n\nThe problems lie in the types used for some inotify interfaces, both at the kernel level and at the glibc level. This mail addresses the kernel problem. I will follow up with some suggestions for glibc changes.\n\nFor the sys_inotify_rm_watch() interface, the type of the \u0027wd\u0027 argument is\ncurrently \u0027u32\u0027, it should be \u0027__s32\u0027 . That is Robert\u0027s suggestion, and\nis consistent with the other declarations of watch descriptors in the\nkernel source, in particular, the inotify_event structure in\ninclude/linux/inotify.h:\n\nstruct inotify_event {\n __s32 wd; /* watch descriptor */\n __u32 mask; /* watch mask */\n __u32 cookie; /* cookie to synchronize two events */\n __u32 len; /* length (including nulls) of name */\n char name[0]; /* stub for possible name */\n};\n\nThe patch makes the changes needed for inotify_rm_watch().\n\nSigned-off-by: Michael Kerrisk \u003cmtk.manpages@googlemail.com\u003e\nCc: Robert Love \u003crlove@google.com\u003e\nCc: Vegard Nossum \u003cvegard.nossum@gmail.com\u003e\nCc: Ulrich Drepper \u003cdrepper@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "272eb01485dda98e3b8910c7c1a53d597616b0a0", "tree": "6a1dcd34c1dd668b465c166c2d6d2596924eff5f", "parents": [ "c2acf7b90821785fe812cc0aa05148e5a1f84204" ], "author": { "name": "Eric Paris", "email": "eparis@redhat.com", "time": "Wed Dec 17 13:59:41 2008 -0500" }, "committer": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Wed Dec 31 18:07:43 2008 -0500" }, "message": "filesystem notification: create fs/notify to contain all fs notification\n\nCreating a generic filesystem notification interface, fsnotify, which will be\nused by inotify, dnotify, and eventually fanotify is really starting to\nclutter the fs directory. This patch simply moves inotify and dnotify into\nfs/notify/inotify and fs/notify/dnotify respectively to make both current fs/\nand future notification tidier.\n\nSigned-off-by: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" } ] }