kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
No description
1,081,087 commits 116 branches 5,798 tags 5.6 GiB
  • C 96.9%
  • Assembly 0.9%
  • Rust 0.6%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Jérémy Jean baad5875fd libceph: reject buckets with mismatched CRUSH ids 
commit 3cde4a8302 upstream.

crush_decode() stores bucket data by array slot, and the mapper later
derives the per-bucket workspace index from the decoded bucket id. A
malformed map can therefore make one bucket reuse another bucket's
workspace by encoding an id different from -1 - slot.

For uniform buckets, the second replica selection expands the source
bucket's permutation into that aliased workspace buffer. If the source
bucket is larger than the aliased bucket, the write runs past the smaller
permutation array and can escape the kvmalloc'd CRUSH workspace. KASAN
reports a slab OOB write of 4 bytes in bucket_perm_choose().

Reject buckets whose encoded id does not match their array slot. Valid
CRUSH maps already use the canonical negative id corresponding to the
bucket slot, so this restores the invariant expected by
work->work[-1 - in->id] without changing valid map behavior.

Cc: stable@vger.kernel.org
Fixes: 66a0e2d579 ("crush: remove mutable part of CRUSH map")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-09-14 13:20:06 +02:00
arch powerpc/powermac: fix OF node refcount 2026-09-14 13:20:04 +02:00
block partitions: aix: bound the pp_count scan to the ppe array 2026-07-24 15:51:24 +02:00
certs X.509: Fix validation of ASN.1 certificate header 2026-07-24 15:51:59 +02:00
crypto crypto: ccm - Set rfc4309 maxauthsize from child 2026-08-23 14:17:31 +02:00
Documentation mm/swap: reject swapon() on filesystem-level encrypted files 2026-09-02 14:27:28 +02:00
drivers of: fix out-of-bounds read in of_alias_scan() stem parser 2026-09-14 13:20:05 +02:00
fs NFSD: Prevent lock owner use-after-free during client teardown 2026-09-14 13:20:06 +02:00
include include/linux/list.h: mark list_add and __list_add as __always_inline 2026-09-14 13:20:03 +02:00
init bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c 2026-08-23 14:17:24 +02:00
io_uring io_uring/io-wq: fix worker accounting when canceling creation callbacks 2026-09-02 14:27:25 +02:00
ipc ipc/shm: serialize orphan cleanup with shm_nattch updates 2026-06-19 13:33:38 +02:00
kernel tracing: Fix crash passing ERR_PTR to kthread_stop() 2026-09-14 13:20:04 +02:00
lib lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() 2026-09-14 13:20:04 +02:00
LICENSES LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes" 2021-07-15 06:31:24 -06:00
mm mm: memcg: stop reclaim when a limit update is superseded 2026-09-14 13:20:03 +02:00
net libceph: reject buckets with mismatched CRUSH ids 2026-09-14 13:20:06 +02:00
samples tracing/events: Fix to check the simple_tsk_fn creation 2026-07-24 15:51:42 +02:00
scripts kconfig: fix potential NULL pointer dereference in conf_askvalue 2026-07-24 15:51:28 +02:00
security selinux: switch two allocations to use kzalloc_objs() 2026-09-02 14:27:26 +02:00
sound ALSA: aloop: Fix racy access at PCM trigger 2026-09-14 13:20:03 +02:00
tools tools/compiler: match glibc 2.42 definition of __attribute_const__ 2026-09-14 13:20:04 +02:00
usr kbuild: hdrcheck: fix cross build with clang 2025-06-27 11:05:22 +01:00
virt KVM: Rename mmu_notifier_* to mmu_invalidate_* 2026-08-27 14:28:21 +02:00
.clang-format clang-format: Update with the latest for_each macro list 2021-05-12 23:32:39 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore Remove *.orig pattern from .gitignore 2024-10-17 15:11:10 +02:00
.mailmap mailmap: add Andrej Shadura 2021-10-18 20:22:03 -10:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Move Daniel Drake to credits 2021-09-21 08:34:58 +03:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS staging: rtl8712: Remove driver using deprecated API wext 2025-12-07 06:09:36 +09:00
Makefile Linux 5.15.220 2026-09-02 14:27:29 +02:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.