linux

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00

No description

C 96.9%
Assembly 0.9%
Rust 0.6%
Shell 0.6%
Python 0.5%
Other 0.3%

Find a file

Michael Bommarito d582e12378 isofs: validate Rock Ridge CE continuation extent against volume size commit `a36d990f59` upstream. rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit `e595447e17` ("[PATCH] rock.c: handle corrupted directories") added cont_offset and cont_size rejection for the CE continuation but did not validate the extent block number itself. commit `f54e18f1b8` ("isofs: Fix infinite looping over CE entries") later capped the CE chain length at RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked. With a crafted ISO mounted via udisks2 (desktop optical auto-mount) or via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at an out-of-range block or at blocks belonging to an adjacent filesystem on the same block device. sb_bread() on an out-of-range block returns NULL cleanly via the block layer EIO path, so there is no memory-safety violation. For in-range reads of adjacent- filesystem data, the CE buffer is parsed as Rock Ridge records and only the text of SL sub-records reaches userspace through readlink(), which makes the info-leak channel narrow and difficult to exploit; still, rejecting the malformed CE outright matches the rejection shape already present in the same function for cont_offset and cont_size. Add an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next to the existing offset/size rejection, printing the same corrupted-directory-entry notice. Fixes: `f54e18f1b8` ("isofs: Fix infinite looping over CE entries") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Link: https://patch.msgid.link/20260419212155.2169382-2-michael.bommarito@gmail.com Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2026-06-01 17:35:23 +02:00
arch	um: virt-pci: Fix build failure	2026-06-01 17:35:19 +02:00
block	blk-mq: use quiesced elevator switch when reinitializing queues	2026-06-01 17:35:09 +02:00
certs	certs/blacklist_hashes.c: fix const confusion in certs blacklist	2022-06-22 14:22:01 +02:00
crypto	crypto: authencesn - reject short ahash digests during instance creation	2026-06-01 17:35:18 +02:00
Documentation	dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning	2026-04-18 10:33:29 +02:00
drivers	dm-verity-fec: correctly reject too-small hash devices	2026-06-01 17:35:23 +02:00
fs	isofs: validate Rock Ridge CE continuation extent against volume size	2026-06-01 17:35:23 +02:00
include	fanotify: fix false positive on permission events	2026-06-01 17:35:21 +02:00
init	init: handle bootloader identifier in kernel parameters	2025-10-19 16:21:45 +02:00
io_uring	io_uring/poll: fix backport of io_poll_add() changes	2026-06-01 17:35:17 +02:00
ipc	ipc: fix to protect IPCS lookups using RCU	2025-06-27 11:05:26 +01:00
kernel	taskstats: set version in TGID exit notifications	2026-06-01 17:35:17 +02:00
lib	lib/ts_kmp: fix integer overflow in pattern length calculation	2026-06-01 17:35:14 +02:00
LICENSES	LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes"	2021-07-15 06:31:24 -06:00
mm	mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()	2026-06-01 17:35:08 +02:00
net	hv_sock: fix ARM64 support	2026-06-01 17:35:22 +02:00
samples	samples: mei: Fix building on musl libc	2025-08-28 16:24:07 +02:00
scripts	scripts/dtc: Remove unused dts_version in dtc-lexer.l	2026-06-01 17:35:12 +02:00
security	apparmor: fix race between freeing data and fs accessing it	2026-04-18 10:33:36 +02:00
sound	ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error	2026-06-01 17:35:22 +02:00
tools	ktest: Fix the month in the name of the failure directory	2026-06-01 17:35:18 +02:00
usr	kbuild: hdrcheck: fix cross build with clang	2025-06-27 11:05:22 +01:00
virt	KVM: Don't clobber irqfd routing type when deassigning irqfd	2026-02-11 13:35:27 +01:00
.clang-format	clang-format: Update with the latest for_each macro list	2021-05-12 23:32:39 +02:00
.cocciconfig	scripts: add Linux .cocciconfig for coccinelle	2016-07-22 12:13:39 +02:00
.get_maintainer.ignore	Opt out of scripts/get_maintainer.pl	2019-05-16 10:53:40 -07:00
.gitattributes	.gitattributes: use 'dts' diff driver for dts files	2019-12-04 19:44:11 -08:00
.gitignore	Remove *.orig pattern from .gitignore	2024-10-17 15:11:10 +02:00
.mailmap	mailmap: add Andrej Shadura	2021-10-18 20:22:03 -10:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: Move Daniel Drake to credits	2021-09-21 08:34:58 +03:00
Kbuild	kbuild: rename hostprogs-y/always to hostprogs/always-y	2020-02-04 01:53:07 +09:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	staging: rtl8712: Remove driver using deprecated API wext	2025-12-07 06:09:36 +09:00
Makefile	Linux 5.15.208	2026-05-23 13:40:45 +02:00
README	Drop all 00-INDEX files from Documentation/	2018-09-09 15:08:58 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.