)]}'
{
  "commit": "35c2a7f4908d404c9124c2efc6ada4640ca4d5d5",
  "tree": "4ef3fa1953b939fb4bfff935b3d351f76d97252b",
  "parents": [
    "8e22cc88d68ca1a46d7d582938f979eb640ed30f"
  ],
  "author": {
    "name": "Hugh Dickins",
    "email": "hughd@google.com",
    "time": "Sun Oct 07 20:32:51 2012 -0700"
  },
  "committer": {
    "name": "Al Viro",
    "email": "viro@zeniv.linux.org.uk",
    "time": "Tue Oct 09 23:33:55 2012 -0400"
  },
  "message": "tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking\n\nFuzzing with trinity oopsed on the 1st instruction of shmem_fh_to_dentry(),\n\tu64 inum \u003d fid-\u003eraw[2];\nwhich is unhelpfully reported as at the end of shmem_alloc_inode():\n\nBUG: unable to handle kernel paging request at ffff880061cd3000\nIP: [\u003cffffffff812190d0\u003e] shmem_alloc_inode+0x40/0x40\nOops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC\nCall Trace:\n [\u003cffffffff81488649\u003e] ? exportfs_decode_fh+0x79/0x2d0\n [\u003cffffffff812d77c3\u003e] do_handle_open+0x163/0x2c0\n [\u003cffffffff812d792c\u003e] sys_open_by_handle_at+0xc/0x10\n [\u003cffffffff83a5f3f8\u003e] tracesys+0xe1/0xe6\n\nRight, tmpfs is being stupid to access fid-\u003eraw[2] before validating that\nfh_len includes it: the buffer kmalloc\u0027ed by do_sys_name_to_handle() may\nfall at the end of a page, and the next page not be present.\n\nBut some other filesystems (ceph, gfs2, isofs, reiserfs, xfs) are being\ncareless about fh_len too, in fh_to_dentry() and/or fh_to_parent(), and\ncould oops in the same way: add the missing fh_len checks to those.\n\nReported-by: Sasha Levin \u003clevinsasha928@gmail.com\u003e\nSigned-off-by: Hugh Dickins \u003chughd@google.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Sage Weil \u003csage@inktank.com\u003e\nCc: Steven Whitehouse \u003cswhiteho@redhat.com\u003e\nCc: Christoph Hellwig \u003chch@infradead.org\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "8e1b60e557b65bea0df86a881376456658a9cffd",
      "old_mode": 33188,
      "old_path": "fs/ceph/export.c",
      "new_id": "02ce90972d81ca6e8b60ed580931c676c441fc2c",
      "new_mode": 33188,
      "new_path": "fs/ceph/export.c"
    },
    {
      "type": "modify",
      "old_id": "e8ed6d4a6181132ff47960dc118cd6fb60c1b81c",
      "old_mode": 33188,
      "old_path": "fs/gfs2/export.c",
      "new_id": "4767774a5f3e7d9c61b5f6ac67571bd450b331ee",
      "new_mode": 33188,
      "new_path": "fs/gfs2/export.c"
    },
    {
      "type": "modify",
      "old_id": "1d3804492aa77d7ca4440d087fd415febc2e3681",
      "old_mode": 33188,
      "old_path": "fs/isofs/export.c",
      "new_id": "2b4f2358eadbb063fab1fb2c275e9cad1151bd6c",
      "new_mode": 33188,
      "new_path": "fs/isofs/export.c"
    },
    {
      "type": "modify",
      "old_id": "46485557cdc63b037994c05e82735605bbb4069a",
      "old_mode": 33188,
      "old_path": "fs/reiserfs/inode.c",
      "new_id": "f27f01a98aa2c9573c6cc61fe093c821ce6e107c",
      "new_mode": 33188,
      "new_path": "fs/reiserfs/inode.c"
    },
    {
      "type": "modify",
      "old_id": "42679223a0fde641e3013980fbd1e733dc6ec60e",
      "old_mode": 33188,
      "old_path": "fs/xfs/xfs_export.c",
      "new_id": "8c6d1d70278cc6e71dbc093cbbfc5f2c5d44df19",
      "new_mode": 33188,
      "new_path": "fs/xfs/xfs_export.c"
    },
    {
      "type": "modify",
      "old_id": "cc12072f8787d5adacc6cd49a78849ca5c2005a6",
      "old_mode": 33188,
      "old_path": "mm/shmem.c",
      "new_id": "67afba5117f2ebe80ef54e487d068fdf99e986bb",
      "new_mode": 33188,
      "new_path": "mm/shmem.c"
    }
  ]
}