Hello community, here is the log from the commit of package kernel-source for openSUSE:Factory checked in at 2016-01-01 19:46:33 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kernel-source (Old) and /work/SRC/openSUSE:Factory/.kernel-source.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "kernel-source" Changes: -------- --- /work/SRC/openSUSE:Factory/kernel-source/kernel-debug.changes 2015-12-29 12:49:45.000000000 +0100 +++ /work/SRC/openSUSE:Factory/.kernel-source.new/kernel-debug.changes 2016-01-01 19:46:46.000000000 +0100 @@ -1,0 +2,7 @@ +Mon Dec 28 16:58:51 CET 2015 - [email protected] + +- ovl: fix permission checking for setattr (CVE-2015-8660 + bsc#960281). +- commit 77a3e32 + +------------------------------------------------------------------- kernel-default.changes: same change kernel-docs.changes: same change kernel-lpae.changes: same change kernel-obs-build.changes: same change kernel-obs-qa.changes: same change kernel-pae.changes: same change kernel-source.changes: same change kernel-syms.changes: same change kernel-vanilla.changes: same change ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kernel-debug.spec ++++++ --- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:51.000000000 +0100 +++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:51.000000000 +0100 @@ -59,7 +59,7 @@ Group: System/Kernel Version: 4.3.3 %if 0%{?is_kotd} -Release: <RELEASE>.g10b7cff +Release: <RELEASE>.g77a3e32 %else Release: 0 %endif kernel-default.spec: same change ++++++ kernel-docs.spec ++++++ --- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:51.000000000 +0100 +++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:51.000000000 +0100 @@ -29,7 +29,7 @@ Group: Documentation/Man Version: 4.3.3 %if 0%{?is_kotd} -Release: <RELEASE>.g10b7cff +Release: <RELEASE>.g77a3e32 %else Release: 0 %endif ++++++ kernel-lpae.spec ++++++ --- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:51.000000000 +0100 +++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:51.000000000 +0100 @@ -59,7 +59,7 @@ Group: System/Kernel Version: 4.3.3 %if 0%{?is_kotd} -Release: <RELEASE>.g10b7cff +Release: <RELEASE>.g77a3e32 %else Release: 0 %endif ++++++ kernel-obs-build.spec ++++++ --- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:51.000000000 +0100 +++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:51.000000000 +0100 @@ -44,7 +44,7 @@ Group: SLES Version: 4.3.3 %if 0%{?is_kotd} -Release: <RELEASE>.g10b7cff +Release: <RELEASE>.g77a3e32 %else Release: 0 %endif kernel-obs-qa.spec: same change ++++++ kernel-pae.spec ++++++ --- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:52.000000000 +0100 +++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:52.000000000 +0100 @@ -59,7 +59,7 @@ Group: System/Kernel Version: 4.3.3 %if 0%{?is_kotd} -Release: <RELEASE>.g10b7cff +Release: <RELEASE>.g77a3e32 %else Release: 0 %endif ++++++ kernel-source.spec ++++++ --- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:52.000000000 +0100 +++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:52.000000000 +0100 @@ -32,7 +32,7 @@ Group: Development/Sources Version: 4.3.3 %if 0%{?is_kotd} -Release: <RELEASE>.g10b7cff +Release: <RELEASE>.g77a3e32 %else Release: 0 %endif ++++++ kernel-syms.spec ++++++ --- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:52.000000000 +0100 +++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:52.000000000 +0100 @@ -27,7 +27,7 @@ Version: 4.3.3 %if %using_buildservice %if 0%{?is_kotd} -Release: <RELEASE>.g10b7cff +Release: <RELEASE>.g77a3e32 %else Release: 0 %endif ++++++ kernel-vanilla.spec ++++++ --- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:52.000000000 +0100 +++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:52.000000000 +0100 @@ -59,7 +59,7 @@ Group: System/Kernel Version: 4.3.3 %if 0%{?is_kotd} -Release: <RELEASE>.g10b7cff +Release: <RELEASE>.g77a3e32 %else Release: 0 %endif ++++++ patches.fixes.tar.bz2 ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/patches.fixes/ovl-fix-permission-checking-for-setattr new/patches.fixes/ovl-fix-permission-checking-for-setattr --- old/patches.fixes/ovl-fix-permission-checking-for-setattr 1970-01-01 01:00:00.000000000 +0100 +++ new/patches.fixes/ovl-fix-permission-checking-for-setattr 2015-12-28 16:58:51.000000000 +0100 @@ -0,0 +1,47 @@ +From: Miklos Szeredi <[email protected]> +Date: Fri, 4 Dec 2015 19:18:48 +0100 +Subject: ovl: fix permission checking for setattr +Git-commit: acff81ec2c79492b180fade3c2894425cd35a545 +Patch-mainline: v4.4-rc4 +References: CVE-2015-8660 bsc#960281 + +[Al Viro] The bug is in being too enthusiastic about optimizing ->setattr() +away - instead of "copy verbatim with metadata" + "chmod/chown/utimes" +(with the former being always safe and the latter failing in case of +insufficient permissions) it tries to combine these two. Note that copyup +itself will have to do ->setattr() anyway; _that_ is where the elevated +capabilities are right. Having these two ->setattr() (one to set verbatim +copy of metadata, another to do what overlayfs ->setattr() had been asked +to do in the first place) combined is where it breaks. + +Signed-off-by: Miklos Szeredi <[email protected]> +Cc: <[email protected]> +Signed-off-by: Al Viro <[email protected]> +Acked-by: Jeff Mahoney <[email protected]> +--- + fs/overlayfs/inode.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c +index ec0c2a0..9612849 100644 +--- a/fs/overlayfs/inode.c ++++ b/fs/overlayfs/inode.c +@@ -49,13 +49,13 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr) + if (err) + goto out; + +- upperdentry = ovl_dentry_upper(dentry); +- if (upperdentry) { ++ err = ovl_copy_up(dentry); ++ if (!err) { ++ upperdentry = ovl_dentry_upper(dentry); ++ + mutex_lock(&upperdentry->d_inode->i_mutex); + err = notify_change(upperdentry, attr, NULL); + mutex_unlock(&upperdentry->d_inode->i_mutex); +- } else { +- err = ovl_copy_up_last(dentry, attr, false); + } + ovl_drop_write(dentry); + out: + ++++++ series.conf ++++++ --- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:52.000000000 +0100 +++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:52.000000000 +0100 @@ -292,6 +292,7 @@ ######################################################## # Overlayfs ######################################################## + patches.fixes/ovl-fix-permission-checking-for-setattr ######################################################## # Swap-over-NFS ++++++ source-timestamp ++++++ --- /var/tmp/diff_new_pack.JdRjGi/_old 2016-01-01 19:46:52.000000000 +0100 +++ /var/tmp/diff_new_pack.JdRjGi/_new 2016-01-01 19:46:52.000000000 +0100 @@ -1,3 +1,3 @@ -2015-12-22 12:19:48 +0100 -GIT Revision: 10b7cffdfab2ff23f20a3b540351232646c1105d +2015-12-28 16:58:51 +0100 +GIT Revision: 77a3e32efb4979780b41ec71dde40026a3045fbc GIT Branch: stable
