Hi Ben, Willy, On Fri, Jun 07, 2013 at 06:42:05AM +0100, Ben Hutchings wrote: > On Tue, 2013-06-04 at 19:23 +0200, Willy Tarreau wrote: > > 2.6.32-longterm review patch. If anyone has any objections, please let me know. > > > > ------------------ > > data exposure > > > > From: Jamie Iles <jamie.iles@xxxxxxxxxx> > > > > CVE-2012-4508 kernel: ext4: AIO vs fallocate stale data exposure > > [dannf: backported to Debian's 2.6.32] > > Well, this has an interesting ancestry. The original upstream commits > were c278531d39f3158bfee93dc67da0b77e09776de2, > 60d4616f3dc63371b3dc367e5e88fd4b4f037f65 and (most importantly) > dee1f973ca341c266229faa5a1a5bb268bed3531 by Dmitry Monakhov > <dmonakhov@xxxxxxxxxx>. They were backported into the RHEL 6 kernel by > Lukas Czerner, according to its changelog. Dann got this version from > Oracle's redpatch repository, where, if I understand rightly, Jamie Iles > attempted to regenerate Lukas's patch(es). That sounds correct to me - the patch is the result of splitting the large ext4 patch that RHEL did from 6.3 -> 6.4. The Virtuozzo/OpenVZ folks came up with the same patch (independently I think) too. > Would any of the above named be prepared to put their Signed-off-by to > this? Sure, I'd be happy to add my s-o-b. Signed-off-by: Jamie Iles <jamie@xxxxxxxxxxxxx> Thanks, Jamie -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html