rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: An issue was discovered in the Linux kernel before 4.18.7. In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace.
Vulnerability ID: CVE-2018-20855
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2019-07-26
File: drivers/infiniband/hw/mlx5/qp.c
Commit message: IB/mlx5: Fix leaking stack memory to userspace

mlx5_ib_create_qp_resp was never initialized and only the first 4 bytes
were written.

Fixes: 41d902cb7c32 ("RDMA/mlx5: Fix definition of mlx5_ib_create_qp_resp")
Cc: <stable@vger.kernel.org>
Acked-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Commit author: Jason Gunthorpe

Vulnerable version (before fix):
 static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd, 	struct mlx5_ib_resources *devr = &dev->devr; 	int inlen = MLX5_ST_SZ_BYTES(create_qp_in); 	struct mlx5_core_dev *mdev = dev->mdev; 	struct mlx5_ib_create_qp_resp resp; 	struct mlx5_ib_cq *send_cq; 	struct mlx5_ib_cq *recv_cq; 	unsigned long flags;

Fixed version (after fix):
 static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd, 	struct mlx5_ib_resources *devr = &dev->devr; 	int inlen = MLX5_ST_SZ_BYTES(create_qp_in); 	struct mlx5_core_dev *mdev = dev->mdev; 	struct mlx5_ib_create_qp_resp resp = {}; 	struct mlx5_ib_cq *send_cq; 	struct mlx5_ib_cq *recv_cq; 	unsigned long flags;

Patch:
patch: @@ -1607,7 +1607,7 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd,
 	struct mlx5_ib_resources *devr = &dev->devr;
 	int inlen = MLX5_ST_SZ_BYTES(create_qp_in);
 	struct mlx5_core_dev *mdev = dev->mdev;
-	struct mlx5_ib_create_qp_resp resp;
+	struct mlx5_ib_create_qp_resp resp = {};
 	struct mlx5_ib_cq *send_cq;
 	struct mlx5_ib_cq *recv_cq;
 	unsigned long flags;
path: drivers/infiniband/hw/mlx5/qp.c
Vulnerability: An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an __blk_drain_queue() use-after-free because a certain error case is mishandled.
Vulnerability ID: CVE-2018-20856
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2019-07-26
File: block/blk-core.c
Commit message: block: blk_init_allocated_queue() set q->fq as NULL in the fail case

We find the memory use-after-free issue in __blk_drain_queue()
on the kernel 4.14. After read the latest kernel 4.18-rc6 we
think it has the same problem.

Memory is allocated for q->fq in the blk_init_allocated_queue().
If the elevator init function called with error return, it will
run into the fail case to free the q->fq.

Then the __blk_drain_queue() uses the same memory after the free
of the q->fq, it will lead to the unpredictable event.

The patch is to set q->fq as NULL in the fail case of
blk_init_allocated_queue().

Fixes: commit 7c94e1c157a2 ("block: introduce blk_flush_queue to drive flush machinery")
Cc: <stable@vger.kernel.org>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
Signed-off-by: xiao jin <jin.xiao@intel.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Commit author: xiao jin

Vulnerable version (before fix):
 int blk_init_allocated_queue(struct request_queue *q) 		q->exit_rq_fn(q, q->fq->flush_rq); out_free_flush_queue: 	blk_free_flush_queue(q->fq); 	return -ENOMEM; } EXPORT_SYMBOL(blk_init_allocated_queue);

Fixed version (after fix):
 int blk_init_allocated_queue(struct request_queue *q) 		q->exit_rq_fn(q, q->fq->flush_rq); out_free_flush_queue: 	blk_free_flush_queue(q->fq); 	q->fq = NULL; 	return -ENOMEM; } EXPORT_SYMBOL(blk_init_allocated_queue);

Patch:
patch: @@ -1184,6 +1184,7 @@ int blk_init_allocated_queue(struct request_queue *q)
 		q->exit_rq_fn(q, q->fq->flush_rq);
 out_free_flush_queue:
 	blk_free_flush_queue(q->fq);
+	q->fq = NULL;
 	return -ENOMEM;
 }
 EXPORT_SYMBOL(blk_init_allocated_queue);
path: block/blk-core.c
Vulnerability: GPAC 0.7.1 has a memory leak in dinf_Read in isomedia/box_code_base.c.
Vulnerability ID: CVE-2018-21017
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2019-09-16
File: src/isomedia/box_code_base.c
Commit message: prevent dref memleak on invalid input (#1183)
Commit author: Aurelien David

Vulnerable version (before fix):
 GF_Err dinf_Read(GF_Box *s, GF_BitStream *bs) 		return e; 	} 	if (!((GF_DataInformationBox *)s)->dref) { 		GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] Missing dref box in dinf\n")); 		((GF_DataInformationBox *)s)->dref = (GF_DataReferenceBox *)gf_isom_box_new(GF_ISOM_BOX_TYPE_DREF); 	} 	return GF_OK; }

Fixed version (after fix):
 GF_Err dinf_Read(GF_Box *s, GF_BitStream *bs) 		return e; 	} 	if (!((GF_DataInformationBox *)s)->dref) { 		GF_Box* dref; 		GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] Missing dref box in dinf\n")); 		dref = gf_isom_box_new(GF_ISOM_BOX_TYPE_DREF); 		((GF_DataInformationBox *)s)->dref = (GF_DataReferenceBox *)dref; 		gf_isom_box_add_for_dump_mode(s, dref); 	} 	return GF_OK; }

Patch:
patch: @@ -931,8 +931,11 @@ GF_Err dinf_Read(GF_Box *s, GF_BitStream *bs)
 		return e;
 	}
 	if (!((GF_DataInformationBox *)s)->dref) {
+		GF_Box* dref;
 		GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] Missing dref box in dinf\n"));
-		((GF_DataInformationBox *)s)->dref = (GF_DataReferenceBox *)gf_isom_box_new(GF_ISOM_BOX_TYPE_DREF);
+		dref = gf_isom_box_new(GF_ISOM_BOX_TYPE_DREF);
+		((GF_DataInformationBox *)s)->dref = (GF_DataReferenceBox *)dref;
+		gf_isom_box_add_for_dump_mode(s, dref);
 	}
 	return GF_OK;
 }
path: src/isomedia/box_code_base.c
Vulnerability: In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c).
Vulnerability ID: CVE-2018-5332
CWE: CWE-787
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2018-01-11
File: net/rds/rdma.c
Commit message: RDS: Heap OOB write in rds_message_alloc_sgs()

When args->nr_local is 0, nr_pages gets also 0 due some size
calculation via rds_rm_size(), which is later used to allocate
pages for DMA, this bug produces a heap Out-Of-Bound write access
to a specific memory region.

Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mohamed Ghannam

Vulnerable version (before fix):
 int rds_rdma_extra_size(struct rds_rdma_args *args)  	local_vec = (struct rds_iovec __user *)(unsigned long) args->local_vec_addr;  	/* figure out the number of pages in the vector */ 	for (i = 0; i < args->nr_local; i++) { 		if (copy_from_user(&vec, &local_vec[i],

Fixed version (after fix):
 int rds_rdma_extra_size(struct rds_rdma_args *args)  	local_vec = (struct rds_iovec __user *)(unsigned long) args->local_vec_addr;  	if (args->nr_local == 0) 		return -EINVAL;  	/* figure out the number of pages in the vector */ 	for (i = 0; i < args->nr_local; i++) { 		if (copy_from_user(&vec, &local_vec[i],

Patch:
patch: @@ -525,6 +525,9 @@ int rds_rdma_extra_size(struct rds_rdma_args *args)
 
 	local_vec = (struct rds_iovec __user *)(unsigned long) args->local_vec_addr;
 
+	if (args->nr_local == 0)
+		return -EINVAL;
+
 	/* figure out the number of pages in the vector */
 	for (i = 0; i < args->nr_local; i++) {
 		if (copy_from_user(&vec, &local_vec[i],
path: net/rds/rdma.c
Vulnerability: In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference.
Vulnerability ID: CVE-2018-5333
CWE: CWE-476
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2018-01-11
File: net/rds/rdma.c
Commit message: RDS: null pointer dereference in rds_atomic_free_op

set rm->atomic.op_active to 0 when rds_pin_pages() fails
or the user supplied address is invalid,
this prevents a NULL pointer usage in rds_atomic_free_op()

Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mohamed Ghannam

Vulnerable version (before fix):
 int rds_cmsg_atomic(struct rds_sock *rs, struct rds_message *rm, err: 	if (page) 		put_page(page); 	kfree(rm->atomic.op_notifier);  	return ret;

Fixed version (after fix):
 int rds_cmsg_atomic(struct rds_sock *rs, struct rds_message *rm, err: 	if (page) 		put_page(page); 	rm->atomic.op_active = 0; 	kfree(rm->atomic.op_notifier);  	return ret;

Patch:
patch: @@ -877,6 +877,7 @@ int rds_cmsg_atomic(struct rds_sock *rs, struct rds_message *rm,
 err:
 	if (page)
 		put_page(page);
+	rm->atomic.op_active = 0;
 	kfree(rm->atomic.op_notifier);
 
 	return ret;
path: net/rds/rdma.c
Vulnerability: In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which allows attackers to cause a denial of service (__lock_acquire use-after-free) or possibly have unspecified other impact.
Vulnerability ID: CVE-2018-5344
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2018-01-12
File: drivers/block/loop.c
Commit message: loop: fix concurrent lo_open/lo_release

范龙飞 reports that KASAN can report a use-after-free in __lock_acquire.
The reason is due to insufficient serialization in lo_release(), which
will continue to use the loop device even after it has decremented the
lo_refcnt to zero.

In the meantime, another process can come in, open the loop device
again as it is being shut down. Confusion ensues.

Reported-by: 范龙飞 <long7573@126.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Commit author: Linus Torvalds

Vulnerable version (before fix):
 static int lo_open(struct block_device *bdev, fmode_t mode) 	return err; }  static void lo_release(struct gendisk *disk, fmode_t mode) { 	struct loop_device *lo = disk->private_data; 	int err;  	if (atomic_dec_return(&lo->lo_refcnt)) static void lo_release(struct gendisk *disk, fmode_t mode) 	mutex_unlock(&lo->lo_ctl_mutex); }  static const struct block_device_operations lo_fops = { 	.owner =	THIS_MODULE, 	.open =		lo_open,

Fixed version (after fix):
 static int lo_open(struct block_device *bdev, fmode_t mode) 	return err; }  static void __lo_release(struct loop_device *lo) { 	int err;  	if (atomic_dec_return(&lo->lo_refcnt)) static void lo_release(struct gendisk *disk, fmode_t mode) 	mutex_unlock(&lo->lo_ctl_mutex); }  static void lo_release(struct gendisk *disk, fmode_t mode) { 	mutex_lock(&loop_index_mutex); 	__lo_release(disk->private_data); 	mutex_unlock(&loop_index_mutex); }  static const struct block_device_operations lo_fops = { 	.owner =	THIS_MODULE, 	.open =		lo_open,

Patch:
patch: @@ -1581,9 +1581,8 @@ static int lo_open(struct block_device *bdev, fmode_t mode)
 	return err;
 }
 
-static void lo_release(struct gendisk *disk, fmode_t mode)
+static void __lo_release(struct loop_device *lo)
 {
-	struct loop_device *lo = disk->private_data;
 	int err;
 
 	if (atomic_dec_return(&lo->lo_refcnt))
@@ -1610,6 +1609,13 @@ static void lo_release(struct gendisk *disk, fmode_t mode)
 	mutex_unlock(&lo->lo_ctl_mutex);
 }
 
+static void lo_release(struct gendisk *disk, fmode_t mode)
+{
+	mutex_lock(&loop_index_mutex);
+	__lo_release(disk->private_data);
+	mutex_unlock(&loop_index_mutex);
+}
+
 static const struct block_device_operations lo_fops = {
 	.owner =	THIS_MODULE,
 	.open =		lo_open,
path: drivers/block/loop.c
Vulnerability: In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which allows attackers to cause a denial of service (__lock_acquire use-after-free) or possibly have unspecified other impact.
Vulnerability ID: CVE-2018-5344
CWE: CWE-362
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2018-01-12
File: drivers/block/loop.c
Commit message: loop: fix concurrent lo_open/lo_release

范龙飞 reports that KASAN can report a use-after-free in __lock_acquire.
The reason is due to insufficient serialization in lo_release(), which
will continue to use the loop device even after it has decremented the
lo_refcnt to zero.

In the meantime, another process can come in, open the loop device
again as it is being shut down. Confusion ensues.

Reported-by: 范龙飞 <long7573@126.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Commit author: Linus Torvalds

Vulnerable version (before fix):
 static int lo_open(struct block_device *bdev, fmode_t mode) 	return err; }  static void lo_release(struct gendisk *disk, fmode_t mode) { 	struct loop_device *lo = disk->private_data; 	int err;  	if (atomic_dec_return(&lo->lo_refcnt)) static void lo_release(struct gendisk *disk, fmode_t mode) 	mutex_unlock(&lo->lo_ctl_mutex); }  static const struct block_device_operations lo_fops = { 	.owner =	THIS_MODULE, 	.open =		lo_open,

Fixed version (after fix):
 static int lo_open(struct block_device *bdev, fmode_t mode) 	return err; }  static void __lo_release(struct loop_device *lo) { 	int err;  	if (atomic_dec_return(&lo->lo_refcnt)) static void lo_release(struct gendisk *disk, fmode_t mode) 	mutex_unlock(&lo->lo_ctl_mutex); }  static void lo_release(struct gendisk *disk, fmode_t mode) { 	mutex_lock(&loop_index_mutex); 	__lo_release(disk->private_data); 	mutex_unlock(&loop_index_mutex); }  static const struct block_device_operations lo_fops = { 	.owner =	THIS_MODULE, 	.open =		lo_open,

Patch:
patch: @@ -1581,9 +1581,8 @@ static int lo_open(struct block_device *bdev, fmode_t mode)
 	return err;
 }
 
-static void lo_release(struct gendisk *disk, fmode_t mode)
+static void __lo_release(struct loop_device *lo)
 {
-	struct loop_device *lo = disk->private_data;
 	int err;
 
 	if (atomic_dec_return(&lo->lo_refcnt))
@@ -1610,6 +1609,13 @@ static void lo_release(struct gendisk *disk, fmode_t mode)
 	mutex_unlock(&lo->lo_ctl_mutex);
 }
 
+static void lo_release(struct gendisk *disk, fmode_t mode)
+{
+	mutex_lock(&loop_index_mutex);
+	__lo_release(disk->private_data);
+	mutex_unlock(&loop_index_mutex);
+}
+
 static const struct block_device_operations lo_fops = {
 	.owner =	THIS_MODULE,
 	.open =		lo_open,
path: drivers/block/loop.c
Vulnerability: ILIAS before 5.2.4 has XSS via the cmd parameter to the displayHeader function in setup/classes/class.ilSetupGUI.php in the Setup component.
Vulnerability ID: CVE-2018-5688
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/ILIAS-eLearning/ILIAS
Published: 2018-01-14
File: setup/classes/class.ilSetupGUI.php
Commit message: Fixed output of "cmd" parameter

(cherry picked from commit 2106df4)
Commit author: mjansen

Vulnerable version (before fix):
 function displayHeader() 			} 		}  		$this->tpl->setVariable("VAL_CMD", $_GET["cmd"]); 		$this->tpl->setVariable("TXT_OK",$this->lng->txt("change")); 		$this->tpl->setVariable("TXT_CHOOSE_LANGUAGE",$this->lng->txt("choose_language")); 		$this->tpl->setVariable("PAGETITLE","Setup");

Fixed version (after fix):
 function displayHeader() 			} 		}  		$this->tpl->setVariable("VAL_CMD", htmlspecialchars($_GET["cmd"])); 		$this->tpl->setVariable("TXT_OK",$this->lng->txt("change")); 		$this->tpl->setVariable("TXT_CHOOSE_LANGUAGE",$this->lng->txt("choose_language")); 		$this->tpl->setVariable("PAGETITLE","Setup");

Patch:
patch: @@ -596,7 +596,7 @@ function displayHeader()
 			}
 		}
 
-		$this->tpl->setVariable("VAL_CMD", $_GET["cmd"]);
+		$this->tpl->setVariable("VAL_CMD", htmlspecialchars($_GET["cmd"]));
 		$this->tpl->setVariable("TXT_OK",$this->lng->txt("change"));
 		$this->tpl->setVariable("TXT_CHOOSE_LANGUAGE",$this->lng->txt("choose_language"));
 		$this->tpl->setVariable("PAGETITLE","Setup");
path: setup/classes/class.ilSetupGUI.php
Vulnerability: An issue was discovered in the __ns_get_path function in fs/nsfs.c in the Linux kernel before 4.11. Due to a race condition when accessing files, a Use After Free condition can occur. This also affects all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-07-05.
Vulnerability ID: CVE-2018-5873
CWE: CWE-416
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2018-07-06
File: fs/nsfs.c
Commit message: nsfs: mark dentry with DCACHE_RCUACCESS

Andrey reported a use-after-free in __ns_get_path():

  spin_lock include/linux/spinlock.h:299 [inline]
  lockref_get_not_dead+0x19/0x80 lib/lockref.c:179
  __ns_get_path+0x197/0x860 fs/nsfs.c:66
  open_related_ns+0xda/0x200 fs/nsfs.c:143
  sock_ioctl+0x39d/0x440 net/socket.c:1001
  vfs_ioctl fs/ioctl.c:45 [inline]
  do_vfs_ioctl+0x1bf/0x1780 fs/ioctl.c:685
  SYSC_ioctl fs/ioctl.c:700 [inline]
  SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691

We are under rcu read lock protection at that point:

        rcu_read_lock();
        d = atomic_long_read(&ns->stashed);
        if (!d)
                goto slow;
        dentry = (struct dentry *)d;
        if (!lockref_get_not_dead(&dentry->d_lockref))
                goto slow;
        rcu_read_unlock();

but don't use a proper RCU API on the free path, therefore a parallel
__d_free() could free it at the same time.  We need to mark the stashed
dentry with DCACHE_RCUACCESS so that __d_free() will be called after all
readers leave RCU.

Fixes: e149ed2b805f ("take the targets of /proc/*/ns/* symlinks to separate fs")
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Cong Wang

Vulnerable version (before fix):
 static void *__ns_get_path(struct path *path, struct ns_common *ns) 		return ERR_PTR(-ENOMEM); 	} 	d_instantiate(dentry, inode); 	dentry->d_fsdata = (void *)ns->ops; 	d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry); 	if (d) {

Fixed version (after fix):
 static void *__ns_get_path(struct path *path, struct ns_common *ns) 		return ERR_PTR(-ENOMEM); 	} 	d_instantiate(dentry, inode); 	dentry->d_flags |= DCACHE_RCUACCESS; 	dentry->d_fsdata = (void *)ns->ops; 	d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry); 	if (d) {

Patch:
patch: @@ -91,6 +91,7 @@ static void *__ns_get_path(struct path *path, struct ns_common *ns)
 		return ERR_PTR(-ENOMEM);
 	}
 	d_instantiate(dentry, inode);
+	dentry->d_flags |= DCACHE_RCUACCESS;
 	dentry->d_fsdata = (void *)ns->ops;
 	d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry);
 	if (d) {
path: fs/nsfs.c
Vulnerability: An issue was discovered in the __ns_get_path function in fs/nsfs.c in the Linux kernel before 4.11. Due to a race condition when accessing files, a Use After Free condition can occur. This also affects all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-07-05.
Vulnerability ID: CVE-2018-5873
CWE: CWE-362
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2018-07-06
File: fs/nsfs.c
Commit message: nsfs: mark dentry with DCACHE_RCUACCESS

Andrey reported a use-after-free in __ns_get_path():

  spin_lock include/linux/spinlock.h:299 [inline]
  lockref_get_not_dead+0x19/0x80 lib/lockref.c:179
  __ns_get_path+0x197/0x860 fs/nsfs.c:66
  open_related_ns+0xda/0x200 fs/nsfs.c:143
  sock_ioctl+0x39d/0x440 net/socket.c:1001
  vfs_ioctl fs/ioctl.c:45 [inline]
  do_vfs_ioctl+0x1bf/0x1780 fs/ioctl.c:685
  SYSC_ioctl fs/ioctl.c:700 [inline]
  SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691

We are under rcu read lock protection at that point:

        rcu_read_lock();
        d = atomic_long_read(&ns->stashed);
        if (!d)
                goto slow;
        dentry = (struct dentry *)d;
        if (!lockref_get_not_dead(&dentry->d_lockref))
                goto slow;
        rcu_read_unlock();

but don't use a proper RCU API on the free path, therefore a parallel
__d_free() could free it at the same time.  We need to mark the stashed
dentry with DCACHE_RCUACCESS so that __d_free() will be called after all
readers leave RCU.

Fixes: e149ed2b805f ("take the targets of /proc/*/ns/* symlinks to separate fs")
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Cong Wang

Vulnerable version (before fix):
 static void *__ns_get_path(struct path *path, struct ns_common *ns) 		return ERR_PTR(-ENOMEM); 	} 	d_instantiate(dentry, inode); 	dentry->d_fsdata = (void *)ns->ops; 	d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry); 	if (d) {

Fixed version (after fix):
 static void *__ns_get_path(struct path *path, struct ns_common *ns) 		return ERR_PTR(-ENOMEM); 	} 	d_instantiate(dentry, inode); 	dentry->d_flags |= DCACHE_RCUACCESS; 	dentry->d_fsdata = (void *)ns->ops; 	d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry); 	if (d) {

Patch:
patch: @@ -91,6 +91,7 @@ static void *__ns_get_path(struct path *path, struct ns_common *ns)
 		return ERR_PTR(-ENOMEM);
 	}
 	d_instantiate(dentry, inode);
+	dentry->d_flags |= DCACHE_RCUACCESS;
 	dentry->d_fsdata = (void *)ns->ops;
 	d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry);
 	if (d) {
path: fs/nsfs.c
Vulnerability: w3m through 0.5.3 is prone to a NULL pointer dereference flaw in formUpdateBuffer in form.c.
Vulnerability ID: CVE-2018-6197
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/tats/w3m
Published: 2018-01-25
File: form.c
Commit message: Prevent invalid columnPos() call in formUpdateBuffer()

Bug-Debian: https://github.com/tats/w3m/issues/89
Commit author: Tatsuya Kinoshita

Vulnerable version (before fix):
 formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form) 	rows = form->rows ? form->rows : 1; 	col = COLPOS(l, a->start.pos); 	for (c_rows = 0; c_rows < rows; c_rows++, l = l->next) { 	    if (rows > 1) { 		pos = columnPos(l, col); 		a = retrieveAnchor(buf->formitem, l->linenumber, pos);

Fixed version (after fix):
 formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form) 	rows = form->rows ? form->rows : 1; 	col = COLPOS(l, a->start.pos); 	for (c_rows = 0; c_rows < rows; c_rows++, l = l->next) { 	    if (l == NULL) 		break; 	    if (rows > 1) { 		pos = columnPos(l, col); 		a = retrieveAnchor(buf->formitem, l->linenumber, pos);

Patch:
patch: @@ -482,6 +482,8 @@ formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form)
 	rows = form->rows ? form->rows : 1;
 	col = COLPOS(l, a->start.pos);
 	for (c_rows = 0; c_rows < rows; c_rows++, l = l->next) {
+	    if (l == NULL)
+		break;
 	    if (rows > 1) {
 		pos = columnPos(l, col);
 		a = retrieveAnchor(buf->formitem, l->linenumber, pos);
path: form.c