{"push_id":1941104082,"size":64,"distinct_size":64,"ref":"refs/heads/cm-14.1","head":"c13267a9d8d90e9a6ba757e622b854c30e7a38c2","before":"11c2e4ef00d3d3c573bc2810a5f8b409b46801ee","commits":[{"sha":"148ee57ec9be7d6fcf237fa47a3d441555c9efe0","author":{"name":"Benjamin LaHaise","email":"43ac650fcde57211c9587717a64b867c0d6ca25b@kvack.org"},"message":"aio: fix kernel memory disclosure in io_getevents() introduced in v3.10\n\ncommit edfbbf388f293d70bf4b7c0bc38774d05e6f711a upstream.\n\nA kernel memory disclosure was introduced in aio_read_events_ring() in v3.10\nby commit a31ad380bed817aa25f8830ad23e1a0480fef797.  The changes made to\naio_read_events_ring() failed to correctly limit the index into\nctx->ring_pages[], allowing an attacked to cause the subsequent kmap() of\nan arbitrary page with a copy_to_user() to copy the contents into userspace.\nThis vulnerability has been assigned CVE-2014-0206.  Thanks to Mateusz and\nPetr for disclosing this issue.\n\nThis patch applies to v3.12+.  A separate backport is needed for 3.10/3.11.\n\n[jmoyer@redhat.com: backported to 3.10]\nSigned-off-by: Benjamin LaHaise <bcrl@kvack.org>\nSigned-off-by: Jeff Moyer <jmoyer@redhat.com>\nCc: Mateusz Guzik <mguzik@redhat.com>\nCc: Petr Matousek <pmatouse@redhat.com>\nCc: Kent Overstreet <kmo@daterainc.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nChange-Id: I4f48da7babcb30ab635c021ea4b636b93638c414","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/148ee57ec9be7d6fcf237fa47a3d441555c9efe0"},{"sha":"7f7cc36b07bced1187acf882b159bd180233d683","author":{"name":"Mathias Krause","email":"c0f5a800b69cdfd927790b9eec175d77c6a1b20d@googlemail.com"},"message":"filter: prevent nla extensions to peek beyond the end of the message\n\n[ Upstream commit 05ab8f2647e4221cbdb3856dd7d32bd5407316b3 ]\n\nThe BPF_S_ANC_NLATTR and BPF_S_ANC_NLATTR_NEST extensions fail to check\nfor a minimal message length before testing the supplied offset to be\nwithin the bounds of the message. This allows the subtraction of the nla\nheader to underflow and therefore -- as the data type is unsigned --\nallowing far to big offset and length values for the search of the\nnetlink attribute.\n\nThe remainder calculation for the BPF_S_ANC_NLATTR_NEST extension is\nalso wrong. It has the minuend and subtrahend mixed up, therefore\ncalculates a huge length value, allowing to overrun the end of the\nmessage while looking for the netlink attribute.\n\nThe following three BPF snippets will trigger the bugs when attached to\na UNIX datagram socket and parsing a message with length 1, 2 or 3.\n\n ,-[ PoC for missing size check in BPF_S_ANC_NLATTR ]--\n | ld\t#0x87654321\n | ldx\t#42\n | ld\t#nla\n | ret\ta\n `---\n\n ,-[ PoC for the same bug in BPF_S_ANC_NLATTR_NEST ]--\n | ld\t#0x87654321\n | ldx\t#42\n | ld\t#nlan\n | ret\ta\n `---\n\n ,-[ PoC for wrong remainder calculation in BPF_S_ANC_NLATTR_NEST ]--\n | ; (needs a fake netlink header at offset 0)\n | ld\t#0\n | ldx\t#42\n | ld\t#nlan\n | ret\ta\n `---\n\nFix the first issue by ensuring the message length fulfills the minimal\nsize constrains of a nla header. Fix the second bug by getting the math\nfor the remainder calculation right.\n\nFixes: 4738c1db15 (\"[SKFILTER]: Add SKF_ADF_NLATTR instruction\")\nFixes: d214c7537b (\"filter: add SKF_AD_NLATTR_NEST to look for nested..\")\nChange-Id: I07aa0d8f3584b5540e1937818b153014b6c2b734\nCc: Patrick McHardy <kaber@trash.net>\nCc: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nAcked-by: Daniel Borkmann <dborkman@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/7f7cc36b07bced1187acf882b159bd180233d683"},{"sha":"63350fb827a12d641e6d8876daa3735ed74e5bf2","author":{"name":"Andy Lutomirski","email":"3cb7d5a8804519b67b2d7945dee31e85c91c02f9@amacapital.net"},"message":"fs: Add a missing permission check to do_umount\n\ncommit a1480dcc3c706e309a88884723446f2e84fedd5b upstream.\n\nAccessing do_remount_sb should require global CAP_SYS_ADMIN, but\nonly one of the two call sites was appropriately protected.\n\nFixes CVE-2014-7975.\n\nChange-Id: I069fde894d1b7e4af84e3ae25ca10224ee5119a0\nSigned-off-by: Andy Lutomirski <luto@amacapital.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/63350fb827a12d641e6d8876daa3735ed74e5bf2"},{"sha":"78e307d69e4e5747518cd0793585f77a6636b624","author":{"name":"Jan Kara","email":"7bb7087018cc5fef3c041f6f038f586664845dbf@suse.cz"},"message":"isofs: Fix infinite looping over CE entries\n\nRock Ridge extensions define so called Continuation Entries (CE) which\ndefine where is further space with Rock Ridge data. Corrupted isofs\nimage can contain arbitrarily long chain of these, including a one\ncontaining loop and thus causing kernel to end in an infinite loop when\ntraversing these entries.\n\nLimit the traversal to 32 entries which should be more than enough space\nto store all the Rock Ridge data.\n\nChange-Id: Id08c1fe0909aebebdaa0cfe7a47e20365e206c33\nReported-by: P J P <ppandit@redhat.com>\nCC: stable@vger.kernel.org\nSigned-off-by: Jan Kara <jack@suse.cz>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/78e307d69e4e5747518cd0793585f77a6636b624"},{"sha":"ac2654bef69a0a058d0d60b36eb86f231e9c77f0","author":{"name":"Jan Kara","email":"7bb7087018cc5fef3c041f6f038f586664845dbf@suse.cz"},"message":"udf: Check path length when reading symlink\n\nSymlink reading code does not check whether the resulting path fits into\nthe page provided by the generic code. This isn't as easy as just\nchecking the symlink size because of various encoding conversions we\nperform on path. So we have to check whether there is still enough space\nin the buffer on the fly.\n\nChange-Id: Ia564db91025af49fe5e7fb5cec3009b9bbed272f\nCC: stable@vger.kernel.org\nReported-by: Carl Henrik Lunde <chlunde@ping.uio.no>\nSigned-off-by: Jan Kara <jack@suse.cz>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/ac2654bef69a0a058d0d60b36eb86f231e9c77f0"},{"sha":"3cf3233d9072fb7a6581b837b83abb8dd6813588","author":{"name":"Miklos Szeredi","email":"c27ee2952768e22f4d3ab9aec0e78ac5f4ddea98@suse.cz"},"message":"BACKPORT: fs: limit filesystem stacking depth\n\nAdd a simple read-only counter to super_block that indicates how deep this\nis in the stack of filesystems.  Previously ecryptfs was the only stackable\nfilesystem and it explicitly disallowed multiple layers of itself.\n\nOverlayfs, however, can be stacked recursively and also may be stacked\non top of ecryptfs or vice versa.\n\nTo limit the kernel stack usage we must limit the depth of the\nfilesystem stack.  Initially the limit is set to 2.\n\nSigned-off-by: Miklos Szeredi <mszeredi@suse.cz>\n\n(cherry picked from commit 69c433ed2ecd2d3264efd7afec4439524b319121)\n\nBug: 32761463\nChange-Id: I69b2fba2112db2ece09a1bf61a44f8fc4db00820","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/3cf3233d9072fb7a6581b837b83abb8dd6813588"},{"sha":"ec07acc53d5c888f554132b95ce17d29ba56718f","author":{"name":"Seung-Woo Kim","email":"deea41885100c1970976e08c89d7c5783582068c@samsung.com"},"message":"regulator: core: Fix regualtor_ena_gpio_free not to access pin after freeing\n\nAfter freeing pin from regulator_ena_gpio_free, loop can access\nthe pin. So this patch fixes not to access pin after freeing.\n\nChange-Id: Ibffe7b69608a2a662548f7ffbaf73726760ceba4\nSigned-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/ec07acc53d5c888f554132b95ce17d29ba56718f"},{"sha":"4e39527f402dc3d0f6c32f2c9e98524c47f60371","author":{"name":"Sasha Levin","email":"3eff170737f7f759a98f81ff6bf07d3c251c0277@oracle.com"},"message":"vfs: read file_handle only once in handle_to_path\n\nWe used to read file_handle twice. Once to get the amount of extra bytes, and\nonce to fetch the entire structure.\n\nThis may be problematic since we do size verifications only after the first\nread, so if the number of extra bytes changes in userspace between the first\nand second calls, we'll have an incoherent view of file_handle.\n\nInstead, read the constant size once, and copy that over to the final\nstructure without having to re-read it again.\n\nChange-Id: Ib05e5129629e27d5a05953098c5bc470fae40d2a\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/4e39527f402dc3d0f6c32f2c9e98524c47f60371"},{"sha":"141335968a7ff6e6bcd01c5b44326328a8e39bbb","author":{"name":"Sasha Levin","email":"3eff170737f7f759a98f81ff6bf07d3c251c0277@oracle.com"},"message":"net: llc: use correct size for sysctl timeout entries\n\nThe timeout entries are sizeof(int) rather than sizeof(long), which\nmeans that when they were getting read we'd also leak kernel memory\nto userspace along with the timeout values.\n\nChange-Id: I328d1186720a6f70f555eeeb62c83ee69814868d\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/141335968a7ff6e6bcd01c5b44326328a8e39bbb"},{"sha":"493a8b6b59b323501572854230b94295eb236d12","author":{"name":"Vladis Dronov","email":"41435c47c64e54f8ec26bbc1be6d7972ea4d40bd@redhat.com"},"message":"Input: aiptek - fix crash on detecting device without endpoints\n\nThe aiptek driver crashes in aiptek_probe() when a specially crafted USB\ndevice without endpoints is detected. This fix adds a check that the device\nhas proper configuration expected by the driver. Also an error return value\nis changed to more matching one in one of the error paths.\n\nChange-Id: I02fa4ffcbe9a71948947ef5baeb72632688d9d07\nReported-by: Ralf Spenneberg <ralf@spenneberg.net>\nSigned-off-by: Vladis Dronov <vdronov@redhat.com>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/493a8b6b59b323501572854230b94295eb236d12"},{"sha":"4cca6f40a15d86a7194dc063064c582acd9d830e","author":{"name":"Ben Hutchings","email":"9c85637c38b80821c7bd8a03bde7b59da81ab77d@decadent.org.uk"},"message":"ppp, slip: Validate VJ compression slot parameters completely\n\n[ Upstream commit 4ab42d78e37a294ac7bc56901d563c642e03c4ae ]\n\nCurrently slhc_init() treats out-of-range values of rslots and tslots\nas equivalent to 0, except that if tslots is too large it will\ndereference a null pointer (CVE-2015-7799).\n\nAdd a range-check at the top of the function and make it return an\nERR_PTR() on error instead of NULL.  Change the callers accordingly.\n\nCompile-tested only.\n\nChange-Id: I1c363f17e89bec3d213658d2c9daeab88d2905ae\nReported-by: 郭永刚 <guoyonggang@360.cn>\nReferences: http://article.gmane.org/gmane.comp.security.oss.general/17908\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/4cca6f40a15d86a7194dc063064c582acd9d830e"},{"sha":"1714e739e23c7e2e44746a857f89526078d8c788","author":{"name":"Marcelo Leitner","email":"b3eee6f47d823c4a37944c0e1e38042365283bcf@redhat.com"},"message":"ipv6: addrconf: validate new MTU before applying it\n\ncommit 77751427a1ff25b27d47a4c36b12c3c8667855ac upstream.\n\nCurrently we don't check if the new MTU is valid or not and this allows\none to configure a smaller than minimum allowed by RFCs or even bigger\nthan interface own MTU, which is a problem as it may lead to packet\ndrops.\n\nIf you have a daemon like NetworkManager running, this may be exploited\nby remote attackers by forging RA packets with an invalid MTU, possibly\nleading to a DoS. (NetworkManager currently only validates for values\ntoo small, but not for too big ones.)\n\nThe fix is just to make sure the new value is valid. That is, between\nIPV6_MIN_MTU and interface's MTU.\n\nNote that similar check is already performed at\nndisc_router_discovery(), for when kernel itself parses the RA.\n\nChange-Id: I81cf7572f96f1844cc6bb033500b8cedbc0b186f\nSigned-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com>\nSigned-off-by: Sabrina Dubroca <sd@queasysnail.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/1714e739e23c7e2e44746a857f89526078d8c788"},{"sha":"c1cf8501bdb6a8663c8fdb5372a1458e11f9e96d","author":{"name":"Roman Gushchin","email":"f505efce8158e7e50be506e8fb337100eec9e897@yandex-team.ru"},"message":"fuse: break infinite loop in fuse_fill_write_pages()\n\ncommit 3ca8138f014a913f98e6ef40e939868e1e9ea876 upstream.\n\nI got a report about unkillable task eating CPU. Further\ninvestigation shows, that the problem is in the fuse_fill_write_pages()\nfunction. If iov's first segment has zero length, we get an infinite\nloop, because we never reach iov_iter_advance() call.\n\nFix this by calling iov_iter_advance() before repeating an attempt to\ncopy data from userspace.\n\nA similar problem is described in 124d3b7041f (\"fix writev regression:\npan hanging unkillable and un-straceable\"). If zero-length segmend\nis followed by segment with invalid address,\niov_iter_fault_in_readable() checks only first segment (zero-length),\niov_iter_copy_from_user_atomic() skips it, fails at second and\nreturns zero -> goto again without skipping zero-length segment.\n\nPatch calls iov_iter_advance() before goto again: we'll skip zero-length\nsegment at second iteraction and iov_iter_fault_in_readable() will detect\ninvalid address.\n\nSpecial thanks to Konstantin Khlebnikov, who helped a lot with the commit\ndescription.\n\nConflicts:\n\tfs/fuse/file.c\n\nChange-Id: If1112e238627fec6fc94d09d339ea0a6140e5a1a\nCc: Andrew Morton <akpm@linux-foundation.org>\nCc: Maxim Patlasov <mpatlasov@parallels.com>\nCc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>\nSigned-off-by: Roman Gushchin <klamm@yandex-team.ru>\nSigned-off-by: Miklos Szeredi <miklos@szeredi.hu>\nFixes: ea9b9907b82a (\"fuse: implement perform_write\")\nCc: <stable@vger.kernel.org>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/c1cf8501bdb6a8663c8fdb5372a1458e11f9e96d"},{"sha":"0e7b8ea1c96138de6d634c4a3f9b4f0a67fa17f5","author":{"name":"Nick Desaulniers","email":"b951273a67bf33267cd4dff69171cdef4e5efbe7@google.com"},"message":"fs: ext4: disable support for fallocate FALLOC_FL_PUNCH_HOLE\n\nBug: 28760453\nChange-Id: I019c2de559db9e4b95860ab852211b456d78c4ca\nSigned-off-by: Nick Desaulniers <ndesaulniers@google.com>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/0e7b8ea1c96138de6d634c4a3f9b4f0a67fa17f5"},{"sha":"3fe9305dee9a1251f5eec8935468254c87fdf30b","author":{"name":"Lukas Czerner","email":"6fc09532a9146f7083562515354b6edd42e64baf@redhat.com"},"message":"ext4: fix NULL pointer dereference when journal restart fails\n\nCurrently when journal restart fails, we'll have the h_transaction of\nthe handle set to NULL to indicate that the handle has been effectively\naborted. We handle this situation quietly in the jbd2_journal_stop() and just\nfree the handle and exit because everything else has been done before we\nattempted (and failed) to restart the journal.\n\nUnfortunately there are a number of problems with that approach\nintroduced with commit\n\n41a5b913197c \"jbd2: invalidate handle if jbd2_journal_restart()\nfails\"\n\nFirst of all in ext4 jbd2_journal_stop() will be called through\n__ext4_journal_stop() where we would try to get a hold of the superblock\nby dereferencing h_transaction which in this case would lead to NULL\npointer dereference and crash.\n\nIn addition we're going to free the handle regardless of the refcount\nwhich is bad as well, because others up the call chain will still\nreference the handle so we might potentially reference already freed\nmemory.\n\nMoreover it's expected that we'll get aborted handle as well as detached\nhandle in some of the journalling function as the error propagates up\nthe stack, so it's unnecessary to call WARN_ON every time we get\ndetached handle.\n\nAnd finally we might leak some memory by forgetting to free reserved\nhandle in jbd2_journal_stop() in the case where handle was detached from\nthe transaction (h_transaction is NULL).\n\nFix the NULL pointer dereference in __ext4_journal_stop() by just\ncalling jbd2_journal_stop() quietly as suggested by Jan Kara. Also fix\nthe potential memory leak in jbd2_journal_stop() and use proper\nhandle refcounting before we attempt to free it to avoid use-after-free\nissues.\n\nAnd finally remove all WARN_ON(!transaction) from the code so that we do\nnot get random traces when something goes wrong because when journal\nrestart fails we will get to some of those functions.\n\nChange-Id: Ibd421c134b9d91a5d47868559e4b04d1d8646b95\nCc: stable@vger.kernel.org\nSigned-off-by: Lukas Czerner <lczerner@redhat.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nReviewed-by: Jan Kara <jack@suse.cz>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/3fe9305dee9a1251f5eec8935468254c87fdf30b"},{"sha":"c6c38dcfcb1772858abf41f0d86b6caf29f8879e","author":{"name":"Calvin Owens","email":"114f95235b01701def87f33797e11d10e01315ab@fb.com"},"message":"sg: Fix double-free when drives detach during SG_IO\n\nIn sg_common_write(), we free the block request and return -ENODEV if\nthe device is detached in the middle of the SG_IO ioctl().\n\nUnfortunately, sg_finish_rem_req() also tries to free srp->rq, so we\nend up freeing rq->cmd in the already free rq object, and then free\nthe object itself out from under the current user.\n\nThis ends up corrupting random memory via the list_head on the rq\nobject. The most common crash trace I saw is this:\n\n  ------------[ cut here ]------------\n  kernel BUG at block/blk-core.c:1420!\n  Call Trace:\n  [<ffffffff81281eab>] blk_put_request+0x5b/0x80\n  [<ffffffffa0069e5b>] sg_finish_rem_req+0x6b/0x120 [sg]\n  [<ffffffffa006bcb9>] sg_common_write.isra.14+0x459/0x5a0 [sg]\n  [<ffffffff8125b328>] ? selinux_file_alloc_security+0x48/0x70\n  [<ffffffffa006bf95>] sg_new_write.isra.17+0x195/0x2d0 [sg]\n  [<ffffffffa006cef4>] sg_ioctl+0x644/0xdb0 [sg]\n  [<ffffffff81170f80>] do_vfs_ioctl+0x90/0x520\n  [<ffffffff81258967>] ? file_has_perm+0x97/0xb0\n  [<ffffffff811714a1>] SyS_ioctl+0x91/0xb0\n  [<ffffffff81602afb>] tracesys+0xdd/0xe2\n    RIP [<ffffffff81281e04>] __blk_put_request+0x154/0x1a0\n\nThe solution is straightforward: just set srp->rq to NULL in the\nfailure branch so that sg_finish_rem_req() doesn't attempt to re-free\nit.\n\nAdditionally, since sg_rq_end_io() will never be called on the object\nwhen this happens, we need to free memory backing ->cmd if it isn't\nembedded in the object itself.\n\nKASAN was extremely helpful in finding the root cause of this bug.\n\nChange-Id: I9bd6648810516bc4969ac1646435d9d5b776d8de\nSigned-off-by: Calvin Owens <calvinowens@fb.com>\nAcked-by: Douglas Gilbert <dgilbert@interlog.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Corinna Vinschen <xda@vinschen.de>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/c6c38dcfcb1772858abf41f0d86b6caf29f8879e"},{"sha":"d9ef9b0fd128bef7e08e6c5f30a5ac453ac43c03","author":{"name":"Peter Zijlstra","email":"4d3106856cce90e8f40acc5180f60ddda3a23b6e@infradead.org"},"message":"perf: Tighten (and fix) the grouping condition\n\nThe fix from 9fc81d87420d (\"perf: Fix events installation during\nmoving group\") was incomplete in that it failed to recognise that\ncreating a group with events for different CPUs is semantically\nbroken -- they cannot be co-scheduled.\n\nFurthermore, it leads to real breakage where, when we create an event\nfor CPU Y and then migrate it to form a group on CPU X, the code gets\nconfused where the counter is programmed -- triggered in practice\nas well by me via the perf fuzzer.\n\nFix this by tightening the rules for creating groups. Only allow\ngrouping of counters that can be co-scheduled in the same context.\nThis means for the same task and/or the same cpu.\n\nChange-Id: I01d7b24b44fff039e72c80cca7f70158fa354470\nFixes: 9fc81d87420d (\"perf: Fix events installation during moving group\")\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Arnaldo Carvalho de Melo <acme@kernel.org>\nCc: Jiri Olsa <jolsa@redhat.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nLink: http://lkml.kernel.org/r/20150123125834.090683288@infradead.org\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>\nGit-commit: c3c87e770458aa004bd7ed3f29945ff436fd6511\nGit-repo: http://git.kernel.org/cgit/linux/kernel/git/tip/tip.git\nSigned-off-by: Patrick Fay <pfay@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/d9ef9b0fd128bef7e08e6c5f30a5ac453ac43c03"},{"sha":"688cee81caf53296f00b38b25a6da80d2ecfe16a","author":{"name":"Nick Desaulniers","email":"b951273a67bf33267cd4dff69171cdef4e5efbe7@google.com"},"message":"BACKPORT: aio: mark AIO pseudo-fs noexec\n\nThis ensures that do_mmap() won't implicitly make AIO memory mappings\nexecutable if the READ_IMPLIES_EXEC personality flag is set.  Such\nbehavior is problematic because the security_mmap_file LSM hook doesn't\ncatch this case, potentially permitting an attacker to bypass a W^X\npolicy enforced by SELinux.\n\nI have tested the patch on my machine.\n\nTo test the behavior, compile and run this:\n\n    #define _GNU_SOURCE\n    #include <unistd.h>\n    #include <sys/personality.h>\n    #include <linux/aio_abi.h>\n    #include <err.h>\n    #include <stdlib.h>\n    #include <stdio.h>\n    #include <sys/syscall.h>\n\n    int main(void) {\n        personality(READ_IMPLIES_EXEC);\n        aio_context_t ctx = 0;\n        if (syscall(__NR_io_setup, 1, &ctx))\n            err(1, \"io_setup\");\n\n        char cmd[1000];\n        sprintf(cmd, \"cat /proc/%d/maps | grep -F '/[aio]'\",\n            (int)getpid());\n        system(cmd);\n        return 0;\n    }\n\nIn the output, \"rw-s\" is good, \"rwxs\" is bad.\n\nSigned-off-by: Jann Horn <jann@thejh.net>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n(cherry picked from commit 22f6b4d34fcf039c63a94e7670e0da24f8575a5a)\n\nBug: 31711619\nChange-Id: I9f2872703bef240d6b82320c744529459bb076dc","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/688cee81caf53296f00b38b25a6da80d2ecfe16a"},{"sha":"56606aa0e132b5da25a1ffdf87e60964020fa354","author":{"name":"Ilya Dryomov","email":"ad0e6692b7885e8fd4eaec2423c74ce4fd4304dd@gmail.com"},"message":"libceph: introduce ceph_crypt() for in-place en/decryption\n\nStarting with 4.9, kernel stacks may be vmalloced and therefore not\nguaranteed to be physically contiguous; the new CONFIG_VMAP_STACK\noption is enabled by default on x86.  This makes it invalid to use\non-stack buffers with the crypto scatterlist API, as sg_set_buf()\nexpects a logical address and won't work with vmalloced addresses.\n\nThere isn't a different (e.g. kvec-based) crypto API we could switch\nnet/ceph/crypto.c to and the current scatterlist.h API isn't getting\nupdated to accommodate this use case.  Allocating a new header and\npadding for each operation is a non-starter, so do the en/decryption\nin-place on a single pre-assembled (header + data + padding) heap\nbuffer.  This is explicitly supported by the crypto API:\n\n    \"... the caller may provide the same scatter/gather list for the\n     plaintext and cipher text. After the completion of the cipher\n     operation, the plaintext data is replaced with the ciphertext data\n     in case of an encryption and vice versa for a decryption.\"\n\nChange-Id: I554cae76340899bb6f00e2e06230f3a27da186a1\nSigned-off-by: Ilya Dryomov <idryomov@gmail.com>\nReviewed-by: Sage Weil <sage@redhat.com>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/56606aa0e132b5da25a1ffdf87e60964020fa354"},{"sha":"57a5e1ff3749eec2aa7f9f50c99450b459076b6d","author":{"name":"Guillaume Nault","email":"3f2beb9890afcf959ec304431b991035a559d9bd@alphalink.fr"},"message":"l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind()\n\nLock socket before checking the SOCK_ZAPPED flag in l2tp_ip6_bind().\nWithout lock, a concurrent call could modify the socket flags between\nthe sock_flag(sk, SOCK_ZAPPED) test and the lock_sock() call. This way,\na socket could be inserted twice in l2tp_ip6_bind_table. Releasing it\nwould then leave a stale pointer there, generating use-after-free\nerrors when walking through the list or modifying adjacent entries.\n\nBUG: KASAN: use-after-free in l2tp_ip6_close+0x22e/0x290 at addr ffff8800081b0ed8\nWrite of size 8 by task syz-executor/10987\nCPU: 0 PID: 10987 Comm: syz-executor Not tainted 4.8.0+ #39\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014\n ffff880031d97838 ffffffff829f835b ffff88001b5a1640 ffff8800081b0ec0\n ffff8800081b15a0 ffff8800081b6d20 ffff880031d97860 ffffffff8174d3cc\n ffff880031d978f0 ffff8800081b0e80 ffff88001b5a1640 ffff880031d978e0\nCall Trace:\n [<ffffffff829f835b>] dump_stack+0xb3/0x118 lib/dump_stack.c:15\n [<ffffffff8174d3cc>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:156\n [<     inline     >] print_address_description mm/kasan/report.c:194\n [<ffffffff8174d666>] kasan_report_error+0x1f6/0x4d0 mm/kasan/report.c:283\n [<     inline     >] kasan_report mm/kasan/report.c:303\n [<ffffffff8174db7e>] __asan_report_store8_noabort+0x3e/0x40 mm/kasan/report.c:329\n [<     inline     >] __write_once_size ./include/linux/compiler.h:249\n [<     inline     >] __hlist_del ./include/linux/list.h:622\n [<     inline     >] hlist_del_init ./include/linux/list.h:637\n [<ffffffff8579047e>] l2tp_ip6_close+0x22e/0x290 net/l2tp/l2tp_ip6.c:239\n [<ffffffff850b2dfd>] inet_release+0xed/0x1c0 net/ipv4/af_inet.c:415\n [<ffffffff851dc5a0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:422\n [<ffffffff84c4581d>] sock_release+0x8d/0x1d0 net/socket.c:570\n [<ffffffff84c45976>] sock_close+0x16/0x20 net/socket.c:1017\n [<ffffffff817a108c>] __fput+0x28c/0x780 fs/file_table.c:208\n [<ffffffff817a1605>] ____fput+0x15/0x20 fs/file_table.c:244\n [<ffffffff813774f9>] task_work_run+0xf9/0x170\n [<ffffffff81324aae>] do_exit+0x85e/0x2a00\n [<ffffffff81326dc8>] do_group_exit+0x108/0x330\n [<ffffffff81348cf7>] get_signal+0x617/0x17a0 kernel/signal.c:2307\n [<ffffffff811b49af>] do_signal+0x7f/0x18f0\n [<ffffffff810039bf>] exit_to_usermode_loop+0xbf/0x150 arch/x86/entry/common.c:156\n [<     inline     >] prepare_exit_to_usermode arch/x86/entry/common.c:190\n [<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0 arch/x86/entry/common.c:259\n [<ffffffff85e4d726>] entry_SYSCALL_64_fastpath+0xc4/0xc6\nObject at ffff8800081b0ec0, in cache L2TP/IPv6 size: 1448\nAllocated:\nPID = 10987\n [ 1116.897025] [<ffffffff811ddcb6>] save_stack_trace+0x16/0x20\n [ 1116.897025] [<ffffffff8174c736>] save_stack+0x46/0xd0\n [ 1116.897025] [<ffffffff8174c9ad>] kasan_kmalloc+0xad/0xe0\n [ 1116.897025] [<ffffffff8174cee2>] kasan_slab_alloc+0x12/0x20\n [ 1116.897025] [<     inline     >] slab_post_alloc_hook mm/slab.h:417\n [ 1116.897025] [<     inline     >] slab_alloc_node mm/slub.c:2708\n [ 1116.897025] [<     inline     >] slab_alloc mm/slub.c:2716\n [ 1116.897025] [<ffffffff817476a8>] kmem_cache_alloc+0xc8/0x2b0 mm/slub.c:2721\n [ 1116.897025] [<ffffffff84c4f6a9>] sk_prot_alloc+0x69/0x2b0 net/core/sock.c:1326\n [ 1116.897025] [<ffffffff84c58ac8>] sk_alloc+0x38/0xae0 net/core/sock.c:1388\n [ 1116.897025] [<ffffffff851ddf67>] inet6_create+0x2d7/0x1000 net/ipv6/af_inet6.c:182\n [ 1116.897025] [<ffffffff84c4af7b>] __sock_create+0x37b/0x640 net/socket.c:1153\n [ 1116.897025] [<     inline     >] sock_create net/socket.c:1193\n [ 1116.897025] [<     inline     >] SYSC_socket net/socket.c:1223\n [ 1116.897025] [<ffffffff84c4b46f>] SyS_socket+0xef/0x1b0 net/socket.c:1203\n [ 1116.897025] [<ffffffff85e4d685>] entry_SYSCALL_64_fastpath+0x23/0xc6\nFreed:\nPID = 10987\n [ 1116.897025] [<ffffffff811ddcb6>] save_stack_trace+0x16/0x20\n [ 1116.897025] [<ffffffff8174c736>] save_stack+0x46/0xd0\n [ 1116.897025] [<ffffffff8174cf61>] kasan_slab_free+0x71/0xb0\n [ 1116.897025] [<     inline     >] slab_free_hook mm/slub.c:1352\n [ 1116.897025] [<     inline     >] slab_free_freelist_hook mm/slub.c:1374\n [ 1116.897025] [<     inline     >] slab_free mm/slub.c:2951\n [ 1116.897025] [<ffffffff81748b28>] kmem_cache_free+0xc8/0x330 mm/slub.c:2973\n [ 1116.897025] [<     inline     >] sk_prot_free net/core/sock.c:1369\n [ 1116.897025] [<ffffffff84c541eb>] __sk_destruct+0x32b/0x4f0 net/core/sock.c:1444\n [ 1116.897025] [<ffffffff84c5aca4>] sk_destruct+0x44/0x80 net/core/sock.c:1452\n [ 1116.897025] [<ffffffff84c5ad33>] __sk_free+0x53/0x220 net/core/sock.c:1460\n [ 1116.897025] [<ffffffff84c5af23>] sk_free+0x23/0x30 net/core/sock.c:1471\n [ 1116.897025] [<ffffffff84c5cb6c>] sk_common_release+0x28c/0x3e0 ./include/net/sock.h:1589\n [ 1116.897025] [<ffffffff8579044e>] l2tp_ip6_close+0x1fe/0x290 net/l2tp/l2tp_ip6.c:243\n [ 1116.897025] [<ffffffff850b2dfd>] inet_release+0xed/0x1c0 net/ipv4/af_inet.c:415\n [ 1116.897025] [<ffffffff851dc5a0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:422\n [ 1116.897025] [<ffffffff84c4581d>] sock_release+0x8d/0x1d0 net/socket.c:570\n [ 1116.897025] [<ffffffff84c45976>] sock_close+0x16/0x20 net/socket.c:1017\n [ 1116.897025] [<ffffffff817a108c>] __fput+0x28c/0x780 fs/file_table.c:208\n [ 1116.897025] [<ffffffff817a1605>] ____fput+0x15/0x20 fs/file_table.c:244\n [ 1116.897025] [<ffffffff813774f9>] task_work_run+0xf9/0x170\n [ 1116.897025] [<ffffffff81324aae>] do_exit+0x85e/0x2a00\n [ 1116.897025] [<ffffffff81326dc8>] do_group_exit+0x108/0x330\n [ 1116.897025] [<ffffffff81348cf7>] get_signal+0x617/0x17a0 kernel/signal.c:2307\n [ 1116.897025] [<ffffffff811b49af>] do_signal+0x7f/0x18f0\n [ 1116.897025] [<ffffffff810039bf>] exit_to_usermode_loop+0xbf/0x150 arch/x86/entry/common.c:156\n [ 1116.897025] [<     inline     >] prepare_exit_to_usermode arch/x86/entry/common.c:190\n [ 1116.897025] [<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0 arch/x86/entry/common.c:259\n [ 1116.897025] [<ffffffff85e4d726>] entry_SYSCALL_64_fastpath+0xc4/0xc6\nMemory state around the buggy address:\n ffff8800081b0d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff8800081b0e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n>ffff8800081b0e80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb\n                                                    ^\n ffff8800081b0f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff8800081b0f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\n==================================================================\n\nThe same issue exists with l2tp_ip_bind() and l2tp_ip_bind_table.\n\nFixes: c51ce49735c1 (\"l2tp: fix oops in L2TP IP sockets for connect() AF_UNSPEC case\")\nChange-Id: I9263d5269178e31534fd0765752b491751919523\nReported-by: Baozeng Ding <sploving1@gmail.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Baozeng Ding <sploving1@gmail.com>\nSigned-off-by: Guillaume Nault <g.nault@alphalink.fr>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_samsung_k3gxx/commits/57a5e1ff3749eec2aa7f9f50c99450b459076b6d"}]}
{"actor":{"display_login":"lineageos-gerrit"}}