{"push_id":1737114742,"size":4,"distinct_size":4,"ref":"refs/heads/cm-14.1","head":"5f02383c9decd1b8b10bcdc008677025e5a1db2d","before":"f959381fbbe69d8e1d63f26e5f3562e76c31ed9e","commits":[{"sha":"6d0770198f40e249c1cc148631a1131c904058a6","author":{"name":"Eric Biggers","email":"0106d512ed1cb672be29d4b167a07ead51709fba@google.com"},"message":"KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings\n\ncommit c9f838d104fed6f2f61d68164712e3204bf5271b upstream.\n\nThis fixes CVE-2017-7472.\n\nRunning the following program as an unprivileged user exhausts kernel\nmemory by leaking thread keyrings:\n\n\t#include <keyutils.h>\n\n\tint main()\n\t{\n\t\tfor (;;)\n\t\t\tkeyctl_set_reqkey_keyring(KEY_REQKEY_DEFL_THREAD_KEYRING);\n\t}\n\nFix it by only creating a new thread keyring if there wasn't one before.\nTo make things more consistent, make install_thread_keyring_to_cred()\nand install_process_keyring_to_cred() both return 0 if the corresponding\nkeyring is already present.\n\nChange-Id: I584b867ac876b8040254a2e9d8ac3948413d7c5a\nFixes: d84f4f992cbd (\"CRED: Inaugurate COW credentials\")\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Sony-Stock-CM/android_kernel_sony_msm8974/commits/6d0770198f40e249c1cc148631a1131c904058a6"},{"sha":"b6c1b8d63e30e9b3b294524cb4e56263a069abed","author":{"name":"David Howells","email":"358fdf7bce8223edb2a0d846104bf62a286894d5@redhat.com"},"message":"KEYS: Change the name of the dead type to \".dead\" to prevent user access\n\ncommit c1644fe041ebaf6519f6809146a77c3ead9193af upstream.\n\nThis fixes CVE-2017-6951.\n\nUserspace should not be able to do things with the \"dead\" key type as it\ndoesn't have some of the helper functions set upon it that the kernel\nneeds.  Attempting to use it may cause the kernel to crash.\n\nFix this by changing the name of the type to \".dead\" so that it's rejected\nup front on userspace syscalls by key_get_type_from_user().\n\nThough this doesn't seem to affect recent kernels, it does affect older\nones, certainly those prior to:\n\n\tcommit c06cfb08b88dfbe13be44a69ae2fdc3a7c902d81\n\tAuthor: David Howells <dhowells@redhat.com>\n\tDate:   Tue Sep 16 17:36:06 2014 +0100\n\tKEYS: Remove key_type::match in favour of overriding default by match_preparse\n\nwhich went in before 3.18-rc1.\n\nChange-Id: Ie0fe24b5c5f341c152e511976b60d393056e89fb\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Sony-Stock-CM/android_kernel_sony_msm8974/commits/b6c1b8d63e30e9b3b294524cb4e56263a069abed"},{"sha":"31633db84903c5a3d59afb3aac9d454ad62e1e40","author":{"name":"Andrey Konovalov","email":"acba6f9b010367f452595b80d6e1782629aa36cc@google.com"},"message":"net/packet: fix overflow in check for tp_reserve\n\nWhen calculating po->tp_hdrlen + po->tp_reserve the result can overflow.\n\nFix by checking that tp_reserve <= INT_MAX on assign.\n\nChange-Id: I6a4ea0cbe87cfd3db0979896c9bf9b3c626ec1d6\nSigned-off-by: Andrey Konovalov <andreyknvl@google.com>\nAcked-by: Eric Dumazet <edumazet@google.com>","distinct":true,"url":"https://api.github.com/repos/Sony-Stock-CM/android_kernel_sony_msm8974/commits/31633db84903c5a3d59afb3aac9d454ad62e1e40"},{"sha":"5f02383c9decd1b8b10bcdc008677025e5a1db2d","author":{"name":"Andrey Konovalov","email":"acba6f9b010367f452595b80d6e1782629aa36cc@google.com"},"message":"net/packet: fix overflow in check for tp_frame_nr\n\nWhen calculating rb->frames_per_block * req->tp_block_nr the result\ncan overflow.\n\nAdd a check that tp_block_size * tp_block_nr <= UINT_MAX.\n\nSince frames_per_block <= tp_block_size, the expression would\nnever overflow.\n\nChange-Id: I3598423e621275aa1d890b80bcf9018929087d90\nSigned-off-by: Andrey Konovalov <andreyknvl@google.com>\nAcked-by: Eric Dumazet <edumazet@google.com>","distinct":true,"url":"https://api.github.com/repos/Sony-Stock-CM/android_kernel_sony_msm8974/commits/5f02383c9decd1b8b10bcdc008677025e5a1db2d"}]}
{"actor":{"display_login":"nailyk-fr"}}