{"push_id":1838117484,"size":6,"distinct_size":6,"ref":"refs/heads/cm-14.1","head":"2d424d6e9733aeb95e32bff414ec2a2bb267ea60","before":"1df92a2806086320d18008a2529a66b95328557d","commits":[{"sha":"7d5669ae46e2cfb46e8d665f735f018402a48998","author":{"name":"Hannes Frederic Sowa","email":"384333b8ca49bccf53afadd43ca0007cb9efc1df@stressinduktion.org"},"message":"unix: correctly track in-flight fds in sending process user_struct\n\ncommit 415e3d3e90ce9e18727e8843ae343eda5a58fad6 upstream.\n\nThe commit referenced in the Fixes tag incorrectly accounted the number\nof in-flight fds over a unix domain socket to the original opener\nof the file-descriptor. This allows another process to arbitrary\ndeplete the original file-openers resource limit for the maximum of\nopen files. Instead the sending processes and its struct cred should\nbe credited.\n\nTo do so, we add a reference counted struct user_struct pointer to the\nscm_fp_list and use it to account for the number of inflight unix fds.\n\nFixes: 712f4aad406bb1 (\"unix: properly account for FDs passed over unix sockets\")\nChange-Id: Ibb7438e752cef70a96b5413e3473c369fb3b556a\nReported-by: David Herrmann <dh.herrmann@gmail.com>\nCc: David Herrmann <dh.herrmann@gmail.com>\nCc: Willy Tarreau <w@1wt.eu>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nSuggested-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n[bwh: Backported to 3.2: adjust context]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/esa-n/android_kernel_lge_hammerhead_test/commits/7d5669ae46e2cfb46e8d665f735f018402a48998"},{"sha":"e87b0febfafeff957e30b22b1be598615ef2158d","author":{"name":"Johannes Berg","email":"9a5936d824e6835dfe162c5611d10d2cf40ffbad@intel.com"},"message":"mac80211: fix fragmentation code, particularly for encryption\n\ncommit 338f977f4eb441e69bb9a46eaa0ac715c931a67f upstream.\n\nThe \"new\" fragmentation code (since my rewrite almost 5 years ago)\nerroneously sets skb->len rather than using skb_trim() to adjust\nthe length of the first fragment after copying out all the others.\nThis leaves the skb tail pointer pointing to after where the data\noriginally ended, and thus causes the encryption MIC to be written\nat that point, rather than where it belongs: immediately after the\ndata.\n\nThe impact of this is that if software encryption is done, then\n a) encryption doesn't work for the first fragment, the connection\n    becomes unusable as the first fragment will never be properly\n    verified at the receiver, the MIC is practically guaranteed to\n    be wrong\n b) we leak up to 8 bytes of plaintext (!) of the packet out into\n    the air\n\nThis is only mitigated by the fact that many devices are capable\nof doing encryption in hardware, in which case this can't happen\nas the tail pointer is irrelevant in that case. Additionally,\nfragmentation is not used very frequently and would normally have\nto be configured manually.\n\nFix this by using skb_trim() properly.\n\nFixes: 2de8e0d999b8 (\"mac80211: rewrite fragmentation\")\nChange-Id: Ia6154022993aa25a225d1fb264608601b6088c14\nReported-by: Jouni Malinen <j@w1.fi>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\n[bwh: Backported to 3.2: adjust context]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/esa-n/android_kernel_lge_hammerhead_test/commits/e87b0febfafeff957e30b22b1be598615ef2158d"},{"sha":"5d076aaffdcd6e1078e0a7292860fea96cc24231","author":{"name":"Dan Carpenter","email":"60b2bf2bc0bec4ca4a4b046ca7ef9255248abff8@oracle.com"},"message":"ALSA: compress: fix an integer overflow check\n\ncommit 6217e5ede23285ddfee10d2e4ba0cc2d4c046205 upstream.\n\nI previously added an integer overflow check here but looking at it now,\nit's still buggy.\n\nThe bug happens in snd_compr_allocate_buffer().  We multiply\n\".fragments\" and \".fragment_size\" and that doesn't overflow but then we\nsave it in an unsigned int so it truncates the high bits away and we\nallocate a smaller than expected size.\n\nFixes: b35cc8225845 ('ALSA: compress_core: integer overflow in snd_compr_allocate_buffer()')\nChange-Id: I2a7dccf9d5b6d7bd02e841c1a6fa754bf4978cd8\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/esa-n/android_kernel_lge_hammerhead_test/commits/5d076aaffdcd6e1078e0a7292860fea96cc24231"},{"sha":"60cc50fed90fa3c7c30c1d7c92498ff800b12dd9","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: seq: Fix race at timer setup and close\n\nALSA sequencer code has an open race between the timer setup ioctl and\nthe close of the client.  This was triggered by syzkaller fuzzer, and\na use-after-free was caught there as a result.\n\nThis patch papers over it by adding a proper queue->timer_mutex lock\naround the timer-related calls in the relevant code path.\n\nBug: 32983360\nChange-Id: I74a0789b15ad8c823adff8652498d95e3304b7a4\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nGit-commit: 3567eb6af614dac436c4b16a8d426f9faed639b3\nGit-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git\nSigned-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/esa-n/android_kernel_lge_hammerhead_test/commits/60cc50fed90fa3c7c30c1d7c92498ff800b12dd9"},{"sha":"554e7c49f280b3c542b3a3b612a8d6c8ed3f7416","author":{"name":"David S. Miller","email":"79caf591e37e1438a2d55ae59670d5cd0d717764@davemloft.net"},"message":"ipv4: Don't do expensive useless work during inetdev destroy.\n\ncommit fbd40ea0180a2d328c5adc61414dc8bab9335ce2 upstream.\n\nWhen an inetdev is destroyed, every address assigned to the interface\nis removed.  And in this scenerio we do two pointless things which can\nbe very expensive if the number of assigned interfaces is large:\n\n1) Address promotion.  We are deleting all addresses, so there is no\n   point in doing this.\n\n2) A full nf conntrack table purge for every address.  We only need to\n   do this once, as is already caught by the existing\n   masq_dev_notifier so masq_inet_event() can skip this.\n\nChange-Id: I37bb2f96ec06c3e28d2b40a034c5e34faaed8ffb\nReported-by: Solar Designer <solar@openwall.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nTested-by: Cyrill Gorcunov <gorcunov@openvz.org>\n[bwh: Backported to 3.2: adjust filename, context]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/esa-n/android_kernel_lge_hammerhead_test/commits/554e7c49f280b3c542b3a3b612a8d6c8ed3f7416"},{"sha":"2d424d6e9733aeb95e32bff414ec2a2bb267ea60","author":{"name":"Dave Weinstein","email":"ebef9371cc90401e536c8185875c2133e11e1f66@google.com"},"message":"arm: oabi compat: add missing access checks\n\ncommit 7de249964f5578e67b99699c5f0b405738d820a2 upstream.\n\nAdd access checks to sys_oabi_epoll_wait() and sys_oabi_semtimedop().\nThis fixes CVE-2016-3857, a local privilege escalation under\nCONFIG_OABI_COMPAT.\n\nChange-Id: I7b22aaa6e12d0a068db330cd5fb87012c6de2604\nCc: stable@vger.kernel.org\nReported-by: Chiachih Wu <wuchiachih@gmail.com>\nReviewed-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Nicolas Pitre <nico@linaro.org>\nSigned-off-by: Dave Weinstein <olorin@google.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/esa-n/android_kernel_lge_hammerhead_test/commits/2d424d6e9733aeb95e32bff414ec2a2bb267ea60"}]}
{"actor":{"display_login":"esa-n"}}