{"push_id":1609846893,"size":7,"distinct_size":7,"ref":"refs/heads/stock-latest","head":"bc0b6dd7dc3156a65b17e833e4bfe47c7573fc4c","before":"647d76bc2442d578e4d4cf35abbd16d462adfcf0","commits":[{"sha":"005001c46de403645ee6a1335765cd10927df8d9","author":{"name":"Marcelo Ricardo Leitner","email":"c04fb515492b5d50ffd8453e8f592dfba6d0858b@gmail.com"},"message":"sctp: deny peeloff operation on asocs with threads sleeping on it\n\ncommit 2dcab5984841 (\"sctp: avoid BUG_ON on sctp_wait_for_sndbuf\")\nattempted to avoid a BUG_ON call when the association being used for a\nsendmsg() is blocked waiting for more sndbuf and another thread did a\npeeloff operation on such asoc, moving it to another socket.\n\nAs Ben Hutchings noticed, then in such case it would return without\nlocking back the socket and would cause two unlocks in a row.\n\nFurther analysis also revealed that it could allow a double free if the\napplication managed to peeloff the asoc that is created during the\nsendmsg call, because then sctp_sendmsg() would try to free the asoc\nthat was created only for that call.\n\nThis patch takes another approach. It will deny the peeloff operation\nif there is a thread sleeping on the asoc, so this situation doesn't\nexist anymore. This avoids the issues described above and also honors\nthe syscalls that are already being handled (it can be multiple sendmsg\ncalls).\n\nJoint work with Xin Long.\n\nFixes: 2dcab5984841 (\"sctp: avoid BUG_ON on sctp_wait_for_sndbuf\")\nChange-Id: Id4a7c9eeba08de25200bf73b7931c35683b6b450\nCc: Alexander Popov <alex.popov@linux.com>\nCc: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>\nSigned-off-by: Xin Long <lucien.xin@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/Reloaded_tomato/commits/005001c46de403645ee6a1335765cd10927df8d9"},{"sha":"cbdbba3639e3d0c2959fae864202929ab4e33bf7","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"net/llc: avoid BUG_ON() in skb_orphan()\n\nIt seems nobody used LLC since linux-3.12.\n\nFortunately fuzzers like syzkaller still know how to run this code,\notherwise it would be no fun.\n\nSetting skb->sk without skb->destructor leads to all kinds of\nbugs, we now prefer to be very strict about it.\n\nIdeally here we would use skb_set_owner() but this helper does not exist yet,\nonly CAN seems to have a private helper for that.\n\nFixes: 376c7311bdb6 (\"net: add a temporary sanity check in skb_orphan()\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n(cherry picked from commit 8b74d439e1697110c5e5c600643e823eb1dd0762)\n\nChange-Id: I17412f0afe525d556ab072a7b89d5839845a2ce7","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/Reloaded_tomato/commits/cbdbba3639e3d0c2959fae864202929ab4e33bf7"},{"sha":"f1753ae97ac1de97bbadab2cf89d974b38c5d662","author":{"name":"Jiri Slaby","email":"5983af6a8e8283aa60de579a10bd4a0e541489a0@suse.cz"},"message":"TTY: n_hdlc, fix lockdep false positive\n\nThe class of 4 n_hdls buf locks is the same because a single function\nn_hdlc_buf_list_init is used to init all the locks. But since\nflush_tx_queue takes n_hdlc->tx_buf_list.spinlock and then calls\nn_hdlc_buf_put which takes n_hdlc->tx_free_buf_list.spinlock, lockdep\nemits a warning:\n=============================================\n[ INFO: possible recursive locking detected ]\n4.3.0-25.g91e30a7-default #1 Not tainted\n---------------------------------------------\na.out/1248 is trying to acquire lock:\n (&(&list->spinlock)->rlock){......}, at: [<ffffffffa01fd020>] n_hdlc_buf_put+0x20/0x60 [n_hdlc]\n\nbut task is already holding lock:\n (&(&list->spinlock)->rlock){......}, at: [<ffffffffa01fdc07>] n_hdlc_tty_ioctl+0x127/0x1d0 [n_hdlc]\n\nother info that might help us debug this:\n Possible unsafe locking scenario:\n\n       CPU0\n       ----\n  lock(&(&list->spinlock)->rlock);\n  lock(&(&list->spinlock)->rlock);\n\n *** DEADLOCK ***\n\n May be due to missing lock nesting notation\n\n2 locks held by a.out/1248:\n #0:  (&tty->ldisc_sem){++++++}, at: [<ffffffff814c9eb0>] tty_ldisc_ref_wait+0x20/0x50\n #1:  (&(&list->spinlock)->rlock){......}, at: [<ffffffffa01fdc07>] n_hdlc_tty_ioctl+0x127/0x1d0 [n_hdlc]\n...\nCall Trace:\n...\n [<ffffffff81738fd0>] _raw_spin_lock_irqsave+0x50/0x70\n [<ffffffffa01fd020>] n_hdlc_buf_put+0x20/0x60 [n_hdlc]\n [<ffffffffa01fdc24>] n_hdlc_tty_ioctl+0x144/0x1d0 [n_hdlc]\n [<ffffffff814c25c1>] tty_ioctl+0x3f1/0xe40\n...\n\nFix it by initializing the spin_locks separately. This removes also\nreduntand memset of a freshly kzallocated space.\n\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nCVE-2017-2636\n\n(backported from e9b736d88af1a143530565929390cadf036dc799 upstream)\nSigned-off-by: Stefan Bader <stefan.bader@canonical.com>\n\nChange-Id: Ifb27b86044c9c69e1a4d7b9712fb27b04802e169","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/Reloaded_tomato/commits/f1753ae97ac1de97bbadab2cf89d974b38c5d662"},{"sha":"d1b652f7e58bf5c8a01cd708eab86066ef3ca028","author":{"name":"Alexander Popov","email":"a553a607cbdcea38d5c7f4eb348a2ce593158f6d@linux.com"},"message":"tty: n_hdlc: get rid of racy n_hdlc.tbuf\n\nCurrently N_HDLC line discipline uses a self-made singly linked list for\ndata buffers and has n_hdlc.tbuf pointer for buffer retransmitting after\nan error.\n\nThe commit be10eb7589337e5defbe214dae038a53dd21add8\n(\"tty: n_hdlc add buffer flushing\") introduced racy access to n_hdlc.tbuf.\nAfter tx error concurrent flush_tx_queue() and n_hdlc_send_frames() can put\none data buffer to tx_free_buf_list twice. That causes double free in\nn_hdlc_release().\n\nLet's use standard kernel linked list and get rid of n_hdlc.tbuf:\nin case of tx error put current data buffer after the head of tx_buf_list.\n\nSigned-off-by: Alexander Popov <alex.popov@linux.com>\n\nCVE-2017-2636\n\nChange-Id: I057e763865c4dec5b1daf1ddde285927dd9803fb\nSigned-off-by: Stefan Bader <stefan.bader@canonical.com>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/Reloaded_tomato/commits/d1b652f7e58bf5c8a01cd708eab86066ef3ca028"},{"sha":"904874c1b80708d6936490fa5db11fc73046aef5","author":{"name":"Ariel Yin","email":"9308cd92d4904c8721204c41e9329abc3a43c10d@google.com"},"message":"ANDROID: ion: check for kref overflow\n\nUserspace can cause the kref to handles to increment\narbitrarily high. Ensure it does not overflow.\n\nSigned-off-by: Daniel Rosenberg <drosen@google.com>\n\nBug: 31992382\nTest: See bug for poc\nChange-Id: I6bff1df385742b1d836d43180dc87fadcea80782","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/Reloaded_tomato/commits/904874c1b80708d6936490fa5db11fc73046aef5"},{"sha":"2a5bdff8055bd20ee4ea62eb032990cd274eb9ab","author":{"name":"Manjeet Singh","email":"d0a3abb6bc513ebf0625f1e87ac0254284e35b10@codeaurora.org"},"message":"qcacld-2.0: Add buf len check in wlan_hdd_cfg80211_testmode\n\nIn __wlan_hdd_cfg80211_testmode API no checks are in place that\nensure that buflen is smaller or equal the size of the stack\nvariable hb_params. Hence, the vos_mem_copy() call can overflow\nstack memory.\n\nAdd buf len check to avoid stack overflow\n\nCRs-Fixed: 1105085\nChange-Id: I6af6a74cc38ebce3337120adcf7e9595f22d3d8c","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/Reloaded_tomato/commits/2a5bdff8055bd20ee4ea62eb032990cd274eb9ab"},{"sha":"bc0b6dd7dc3156a65b17e833e4bfe47c7573fc4c","author":{"name":"Andrey Ryabinin","email":"93e46ad9a51c483bc64b86deb9d8d0d7dbbb3fe0@virtuozzo.com"},"message":"mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]\n\nThis fixes CVE-2016-8650.\n\nIf mpi_powm() is given a zero exponent, it wants to immediately return\neither 1 or 0, depending on the modulus.  However, if the result was\ninitalised with zero limb space, no limbs space is allocated and a\nNULL-pointer exception ensues.\n\nFix this by allocating a minimal amount of limb space for the result when\nthe 0-exponent case when the result is 1 and not touching the limb space\nwhen the result is 0.\n\nThis affects the use of RSA keys and X.509 certificates that carry them.\n\nBUG: unable to handle kernel NULL pointer dereference at           (null)\nIP: [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6\nPGD 0\nOops: 0002 [#1] SMP\nModules linked in:\nCPU: 3 PID: 3014 Comm: keyctl Not tainted 4.9.0-rc6-fscache+ #278\nHardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014\ntask: ffff8804011944c0 task.stack: ffff880401294000\nRIP: 0010:[<ffffffff8138ce5d>]  [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6\nRSP: 0018:ffff880401297ad8  EFLAGS: 00010212\nRAX: 0000000000000000 RBX: ffff88040868bec0 RCX: ffff88040868bba0\nRDX: ffff88040868b260 RSI: ffff88040868bec0 RDI: ffff88040868bee0\nRBP: ffff880401297ba8 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000047 R11: ffffffff8183b210 R12: 0000000000000000\nR13: ffff8804087c7600 R14: 000000000000001f R15: ffff880401297c50\nFS:  00007f7a7918c700(0000) GS:ffff88041fb80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 0000000401250000 CR4: 00000000001406e0\nStack:\n ffff88040868bec0 0000000000000020 ffff880401297b00 ffffffff81376cd4\n 0000000000000100 ffff880401297b10 ffffffff81376d12 ffff880401297b30\n ffffffff81376f37 0000000000000100 0000000000000000 ffff880401297ba8\nCall Trace:\n [<ffffffff81376cd4>] ? __sg_page_iter_next+0x43/0x66\n [<ffffffff81376d12>] ? sg_miter_get_next_page+0x1b/0x5d\n [<ffffffff81376f37>] ? sg_miter_next+0x17/0xbd\n [<ffffffff8138ba3a>] ? mpi_read_raw_from_sgl+0xf2/0x146\n [<ffffffff8132a95c>] rsa_verify+0x9d/0xee\n [<ffffffff8132acca>] ? pkcs1pad_sg_set_buf+0x2e/0xbb\n [<ffffffff8132af40>] pkcs1pad_verify+0xc0/0xe1\n [<ffffffff8133cb5e>] public_key_verify_signature+0x1b0/0x228\n [<ffffffff8133d974>] x509_check_for_self_signed+0xa1/0xc4\n [<ffffffff8133cdde>] x509_cert_parse+0x167/0x1a1\n [<ffffffff8133d609>] x509_key_preparse+0x21/0x1a1\n [<ffffffff8133c3d7>] asymmetric_key_preparse+0x34/0x61\n [<ffffffff812fc9f3>] key_create_or_update+0x145/0x399\n [<ffffffff812fe227>] SyS_add_key+0x154/0x19e\n [<ffffffff81001c2b>] do_syscall_64+0x80/0x191\n [<ffffffff816825e4>] entry_SYSCALL64_slow_path+0x25/0x25\nCode: 56 41 55 41 54 53 48 81 ec a8 00 00 00 44 8b 71 04 8b 42 04 4c 8b 67 18 45 85 f6 89 45 80 0f 84 b4 06 00 00 85 c0 75 2f 41 ff ce <49> c7 04 24 01 00 00 00 b0 01 75 0b 48 8b 41 18 48 83 38 01 0f\nRIP  [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6\n RSP <ffff880401297ad8>\nCR2: 0000000000000000\n---[ end trace d82015255d4a5d8d ]---\n\nBasically, this is a backport of a libgcrypt patch:\n\n\thttp://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=patch;h=6e1adb05d290aeeb1c230c763970695f4a538526\n\nFixes: cdec9cb5167a (\"crypto: GnuPG based MPI lib - source files (part 1)\")\nChange-Id: I0c1a9f9d536e26211eb3ba040f82c7b6382a8570\nSigned-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\ncc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>\ncc: linux-ima-devel@lists.sourceforge.net\ncc: stable@vger.kernel.org\nSigned-off-by: James Morris <james.l.morris@oracle.com>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/Reloaded_tomato/commits/bc0b6dd7dc3156a65b17e833e4bfe47c7573fc4c"}]}
{"actor":{"display_login":"RiteshSaxena"}}