{"push_id":578533286,"size":4,"distinct_size":4,"ref":"refs/heads/L5","head":"b0cefc37731b3f950a2419aa4b227e3232e60f6f","before":"4bc993403a1d8461488b951392c704512e82e8a6","commits":[{"sha":"b42ec4967a6b1a1fdb5c0aa2f5fd6ca945c4813f","author":{"email":"cef439e78636cdab99cd2923826c5065a0743e5b@strlen.de","name":"Florian Westphal"},"message":"netfilter: conntrack: disable generic tracking for known protocols\n\nGiven following iptables ruleset:\n\n-P FORWARD DROP\n-A FORWARD -m sctp --dport 9 -j ACCEPT\n-A FORWARD -p tcp --dport 80 -j ACCEPT\n-A FORWARD -p tcp -m conntrack -m state ESTABLISHED,RELATED -j ACCEPT\n\nOne would assume that this allows SCTP on port 9 and TCP on port 80.\nUnfortunately, if the SCTP conntrack module is not loaded, this allows\n*all* SCTP communication, to pass though, i.e. -p sctp -j ACCEPT,\nwhich we think is a security issue.\n\nThis is because on the first SCTP packet on port 9, we create a dummy\n\"generic l4\" conntrack entry without any port information (since\nconntrack doesn't know how to extract this information).\n\nAll subsequent packets that are unknown will then be in established\nstate since they will fallback to proto_generic and will match the\n'generic' entry.\n\nOur originally proposed version [1] completely disabled generic protocol\ntracking, but Jozsef suggests to not track protocols for which a more\nsuitable helper is available, hence we now mitigate the issue for in\ntree known ct protocol helpers only, so that at least NAT and direction\ninformation will still be preserved for others.\n\n [1] http://www.spinics.net/lists/netfilter-devel/msg33430.html\n\nJoint work with Daniel Borkmann.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nAcked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\n\nConflicts:\n\tnet/netfilter/nf_conntrack_proto_generic.c\n\nChange-Id: I9bac2de7bc1eb406c1df53510dedaba6440a9f07","distinct":true,"url":"https://api.github.com/repos/VanirAOSP/kernel_samsung_jf/commits/b42ec4967a6b1a1fdb5c0aa2f5fd6ca945c4813f"},{"sha":"ec0c9495d8527927e104baef17c59160566cd2cc","author":{"email":"8c1011c9d06fc72acd93645d683782ab9543044d@google.com","name":"Michael Halcrow"},"message":"eCryptfs: Remove buggy and unnecessary write in file name decode routine\n\nDmitry Chernenkov used KASAN to discover that eCryptfs writes past the\nend of the allocated buffer during encrypted filename decoding. This\nfix corrects the issue by getting rid of the unnecessary 0 write when\nthe current bit offset is 2.\n\nChange-Id: I63ab4859f7085d5c48f2b782b1757fea4aab0dda\nSigned-off-by: Michael Halcrow <mhalcrow@google.com>\nReported-by: Dmitry Chernenkov <dmitryc@google.com>\nSuggested-by: Kees Cook <keescook@chromium.org>\nCc: stable@vger.kernel.org # v2.6.29+: 51ca58d eCryptfs: Filename Encryption: Encoding and encryption functions\nSigned-off-by: Tyler Hicks <tyhicks@canonical.com>","distinct":true,"url":"https://api.github.com/repos/VanirAOSP/kernel_samsung_jf/commits/ec0c9495d8527927e104baef17c59160566cd2cc"},{"sha":"98e47d005654b2666966f58b67dabe57d21c2733","author":{"email":"00bf0f20509cb3bd3255c624dba0f295e3c4128e@linaro.org","name":"Dave Martin"},"message":"ARM: 7583/1: decompressor: Enable unaligned memory access for v6 and above\n\nModern GCC can generate code which makes use of the CPU's native\nunaligned memory access capabilities.  This is useful for the C\ndecompressor implementations used for unpacking compressed kernels.\n\nThis patch disables alignment faults and enables the v6 unaligned\naccess model on CPUs which support these features (i.e., v6 and\nlater), allowing full unaligned access support for C code in the\ndecompressor.\n\nThe decompressor C code must not be built to assume that unaligned\naccess works if support for v5 or older platforms is included in\nthe kernel.\n\nFor correct code generation, C decompressor code must always use\nthe get_unaligned and put_unaligned accessors when dealing with\nunaligned pointers, regardless of this patch.\n\nChange-Id: I67b47f428cb5ccfd1b175a3a4bd4ba66744f4c18\nSigned-off-by: Dave Martin <dave.martin@linaro.org>\nAcked-by: Nicolas Pitre <nico@linaro.org>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>","distinct":true,"url":"https://api.github.com/repos/VanirAOSP/kernel_samsung_jf/commits/98e47d005654b2666966f58b67dabe57d21c2733"},{"sha":"b0cefc37731b3f950a2419aa4b227e3232e60f6f","author":{"email":"66c6d6a7d8cc18849a70ebcf8e1cc023b95b02c2@dho.im","name":"DHOMD"},"message":"Merge branch 'cm' into HEAD","distinct":true,"url":"https://api.github.com/repos/VanirAOSP/kernel_samsung_jf/commits/b0cefc37731b3f950a2419aa4b227e3232e60f6f"}]}