{"push_id":876939369,"size":17,"distinct_size":17,"ref":"refs/heads/cm-13.0","head":"ed2f3d245e91f1c75a57136cc0310ffb7974ae98","before":"4997d6e9a35f300b5d6d84d6f424b637f13db9ca","commits":[{"sha":"2645e95a3490a1f96cbc8f571066603b51260e6e","author":{"email":"10a8c465cefc9bdd6c925e26964d23c90f1141cc@google.com","name":"Dmitry Torokhov"},"message":"net: fix iterating over hashtable in tcp_nuke_addr()\n\nThe actual size of the tcp hashinfo table is tcp_hashinfo.ehash_mask + 1\nso we need to adjust the loop accordingly to get the sockets hashed into\nthe last bucket.\n\nChange-Id: I796b3c7b4a1a7fa35fba9e5192a4a403eb6e17de\nSigned-off-by: Dmitry Torokhov <dtor@google.com>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_google_msm/commits/2645e95a3490a1f96cbc8f571066603b51260e6e"},{"sha":"f911921066e368b8f62d460773996df8d59564cf","author":{"email":"3d479b85ea8c465591772958e9b4342563a1d10a@google.com","name":"dcashman"},"message":"mm: mmap: Add new /proc tunable for mmap_base ASLR.\n\nASLR currently only uses 8 bits to generate the random offset for the\nmmap base address on 32 bit architectures. This value was chosen to\nprevent a poorly chosen value from dividing the address space in such\na way as to prevent large allocations. This may not be an issue on all\nplatforms. Allow the specification of a minimum number of bits so that\nplatforms desiring greater ASLR protection may determine where to place\nthe trade-off.\n\nBUG=24047224\nSigned-off-by: Daniel Cashman <dcashman@google.com>\nChange-Id: I1e173f2d890484421298722c5a045c65ca5af581","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_google_msm/commits/f911921066e368b8f62d460773996df8d59564cf"},{"sha":"ef326c8a778711e3ed90cd2e1a6bb932344c8e31","author":{"email":"3d479b85ea8c465591772958e9b4342563a1d10a@google.com","name":"dcashman"},"message":"arm: mm: support ARCH_MMAP_RND_BITS.\n\nBug: 24047224\nSigned-off-by: Daniel Cashman <dcashman@google.com>\nChange-Id: I579513783865289897845e19b461f69cb90a1d67","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_google_msm/commits/ef326c8a778711e3ed90cd2e1a6bb932344c8e31"},{"sha":"5507ac417712a979e6b205dfa45a578f43173515","author":{"email":"fbe788dcd509b324901fbdfe505a4d610d560569@google.com","name":"Jeff Vander Stoep"},"message":"Revert \"SELinux: ss: Fix policy write for ioctl operations\"\n\nThis reverts commit c06168226f5eaaaad93af5b2811f213b01382363.\n\nBug: 22846070\nChange-Id: I665c1f2350e10ce890e7c4be1a06e666929d5d7a\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_google_msm/commits/5507ac417712a979e6b205dfa45a578f43173515"},{"sha":"86cff3cd1b98b1166e313fd58b4f3c3bec4dcd60","author":{"email":"fbe788dcd509b324901fbdfe505a4d610d560569@google.com","name":"Jeff Vander Stoep"},"message":"Revert \"SELinux: use deletion-safe iterator to free list\"\n\nThis reverts commit c9a8571249fa3a55a0490bd571eaf0cea097fab0.\n\nBug: 22846070\nChange-Id: I85e2b6322f98bd584ed523b0bd0291375dbc35dc\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_google_msm/commits/86cff3cd1b98b1166e313fd58b4f3c3bec4dcd60"},{"sha":"850ae1026468a3778c9c83c527cd7bd3be921f97","author":{"email":"fbe788dcd509b324901fbdfe505a4d610d560569@google.com","name":"Jeff Vander Stoep"},"message":"Revert \"SELinux: per-command whitelisting of ioctls\"\n\nThis reverts commit bc84b4adb1469e3d05ad76c304a4c545feaf1f88.\n\nBug: 22846070\nChange-Id: Ib4cb130b2225ea2e22556ff852313e0de7dddcab\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_google_msm/commits/850ae1026468a3778c9c83c527cd7bd3be921f97"},{"sha":"61b02a0867fd1dccbd9de2c03c523420ee6d33e6","author":{"email":"fbe788dcd509b324901fbdfe505a4d610d560569@google.com","name":"Jeff Vander Stoep"},"message":"Revert \"security: lsm_audit: add ioctl specific auditing\"\n\nThis reverts commit 643ce43c226cdfa73bcac2fa91f1f8a3dfd171a2.\n\nBug: 22846070\nChange-Id: I5dde1878e5baac43b4968141c0dc60b70e042183\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_google_msm/commits/61b02a0867fd1dccbd9de2c03c523420ee6d33e6"},{"sha":"4dbcdb9da6efdd39e9174884ce6616a29b96fd94","author":{"email":"fbe788dcd509b324901fbdfe505a4d610d560569@google.com","name":"Jeff Vander Stoep"},"message":"selinux: remove unnecessary pointer reassignment\n\n(cherry pick from commit 83d4a806ae46397f606de7376b831524bd3a21e5)\n\nCommit f01e1af445fa (\"selinux: don't pass in NULL avd to avc_has_perm_noaudit\")\nmade this pointer reassignment unnecessary. Avd should continue to reference\nthe stack-based copy.\n\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>\nAcked-by: Stephen Smalley <sds@tycho.nsa.gov>\n[PM: tweaked subject line]\nSigned-off-by: Paul Moore <pmoore@redhat.com>\nBug: 22846070\nChange-Id: Ie33688d163870705272607309a27fb7c8f870748","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_google_msm/commits/4dbcdb9da6efdd39e9174884ce6616a29b96fd94"},{"sha":"f819d5a4c56585ac5c0ccc3b28504f165dfe0d2b","author":{"email":"fbe788dcd509b324901fbdfe505a4d610d560569@google.com","name":"Jeff Vander Stoep"},"message":"security: add ioctl specific auditing to lsm_audit\n\n(cherry pick from commit 671a2781ff01abf4fdc8904881fc3abd3a8279af)\n\nAdd information about ioctl calls to the LSM audit data. Log the\nfile path and command number.\n\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>\nAcked-by: Nick Kralevich <nnk@google.com>\n[PM: subject line tweak]\nSigned-off-by: Paul Moore <pmoore@redhat.com>\nBug: 22846070\nChange-Id: I4a7678294e0a3075f57bd77c76fd17e6f0d33e75","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_google_msm/commits/f819d5a4c56585ac5c0ccc3b28504f165dfe0d2b"},{"sha":"679cb23ae6df08f44445fa275fea307e79e7de5e","author":{"email":"fbe788dcd509b324901fbdfe505a4d610d560569@google.com","name":"Jeff Vander Stoep"},"message":"selinux: extended permissions for ioctls\n\n(cherry picked from commit fa1aa143ac4a682c7f5fd52a3cf05f5a6fe44a0a)\n\nAdd extended permissions logic to selinux. Extended permissions\nprovides additional permissions in 256 bit increments. Extend the\ngeneric ioctl permission check to use the extended permissions for\nper-command filtering. Source/target/class sets including the ioctl\npermission may additionally include a set of commands. Example:\n\nallowxperm <source> <target>:<class> ioctl unpriv_app_socket_cmds\nauditallowxperm <source> <target>:<class> ioctl priv_gpu_cmds\n\nWhere unpriv_app_socket_cmds and priv_gpu_cmds are macros\nrepresenting commonly granted sets of ioctl commands.\n\nWhen ioctl commands are omitted only the permissions are checked.\nThis feature is intended to provide finer granularity for the ioctl\npermission that may be too imprecise. For example, the same driver\nmay use ioctls to provide important and benign functionality such as\ndriver version or socket type as well as dangerous capabilities such\nas debugging features, read/write/execute to physical memory or\naccess to sensitive data. Per-command filtering provides a mechanism\nto reduce the attack surface of the kernel, and limit applications\nto the subset of commands required.\n\nThe format of the policy binary has been modified to include ioctl\ncommands, and the policy version number has been incremented to\nPOLICYDB_VERSION_XPERMS_IOCTL=30 to account for the format\nchange.\n\nThe extended permissions logic is deliberately generic to allow\ncomponents to be reused e.g. netlink filters\n\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>\nAcked-by: Nick Kralevich <nnk@google.com>\nSigned-off-by: Paul Moore <pmoore@redhat.com>\nBug: 22846070\nChange-Id: I299dc776d2f98d593ecc051707110c92a085350f","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_google_msm/commits/679cb23ae6df08f44445fa275fea307e79e7de5e"},{"sha":"f4c97af43a0d0296855f269b3c2f59fea8643c7b","author":{"email":"fbe788dcd509b324901fbdfe505a4d610d560569@google.com","name":"Jeff Vander Stoep"},"message":"selinux: Android kernel compatibility with M userspace\n\nNOT intended for new Android devices - this commit is unnecessary\nfor a target device that does not have a previous M variant.\n\nDO NOT upstream. Android only.\n\nMotivation:\n\nThis commit mitigates a mismatch between selinux kernel and\nselinux userspace. The selinux ioctl white-listing binary policy\nformat that was accepted into Android M differs slightly from what\nwas later accepted into the upstream kernel. This leaves Android\nmaster branch kernels incompatible with Android M releases. This\npatch restores backwards compatibility. This is important because:\n\n1. kernels may be updated on a different cycle than the rest of the\n   OS e.g. security patching.\n2. Android M bringup may still be ongoing for some devices. The\n   same kernel should work for both M and master.\n\nBackwards compatibility is achieved by checking for an Android M\npolicy characteristic during initial policy read and converting to\nupstream policy format. The inverse conversion is done for policy\nwrite as required for CTS testing.\n\nBug: 22846070\nChange-Id: I2f1ee2eee402f37cf3c9df9f9e03c1b9ddec1929\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_google_msm/commits/f4c97af43a0d0296855f269b3c2f59fea8643c7b"},{"sha":"36cb59c3b6f1b34e49a7c683a7dc7a479d9ad90d","author":{"email":"eec72676ad9a62f2727dfed6d270d98c0d02adec@linux.intel.com","name":"Kirill A. Shutemov"},"message":"BACKPORT: pagemap: do not leak physical addresses to non-privileged userspace\n\n(cherry pick from commit ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce)\n\nAs pointed by recent post[1] on exploiting DRAM physical imperfection,\n/proc/PID/pagemap exposes sensitive information which can be used to do\nattacks.\n\nThis disallows anybody without CAP_SYS_ADMIN to read the pagemap.\n\n[1] http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html\n\n[ Eventually we might want to do anything more finegrained, but for now\n  this is the simple model.   - Linus ]\n\nSigned-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>\nAcked-by: Konstantin Khlebnikov <khlebnikov@openvz.org>\nAcked-by: Andy Lutomirski <luto@amacapital.net>\nCc: Pavel Emelyanov <xemul@parallels.com>\nCc: Andrew Morton <akpm@linux-foundation.org>\nCc: Mark Seaborn <mseaborn@chromium.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Mark Salyzyn <salyzyn@google.com>\nBug: 25739721\nChange-Id: I3ecab3fee154f329258a051afc1b29531da74ee3","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_google_msm/commits/36cb59c3b6f1b34e49a7c683a7dc7a479d9ad90d"},{"sha":"ec5692bfbf21ceafe9c1decc6874522744d8cc0a","author":{"email":"33837adfb53316eae44aad04041e1240088d76fd@linaro.org","name":"John Stultz"},"message":"ANDROID: exec_domains: Disable request_module() call for personalities\n\n(cherry pick from commit a9ac1262ce80c287562e604f3bb24f232fcb686e)\n\nWith Android M, Android environments use a separate execution\ndomain for 32bit processes.\nSee:\nhttps://android-review.googlesource.com/#/c/122131/\n\nThis results in systems that use kernel modules to see selinux\naudit noise like:\n  type=1400 audit(28.989:15): avc: denied { module_request } for\n  pid=1622 comm=\"app_process32\" kmod=\"personality-8\"\n  scontext=u:r:zygote:s0 tcontext=u:r:kernel:s0 tclass=system\n\nWhile using kernel modules is unadvised, some systems do require\nthem.\n\nThus to avoid developers adding sepolicy exceptions to allow for\nrequest_module calls, this patch disables the logic which tries\nto call request_module for the 32bit personality (ie:\npersonality-8), which doesn't actually exist.\n\nSigned-off-by: John Stultz <john.stultz@linaro.org>\nChange-Id: I9cb90bd1291f0a858befa7d347c85464346702db","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_google_msm/commits/ec5692bfbf21ceafe9c1decc6874522744d8cc0a"},{"sha":"9c74840ba858a8a9de929d30494b4c3ec01a7676","author":{"email":"e4b32643abc22f0015f12596bd9b0c46cec422aa@google.com","name":"Greg Hackmann"},"message":"ANDROID: android: base-cfg: disable CONFIG_SYSVIPC\n\nAndroid SELinux policies block SysV IPC.  New kernels should not be\nbuilt with it.\n\nBug: 22300191\n\nChange-Id: Ia4bcb179ff71825cab19eed603d4064a8d061a93\nSigned-off-by: Greg Hackmann <ghackmann@google.com>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_google_msm/commits/9c74840ba858a8a9de929d30494b4c3ec01a7676"},{"sha":"ba12043ff2d40e9f39b36a65d6dd4517bb547430","author":{"email":"78601e57ee83647e8b7edd75f0813a55a70302d1@gmail.com","name":"Dave Daynard"},"message":"flo: disable CONFIG_SYSVIPC\n\nChange-Id: I0b7d1f4da9ca6af4326f143512efd771dfe08420","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_google_msm/commits/ba12043ff2d40e9f39b36a65d6dd4517bb547430"},{"sha":"36e0b6918c5abb2aadf9150d434502fd92851a43","author":{"email":"78601e57ee83647e8b7edd75f0813a55a70302d1@gmail.com","name":"Dave Daynard"},"message":"Delete build.config\n\nThis is a shared kernel.\n\nChange-Id: I46a8ddb31c94d79ef3594a0ae7d308e285eef11a","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_google_msm/commits/36e0b6918c5abb2aadf9150d434502fd92851a43"},{"sha":"ed2f3d245e91f1c75a57136cc0310ffb7974ae98","author":{"email":"1dd89e5367785ba89076cd264daac0464fdf0d7b@cellrox.com","name":"Amir Goldstein"},"message":"sysrq: Emergency Remount R/O in reverse order\n\nThis change fixes a problem where reboot on Android panics the kernel\nalmost every time when file systems are mounted over loop devices.\n\nAndroid reboot command does:\n- sync\n- echo u > /proc/sysrq-trigger\n- syscall_reboot\n\nThe problem is with sysrq emergency remount R/O trying to remount-ro\nin wrong order.\nsince /data is re-mounted ro before loop devices, loop device\nremount-ro fails to flush the journal and panics the kernel:\n\n  EXT4-fs (loop0): Remounting filesystem read-only\n  EXT4-fs (loop0): previous I/O error to superblock detected\n  loop: Write error at byte offset 0, length 4096.\n  Buffer I/O error on device loop0, logical block 0\n  lost page write due to I/O error on loop0\n  Kernel panic - not syncing: EXT4-fs panic from previous error\n\nThe fix is quite simple. In do_emergency_remount(), use\nlist_for_each_entry_reverse() on sb list instead of list_for_each_entry().\nIt makes a lot of sense to umount the file systems in reverse order in\nwhich they were added to sb list.\n\nChange-Id: I4370e39b5873bd16ade5d5f9ddb2704beb02a2bb\nSigned-off-by: Amir Goldstein <amir@cellrox.com>\nAcked-by: Oren Laadan <orenl@cellrox.com>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_google_msm/commits/ed2f3d245e91f1c75a57136cc0310ffb7974ae98"}]}