{"push_id":588601627,"size":3,"distinct_size":3,"ref":"refs/heads/lge-lp","head":"90c691afcb56c0fe8603a13dc9df74a4c26b77b0","before":"d15e656676f6ce07115be6cad8b467d538892584","commits":[{"sha":"3dbdfc92b80da0e031b2b13154bc2899962fd497","author":{"email":"8a741aa8cbd77ebc4a56ddb528ce9fd15d42f034@xmission.com","name":"Eric W. Biederman"},"message":"mnt: Only change user settable mount flags in remount\n\ncommit a6138db815df5ee542d848318e5dae681590fccd upstream.\n\nKenton Varda <kenton@sandstorm.io> discovered that by remounting a\nread-only bind mount read-only in a user namespace the\nMNT_LOCK_READONLY bit would be cleared, allowing an unprivileged user\nto the remount a read-only mount read-write.\n\nCorrect this by replacing the mask of mount flags to preserve\nwith a mask of mount flags that may be changed, and preserve\nall others.   This ensures that any future bugs with this mask and\nremount will fail in an easy to detect way where new mount flags\nsimply won't change.\n\nAcked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>\nSigned-off-by: \"Eric W. Biederman\" <ebiederm@xmission.com>\nCc: Francis Moreau <francis.moro@gmail.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nChange-Id: Ibd206038f84b8f9f92f7fe9fb64f835048a2e1fb","distinct":true,"url":"https://api.github.com/repos/lg-devs/android_kernel_lge_msm8974-caf/commits/3dbdfc92b80da0e031b2b13154bc2899962fd497"},{"sha":"e09b067c1b832cc417fb91c6634fb2fee0c7b90b","author":{"email":"8a741aa8cbd77ebc4a56ddb528ce9fd15d42f034@xmission.com","name":"Eric W. Biederman"},"message":"mnt: Prevent pivot_root from creating a loop in the mount tree\n\ncommit 0d0826019e529f21c84687521d03f60cd241ca7d upstream.\n\nAndy Lutomirski recently demonstrated that when chroot is used to set\nthe root path below the path for the new ``root'' passed to pivot_root\nthe pivot_root system call succeeds and leaks mounts.\n\nIn examining the code I see that starting with a new root that is\nbelow the current root in the mount tree will result in a loop in the\nmount tree after the mounts are detached and then reattached to one\nanother.  Resulting in all kinds of ugliness including a leak of that\nmounts involved in the leak of the mount loop.\n\nPrevent this problem by ensuring that the new mount is reachable from\nthe current root of the mount tree.\n\n[Added stable cc.  Fixes CVE-2014-7970.  --Andy]\n\nReported-by: Andy Lutomirski <luto@amacapital.net>\nReviewed-by: Andy Lutomirski <luto@amacapital.net>\nLink: http://lkml.kernel.org/r/87bnpmihks.fsf@x220.int.ebiederm.org\nSigned-off-by: \"Eric W. Biederman\" <ebiederm@xmission.com>\nSigned-off-by: Andy Lutomirski <luto@amacapital.net>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>\n\nChange-Id: Ia01b2968d2bbc828a4da1f80e9ab4410f659f354","distinct":true,"url":"https://api.github.com/repos/lg-devs/android_kernel_lge_msm8974-caf/commits/e09b067c1b832cc417fb91c6634fb2fee0c7b90b"},{"sha":"90c691afcb56c0fe8603a13dc9df74a4c26b77b0","author":{"email":"9ff04a02a69f376b2b9aeec27187017cbf3cf5f9@redhat.com","name":"Daniel Borkmann"},"message":"netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages\n\nSome occurences in the netfilter tree use skb_header_pointer() in\nthe following way ...\n\n  struct dccp_hdr _dh, *dh;\n  ...\n  skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);\n\n... where dh itself is a pointer that is being passed as the copy\nbuffer. Instead, we need to use &_dh as the forth argument so that\nwe're copying the data into an actual buffer that sits on the stack.\n\nCurrently, we probably could overwrite memory on the stack (e.g.\nwith a possibly mal-formed DCCP packet), but unintentionally, as\nwe only want the buffer to be placed into _dh variable.\n\nFixes: 2bc780499aa3 (\"[NETFILTER]: nf_conntrack: add DCCP protocol support\")\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\n\nChange-Id: Iaceab03a8a14f399ff4166bc3f63d0c178a09a40","distinct":true,"url":"https://api.github.com/repos/lg-devs/android_kernel_lge_msm8974-caf/commits/90c691afcb56c0fe8603a13dc9df74a4c26b77b0"}]}