{"push_id":652150175,"size":12,"distinct_size":1,"ref":"refs/heads/kk-dev6","head":"1472ec9032798d4b02f9ebc43d14404f6c7a70ab","before":"7af42a549e3a63e0373ff4cd3ba845b23d5171a9","commits":[{"sha":"c56c84161c564b25aa5ea7fcd2098e5050c96ac7","author":{"email":"8c1011c9d06fc72acd93645d683782ab9543044d@google.com","name":"Michael Halcrow"},"message":"eCryptfs: Remove buggy and unnecessary write in file name decode routine\n\nDmitry Chernenkov used KASAN to discover that eCryptfs writes past the\nend of the allocated buffer during encrypted filename decoding. This\nfix corrects the issue by getting rid of the unnecessary 0 write when\nthe current bit offset is 2.\n\nChange-Id: Id8e04a580e550495c46cd36fec430a1ec4342940\nSigned-off-by: Michael Halcrow <mhalcrow@google.com>\nReported-by: Dmitry Chernenkov <dmitryc@google.com>\nSuggested-by: Kees Cook <keescook@chromium.org>\nCc: stable@vger.kernel.org # v2.6.29+: 51ca58d eCryptfs: Filename Encryption: Encoding and encryption functions\nSigned-off-by: Tyler Hicks <tyhicks@canonical.com>","distinct":false,"url":"https://api.github.com/repos/rcristi/android_kernel_htc_msm8960/commits/c56c84161c564b25aa5ea7fcd2098e5050c96ac7"},{"sha":"93dd704594f08b0f9a2deb42796518f1bd5630ce","author":{"email":"cef439e78636cdab99cd2923826c5065a0743e5b@strlen.de","name":"Florian Westphal"},"message":"netfilter: conntrack: disable generic tracking for known protocols\n\nGiven following iptables ruleset:\n\n-P FORWARD DROP\n-A FORWARD -m sctp --dport 9 -j ACCEPT\n-A FORWARD -p tcp --dport 80 -j ACCEPT\n-A FORWARD -p tcp -m conntrack -m state ESTABLISHED,RELATED -j ACCEPT\n\nOne would assume that this allows SCTP on port 9 and TCP on port 80.\nUnfortunately, if the SCTP conntrack module is not loaded, this allows\n*all* SCTP communication, to pass though, i.e. -p sctp -j ACCEPT,\nwhich we think is a security issue.\n\nThis is because on the first SCTP packet on port 9, we create a dummy\n\"generic l4\" conntrack entry without any port information (since\nconntrack doesn't know how to extract this information).\n\nAll subsequent packets that are unknown will then be in established\nstate since they will fallback to proto_generic and will match the\n'generic' entry.\n\nOur originally proposed version [1] completely disabled generic protocol\ntracking, but Jozsef suggests to not track protocols for which a more\nsuitable helper is available, hence we now mitigate the issue for in\ntree known ct protocol helpers only, so that at least NAT and direction\ninformation will still be preserved for others.\n\n [1] http://www.spinics.net/lists/netfilter-devel/msg33430.html\n\nJoint work with Daniel Borkmann.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nAcked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\n\nConflicts:\n\tnet/netfilter/nf_conntrack_proto_generic.c\n\nChange-Id: I5f7ddfa2d29672cc4533ad907bd7605bdc6c4bf7","distinct":false,"url":"https://api.github.com/repos/rcristi/android_kernel_htc_msm8960/commits/93dd704594f08b0f9a2deb42796518f1bd5630ce"},{"sha":"a5f60de7509b0a6567dc27390d6f5f76b12c5849","author":{"email":"0d1dae58f23e775314d087dff72f8e136928d2cc@codeaurora.org","name":"raghavendra ambadas"},"message":"msm: mdp: Validate input arguments from user space\n\nFully verify the input arguments from user client are safe\nto use.\n\nChange-Id: Ie14332443b187951009c63ebfb78456dcd9ba60f\nSigned-off-by: Raghavendra Ambadas <rambad@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/rcristi/android_kernel_htc_msm8960/commits/a5f60de7509b0a6567dc27390d6f5f76b12c5849"},{"sha":"4701351775b000b904cd990f7bad36501ff2d9cd","author":{"email":"8a741aa8cbd77ebc4a56ddb528ce9fd15d42f034@xmission.com","name":"Eric W. Biederman"},"message":"mnt: Only change user settable mount flags in remount\n\ncommit a6138db815df5ee542d848318e5dae681590fccd upstream.\n\nKenton Varda <kenton@sandstorm.io> discovered that by remounting a\nread-only bind mount read-only in a user namespace the\nMNT_LOCK_READONLY bit would be cleared, allowing an unprivileged user\nto the remount a read-only mount read-write.\n\nCorrect this by replacing the mask of mount flags to preserve\nwith a mask of mount flags that may be changed, and preserve\nall others.   This ensures that any future bugs with this mask and\nremount will fail in an easy to detect way where new mount flags\nsimply won't change.\n\nChange-Id: I99aeb9d5e210320201438bed83aea9b143dceda7\nAcked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>\nSigned-off-by: \"Eric W. Biederman\" <ebiederm@xmission.com>\nCc: Francis Moreau <francis.moro@gmail.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","distinct":false,"url":"https://api.github.com/repos/rcristi/android_kernel_htc_msm8960/commits/4701351775b000b904cd990f7bad36501ff2d9cd"},{"sha":"a67703476d1be9c159b11793b91b20304c3827cc","author":{"email":"8a741aa8cbd77ebc4a56ddb528ce9fd15d42f034@xmission.com","name":"Eric W. Biederman"},"message":"mnt: Prevent pivot_root from creating a loop in the mount tree\n\ncommit 0d0826019e529f21c84687521d03f60cd241ca7d upstream.\n\nAndy Lutomirski recently demonstrated that when chroot is used to set\nthe root path below the path for the new ``root'' passed to pivot_root\nthe pivot_root system call succeeds and leaks mounts.\n\nIn examining the code I see that starting with a new root that is\nbelow the current root in the mount tree will result in a loop in the\nmount tree after the mounts are detached and then reattached to one\nanother.  Resulting in all kinds of ugliness including a leak of that\nmounts involved in the leak of the mount loop.\n\nPrevent this problem by ensuring that the new mount is reachable from\nthe current root of the mount tree.\n\n[Added stable cc.  Fixes CVE-2014-7970.  --Andy]\n\nChange-Id: Ia508d33f3ee452b47da3fc52eb9b89c01abaf4f7\nReported-by: Andy Lutomirski <luto@amacapital.net>\nReviewed-by: Andy Lutomirski <luto@amacapital.net>\nLink: http://lkml.kernel.org/r/87bnpmihks.fsf@x220.int.ebiederm.org\nSigned-off-by: \"Eric W. Biederman\" <ebiederm@xmission.com>\nSigned-off-by: Andy Lutomirski <luto@amacapital.net>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>","distinct":false,"url":"https://api.github.com/repos/rcristi/android_kernel_htc_msm8960/commits/a67703476d1be9c159b11793b91b20304c3827cc"},{"sha":"159c6a86244c0be29f9075376a2799501382970b","author":{"email":"9ff04a02a69f376b2b9aeec27187017cbf3cf5f9@redhat.com","name":"Daniel Borkmann"},"message":"netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages\n\nSome occurences in the netfilter tree use skb_header_pointer() in\nthe following way ...\n\n  struct dccp_hdr _dh, *dh;\n  ...\n  skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);\n\n... where dh itself is a pointer that is being passed as the copy\nbuffer. Instead, we need to use &_dh as the forth argument so that\nwe're copying the data into an actual buffer that sits on the stack.\n\nCurrently, we probably could overwrite memory on the stack (e.g.\nwith a possibly mal-formed DCCP packet), but unintentionally, as\nwe only want the buffer to be placed into _dh variable.\n\nChange-Id: I3a61724089c8f928af25af51597991eaba293843\nFixes: 2bc780499aa3 (\"[NETFILTER]: nf_conntrack: add DCCP protocol support\")\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/rcristi/android_kernel_htc_msm8960/commits/159c6a86244c0be29f9075376a2799501382970b"},{"sha":"b7bcd0ec9169a31c3ef43b9f00433c967228882c","author":{"email":"e642b69ed2fc111e09ffdc37feb733a52253340d@oracle.com","name":"Sasha Levin"},"message":"vfs: read file_handle only once in handle_to_path\n\nWe used to read file_handle twice. Once to get the amount of extra bytes, and\nonce to fetch the entire structure.\n\nThis may be problematic since we do size verifications only after the first\nread, so if the number of extra bytes changes in userspace between the first\nand second calls, we'll have an incoherent view of file_handle.\n\nInstead, read the constant size once, and copy that over to the final\nstructure without having to re-read it again.\n\nChange-Id: Ib05e5129629e27d5a05953098c5bc470fae40d2a\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":false,"url":"https://api.github.com/repos/rcristi/android_kernel_htc_msm8960/commits/b7bcd0ec9169a31c3ef43b9f00433c967228882c"},{"sha":"9aef54c219bb99b355945beade7787bbb89af2cc","author":{"email":"eec72676ad9a62f2727dfed6d270d98c0d02adec@linux.intel.com","name":"Kirill A. Shutemov"},"message":"mm: Fix NULL pointer dereference in madvise(MADV_WILLNEED) support\n\nSasha Levin found a NULL pointer dereference that is due to a missing\npage table lock, which in turn is due to the pmd entry in question being\na transparent huge-table entry.\n\nThe code - introduced in commit 1998cc048901 (\"mm: make\nmadvise(MADV_WILLNEED) support swap file prefetch\") - correctly checks\nfor this situation using pmd_none_or_trans_huge_or_clear_bad(), but it\nturns out that that function doesn't work correctly.\n\npmd_none_or_trans_huge_or_clear_bad() expected that pmd_bad() would\ntrigger if the transparent hugepage bit was set, but it doesn't do that\nif pmd_numa() is also set. Note that the NUMA bit only gets set on real\nNUMA machines, so people trying to reproduce this on most normal\ndevelopment systems would never actually trigger this.\n\nFix it by removing the very subtle (and subtly incorrect) expectation,\nand instead just checking pmd_trans_huge() explicitly.\n\nReported-by: Sasha Levin <sasha.levin@oracle.com>\nAcked-by: Andrea Arcangeli <aarcange@redhat.com>\n[ Additionally remove the now stale test for pmd_trans_huge() inside the\n  pmd_bad() case - Linus ]\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n\nChange-Id: I3f3763f236ef102de735297cd175cf514d40d28f","distinct":false,"url":"https://api.github.com/repos/rcristi/android_kernel_htc_msm8960/commits/9aef54c219bb99b355945beade7787bbb89af2cc"},{"sha":"d1ac1ae894c4b48804dd3b856688fcc47302edab","author":{"email":"257d7d5bef225e0a56b3375b0c1e95c6bb0ab871@modio.se","name":"D.S. Ljungmark"},"message":"ipv6: Don't reduce hop limit for an interface\n\nA local route may have a lower hop_limit set than global routes do.\n\nRFC 3756, Section 4.2.7, \"Parameter Spoofing\"\n\n>   1.  The attacker includes a Current Hop Limit of one or another small\n>       number which the attacker knows will cause legitimate packets to\n>       be dropped before they reach their destination.\n\n>   As an example, one possible approach to mitigate this threat is to\n>   ignore very small hop limits.  The nodes could implement a\n>   configurable minimum hop limit, and ignore attempts to set it below\n>   said limit.\n\nChange-Id: I51ee1778e3d2d5fa1aefbdf1ad8869e4e8dc28b2\nSigned-off-by: D.S. Ljungmark <ljungmark@modio.se>\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/rcristi/android_kernel_htc_msm8960/commits/d1ac1ae894c4b48804dd3b856688fcc47302edab"},{"sha":"9f39b7237e3dfa771f53b552af88782a4ca21153","author":{"email":"e642b69ed2fc111e09ffdc37feb733a52253340d@oracle.com","name":"Sasha Levin"},"message":"net: llc: use correct size for sysctl timeout entries\n\nThe timeout entries are sizeof(int) rather than sizeof(long), which\nmeans that when they were getting read we'd also leak kernel memory\nto userspace along with the timeout values.\n\nChange-Id: I328d1186720a6f70f555eeeb62c83ee69814868d\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/rcristi/android_kernel_htc_msm8960/commits/9f39b7237e3dfa771f53b552af88782a4ca21153"},{"sha":"25e030eb5a5ef343559c59f65de12bdc0834818e","author":{"email":"fe08d3c717adf2ae63592e4c9aec6e3e404d8e3e@davemloft.net","name":"David S. Miller"},"message":"ipv4: Missing sk_nulls_node_init() in ping_unhash().\n\nIf we don't do that, then the poison value is left in the ->pprev\nbacklink.\n\nThis can cause crashes if we do a disconnect, followed by a connect().\n\nChange-Id: I021261c6639339a0d027ee5cb086ba7301db334a\nTested-by: Linus Torvalds <torvalds@linux-foundation.org>\nReported-by: Wen Xu <hotdog3645@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/rcristi/android_kernel_htc_msm8960/commits/25e030eb5a5ef343559c59f65de12bdc0834818e"},{"sha":"1472ec9032798d4b02f9ebc43d14404f6c7a70ab","author":{"email":"f169e76e52db3e1fb4e30944db7ddd6efb8f01ee@gmail.com","name":"Cristian RAUTA"},"message":"Merge remote-tracking branch 'cyanogenmod/cm-11.0' into kk-dev6","distinct":true,"url":"https://api.github.com/repos/rcristi/android_kernel_htc_msm8960/commits/1472ec9032798d4b02f9ebc43d14404f6c7a70ab"}]}