{"push_id":555389369,"size":125,"distinct_size":125,"ref":"refs/heads/cm-12.0","head":"c6c494ba3757a8d4ce61eca5ce321b7191e85b63","before":"f137051475e4e7bedf0c875fc7f989f21943d9b7","commits":[{"sha":"8dd5cd7a0f6686cb4425e36491befdf85776862c","author":{"email":"0672176982fbc629cc374f31a7a45ae1671abf90@solarflare.com","name":"Ben Hutchings"},"message":"net: Allow driver to limit number of GSO segments per skb\n\n[ Upstream commit 30b678d844af3305cda5953467005cebb5d7b687 ]\n\nA peer (or local user) may cause TCP to use a nominal MSS of as little\nas 88 (actual MSS of 76 with timestamps).  Given that we have a\nsufficiently prodigious local sender and the peer ACKs quickly enough,\nit is nevertheless possible to grow the window for such a connection\nto the point that we will try to send just under 64K at once.  This\nresults in a single skb that expands to 861 segments.\n\nIn some drivers with TSO support, such an skb will require hundreds of\nDMA descriptors; a substantial fraction of a TX ring or even more than\na full ring.  The TX queue selected for the skb may stall and trigger\nthe TX watchdog repeatedly (since the problem skb will be retried\nafter the TX reset).  This particularly affects sfc, for which the\nissue is designated as CVE-2012-3412.\n\nTherefore:\n1. Add the field net_device::gso_max_segs holding the device-specific\n   limit.\n2. In netif_skb_features(), if the number of segments is too high then\n   mask out GSO features to force fall back to software GSO.\n\nSigned-off-by: Ben Hutchings <bhutchings@solarflare.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/8dd5cd7a0f6686cb4425e36491befdf85776862c"},{"sha":"db302813bb522c463ccf696b9c6646dd8e4a6b28","author":{"email":"0672176982fbc629cc374f31a7a45ae1671abf90@solarflare.com","name":"Ben Hutchings"},"message":"sfc: Fix maximum number of TSO segments and minimum TX queue size\n\n[ Upstream commit 7e6d06f0de3f74ca929441add094518ae332257c ]\n\nCurrently an skb requiring TSO may not fit within a minimum-size TX\nqueue.  The TX queue selected for the skb may stall and trigger the TX\nwatchdog repeatedly (since the problem skb will be retried after the\nTX reset).  This issue is designated as CVE-2012-3412.\n\nSet the maximum number of TSO segments for our devices to 100.  This\nshould make no difference to behaviour unless the actual MSS is less\nthan about 700.  Increase the minimum TX queue size accordingly to\nallow for 2 worst-case skbs, so that there will definitely be space\nto add an skb after we wake a queue.\n\nTo avoid invalidating existing configurations, change\nefx_ethtool_set_ringparam() to fix up values that are too small rather\nthan returning -EINVAL.\n\nSigned-off-by: Ben Hutchings <bhutchings@solarflare.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/db302813bb522c463ccf696b9c6646dd8e4a6b28"},{"sha":"b4f5016f6e756a97a10a0467909947c13647c9a1","author":{"email":"0672176982fbc629cc374f31a7a45ae1671abf90@solarflare.com","name":"Ben Hutchings"},"message":"tcp: Apply device TSO segment limit earlier\n\n[ Upstream commit 1485348d2424e1131ea42efc033cbd9366462b01 ]\n\nCache the device gso_max_segs in sock::sk_gso_max_segs and use it to\nlimit the size of TSO skbs.  This avoids the need to fall back to\nsoftware GSO for local TCP senders.\n\nSigned-off-by: Ben Hutchings <bhutchings@solarflare.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/b4f5016f6e756a97a10a0467909947c13647c9a1"},{"sha":"2ba0cc8905a25b9caca8cb71a9b0f81275648c74","author":{"email":"c13eb7adba3791d7816ec39950f7b93587553548@gmail.com","name":"Hiroaki SHIMODA"},"message":"net_sched: gact: Fix potential panic in tcf_gact().\n\n[ Upstream commit 696ecdc10622d86541f2e35cc16e15b6b3b1b67e ]\n\ngact_rand array is accessed by gact->tcfg_ptype whose value\nis assumed to less than MAX_RAND, but any range checks are\nnot performed.\n\nSo add a check in tcf_gact_init(). And in tcf_gact(), we can\nreduce a branch.\n\nSigned-off-by: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/2ba0cc8905a25b9caca8cb71a9b0f81275648c74"},{"sha":"7c64dcd8330abea0481f0e96a957652268c62c05","author":{"email":"24f7fe9d205c8a9f6ade0c2894e14303ca16087f@intel.com","name":"Wu Fengguang"},"message":"isdnloop: fix and simplify isdnloop_init()\n\n[ Upstream commit 77f00f6324cb97cf1df6f9c4aaeea6ada23abdb2 ]\n\nFix a buffer overflow bug by removing the revision and printk.\n\n[   22.016214] isdnloop-ISDN-driver Rev 1.11.6.7\n[   22.097508] isdnloop: (loop0) virtual card added\n[   22.174400] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff83244972\n[   22.174400]\n[   22.436157] Pid: 1, comm: swapper Not tainted 3.5.0-bisect-00018-gfa8bbb1-dirty #129\n[   22.624071] Call Trace:\n[   22.720558]  [<ffffffff832448c3>] ? CallcNew+0x56/0x56\n[   22.815248]  [<ffffffff8222b623>] panic+0x110/0x329\n[   22.914330]  [<ffffffff83244972>] ? isdnloop_init+0xaf/0xb1\n[   23.014800]  [<ffffffff832448c3>] ? CallcNew+0x56/0x56\n[   23.090763]  [<ffffffff8108e24b>] __stack_chk_fail+0x2b/0x30\n[   23.185748]  [<ffffffff83244972>] isdnloop_init+0xaf/0xb1\n\nSigned-off-by: Fengguang Wu <fengguang.wu@intel.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/7c64dcd8330abea0481f0e96a957652268c62c05"},{"sha":"d56ac4ee818c138a68eadf63125afaa1d446812f","author":{"email":"a9985f635ca4eb5d7c64df6d16c76aa9811509c5@ispras.ru","name":"Alexey Khoroshilov"},"message":"net/core: Fix potential memory leak in dev_set_alias()\n\n[ Upstream commit 7364e445f62825758fa61195d237a5b8ecdd06ec ]\n\nDo not leak memory by updating pointer with potentially NULL realloc return value.\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\nSigned-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/d56ac4ee818c138a68eadf63125afaa1d446812f"},{"sha":"7b3ac6b4795807dc89111a848fac8beaf517004c","author":{"email":"7d2ef6d3fdd2c93a50624b6ed655103deb8bd553@iogearbox.net","name":"danborkmann@iogearbox.net"},"message":"af_packet: remove BUG statement in tpacket_destruct_skb\n\n[ Upstream commit 7f5c3e3a80e6654cf48dfba7cf94f88c6b505467 ]\n\nHere's a quote of the comment about the BUG macro from asm-generic/bug.h:\n\n Don't use BUG() or BUG_ON() unless there's really no way out; one\n example might be detecting data structure corruption in the middle\n of an operation that can't be backed out of.  If the (sub)system\n can somehow continue operating, perhaps with reduced functionality,\n it's probably not BUG-worthy.\n\n If you're tempted to BUG(), think again:  is completely giving up\n really the *only* solution?  There are usually better options, where\n users don't need to reboot ASAP and can mostly shut down cleanly.\n\nIn our case, the status flag of a ring buffer slot is managed from both sides,\nthe kernel space and the user space. This means that even though the kernel\nside might work as expected, the user space screws up and changes this flag\nright between the send(2) is triggered when the flag is changed to\nTP_STATUS_SENDING and a given skb is destructed after some time. Then, this\nwill hit the BUG macro. As David suggested, the best solution is to simply\nremove this statement since it cannot be used for kernel side internal\nconsistency checks. I've tested it and the system still behaves /stable/ in\nthis case, so in accordance with the above comment, we should rather remove it.\n\nSigned-off-by: Daniel Borkmann <daniel.borkmann@tik.ee.ethz.ch>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/7b3ac6b4795807dc89111a848fac8beaf517004c"},{"sha":"db0010a7059d8351414fda02a5a885a22c53fda3","author":{"email":"0672176982fbc629cc374f31a7a45ae1671abf90@solarflare.com","name":"Ben Hutchings"},"message":"ipv6: addrconf: Avoid calling netdevice notifiers with RCU read-side lock\n\n[ Upstream commit 4acd4945cd1e1f92b20d14e349c6c6a52acbd42d ]\n\nCong Wang reports that lockdep detected suspicious RCU usage while\nenabling IPV6 forwarding:\n\n [ 1123.310275] ===============================\n [ 1123.442202] [ INFO: suspicious RCU usage. ]\n [ 1123.558207] 3.6.0-rc1+ #109 Not tainted\n [ 1123.665204] -------------------------------\n [ 1123.768254] include/linux/rcupdate.h:430 Illegal context switch in RCU read-side critical section!\n [ 1123.992320]\n [ 1123.992320] other info that might help us debug this:\n [ 1123.992320]\n [ 1124.307382]\n [ 1124.307382] rcu_scheduler_active = 1, debug_locks = 0\n [ 1124.522220] 2 locks held by sysctl/5710:\n [ 1124.648364]  #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff81768498>] rtnl_trylock+0x15/0x17\n [ 1124.882211]  #1:  (rcu_read_lock){.+.+.+}, at: [<ffffffff81871df8>] rcu_lock_acquire+0x0/0x29\n [ 1125.085209]\n [ 1125.085209] stack backtrace:\n [ 1125.332213] Pid: 5710, comm: sysctl Not tainted 3.6.0-rc1+ #109\n [ 1125.441291] Call Trace:\n [ 1125.545281]  [<ffffffff8109d915>] lockdep_rcu_suspicious+0x109/0x112\n [ 1125.667212]  [<ffffffff8107c240>] rcu_preempt_sleep_check+0x45/0x47\n [ 1125.781838]  [<ffffffff8107c260>] __might_sleep+0x1e/0x19b\n[...]\n [ 1127.445223]  [<ffffffff81757ac5>] call_netdevice_notifiers+0x4a/0x4f\n[...]\n [ 1127.772188]  [<ffffffff8175e125>] dev_disable_lro+0x32/0x6b\n [ 1127.885174]  [<ffffffff81872d26>] dev_forward_change+0x30/0xcb\n [ 1128.013214]  [<ffffffff818738c4>] addrconf_forward_change+0x85/0xc5\n[...]\n\naddrconf_forward_change() uses RCU iteration over the netdev list,\nwhich is unnecessary since it already holds the RTNL lock.  We also\ncannot reasonably require netdevice notifier functions not to sleep.\n\nReported-by: Cong Wang <amwang@redhat.com>\nSigned-off-by: Ben Hutchings <bhutchings@solarflare.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/db0010a7059d8351414fda02a5a885a22c53fda3"},{"sha":"277a61730b97c4b9c213b4db62a4d47e28293b23","author":{"email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com","name":"Mathias Krause"},"message":"atm: fix info leak in getsockopt(SO_ATMPVC)\n\n[ Upstream commit e862f1a9b7df4e8196ebec45ac62295138aa3fc2 ]\n\nThe ATM code fails to initialize the two padding bytes of struct\nsockaddr_atmpvc inserted for alignment. Add an explicit memset(0)\nbefore filling the structure to avoid the info leak.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/277a61730b97c4b9c213b4db62a4d47e28293b23"},{"sha":"121508f89f39a02a0e8779bbcc0894c9853696e1","author":{"email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com","name":"Mathias Krause"},"message":"atm: fix info leak via getsockname()\n\n[ Upstream commit 3c0c5cfdcd4d69ffc4b9c0907cec99039f30a50a ]\n\nThe ATM code fails to initialize the two padding bytes of struct\nsockaddr_atmpvc inserted for alignment. Add an explicit memset(0)\nbefore filling the structure to avoid the info leak.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/121508f89f39a02a0e8779bbcc0894c9853696e1"},{"sha":"bf3d028dfb4733741c4d0800ea68dbec9ce45b35","author":{"email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com","name":"Mathias Krause"},"message":"Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER)\n\n[ Upstream commit e15ca9a0ef9a86f0477530b0f44a725d67f889ee ]\n\nThe HCI code fails to initialize the two padding bytes of struct\nhci_ufilter before copying it to userland -- that for leaking two\nbytes kernel stack. Add an explicit memset(0) before filling the\nstructure to avoid the info leak.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Marcel Holtmann <marcel@holtmann.org>\nCc: Gustavo Padovan <gustavo@padovan.org>\nCc: Johan Hedberg <johan.hedberg@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/bf3d028dfb4733741c4d0800ea68dbec9ce45b35"},{"sha":"db1b2633be299800c314451f3baced31f7ab8058","author":{"email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com","name":"Mathias Krause"},"message":"Bluetooth: HCI - Fix info leak via getsockname()\n\n[ Upstream commit 3f68ba07b1da811bf383b4b701b129bfcb2e4988 ]\n\nThe HCI code fails to initialize the hci_channel member of struct\nsockaddr_hci and that for leaks two bytes kernel stack via the\ngetsockname() syscall. Initialize hci_channel with 0 to avoid the\ninfo leak.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Marcel Holtmann <marcel@holtmann.org>\nCc: Gustavo Padovan <gustavo@padovan.org>\nCc: Johan Hedberg <johan.hedberg@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/db1b2633be299800c314451f3baced31f7ab8058"},{"sha":"f72d6b6da4aa98829293e015813b81f2b0222665","author":{"email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com","name":"Mathias Krause"},"message":"Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST)\n\n[ Upstream commit f9432c5ec8b1e9a09b9b0e5569e3c73db8de432a ]\n\nThe RFCOMM code fails to initialize the two padding bytes of struct\nrfcomm_dev_list_req inserted for alignment before copying it to\nuserland. Additionally there are two padding bytes in each instance of\nstruct rfcomm_dev_info. The ioctl() that for disclosures two bytes plus\ndev_num times two bytes uninitialized kernel heap memory.\n\nAllocate the memory using kzalloc() to fix this issue.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Marcel Holtmann <marcel@holtmann.org>\nCc: Gustavo Padovan <gustavo@padovan.org>\nCc: Johan Hedberg <johan.hedberg@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/f72d6b6da4aa98829293e015813b81f2b0222665"},{"sha":"e824de777af662f349218919a7fd4326c9f5d7ba","author":{"email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com","name":"Mathias Krause"},"message":"Bluetooth: RFCOMM - Fix info leak via getsockname()\n\n[ Upstream commit 9344a972961d1a6d2c04d9008b13617bcb6ec2ef ]\n\nThe RFCOMM code fails to initialize the trailing padding byte of struct\nsockaddr_rc added for alignment. It that for leaks one byte kernel stack\nvia the getsockname() syscall. Add an explicit memset(0) before filling\nthe structure to avoid the info leak.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Marcel Holtmann <marcel@holtmann.org>\nCc: Gustavo Padovan <gustavo@padovan.org>\nCc: Johan Hedberg <johan.hedberg@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/e824de777af662f349218919a7fd4326c9f5d7ba"},{"sha":"d001de340053a92f911c0500215f2e2f4d630769","author":{"email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com","name":"Mathias Krause"},"message":"Bluetooth: L2CAP - Fix info leak via getsockname()\n\n[ Upstream commit 792039c73cf176c8e39a6e8beef2c94ff46522ed ]\n\nThe L2CAP code fails to initialize the l2_bdaddr_type member of struct\nsockaddr_l2 and the padding byte added for alignment. It that for leaks\ntwo bytes kernel stack via the getsockname() syscall. Add an explicit\nmemset(0) before filling the structure to avoid the info leak.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Marcel Holtmann <marcel@holtmann.org>\nCc: Gustavo Padovan <gustavo@padovan.org>\nCc: Johan Hedberg <johan.hedberg@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/d001de340053a92f911c0500215f2e2f4d630769"},{"sha":"4dfbc499f9174fa5ce7532a6566ca11ac93b3888","author":{"email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com","name":"Mathias Krause"},"message":"llc: fix info leak via getsockname()\n\n[ Upstream commit 3592aaeb80290bda0f2cf0b5456c97bfc638b192 ]\n\nThe LLC code wrongly returns 0, i.e. \"success\", when the socket is\nzapped. Together with the uninitialized uaddrlen pointer argument from\nsys_getsockname this leads to an arbitrary memory leak of up to 128\nbytes kernel stack via the getsockname() syscall.\n\nReturn an error instead when the socket is zapped to prevent the info\nleak. Also remove the unnecessary memset(0). We don't directly write to\nthe memory pointed by uaddr but memcpy() a local structure at the end of\nthe function that is properly initialized.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/4dfbc499f9174fa5ce7532a6566ca11ac93b3888"},{"sha":"8b4ca301b79871fcea3a9ad9bfe036eed88b0755","author":{"email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com","name":"Mathias Krause"},"message":"dccp: fix info leak via getsockopt(DCCP_SOCKOPT_CCID_TX_INFO)\n\n[ Upstream commit 7b07f8eb75aa3097cdfd4f6eac3da49db787381d ]\n\nThe CCID3 code fails to initialize the trailing padding bytes of struct\ntfrc_tx_info added for alignment on 64 bit architectures. It that for\npotentially leaks four bytes kernel stack via the getsockopt() syscall.\nAdd an explicit memset(0) before filling the structure to avoid the\ninfo leak.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Gerrit Renker <gerrit@erg.abdn.ac.uk>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/8b4ca301b79871fcea3a9ad9bfe036eed88b0755"},{"sha":"367c7e9b72de50a46c63b946617c95e3f0eef233","author":{"email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com","name":"Mathias Krause"},"message":"ipvs: fix info leak in getsockopt(IP_VS_SO_GET_TIMEOUT)\n\n[ Upstream commit 2d8a041b7bfe1097af21441cb77d6af95f4f4680 ]\n\nIf at least one of CONFIG_IP_VS_PROTO_TCP or CONFIG_IP_VS_PROTO_UDP is\nnot set, __ip_vs_get_timeouts() does not fully initialize the structure\nthat gets copied to userland and that for leaks up to 12 bytes of kernel\nstack. Add an explicit memset(0) before passing the structure to\n__ip_vs_get_timeouts() to avoid the info leak.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Wensong Zhang <wensong@linux-vs.org>\nCc: Simon Horman <horms@verge.net.au>\nCc: Julian Anastasov <ja@ssi.bg>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/367c7e9b72de50a46c63b946617c95e3f0eef233"},{"sha":"e9f26aa0a17f0f3d9b1c18d29028c69b4e55e05d","author":{"email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com","name":"Mathias Krause"},"message":"net: fix info leak in compat dev_ifconf()\n\n[ Upstream commit 43da5f2e0d0c69ded3d51907d9552310a6b545e8 ]\n\nThe implementation of dev_ifconf() for the compat ioctl interface uses\nan intermediate ifc structure allocated in userland for the duration of\nthe syscall. Though, it fails to initialize the padding bytes inserted\nfor alignment and that for leaks four bytes of kernel stack. Add an\nexplicit memset(0) before filling the structure to avoid the info leak.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/e9f26aa0a17f0f3d9b1c18d29028c69b4e55e05d"},{"sha":"cb8f207052471a5c97551751286f14a42d07baf2","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"netlink: fix possible spoofing from non-root processes\n\n[ Upstream commit 20e1db19db5d6b9e4e83021595eab0dc8f107bef ]\n\nNon-root user-space processes can send Netlink messages to other\nprocesses that are well-known for being subscribed to Netlink\nasynchronous notifications. This allows ilegitimate non-root\nprocess to send forged messages to Netlink subscribers.\n\nThe userspace process usually verifies the legitimate origin in\ntwo ways:\n\na) Socket credentials. If UID != 0, then the message comes from\n   some ilegitimate process and the message needs to be dropped.\n\nb) Netlink portID. In general, portID == 0 means that the origin\n   of the messages comes from the kernel. Thus, discarding any\n   message not coming from the kernel.\n\nHowever, ctnetlink sets the portID in event messages that has\nbeen triggered by some user-space process, eg. conntrack utility.\nSo other processes subscribed to ctnetlink events, eg. conntrackd,\nknow that the event was triggered by some user-space action.\n\nNeither of the two ways to discard ilegitimate messages coming\nfrom non-root processes can help for ctnetlink.\n\nThis patch adds capability validation in case that dst_pid is set\nin netlink_sendmsg(). This approach is aggressive since existing\napplications using any Netlink bus to deliver messages between\ntwo user-space processes will break. Note that the exception is\nNETLINK_USERSOCK, since it is reserved for netlink-to-netlink\nuserspace communication.\n\nStill, if anyone wants that his Netlink bus allows netlink-to-netlink\nuserspace, then they can set NL_NONROOT_SEND. However, by default,\nI don't think it makes sense to allow to use NETLINK_ROUTE to\ncommunicate two processes that are sending no matter what information\nthat is not related to link/neighbouring/routing. They should be using\nNETLINK_USERSOCK instead for that.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Cl3Kener/HERC-KERNELS/commits/cb8f207052471a5c97551751286f14a42d07baf2"}]}