{"push_id":839600721,"size":3,"distinct_size":3,"ref":"refs/heads/cm-13.0","head":"7fc0183eafab217e4bf30a6cf431eb4086b24c38","before":"bb354feced765ec8a144e27f564ff7880ec28026","commits":[{"sha":"74402d1e7062f53b0d65421a5fccdc88b2161bd2","author":{"email":"de609eb4d5d70b1d38ec6642adbfc33a2781f63c@zeniv.linux.org.uk","name":"Al Viro"},"message":"vfs: new internal helper: mnt_has_parent(mnt)\n\nvfsmounts have ->mnt_parent pointing either to a different vfsmount\nor to itself; it's never NULL and termination condition in loops\ntraversing the tree towards root is mnt == mnt->mnt_parent.  At least\none place (see the next patch) is confused about what's going on;\nlet's add an explicit helper checking it right way and use it in\nall places where we need it.  Not that there had been too many,\nbut...\n\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\n(cherry picked from commit b2dba1af3c4157040303a76d25216b1713d333d0)\nCVE-2014-7970\nBugLink: http://bugs.launchpad.net/bugs/1383356\nSigned-off-by: Luis Henriques <luis.henriques@canonical.com>\nAcked-by: Stefan Bader <stefan.bader@canonical.com>\nAcked-by: Andy Whitcroft <apw@canonical.com>\nSigned-off-by: Andy Whitcroft <apw@canonical.com>\n\nChange-Id: Iaa5ab510804f3b17fe71197b8919d663a416bf05","distinct":true,"url":"https://api.github.com/repos/CCD-1997/android_kernel_samsung_espresso10/commits/74402d1e7062f53b0d65421a5fccdc88b2161bd2"},{"sha":"ba71933fdc46e808f0621aa3a5fb7876c15ed892","author":{"email":"de609eb4d5d70b1d38ec6642adbfc33a2781f63c@zeniv.linux.org.uk","name":"Al Viro"},"message":"vfs: more mnt_parent cleanups\n\na) mount --move is checking that ->mnt_parent is non-NULL before\nlooking if that parent happens to be shared; ->mnt_parent is never\nNULL and it's not even an misspelled !mnt_has_parent()\n\nb) pivot_root open-codes is_path_reachable(), poorly.\n\nc) so does path_is_under(), while we are at it.\n\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\n(backported from commit afac7cba7ed31968a95e181dc25e204e45009ea8)\nCVE-2014-7970\nBugLink: http://bugs.launchpad.net/bugs/1383356\nSigned-off-by: Luis Henriques <luis.henriques@canonical.com>\nAcked-by: Stefan Bader <stefan.bader@canonical.com>\nAcked-by: Andy Whitcroft <apw@canonical.com>\nSigned-off-by: Andy Whitcroft <apw@canonical.com>\n\nChange-Id: I6b2297f46388f135c1b760a37d45efc0e33542db","distinct":true,"url":"https://api.github.com/repos/CCD-1997/android_kernel_samsung_espresso10/commits/ba71933fdc46e808f0621aa3a5fb7876c15ed892"},{"sha":"7fc0183eafab217e4bf30a6cf431eb4086b24c38","author":{"email":"8a741aa8cbd77ebc4a56ddb528ce9fd15d42f034@xmission.com","name":"Eric W. Biederman"},"message":"mnt: Prevent pivot_root from creating a loop in the mount tree\n\nAndy Lutomirski recently demonstrated that when chroot is used to set\nthe root path below the path for the new ``root'' passed to pivot_root\nthe pivot_root system call succeeds and leaks mounts.\n\nIn examining the code I see that starting with a new root that is\nbelow the current root in the mount tree will result in a loop in the\nmount tree after the mounts are detached and then reattached to one\nanother.  Resulting in all kinds of ugliness including a leak of that\nmounts involved in the leak of the mount loop.\n\nPrevent this problem by ensuring that the new mount is reachable from\nthe current root of the mount tree.\n\n[Added stable cc.  Fixes CVE-2014-7970.  --Andy]\n\nCc: stable@vger.kernel.org\nReported-by: Andy Lutomirski <luto@amacapital.net>\nReviewed-by: Andy Lutomirski <luto@amacapital.net>\nLink: http://lkml.kernel.org/r/87bnpmihks.fsf@x220.int.ebiederm.org\nSigned-off-by: \"Eric W. Biederman\" <ebiederm@xmission.com>\nSigned-off-by: Andy Lutomirski <luto@amacapital.net>\n(backported from commit 0d0826019e529f21c84687521d03f60cd241ca7d)\nCVE-2014-7970\nBugLink: http://bugs.launchpad.net/bugs/1383356\nSigned-off-by: Luis Henriques <luis.henriques@canonical.com>\nAcked-by: Stefan Bader <stefan.bader@canonical.com>\nAcked-by: Andy Whitcroft <apw@canonical.com>\nSigned-off-by: Andy Whitcroft <apw@canonical.com>\n\nChange-Id: I0fe1d090eeb4765cc49401784e44a430f9585498","distinct":true,"url":"https://api.github.com/repos/CCD-1997/android_kernel_samsung_espresso10/commits/7fc0183eafab217e4bf30a6cf431eb4086b24c38"}]}