{"push_id":905608777,"size":1,"distinct_size":1,"ref":"refs/heads/cm-12.1","head":"06141574648504457452cdf59ae1707e8e8604f6","before":"8a5a1a15483f945a42a39923030d5ad9b5783c2a","commits":[{"sha":"06141574648504457452cdf59ae1707e8e8604f6","author":{"email":"331be22c6b63ca3e0a03d408c2d906b1b02cd5f2@stressinduktion.org","name":"Hannes Frederic Sowa"},"message":"net: add validation for the socket syscall protocol argument\n\n郭永刚 reported that one could simply crash the kernel as root by\nusing a simple program:\n\n\tint socket_fd;\n\tstruct sockaddr_in addr;\n\taddr.sin_port = 0;\n\taddr.sin_addr.s_addr = INADDR_ANY;\n\taddr.sin_family = 10;\n\n\tsocket_fd = socket(10,3,0x40000000);\n\tconnect(socket_fd , &addr,16);\n\nAF_INET, AF_INET6 sockets actually only support 8-bit protocol\nidentifiers. inet_sock's skc_protocol field thus is sized accordingly,\nthus larger protocol identifiers simply cut off the higher bits and\nstore a zero in the protocol fields.\n\nThis could lead to e.g. NULL function pointer because as a result of\nthe cut off inet_num is zero and we call down to inet_autobind, which\nis NULL for raw sockets.\n\nkernel: Call Trace:\nkernel:  [<ffffffff816db90e>] ? inet_autobind+0x2e/0x70\nkernel:  [<ffffffff816db9a4>] inet_dgram_connect+0x54/0x80\nkernel:  [<ffffffff81645069>] SYSC_connect+0xd9/0x110\nkernel:  [<ffffffff810ac51b>] ? ptrace_notify+0x5b/0x80\nkernel:  [<ffffffff810236d8>] ? syscall_trace_enter_phase2+0x108/0x200\nkernel:  [<ffffffff81645e0e>] SyS_connect+0xe/0x10\nkernel:  [<ffffffff81779515>] tracesys_phase2+0x84/0x89\n\nI found no particular commit which introduced this problem.\n\nChange-Id: I653fad90da54908144cc8916c2dccb1fa6f14eed\nCVE: CVE-2015-8543\nCc: Cong Wang <cwang@twopensource.com>\nReported-by: 郭永刚 <guoyonggang@360.cn>\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_samsung_d2/commits/06141574648504457452cdf59ae1707e8e8604f6"}]}