{"push_id":1195930037,"size":3,"distinct_size":3,"ref":"refs/heads/aosp-common/android-4.4","head":"5b2129ec25a33cda9662232afdfa6af7c9bc168a","before":"eb976ed445e57de1e6469b9f3a1aaf33f862c1dd","commits":[{"sha":"e6ec611adde326cd28f0692a263b31821f86b071","author":{"name":"Jann Horn","email":"56d347afa87ea2ef19771afd2a88746144865893@thejh.net"},"message":"BACKPORT: ptrace: use fsuid, fsgid, effective creds for fs access checks\n\nThis patch backports 969624b (which backports caaee6234d0 upstream),\nfrom the v4.4-stable branch to the common/android-4.4 branch.\n\nThis patch is needed to provide the PTRACE_MODE_ATTACH_FSCREDS definition\nwhich was used by the backported version of proc/<tid>/timerslack_ns\nin change-id: Ie5799b9a3402a31f88cd46437dcda4a0e46415a7\n\ncommit caaee6234d05a58c5b4d05e7bf766131b810a657 upstream.\n\nBy checking the effective credentials instead of the real UID / permitted\ncapabilities, ensure that the calling process actually intended to use its\ncredentials.\n\nTo ensure that all ptrace checks use the correct caller credentials (e.g.\nin case out-of-tree code or newly added code omits the PTRACE_MODE_*CREDS\nflag), use two new flags and require one of them to be set.\n\nThe problem was that when a privileged task had temporarily dropped its\nprivileges, e.g.  by calling setreuid(0, user_uid), with the intent to\nperform following syscalls with the credentials of a user, it still passed\nptrace access checks that the user would not be able to pass.\n\nWhile an attacker should not be able to convince the privileged task to\nperform a ptrace() syscall, this is a problem because the ptrace access\ncheck is reused for things in procfs.\n\nIn particular, the following somewhat interesting procfs entries only rely\non ptrace access checks:\n\n /proc/$pid/stat - uses the check for determining whether pointers\n     should be visible, useful for bypassing ASLR\n /proc/$pid/maps - also useful for bypassing ASLR\n /proc/$pid/cwd - useful for gaining access to restricted\n     directories that contain files with lax permissions, e.g. in\n     this scenario:\n     lrwxrwxrwx root root /proc/13020/cwd -> /root/foobar\n     drwx------ root root /root\n     drwxr-xr-x root root /root/foobar\n     -rw-r--r-- root root /root/foobar/secret\n\nTherefore, on a system where a root-owned mode 6755 binary changes its\neffective credentials as described and then dumps a user-specified file,\nthis could be used by an attacker to reveal the memory layout of root's\nprocesses or reveal the contents of files he is not allowed to access\n(through /proc/$pid/cwd).\n\n[akpm@linux-foundation.org: fix warning]\nSigned-off-by: Jann Horn <jann@thejh.net>\nAcked-by: Kees Cook <keescook@chromium.org>\nCc: Casey Schaufler <casey@schaufler-ca.com>\nCc: Oleg Nesterov <oleg@redhat.com>\nCc: Ingo Molnar <mingo@redhat.com>\nCc: James Morris <james.l.morris@oracle.com>\nCc: \"Serge E. Hallyn\" <serge.hallyn@ubuntu.com>\nCc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>\nCc: Andy Lutomirski <luto@kernel.org>\nCc: Al Viro <viro@zeniv.linux.org.uk>\nCc: \"Eric W. Biederman\" <ebiederm@xmission.com>\nCc: Willy Tarreau <w@1wt.eu>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n[jstultz: Cherry-picked for common/android-4.4]\nSigned-off-by: John Stultz <john.stultz@linaro.org>","distinct":true,"url":"https://api.github.com/repos/olivieer/kernel_msm/commits/e6ec611adde326cd28f0692a263b31821f86b071"},{"sha":"50437c019f146eb138d819d558a3f562419573fa","author":{"name":"Bjørn Mork","email":"73004647096653cb035375f893ae959ac7bd4f38@mork.no"},"message":"UPSTREAM: cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind\n\n(cherry pick from commit 4d06dd537f95683aba3651098ae288b7cbff8274)\n\nusbnet_link_change will call schedule_work and should be\navoided if bind is failing. Otherwise we will end up with\nscheduled work referring to a netdev which has gone away.\n\nInstead of making the call conditional, we can just defer\nit to usbnet_probe, using the driver_info flag made for\nthis purpose.\n\nFixes: 8a34b0ae8778 (\"usbnet: cdc_ncm: apply usbnet_link_change\")\nReported-by: Andrey Konovalov <andreyknvl@gmail.com>\nSuggested-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Bjørn Mork <bjorn@mork.no>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nChange-Id: Id9a6d02bdd98bf495d26595cf2cc90e480746186\nBug: 28744625","distinct":true,"url":"https://api.github.com/repos/olivieer/kernel_msm/commits/50437c019f146eb138d819d558a3f562419573fa"},{"sha":"5b2129ec25a33cda9662232afdfa6af7c9bc168a","author":{"name":"Daniel Rosenberg","email":"ba8cfe5d21fcfdde5eed8cabcaff0549d9612a2a@google.com"},"message":"sdcardfs: Truncate packages_gid.list on overflow\n\npackages_gid.list was improperly returning the wrong\ncount. Use scnprintf instead, and inform the user that\nthe list was truncated if it is.\n\nBug: 30013843\nChange-Id: Ida2b2ef7cd86dd87300bfb4c2cdb6bfe2ee1650d\nSigned-off-by: Daniel Rosenberg <drosen@google.com>","distinct":true,"url":"https://api.github.com/repos/olivieer/kernel_msm/commits/5b2129ec25a33cda9662232afdfa6af7c9bc168a"}]}
{"actor":{"display_login":"pepe-bot"}}