{"push_id":1304564299,"size":8,"distinct_size":8,"ref":"refs/heads/cm-13.0","head":"a57c4b130ae299f86e731443a8500689830715cf","before":"bd110f2dc9048b579c5b20cf9a36f5261c12ddb0","commits":[{"sha":"984e895ff2284b7d962c046bbdc697038d2b7149","author":{"name":"Theodore Ts'o","email":"27d72d8f7672ec04389c6b6ff53fcc4e9145bb77@mit.edu"},"message":"ext4: grab page before starting transaction handle in write_begin()\n\nThe grab_cache_page_write_begin() function can potentially sleep for a\nlong time, since it may need to do memory allocation which can block\nif the system is under significant memory pressure, and because it may\nbe blocked on page writeback. If it does take a long time to grab the\npage, it's better that we not hold an active jbd2 handle.\n\nSo grab a handle on the page first, and _then_ start the transaction\nhandle.\n\nThis commit fixes the following long transaction handle hold time:\n\npostmark-2917 [000] .... 196.435786: jbd2_handle_stats: dev 254,32\ntid 570 type 2 line_no 2541 interval 311 sync 0 requested_blocks 1\ndirtied_blocks 0\n\nSigned-off-by: \"Theodore Ts'o\" <tytso@mit.edu>\nReviewed-by: Jan Kara <jack@suse.cz>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/984e895ff2284b7d962c046bbdc697038d2b7149"},{"sha":"cb194c58e4982556e6d308a8616da7cd8c8f6f98","author":{"name":"Theodore Ts'o","email":"27d72d8f7672ec04389c6b6ff53fcc4e9145bb77@mit.edu"},"message":"ext4: fix ext4_discard_allocated_blocks() if we can't allocate the pa struct\n\nIf there is a failure while allocating the preallocation structure, a\nnumber of blocks can end up getting marked in the in-memory buddy\nbitmap, and then not getting released.  This can result in the\nfollowing corruption getting reported by the kernel:\n\nEXT4-fs error (device sda3): ext4_mb_generate_buddy:758: group 1126,\n12793 clusters in bitmap, 12729 in gd\n\nIn that case, we need to release the blocks using mb_free_blocks().\n\nTested: fs smoke test; also demonstrated that with injected errors,\n\tthe file system is no longer getting corrupted\n\nGoogle-Bug-Id: 16657874\n\nSigned-off-by: \"Theodore Ts'o\" <tytso@mit.edu>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/cb194c58e4982556e6d308a8616da7cd8c8f6f98"},{"sha":"6a2562982235111233911e761889c193b29e87b2","author":{"name":"Hans de Goede","email":"a4b43a7169288183ae7c1f5a0140023a97961f48@redhat.com"},"message":"selinux: classmap: Add mappings for capabilities 35 and 36\n\nThese are present in include/linux/capability.h but are missing from\nsecurity/selinux/include/classmap.h.\n\nNote that capability 36 is called CAP_EPOLLWAKEUP yet it is mapped to\n\"block_suspend\" in classmap.h, this is done because it was renamed later\nto CAP_BLOCK_SUSPEND <sigh> and recent userspace (recent selinux policies)\nexpect it to be named that way.\n\nSigned-off-by: Hans de Goede <hdegoede@redhat.com>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/6a2562982235111233911e761889c193b29e87b2"},{"sha":"e25bdb11d9718f3a27602629ad4333bc327bbb86","author":{"name":"Steven Rostedt","email":"9f626a07de58780741a9085807c77fd646ef3459@goodmis.org"},"message":"SELinux: Fix possible NULL pointer dereference in selinux_inode_permission()\n\nWhile running stress tests on adding and deleting ftrace instances I hit\nthis bug:\n\n  BUG: unable to handle kernel NULL pointer dereference at 0000000000000020\n  IP: selinux_inode_permission+0x85/0x160\n  PGD 63681067 PUD 7ddbe067 PMD 0\n  Oops: 0000 [#1] PREEMPT\n  CPU: 0 PID: 5634 Comm: ftrace-test-mki Not tainted 3.13.0-rc4-test-00033-gd2a6dde-dirty #20\n  Hardware name:                  /DG965MQ, BIOS MQ96510J.86A.0372.2006.0605.1717 06/05/2006\n  task: ffff880078375800 ti: ffff88007ddb0000 task.ti: ffff88007ddb0000\n  RIP: 0010:[<ffffffff812d8bc5>]  [<ffffffff812d8bc5>] selinux_inode_permission+0x85/0x160\n  RSP: 0018:ffff88007ddb1c48  EFLAGS: 00010246\n  RAX: 0000000000000000 RBX: 0000000000800000 RCX: ffff88006dd43840\n  RDX: 0000000000000001 RSI: 0000000000000081 RDI: ffff88006ee46000\n  RBP: ffff88007ddb1c88 R08: 0000000000000000 R09: ffff88007ddb1c54\n  R10: 6e6576652f6f6f66 R11: 0000000000000003 R12: 0000000000000000\n  R13: 0000000000000081 R14: ffff88006ee46000 R15: 0000000000000000\n  FS:  00007f217b5b6700(0000) GS:ffffffff81e21000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033^M\n  CR2: 0000000000000020 CR3: 000000006a0fe000 CR4: 00000000000007f0\n  Call Trace:\n    security_inode_permission+0x1c/0x30\n    __inode_permission+0x41/0xa0\n    inode_permission+0x18/0x50\n    link_path_walk+0x66/0x920\n    path_openat+0xa6/0x6c0\n    do_filp_open+0x43/0xa0\n    do_sys_open+0x146/0x240\n    SyS_open+0x1e/0x20\n    system_call_fastpath+0x16/0x1b\n  Code: 84 a1 00 00 00 81 e3 00 20 00 00 89 d8 83 c8 02 40 f6 c6 04 0f 45 d8 40 f6 c6 08 74 71 80 cf 02 49 8b 46 38 4c 8d 4d cc 45 31 c0 <0f> b7 50 20 8b 70 1c 48 8b 41 70 89 d9 8b 78 04 e8 36 cf ff ff\n  RIP  selinux_inode_permission+0x85/0x160\n  CR2: 0000000000000020\n\nInvestigating, I found that the inode->i_security was NULL, and the\ndereference of it caused the oops.\n\nin selinux_inode_permission():\n\n\tisec = inode->i_security;\n\n\trc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);\n\nNote, the crash came from stressing the deletion and reading of debugfs\nfiles.  I was not able to recreate this via normal files.  But I'm not\nsure they are safe.  It may just be that the race window is much harder\nto hit.\n\nWhat seems to have happened (and what I have traced), is the file is\nbeing opened at the same time the file or directory is being deleted.\nAs the dentry and inode locks are not held during the path walk, nor is\nthe inodes ref counts being incremented, there is nothing saving these\nstructures from being discarded except for an rcu_read_lock().\n\nThe rcu_read_lock() protects against freeing of the inode, but it does\nnot protect freeing of the inode_security_struct.  Now if the freeing of\nthe i_security happens with a call_rcu(), and the i_security field of\nthe inode is not changed (it gets freed as the inode gets freed) then\nthere will be no issue here.  (Linus Torvalds suggested not setting the\nfield to NULL such that we do not need to check if it is NULL in the\npermission check).\n\nNote, this is a hack, but it fixes the problem at hand.  A real fix is\nto restructure the destroy_inode() to call all the destructor handlers\nfrom the RCU callback.  But that is a major job to do, and requires a\nlot of work.  For now, we just band-aid this bug with this fix (it\nworks), and work on a more maintainable solution in the future.\n\nLink: http://lkml.kernel.org/r/20140109101932.0508dec7@gandalf.local.home\nLink: http://lkml.kernel.org/r/20140109182756.17abaaa8@gandalf.local.home\n\nSigned-off-by: Steven Rostedt <rostedt@goodmis.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Luis Henriques <luis.henriques@canonical.com>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/e25bdb11d9718f3a27602629ad4333bc327bbb86"},{"sha":"8628108a86d546fc3e30c856dd5d33fcca5ae8e1","author":{"name":"Stephen Smalley","email":"a113c662ba7e86bc1a8f97e28bfedcdc6b0de5bd@tycho.nsa.gov"},"message":"SELinux: Fix kernel BUG on empty security contexts.\n\nSetting an empty security context (length=0) on a file will\nlead to incorrectly dereferencing the type and other fields\nof the security context structure, yielding a kernel BUG.\nAs a zero-length security context is never valid, just reject\nall such security contexts whether coming from userspace\nvia setxattr or coming from the filesystem upon a getxattr\nrequest by SELinux.\n\nSetting a security context value (empty or otherwise) unknown to\nSELinux in the first place is only possible for a root process\n(CAP_MAC_ADMIN), and, if running SELinux in enforcing mode, only\nif the corresponding SELinux mac_admin permission is also granted\nto the domain by policy.  In Fedora policies, this is only allowed for\nspecific domains such as livecd for setting down security contexts\nthat are not defined in the build host policy.\n\nReproducer:\nsu\nsetenforce 0\ntouch foo\nsetfattr -n security.selinux foo\n\nCaveat:\nRelabeling or removing foo after doing the above may not be possible\nwithout booting with SELinux disabled.  Any subsequent access to foo\nafter doing the above will also trigger the BUG.\n\nBUG output from Matthew Thode:\n[  473.893141] ------------[ cut here ]------------\n[  473.962110] kernel BUG at security/selinux/ss/services.c:654!\n[  473.995314] invalid opcode: 0000 [#6] SMP\n[  474.027196] Modules linked in:\n[  474.058118] CPU: 0 PID: 8138 Comm: ls Tainted: G      D   I\n3.13.0-grsec #1\n[  474.116637] Hardware name: Supermicro X8ST3/X8ST3, BIOS 2.0\n07/29/10\n[  474.149768] task: ffff8805f50cd010 ti: ffff8805f50cd488 task.ti:\nffff8805f50cd488\n[  474.183707] RIP: 0010:[<ffffffff814681c7>]  [<ffffffff814681c7>]\ncontext_struct_compute_av+0xce/0x308\n[  474.219954] RSP: 0018:ffff8805c0ac3c38  EFLAGS: 00010246\n[  474.252253] RAX: 0000000000000000 RBX: ffff8805c0ac3d94 RCX:\n0000000000000100\n[  474.287018] RDX: ffff8805e8aac000 RSI: 00000000ffffffff RDI:\nffff8805e8aaa000\n[  474.321199] RBP: ffff8805c0ac3cb8 R08: 0000000000000010 R09:\n0000000000000006\n[  474.357446] R10: 0000000000000000 R11: ffff8805c567a000 R12:\n0000000000000006\n[  474.419191] R13: ffff8805c2b74e88 R14: 00000000000001da R15:\n0000000000000000\n[  474.453816] FS:  00007f2e75220800(0000) GS:ffff88061fc00000(0000)\nknlGS:0000000000000000\n[  474.489254] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  474.522215] CR2: 00007f2e74716090 CR3: 00000005c085e000 CR4:\n00000000000207f0\n[  474.556058] Stack:\n[  474.584325]  ffff8805c0ac3c98 ffffffff811b549b ffff8805c0ac3c98\nffff8805f1190a40\n[  474.618913]  ffff8805a6202f08 ffff8805c2b74e88 00068800d0464990\nffff8805e8aac860\n[  474.653955]  ffff8805c0ac3cb8 000700068113833a ffff880606c75060\nffff8805c0ac3d94\n[  474.690461] Call Trace:\n[  474.723779]  [<ffffffff811b549b>] ? lookup_fast+0x1cd/0x22a\n[  474.778049]  [<ffffffff81468824>] security_compute_av+0xf4/0x20b\n[  474.811398]  [<ffffffff8196f419>] avc_compute_av+0x2a/0x179\n[  474.843813]  [<ffffffff8145727b>] avc_has_perm+0x45/0xf4\n[  474.875694]  [<ffffffff81457d0e>] inode_has_perm+0x2a/0x31\n[  474.907370]  [<ffffffff81457e76>] selinux_inode_getattr+0x3c/0x3e\n[  474.938726]  [<ffffffff81455cf6>] security_inode_getattr+0x1b/0x22\n[  474.970036]  [<ffffffff811b057d>] vfs_getattr+0x19/0x2d\n[  475.000618]  [<ffffffff811b05e5>] vfs_fstatat+0x54/0x91\n[  475.030402]  [<ffffffff811b063b>] vfs_lstat+0x19/0x1b\n[  475.061097]  [<ffffffff811b077e>] SyS_newlstat+0x15/0x30\n[  475.094595]  [<ffffffff8113c5c1>] ? __audit_syscall_entry+0xa1/0xc3\n[  475.148405]  [<ffffffff8197791e>] system_call_fastpath+0x16/0x1b\n[  475.179201] Code: 00 48 85 c0 48 89 45 b8 75 02 0f 0b 48 8b 45 a0 48\n8b 3d 45 d0 b6 00 8b 40 08 89 c6 ff ce e8 d1 b0 06 00 48 85 c0 49 89 c7\n75 02 <0f> 0b 48 8b 45 b8 4c 8b 28 eb 1e 49 8d 7d 08 be 80 01 00 00 e8\n[  475.255884] RIP  [<ffffffff814681c7>]\ncontext_struct_compute_av+0xce/0x308\n[  475.296120]  RSP <ffff8805c0ac3c38>\n[  475.328734] ---[ end trace f076482e9d754adc ]---\n\nReported-by:  Matthew Thode <mthode@mthode.org>\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>\nCc: stable@vger.kernel.org\nSigned-off-by: Paul Moore <pmoore@redhat.com>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/8628108a86d546fc3e30c856dd5d33fcca5ae8e1"},{"sha":"971abfe0c80efd8a2f19ad9cfa8677b00dc44997","author":{"name":"Vineeta Srivastava","email":"d39190360d5c6afcb6ced8b0844a2f29572379a4@google.com"},"message":"Fix sizeof-pointer-memaccess warning with gcc 4.8\n\nThis patch fixes wrong memcpy size when copying ltk value to\nHCI_OP_LE_LTK_REPLY command.","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/971abfe0c80efd8a2f19ad9cfa8677b00dc44997"},{"sha":"1db15116666963cdeacdb5dc6830cf0dd2b589cd","author":{"name":"Lorenzo Colitti","email":"bb03c7a1072f7993eaae5ac54ef7bc06e4588478@google.com"},"message":"net: ipv6: Add IPv6 support to the ping socket.\n\n[backport of net-next 6d0bfe22611602f36617bc7aa2ffa1bbb2f54c67]\n\nThis adds the ability to send ICMPv6 echo requests without a\nraw socket. The equivalent ability for ICMPv4 was added in\n2011.\n\nInstead of having separate code paths for IPv4 and IPv6, make\nmost of the code in net/ipv4/ping.c dual-stack and only add a\nfew IPv6-specific bits (like the protocol definition) to a new\nnet/ipv6/ping.c. Hopefully this will reduce divergence and/or\nduplication of bugs in the future.\n\nCaveats:\n\n- Setting options via ancillary data (e.g., using IPV6_PKTINFO\n  to specify the outgoing interface) is not yet supported.\n- There are no separate security settings for IPv4 and IPv6;\n  everything is controlled by /proc/net/ipv4/ping_group_range.\n- The proc interface does not yet display IPv6 ping sockets\n  properly.\n\nTested with a patched copy of ping6 and using raw socket calls.\nCompiles and works with all of CONFIG_IPV6={n,m,y}.\n\nChange-Id: I0081b4654dd54b12c8f233e00e18943582aa2142\nSigned-off-by: Lorenzo Colitti <lorenzo@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n[lorenzo@google.com: backported to 3.4]\nSigned-off-by: Lorenzo Colitti <lorenzo@google.com>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/1db15116666963cdeacdb5dc6830cf0dd2b589cd"},{"sha":"a57c4b130ae299f86e731443a8500689830715cf","author":{"name":"Linus Torvalds","email":"ead7104581934751970e9decb2db5deb20a9e407@linux-foundation.org"},"message":"net/l2tp: don't fall back on UDP [get|set]sockopt\n\nThe l2tp [get|set]sockopt() code has fallen back to the UDP functions\nfor socket option levels != SOL_PPPOL2TP since day one, but that has\nnever actually worked, since the l2tp socket isn't an inet socket.\n\nAs David Miller points out:\n\n  \"If we wanted this to work, it'd have to look up the tunnel and then\n   use tunnel->sk, but I wonder how useful that would be\"\n\nSince this can never have worked so nobody could possibly have depended\non that functionality, just remove the broken code and return -EINVAL.\n\nReported-by: Sasha Levin <sasha.levin@oracle.com>\nAcked-by: James Chapman <jchapman@katalix.com>\nAcked-by: David Miller <davem@davemloft.net>\nCc: Phil Turnbull <phil.turnbull@oracle.com>\nCc: Vegard Nossum <vegard.nossum@oracle.com>\nCc: Willy Tarreau <w@1wt.eu>\nCc: stable@vger.kernel.org\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/a57c4b130ae299f86e731443a8500689830715cf"}]}
{"actor":{"display_login":"sigma-1"}}