{"push_id":988973184,"size":8,"distinct_size":8,"ref":"refs/heads/cm-13.0","head":"096edea7148f5e05258f9b42f66d3fc39ee2c607","before":"cf2b5fe313aad26530d5d46af9222ce367a452d2","commits":[{"sha":"a7a9d8516ec987f32d62e33594210a0fee392498","author":{"email":"74c05afa918858348d6db8037d82fa8124870113@openvz.org","name":"Andrey Vagin"},"message":"netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len\n\n\"len\" contains sizeof(nf_ct_ext) and size of extensions. In a worst\ncase it can contain all extensions. Bellow you can find sizes for all\ntypes of extensions. Their sum is definitely bigger than 256.\n\nnf_ct_ext_types[0]->len = 24\nnf_ct_ext_types[1]->len = 32\nnf_ct_ext_types[2]->len = 24\nnf_ct_ext_types[3]->len = 32\nnf_ct_ext_types[4]->len = 152\nnf_ct_ext_types[5]->len = 2\nnf_ct_ext_types[6]->len = 16\nnf_ct_ext_types[7]->len = 8\n\nI have seen \"len\" up to 280 and my host has crashes w/o this patch.\n\nThe right way to fix this problem is reducing the size of the ecache\nextension (4) and Florian is going to do this, but these changes will\nbe quite large to be appropriate for a stable tree.\n\nChange-Id: Id44470ab1d54526993927cdda68342e591a5d6c3\nFixes: 5b423f6a40a0 (netfilter: nf_conntrack: fix racy timer handling with reliable)\nCc: Pablo Neira Ayuso <pablo@netfilter.org>\nCc: Patrick McHardy <kaber@trash.net>\nCc: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>\nCc: \"David S. Miller\" <davem@davemloft.net>\nSigned-off-by: Andrey Vagin <avagin@openvz.org>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":true,"url":"https://api.github.com/repos/PoisonNinja/android_kernel_samsung_smdk4412/commits/a7a9d8516ec987f32d62e33594210a0fee392498"},{"sha":"6a5c4b88f9d9d3e985c9503af7cbcab0454b0887","author":{"email":"cef439e78636cdab99cd2923826c5065a0743e5b@strlen.de","name":"Florian Westphal"},"message":"netfilter: conntrack: disable generic tracking for known protocols\n\nGiven following iptables ruleset:\n\n-P FORWARD DROP\n-A FORWARD -m sctp --dport 9 -j ACCEPT\n-A FORWARD -p tcp --dport 80 -j ACCEPT\n-A FORWARD -p tcp -m conntrack -m state ESTABLISHED,RELATED -j ACCEPT\n\nOne would assume that this allows SCTP on port 9 and TCP on port 80.\nUnfortunately, if the SCTP conntrack module is not loaded, this allows\n*all* SCTP communication, to pass though, i.e. -p sctp -j ACCEPT,\nwhich we think is a security issue.\n\nThis is because on the first SCTP packet on port 9, we create a dummy\n\"generic l4\" conntrack entry without any port information (since\nconntrack doesn't know how to extract this information).\n\nAll subsequent packets that are unknown will then be in established\nstate since they will fallback to proto_generic and will match the\n'generic' entry.\n\nOur originally proposed version [1] completely disabled generic protocol\ntracking, but Jozsef suggests to not track protocols for which a more\nsuitable helper is available, hence we now mitigate the issue for in\ntree known ct protocol helpers only, so that at least NAT and direction\ninformation will still be preserved for others.\n\n [1] http://www.spinics.net/lists/netfilter-devel/msg33430.html\n\nJoint work with Daniel Borkmann.\n\nChange-Id: I07168aac05cc01ebbb900aad884a672cadc24569\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nAcked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":true,"url":"https://api.github.com/repos/PoisonNinja/android_kernel_samsung_smdk4412/commits/6a5c4b88f9d9d3e985c9503af7cbcab0454b0887"},{"sha":"2acd51f51ffd6e14b24d812da47594f53d917378","author":{"email":"e642b69ed2fc111e09ffdc37feb733a52253340d@oracle.com","name":"Sasha Levin"},"message":"net: llc: use correct size for sysctl timeout entries\n\nThe timeout entries are sizeof(int) rather than sizeof(long), which\nmeans that when they were getting read we'd also leak kernel memory\nto userspace along with the timeout values.\n\nChange-Id: I65ab7dc468480dca04108e077194735fa9dc61b5\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/PoisonNinja/android_kernel_samsung_smdk4412/commits/2acd51f51ffd6e14b24d812da47594f53d917378"},{"sha":"5080905535c3c977a96a0ef7faaa5095dafd7760","author":{"email":"d9a55baaefd0f4fe2aaf269ad03fc894be45891b@gmail.com","name":"Harry Lin"},"message":"udp: fix behavior of wrong checksums\n\nWe have two problems in UDP stack related to bogus checksums :\n\n1 ) We return -EGAIN to application even if receive queue is not empty.\n    This breaks applications using edge trigger epoll()\n\n2 ) Under UDP flood, we can loop forever without yielding to other\n    processes, potentially hanging the host, especially on non SMP.\n\nThis patch is an attempt to make things better.\n\nWe might in the future add extra support for rt applications\nwanting to better control time spent doing a recv() in a hostile\nenvironment. For example we could validate checksums before queuing\npackets in socket receive queue.\n\nChange-Id: Ic25820228fd735e25a850951e059bf75ae39b653\nSigned-off-by: Eruc Dumazet <edumazet@google.com>\nCc: Willem de Brujin <willemb@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/PoisonNinja/android_kernel_samsung_smdk4412/commits/5080905535c3c977a96a0ef7faaa5095dafd7760"},{"sha":"13696bfd759e22d99eab7a81b18341b05772aad4","author":{"email":"331be22c6b63ca3e0a03d408c2d906b1b02cd5f2@stressinduktion.org","name":"Hannes Frederic Sowa"},"message":"ipv4: try to cache dst_entries which would cause a redirect\n\nNot caching dst_entries which cause redirects could be exploited by hosts\non the same subnet, causing a severe DoS attack. This effect aggravated\nsince commit f88649721268999 (\"ipv4: fix dst race in sk_dst_get()\").\n\nLookups causing redirects will be allocated with DST_NOCACHE set which\nwill force dst_release to free them via RCU.  Unfortunately waiting for\nRCU grace period just takes too long, we can end up with >1M dst_entries\nwaiting to be released and the system will run OOM. rcuos threads cannot\ncatch up under high softirq load.\n\nAttaching the flag to emit a redirect later on to the specific skb allows\nus to cache those dst_entries thus reducing the pressure on allocation\nand deallocation.\n\nThis issue was discovered by Marcelo Leitner.\n\nCc: Julian Anastasov <ja@ssi.bg>\nSigned-off-by: Marcelo Leitner <mleitner@redhat.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: Julian Anastasov <ja@ssi.bg>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n\nConflicts:\n\tinclude/net/ip.h\n\tnet/ipv4/route.c\n\nChange-Id: I53e4b500a4db2f5fece937a42a3bd810b2640c44","distinct":true,"url":"https://api.github.com/repos/PoisonNinja/android_kernel_samsung_smdk4412/commits/13696bfd759e22d99eab7a81b18341b05772aad4"},{"sha":"f7a711c992bb3272bc07d66c60ec79a276638817","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"tcp_cubic: better follow cubic curve after idle period\n\nJana Iyengar found an interesting issue on CUBIC :\n\nThe epoch is only updated/reset initially and when experiencing losses.\nThe delta \"t\" of now - epoch_start can be arbitrary large after app idle\nas well as the bic_target. Consequentially the slope (inverse of\nca->cnt) would be really large, and eventually ca->cnt would be\nlower-bounded in the end to 2 to have delayed-ACK slow-start behavior.\n\nThis particularly shows up when slow_start_after_idle is disabled\nas a dangerous cwnd inflation (1.5 x RTT) after few seconds of idle\ntime.\n\nJana initial fix was to reset epoch_start if app limited,\nbut Neal pointed out it would ask the CUBIC algorithm to recalculate the\ncurve so that we again start growing steeply upward from where cwnd is\nnow (as CUBIC does just after a loss). Ideally we'd want the cwnd growth\ncurve to be the same shape, just shifted later in time by the amount of\nthe idle period.\n\nChange-Id: Ia99e2743517729b1c0589fbb8db9965ec806043b\nReported-by: Jana Iyengar <jri@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: Yuchung Cheng <ycheng@google.com>\nSigned-off-by: Neal Cardwell <ncardwell@google.com>\nCc: Stephen Hemminger <stephen@networkplumber.org>\nCc: Sangtae Ha <sangtae.ha@gmail.com>\nCc: Lawrence Brakmo <lawrence@brakmo.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Andrea Arcangeli <aarcange@redhat.com>","distinct":true,"url":"https://api.github.com/repos/PoisonNinja/android_kernel_samsung_smdk4412/commits/f7a711c992bb3272bc07d66c60ec79a276638817"},{"sha":"13d1b294893bb995fa38660585745e6a23631075","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"tcp_cubic: do not set epoch_start in the future\n\nTracking idle time in bictcp_cwnd_event() is imprecise, as epoch_start\nis normally set at ACK processing time, not at send time.\n\nDoing a proper fix would need to add an additional state variable,\nand does not seem worth the trouble, given CUBIC bug has been there\nforever before Jana noticed it.\n\nLet's simply not set epoch_start in the future, otherwise\nbictcp_update() could overflow and CUBIC would again\ngrow cwnd too fast.\n\nThis was detected thanks to a packetdrill test Neal wrote that was flaky\nbefore applying this fix.\n\nChange-Id: I600d3a8ac0ed1d70f3ff5cc6b7341ac13178f4f3\nFixes: 30927520dbae (\"tcp_cubic: better follow cubic curve after idle period\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: Neal Cardwell <ncardwell@google.com>\nSigned-off-by: Yuchung Cheng <ycheng@google.com>\nCc: Jana Iyengar <jri@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Andrea Arcangeli <aarcange@redhat.com>","distinct":true,"url":"https://api.github.com/repos/PoisonNinja/android_kernel_samsung_smdk4412/commits/13d1b294893bb995fa38660585745e6a23631075"},{"sha":"096edea7148f5e05258f9b42f66d3fc39ee2c607","author":{"email":"b24a855ec78b0669e4df933179b6cca020788deb@gmail.com","name":"Jason Lu"},"message":"Merge remote-tracking branch 'cyanogenmod/cm-13.0' into HEAD","distinct":true,"url":"https://api.github.com/repos/PoisonNinja/android_kernel_samsung_smdk4412/commits/096edea7148f5e05258f9b42f66d3fc39ee2c607"}]}