{"push_id":1225348432,"size":4,"distinct_size":4,"ref":"refs/heads/aosp-common/android-4.1","head":"457955a4c48e7f036e95a9ea10d6212ae26a178e","before":"85bf756ed81f8d0831b3ef12e1157ff684be4b61","commits":[{"sha":"523a7ca3091ea48b01d75008a2417df3d318c626","author":{"name":"WANG Cong","email":"3f5d79d28d6d48052800caba9df0b30e06fefe41@gmail.com"},"message":"UPSTREAM: ppp: defer netns reference release for ppp channel\n\n(cherry pick from commit 205e1e255c479f3fd77446415706463b282f94e4)\n\nMatt reported that we have a NULL pointer dereference\nin ppp_pernet() from ppp_connect_channel(),\ni.e. pch->chan_net is NULL.\n\nThis is due to that a parallel ppp_unregister_channel()\ncould happen while we are in ppp_connect_channel(), during\nwhich pch->chan_net set to NULL. Since we need a reference\nto net per channel, it makes sense to sync the refcnt\nwith the life time of the channel, therefore we should\nrelease this reference when we destroy it.\n\nFixes: 1f461dcdd296 (\"ppp: take reference on channels netns\")\nReported-by: Matt Bennett <Matt.Bennett@alliedtelesis.co.nz>\nCc: Paul Mackerras <paulus@samba.org>\nCc: linux-ppp@vger.kernel.org\nCc: Guillaume Nault <g.nault@alphalink.fr>\nCc: Cyrill Gorcunov <gorcunov@openvz.org>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nReviewed-by: Cyrill Gorcunov <gorcunov@openvz.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n\nFixes: Change-Id: Iee0015eca5bd181954bb4896a3720f7549c5ed0b (\"UPSTREAM:\nppp: take reference on channels netns\")\nSigned-off-by: Amit Pundir <amit.pundir@linaro.org>\nChange-Id: I24d0bb6f349ab3829f63cfe935ed97b6913a3508","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/523a7ca3091ea48b01d75008a2417df3d318c626"},{"sha":"3386f0493ecb3341bf6c26717e4f49598c0f501e","author":{"name":"Jann Horn","email":"08549507bd16ecbb2beecd8441c2aad0883eaf18@google.com"},"message":"UPSTREAM: proc: prevent stacking filesystems on top\n\n(cherry picked from commit e54ad7f1ee263ffa5a2de9c609d58dfa27b21cd9)\n\nThis prevents stacking filesystems (ecryptfs and overlayfs) from using\nprocfs as lower filesystem.  There is too much magic going on inside\nprocfs, and there is no good reason to stack stuff on top of procfs.\n\n(For example, procfs does access checks in VFS open handlers, and\necryptfs by design calls open handlers from a kernel thread that doesn't\ndrop privileges or so.)\n\nSigned-off-by: Jann Horn <jannh@google.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nChange-Id: Ib050ef9dc10e623589d22e3a9e6aee9ee4f0cd5d\nBug: 29444228","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/3386f0493ecb3341bf6c26717e4f49598c0f501e"},{"sha":"78385c57b09384b81c2f6316ab17983a4b315e8e","author":{"name":"Jann Horn","email":"08549507bd16ecbb2beecd8441c2aad0883eaf18@google.com"},"message":"UPSTREAM: ecryptfs: forbid opening files without mmap handler\n\n(cherry picked from commit 2f36db71009304b3f0b95afacd8eba1f9f046b87)\n\nThis prevents users from triggering a stack overflow through a recursive\ninvocation of pagefault handling that involves mapping procfs files into\nvirtual memory.\n\nSigned-off-by: Jann Horn <jannh@google.com>\nAcked-by: Tyler Hicks <tyhicks@canonical.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nChange-Id: I0be77c7f8bd3046bc34cd87ef577529792d479bc\nBug: 29444228","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/78385c57b09384b81c2f6316ab17983a4b315e8e"},{"sha":"457955a4c48e7f036e95a9ea10d6212ae26a178e","author":{"name":"Jann Horn","email":"08549507bd16ecbb2beecd8441c2aad0883eaf18@google.com"},"message":"UPSTREAM: sched: panic on corrupted stack end\n\n(cherry pick from commit 29d6455178a09e1dc340380c582b13356227e8df)\n\nUntil now, hitting this BUG_ON caused a recursive oops (because oops\nhandling involves do_exit(), which calls into the scheduler, which in\nturn raises an oops), which caused stuff below the stack to be\noverwritten until a panic happened (e.g.  via an oops in interrupt\ncontext, caused by the overwritten CPU index in the thread_info).\n\nJust panic directly.\n\nSigned-off-by: Jann Horn <jannh@google.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nChange-Id: Ia3acb3f747f7a58ec2d071644433b0591925969f\nBug: 29444228","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/457955a4c48e7f036e95a9ea10d6212ae26a178e"}]}
{"actor":{"display_login":"Jackeagle"}}