{"push_id":1091771778,"size":1,"distinct_size":1,"ref":"refs/heads/aosp/LA.BF64.1.1_rb1.27","head":"5af078e9e7b1bc5e44076ed85f840c917cf233a6","before":"0e1955868544801986acdda5f5e565bd95286307","commits":[{"sha":"5af078e9e7b1bc5e44076ed85f840c917cf233a6","author":{"email":"b5a22de8256f40710480b913c59ab5d71612734d@carbonrom.org","name":"Christian Oder"},"message":"[1.1] pipe: Fix buffer offset after partially failed read\n\nQuoting the RHEL advisory:\r\n\r\n> It was found that the fix for CVE-2015-1805 incorrectly kept buffer\r\n> offset and buffer length in sync on a failed atomic read, potentially\r\n> resulting in a pipe buffer state corruption. A local, unprivileged user\r\n> could use this flaw to crash the system or leak kernel memory to user\r\n> space. (CVE-2016-0774, Moderate)\r\n\r\nThe same flawed fix was applied to stable branches from 2.6.32.y to\r\n3.14.y inclusive, and I was able to reproduce the issue on 3.2.y.\r\nWe need to give pipe_iov_copy_to_user() a separate offset variable\r\nand only update the buffer offset if it succeeds.\r\n\r\nChange-Id: I988802f38acf40c7671fa0978880928b02d29b56\r\nReferences: https://rhn.redhat.com/errata/RHSA-2016-0103.html\r\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\r\n(cherry picked from commit feae3ca2e5e1a8f44aa6290255d3d9709985d0b2)","distinct":true,"url":"https://api.github.com/repos/sonyxperiadev/kernel/commits/5af078e9e7b1bc5e44076ed85f840c917cf233a6"}]}