{"push_id":1449274291,"size":2,"distinct_size":2,"ref":"refs/heads/cm-14.1","head":"cf62f38f53fe434501116031245ea97cfa45980f","before":"770eb0afbd8d4c48d508fa34dd081fe29badb711","commits":[{"sha":"c87009617bfcc3b9ca74cc112c43526cef2ce776","author":{"name":"Al Viro","email":"2a537e97523ffee458777df5f34a2f8c9964f945@zeniv.linux.org.uk"},"message":"arm: fix handling of F_OFD_... in oabi_fcntl64()\n\nChange-Id: I75054f88e8c2c10a61b100a20b00bfbf09ff7c4d\nCc: stable@vger.kernel.org # 3.15+\nReviewed-by: Jeff Layton <jeff.layton@primarydata.com>\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>","distinct":true,"url":"https://api.github.com/repos/Chippa-a/android_kernel_sony_apq8064/commits/c87009617bfcc3b9ca74cc112c43526cef2ce776"},{"sha":"cf62f38f53fe434501116031245ea97cfa45980f","author":{"name":"Philip Pettersson","email":"a92d5039dce26639c800f4cf2f37bd0c3c2ae41c@gmail.com"},"message":"packet: fix race condition in packet_set_ring\n\nWhen packet_set_ring creates a ring buffer it will initialize a\nstruct timer_list if the packet version is TPACKET_V3. This value\ncan then be raced by a different thread calling setsockopt to\nset the version to TPACKET_V1 before packet_set_ring has finished.\n\nThis leads to a use-after-free on a function pointer in the\nstruct timer_list when the socket is closed as the previously\ninitialized timer will not be deleted.\n\nThe bug is fixed by taking lock_sock(sk) in packet_setsockopt when\nchanging the packet version while also taking the lock at the start\nof packet_set_ring.\n\nChange-Id: Iec8b20f499134e1edd0f9214aa4dde477d1674e1\nFixes: f6fb8f100b80 (\"af-packet: TPACKET_V3 flexible buffer implementation.\")\nSigned-off-by: Philip Pettersson <philip.pettersson@gmail.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/Chippa-a/android_kernel_sony_apq8064/commits/cf62f38f53fe434501116031245ea97cfa45980f"}]}
{"actor":{"display_login":"Chippa-a"}}