{"push_id":1347394396,"size":2,"distinct_size":2,"ref":"refs/heads/mkm","head":"59176e30ceeda30bd7c6119375c32708df87689d","before":"e5a1d1b89c51365687d8b6c064c2fbef99eb5a7c","commits":[{"sha":"f65ffb45ef2318a984746b363052e08402010fdc","author":{"name":"Arnaldo Carvalho de Melo","email":"7310a59577712e001e6abd523e66592d8f2dc989@redhat.com"},"message":"net: Fix use after free in the recvmmsg exit path\n\nThe syzkaller fuzzer hit the following use-after-free:\n\n  Call Trace:\n   [<ffffffff8175ea0e>] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:295\n   [<ffffffff851cc31a>] __sys_recvmmsg+0x6fa/0x7f0 net/socket.c:2261\n   [<     inline     >] SYSC_recvmmsg net/socket.c:2281\n   [<ffffffff851cc57f>] SyS_recvmmsg+0x16f/0x180 net/socket.c:2270\n   [<ffffffff86332bb6>] entry_SYSCALL_64_fastpath+0x16/0x7a\n  arch/x86/entry/entry_64.S:185\n\nAnd, as Dmitry rightly assessed, that is because we can drop the\nreference and then touch it when the underlying recvmsg calls return\nsome packets and then hit an error, which will make recvmmsg to set\nsock->sk->sk_err, oops, fix it.\n\nReported-and-Tested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: Alexander Potapenko <glider@google.com>\nCc: Eric Dumazet <edumazet@google.com>\nCc: Kostya Serebryany <kcc@google.com>\nCc: Sasha Levin <sasha.levin@oracle.com>\nFixes: a2e2725541fa (\"net: Introduce recvmmsg socket syscall\")\nhttp://lkml.kernel.org/r/20160122211644.GC2470@redhat.com\nSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n\nChange-Id: I85023356db6c0f0a2f1b8ad2f1ac07ecb7c059c2","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_htc_msm8974/commits/f65ffb45ef2318a984746b363052e08402010fdc"},{"sha":"59176e30ceeda30bd7c6119375c32708df87689d","author":{"name":"martincz","email":"9eccfaca879daa038a410859bd0ef76c6c204ee6@mokeedev.com"},"message":"Merge branch 'remote' into mkm","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_htc_msm8974/commits/59176e30ceeda30bd7c6119375c32708df87689d"}]}
{"actor":{"display_login":"mokeeopensource"}}