{"push_id":1030636866,"size":3,"distinct_size":3,"ref":"refs/heads/cm-13.0_mod","head":"cbb0b6bdc0deea54e2878f9a360932f2fe9506de","before":"d8f84d7d2c5f2e3c3c73d7287e8e29c0b49ea2fe","commits":[{"sha":"0998c22bcb6ad82232efe0f1ca4cc13b9cc6701e","author":{"email":"ebac1d06c1688626821bb0e574a037a7a5354e49@redhat.com","name":"David Howells"},"message":"KEYS: Fix race between read and revoke\n\nThis fixes CVE-2015-7550.\n\nThere's a race between keyctl_read() and keyctl_revoke().  If the revoke\nhappens between keyctl_read() checking the validity of a key and the key's\nsemaphore being taken, then the key type read method will see a revoked key.\n\nThis causes a problem for the user-defined key type because it assumes in\nits read method that there will always be a payload in a non-revoked key\nand doesn't check for a NULL pointer.\n\nFix this by making keyctl_read() check the validity of a key after taking\nsemaphore instead of before.\n\nI think the bug was introduced with the original keyrings code.\n\nThis was discovered by a multithreaded test program generated by syzkaller\n(http://github.com/google/syzkaller).  Here's a cleaned up version:\n\n\t#include <sys/types.h>\n\t#include <keyutils.h>\n\t#include <pthread.h>\n\tvoid *thr0(void *arg)\n\t{\n\t\tkey_serial_t key = (unsigned long)arg;\n\t\tkeyctl_revoke(key);\n\t\treturn 0;\n\t}\n\tvoid *thr1(void *arg)\n\t{\n\t\tkey_serial_t key = (unsigned long)arg;\n\t\tchar buffer[16];\n\t\tkeyctl_read(key, buffer, 16);\n\t\treturn 0;\n\t}\n\tint main()\n\t{\n\t\tkey_serial_t key = add_key(\"user\", \"%\", \"foo\", 3, KEY_SPEC_USER_KEYRING);\n\t\tpthread_t th[5];\n\t\tpthread_create(&th[0], 0, thr0, (void *)(unsigned long)key);\n\t\tpthread_create(&th[1], 0, thr1, (void *)(unsigned long)key);\n\t\tpthread_create(&th[2], 0, thr0, (void *)(unsigned long)key);\n\t\tpthread_create(&th[3], 0, thr1, (void *)(unsigned long)key);\n\t\tpthread_join(th[0], 0);\n\t\tpthread_join(th[1], 0);\n\t\tpthread_join(th[2], 0);\n\t\tpthread_join(th[3], 0);\n\t\treturn 0;\n\t}\n\nBuild as:\n\n\tcc -o keyctl-race keyctl-race.c -lkeyutils -lpthread\n\nRun as:\n\n\twhile keyctl-race; do :; done\n\nas it may need several iterations to crash the kernel.  The crash can be\nsummarised as:\n\n\tBUG: unable to handle kernel NULL pointer dereference at 0000000000000010\n\tIP: [<ffffffff81279b08>] user_read+0x56/0xa3\n\t...\n\tCall Trace:\n\t [<ffffffff81276aa9>] keyctl_read_key+0xb6/0xd7\n\t [<ffffffff81277815>] SyS_keyctl+0x83/0xe0\n\t [<ffffffff815dbb97>] entry_SYSCALL_64_fastpath+0x12/0x6f\n\nChange-Id: Id4a5e47860162f62c94bb66728ca9e712f9d89c2\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: stable@vger.kernel.org\nSigned-off-by: James Morris <james.l.morris@oracle.com>","distinct":true,"url":"https://api.github.com/repos/MSM8930-Samsung/android_kernel_samsung_msm8930-common/commits/0998c22bcb6ad82232efe0f1ca4cc13b9cc6701e"},{"sha":"940038a0b7fddc9dd7b2f33a2b4ab970d245e8e5","author":{"email":"4b8373d016f277527198385ba72fda0feb5da015@hurleysoftware.com","name":"Peter Hurley"},"message":"tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)\n\nioctl(TIOCGETD) retrieves the line discipline id directly from the\nldisc because the line discipline id (c_line) in termios is untrustworthy;\nuserspace may have set termios via ioctl(TCSETS*) without actually\nchanging the line discipline via ioctl(TIOCSETD).\n\nHowever, directly accessing the current ldisc via tty->ldisc is\nunsafe; the ldisc ptr dereferenced may be stale if the line discipline\nis changing via ioctl(TIOCSETD) or hangup.\n\nWait for the line discipline reference (just like read() or write())\nto retrieve the \"current\" line discipline id.\n\nChange-Id: I9365c772052594e1783011a34c97c1ef1e90a178\nCc: <stable@vger.kernel.org>\nSigned-off-by: Peter Hurley <peter@hurleysoftware.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/MSM8930-Samsung/android_kernel_samsung_msm8930-common/commits/940038a0b7fddc9dd7b2f33a2b4ab970d245e8e5"},{"sha":"cbb0b6bdc0deea54e2878f9a360932f2fe9506de","author":{"email":"73675debcd8a436be48ec22211dcf44fe0df0a64@decadent.org.uk","name":"Ben Hutchings"},"message":"pipe: iovec: Fix memory corruption when retrying atomic copy as non-atomic\n\npipe_iov_copy_{from,to}_user() may be tried twice with the same iovec,\nthe first time atomically and the second time not.  The second attempt\nneeds to continue from the iovec position, pipe buffer offset and\nremaining length where the first attempt failed, but currently the\npipe buffer offset and remaining length are reset.  This will corrupt\nthe piped data (possibly also leading to an information leak between\nprocesses) and may also corrupt kernel memory.\n\nThis was fixed upstream by commits f0d1bec9d58d (\"new helper:\ncopy_page_from_iter()\") and 637b58c2887e (\"switch pipe_read() to\ncopy_page_to_iter()\"), but those aren't suitable for stable.  This fix\nfor older kernel versions was made by Seth Jennings for RHEL and I\nhave extracted it from their update.\n\nCVE-2015-1805\n\nChange-Id: I135d33b32e9037d7c68ee20715e4f850f2302b4e\nReferences: https://bugzilla.redhat.com/show_bug.cgi?id=1202855\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","distinct":true,"url":"https://api.github.com/repos/MSM8930-Samsung/android_kernel_samsung_msm8930-common/commits/cbb0b6bdc0deea54e2878f9a360932f2fe9506de"}]}