{"push_id":1363498995,"size":19,"distinct_size":4,"ref":"refs/heads/boeffla13.0_n5120_l531a9","head":"4114588bd8138b33823fb6c1f83eebaf3f6f17b0","before":"741856d225e622501ed69e27f72f60d5de7e30ea","commits":[{"sha":"d93d41a4b8740995d06eb1356bb049f916906082","author":{"name":"Nick Desaulniers","email":"b951273a67bf33267cd4dff69171cdef4e5efbe7@google.com"},"message":"binder: prevent kptr leak by using %pK format specifier\n\nWorks in conjunction with kptr_restrict.\nBug: 30143283\n\nChange-Id: I2b3ce22f4e206e74614d51453a1d59b7080ab05a","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-n51x0/commits/d93d41a4b8740995d06eb1356bb049f916906082"},{"sha":"7a1d19323a753ff9825c07e51d4ec5321ca85507","author":{"name":"Arnaldo Carvalho de Melo","email":"7310a59577712e001e6abd523e66592d8f2dc989@redhat.com"},"message":"net: Fix use after free in the recvmmsg exit path\n\nThe syzkaller fuzzer hit the following use-after-free:\n\n  Call Trace:\n   [<ffffffff8175ea0e>] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:295\n   [<ffffffff851cc31a>] __sys_recvmmsg+0x6fa/0x7f0 net/socket.c:2261\n   [<     inline     >] SYSC_recvmmsg net/socket.c:2281\n   [<ffffffff851cc57f>] SyS_recvmmsg+0x16f/0x180 net/socket.c:2270\n   [<ffffffff86332bb6>] entry_SYSCALL_64_fastpath+0x16/0x7a\n  arch/x86/entry/entry_64.S:185\n\nAnd, as Dmitry rightly assessed, that is because we can drop the\nreference and then touch it when the underlying recvmsg calls return\nsome packets and then hit an error, which will make recvmmsg to set\nsock->sk->sk_err, oops, fix it.\n\nReported-and-Tested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: Alexander Potapenko <glider@google.com>\nCc: Eric Dumazet <edumazet@google.com>\nCc: Kostya Serebryany <kcc@google.com>\nCc: Sasha Levin <sasha.levin@oracle.com>\nFixes: a2e2725541fa (\"net: Introduce recvmmsg socket syscall\")\nhttp://lkml.kernel.org/r/20160122211644.GC2470@redhat.com\nSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n\nChange-Id: Ie3b6ee89ad3e8cd3a0fe8f50f74aaa4834d0b4ca","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-n51x0/commits/7a1d19323a753ff9825c07e51d4ec5321ca85507"},{"sha":"032f1790ca022e3cd37071a07c985fec9337be05","author":{"name":"Arnaldo Carvalho de Melo","email":"7310a59577712e001e6abd523e66592d8f2dc989@redhat.com"},"message":"net: Fix use after free in the recvmmsg exit path\n\nThe syzkaller fuzzer hit the following use-after-free:\n\n  Call Trace:\n   [<ffffffff8175ea0e>] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:295\n   [<ffffffff851cc31a>] __sys_recvmmsg+0x6fa/0x7f0 net/socket.c:2261\n   [<     inline     >] SYSC_recvmmsg net/socket.c:2281\n   [<ffffffff851cc57f>] SyS_recvmmsg+0x16f/0x180 net/socket.c:2270\n   [<ffffffff86332bb6>] entry_SYSCALL_64_fastpath+0x16/0x7a\n  arch/x86/entry/entry_64.S:185\n\nAnd, as Dmitry rightly assessed, that is because we can drop the\nreference and then touch it when the underlying recvmsg calls return\nsome packets and then hit an error, which will make recvmmsg to set\nsock->sk->sk_err, oops, fix it.\n\nReported-and-Tested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: Alexander Potapenko <glider@google.com>\nCc: Eric Dumazet <edumazet@google.com>\nCc: Kostya Serebryany <kcc@google.com>\nCc: Sasha Levin <sasha.levin@oracle.com>\nFixes: a2e2725541fa (\"net: Introduce recvmmsg socket syscall\")\nhttp://lkml.kernel.org/r/20160122211644.GC2470@redhat.com\nSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n\nChange-Id: Ie3b6ee89ad3e8cd3a0fe8f50f74aaa4834d0b4ca","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-n51x0/commits/032f1790ca022e3cd37071a07c985fec9337be05"},{"sha":"853ce6f692a6abe8a5140e7861e131b8026ef309","author":{"name":"Nick Desaulniers","email":"b951273a67bf33267cd4dff69171cdef4e5efbe7@google.com"},"message":"fs: ext4: disable support for fallocate FALLOC_FL_PUNCH_HOLE\n\nBug: 28760453\nChange-Id: I019c2de559db9e4b95860ab852211b456d78c4ca\nSigned-off-by: Nick Desaulniers <ndesaulniers@google.com>","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-n51x0/commits/853ce6f692a6abe8a5140e7861e131b8026ef309"},{"sha":"bc08f5ac1aa6ace07ca9b1596589372ff13e7c2b","author":{"name":"Lars-Peter Clausen","email":"7f698333860e9f21dcc513102ebee3bcaf8d683e@metafoo.de"},"message":"UPSTREAM: ALSA: control: Fix replacing user controls\n\n(cherry pick from commit 82262a46627bebb0febcc26664746c25cef08563)\n\nThere are two issues with the current implementation for replacing user\ncontrols. The first is that the code does not check if the control is\nactually a user control and neither does it check if the control is\nowned by the process that tries to remove it. That allows userspace\napplications to remove arbitrary controls, which can cause a user after\nfree if a for example a driver does not expect a control to be removed\nfrom under its feed.\n\nThe second issue is that on one hand when a control is replaced the\nuser_ctl_count limit is not checked and on the other hand the\nuser_ctl_count is increased (even though the number of user controls\ndoes not change). This allows userspace, once the user_ctl_count limit\nhas been reached, to repeatedly replace a control until user_ctl_count\noverflows. Once that happens new controls can be added effectively\nbypassing the user_ctl_count limit.\n\nBoth issues can be fixed by instead of open-coding the removal of the\ncontrol that is to be replaced to use snd_ctl_remove_user_ctl(). This\nfunction does proper permission checks as well as decrements\nuser_ctl_count after the control has been removed.\n\nNote that by using snd_ctl_remove_user_ctl() the check which returns\n-EBUSY at beginning of the function if the control already exists is\nremoved. This is not a problem though since the check is quite\nuseless, because the lock that is protecting the control list is\nreleased between the check and before adding the new control to the\nlist, which means that it is possible that a different control with\nthe same settings is added to the list after the check. Luckily there\nis another check that is done while holding the lock in snd_ctl_add(),\nso we'll rely on that to make sure that the same control is not added\ntwice.\n\nSigned-off-by: Lars-Peter Clausen <lars@metafoo.de>\nAcked-by: Jaroslav Kysela <perex@perex.cz>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nChange-Id: I0b183e2d52afe8e747f59e1ecca6f6fbbac2d016\nBug: 29916012","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-n51x0/commits/bc08f5ac1aa6ace07ca9b1596589372ff13e7c2b"},{"sha":"2e73e51204228c40cfd8492d6083c3708b748d92","author":{"name":"Mohamad Ayyash","email":"a63011e6db47c5624401b2ef01e42a84436c0cfe@google.com"},"message":"Replace %p with %pK to prevent leaking kernel address\n\nBUG: 27532522\nChange-Id: Ic0710a9a8cfc682acd88ecf3bbfeece2d798c4a4\nSigned-off-by: Mohamad Ayyash <mkayyash@google.com>","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-n51x0/commits/2e73e51204228c40cfd8492d6083c3708b748d92"},{"sha":"3f5c497d9a19e56f6cf0277a24d959d243c02cdf","author":{"name":"kangjie","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"fix infoleak in rtnetlink\n\nthe stack object “map” has a total size of 32 bytes. Its last 4\nbytes are padding generated by compiler. These padding bytes are\nnot initialized and sent out via “nla_put”\n\nBug: 28620102\n\nChange-Id: I13da380c6fe8abca49e3cf9f05293c02b44d2e5e\nSigned-off-by: kangjie <kangjielu@gmail.com>","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-n51x0/commits/3f5c497d9a19e56f6cf0277a24d959d243c02cdf"},{"sha":"4d0c82089c80d1d7a470ac9282ae19c7d732db30","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"tcp: fix use after free in tcp_xmit_retransmit_queue()\n\nWhen tcp_sendmsg() allocates a fresh and empty skb, it puts it at the\ntail of the write queue using tcp_add_write_queue_tail()\n\nThen it attempts to copy user data into this fresh skb.\n\nIf the copy fails, we undo the work and remove the fresh skb.\n\nUnfortunately, this undo lacks the change done to tp->highest_sack and\nwe can leave a dangling pointer (to a freed skb)\n\nLater, tcp_xmit_retransmit_queue() can dereference this pointer and\naccess freed memory. For regular kernels where memory is not unmapped,\nthis might cause SACK bugs because tcp_highest_sack_seq() is buggy,\nreturning garbage instead of tp->snd_nxt, but with various debug\nfeatures like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel.\n\nThis bug was found by Marco Grassi thanks to syzkaller.\n\nChange-Id: I264f97d30d0a623011d9ee811c63fa0e0c2149a2\nFixes: 6859d49475d4 (\"[TCP]: Abstract tp->highest_sack accessing & point to next skb\")\nReported-by: Marco Grassi <marco.gra@gmail.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>\nCc: Yuchung Cheng <ycheng@google.com>\nCc: Neal Cardwell <ncardwell@google.com>\nAcked-by: Neal Cardwell <ncardwell@google.com>\nReviewed-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-n51x0/commits/4d0c82089c80d1d7a470ac9282ae19c7d732db30"},{"sha":"c99d3773d524b4ee37b1f5a6d13f9d195c78b857","author":{"name":"andip71","email":"e6ecbe9226906ebc6c74fcf434eb9f5addb9e0e0@gmx.de"},"message":"Boeffla ramfs: Update busybox to version 1.25.1 (self-compiled Boeffla version)","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-n51x0/commits/c99d3773d524b4ee37b1f5a6d13f9d195c78b857"},{"sha":"956ef1c01ec1f57743481b692dd2154e6d51470d","author":{"name":"andip71","email":"e6ecbe9226906ebc6c74fcf434eb9f5addb9e0e0@gmx.de"},"message":"bbuild: remove last hardcoded architecture piece","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-n51x0/commits/956ef1c01ec1f57743481b692dd2154e6d51470d"},{"sha":"5d870b26e6ed79f6ef769cf3192741534736de29","author":{"name":"andip71","email":"e6ecbe9226906ebc6c74fcf434eb9f5addb9e0e0@gmx.de"},"message":"bbuild: configurable dtbtool","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-n51x0/commits/5d870b26e6ed79f6ef769cf3192741534736de29"},{"sha":"8d38fcb7343381946a2a4d404c8904ceca126295","author":{"name":"RGIB","email":"b54ff0d1a7d2ffe840924c8be56d4f720affdce6@gmail.com"},"message":"smdk4412 : fix build\n\nChange-Id: I0e5b9979850042d790cb89996163bdc69a4c7879","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-n51x0/commits/8d38fcb7343381946a2a4d404c8904ceca126295"},{"sha":"5a3f4a6e4ee30b518908069fb494f419bd296822","author":{"name":"Linus Torvalds","email":"ead7104581934751970e9decb2db5deb20a9e407@linux-foundation.org"},"message":"mm: remove gup_flags FOLL_WRITE games from __get_user_pages()\n\nThis is an ancient bug that was actually attempted to be fixed once\n(badly) by me eleven years ago in commit 4ceb5db9757a (\"Fix\nget_user_pages() race for write access\") but that was then undone due to\nproblems on s390 by commit f33ea7f404e5 (\"fix get_user_pages bug\").\n\nIn the meantime, the s390 situation has long been fixed, and we can now\nfix it by checking the pte_dirty() bit properly (and do it better).  The\ns390 dirty bit was implemented in abf09bed3cce (\"s390/mm: implement\nsoftware dirty bits\") which made it into v3.9.  Earlier kernels will\nhave to look at the page state itself.\n\nAlso, the VM has become more scalable, and what used a purely\ntheoretical race back then has become easier to trigger.\n\nTo fix it, we introduce a new internal FOLL_COW flag to mark the \"yes,\nwe already did a COW\" rather than play racy games with FOLL_WRITE that\nis very fundamental, and then use the pte dirty flag to validate that\nthe FOLL_COW flag is still valid.\n\nChange-Id: Id9bec3722797dff7d0ff0d9f6097c4229e31fd62\nReported-and-tested-by: Phil \"not Paul\" Oester <kernel@linuxace.com>\nAcked-by: Hugh Dickins <hughd@google.com>\nReviewed-by: Michal Hocko <mhocko@suse.com>\nCc: Andy Lutomirski <luto@kernel.org>\nCc: Kees Cook <keescook@chromium.org>\nCc: Oleg Nesterov <oleg@redhat.com>\nCc: Willy Tarreau <w@1wt.eu>\nCc: Nick Piggin <npiggin@gmail.com>\nCc: Greg Thelen <gthelen@google.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n[wt: s/gup.c/memory.c; s/follow_page_pte/follow_page_mask;\n     s/faultin_page/__get_user_page]\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-n51x0/commits/5a3f4a6e4ee30b518908069fb494f419bd296822"},{"sha":"53fb0d30788e9b1b09c8cccc463e9e6b5d9ad211","author":{"name":"David Howells","email":"358fdf7bce8223edb2a0d846104bf62a286894d5@redhat.com"},"message":"KEYS: Fix short sprintf buffer in /proc/keys show function\n\nFix a short sprintf buffer in proc_keys_show().  If the gcc stack protector\nis turned on, this can cause a panic due to stack corruption.\n\nThe problem is that xbuf[] is not big enough to hold a 64-bit timeout\nrendered as weeks:\n\n\t(gdb) p 0xffffffffffffffffULL/(60*60*24*7)\n\t$2 = 30500568904943\n\nThat's 14 chars plus NUL, not 11 chars plus NUL.\n\nExpand the buffer to 16 chars.\n\nI think the unpatched code apparently works if the stack-protector is not\nenabled because on a 32-bit machine the buffer won't be overflowed and on a\n64-bit machine there's a 64-bit aligned pointer at one side and an int that\nisn't checked again on the other side.\n\nThe panic incurred looks something like:\n\nKernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff81352ebe\nCPU: 0 PID: 1692 Comm: reproducer Not tainted 4.7.2-201.fc24.x86_64 #1\nHardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\n 0000000000000086 00000000fbbd2679 ffff8800a044bc00 ffffffff813d941f\n ffffffff81a28d58 ffff8800a044bc98 ffff8800a044bc88 ffffffff811b2cb6\n ffff880000000010 ffff8800a044bc98 ffff8800a044bc30 00000000fbbd2679\nCall Trace:\n [<ffffffff813d941f>] dump_stack+0x63/0x84\n [<ffffffff811b2cb6>] panic+0xde/0x22a\n [<ffffffff81352ebe>] ? proc_keys_show+0x3ce/0x3d0\n [<ffffffff8109f7f9>] __stack_chk_fail+0x19/0x30\n [<ffffffff81352ebe>] proc_keys_show+0x3ce/0x3d0\n [<ffffffff81350410>] ? key_validate+0x50/0x50\n [<ffffffff8134db30>] ? key_default_cmp+0x20/0x20\n [<ffffffff8126b31c>] seq_read+0x2cc/0x390\n [<ffffffff812b6b12>] proc_reg_read+0x42/0x70\n [<ffffffff81244fc7>] __vfs_read+0x37/0x150\n [<ffffffff81357020>] ? security_file_permission+0xa0/0xc0\n [<ffffffff81246156>] vfs_read+0x96/0x130\n [<ffffffff81247635>] SyS_read+0x55/0xc0\n [<ffffffff817eb872>] entry_SYSCALL_64_fastpath+0x1a/0xa4\n\nChange-Id: I0787d5a38c730ecb75d3c08f28f0ab36295d59e7\nReported-by: Ondrej Kozina <okozina@redhat.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nTested-by: Ondrej Kozina <okozina@redhat.com>","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-n51x0/commits/53fb0d30788e9b1b09c8cccc463e9e6b5d9ad211"},{"sha":"7ff4f626a5562acd9ea854a10235d79430ffe429","author":{"name":"ZaneZam","email":"ca7a87512c42f7ce48fd0e6c9f7827f25ffab673@yahoo.com"},"message":"Release tag: 3.1-beta6","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-n51x0/commits/7ff4f626a5562acd9ea854a10235d79430ffe429"},{"sha":"f2259a7de53c0d46ac1f99543d8f536eec401af1","author":{"name":"ZaneZam","email":"ca7a87512c42f7ce48fd0e6c9f7827f25ffab673@yahoo.com"},"message":"toolchain: Preperation for non-stock toolchain useage","distinct":true,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-n51x0/commits/f2259a7de53c0d46ac1f99543d8f536eec401af1"},{"sha":"de3f3bbd1fd54d75318ce67e4e10fa58cdbbe085","author":{"name":"ZaneZam","email":"ca7a87512c42f7ce48fd0e6c9f7827f25ffab673@yahoo.com"},"message":"toolchain: bring in header file to be able to use gcc 5.0.0\n\ntaken from an one plus one kernel:\nhttps://github.com/zanezam/boeffla-kernel-cm-bacon/blob/boeffla_v23/include/linux/compiler-gcc5.h","distinct":true,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-n51x0/commits/de3f3bbd1fd54d75318ce67e4e10fa58cdbbe085"},{"sha":"af3dfa30a4e3bd2f2784e3201def918e5975305f","author":{"name":"ZaneZam","email":"ca7a87512c42f7ce48fd0e6c9f7827f25ffab673@yahoo.com"},"message":"toolchain: switch to compatible linaro toolchain gcc 5.3.1 (own customized build) + add optimzied flags and CCACHE\n\nmore info and configuration: https://github.com/zanezam/ct-ng_linaro/tree/custom","distinct":true,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-n51x0/commits/af3dfa30a4e3bd2f2784e3201def918e5975305f"},{"sha":"4114588bd8138b33823fb6c1f83eebaf3f6f17b0","author":{"name":"ZaneZam","email":"ca7a87512c42f7ce48fd0e6c9f7827f25ffab673@yahoo.com"},"message":"toolchain: add graphite optimizations","distinct":true,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-n51x0/commits/4114588bd8138b33823fb6c1f83eebaf3f6f17b0"}]}
{"actor":{"display_login":"zanezam"}}