{"push_id":1040947580,"size":1,"distinct_size":1,"ref":"refs/heads/mkm","head":"58efce595d0d438a662bd47a89c8f1e0fb25439b","before":"bd655c6bbe8eaca5b73d78fef1e103357174dda9","commits":[{"sha":"58efce595d0d438a662bd47a89c8f1e0fb25439b","author":{"email":"73675debcd8a436be48ec22211dcf44fe0df0a64@decadent.org.uk","name":"Ben Hutchings"},"message":"pipe: Fix buffer offset after partially failed read\n\nQuoting the RHEL advisory:\n\n> It was found that the fix for CVE-2015-1805 incorrectly kept buffer\n> offset and buffer length in sync on a failed atomic read, potentially\n> resulting in a pipe buffer state corruption. A local, unprivileged user\n> could use this flaw to crash the system or leak kernel memory to user\n> space. (CVE-2016-0774, Moderate)\n\nThe same flawed fix was applied to stable branches from 2.6.32.y to\n3.14.y inclusive, and I was able to reproduce the issue on 3.2.y.\nWe need to give pipe_iov_copy_to_user() a separate offset variable\nand only update the buffer offset if it succeeds.\n\nChange-Id: I988802f38acf40c7671fa0978880928b02d29b56\nReferences: https://rhn.redhat.com/errata/RHSA-2016-0103.html\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\n(cherry picked from commit feae3ca2e5e1a8f44aa6290255d3d9709985d0b2)","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_motorola_msm8916/commits/58efce595d0d438a662bd47a89c8f1e0fb25439b"}]}