{"push_id":1459093554,"size":8,"distinct_size":8,"ref":"refs/heads/ng7.1","head":"5fa3bf3a2a784bdcd4c0e4350ae14b3555ec6cc6","before":"36f1c6937573ef1f7fad16340be9ed8ec827e9d5","commits":[{"sha":"ce64b7b037588dc381550634d74fb72e9f36631c","author":{"name":"Michael Halcrow","email":"e62790ff9ab121a4051ae69d1d796a4b2d0e9647@google.com"},"message":"eCryptfs: Remove buggy and unnecessary write in file name decode routine\n\nDmitry Chernenkov used KASAN to discover that eCryptfs writes past the\nend of the allocated buffer during encrypted filename decoding. This\nfix corrects the issue by getting rid of the unnecessary 0 write when\nthe current bit offset is 2.\n\nChange-Id: Id8e04a580e550495c46cd36fec430a1ec4342940\nSigned-off-by: Michael Halcrow <mhalcrow@google.com>\nReported-by: Dmitry Chernenkov <dmitryc@google.com>\nSuggested-by: Kees Cook <keescook@chromium.org>\nCc: stable@vger.kernel.org # v2.6.29+: 51ca58d eCryptfs: Filename Encryption: Encoding and encryption functions\nSigned-off-by: Tyler Hicks <tyhicks@canonical.com>","distinct":true,"url":"https://api.github.com/repos/SlimRoms/kernel_motorola_msm8916/commits/ce64b7b037588dc381550634d74fb72e9f36631c"},{"sha":"1f559ce14799d313017bd4c75aac9c7b4c49308f","author":{"name":"Eric W. Biederman","email":"e4ccc9f9b54eebd6cb8fc7643b8083f628b68ff2@xmission.com"},"message":"mnt: Only change user settable mount flags in remount\n\ncommit a6138db815df5ee542d848318e5dae681590fccd upstream.\n\nKenton Varda <kenton@sandstorm.io> discovered that by remounting a\nread-only bind mount read-only in a user namespace the\nMNT_LOCK_READONLY bit would be cleared, allowing an unprivileged user\nto the remount a read-only mount read-write.\n\nCorrect this by replacing the mask of mount flags to preserve\nwith a mask of mount flags that may be changed, and preserve\nall others.   This ensures that any future bugs with this mask and\nremount will fail in an easy to detect way where new mount flags\nsimply won't change.\n\nChange-Id: If642f81697dec818d0053648f5d612bba00dd102\nAcked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>\nSigned-off-by: \"Eric W. Biederman\" <ebiederm@xmission.com>\nCc: Francis Moreau <francis.moro@gmail.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","distinct":true,"url":"https://api.github.com/repos/SlimRoms/kernel_motorola_msm8916/commits/1f559ce14799d313017bd4c75aac9c7b4c49308f"},{"sha":"470a047cc0e89ce918267865a24a844edc6240f2","author":{"name":"Sasha Levin","email":"3eff170737f7f759a98f81ff6bf07d3c251c0277@oracle.com"},"message":"vfs: read file_handle only once in handle_to_path\n\nWe used to read file_handle twice. Once to get the amount of extra bytes, and\nonce to fetch the entire structure.\n\nThis may be problematic since we do size verifications only after the first\nread, so if the number of extra bytes changes in userspace between the first\nand second calls, we'll have an incoherent view of file_handle.\n\nInstead, read the constant size once, and copy that over to the final\nstructure without having to re-read it again.\n\nChange-Id: Ib05e5129629e27d5a05953098c5bc470fae40d2a\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/SlimRoms/kernel_motorola_msm8916/commits/470a047cc0e89ce918267865a24a844edc6240f2"},{"sha":"555e236e9a2fa16ea30e7738142d9f2712696a16","author":{"name":"Kirill A. Shutemov","email":"e4d0c2966af3c70025b28e24a0f33104c6291010@linux.intel.com"},"message":"mm: Fix NULL pointer dereference in madvise(MADV_WILLNEED) support\n\nSasha Levin found a NULL pointer dereference that is due to a missing\npage table lock, which in turn is due to the pmd entry in question being\na transparent huge-table entry.\n\nThe code - introduced in commit 1998cc048901 (\"mm: make\nmadvise(MADV_WILLNEED) support swap file prefetch\") - correctly checks\nfor this situation using pmd_none_or_trans_huge_or_clear_bad(), but it\nturns out that that function doesn't work correctly.\n\npmd_none_or_trans_huge_or_clear_bad() expected that pmd_bad() would\ntrigger if the transparent hugepage bit was set, but it doesn't do that\nif pmd_numa() is also set. Note that the NUMA bit only gets set on real\nNUMA machines, so people trying to reproduce this on most normal\ndevelopment systems would never actually trigger this.\n\nFix it by removing the very subtle (and subtly incorrect) expectation,\nand instead just checking pmd_trans_huge() explicitly.\n\nReported-by: Sasha Levin <sasha.levin@oracle.com>\nAcked-by: Andrea Arcangeli <aarcange@redhat.com>\n[ Additionally remove the now stale test for pmd_trans_huge() inside the\n  pmd_bad() case - Linus ]\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n\nChange-Id: I3f3763f236ef102de735297cd175cf514d40d28f","distinct":true,"url":"https://api.github.com/repos/SlimRoms/kernel_motorola_msm8916/commits/555e236e9a2fa16ea30e7738142d9f2712696a16"},{"sha":"0f88b2629cf87dfc0f554c44f4051ce090217edd","author":{"name":"Sasha Levin","email":"3eff170737f7f759a98f81ff6bf07d3c251c0277@oracle.com"},"message":"net: llc: use correct size for sysctl timeout entries\n\nThe timeout entries are sizeof(int) rather than sizeof(long), which\nmeans that when they were getting read we'd also leak kernel memory\nto userspace along with the timeout values.\n\nChange-Id: I328d1186720a6f70f555eeeb62c83ee69814868d\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/SlimRoms/kernel_motorola_msm8916/commits/0f88b2629cf87dfc0f554c44f4051ce090217edd"},{"sha":"c5fd35442fc4d39820f9096153d899f754d974a4","author":{"name":"David Howells","email":"358fdf7bce8223edb2a0d846104bf62a286894d5@redhat.com"},"message":"KEYS: Fix short sprintf buffer in /proc/keys show function\n\nFix a short sprintf buffer in proc_keys_show().  If the gcc stack protector\nis turned on, this can cause a panic due to stack corruption.\n\nThe problem is that xbuf[] is not big enough to hold a 64-bit timeout\nrendered as weeks:\n\n\t(gdb) p 0xffffffffffffffffULL/(60*60*24*7)\n\t$2 = 30500568904943\n\nThat's 14 chars plus NUL, not 11 chars plus NUL.\n\nExpand the buffer to 16 chars.\n\nI think the unpatched code apparently works if the stack-protector is not\nenabled because on a 32-bit machine the buffer won't be overflowed and on a\n64-bit machine there's a 64-bit aligned pointer at one side and an int that\nisn't checked again on the other side.\n\nThe panic incurred looks something like:\n\nKernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff81352ebe\nCPU: 0 PID: 1692 Comm: reproducer Not tainted 4.7.2-201.fc24.x86_64 #1\nHardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\n 0000000000000086 00000000fbbd2679 ffff8800a044bc00 ffffffff813d941f\n ffffffff81a28d58 ffff8800a044bc98 ffff8800a044bc88 ffffffff811b2cb6\n ffff880000000010 ffff8800a044bc98 ffff8800a044bc30 00000000fbbd2679\nCall Trace:\n [<ffffffff813d941f>] dump_stack+0x63/0x84\n [<ffffffff811b2cb6>] panic+0xde/0x22a\n [<ffffffff81352ebe>] ? proc_keys_show+0x3ce/0x3d0\n [<ffffffff8109f7f9>] __stack_chk_fail+0x19/0x30\n [<ffffffff81352ebe>] proc_keys_show+0x3ce/0x3d0\n [<ffffffff81350410>] ? key_validate+0x50/0x50\n [<ffffffff8134db30>] ? key_default_cmp+0x20/0x20\n [<ffffffff8126b31c>] seq_read+0x2cc/0x390\n [<ffffffff812b6b12>] proc_reg_read+0x42/0x70\n [<ffffffff81244fc7>] __vfs_read+0x37/0x150\n [<ffffffff81357020>] ? security_file_permission+0xa0/0xc0\n [<ffffffff81246156>] vfs_read+0x96/0x130\n [<ffffffff81247635>] SyS_read+0x55/0xc0\n [<ffffffff817eb872>] entry_SYSCALL_64_fastpath+0x1a/0xa4\n\nChange-Id: I0787d5a38c730ecb75d3c08f28f0ab36295d59e7\nReported-by: Ondrej Kozina <okozina@redhat.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nTested-by: Ondrej Kozina <okozina@redhat.com>","distinct":true,"url":"https://api.github.com/repos/SlimRoms/kernel_motorola_msm8916/commits/c5fd35442fc4d39820f9096153d899f754d974a4"},{"sha":"495e7a9c8eb83f631434dd6306332de7c0c131e3","author":{"name":"Nick Desaulniers","email":"b951273a67bf33267cd4dff69171cdef4e5efbe7@google.com"},"message":"fs: ext4: disable support for fallocate FALLOC_FL_PUNCH_HOLE\n\nBug: 28760453\nChange-Id: I019c2de559db9e4b95860ab852211b456d78c4ca\nSigned-off-by: Nick Desaulniers <ndesaulniers@google.com>","distinct":true,"url":"https://api.github.com/repos/SlimRoms/kernel_motorola_msm8916/commits/495e7a9c8eb83f631434dd6306332de7c0c131e3"},{"sha":"5fa3bf3a2a784bdcd4c0e4350ae14b3555ec6cc6","author":{"name":"Alberto97","email":"7e698329ce67c109a7d37e62879d5cb8156736ef@gmail.com"},"message":"Revert \"msm: mdss: Port HBM fixes\"\n\nThis reverts commit 6f4d67ca15d6aa454077a2a6c01974ea3b9ef467.\n\nChange-Id: I233fdaa35da343c6f0a2803757c46712ba432712","distinct":true,"url":"https://api.github.com/repos/SlimRoms/kernel_motorola_msm8916/commits/5fa3bf3a2a784bdcd4c0e4350ae14b3555ec6cc6"}]}
{"actor":{"display_login":"SlimAdmin"}}