{"push_id":986504844,"size":7,"distinct_size":7,"ref":"refs/heads/mkm","head":"78ce8b0c3c4de1e1321b305ee9f589d5df7a2527","before":"a71674cd48fee55b3734441c6452d0edc1f13cbd","commits":[{"sha":"862518ae8df76d87c7e816e272a26ad0a9cb1464","author":{"email":"518d07701a80fb29f0da45c7c615106b9be9d5c6@redhat.com","name":"Marcelo Leitner"},"message":"ipv6: addrconf: validate new MTU before applying it\n\nCurrently we don't check if the new MTU is valid or not and this allows\none to configure a smaller than minimum allowed by RFCs or even bigger\nthan interface own MTU, which is a problem as it may lead to packet\ndrops.\n\nIf you have a daemon like NetworkManager running, this may be exploited\nby remote attackers by forging RA packets with an invalid MTU, possibly\nleading to a DoS. (NetworkManager currently only validates for values\ntoo small, but not for too big ones.)\n\nThe fix is just to make sure the new value is valid. That is, between\nIPV6_MIN_MTU and interface's MTU.\n\nNote that similar check is already performed at\nndisc_router_discovery(), for when kernel itself parses the RA.\n\nChange-Id: I6b70d0c12a77c7932066982f8797d8024f130d7c\nSigned-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com>\nSigned-off-by: Sabrina Dubroca <sd@queasysnail.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_samsung_smdk4412/commits/862518ae8df76d87c7e816e272a26ad0a9cb1464"},{"sha":"289184d8d4ef53fc254449ee99fdcef3b064aedc","author":{"email":"10a8c465cefc9bdd6c925e26964d23c90f1141cc@google.com","name":"Dmitry Torokhov"},"message":"net: fix iterating over hashtable in tcp_nuke_addr()\n\nThe actual size of the tcp hashinfo table is tcp_hashinfo.ehash_mask + 1\nso we need to adjust the loop accordingly to get the sockets hashed into\nthe last bucket.\n\nChange-Id: I796b3c7b4a1a7fa35fba9e5192a4a403eb6e17de\nSigned-off-by: Dmitry Torokhov <dtor@google.com>","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_samsung_smdk4412/commits/289184d8d4ef53fc254449ee99fdcef3b064aedc"},{"sha":"5e60df5a7c346658adad7e8eafb1450491a660bb","author":{"email":"331be22c6b63ca3e0a03d408c2d906b1b02cd5f2@stressinduktion.org","name":"Hannes Frederic Sowa"},"message":"net: add validation for the socket syscall protocol argument\n\n郭永刚 reported that one could simply crash the kernel as root by\nusing a simple program:\n\n\tint socket_fd;\n\tstruct sockaddr_in addr;\n\taddr.sin_port = 0;\n\taddr.sin_addr.s_addr = INADDR_ANY;\n\taddr.sin_family = 10;\n\n\tsocket_fd = socket(10,3,0x40000000);\n\tconnect(socket_fd , &addr,16);\n\nAF_INET, AF_INET6 sockets actually only support 8-bit protocol\nidentifiers. inet_sock's skc_protocol field thus is sized accordingly,\nthus larger protocol identifiers simply cut off the higher bits and\nstore a zero in the protocol fields.\n\nThis could lead to e.g. NULL function pointer because as a result of\nthe cut off inet_num is zero and we call down to inet_autobind, which\nis NULL for raw sockets.\n\nkernel: Call Trace:\nkernel:  [<ffffffff816db90e>] ? inet_autobind+0x2e/0x70\nkernel:  [<ffffffff816db9a4>] inet_dgram_connect+0x54/0x80\nkernel:  [<ffffffff81645069>] SYSC_connect+0xd9/0x110\nkernel:  [<ffffffff810ac51b>] ? ptrace_notify+0x5b/0x80\nkernel:  [<ffffffff810236d8>] ? syscall_trace_enter_phase2+0x108/0x200\nkernel:  [<ffffffff81645e0e>] SyS_connect+0xe/0x10\nkernel:  [<ffffffff81779515>] tracesys_phase2+0x84/0x89\n\nI found no particular commit which introduced this problem.\n\nChange-Id: If01a1f7d3c652e8e67d5090eb8ea91389829b2ea\nCVE: CVE-2015-8543\nCc: Cong Wang <cwang@twopensource.com>\nReported-by: 郭永刚 <guoyonggang@360.cn>\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_samsung_smdk4412/commits/5e60df5a7c346658adad7e8eafb1450491a660bb"},{"sha":"9c25bb369d3df8816610919ae76faaf5fb04c14a","author":{"email":"fe08d3c717adf2ae63592e4c9aec6e3e404d8e3e@davemloft.net","name":"David S. Miller"},"message":"bluetooth: Validate socket address length in sco_sock_bind().\n\nChange-Id: Id051e0c1a5d89ea90e9b058175c37c952cad70bc\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_samsung_smdk4412/commits/9c25bb369d3df8816610919ae76faaf5fb04c14a"},{"sha":"7263d7854a4418052aafc520e66313ffc8a2bedc","author":{"email":"9ff04a02a69f376b2b9aeec27187017cbf3cf5f9@redhat.com","name":"Daniel Borkmann"},"message":"netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages\n\nSome occurences in the netfilter tree use skb_header_pointer() in\nthe following way ...\n\n  struct dccp_hdr _dh, *dh;\n  ...\n  skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);\n\n... where dh itself is a pointer that is being passed as the copy\nbuffer. Instead, we need to use &_dh as the forth argument so that\nwe're copying the data into an actual buffer that sits on the stack.\n\nCurrently, we probably could overwrite memory on the stack (e.g.\nwith a possibly mal-formed DCCP packet), but unintentionally, as\nwe only want the buffer to be placed into _dh variable.\n\nChange-Id: I61e449445e085beec3697ec9ffbad0838fb6bff8\nFixes: 2bc780499aa3 (\"[NETFILTER]: nf_conntrack: add DCCP protocol support\")\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_samsung_smdk4412/commits/7263d7854a4418052aafc520e66313ffc8a2bedc"},{"sha":"b6ad77af717a40d98627ad297b096d5cb1d36eb9","author":{"email":"257d7d5bef225e0a56b3375b0c1e95c6bb0ab871@modio.se","name":"D.S. Ljungmark"},"message":"ipv6: Don't reduce hop limit for an interface\n\nA local route may have a lower hop_limit set than global routes do.\n\nRFC 3756, Section 4.2.7, \"Parameter Spoofing\"\n\n>   1.  The attacker includes a Current Hop Limit of one or another small\n>       number which the attacker knows will cause legitimate packets to\n>       be dropped before they reach their destination.\n\n>   As an example, one possible approach to mitigate this threat is to\n>   ignore very small hop limits.  The nodes could implement a\n>   configurable minimum hop limit, and ignore attempts to set it below\n>   said limit.\n\nChange-Id: I8d9d9cd978b8d5587cc1056dc65683291f0a153a\nSigned-off-by: D.S. Ljungmark <ljungmark@modio.se>\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_samsung_smdk4412/commits/b6ad77af717a40d98627ad297b096d5cb1d36eb9"},{"sha":"78ce8b0c3c4de1e1321b305ee9f589d5df7a2527","author":{"email":"239d0dcf4c4fca4a9859e3f56c56755f6b1aec1c@mokeedev.com","name":"martincz"},"message":"Merge branch 'remote' into mkm","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_samsung_smdk4412/commits/78ce8b0c3c4de1e1321b305ee9f589d5df7a2527"}]}