{"push_id":1272245402,"size":169,"distinct_size":169,"ref":"refs/heads/marshmallow","head":"35e2b1188a1485261934ce79f82ac1d64f9cd4d7","before":"4523d1ad8269c4e5834649b7a5939d5733065bdb","commits":[{"sha":"7355dcd15a61fa243cacf7c7c720048f15b926a7","author":{"name":"Andi Kleen","email":"c11846b976c384ad30536475c5d4d3ae71259b65@linux.intel.com"},"message":"x86, asmlinkage, apm: Make APM data structure used from assembler visible\n\ncommit 54c2f3fdb941204cad136024c7b854b7ad112ab6 upstream.\n\nSigned-off-by: Andi Kleen <ak@linux.intel.com>\nLink: http://lkml.kernel.org/r/1375740170-7446-12-git-send-email-andi@firstfloor.org\nSigned-off-by: H. Peter Anvin <hpa@linux.intel.com>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/7355dcd15a61fa243cacf7c7c720048f15b926a7"},{"sha":"62c276282e13e1d3c962275b6bf6a752210b1192","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: x_tables: validate e->target_offset early\n\ncommit bdf533de6968e9686df777dc178486f600c6e617 upstream.\n\nWe should check that e->target_offset is sane before\nmark_source_chains gets called since it will fetch the target entry\nfor loop detection.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/62c276282e13e1d3c962275b6bf6a752210b1192"},{"sha":"e7fa246584491f038457c5ed9abf7cbe172b6ec2","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: x_tables: don't move to non-existent next rule\n\ncommit f24e230d257af1ad7476c6e81a8dc3127a74204e upstream.\n\nBen Hawkes says:\n\n In the mark_source_chains function (net/ipv4/netfilter/ip_tables.c) it\n is possible for a user-supplied ipt_entry structure to have a large\n next_offset field. This field is not bounds checked prior to writing a\n counter value at the supplied offset.\n\nBase chains enforce absolute verdict.\n\nUser defined chains are supposed to end with an unconditional return,\nxtables userspace adds them automatically.\n\nBut if such return is missing we will move to non-existent next rule.\n\nCVE-2016-3134\n\nReported-by: Ben Hawkes <hawkes@google.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Chas Williams <3chas3@gmail.com>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/e7fa246584491f038457c5ed9abf7cbe172b6ec2"},{"sha":"56a1a1e18d7a9bb21a1f48f886ef64f5252e51a6","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: x_tables: add and use xt_check_entry_offsets\n\ncommit 7d35812c3214afa5b37a675113555259cfd67b98 upstream.\n\nCurrently arp/ip and ip6tables each implement a short helper to check that\nthe target offset is large enough to hold one xt_entry_target struct and\nthat t->u.target_size fits within the current rule.\n\nUnfortunately these checks are not sufficient.\n\nTo avoid adding new tests to all of ip/ip6/arptables move the current\nchecks into a helper, then extend this helper in followup patches.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/56a1a1e18d7a9bb21a1f48f886ef64f5252e51a6"},{"sha":"922a88664ab7cefcfb9fedf037734cb5a5c914a9","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: x_tables: kill check_entry helper\n\ncommit aa412ba225dd3bc36d404c28cdc3d674850d80d0 upstream.\n\nOnce we add more sanity testing to xt_check_entry_offsets it\nbecomes relvant if we're expecting a 32bit 'config_compat' blob\nor a normal one.\n\nSince we already have a lot of similar-named functions (check_entry,\ncompat_check_entry, find_and_check_entry, etc.) and the current\nincarnation is short just fold its contents into the callers.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/922a88664ab7cefcfb9fedf037734cb5a5c914a9"},{"sha":"7445e97a430e68cb9dcbe2386d02baf467d87c8d","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: x_tables: assert minimum target size\n\ncommit a08e4e190b866579896c09af59b3bdca821da2cd upstream.\n\nThe target size includes the size of the xt_entry_target struct.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/7445e97a430e68cb9dcbe2386d02baf467d87c8d"},{"sha":"05346e3455fa4803b4ba1247475e8be71670ca42","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: x_tables: add compat version of xt_check_entry_offsets\n\ncommit fc1221b3a163d1386d1052184202d5dc50d302d1 upstream.\n\n32bit rulesets have different layout and alignment requirements, so once\nmore integrity checks get added to xt_check_entry_offsets it will reject\nwell-formed 32bit rulesets.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/05346e3455fa4803b4ba1247475e8be71670ca42"},{"sha":"e4d91cbec432234e41b682887f6b0203bdc747a5","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: x_tables: check standard target size too\n\ncommit 7ed2abddd20cf8f6bd27f65bd218f26fa5bf7f44 upstream.\n\nWe have targets and standard targets -- the latter carries a verdict.\n\nThe ip/ip6tables validation functions will access t->verdict for the\nstandard targets to fetch the jump offset or verdict for chainloop\ndetection, but this happens before the targets get checked/validated.\n\nThus we also need to check for verdict presence here, else t->verdict\ncan point right after a blob.\n\nSpotted with UBSAN while testing malformed blobs.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/e4d91cbec432234e41b682887f6b0203bdc747a5"},{"sha":"542d538fdfecab20e34808439954f8f4a2626f6e","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: x_tables: check for bogus target offset\n\ncommit ce683e5f9d045e5d67d1312a42b359cb2ab2a13c upstream.\n\nWe're currently asserting that targetoff + targetsize <= nextoff.\n\nExtend it to also check that targetoff is >= sizeof(xt_entry).\nSince this is generic code, add an argument pointing to the start of the\nmatch/target, we can then derive the base structure size from the delta.\n\nWe also need the e->elems pointer in a followup change to validate matches.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/542d538fdfecab20e34808439954f8f4a2626f6e"},{"sha":"4c4ca1801472e7484a2aa1795c84809eb9a38f4f","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: x_tables: validate all offsets and sizes in a rule\n\ncommit 13631bfc604161a9d69cd68991dff8603edd66f9 upstream.\n\nValidate that all matches (if any) add up to the beginning of\nthe target and that each match covers at least the base structure size.\n\nThe compat path should be able to safely re-use the function\nas the structures only differ in alignment; added a\nBUILD_BUG_ON just in case we have an arch that adds padding as well.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/4c4ca1801472e7484a2aa1795c84809eb9a38f4f"},{"sha":"d04a3eb1b277e115d32eb5f52145fadfa4b1e1f3","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: x_tables: don't reject valid target size on some architectures\n\ncommit 7b7eba0f3515fca3296b8881d583f7c1042f5226 upstream.\n\nQuoting John Stultz:\n  In updating a 32bit arm device from 4.6 to Linus' current HEAD, I\n  noticed I was having some trouble with networking, and realized that\n  /proc/net/ip_tables_names was suddenly empty.\n  Digging through the registration process, it seems we're catching on the:\n\n   if (strcmp(t->u.user.name, XT_STANDARD_TARGET) == 0 &&\n       target_offset + sizeof(struct xt_standard_target) != next_offset)\n         return -EINVAL;\n\n  Where next_offset seems to be 4 bytes larger then the\n  offset + standard_target struct size.\n\nnext_offset needs to be aligned via XT_ALIGN (so we can access all members\nof ip(6)t_entry struct).\n\nThis problem didn't show up on i686 as it only needs 4-byte alignment for\nu64, but iptables userspace on other 32bit arches does insert extra padding.\n\nReported-by: John Stultz <john.stultz@linaro.org>\nTested-by: John Stultz <john.stultz@linaro.org>\nFixes: 7ed2abddd20cf (\"netfilter: x_tables: check standard target size too\")\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/d04a3eb1b277e115d32eb5f52145fadfa4b1e1f3"},{"sha":"b2a6f4f1e58af1f1962a2d614eadfc49174556c8","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: arp_tables: simplify translate_compat_table args\n\ncommit 8dddd32756f6fe8e4e82a63361119b7e2384e02f upstream.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/b2a6f4f1e58af1f1962a2d614eadfc49174556c8"},{"sha":"3039df5daedde0497f67d048749262d73a40227f","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: ip_tables: simplify translate_compat_table args\n\ncommit 7d3f843eed29222254c9feab481f55175a1afcc9 upstream.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/3039df5daedde0497f67d048749262d73a40227f"},{"sha":"617688044eca89ed6339ef5f0e464393be217e63","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: ip6_tables: simplify translate_compat_table args\n\ncommit 329a0807124f12fe1c8032f95d8a8eb47047fb0e upstream.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/617688044eca89ed6339ef5f0e464393be217e63"},{"sha":"808cd7695ba353549108fa471e78d23ded656261","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: x_tables: xt_compat_match_from_user doesn't need a retval\n\ncommit 0188346f21e6546498c2a0f84888797ad4063fc5 upstream.\n\nAlways returned 0.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/808cd7695ba353549108fa471e78d23ded656261"},{"sha":"ab2ce787a8ca0f98fe7bbea75c985f691856fd90","author":{"name":"Dave Jones","email":"aeb86c368b3b356d5000d6aecf911b50d61d5460@codemonkey.org.uk"},"message":"netfilter: ensure number of counters is >0 in do_replace()\n\ncommit 1086bbe97a074844188c6c988fa0b1a98c3ccbb9 upstream.\n\nAfter improving setsockopt() coverage in trinity, I started triggering\nvmalloc failures pretty reliably from this code path:\n\nwarn_alloc_failed+0xe9/0x140\n__vmalloc_node_range+0x1be/0x270\nvzalloc+0x4b/0x50\n__do_replace+0x52/0x260 [ip_tables]\ndo_ipt_set_ctl+0x15d/0x1d0 [ip_tables]\nnf_setsockopt+0x65/0x90\nip_setsockopt+0x61/0xa0\nraw_setsockopt+0x16/0x60\nsock_common_setsockopt+0x14/0x20\nSyS_setsockopt+0x71/0xd0\n\nIt turns out we don't validate that the num_counters field in the\nstruct we pass in from userspace is initialized.\n\nThe same problem also exists in ebtables, arptables, ipv6, and the\ncompat variants.\n\nSigned-off-by: Dave Jones <davej@codemonkey.org.uk>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/ab2ce787a8ca0f98fe7bbea75c985f691856fd90"},{"sha":"16e2678eca9c08ad67ad34e5aae74130880f9a79","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: x_tables: do compat validation via translate_table\n\ncommit 09d9686047dbbe1cf4faa558d3ecc4aae2046054 upstream.\n\nThis looks like refactoring, but its also a bug fix.\n\nProblem is that the compat path (32bit iptables, 64bit kernel) lacks a few\nsanity tests that are done in the normal path.\n\nFor example, we do not check for underflows and the base chain policies.\n\nWhile its possible to also add such checks to the compat path, its more\ncopy&pastry, for instance we cannot reuse check_underflow() helper as\ne->target_offset differs in the compat case.\n\nOther problem is that it makes auditing for validation errors harder; two\nplaces need to be checked and kept in sync.\n\nAt a high level 32 bit compat works like this:\n1- initial pass over blob:\n   validate match/entry offsets, bounds checking\n   lookup all matches and targets\n   do bookkeeping wrt. size delta of 32/64bit structures\n   assign match/target.u.kernel pointer (points at kernel\n   implementation, needed to access ->compatsize etc.)\n\n2- allocate memory according to the total bookkeeping size to\n   contain the translated ruleset\n\n3- second pass over original blob:\n   for each entry, copy the 32bit representation to the newly allocated\n   memory.  This also does any special match translations (e.g.\n   adjust 32bit to 64bit longs, etc).\n\n4- check if ruleset is free of loops (chase all jumps)\n\n5-first pass over translated blob:\n   call the checkentry function of all matches and targets.\n\nThe alternative implemented by this patch is to drop steps 3&4 from the\ncompat process, the translation is changed into an intermediate step\nrather than a full 1:1 translate_table replacement.\n\nIn the 2nd pass (step #3), change the 64bit ruleset back to a kernel\nrepresentation, i.e. put() the kernel pointer and restore ->u.user.name .\n\nThis gets us a 64bit ruleset that is in the format generated by a 64bit\niptables userspace -- we can then use translate_table() to get the\n'native' sanity checks.\n\nThis has two drawbacks:\n\n1. we re-validate all the match and target entry structure sizes even\nthough compat translation is supposed to never generate bogus offsets.\n2. we put and then re-lookup each match and target.\n\nTHe upside is that we get all sanity tests and ruleset validations\nprovided by the normal path and can remove some duplicated compat code.\n\niptables-restore time of autogenerated ruleset with 300k chains of form\n-A CHAIN0001 -m limit --limit 1/s -j CHAIN0002\n-A CHAIN0002 -m limit --limit 1/s -j CHAIN0003\n\nshows no noticeable differences in restore times:\nold:   0m30.796s\nnew:   0m31.521s\n64bit: 0m25.674s\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/16e2678eca9c08ad67ad34e5aae74130880f9a79"},{"sha":"8fb2c8f23066705ce3fd1e9a029595a38bf4f568","author":{"name":"Bernhard Thaler","email":"8868eb4d3b05aa1a86ffa5fc67c946819c6944f3@wvnet.at"},"message":"Revert \"netfilter: ensure number of counters is >0 in do_replace()\"\n\ncommit d26e2c9ffa385dd1b646f43c1397ba12af9ed431 upstream.\n\nThis partially reverts commit 1086bbe97a07 (\"netfilter: ensure number of\ncounters is >0 in do_replace()\") in net/bridge/netfilter/ebtables.c.\n\nSetting rules with ebtables does not work any more with 1086bbe97a07 place.\n\nThere is an error message and no rules set in the end.\n\ne.g.\n\n~# ebtables -t nat -A POSTROUTING --src 12:34:56:78:9a:bc -j DROP\nUnable to update the kernel. Two possible causes:\n1. Multiple ebtables programs were executing simultaneously. The ebtables\n   userspace tool doesn't by default support multiple ebtables programs\nrunning\n\nReverting the ebtables part of 1086bbe97a07 makes this work again.\n\nSigned-off-by: Bernhard Thaler <bernhard.thaler@wvnet.at>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/8fb2c8f23066705ce3fd1e9a029595a38bf4f568"},{"sha":"af6d7fe5374dffda6253e1d38070f351ed8cbad5","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: x_tables: introduce and use xt_copy_counters_from_user\n\ncommit 63ecb81aadf1c823c85c70a2bfd1ec9df3341a72 upstream.\n\ncommit d7591f0c41ce3e67600a982bab6989ef0f07b3ce upstream\n\nThe three variants use same copy&pasted code, condense this into a\nhelper and use that.\n\nMake sure info.name is 0-terminated.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/af6d7fe5374dffda6253e1d38070f351ed8cbad5"},{"sha":"c7695e22f977500320ab471fbaa139ae31dbb57c","author":{"name":"Palik, Imre","email":"c942c8d06b237f5bfe1a4f3419c14f4948893694@amazon.de"},"message":"perf/x86: Honor the architectural performance monitoring version\n\ncommit 2c33645d366d13b969d936b68b9f4875b1fdddea upstream.\n\nArchitectural performance monitoring, version 1, doesn't support fixed counters.\n\nCurrently, even if a hypervisor advertises support for architectural\nperformance monitoring version 1, perf may still try to use the fixed\ncounters, as the constraints are set up based on the CPU model.\n\nThis patch ensures that perf honors the architectural performance monitoring\nversion returned by CPUID, and it only uses the fixed counters for version 2\nand above.\n\n(Some of the ideas in this patch came from Peter Zijlstra.)\n\nSigned-off-by: Imre Palik <imrep@amazon.de>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Andrew Morton <akpm@linux-foundation.org>\nCc: Andy Lutomirski <luto@amacapital.net>\nCc: Anthony Liguori <aliguori@amazon.com>\nCc: Arnaldo Carvalho de Melo <acme@kernel.org>\nCc: Borislav Petkov <bp@alien8.de>\nCc: Brian Gerst <brgerst@gmail.com>\nCc: Denys Vlasenko <dvlasenk@redhat.com>\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Oleg Nesterov <oleg@redhat.com>\nCc: Paul Mackerras <paulus@samba.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nLink: http://lkml.kernel.org/r/1433767609-1039-1-git-send-email-imrep.amz@gmail.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\n[wt: FIXED_EVENT_FLAGS was X86_RAW_EVENT_MASK in 3.10]\nCc: Kevin Christopher <kevinc@vmware.com>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/guts94/kenzo/commits/c7695e22f977500320ab471fbaa139ae31dbb57c"}]}
{"actor":{"display_login":"guts94"}}