{"push_id":2360609540,"size":10,"distinct_size":10,"ref":"refs/heads/nexus-6p","head":"06187a1363d322c8f155491603ea2d5ef8b8cf21","before":"b9f23022bcc22efc06fe095e7dd3333b4beabd54","commits":[{"sha":"e7b9da83d5af2e2e2c7ac18f8f2dd02d7d53c67d","author":{"name":"Paul Moore","email":"54f65660711c038b3360dd7288dc12347ae58ba3@paul-moore.com"},"message":"selinux: skip bounded transition processing if the policy isn't loaded\n\ncommit 4b14752ec4e0d87126e636384cf37c8dd9df157c upstream.\n\nWe can't do anything reasonable in security_bounded_transition() if we\ndon't have a policy loaded, and in fact we could run into problems\nwith some of the code inside expecting a policy.  Fix these problems\nlike we do many others in security/selinux/ss/services.c by checking\nto see if the policy is loaded (ss_initialized) and returning quickly\nif it isn't.\n\nReported-by: syzbot <syzkaller-bugs@googlegroups.com>\nSigned-off-by: Paul Moore <paul@paul-moore.com>\nAcked-by: Stephen Smalley <sds@tycho.nsa.gov>\nReviewed-by: James Morris <james.l.morris@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/norbertc/nexus-kernel/commits/e7b9da83d5af2e2e2c7ac18f8f2dd02d7d53c67d"},{"sha":"ed18454764cdca6ba649ee325396e8543c7ae364","author":{"name":"Eric Biggers","email":"0106d512ed1cb672be29d4b167a07ead51709fba@google.com"},"message":"crypto: x86/twofish-3way - Fix %rbp usage\n\ncommit d8c7fe9f2a486a6e5f0d5229ca43807af5ab22c6 upstream.\n\nUsing %rbp as a temporary register breaks frame pointer convention and\nbreaks stack traces when unwinding from an interrupt in the crypto code.\n\nIn twofish-3way, we can't simply replace %rbp with another register\nbecause there are none available.  Instead, we use the stack to hold the\nvalues that %rbp, %r11, and %r12 were holding previously.  Each of these\nvalues represents the half of the output from the previous Feistel round\nthat is being passed on unchanged to the following round.  They are only\nused once per round, when they are exchanged with %rax, %rbx, and %rcx.\n\nAs a result, we free up 3 registers (one per block) and can reassign\nthem so that %rbp is not used, and additionally %r14 and %r15 are not\nused so they do not need to be saved/restored.\n\nThere may be a small overhead caused by replacing 'xchg REG, REG' with\nthe needed sequence 'mov MEM, REG; mov REG, MEM; mov REG, REG' once per\nround.  But, counterintuitively, when I tested \"ctr-twofish-3way\" on a\nHaswell processor, the new version was actually about 2% faster.\n(Perhaps 'xchg' is not as well optimized as plain moves.)\n\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nReviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/norbertc/nexus-kernel/commits/ed18454764cdca6ba649ee325396e8543c7ae364"},{"sha":"cc0e7b490daa4057a9b14609b1e2a4466696405a","author":{"name":"Dmitry Vyukov","email":"b57e2f029877ea15ce154a1e552a90c512dd912a@google.com"},"message":"netfilter: x_tables: fix int overflow in xt_alloc_table_info()\n\ncommit 889c604fd0b5f6d3b8694ade229ee44124de1127 upstream.\n\nsyzkaller triggered OOM kills by passing ipt_replace.size = -1\nto IPT_SO_SET_REPLACE. The root cause is that SMP_ALIGN() in\nxt_alloc_table_info() causes int overflow and the size check passes\nwhen it should not. SMP_ALIGN() is no longer needed leftover.\n\nRemove SMP_ALIGN() call in xt_alloc_table_info().\n\nReported-by: syzbot+4396883fa8c4f64e0175@syzkaller.appspotmail.com\nSigned-off-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/norbertc/nexus-kernel/commits/cc0e7b490daa4057a9b14609b1e2a4466696405a"},{"sha":"a332b82d25b3e13351546115306cf658ce210769","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"netfilter: x_tables: avoid out-of-bounds reads in xt_request_find_{match|target}\n\ncommit da17c73b6eb74aad3c3c0654394635675b623b3e upstream.\n\nIt looks like syzbot found its way into netfilter territory.\n\nIssue here is that @name comes from user space and might\nnot be null terminated.\n\nOut-of-bound reads happen, KASAN is not happy.\n\nv2 added similar fix for xt_request_find_target(),\nas Florian advised.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nAcked-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/norbertc/nexus-kernel/commits/a332b82d25b3e13351546115306cf658ce210769"},{"sha":"310b7ebb20e9c2eed9d49f12ac57d7ee2cbfc685","author":{"name":"Dmitry Vyukov","email":"b57e2f029877ea15ce154a1e552a90c512dd912a@google.com"},"message":"netfilter: ipt_CLUSTERIP: fix out-of-bounds accesses in clusterip_tg_check()\n\ncommit 1a38956cce5eabd7b74f94bab70265e4df83165e upstream.\n\nCommit 136e92bbec0a switched local_nodes from an array to a bitmask\nbut did not add proper bounds checks. As the result\nclusterip_config_init_nodelist() can both over-read\nipt_clusterip_tgt_info.local_nodes and over-write\nclusterip_config.local_nodes.\n\nAdd bounds checks for both.\n\nFixes: 136e92bbec0a (\"[NETFILTER] CLUSTERIP: use a bitmap to store node responsibility data\")\nSigned-off-by: Dmitry Vyukov <dvyukov@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/norbertc/nexus-kernel/commits/310b7ebb20e9c2eed9d49f12ac57d7ee2cbfc685"},{"sha":"fe4862f74196f46262682be3f7853ea79ec7d3e6","author":{"name":"Cong Wang","email":"3f5d79d28d6d48052800caba9df0b30e06fefe41@gmail.com"},"message":"netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert\n\ncommit 7dc68e98757a8eccf8ca7a53a29b896f1eef1f76 upstream.\n\nrateest_hash is supposed to be protected by xt_rateest_mutex,\nand, as suggested by Eric, lookup and insert should be atomic,\nso we should acquire the xt_rateest_mutex once for both.\n\nSo introduce a non-locking helper for internal use and keep the\nlocking one for external.\n\nReported-by: <syzbot+5cb189720978275e4c75@syzkaller.appspotmail.com>\nFixes: 5859034d7eb8 (\"[NETFILTER]: x_tables: add RATEEST target\")\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nReviewed-by: Florian Westphal <fw@strlen.de>\nReviewed-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/norbertc/nexus-kernel/commits/fe4862f74196f46262682be3f7853ea79ec7d3e6"},{"sha":"17b0df087868187904c4a10b063e9979607077ad","author":{"name":"Willem de Bruijn","email":"86b583cfb6b08f85a219d9441a0068d5b14d5476@google.com"},"message":"net: avoid skb_warn_bad_offload on IS_ERR\n\ncommit 8d74e9f88d65af8bb2e095aff506aa6eac755ada upstream.\n\nskb_warn_bad_offload warns when packets enter the GSO stack that\nrequire skb_checksum_help or vice versa. Do not warn on arbitrary\nbad packets. Packet sockets can craft many. Syzkaller was able to\ndemonstrate another one with eth_type games.\n\nIn particular, suppress the warning when segmentation returns an\nerror, which is for reasons other than checksum offload.\n\nSee also commit 36c92474498a (\"net: WARN if skb_checksum_help() is\ncalled on skb requiring segmentation\") for context on this warning.\n\nSigned-off-by: Willem de Bruijn <willemb@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/norbertc/nexus-kernel/commits/17b0df087868187904c4a10b063e9979607077ad"},{"sha":"e2eb7f9e651abd53543c2e1a79cec3a3f4e524e7","author":{"name":"David Howells","email":"358fdf7bce8223edb2a0d846104bf62a286894d5@redhat.com"},"message":"Provide a function to create a NUL-terminated string from unterminated data\n\ncommit f35157417215ec138c920320c746fdb3e04ef1d5 upstream.\n\nProvide a function, kmemdup_nul(), that will create a NUL-terminated string\nfrom an unterminated character array where the length is known in advance.\n\nThis is better than kstrndup() in situations where we already know the\nstring length as the strnlen() in kstrndup() is superfluous.\n\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/norbertc/nexus-kernel/commits/e2eb7f9e651abd53543c2e1a79cec3a3f4e524e7"},{"sha":"3fef016481661757be94350936d7d7c08352f0a0","author":{"name":"Paul Moore","email":"54f65660711c038b3360dd7288dc12347ae58ba3@paul-moore.com"},"message":"selinux: ensure the context is NUL terminated in security_context_to_sid_core()\n\ncommit ef28df55ac27e1e5cd122e19fa311d886d47a756 upstream.\n\nThe syzbot/syzkaller automated tests found a problem in\nsecurity_context_to_sid_core() during early boot (before we load the\nSELinux policy) where we could potentially feed context strings without\nNUL terminators into the strcmp() function.\n\nWe already guard against this during normal operation (after the SELinux\npolicy has been loaded) by making a copy of the context strings and\nexplicitly adding a NUL terminator to the end.  The patch extends this\nprotection to the early boot case (no loaded policy) by moving the context\ncopy earlier in security_context_to_sid_core().\n\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: Paul Moore <paul@paul-moore.com>\nReviewed-By: William Roberts <william.c.roberts@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/norbertc/nexus-kernel/commits/3fef016481661757be94350936d7d7c08352f0a0"},{"sha":"06187a1363d322c8f155491603ea2d5ef8b8cf21","author":{"name":"Nogah Frankel","email":"a6351630d812519aff3c043422ccee3bdba26faf@mellanox.com"},"message":"net_sched: red: Avoid illegal values\n\n[ Upstream commit 8afa10cbe281b10371fee5a87ab266e48d71a7f9 ]\n\nCheck the qmin & qmax values doesn't overflow for the given Wlog value.\nCheck that qmin <= qmax.\n\nFixes: a783474591f2 (\"[PKT_SCHED]: Generic RED layer\")\nSigned-off-by: Nogah Frankel <nogahf@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/norbertc/nexus-kernel/commits/06187a1363d322c8f155491603ea2d5ef8b8cf21"}]}
{"actor":{"display_login":"norbertc"}}