{"push_id":2324761646,"size":25,"distinct_size":0,"ref":"refs/heads/8.1","head":"7d8e2dd1be15811942674f964010418110feb6e1","before":"5f3c96a078acec72f69877fddcc1912ffd84deaf","commits":[{"sha":"eafd3e9efb218f177ae7c4be2e0414a91ec8a08f","author":{"name":"Andy Whitcroft","email":"4a4a9e194cc5d2585ac40c9d65b8b3b004616bed@canonical.com"},"message":"xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window\n\nWhen a new xfrm state is created during an XFRM_MSG_NEWSA call we validate\nthe user supplied replay_esn to ensure that the size is valid and to ensure\nthat the replay_window size is within the allocated buffer.  However later\nit is possible to update this replay_esn via a XFRM_MSG_NEWAE call.\nThere we again validate the size of the supplied buffer matches the\nexisting state and if so inject the contents.  We do not at this point\ncheck that the replay_window is within the allocated memory.  This leads\nto out-of-bounds reads and writes triggered by netlink packets.  This leads\nto memory corruption and the potential for priviledge escalation.\n\nWe already attempt to validate the incoming replay information in\nxfrm_new_ae() via xfrm_replay_verify_len().  This confirms that the\nuser is not trying to change the size of the replay state buffer which\nincludes the replay_esn.  It however does not check the replay_window\nremains within that buffer.  Add validation of the contained replay_window.\n\nAdditionally Kees Cook has pointed out that xfrm_replay_state_esn_len()\nis subject to wrapping issues.  To ensure we are correctly ensuring that\nthe two ESN structures are the same size compare both the overall size\nas reported by xfrm_replay_state_esn_len() and the internal length are\nthe same.\n\nCVE-2017-7184\nZDI-CAN-4586\nBug: 36565222\nSigned-off-by: Andy Whitcroft <apw@canonical.com>\nReviewed-by: Tyler Hicks <tyhicks@canonical.com>\nReviewed-by: John Johansen <john.johansen@canonical.com>\nReviewed-by: Kees Cook <keescook@chromium.org>\nChange-Id: I50d2766ab19fb182a5e75adf9e46ff043f2d99ea","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/eafd3e9efb218f177ae7c4be2e0414a91ec8a08f"},{"sha":"71c7c7a99bfe320cd7b266846a3363795f389299","author":{"name":"Nick Desaulniers","email":"b951273a67bf33267cd4dff69171cdef4e5efbe7@google.com"},"message":"Merge branch android-msm-bullhead-3.10 into android-msm-bullhead-3.10-security-next\n\nJune 2017.1\n\nBug: 37156499","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/71c7c7a99bfe320cd7b266846a3363795f389299"},{"sha":"6ac12ca5e04e25bc4121921916f461ed723343de","author":{"name":"Stuart Scott","email":"b77b697c61487cecba340e1b895b4971f4cb200d@google.com"},"message":"Merge android-msm-bullhead-3.10 into android-msm-bullhead-3.10-security-next\n\nJuly 2017.1","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/6ac12ca5e04e25bc4121921916f461ed723343de"},{"sha":"044df8f01a1ca2d3af83fbe0e58639874e5d22bc","author":{"name":"Stuart Scott","email":"b77b697c61487cecba340e1b895b4971f4cb200d@google.com"},"message":"Merge android-msm-bullhead-3.10 into android-msm-bullhead-3.10-security-next\n\nAugust 2017.1","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/044df8f01a1ca2d3af83fbe0e58639874e5d22bc"},{"sha":"0709c3c6108b0ae5043921ab00aaa11a0c100788","author":{"name":"Jonathan Solnit","email":"5b052bc42b7d24057766cac85ee1eabb55909c79@google.com"},"message":"Merge branch 'android-msm-bullhead-3.10' into android-msm-bullhead-3.10-security-next\n\nSeptember 2017.2\n\nBug: 63173580\nChange-Id: I6bec05cd49952060278af2e1df4ca43ca98abaf3","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/0709c3c6108b0ae5043921ab00aaa11a0c100788"},{"sha":"8026678831980157765a331172adf2b8ee34b164","author":{"name":"Siqi Lin","email":"05311c862ac5771ebcb1a0a3adac66d431c622e1@google.com"},"message":"Merge branch 'android-msm-bullhead-3.10' into android-msm-bullhead-3.10-security-next\n\nOctober 2017.3\n\nChange-Id: Ie98e2c01d2872040b2185586889d07e705188e51\nSigned-off-by: Siqi Lin <siqilin@google.com>","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/8026678831980157765a331172adf2b8ee34b164"},{"sha":"af1d5ce4f15d5f4c78fb6d1375aa49b94613ee54","author":{"name":"Andrew Lehmer","email":"9018f1bcf42eaf693e0ffeae8e6dc2285c3cc65a@google.com"},"message":"Merge branch 'android-msm-bullhead-3.10' into android-msm-bullhead-3.10-security-next\n\nChange-Id: I12c597318d45de2cc272839babe66fac085f682c\nSigned-off-by: Andrew Lehmer <alehmer@google.com>","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/af1d5ce4f15d5f4c78fb6d1375aa49b94613ee54"},{"sha":"bab2a7662626eddc406a80cf6f3c3909a6fe8a2d","author":{"name":"Patrick Tjin","email":"46d88a89e92edd8988129e9c71eaf27efb6541ae@google.com"},"message":"Merge branch 'android-msm-bullhead-3.10' into android-msm-bullhead-3.10-security-next\n\nDecember 2017.1\n\nChange-Id: I56f2d71a583d2d0e28a9b07fc7ecc1d9f33e6b68","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/bab2a7662626eddc406a80cf6f3c3909a6fe8a2d"},{"sha":"f14746146c053151b9e11a193f04df50984d6dc7","author":{"name":"Patrick Tjin","email":"46d88a89e92edd8988129e9c71eaf27efb6541ae@google.com"},"message":"Merge 'android-msm-bullhead-3.10' into android-msm-bullhead-3.10-security-next\n\nJanuary 2018.1\n\nBug: 68996203\nChange-Id: Ide7097d9ae4250a5823dd46a3f21d8d6cd2cc0fe","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/f14746146c053151b9e11a193f04df50984d6dc7"},{"sha":"77c84e27449b17e601d6ad89ad61cdc5a2a3c641","author":{"name":"Paul Lawrence","email":"e807599d46d645cab93c8081b4e7de9e4aee62d0@google.com"},"message":"iovec: make sure the caller actually wants anything in memcpy_fromiovecend\n\nBased on upstream change 06ebb06d49486676272a3c030bfeef4bd969a8e6\n\nOne more instance when the caller requests 0 bytes instead of running\noff and dereferencing potentially invalid iovecs.\n\nSigned-off-by: Paul Lawrence <paullawrence@google.com>\nBug: 36279469\nChange-Id: Ib8d529e17c07c77357ab70bd6a2d7e305d6b27f0","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/77c84e27449b17e601d6ad89ad61cdc5a2a3c641"},{"sha":"1a3c1bcabec2b5374914b2ca9d1a6569bb44bb0b","author":{"name":"Steve Pfetsch","email":"bb211e4bef0918e20e6005fce72228c45515844d@google.com"},"message":"FROMLIST: input: synaptics_dsx: remove unused synaptics touch screen driver files\n\nRemove unused Synaptics DSX touch screen driver files as these\nare not used in any of the latest targets.\n\nBug: 68992479\nChange-Id: I0cc19825691c92fee1c5b71ff7e9e7a6253f6afe\nSigned-off-by: Shantanu Jain <shjain@codeaurora.org>\nSigned-off-by: Steve Pfetsch <spfetsch@google.com>\n(am from: https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=e83ebd2098009b0d336ffab11e00f739902bd5d9)","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/1a3c1bcabec2b5374914b2ca9d1a6569bb44bb0b"},{"sha":"246914e0202d1bcd1289bf4a191771d76402a55f","author":{"name":"Mohammed Javid","email":"8ac1ea830510c533b5e712c0a9734492c55fa2d3@codeaurora.org"},"message":"msm: ipa: Fix to use after free issue\n\nAdded to code changes to ref_cnt variable will decrement only\nwhen add_ref_hdr variable is true.\n\nBug: 68992478\nChange-Id: I0bcc3909669f4843c43135e5f047ac28fa62bb63\nAcked-by: Ashok Vuyyuru <avuyyuru@qti.qualcomm.com>\nSigned-off-by: Mohammed Javid <mjavid@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/246914e0202d1bcd1289bf4a191771d76402a55f"},{"sha":"063046052d7a5d311943564161a22b9ee6f35780","author":{"name":"Dennis Cagle","email":"1c958d084f7278f93cbdf16f75fd9d20fa6ac1af@codeaurora.org"},"message":"qcacld-2.0: Fix int overflow in wma_unified_link_radio_stats_event_handler\n\nCheck for the validity of the number of channels passed in the\nradio stats event received from firmware to ensure an integer\noverflow does not happen.\n\nChange-Id: Idf5738a40139aafad4de422965dc4ff3d0e53a32\nCRs-Fixed: 2149958\nBug: 68992439\nSigned-off-by: Dennis Cagle <d-cagle@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/063046052d7a5d311943564161a22b9ee6f35780"},{"sha":"a7fc3e1a0f5d31ccd5d0213248f194f2cb6e7261","author":{"name":"Paul Zhang","email":"2664aff767c6b6a85c51ca8df704fab394fd3860@codeaurora.org"},"message":"qcacld-2.0: Prevent buffer overflow\n\nIn function WLANQCMBR_McProcessMsg, variable data_len\nis from message, which should not be trusted. Buffer\noverflow will happen if using it directory to copy data\nto utf_buf.\n\nBug: 68992429\n\nChange-Id: I21479f510b95e6ced214f80d942db919837e8324\nCRs-Fixed: 2113052\nSigned-off-by: Ahmed ElArabawy <arabawy@google.com>","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/a7fc3e1a0f5d31ccd5d0213248f194f2cb6e7261"},{"sha":"7f216fba6d68e255ed4afcca0b44b0a641441b26","author":{"name":"Sridhar Selvaraj","email":"9ee4d8c2fef21b5ef7d54e3d52a213c4fd8ed081@codeaurora.org"},"message":"qcacld-2.0: Change local variables to dynamic in limProcessAuthFrame\n\nCurrently limProcessAuthFrame stack frame size exceeds 1024 and causes\nbuild failures for 32 bit platforms.\n\nMove multiple variables from local to dynamic allocation to reduce the\nframe size of limProcessAuthFrame.\n\nBug: 68992416\n\nChange-Id: I83cf5ab24693e0ce012894d808ac79bf37fa9a08\nCRs-Fixed: 2082544\nSigned-off-by: Ahmed ElArabawy <arabawy@google.com>","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/7f216fba6d68e255ed4afcca0b44b0a641441b26"},{"sha":"a4f67fd7a97695ab6085f1f2c95cf9b74a1c997f","author":{"name":"Srinivas Girigowda","email":"a31baf9905f545cc28ca3ed31e582f4e1f5462f1@codeaurora.org"},"message":"qcacld-2.0: Propagate key sequence counter to SME\n\npropagation from qcacld-3.0 to qcacld-2.0\n\nCurrently the key sequence counter received from userspace is not\npropagated to SME, so add logic to propagate it.\n\nChange-Id: I5371700003744eb967c578c44e4d130628efcdc8\nCRs-Fixed: 2133033\nBug: 69846132\nSigned-off-by: Srinivas Girigowda <sgirigow@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/a4f67fd7a97695ab6085f1f2c95cf9b74a1c997f"},{"sha":"fff552a2532eac72763a91169cc60f38c887cacd","author":{"name":"Srinivas Girigowda","email":"a31baf9905f545cc28ca3ed31e582f4e1f5462f1@codeaurora.org"},"message":"qcacld-2.0: Fix to propagate key-receiver-sequence-counter to WMA\n\npropagation from qcacld-3.0 to qcacld-2.0\n\nSME module propagates KeyRSC to MAC/PE module but MAC/PE doesn't\npass this counter to WMA and due to which WMA is not able pass to\nnext module.\n\nAdd a fix to propagate KeyRSC field from MAC to WMA module and further\ndown in stack.\n\nChange-Id: I157a44610e184b5e10d838fbc5d6b810e3efd6db\nCRs-Fixed: 2133114\nBug: 69846132\nSigned-off-by: Srinivas Girigowda <sgirigow@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/fff552a2532eac72763a91169cc60f38c887cacd"},{"sha":"00a5bc6061cf8c363a0066c46b2c260e27fa9d63","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"BACKPORT: ALSA: seq: Fix use-after-free at creating a port\n\nThere is a potential race window opened at creating and deleting a\nport via ioctl, as spotted by fuzzing.  snd_seq_create_port() creates\na port object and returns its pointer, but it doesn't take the\nrefcount, thus it can be deleted immediately by another thread.\nMeanwhile, snd_seq_ioctl_create_port() still calls the function\nsnd_seq_system_client_ev_port_start() with the created port object\nthat is being deleted, and this triggers use-after-free like:\n\n BUG: KASAN: use-after-free in snd_seq_ioctl_create_port+0x504/0x630 [snd_seq] at addr ffff8801f2241cb1\n =============================================================================\n BUG kmalloc-512 (Tainted: G    B          ): kasan: bad access detected\n -----------------------------------------------------------------------------\n INFO: Allocated in snd_seq_create_port+0x94/0x9b0 [snd_seq] age=1 cpu=3 pid=4511\n \t___slab_alloc+0x425/0x460\n \t__slab_alloc+0x20/0x40\n  \tkmem_cache_alloc_trace+0x150/0x190\n\tsnd_seq_create_port+0x94/0x9b0 [snd_seq]\n\tsnd_seq_ioctl_create_port+0xd1/0x630 [snd_seq]\n \tsnd_seq_do_ioctl+0x11c/0x190 [snd_seq]\n \tsnd_seq_ioctl+0x40/0x80 [snd_seq]\n \tdo_vfs_ioctl+0x54b/0xda0\n \tSyS_ioctl+0x79/0x90\n \tentry_SYSCALL_64_fastpath+0x16/0x75\n INFO: Freed in port_delete+0x136/0x1a0 [snd_seq] age=1 cpu=2 pid=4717\n \t__slab_free+0x204/0x310\n \tkfree+0x15f/0x180\n \tport_delete+0x136/0x1a0 [snd_seq]\n \tsnd_seq_delete_port+0x235/0x350 [snd_seq]\n \tsnd_seq_ioctl_delete_port+0xc8/0x180 [snd_seq]\n \tsnd_seq_do_ioctl+0x11c/0x190 [snd_seq]\n \tsnd_seq_ioctl+0x40/0x80 [snd_seq]\n \tdo_vfs_ioctl+0x54b/0xda0\n \tSyS_ioctl+0x79/0x90\n \tentry_SYSCALL_64_fastpath+0x16/0x75\n Call Trace:\n  [<ffffffff81b03781>] dump_stack+0x63/0x82\n  [<ffffffff81531b3b>] print_trailer+0xfb/0x160\n  [<ffffffff81536db4>] object_err+0x34/0x40\n  [<ffffffff815392d3>] kasan_report.part.2+0x223/0x520\n  [<ffffffffa07aadf4>] ? snd_seq_ioctl_create_port+0x504/0x630 [snd_seq]\n  [<ffffffff815395fe>] __asan_report_load1_noabort+0x2e/0x30\n  [<ffffffffa07aadf4>] snd_seq_ioctl_create_port+0x504/0x630 [snd_seq]\n  [<ffffffffa07aa8f0>] ? snd_seq_ioctl_delete_port+0x180/0x180 [snd_seq]\n  [<ffffffff8136be50>] ? taskstats_exit+0xbc0/0xbc0\n  [<ffffffffa07abc5c>] snd_seq_do_ioctl+0x11c/0x190 [snd_seq]\n  [<ffffffffa07abd10>] snd_seq_ioctl+0x40/0x80 [snd_seq]\n  [<ffffffff8136d433>] ? acct_account_cputime+0x63/0x80\n  [<ffffffff815b515b>] do_vfs_ioctl+0x54b/0xda0\n  .....\n\nWe may fix this in a few different ways, and in this patch, it's fixed\nsimply by taking the refcount properly at snd_seq_create_port() and\nletting the caller unref the object after use.  Also, there is another\npotential use-after-free by sprintf() call in snd_seq_create_port(),\nand this is moved inside the lock.\n\nThis fix covers CVE-2017-15265.\n\nReported-and-tested-by: Michael23 Yu <ycqzsy@gmail.com>\nSuggested-by: Linus Torvalds <torvalds@linux-foundation.org>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\n(cherry picked from commit 71105998845fb012937332fe2e806d443c09e026)\nSigned-off-by: Connor O'Brien <connoro@google.com>\nBug: 67900971\n\nChange-Id: Id29492065ff11927db7c0c1f50288f07a52e9823","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/00a5bc6061cf8c363a0066c46b2c260e27fa9d63"},{"sha":"9e27b06ddf3a2c620e20a7165a88e4cb8481529f","author":{"name":"Trishansh Bhardwaj","email":"e6f3043187f404ce783dec579af51dccff5a72a4@codeaurora.org"},"message":"msm: camera: Return -NOTTY on invalid ioctl command.\n\nCheck validity of command before processing.\n\nBug: 67713103\nChange-Id: Icc5c57eac999b7c40fbb9505b2b88745167adc66\nSigned-off-by: Trishansh Bhardwaj <tbhardwa@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/9e27b06ddf3a2c620e20a7165a88e4cb8481529f"},{"sha":"4d27be6faa9c2ff28395302c1119f3fe2419b14e","author":{"name":"Chenbo Feng","email":"41ff9ca698b527685d468e528334a344f4fd728b@google.com"},"message":"ANDROID: qtaguid: Fix the UAF probelm with tag_ref_tree\n\nWhen multiple threads is trying to tag/delete the same socket at the\nsame time, there is a chance the tag_ref_entry of the target socket to\nbe null before the uid_tag_data entry is freed. It is caused by the\nctrl_cmd_tag function where it doesn't correctly grab the spinlocks\nwhen tagging a socket.\n\nSigned-off-by: Chenbo Feng <fengc@google.com>\nBug: 65853158\nChange-Id: I5d89885918054cf835370a52bff2d693362ac5f0","distinct":false,"url":"https://api.github.com/repos/Yaznas/kernel_lge_bullhead/commits/4d27be6faa9c2ff28395302c1119f3fe2419b14e"}]}
{"actor":{"display_login":"Yaznas"}}