{"push_id":2833641600,"size":3,"distinct_size":3,"ref":"refs/heads/lineage-15.1","head":"d512eb2847e6333de868a6b4b6f13df7d3a8b86e","before":"d0a4eb3ac97aaf924b432bc9b54f9b306efdc2a4","commits":[{"sha":"1fa279c1ff159dd56bf6953579081a1856c62c6b","author":{"name":"Todd Kjos","email":"8be399b0cc2f31b2ed16702a88343f61fd6797ee@google.com"},"message":"FROMLIST: binder: fix proc->files use-after-free\n\n(from https://patchwork.kernel.org/patch/10058587/)\n\nproc->files cleanup is initiated by binder_vma_close. Therefore\na reference on the binder_proc is not enough to prevent the\nfiles_struct from being released while the binder_proc still has\na reference. This can lead to an attempt to dereference the\nstale pointer obtained from proc->files prior to proc->files\ncleanup. This has been seen once in task_get_unused_fd_flags()\nwhen __alloc_fd() is called with a stale \"files\".\n\nThe fix is to always use get_files_struct() to obtain struct_files\nso that the refcount on the files_struct is used to prevent\na premature free. proc->files is removed since we get it every\ntime.\n\nBug: 69164715\nChange-Id: I6431027d3d569e76913935c21885201505627982\nSigned-off-by: Todd Kjos <tkjos@google.com>","distinct":true,"url":"https://api.github.com/repos/lin15-microG/android_kernel_oneplus_msm8996/commits/1fa279c1ff159dd56bf6953579081a1856c62c6b"},{"sha":"949c2be53b80c82b7ad3461052596ed413e44559","author":{"name":"Florian Westphal","email":"cef439e78636cdab99cd2923826c5065a0743e5b@strlen.de"},"message":"netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets\n\ncommit b71812168571fa55e44cdd0254471331b9c4c4c6 upstream.\n\nWe need to make sure the offsets are not out of range of the\ntotal size.\nAlso check that they are in ascending order.\n\nThe WARN_ON triggered by syzkaller (it sets panic_on_warn) is\nchanged to also bail out, no point in continuing parsing.\n\nBriefly tested with simple ruleset of\n-A INPUT --limit 1/s' --log\nplus jump to custom chains using 32bit ebtables binary.\n\nReported-by: <syzbot+845a53d13171abf8bf29@syzkaller.appspotmail.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/lin15-microG/android_kernel_oneplus_msm8996/commits/949c2be53b80c82b7ad3461052596ed413e44559"},{"sha":"d512eb2847e6333de868a6b4b6f13df7d3a8b86e","author":{"name":"dianlujitao","email":"426a063be0e36cd758b6e57f81d0d38f9087ed32@lineageos.org"},"message":"Merge tag 'ASB-2018-08-05_3.18-o-mr1' of https://android.googlesource.com/kernel/common into HEAD\n\nhttps://source.android.com/security/bulletin/2018-08-01\nCVE-2017-18249*\nCVE-2018-9465\nCVE-2018-9439\nCVE-2018-1068\n\n* currently no 4.4 backports exist for CVE-2017-18249 on android-4.4\n  release branches. This affects only devices using f2fs running\n  4.4 kernels.\n\nChange-Id: I1bc8fb5bbec2d16a8c1e855cb7d8b41ae763a2df","distinct":true,"url":"https://api.github.com/repos/lin15-microG/android_kernel_oneplus_msm8996/commits/d512eb2847e6333de868a6b4b6f13df7d3a8b86e"}]}
{"actor":{"display_login":"MSe1969"}}