{"push_id":3120839742,"size":8,"distinct_size":8,"ref":"refs/heads/mko-mr1","head":"dfb9e57ba8bff9b2205102d442e9cd025f651182","before":"2e06d8693c537cec98815035e89a5690c47168e5","commits":[{"sha":"a85f1968d0821e5d2efd8ad7e70c9889eb68bee9","author":{"name":"Siqi Lin","email":"1edb82616217f5071421f5c5e0a5fa5e1ab2a1fe@google.com"},"message":"Merge branch 'android-msm-angler-3.10' into android-msm-angler-3.10-security-next\n\nMerging before December security patches.\n\nBug: 117289280\nChange-Id: I94499e16c740f728d6f6e9e5c401d62007479b33\nSigned-off-by: Siqi Lin <siqilin@google.com>","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/a85f1968d0821e5d2efd8ad7e70c9889eb68bee9"},{"sha":"a270de4b8b9e98ec14005b9ffbc5589490f14c1e","author":{"name":"Christoph Paasch","email":"76034b3b6d3b031435cc9968b738d3b7190d594f@apple.com"},"message":"net: Set sk_prot_creator when cloning sockets to the right proto\n\ncommit 9d538fa60bad4f7b23193c89e843797a1cf71ef3 upstream.\n\nsk->sk_prot and sk->sk_prot_creator can differ when the app uses\nIPV6_ADDRFORM (transforming an IPv6-socket to an IPv4-one).\nWhich is why sk_prot_creator is there to make sure that sk_prot_free()\ndoes the kmem_cache_free() on the right kmem_cache slab.\n\nNow, if such a socket gets transformed back to a listening socket (using\nconnect() with AF_UNSPEC) we will allocate an IPv4 tcp_sock through\nsk_clone_lock() when a new connection comes in. But sk_prot_creator will\nstill point to the IPv6 kmem_cache (as everything got copied in\nsk_clone_lock()). When freeing, we will thus put this\nmemory back into the IPv6 kmem_cache although it was allocated in the\nIPv4 cache. I have seen memory corruption happening because of this.\n\nWith slub-debugging and MEMCG_KMEM enabled this gives the warning\n\t\"cache_from_obj: Wrong slab cache. TCPv6 but object is from TCP\"\n\nA C-program to trigger this:\n\nvoid main(void)\n{\n        int fd = socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP);\n        int new_fd, newest_fd, client_fd;\n        struct sockaddr_in6 bind_addr;\n        struct sockaddr_in bind_addr4, client_addr1, client_addr2;\n        struct sockaddr unsp;\n        int val;\n\n        memset(&bind_addr, 0, sizeof(bind_addr));\n        bind_addr.sin6_family = AF_INET6;\n        bind_addr.sin6_port = ntohs(42424);\n\n        memset(&client_addr1, 0, sizeof(client_addr1));\n        client_addr1.sin_family = AF_INET;\n        client_addr1.sin_port = ntohs(42424);\n        client_addr1.sin_addr.s_addr = inet_addr(\"127.0.0.1\");\n\n        memset(&client_addr2, 0, sizeof(client_addr2));\n        client_addr2.sin_family = AF_INET;\n        client_addr2.sin_port = ntohs(42421);\n        client_addr2.sin_addr.s_addr = inet_addr(\"127.0.0.1\");\n\n        memset(&unsp, 0, sizeof(unsp));\n        unsp.sa_family = AF_UNSPEC;\n\n        bind(fd, (struct sockaddr *)&bind_addr, sizeof(bind_addr));\n\n        listen(fd, 5);\n\n        client_fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);\n        connect(client_fd, (struct sockaddr *)&client_addr1, sizeof(client_addr1));\n        new_fd = accept(fd, NULL, NULL);\n        close(fd);\n\n        val = AF_INET;\n        setsockopt(new_fd, SOL_IPV6, IPV6_ADDRFORM, &val, sizeof(val));\n\n        connect(new_fd, &unsp, sizeof(unsp));\n\n        memset(&bind_addr4, 0, sizeof(bind_addr4));\n        bind_addr4.sin_family = AF_INET;\n        bind_addr4.sin_port = ntohs(42421);\n        bind(new_fd, (struct sockaddr *)&bind_addr4, sizeof(bind_addr4));\n\n        listen(new_fd, 5);\n\n        client_fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);\n        connect(client_fd, (struct sockaddr *)&client_addr2, sizeof(client_addr2));\n\n        newest_fd = accept(new_fd, NULL, NULL);\n        close(new_fd);\n\n        close(client_fd);\n        close(new_fd);\n}\n\nAs far as I can see, this bug has been there since the beginning of the\ngit-days.\n\nBug: 113509306\nSigned-off-by: Christoph Paasch <cpaasch@apple.com>\nReviewed-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Willy Tarreau <w@1wt.eu>\nChange-Id: I98ef334a09ed3a75a6cc61bf94b5e06f5a13b63f","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/a270de4b8b9e98ec14005b9ffbc5589490f14c1e"},{"sha":"da2dec03cb0de2abeaa93cf5375039e00d8c63fa","author":{"name":"Trishansh Bhardwaj","email":"c326d03a3f9e0c30bd158941754b7fb22360f036@codeaurora.org"},"message":"msm: camera: Fix out-of-bounds read in string class name.\n\njpeg driver is calling class_create with stack variable, which\ncan be overwritten by other stack variables.\n\nBug: 114041685\nChange-Id: I3c22a5b3375b970ff6b1c6de983dd5833f4e11d0\nSigned-off-by: Trishansh Bhardwaj <tbhardwa@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/da2dec03cb0de2abeaa93cf5375039e00d8c63fa"},{"sha":"78fa0bd3ccb145c2986cefab10fd830427026fcc","author":{"name":"Siva Kumar Akkireddi","email":"2909cdf90d15e9d9c9881e06371b7391d429cdfa@codeaurora.org"},"message":"msm: sps: Suppress bind/unbind attributes\n\nSPS driver does not support manual bind/unbind operations\nthrough sysfs. Suppress the bind/unbind nodes. Do not free\nSPS struct in sps_device_de_init since it is being done in\nsps_exit, and also to avoid use-after-free.\n\nBug: 114042002\nChange-Id: If6da6c5fb9d1a44d0420c6151f7f9d0a33cb2d04\nSigned-off-by: Siva Kumar Akkireddi <sivaa@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/78fa0bd3ccb145c2986cefab10fd830427026fcc"},{"sha":"309d642245e2d4071cdd68a8213d06533b4c4fa5","author":{"name":"Siqi Lin","email":"1edb82616217f5071421f5c5e0a5fa5e1ab2a1fe@google.com"},"message":"Merge branch 'android-msm-angler-3.10-security-next' into android-msm-angler-3.10\n\nDecember 2018.1\n\nBug: 117289280\nChange-Id: I43558e273e8190cf0b5008cad6f30ad9c0fab19f\nSigned-off-by: Siqi Lin <siqilin@google.com>","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/309d642245e2d4071cdd68a8213d06533b4c4fa5"},{"sha":"75b92131a7aca41eb05407ef76de80b2caf0e3c7","author":{"name":"razorloves","email":"a0cae2157a932d956bb09c9f5eba03562b2464e9@gmail.com"},"message":"Merge aosp tag 'android-8.1.0_r0.111' into lineage-15.1\n\nOctober 2018 OPM7.181005.003\n\n  0e533ed ANDROID: sdcardfs: Don't use OVERRIDE_CRED macro\n  f95b613 ANDROID: sdcardfs: Change current->fs under lock\n\nChange-Id: I6dc7de875b65205ca1b3331c2e4d54435faf8824","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/75b92131a7aca41eb05407ef76de80b2caf0e3c7"},{"sha":"e8c57cdbe230b5afe8b444a0258864091c0335d1","author":{"name":"razorloves","email":"a0cae2157a932d956bb09c9f5eba03562b2464e9@gmail.com"},"message":"Merge aosp tag 'android-8.1.0_r0.121' into lineage-15.1\n\nDecember 2018 OPM7.181205.001\n\n  78fa0bd msm: sps: Suppress bind/unbind attributes\n  da2dec0 msm: camera: Fix out-of-bounds read in string class name.\n  a270de4 net: Set sk_prot_creator when cloning sockets to the right proto\n\nChange-Id: I2d9e4372294705896d27b517af2a7d63c4d20863","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/e8c57cdbe230b5afe8b444a0258864091c0335d1"},{"sha":"dfb9e57ba8bff9b2205102d442e9cd025f651182","author":{"name":"martincz","email":"239d0dcf4c4fca4a9859e3f56c56755f6b1aec1c@mokeedev.com"},"message":"angler: Rebrand to MoKee\n\nChange-Id: I2143085635bd0a199cb4ba8578d0d27c0f8e3e79","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/dfb9e57ba8bff9b2205102d442e9cd025f651182"}]}
{"actor":{"display_login":"mokeeopensource"}}