payload: {"push_id":3290269788,"size":6,"distinct_size":6,"ref":"refs/heads/pie","head":"19f11975441a00c30af04cf25922aeeaa804e3e2","before":"a60e45983df3015d6c1fbe1356eaf6fd02624378","commits":[{"sha":"5051ea7a65a0c5680b9d6e48f38d61a6a11a8923","author":{"name":"Alberto97","email":"64b2707298a0a8afed6e8730ee5b9a40007a9ed9@gmail.com"},"message":"Backport \"update supported page-orders for ion pool\"\n\nCONFIG_IOMMU_IO_PGTABLE_ARMV7S has been introduced in 4.9.\nReplace it with CONFIG_ARM on previous releases.","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/5051ea7a65a0c5680b9d6e48f38d61a6a11a8923"},{"sha":"f6e2ebc09d63e1bb514458cd30a54f262fcea967","author":{"name":"Linus Torvalds","email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org"},"message":"Make file credentials available to the seqfile interfaces\n\ncommit 34dbbcdbf63360661ff7bda6c5f52f99ac515f92 upstream.\n\nA lot of seqfile users seem to be using things like %pK that uses the\ncredentials of the current process, but that is actually completely\nwrong for filesystem interfaces.\n\nThe unix semantics for permission checking files is to check permissions\nat _open_ time, not at read or write time, and that is not just a small\ndetail: passing off stdin/stdout/stderr to a suid application and making\nthe actual IO happen in privileged context is a classic exploit\ntechnique.\n\nSo if we want to be able to look at permissions at read time, we need to\nuse the file open credentials, not the current ones.  Normal file\naccesses can just use \"f_cred\" (or any of the helper functions that do\nthat, like file_ns_capable()), but the seqfile interfaces do not have\nany such options.\n\nIt turns out that seq_file _does_ save away the user_ns information of\nthe file, though.  Since user_ns is just part of the full credential\ninformation, replace that special case with saving off the cred pointer\ninstead, and suddenly seq_file has all the permission information it\nneeds.\n\nBug: 117422211\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Jann Horn <jannh@google.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nChange-Id: I7a8b7463ceb4ba4408f9dd2bd625de2638aad2ba","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/f6e2ebc09d63e1bb514458cd30a54f262fcea967"},{"sha":"d207a00726e6c71fc23aef8231f9ba3b23cf73ea","author":{"name":"Linus Torvalds","email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org"},"message":"/proc/iomem: only expose physical resource addresses to privileged users\n\ncommit 51d7b120418e99d6b3bf8df9eb3cc31e8171dee4 upstream.\n\nIn commit c4004b02f8e5b (\"x86: remove the kernel code/data/bss resources\nfrom /proc/iomem\") I was hoping to remove the phyiscal kernel address\ndata from /proc/iomem entirely, but that had to be reverted because some\nsystem programs actually use it.\n\nThis limits all the detailed resource information to properly\ncredentialed users instead.\n\nBug: 117422211\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Mark Salyzyn <salyzyn@android.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nChange-Id: Ia829ad3659bd36b959ee5f446dca53c5aa4d5654","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/d207a00726e6c71fc23aef8231f9ba3b23cf73ea"},{"sha":"26571d555f33700ad6f46669dd295a6750ca4119","author":{"name":"Theodore Ts'o","email":"4ed386e0495d3e109932df055831d9ec2f824927@mit.edu"},"message":"ext4: always verify the magic number in xattr blocks\n\ncommit 513f86d73855ce556ea9522b6bfd79f87356dc3a upstream.\n\nIf there an inode points to a block which is also some other type of\nmetadata block (such as a block allocation bitmap), the\nbuffer_verified flag can be set when it was validated as that other\nmetadata block type; however, it would make a really terrible external\nattribute block.  The reason why we use the verified flag is to avoid\nconstantly reverifying the block.  However, it doesn't take much\noverhead to make sure the magic number of the xattr block is correct,\nand this will avoid potential crashes.\n\nThis addresses CVE-2018-10879.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=200001\n\nBug: 116406063\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nReviewed-by: Andreas Dilger <adilger@dilger.ca>\nCc: stable@kernel.org\n[ghackmann@google.com: 3.18 backport: adjust context]\nSigned-off-by: Greg Hackmann <ghackmann@google.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nChange-Id: I29aca13d06b69577c2f83e8cc68c21e6fbbaac07","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/26571d555f33700ad6f46669dd295a6750ca4119"},{"sha":"335b378060a05b578662dc5b660075394a27f6a7","author":{"name":"Theodore Ts'o","email":"4ed386e0495d3e109932df055831d9ec2f824927@mit.edu"},"message":"ext4: add corruption check in ext4_xattr_set_entry()\n\ncommit 5369a762c882c0b6e9599e4ebbb3a9ba9eee7e2d upstream.\n\nIn theory this should have been caught earlier when the xattr list was\nverified, but in case it got missed, it's simple enough to add check\nto make sure we don't overrun the xattr buffer.\n\nThis addresses CVE-2018-10879.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=200001\n\nBug: 116406063\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nReviewed-by: Andreas Dilger <adilger@dilger.ca>\n[bwh: Backported to 3.16:\n - Add inode parameter to ext4_xattr_set_entry() and update callers\n - Return -EIO instead of -EFSCORRUPTED on error\n - Adjust context]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: Greg Hackmann <ghackmann@google.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nChange-Id: Ibeab9d3ac724e3af7f9c8bcbce14aba7ec3782d1","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/335b378060a05b578662dc5b660075394a27f6a7"},{"sha":"19f11975441a00c30af04cf25922aeeaa804e3e2","author":{"name":"Todd Kjos","email":"8be399b0cc2f31b2ed16702a88343f61fd6797ee@google.com"},"message":"binder: fix race between munmap() and direct reclaim\n\nAn munmap() on a binder device causes binder_vma_close() to be called\nwhich clears the alloc->vma pointer.\n\nIf direct reclaim causes binder_alloc_free_page() to be called, there\nis a race where alloc->vma is read into a local vma pointer and then\nused later after the mm->mmap_sem is acquired. This can result in\ncalling zap_page_range() with an invalid vma which manifests as a\nuse-after-free in zap_page_range().\n\nThe fix is to check alloc->vma after acquiring the mmap_sem (which we\nwere acquiring anyway) and bail out of binder_alloc_free_page() if it\nhas changed to NULL.\n\nBug: 120025196\nChange-Id: I9ea0558a57635a747d7a48ed35991d39b860abf6\nSigned-off-by: Todd Kjos <tkjos@google.com>","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/19f11975441a00c30af04cf25922aeeaa804e3e2"}]}
other: {"actor":{"display_login":"Alberto97"}}