This repository was archived by the owner on Nov 5, 2019. It is now read-only.

Many security patches#1

Closed

SkewedZeppelin wants to merge 131 commits intoGrapheneOS-Archive:10from

SkewedZeppelin:10

Commits on Oct 4, 2019

floppy: fix div-by-zero in setup_format_params

evdenis
authored and
SkewedZeppelin
committed
floppy: fix out-of-bounds read in copy_buffer

evdenis
authored and
SkewedZeppelin
committed
gather extra early boot entropy like PaX

thestinger
authored and
SkewedZeppelin
committed
use kernel command-line for early entropy

thestinger
authored and
SkewedZeppelin
committed
port of grsecurity's DEVICE_SIDECHANNEL feature

thestinger
authored and
SkewedZeppelin
committed
disable ptrace_scope by default

thestinger
authored and
SkewedZeppelin
committed
arm64: zero the leading stack canary byte

thestinger
authored and
SkewedZeppelin
committed
add page sanitization / verification

thestinger
authored and
SkewedZeppelin
committed
add slub sanitization

thestinger
authored and
SkewedZeppelin
committed
slub: add check for write-after-free

thestinger
authored and
SkewedZeppelin
committed
add slub free list XOR encryption

thestinger
authored and
SkewedZeppelin
committed
slub: add multi-purpose random cookies

thestinger
authored and
SkewedZeppelin
committed
slub: check cookies in __check_heap_object

thestinger
authored and
SkewedZeppelin
committed
add missing cache_from_obj !PageSlab check

thestinger
authored and
SkewedZeppelin
committed
real slab_equal_or_root check for !MEMCG_KMEM

thestinger
authored and
SkewedZeppelin
committed
always perform cache_from_obj sanity checks

thestinger
authored and
SkewedZeppelin
committed
panic on kmem_cache_free with the wrong cache

thestinger
authored and
SkewedZeppelin
committed
panic on !PageSlab && !PageCompound in ksize

thestinger
authored and
SkewedZeppelin
committed
add kmalloc alloc_size attributes

thestinger
authored and
SkewedZeppelin
committed
add vmalloc alloc_size attributes

thestinger
authored and
SkewedZeppelin
committed
arm64: properly account for stack rnd in mmap base

thestinger
authored and
SkewedZeppelin
committed
arm64: determine stack entropy based on mmap entropy

thestinger
authored and
SkewedZeppelin
committed
arm64: move ET_DYN base lower in the address space

thestinger
authored and
SkewedZeppelin
committed
randomize lower bits of the argument block

thestinger
authored and
SkewedZeppelin
committed
fix qcacld-2.0 buffer overflows

thestinger
authored and
SkewedZeppelin
committed
disable brk system call

thestinger
authored and
SkewedZeppelin
committed
enable protected_{symlinks,hardlinks} by default

thestinger
authored and
SkewedZeppelin
committed
wcnss: fix 3 byte buffer overflow on MAC change

thestinger
authored and
SkewedZeppelin
committed
arm64: crypto: increase AES interleave to 4x

Ard Biesheuvel
authored and
SkewedZeppelin
committed
arm64/crypto: issue aese/aesmc instructions in pairs

Ard Biesheuvel
authored and
SkewedZeppelin
committed
arm64: crypto: reduce priority of core AES cipher

Ard Biesheuvel
authored and
SkewedZeppelin
committed
net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()

Avijit Kanti Das
authored and
SkewedZeppelin
committed
cuse: fix memory leak

szmi
authored and
SkewedZeppelin
committed
net: llc: use correct size for sysctl timeout entries

sashalevin
authored and
SkewedZeppelin
committed
net: rds: use correct size for max unacked packets and bytes

sashalevin
authored and
SkewedZeppelin
committed
USB: whiteheat: fix potential null-deref at probe

jhovold
authored and
SkewedZeppelin
committed
Input: aiptek - fix crash on detecting device without endpoints

nefigtut
authored and
SkewedZeppelin
committed
USB: serial: visor: fix crash on detecting device without write_urbs

nefigtut
authored and
SkewedZeppelin
committed
kexec/uefi: copy secure_boot flag in boot params across kexec reboot

daveyoung
authored and
SkewedZeppelin
committed
media/vivid-osd: fix info leak in ioctl

Salva Peiró
authored and
SkewedZeppelin
committed
staging/dgnc: fix info leak in ioctl

Salva Peiró
authored and
SkewedZeppelin
committed
KVM: svm: unconditionally intercept #DB

bonzini
authored and
SkewedZeppelin
committed
powerpc/tm: Block signal return setting invalid MSR state

mikey
authored and
SkewedZeppelin
committed
powerpc/tm: Check for already reclaimed tasks

mikey
authored and
SkewedZeppelin
committed
ovl: fix dentry reference leak

dhowells
authored and
SkewedZeppelin
committed
x86/mm: Add barriers and document switch_mm()-vs-flush synchronization

amluto
authored and
SkewedZeppelin
committed
ALSA: hrtimer: Fix stall by hrtimer_cancel()

tiwai
authored and
SkewedZeppelin
committed
USB: visor: fix null-deref at probe

jhovold
authored and
SkewedZeppelin
committed
x86/mm/32: Enable full randomization on i386 and X86_32

Hector Marco-Gisbert
authored and
SkewedZeppelin
committed
arm: oabi compat: add missing access checks

Dave Weinstein
authored and
SkewedZeppelin
committed
msm-core: debug: Update the number of supported pstates.

Archana Sathyakumar
authored and
SkewedZeppelin
committed
rds: fix an infoleak in rds_inc_info_copy

kengiter
authored and
SkewedZeppelin
committed
radio-iris: check argument values before copying the data

Kamal Negi
authored and
SkewedZeppelin
committed
spcom: check size before calling copy_to_user()

Amir Samuelov
authored and
SkewedZeppelin
committed
spcom: check buf_size validity for user send command

Amir Samuelov
authored and
SkewedZeppelin
committed
spcom: check buf size for send modified command

Amir Samuelov
authored and
SkewedZeppelin
committed
ASoC: wcd9320: Fix out of bounds for mad input value

Karthikeyan Mani
authored and
SkewedZeppelin
committed
ASoC: msm: qdsp6v2: DAP: Add check to validate param length

Sharad Sangle
authored and
SkewedZeppelin
committed
net: ipc_router: fix NULL pointer de-reference issue

Arun Kumar Neelakantam
authored and
SkewedZeppelin
committed
s390/sclp_ctl: fix potential information leak with /dev/sclp

Martin Schwidefsky
authored and
SkewedZeppelin
committed
apparmor: fix oops, validate buffer size in apparmor_setprocattr()

vegard
authored and
SkewedZeppelin
committed
input: synaptics: allocate heap memory for buffer

m-chong
authored and
SkewedZeppelin
committed
ASoC: msm: qdsp6v2: DAP: Add check to validate data length

ashishrjain
authored and
SkewedZeppelin
committed
ASoC: msm: qdsp6v2: DAP: Allocate param buffer with correct size

ashishrjain
authored and
SkewedZeppelin
committed
ASoC: msm: qdsp6v2: DAP: Add check to validate param length

ashishrjain
authored and
SkewedZeppelin
committed
ASoC: msm: qdsp6v2: DAP: Update check to validate data length

ashishrjain
authored and
SkewedZeppelin
committed
msm-core: use get_user() API to read userspace data/settings

Mohammed Khajapasha
authored and
SkewedZeppelin
committed
crypto: algif_hash - Only export and import on sockets with data

herbertx
authored and
SkewedZeppelin
committed
sysctl: Drop reference added by grab_header in proc_sys_readdir

zhouchengming1
authored and
SkewedZeppelin
committed
USB: gadgetfs: fix unbounded memory allocation bug

AlanStern
authored and
SkewedZeppelin
committed
USB: dummy-hcd: fix bug in stop_activity (handle ep0)

AlanStern
authored and
SkewedZeppelin
committed
USB: gadgetfs: fix checks of wTotalLength in config descriptors

AlanStern
authored and
SkewedZeppelin
committed
USB: gadgetfs: fix use-after-free bug

AlanStern
authored and
SkewedZeppelin
committed
FROMLIST: CHROMIUM: usb: gadget: configfs: Fix KASAN use-after-free

Jim Lin
authored and
SkewedZeppelin
committed
ASoC: msm: qdsp6v2: return error when copy from userspace fails

Siena Richard
authored and
SkewedZeppelin
committed
input: touchscreen: gt9xx: fix memory corruption in Goodix driver

Vevek Venkatesan
authored and
SkewedZeppelin
committed
Prevent heap overflow in uvc driver

Robb Glasser
authored and
SkewedZeppelin
committed
BACKPORT: f2fs: sanity check log_blocks_per_seg

Jin Qian
authored and
SkewedZeppelin
committed
KVM: Don't accept obviously wrong gsi values via KVM_IRQFD

schnhrr
authored and
SkewedZeppelin
committed
binfmt_elf: use ELF_ET_DYN_BASE only for PIE

kees
authored and
SkewedZeppelin
committed
msm: gsi: fix memory corruption from debugfs

Skylar Chang
authored and
SkewedZeppelin
committed
wil6210: protect against invalid length of tx management frame

Hamad Kadmany
authored and
SkewedZeppelin
committed
msm: camera: sensor: Validate destination step position

Rajesh Bondugula
authored and
SkewedZeppelin
committed
Bluetooth: hidp_connection_add() unsafe use of l2cap_pi()

Al Viro
authored and
SkewedZeppelin
committed
msm: mdss: check the length of the external input buffer properly

Ashish Garg
authored and
SkewedZeppelin
committed
USB: fix problems with duplicate endpoint addresses

AlanStern
authored and
SkewedZeppelin
committed
ALSA: usx2y: Fix invalid stream URBs

tiwai
authored and
SkewedZeppelin
committed
ALSA: bcd2000: Add a sanity check for invalid EPs

tiwai
authored and
SkewedZeppelin
committed
input: touchscreen: fix buffer overflow issue in synaptics driver

Shantanu Jain
authored and
SkewedZeppelin
committed
msm: mdss: Add check to fix null pointer dereference

Krishna Manikandan
authored and
SkewedZeppelin
committed
ASoC: qdsp6v2: prevent null pointer dereference for _vol_cmds

Xiaojun Sang
authored and
SkewedZeppelin
committed
ipc/shm: Fix shmat mmap nil-page protection

Davidlohr Bueso
authored and
SkewedZeppelin
committed
tcp: remove BUG_ON() in tcp_check_req()

edumazet
authored and
SkewedZeppelin
committed
irda: Fix lockdep annotations in hashbin_delete().

davem330
authored and
SkewedZeppelin
committed
bluetooth: Fix free data pointer routine

Sungjun Park
authored and
SkewedZeppelin
committed
msm: ba: Fix race conditions in debug writes

Rahul Sharma
authored and
SkewedZeppelin
committed
iommu: iommu-debug: cleanup iommu debug

Liam Mark
authored and
SkewedZeppelin
committed
xfs: don't call xfs_da_shrink_inode with NULL bp

sandeen
authored and
SkewedZeppelin
committed
x86/paravirt: Fix spectre-v2 mitigations for paravirt guests

Peter Zijlstra
authored and
SkewedZeppelin
committed
xfs: don't fail when converting shortform attr to long form during ATTR_REPLACE

djwong
authored and
SkewedZeppelin
committed
scsi: libsas: fix a race condition when smp task timeout

JasonYanHw
authored and
SkewedZeppelin
committed
net: phy: mdio-bcm-unimac: fix potential NULL dereference in unimac_mdio_probe()

Wei Yongjun
authored and
SkewedZeppelin
committed
drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl

Dan Carpenter
authored and
SkewedZeppelin
committed
inet: update the IP ID generation algorithm to higher standards.

aksecurity
authored and
SkewedZeppelin
committed
tty: mark Siemens R3964 line discipline as BROKEN

gregkh
authored and
SkewedZeppelin
committed
ext4: zero out the unused memory region in the extent tree block

rsriramr
authored and
SkewedZeppelin
committed
Bluetooth: hidp: fix buffer overflow

Yoha-test
authored and
SkewedZeppelin
committed
ipv6_sockglue: Fix a missing-check bug in ip6_ra_control()

zhanggenex
authored and
SkewedZeppelin
committed
scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main()

zhanggenex
authored and
SkewedZeppelin
committed
powerpc/pseries/dlpar: Fix a missing check in dlpar_parse_cc_property()

zhanggenex
authored and
SkewedZeppelin
committed
Fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe

benquike
authored and
SkewedZeppelin
committed
USB: rio500: refuse more than one device at a time

oneukum
authored and
SkewedZeppelin
committed
media: dvb: usb: fix use after free in dvb_usb_device_exit

oneukum
authored and
SkewedZeppelin
committed
ALSA: core: Fix card races between register and disconnect

tiwai
authored and
SkewedZeppelin
committed
USB: yurex: Fix protection fault after device removal

AlanStern
authored and
SkewedZeppelin
committed
xfrm: policy: Fix out-of-bound array accesses in __xfrm_policy_unlink

YueHaibing
authored and
SkewedZeppelin
committed
scsi: libsas: delete sas port if expander discover failed

JasonYanHw
authored and
SkewedZeppelin
committed
ath6kl: add some bounds checking

Dan Carpenter
authored and
SkewedZeppelin
committed
ax25: enforce CAP_NET_RAW for raw sockets

Armondile
authored and
SkewedZeppelin
committed
UPSTREAM: ANDROID: binder: remove waitqueue when thread exits.

Martijn Coenen
authored and
SkewedZeppelin
committed
msm: camera: Synchronize camera open/close calls.

Trishansh Bhardwaj
authored and
SkewedZeppelin
committed
Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer

holtmann
authored and
SkewedZeppelin
committed
Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt

holtmann
authored and
SkewedZeppelin
committed
net: crypto set sk to NULL when af_alg_release.

Mao Wenan
authored and
SkewedZeppelin
committed
ozwpan: Use unsigned ints to prevent heap overflow

zx2c4
authored and
SkewedZeppelin
committed
tcp: fix zero cwnd in tcp_cwnd_reduction

yuchungcheng
authored and
SkewedZeppelin
committed
ASoC: msm: qdsp6v2: DAP: Add check to validate param length

kunleiz
authored and
SkewedZeppelin
committed
ASoC: msm: qdsp6v2: DAP: Add check to validate data length

ashishrjain
authored and
SkewedZeppelin
committed
ASoC: msm: qdsp6v2: DAP: Update check to validate data length

ashishrjain
authored and
SkewedZeppelin
committed
ASoC: msm: qdsp6v2: return error when copy from userspace fails

Siena Richard
authored and
SkewedZeppelin
committed
BACKPORT: f2fs: sanity check log_blocks_per_seg

Jin Qian
authored and
SkewedZeppelin
committed

Many security patches#1SkewedZeppelin wants to merge 131 commits intoGrapheneOS-Archive:10GrapheneOS-Archive/kernel_google_marlin:10from SkewedZeppelin:10Copy head branch name to clipboard

Commits

Commits on Oct 4, 2019

Many security patches#1
SkewedZeppelin wants to merge 131 commits intoGrapheneOS-Archive:10from
SkewedZeppelin:10