)]}'
{
  "log": [
    {
      "commit": "7ed47b7d142ec99ad6880bbbec51e9f12b3af74c",
      "tree": "0126b7ab0756dee49d6170f1db6accff5c26b793",
      "parents": [
        "d93dc5c4478c1fd5de85a3e8aece9aad7bbae044"
      ],
      "author": {
        "name": "Nick Bowler",
        "email": "nbowler@elliptictech.com",
        "time": "Thu Oct 20 14:16:55 2011 +0200"
      },
      "committer": {
        "name": "Herbert Xu",
        "email": "herbert@gondor.apana.org.au",
        "time": "Fri Oct 21 13:18:42 2011 +0200"
      },
      "message": "crypto: ghash - Avoid null pointer dereference if no key is set\n\nThe ghash_update function passes a pointer to gf128mul_4k_lle which will\nbe NULL if ghash_setkey is not called or if the most recent call to\nghash_setkey failed to allocate memory.  This causes an oops.  Fix this\nup by returning an error code in the null case.\n\nThis is trivially triggered from unprivileged userspace through the\nAF_ALG interface by simply writing to the socket without setting a key.\n\nThe ghash_final function has a similar issue, but triggering it requires\na memory allocation failure in ghash_setkey _after_ at least one\nsuccessful call to ghash_update.\n\n  BUG: unable to handle kernel NULL pointer dereference at 00000670\n  IP: [\u003cd88c92d4\u003e] gf128mul_4k_lle+0x23/0x60 [gf128mul]\n  *pde \u003d 00000000\n  Oops: 0000 [#1] PREEMPT SMP\n  Modules linked in: ghash_generic gf128mul algif_hash af_alg nfs lockd nfs_acl sunrpc bridge ipv6 stp llc\n\n  Pid: 1502, comm: hashatron Tainted: G        W   3.1.0-rc9-00085-ge9308cf #32 Bochs Bochs\n  EIP: 0060:[\u003cd88c92d4\u003e] EFLAGS: 00000202 CPU: 0\n  EIP is at gf128mul_4k_lle+0x23/0x60 [gf128mul]\n  EAX: d69db1f0 EBX: d6b8ddac ECX: 00000004 EDX: 00000000\n  ESI: 00000670 EDI: d6b8ddac EBP: d6b8ddc8 ESP: d6b8dda4\n   DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068\n  Process hashatron (pid: 1502, ti\u003dd6b8c000 task\u003dd6810000 task.ti\u003dd6b8c000)\n  Stack:\n   00000000 d69db1f0 00000163 00000000 d6b8ddc8 c101a520 d69db1f0 d52aa000\n   00000ff0 d6b8dde8 d88d310f d6b8a3f8 d52aa000 00001000 d88d502c d6b8ddfc\n   00001000 d6b8ddf4 c11676ed d69db1e8 d6b8de24 c11679ad d52aa000 00000000\n  Call Trace:\n   [\u003cc101a520\u003e] ? kmap_atomic_prot+0x37/0xa6\n   [\u003cd88d310f\u003e] ghash_update+0x85/0xbe [ghash_generic]\n   [\u003cc11676ed\u003e] crypto_shash_update+0x18/0x1b\n   [\u003cc11679ad\u003e] shash_ahash_update+0x22/0x36\n   [\u003cc11679cc\u003e] shash_async_update+0xb/0xd\n   [\u003cd88ce0ba\u003e] hash_sendpage+0xba/0xf2 [algif_hash]\n   [\u003cc121b24c\u003e] kernel_sendpage+0x39/0x4e\n   [\u003cd88ce000\u003e] ? 0xd88cdfff\n   [\u003cc121b298\u003e] sock_sendpage+0x37/0x3e\n   [\u003cc121b261\u003e] ? kernel_sendpage+0x4e/0x4e\n   [\u003cc10b4dbc\u003e] pipe_to_sendpage+0x56/0x61\n   [\u003cc10b4e1f\u003e] splice_from_pipe_feed+0x58/0xcd\n   [\u003cc10b4d66\u003e] ? splice_from_pipe_begin+0x10/0x10\n   [\u003cc10b51f5\u003e] __splice_from_pipe+0x36/0x55\n   [\u003cc10b4d66\u003e] ? splice_from_pipe_begin+0x10/0x10\n   [\u003cc10b6383\u003e] splice_from_pipe+0x51/0x64\n   [\u003cc10b63c2\u003e] ? default_file_splice_write+0x2c/0x2c\n   [\u003cc10b63d5\u003e] generic_splice_sendpage+0x13/0x15\n   [\u003cc10b4d66\u003e] ? splice_from_pipe_begin+0x10/0x10\n   [\u003cc10b527f\u003e] do_splice_from+0x5d/0x67\n   [\u003cc10b6865\u003e] sys_splice+0x2bf/0x363\n   [\u003cc129373b\u003e] ? sysenter_exit+0xf/0x16\n   [\u003cc104dc1e\u003e] ? trace_hardirqs_on_caller+0x10e/0x13f\n   [\u003cc129370c\u003e] sysenter_do_call+0x12/0x32\n  Code: 83 c4 0c 5b 5e 5f c9 c3 55 b9 04 00 00 00 89 e5 57 8d 7d e4 56 53 8d 5d e4 83 ec 18 89 45 e0 89 55 dc 0f b6 70 0f c1 e6 04 01 d6 \u003cf3\u003e a5 be 0f 00 00 00 4e 89 d8 e8 48 ff ff ff 8b 45 e0 89 da 0f\n  EIP: [\u003cd88c92d4\u003e] gf128mul_4k_lle+0x23/0x60 [gf128mul] SS:ESP 0068:d6b8dda4\n  CR2: 0000000000000670\n  ---[ end trace 4eaa2a86a8e2da24 ]---\n  note: hashatron[1502] exited with preempt_count 1\n  BUG: scheduling while atomic: hashatron/1502/0x10000002\n  INFO: lockdep is turned off.\n  [...]\n\nSigned-off-by: Nick Bowler \u003cnbowler@elliptictech.com\u003e\nCc: stable@kernel.org [2.6.37+]\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\n"
    },
    {
      "commit": "2cdc6899a88e2b9c6cb82ebd547bf58932d534df",
      "tree": "37b4c093970fe8f5288cef9150f9d03b26c3b92b",
      "parents": [
        "cbdcf80d8b9486ddb699a044c6f87f25821708cb"
      ],
      "author": {
        "name": "Huang Ying",
        "email": "ying.huang@intel.com",
        "time": "Thu Aug 06 15:32:38 2009 +1000"
      },
      "committer": {
        "name": "Herbert Xu",
        "email": "herbert@gondor.apana.org.au",
        "time": "Thu Aug 06 15:32:38 2009 +1000"
      },
      "message": "crypto: ghash - Add GHASH digest algorithm for GCM\n\nGHASH is implemented as a shash algorithm. The actual implementation\nis copied from gcm.c. This makes it possible to add\narchitecture/hardware accelerated GHASH implementation.\n\nSigned-off-by: Huang Ying \u003cying.huang@intel.com\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\n"
    }
  ]
}