Essential Products - PH-1 9.0 - Developer preview

netfilter: nfnetlink: use original skbuff when acking batches

Since bd678e09dc17 ("netfilter: nfnetlink: fix splat due to incorrect
socket memory accounting in skbuff clones"), we don't manually attach
the sk to the skbuff clone anymore, so we have to use the original
skbuff from netlink_ack() which needs to access the sk pointer.

Change-Id: I4ae7e9c52d9a10f8c88dbd179506bae94d5080e4
Fixes: bd678e09dc17 ("netfilter: nfnetlink: fix splat due to incorrect socket memory accounting in skbuff clones")
Reported-by: Dmitry Vyukov <[email protected]>
Signed-off-by: Pablo Neira Ayuso <[email protected]>

Essential Products - PH-1 8.1 - May 2018 Security patch

selinux: fix double free in selinux_parse_opts_str()

This patch is based on a discussion generated by an earlier patch
from Tetsuo Handa:

* https://marc.info/?t=149035659300001&r=1&w=2

The double free problem involves the mnt_opts field of the
security_mnt_opts struct, selinux_parse_opts_str() frees the memory
on error, but doesn't set the field to NULL so if the caller later
attempts to call security_free_mnt_opts() we trigger the problem.

In order to play it safe we change selinux_parse_opts_str() to call
security_free_mnt_opts() on error instead of free'ing the memory
directly.  This should ensure that everything is handled correctly,
regardless of what the caller may do.

Change-Id: Ibc2dd57e914203e97dfe301f04adee0084830c85
Fixes: e0007529893c1c06 ("LSM/SELinux: Interfaces to allow FS to control mount options")
Cc: [email protected]
Cc: Tetsuo Handa <[email protected]>
Reported-by: Dmitry Vyukov <[email protected]>
Signed-off-by: Paul Moore <[email protected]>
Signed-off-by: James Morris <[email protected]>

Essential Products - PH-1 8.1 - April 2018 Security patch

OPM1.180104.141

Linux 4.4.126

Essential Products - PH-1 8.1 Official release

OPM1.180104.092

Linux 4.4.120

Essential Products - PH-1 8.1 Beta

allow LZ4 zram compression

Change-Id: I3c6116401f1c577ada75908dfda779f9f597d854