{"push_id":1952271064,"size":16,"distinct_size":16,"ref":"refs/heads/android-msm-shamrock-3.10-nougat-mr1-release","head":"116ee35603a5fafcfaf3287b2e75685d99bdd830","before":"703b1b827c09cac0767a5c2af06b22b8a80e1abf","commits":[{"sha":"117fb20da62099bf376e349d350611c25ba1313e","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"USB: f_qc_rndis: Prevent use-after-free for _rndis_qc\n\nAssume that there are two threads, thread1 is setting\nvalue of _rndis_qc variable in rndis_qc_bind_config_vendor\nfunction. Thread2 jumps in and get the value of _rndis_qc\nin rndis_qc_open_dev function before it is freed in\nrndis_qc_bind_config_vendor function, since rndis_ipa_init\nor usb_add_function failed. Use-after-free will happen as\nThread2 is referencing freed objects. To prevent this\nspinlock is used where ever it is needed to protect\n_rndis_qc variable.\n\n\nBug: 35136547\nChange-Id: Ibfe10cedc18bcb19dd01cd2bec43a5554fd008bc\nSigned-off-by: Pratham Pratap <prathampratap@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/android/kernel_msm/commits/117fb20da62099bf376e349d350611c25ba1313e"},{"sha":"4fd4788a08f5eef65977fa4385ab844a6aa14abe","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"msm: ipa: Fix for missing int overflow check in the refcount library\n\nOverflow of reference counter can lead to memory leak.\n\nBefore incrementing the reference count, check with\nU32_MAX and return for error check.\n\nBug: 35467471\nChange-Id: Ib96d36574ee086ec73c9836110cb2c98e8ae3d66\nAcked-by: Mohammed Javid <mjavid@qti.qualcomm.com>\nSigned-off-by: Utkarsh Saxena <usaxena@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/android/kernel_msm/commits/4fd4788a08f5eef65977fa4385ab844a6aa14abe"},{"sha":"edaa588dec5523e1e23c2a1a2eb943da8598ed37","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"qcdev: Check the digest length during the SHA operations\n\nCheck the digest length to avoid buffer overflow while\ndoing the SHA operations.\n\nBug: 36591162\nChange-Id: I4d3fb20723f59e905a672edaf84ee5d0865905b1\nSigned-off-by: Brahmaji K <bkomma@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/android/kernel_msm/commits/edaa588dec5523e1e23c2a1a2eb943da8598ed37"},{"sha":"abd7b6cfa4abc4f7c75cf85a5163c888611ca714","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"timerfd: Protect the might cancel mechanism proper\n\nThe handling of the might_cancel queueing is not properly protected, so\nparallel operations on the file descriptor can race with each other and\nlead to list corruptions or use after free.\n\nProtect the context for these operations with a seperate lock.\n\nThe wait queue lock cannot be reused for this because that would create a\nlock inversion scenario vs. the cancel lock. Replacing might_cancel with an\natomic (atomic_t or atomic bit) does not help either because it still can\nrace vs. the actual list operation.\n\nBug: 36266767\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: \"linux-fsdevel@vger.kernel.org\"\nCc: syzkaller <syzkaller@googlegroups.com>\nCc: Al Viro <viro@zeniv.linux.org.uk>\nCc: linux-fsdevel@vger.kernel.org\nLink: http://lkml.kernel.org/r/alpine.DEB.2.20.1701311521430.3457@nanos\nGit-repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git\nGit-commit: 1e38da300e1e395a15048b0af1e5305bd91402f6\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>\nChange-Id: I13e94352e63eeb27abdd42b90e3da916c2608f63","distinct":true,"url":"https://api.github.com/repos/android/kernel_msm/commits/abd7b6cfa4abc4f7c75cf85a5163c888611ca714"},{"sha":"4d982e7f94c7c1b4f9d36b4d3a2f288e0f6cb934","author":{"name":"Jin Qian","email":"0a9aa3d3574a19f4323dcc26c6c102ebcca97ce1@google.com"},"message":"BACKPORT: f2fs: sanity check log_blocks_per_seg\n\nf2fs currently only supports 4KB block size and 2MB segment size.\nSanity check log_blocks_per_seg == 9, i.e. 2MB/4KB = (1 << 9)\n\nPartially\n(cherry-picked from commit 9a59b62fd88196844cee5fff851bee2cfd7afb6e)\n\nf2fs: do more integrity verification for superblock\n    \nDo more sanity check for superblock during ->mount.\n    \nSigned-off-by: Chao Yu <chao2.yu@samsung.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\n\nBug: 36817013\nChange-Id: I0be52e54fba82083068337ceb9f7ad985a87319f\nSigned-off-by: Jin Qian <jinqian@google.com>","distinct":true,"url":"https://api.github.com/repos/android/kernel_msm/commits/4d982e7f94c7c1b4f9d36b4d3a2f288e0f6cb934"},{"sha":"bc64de9c0d8c1e8bd8bae0802ba8056e23ab6167","author":{"name":"Jin Qian","email":"0a9aa3d3574a19f4323dcc26c6c102ebcca97ce1@android.com"},"message":"BACKPORT: f2fs: sanity check checkpoint segno and blkoff\n\nMake sure segno and blkoff read from raw image are valid.\n\nFixed conflicts due to missing commit 1e968fdfe69e\n(\"f2fs: introduce f2fs_cp_error for readability\") and commit 6bacf52fb58a\n(\"f2fs: add unlikely() macro for compiler more aggressively\").\n\n(url https://sourceforge.net/p/linux-f2fs/mailman/message/35835945)\n\nSigned-off-by: Jin Qian <jinqian@google.com>\nSigned-off-by: Siqi Lin <siqilin@google.com>\nBug: 36588520\nChange-Id: Iba66ab97d3d0870ea48b5ef192d9075f225a934a","distinct":true,"url":"https://api.github.com/repos/android/kernel_msm/commits/bc64de9c0d8c1e8bd8bae0802ba8056e23ab6167"},{"sha":"fb9519de5bfac35a91864ddd0f905bd01e159a8b","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"f2fs: sanity check segment count\n\nF2FS uses 4 bytes to represent block address. As a result, supported\nsize of disk is 16 TB and it equals to 16 * 1024 * 1024 / 2 segments.\n\nBug: 36815012\nSigned-off-by: Jin Qian <jinqian@google.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\nGit-repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git\nGit-commit: b9dd46188edc2f0d1f37328637860bb65a771124\n[srkupp@codeaurora.org: Resolved minor conflict]\nSigned-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>\nChange-Id: Id1a67927262451762a4d423fa50b370ec3cdb56c","distinct":true,"url":"https://api.github.com/repos/android/kernel_msm/commits/fb9519de5bfac35a91864ddd0f905bd01e159a8b"},{"sha":"83c97b1efc62cf7991424a6af88da2f868d8fc4a","author":{"name":"Ariel Yin","email":"9308cd92d4904c8721204c41e9329abc3a43c10d@google.com"},"message":"Merge \"BACKPORT: f2fs: sanity check log_blocks_per_seg\" into mnc-dr-dev-qcom-lego","distinct":true,"url":"https://api.github.com/repos/android/kernel_msm/commits/83c97b1efc62cf7991424a6af88da2f868d8fc4a"},{"sha":"e799f63d6d3a47c752937a9cac614fbd01f2ecb6","author":{"name":"Ariel Yin","email":"9308cd92d4904c8721204c41e9329abc3a43c10d@google.com"},"message":"Merge \"f2fs: sanity check segment count\" into mnc-dr-dev-qcom-lego","distinct":true,"url":"https://api.github.com/repos/android/kernel_msm/commits/e799f63d6d3a47c752937a9cac614fbd01f2ecb6"},{"sha":"742612051cf806db7a368f1f51d2c08080bb5545","author":{"name":"Ariel Yin","email":"9308cd92d4904c8721204c41e9329abc3a43c10d@google.com"},"message":"Merge \"BACKPORT: f2fs: sanity check checkpoint segno and blkoff\" into mnc-dr-dev-qcom-lego","distinct":true,"url":"https://api.github.com/repos/android/kernel_msm/commits/742612051cf806db7a368f1f51d2c08080bb5545"},{"sha":"568018a8a24158cddc0a4d596ec2ce2cd6bf3810","author":{"name":"Ariel Yin","email":"9308cd92d4904c8721204c41e9329abc3a43c10d@google.com"},"message":"Merge \"msm: ipa: Fix for missing int overflow check in the refcount library\" into mnc-dr-dev-qcom-lego","distinct":true,"url":"https://api.github.com/repos/android/kernel_msm/commits/568018a8a24158cddc0a4d596ec2ce2cd6bf3810"},{"sha":"75fa02c61dcd62a3111ccc98f90e58ad55da1f91","author":{"name":"Ariel Yin","email":"9308cd92d4904c8721204c41e9329abc3a43c10d@google.com"},"message":"Merge \"USB: f_qc_rndis: Prevent use-after-free for _rndis_qc\" into mnc-dr-dev-qcom-lego","distinct":true,"url":"https://api.github.com/repos/android/kernel_msm/commits/75fa02c61dcd62a3111ccc98f90e58ad55da1f91"},{"sha":"ffe68a6c402339adf68bdbe461b699d90dd82c33","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"msm: kgsl: Fix the race between context create and destroy\n\nHold the context lock before updating the context id in\nparam->drawctxt_id to avoid race condition between context\ncreation and context destroy.\n\nBug: 36491445\nChange-Id: Ic26d3e5b68078c02d15c38080b1a262ea4b1f7fe\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/android/kernel_msm/commits/ffe68a6c402339adf68bdbe461b699d90dd82c33"},{"sha":"47db52cab94f8717d9e8780466479d32b8d5698e","author":{"name":"Ariel Yin","email":"9308cd92d4904c8721204c41e9329abc3a43c10d@google.com"},"message":"Merge \"qcdev: Check the digest length during the SHA operations\" into mnc-dr-dev-qcom-lego","distinct":true,"url":"https://api.github.com/repos/android/kernel_msm/commits/47db52cab94f8717d9e8780466479d32b8d5698e"},{"sha":"333719a83d9b0e53cd291fc5fcd18227d997dc4f","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"radio-iris: Use copy_from_user API to access userspace memory\n\nDirectly accessing userspace memory pointer in kernel space without\nchecking validity of pointer. This can lead to security vulnerability.\nUse copy_from_user API's to make sure there is no illegal memory access.\n\nBug: 36386593\nChange-Id: I66a0b1931814ee19634a30dee02a5600066aa70b\nSigned-off-by: Kamal Negi <kamaln@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/android/kernel_msm/commits/333719a83d9b0e53cd291fc5fcd18227d997dc4f"},{"sha":"116ee35603a5fafcfaf3287b2e75685d99bdd830","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"ASoC: msm: qdspv2: add result check when audio process fail\n\nA audio_process_event_req is not always to success. Therefore,\ncheck the return value for audio_process_event_req, and\ninitializ usr_evt before using it.\n\nBug: 35764875\nCRs-Fixed: 2029798\nChange-Id: I4adf682575f5f9233a1a1a533f9c6361af8a5bcf\nSigned-off-by: kunleiz <kunleiz@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/android/kernel_msm/commits/116ee35603a5fafcfaf3287b2e75685d99bdd830"}]}
{"actor":{"display_login":"hubot"}}