{"push_id":1738185882,"size":209,"distinct_size":209,"ref":"refs/heads/cm-14.1","head":"d7d6b2e49d7486f09a06f91a8730b207ca55d4e1","before":"855b18b6cc9f9325d67c150f5e69a6485b8b0865","commits":[{"sha":"b2dd36938c30f62a1a1dfbd74a3bd61b9e634990","author":{"name":"Xiaojun Sang","email":"2dc0774bd7308bab634efe4d5a19a2fc19a72888@codeaurora.org"},"message":"ASoC: soc: prevent risk of buffer overflow\n\nIn case of large value for bufcnt_t or bufcnt,\ncmd_size may overflow. Buffer size allocated by cmd_size might\nbe not as expected.\nPossible buffer overflow could happen.\n\nCRs-Fixed: 1084210\nChange-Id: I9556f18dd6a9fdf3f76c133ae75c04ecce171f08\nSigned-off-by: Xiaojun Sang <xsang@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/b2dd36938c30f62a1a1dfbd74a3bd61b9e634990"},{"sha":"351922035c22c0f56a744ab4c41ca08e325d6261","author":{"name":"Zhen Kong","email":"b999fb1d59364862997bac94d5b793be36d63b01@codeaurora.org"},"message":"qseecom: improve error checks in qseecom_probe()\n\nMake change in qseecom_probe() to improve the error return value\nchecks on some subfunctions, and free memory allocated within\nqseecom_retrieve_ce_data.\n\nCRs-fixed: 1075082\nChange-Id: I971e555ec8d02ccf4382e83132a696b065a8ff12\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/351922035c22c0f56a744ab4c41ca08e325d6261"},{"sha":"8793e155127cb21ba548ca8d5be0a2e4aa938db5","author":{"name":"Sanjay Singh","email":"879562a9d4b691509d24c9d9079cff78eb3cc12a@codeaurora.org"},"message":"msm: vidc: WARN_ON() reveals fuction addresses\n\nThere is a security vulnerability where function addresses are\nprinted in kernel message if WARN_ON() is invoked implicitly.\nWARN_ON() call is made explicit to avoid this issue.\n\nChange-Id: If75581803adf62cb9bda3784ad1d4f4088e0d797\nSigned-off-by: Sanjay Singh <sisanj@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/8793e155127cb21ba548ca8d5be0a2e4aa938db5"},{"sha":"4d37e248171ae6e63abff8bad4fa9effa3e66ec0","author":{"name":"Kirill A. Shutemov","email":"e4d0c2966af3c70025b28e24a0f33104c6291010@linux.intel.com"},"message":"mm: avoid setting up anonymous pages into file mapping\n\ncommit 6b7339f4c31ad69c8e9c0b2859276e22cf72176d upstream.\n\nReading page fault handler code I've noticed that under right\ncircumstances kernel would map anonymous pages into file mappings: if\nthe VMA doesn't have vm_ops->fault() and the VMA wasn't fully populated\non ->mmap(), kernel would handle page fault to not populated pte with\ndo_anonymous_page().\n\nLet's change page fault handler to use do_anonymous_page() only on\nanonymous VMA (->vm_ops == NULL) and make sure that the VMA is not\nshared.\n\nFor file mappings without vm_ops->fault() or shred VMA without vm_ops,\npage fault on pte_none() entry would lead to SIGBUS.\n\nSigned-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>\nAcked-by: Oleg Nesterov <oleg@redhat.com>\nCc: Andrew Morton <akpm@linux-foundation.org>\nCc: Willy Tarreau <w@1wt.eu>\nCc: stable@vger.kernel.org\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nGit-repo: https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux-stable\nGit-commit: efcbc94afe6dd0f8a4b112a0f3385cdc89ea58ba\nChange-Id: Ifab61dd2e0f503811ff428ab6b1d8ba62436e920\nSigned-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/4d37e248171ae6e63abff8bad4fa9effa3e66ec0"},{"sha":"aaca6229558ea725e0c0f5f9ad939a502e7d8c00","author":{"name":"John Dias","email":"c40de28728b9e8a4babeb665245ede5ea5146bf8@google.com"},"message":"perf: don't leave group_entry on sibling list (use-after-free)\n\nWhen perf_group_detach is called on a group leader,\nit should empty its sibling list. Otherwise, when\na sibling is later deallocated, list_del_event()\nremoves the sibling's group_entry from its current\nlist, which can be the now-deallocated group leader's\nsibling list (use-after-free bug).\n\nBug: 32402548\nChange-Id: I99f6bc97c8518df1cb0035814368012ba72ab1f1\nSigned-off-by: John Dias <joaodias@google.com>\nGit-repo: https://android.googlesource.com/kernel/msm\nGit-commit: 6b6cfb2362f09553b46b3b7e5684b16b6e53e373\nSigned-off-by: Dennis Cagle <d-cagle@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/aaca6229558ea725e0c0f5f9ad939a502e7d8c00"},{"sha":"32d12dc60f35dd2c223c917a26c1b091484ca393","author":{"name":"Siqi Lin","email":"05311c862ac5771ebcb1a0a3adac66d431c622e1@google.com"},"message":"ALSA: info: Check for integer overflow in snd_info_entry_write()\n\nsnd_info_entry_write() resizes the buffer with an unsigned long\nsize argument that gets truncated because resize_info_buffer()\ntakes the size parameter as an unsigned int. On 64-bit kernels,\nthis causes the following copy_to_user() to write out-of-bounds\nif (pos + count) can't be represented by an unsigned int.\n\nBug: 32510733\nChange-Id: I9e8b55f93f2bd606b4a73b5a4525b71ee88c7c23\nSigned-off-by: Siqi Lin <siqilin@google.com>\nGit-repo: https://android.googlesource.com/kernel/msm\nGit-commit: 600c59f1f58bf30716d4a072add85f8da77c145c\nSigned-off-by: Dennis Cagle <d-cagle@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/32d12dc60f35dd2c223c917a26c1b091484ca393"},{"sha":"e216b3be6d57eb82cdec1681183dcdd759853849","author":{"name":"Andrew Chant","email":"74abe530dd61f06b906af7d23d7dcf61131999f9@google.com"},"message":"input: synaptics_dsx: add update bounds checks.\n\nFirmware updates contain offsets that are parsed\nby the kernel driver.  Ensure all offsets are within\nthe bounds of the firmware update.\n\nTESTED:\nsuccessfully parsed update firmware on device boot.\n\nBug: 31525965\nBug: 31968442\nChange-Id: I074d3f26d33f723a0b239b59ebc3a680d991cdae\nSigned-off-by: Andrew Chant <achant@google.com>\nGit-repo: https://android.googlesource.com/kernel/msm\nGit-commit: ac2afe08221e0d077befd2e6f216598640af2d51\nSigned-off-by: Dennis Cagle <d-cagle@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/e216b3be6d57eb82cdec1681183dcdd759853849"},{"sha":"6db3b74ea532432bf10d0f90a5c0620a1355b968","author":{"name":"Steven Rostedt (Red Hat)","email":"9f626a07de58780741a9085807c77fd646ef3459@goodmis.org"},"message":"ring-buffer: Prevent overflow of size in ring_buffer_resize()\n\nIf the size passed to ring_buffer_resize() is greater than MAX_LONG - BUF_PAGE_SIZE\nthen the DIV_ROUND_UP() will return zero.\n\nHere's the details:\n\n  # echo 18014398509481980 > /sys/kernel/debug/tracing/buffer_size_kb\n\ntracing_entries_write() processes this and converts kb to bytes.\n\n 18014398509481980 << 10 = 18446744073709547520\n\nand this is passed to ring_buffer_resize() as unsigned long size.\n\n size = DIV_ROUND_UP(size, BUF_PAGE_SIZE);\n\nWhere DIV_ROUND_UP(a, b) is (a + b - 1)/b\n\nBUF_PAGE_SIZE is 4080 and here\n\n 18446744073709547520 + 4080 - 1 = 18446744073709551599\n\nwhere 18446744073709551599 is still smaller than 2^64\n\n 2^64 - 18446744073709551599 = 17\n\nBut now 18446744073709551599 / 4080 = 4521260802379792\n\nand size = size * 4080 = 18446744073709551360\n\nThis is checked to make sure its still greater than 2 * 4080,\nwhich it is.\n\nThen we convert to the number of buffer pages needed.\n\n nr_page = DIV_ROUND_UP(size, BUF_PAGE_SIZE)\n\nbut this time size is 18446744073709551360 and\n\n 2^64 - (18446744073709551360 + 4080 - 1) = -3823\n\nThus it overflows and the resulting number is less than 4080, which makes\n\n  3823 / 4080 = 0\n\nan nr_pages is set to this. As we already checked against the minimum that\nnr_pages may be, this causes the logic to fail as well, and we crash the\nkernel.\n\nThere's no reason to have the two DIV_ROUND_UP() (that's just result of\nhistorical code changes), clean up the code and fix this bug.\n\nCc: stable@vger.kernel.org # 3.5+\nFixes: 83f40318dab00 (\"ring-buffer: Make removal of ring buffer pages atomic\")\nSigned-off-by: Steven Rostedt <rostedt@goodmis.org>\n(cherry picked from commit 59643d1535eb220668692a5359de22545af579f6)\nGit-repo: http://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git\nGit-commit: 59643d1535eb220668692a5359de22545af579f6\nChange-Id: If773b9678be6cbcd1a8821bbd23be798a3289948\nSigned-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/6db3b74ea532432bf10d0f90a5c0620a1355b968"},{"sha":"5e97606c123b2633107fddd14a295205ad9f5ce1","author":{"name":"EunTaik Lee","email":"d2233ab27ded9ee023d5c949fa5e901e18090c48@samsung.com"},"message":"staging/android/ion : fix a race condition in the ion driver\n\nThere is a use-after-free problem in the ion driver.\nThis is caused by a race condition in the ion_ioctl()\nfunction.\n\nA handle has ref count of 1 and two tasks on different\ncpus calls ION_IOC_FREE simultaneously.\n\ncpu 0                                   cpu 1\n-------------------------------------------------------\nion_handle_get_by_id()\n(ref == 2)\n                            ion_handle_get_by_id()\n                            (ref == 3)\n\nion_free()\n(ref == 2)\n\nion_handle_put()\n(ref == 1)\n\n                            ion_free()\n                            (ref == 0 so ion_handle_destroy() is\n                            called\n                            and the handle is freed.)\n\n                            ion_handle_put() is called and it\n                            decreases the slub's next free pointer\n\nThe problem is detected as an unaligned access in the\nspin lock functions since it uses load exclusive\n instruction. In some cases it corrupts the slub's\nfree pointer which causes a mis-aligned access to the\nnext free pointer.(kmalloc returns a pointer like\nffffc0745b4580aa). And it causes lots of other\nhard-to-debug problems.\n\nThis symptom is caused since the first member in the\nion_handle structure is the reference count and the\nion driver decrements the reference after it has been\nfreed.\n\nTo fix this problem client->lock mutex is extended\nto protect all the codes that uses the handle.\n\nChange-Id: Ia1a36ad6336305fe8383863cfab066a56525fd9f\nSigned-off-by: Eun Taik Lee <eun.taik.lee@samsung.com>\nReviewed-by: Laura Abbott <labbott@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nGit-commit: 9590232bb4f4cc824f3425a6e1349afbe6d6d2b7\nGit-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\n[shashim@codeaurora.org: Resolved minor merge conflicts]\nSigned-off-by: Shiraz Hashim <shashim@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/5e97606c123b2633107fddd14a295205ad9f5ce1"},{"sha":"46a84a7e273c44c797dd17565c94d57f5541d305","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"perf: don't leave group_entry on sibling list (use-after-free)\"","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/46a84a7e273c44c797dd17565c94d57f5541d305"},{"sha":"422ef72378656c866ce8381eea10d64e99f325d7","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"ALSA: info: Check for integer overflow in snd_info_entry_write()\"","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/422ef72378656c866ce8381eea10d64e99f325d7"},{"sha":"b7c4118aecb87700a76b30f90d14d588e90844ca","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"input: synaptics_dsx: add update bounds checks.\"","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/b7c4118aecb87700a76b30f90d14d588e90844ca"},{"sha":"408d2d8f69656d769ac4d45aaf21f564b0e81887","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"ring-buffer: Prevent overflow of size in ring_buffer_resize()\"","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/408d2d8f69656d769ac4d45aaf21f564b0e81887"},{"sha":"37ed899fbf4544a429e8ee373e28001db946ffba","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"mm: avoid setting up anonymous pages into file mapping\"","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/37ed899fbf4544a429e8ee373e28001db946ffba"},{"sha":"341c4134847660b29178f53849eac2791545b985","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"staging/android/ion : fix a race condition in the ion driver\"","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/341c4134847660b29178f53849eac2791545b985"},{"sha":"cc7b941d724a0cf02b64c8c252baa8e63f84f386","author":{"name":"Divya Narayanan Poojary","email":"544d0796c14903f0307351f73ee01aa84bc55143@codeaurora.org"},"message":"ASoC: msm-lsm-client: cleanup ioctl functions\n\nSome of the ioctl command handling is not properly using the\ncopy_from_user interface. Fix these issues and cleanup the ioctl\nfunctions to make sure there is no illegal memory access.\n\nCRs-Fixed: 1087469\nChange-Id: Ieb1beb92e7854a05b8045de0ce179d12c9a6da74\nSigned-off-by: Bhalchandra Gajare <gajare@codeaurora.org>\nSigned-off-by: Divya Narayanan Poojary <dnaray@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/cc7b941d724a0cf02b64c8c252baa8e63f84f386"},{"sha":"a1c086b73aad1858466324de31fa039d9fd355d8","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"ASoC: msm-lsm-client: cleanup ioctl functions\"","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/a1c086b73aad1858466324de31fa039d9fd355d8"},{"sha":"ba687fdf399cdebad80e7743f9ec371cf1fbe911","author":{"name":"Xiaojun Sang","email":"2dc0774bd7308bab634efe4d5a19a2fc19a72888@codeaurora.org"},"message":"ASoC: qdsp6v2: fix potential bug of infinite loop\n\nWhen variable bufsz equals to 0, there would be infinite loop\nat q6asm_audio_client_buf_alloc.\nFix the potential bug by checking bufsz beforehand.\n\nCRs-Fixed: 1072280\nChange-Id: I13850031e621dff92b9ad759375964b8cc5cce67\nSigned-off-by: Xiaojun Sang <xsang@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/ba687fdf399cdebad80e7743f9ec371cf1fbe911"},{"sha":"bb851289bc715769784d74bfa0e486b80118edf0","author":{"name":"Banajit Goswami","email":"d9f3b0ac7d3275ff534aa3f7cbf6fa940e574816@codeaurora.org"},"message":"ASoC: msm: q6dspv2: use correct variable type to store ION buff size\n\nThe size of the physical memory allocated for ION buffers\nare of type size_t. Change updates the type of variables\nsent to ION drivers to size_t to avoid any mismatch.\n\nChange-Id: I3d33ed922b979652c64027e6f1c6f0a8ed4850a3\nSigned-off-by: Banajit Goswami <bgoswami@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/bb851289bc715769784d74bfa0e486b80118edf0"},{"sha":"293473819ac67cbee7355453cbbf7bf8a813645a","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"ASoC: soc: prevent risk of buffer overflow\"","distinct":true,"url":"https://api.github.com/repos/3xpl01ts/android_kernel_oneplus_msm8994-los/commits/293473819ac67cbee7355453cbbf7bf8a813645a"}]}
{"actor":{"display_login":"3xpl01ts"}}