{"push_id":1761293423,"size":52,"distinct_size":52,"ref":"refs/heads/aospn","head":"c8dc693a64970b06a28ad20af804c39c4e74f36b","before":"92317b6b7d23596b2d2440b1b5e4f04ae6382327","commits":[{"sha":"5c4755b4566548537a74d0ed5f156df46b5991b8","author":{"name":"cb","email":"9be6f3c0f9eeb50a3605ff5e26e068f348414aa5@gmail.com"},"message":"ARM: dts: Fix gpu idle timeout after HZ change to 300\n\nChange-Id: I74d69a59765294a06c03c5b0d1fd8d4602256a18","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/5c4755b4566548537a74d0ed5f156df46b5991b8"},{"sha":"fb65e353a0ff9582b55f1164e41f94afa43f0c78","author":{"name":"Sunil Khatri","email":"c2fa09c6a63ee27656efbed7bd5e770f84d009d0@codeaurora.org"},"message":"msm: kgsl: Fix kgsl memory allocation and free race condition\n\nWhen allocating userspace memory keep reference to memory\nallocation till it is completely initialized and info is sent back\nto userspace.\n\nChange-Id: Id72c82bf98c094ecbd4722813c732a998dcbb188\nSigned-off-by: Tarun Karra <tkarra@codeaurora.org>\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/fb65e353a0ff9582b55f1164e41f94afa43f0c78"},{"sha":"f79a29a7f3c3dd42f4446ede107f99b1b87f937c","author":{"name":"Vasantha Balla","email":"a63455bc28bcd5683113ab867f73edf8de46e12a@codeaurora.org"},"message":"msm-vidc: Allocate bus vote data during initialization\n\nDynamic reallocation of vote_data memory can cause double free\nproblem if multiple instances try to reallocate simultaneously.\nSo allocate this memory statically.\n\nChange-Id: Ib5ff08c600a4b69a38b519688bbc153de9f50090\nSigned-off-by: Vasantha Balla<vballa@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/f79a29a7f3c3dd42f4446ede107f99b1b87f937c"},{"sha":"f3341ab2789baa04156aa2909148f935891e02fb","author":{"name":"Divya Ojha","email":"adb4e6b5a390cf1c8a4310d9c2b75b6f6cb7bd3b@codeaurora.org"},"message":"drivers: qcom: ultrasound: check concurrent device open operations\n\nMake opened device count atomic variable to avoid probable race\ncondition. Race condition leads to memory leak and list corruption.\n\nChange-Id: I4da98f27d36f616bc8fa7b1a848c20cc7eea04e5\nSigned-off-by: Divya Ojha <dojha@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/f3341ab2789baa04156aa2909148f935891e02fb"},{"sha":"19b902884f530755071a77ab0fb186743c543995","author":{"name":"Utkarsh Saxena","email":"a77f4916ff39fc133abd3bb49cf55a0c1b56ef54@codeaurora.org"},"message":"msm: ipa: Fix memory leak in ipa driver\n\nFree the memory pointed by msg pointer if\ncopy_to_user fails.\n\nChange-Id: I628e089d844a3e1818a1a550e77ac10f33640ac9\nAcked-by: Mohammed Javid <mjavid@qti.qualcomm.com>\nSigned-off-by: Utkarsh Saxena <usaxena@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/19b902884f530755071a77ab0fb186743c543995"},{"sha":"5b33568759ba9a5490080b5316f77617e3472520","author":{"name":"Sudarshan Rajagopalan","email":"cc0b98e3bd9fd2d4fb47408a421554f5cc82cf2a@codeaurora.org"},"message":"ashmem: remove cache maintenance support\n\nThe cache maintenance routines in ashmem were causing\nseveral security issues. Since they are not being used\nanymore by any drivers, its well to remove them entirely.\n\nCRs-Fixed: 1107034, 2001129, 2007786\nChange-Id: I955e33d90b888d58db5cf6bb490905283374425b\nSigned-off-by: Sudarshan Rajagopalan <sudaraja@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/5b33568759ba9a5490080b5316f77617e3472520"},{"sha":"6db4bc48a906729b67a2586d800bc922bf557381","author":{"name":"AnilKumar Chimata","email":"854bb27c381db2dfaf01c50430201bb7d5894768@codeaurora.org"},"message":"crypto: msm: Fix buffer overflow issue\n\nIn multi-threaded environment diglen variable could be modified\nby multiple threads at the same time. Buffer overflow might\nhappen in current thread if another thread changes the diglen\nvariable. So add mutex locks to avoid this issue.\n\nChange-Id: I62c63c55c028dedb1dd0eec862851bd8e818a5d3\nSigned-off-by: AnilKumar Chimata <anilc@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/6db4bc48a906729b67a2586d800bc922bf557381"},{"sha":"67bfa13b10b3a579f50630133fe701e6239b69ad","author":{"name":"Harsh Sahu","email":"062485454ca52b6187093d2ba1bac5da25a47a5e@codeaurora.org"},"message":"msm: mdss: fix race condition during mdp debugfs release\n\nFix race condition in the release of the mdp debugfs functions\npanel_debug_base_release and mdss_debug_base_release by adding\nthe lock for unpreempted freeing of the buffer so that multiple\nconcurrent processes cannot affect the release which can possibly\nlead to use-after-free operation on the buffer.\n\nChange-Id: I9586081b65ae2eb0e7f6e30c606ee748ae9ef7e8\nSigned-off-by: Harsh Sahu <hsahu@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/67bfa13b10b3a579f50630133fe701e6239b69ad"},{"sha":"0d5805e889c881dc6ad17d177dcceec49813cfef","author":{"name":"Zhen Kong","email":"b999fb1d59364862997bac94d5b793be36d63b01@codeaurora.org"},"message":"crypto: msm: check invalid src and dst vbuf in qcedev.c\n\nsrc and dst vbuf address and length are provided from userspace,\nand they are invalid if vbuf address is NULL but length is not zero.\nAdd additional checks in qcedev_check_cipher_params to prevent it.\n\nChange-Id: Iadc1a0c1c5b2f7a56acd03a23c08e45b5a671b19\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/0d5805e889c881dc6ad17d177dcceec49813cfef"},{"sha":"1738980eedd456fc87413d2736be732778ef21d3","author":{"name":"Siba Prasad","email":"a31d09afa8a8630808d21e5dc28a684eeb002b4c@codeaurora.org"},"message":"mmc: card: block: check the user controlled parameters to avoid overflow\n\nAccording to specs, some commands require a delay after\nissuing the command. idata->ic struct is received from\nuser in mmc_blk_ioctl_cmd(). So idata->ic.postsleep_min_us,\nidata->ic.postsleep_max_us are user controlled. If the min\nand max values are set such as max < min, then operation in\nthe function do_usleep_range will overflow. For avoiding this,\nput a condition for checking max < min. If the condition is\ntrue, then print the error message with respective values and\nreturn error.\n\nChange-Id: I76828b58aa46fc4e195da4ae0babb02a7abf6bbe\nSigned-off-by: Siba Prasad <sibap@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/1738980eedd456fc87413d2736be732778ef21d3"},{"sha":"6310befbf7d047c9cccb88662fdac3e6bb7190ed","author":{"name":"Satya Durga Srinivasu Prabhala","email":"bb669462aab94669983656dbaa2e73952d661c2d@codeaurora.org"},"message":"soc: qcom: remove debugfs interface from ssr\n\nAs debugfs interface is intended to test the respective ssr, remove\nfrom the driver to make sure it won't be available by default.\n\nCRs-Fixed: 2025661\nChange-Id: I6af9a8333c8028611f889cc2f9b0beb37ef12c9b\nSigned-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/6310befbf7d047c9cccb88662fdac3e6bb7190ed"},{"sha":"be477067a6b5f5491111a85228fec522a0da4028","author":{"name":"Sarada Prasanna Garnayak","email":"5a6c89d8d2d571c394d8fd07c242c922ccf59e68@codeaurora.org"},"message":"wcnss: fix the potential memory leak and heap overflow\n\nThe wcnss platform driver update the wlan calibration data\nby the user space wlan daemon. The wlan user space daemon store\nthe updated wlan calibration data reported by wlan firmware in\nuser space and write it back to the wcnss platform calibration\ndata buffer for the calibration data download and update.\n\nDuring the wlan calibration data store and retrieve operation\nthere are some potential race condition which leads to memory leak\nand buffer overflow during the context switch.\n\nFix the above issue by adding protection code and avoid usage of\nglobal pointer during the device file read and write operation.\n\nCRs-Fixed: 2015858\nChange-Id: Ib5b57eb86dcb4e6ed799b5222d06396eaabfaad3\nSigned-off-by: Sarada Prasanna Garnayak <sgarna@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/be477067a6b5f5491111a85228fec522a0da4028"},{"sha":"92e626a88ee6c5d23c53f0e006cb6b4483f2ebb2","author":{"name":"Sunil Khatri","email":"c2fa09c6a63ee27656efbed7bd5e770f84d009d0@codeaurora.org"},"message":"msm: kgsl: Fix the race between context create and destroy\n\nHold the context lock before updating the context id in\nparam->drawctxt_id to avoid race condition between context\ncreation and context destroy.\n\nChange-Id: Ic26d3e5b68078c02d15c38080b1a262ea4b1f7fe\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/92e626a88ee6c5d23c53f0e006cb6b4483f2ebb2"},{"sha":"443510bdd88d1ddb37a77e4dd013ffcfe8ec274c","author":{"name":"Skylar Chang","email":"e55369b827ac1e5cdf23e9f11dabe26a7634de99@codeaurora.org"},"message":"msm : rmnet_ipa: fix memory overflow issue\n\nFix the security issue where mux channel name might\nnot be null-terminated causing memory access overflow\nin ipa wan driver.\n\nChange-Id: I3ef440b62cf3861464fb60c1e7f65f2be5e39ed0\nAcked-by: Shihuan Liu <shihuanl@qti.qualcomm.com>\nSigned-off-by: Skylar Chang <chiaweic@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/443510bdd88d1ddb37a77e4dd013ffcfe8ec274c"},{"sha":"04f7f99179676bfaa04e59d6d2839368319619b3","author":{"name":"Kishor PK","email":"59e3e0452a674ecf9c3b6490ddfc6768fdd530bb@codeaurora.org"},"message":"soc: qcom: pil: Avoid possible buffer overflow during Modem boot\n\nBuffer overflow can occur if MBA firmware size exceeds 1MB.\nSo validate size before copying the firmware.\n\nCRs-Fixed: 2001803\nChange-Id: I070ddf85fbc47df072e7258369272366262ebf46\nSigned-off-by: Kishor PK <kpbhat@codeaurora.org>\nSigned-off-by: Srinivasarao P <spathi@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/04f7f99179676bfaa04e59d6d2839368319619b3"},{"sha":"8b890bd5ecc1f6a6aecccf5df8fe07368b08a7a7","author":{"name":"cb","email":"9be6f3c0f9eeb50a3605ff5e26e068f348414aa5@gmail.com"},"message":"Revert \"posix_acl: Clear SGID bit when setting file permissions\"\n\nThis reverts commit 56325629f5d806fbd961771ca7f1dc5a23e3cffb.","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/8b890bd5ecc1f6a6aecccf5df8fe07368b08a7a7"},{"sha":"9710fa55709bd66696c203533f94327241b1036e","author":{"name":"Jan Kara","email":"7bb7087018cc5fef3c041f6f038f586664845dbf@suse.cz"},"message":"posix_acl: Clear SGID bit when setting file permissions\n\nWhen file permissions are modified via chmod(2) and the user is not in\nthe owning group or capable of CAP_FSETID, the setgid bit is cleared in\ninode_change_ok().  Setting a POSIX ACL via setxattr(2) sets the file\npermissions as well as the new ACL, but doesn't clear the setgid bit in\na similar way; this allows to bypass the check in chmod(2).  Fix that.\n\nReferences: CVE-2016-7097\nReviewed-by: Christoph Hellwig <hch@lst.de>\nReviewed-by: Jeff Layton <jlayton@redhat.com>\nSigned-off-by: Jan Kara <jack@suse.cz>\nSigned-off-by: Andreas Gruenbacher <agruenba@redhat.com>\nGit-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/\nlinux.git\nGit-commit: 073931017b49d9458aa351605b43a7e34598caef\nChange-Id: Idf7cd8d0fb030fedeabd46254e4c4a9c08bce8b5\n[d-cagle@codeaurora.org: Resolve merge conflicts and style]\nSigned-off-by: Dennis Cagle <d-cagle@codeaurora.org>\n[stummala@codeaurora.org: Resolve merge conflicts on existing files and\nskip files fs/ceph/acl.c, fs/hfsplus/posix_acl.c and fs/jfs/acl.c from\noriginal change as those files are not present/fix is not applicable on\n3.10 kernel]\nSigned-off-by: Sahitya Tummala <stummala@codeaurora.org>\n\nConflicts:\n\tfs/f2fs/acl.c","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/9710fa55709bd66696c203533f94327241b1036e"},{"sha":"4796e70a140a4aa502463dfb1bcb79d14e6e725d","author":{"name":"Cong Wang","email":"3f5d79d28d6d48052800caba9df0b30e06fefe41@gmail.com"},"message":"FROMLIST: 9p: fix a potential acl leak\n\n(https://lkml.org/lkml/2016/12/13/579)\n\nposix_acl_update_mode() could possibly clear 'acl', if so\nwe leak the memory pointed by 'acl'. Save this pointer\nbefore calling posix_acl_update_mode() and release the memory\nif 'acl' really gets cleared.\n\nReported-by: Mark Salyzyn <salyzyn@android.com>\nReviewed-by: Jan Kara <jack@suse.cz>\nReviewed-by: Greg Kurz <groug@kaod.org>\nCc: Eric Van Hensbergen <ericvh@gmail.com>\nCc: Ron Minnich <rminnich@sandia.gov>\nCc: Latchesar Ionkov <lucho@ionkov.net>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nBug: 32458736\nChange-Id: Ia78da401e6fd1bfd569653bd2cd0ebd3f9c737a0\nGit-repo: https://android.googlesource.com/kernel/msm/\nGit-commit: 7c780387c931f63fe67830c817f65c1272512bb1\nSigned-off-by: Dennis Cagle <d-cagle@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/4796e70a140a4aa502463dfb1bcb79d14e6e725d"},{"sha":"12273a17fc333973ca1cc042a0f036f01fcf36a2","author":{"name":"Mark Salyzyn","email":"4814ffc71be21311f04ef34122c19152acc840c4@google.com"},"message":"ANDROID: fix acl leaks\n\nFixes regressions associated with commit\n073931017b49d9458aa351605b43a7e34598caef\n\nSigned-off-by: Mark Salyzyn <salyzyn@google.com>\nBug: 32458736\nChange-Id: I6ee127dfdf3594d24ccd8560541ac554c5b05eb6\n[stummala@codeaurora.org: Fixed merge conflicts]\nSigned-off-by: Sahitya Tummala <stummala@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/12273a17fc333973ca1cc042a0f036f01fcf36a2"},{"sha":"79d70be0c64a5566e0fe0f47167bf0724a006920","author":{"name":"Zhen Kong","email":"b999fb1d59364862997bac94d5b793be36d63b01@codeaurora.org"},"message":"qseecom: add mutex around qseecom_set_client_mem_param\n\nAdd mutex around qseecom_set_client_mem_param to prevent an\nioctl thread modifying and corrupting data which is being\nprocessed by another ioctl in the other thread\n\nChange-Id: I0cfb8afab4001c2913be693dfe44c761b9568893\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/aospkenzokang/android_kernel_xiaomi_kenzo/commits/79d70be0c64a5566e0fe0f47167bf0724a006920"}]}
{"actor":{"display_login":"kabirkalsi"}}