{"push_id":1976764370,"size":110,"distinct_size":110,"ref":"refs/heads/deft","head":"2d8b18e19dec66a8063ab8ae6fc36a91a0498716","before":"541c53b17572e99e35fb911a4670f091d8cc147d","commits":[{"sha":"c65dfb535162135b931f70950ddb620b17999b39","author":{"name":"Liangliang Lu","email":"f615cd9161b701e9f1351d8b7046d3f2d417e660@codeaurora.org"},"message":"trace: ipc_logging: Avoid buffer overflow in ipc_log_string()\n\nIn ipc_log_string() the return value from vsnprintf(), data_size,\nis used to increment ectxt.offset. However, this length could\nactually be much larger than that of ectxt.buff itself. This is a\ntypical mistake of [v]snprintf() usage [1], in that it returns\nnot the number of characters written but how many characters\n*would* have been written regardless of whether it was truncated.\nThe result is that even though ectxt.buff itself is not overrun,\nthe incorrect size in ectxt.offset will be later used as the length\nparameter when memcpy()'ing to the ipc_log_page's data, overflowing\nthat memory and beyond. The write_page's write_offset would also\nindicate an out-of-bounds (greater than PAGE_SIZE) length.\n\nThe fix is simple: use vscnprintf() instead of vsnprintf().\n\n[1] https://lwn.net/Articles/69419/\n\nChange-Id: I2e9d44e74f5f30a009732e31a554d82e31946999\nSigned-off-by: Jack Pham <jackp@codeaurora.org>\nSigned-off-by: Liangliang Lu <luliang@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/c65dfb535162135b931f70950ddb620b17999b39"},{"sha":"3c067d6da2eb83f0761c0bd3bd1848b6349c0f3f","author":{"name":"Santosh Mardi","email":"c3a54d58cc5d1ef77c1918d838655e4cbf4d8a24@codeaurora.org"},"message":"cpufreq: flush queued work before freeing policy\n\nWhen system resume and suspend happening at the same time,\nthe resume sequence will schedule the work (policy->update)\nbefore policy->update getting chance to run in the meantime\nsuspend or hotplug of an cpu happens at the same time resume\nis happening, and if the cpu is the last in the cluster\npolicy is freed.\n\nThis triggers an issue when scheduler tries to schedule the work\nwhich is scheduled in resume path But the handles are freed already.\n\nFlush the Queued work if any before freeing policy.\n\nChange-Id: I41504e7d9c201916457681537ac480c92e7cbe5d\nSigned-off-by: Santosh Mardi <gsantosh@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/3c067d6da2eb83f0761c0bd3bd1848b6349c0f3f"},{"sha":"089a1ad56c2c531aa42bafd3af9789dfee17b7e0","author":{"name":"Manoj Prabhu B","email":"ddf4043a996bf7f608ab271ea96052c669b1253b@codeaurora.org"},"message":"diag: Synchronize msg mask read and write on a peripheral\n\nThe patch synchronizes msg mask read and write on a peripheral\nby proper protection of mask_info and msg_mask_table_count.\n\nCRs-Fixed: 2042362, 2055291\nChange-Id: If136012855834b0b8cba91eb66bf711750e8f372\nSigned-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/089a1ad56c2c531aa42bafd3af9789dfee17b7e0"},{"sha":"ee781281d97f42654da5bf42644ec5da89af7603","author":{"name":"Prateek Sood","email":"171adf8aecf0ca6fb857cc267ad41f819345a5f0@codeaurora.org"},"message":"osq_lock: fix osq_lock queue corruption\n\nFix ordering of link creation between node->prev and prev->next in\nosq_lock(). A case in which the status of optimistic spin queue is\nCPU6->CPU2 in which CPU6 has acquired the lock. At this point if CPU0\ncomes in to acquire osq_lock, it will update the tail count. After tail\ncount update if CPU2 starts to unqueue itself from optimistic spin queue,\nit will find updated tail count with CPU0 and update CPU2 node->next to\nNULL in osq_wait_next(). If reordering of following stores happen then\nprev->next where prev being CPU2 would be updated to point to CPU0 node:\n\tnode->prev = prev;\n\tWRITE_ONCE(prev->next, node);\n\nAt this point if next instruction\n\tWRITE_ONCE(next->prev, prev);\n\nin CPU2 path is committed before the update of CPU0 node->prev = prev then\nCPU0 node->prev will point to CPU6 node. At this point if CPU0 path's\nnode->prev = prev is committed resulting in change of CPU0 prev back to\nCPU2 node. CPU2 node->next is NULL currently, so if CPU0 gets into unqueue\npath of osq_lock it will keep spinning in infinite loop as condition\nprev->next == node will never be true.\n\nChange-Id: I0b484f59f2e2945be4122792319c3431e55ec33e\nSigned-off-by: Prateek Sood <prsood@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/ee781281d97f42654da5bf42644ec5da89af7603"},{"sha":"c5085559112f67a5520c3fc1c38c7383d45c626e","author":{"name":"Prateek Sood","email":"171adf8aecf0ca6fb857cc267ad41f819345a5f0@codeaurora.org"},"message":"osq_lock: avoid live-lock issue for RT task\n\nLive Lock  due to task spinning while unqueue of CPU osq_node\nfrom optimistic_spin_queue. Task T1 had decremented mutex count to\nacquire the lock on CPU0. Before setting owner it got preempted. On\nCPU1 task T2 acquired osq_lock and started spinning on owner of mutex\nwith preemption disabled. CPU1 runq has one task, so need_resched will\nnot be set. On CPU0 task T3 tried to acquire osq_lock to spin on the\nsame mutex. At this time following scenario causes soft lockup:\n\nAfter preemption of task T1, RT task T3 tried to acquire the same\nmutex. It will start spinning on the osq_lock until the lock is available\nor need_resched is set. For RT task, need_resched will not be set. Task T3\nwill not be able to bail out of the infinite loop.\n\nChange-Id: Icd599bdcebda23b22dcd5e6f9be8842bb8f2f5b6\nSigned-off-by: Prateek Sood <prsood@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/c5085559112f67a5520c3fc1c38c7383d45c626e"},{"sha":"cdff0f9c335b2febba0ec842c892f7e2d1356c92","author":{"name":"Srinivasarao P","email":"5838be2f68866147a6b98dc0567ce3ec89ebe5fc@codeaurora.org"},"message":"defconfig: disable cp_access\n\ncpaccess module gives userspace control over system control\nregisters so disable cp_access module.\n\nChange-Id: Ib49412957f91ce65f4350c5c72358b1c53eed43e\nSigned-off-by: Srinivasarao P <spathi@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/cdff0f9c335b2febba0ec842c892f7e2d1356c92"},{"sha":"69650e9e9fabed717e790133bdd893a8ecf31f10","author":{"name":"Trishansh Bhardwaj","email":"e6f3043187f404ce783dec579af51dccff5a72a4@codeaurora.org"},"message":"msm: camera: Instead of read_lock use read_lock_irqsave.\n\nPrevent deadlock between tasklet and delete_stream by stopping\nirq during delete_stream.\n\nCRs-Fixed: 2076578\nChange-Id: Ibcc9fd44403d24112b01150a7d1f3c6e705ea99a\nSigned-off-by: Trishansh Bhardwaj <tbhardwa@codeaurora.org>\nSigned-off-by: VijayaKumar T M <vtmuni@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/69650e9e9fabed717e790133bdd893a8ecf31f10"},{"sha":"919a55db36e14cc0792675d9ddfc433139af146c","author":{"name":"Ajay Agarwal","email":"6ce74e795e4e66d21ad0250cc70f37caae833642@codeaurora.org"},"message":"dwc3: Do not perform core reinitialisation for host only mode\n\nCuurently as a part of start host, after the block reset we\nare performing core init and gadget restart of the dwc3\ncontroller. This causes crash for host only controller where\nep0 and ep1 have not been initialised but are being\ndereferenced. Also, HW reinitialisation is not required for\nstart or restart host routine.\n\nChange-Id: Ie2b781ecb03a1d0a02c5f4305d518adc18dc6ade\nSigned-off-by: Ajay Agarwal <ajaya@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/919a55db36e14cc0792675d9ddfc433139af146c"},{"sha":"7aa8d062efd023d063c4523a1a0802ef9530303c","author":{"name":"Harsh Sahu","email":"062485454ca52b6187093d2ba1bac5da25a47a5e@codeaurora.org"},"message":"msm: mdss: fix the use after free problem in rotator ioctl\n\nCurrently the fence fd is installed too early. This can cause a\nuse after free problem if the fence fd is closed in some other thread.\nThis change will install the fence fd where it is required and\neliminates the problem.\n\nChange-Id: I5cf585ea87ef75fccae06da6cb5a6c16fc74eff3\nSigned-off-by: Harsh Sahu <hsahu@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/7aa8d062efd023d063c4523a1a0802ef9530303c"},{"sha":"68ccd6e493accf59247fd49a4468bcf3d5533c41","author":{"name":"annamraj","email":"7a682bcda5ef05c5defc21be6262fc408a917b3e@codeaurora.org"},"message":"msm: camera: Make use of mutex lock to avoid race condition\n\nMake use of mutex lock to access IOCTL so that two threads\ncan avoid race condition.\n\nChange-Id: I00db78a42c86eef8a157b5b3547e4ca0006b0853\nSigned-off-by: annamraj <annamraj@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/68ccd6e493accf59247fd49a4468bcf3d5533c41"},{"sha":"7d686ee27e1031a799c09fdb89932a00c75a1a59","author":{"name":"Weiyin Jiang","email":"25745fd6cb0247e11bcb32583c6893d37cc23b30@codeaurora.org"},"message":"SoC: msm: audio-effects: return directly to avoid integer overflow\n\nReturn error code directly to avoid further integer overflow leading\nto buffer overflow.\n\nChange-Id: I8b74efda227726494724f4387c45b5b6fa04637b\nCRs-Fixed: 2077909\nSigned-off-by: Weiyin Jiang <wjiang@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/7d686ee27e1031a799c09fdb89932a00c75a1a59"},{"sha":"4ec9d1e36e4ac054c0874edd62ee1103901dfbf8","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"msm: camera: Make use of mutex lock to avoid race condition\"","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/4ec9d1e36e4ac054c0874edd62ee1103901dfbf8"},{"sha":"7f8a8d67f60f10d1f37ca9e53f485c8159e17989","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"msm: mdss: fix the use after free problem in rotator ioctl\"","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/7f8a8d67f60f10d1f37ca9e53f485c8159e17989"},{"sha":"e083ac1a82f1fd114beefb11c6719e368473b537","author":{"name":"Tony Truong","email":"ae59414b9c21833369532308da89684a378f748d@codeaurora.org"},"message":"msm: pcie: add bounds check for debugfs register write\n\nVia debugfs nodes, users have the option to read and write to\nany PCIe register. To ensure clients do not access registers\noutside the PCIe range, add checks to validate the offset clients\nprovide.\n\nChange-Id: Ia35cd04c57f01c21a47962be596bca395b5ca247\nSigned-off-by: Tony Truong <truong@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/e083ac1a82f1fd114beefb11c6719e368473b537"},{"sha":"ae5355d3cf74f21fa057d9156e019b7566ea8b87","author":{"name":"Mohit Aggarwal","email":"e312531ff0a491048a1f78294d19bb12f0137756@codeaurora.org"},"message":"diag: dci: Add protection while querying event status\n\nCurrently, protection is missing when querying event\nstatus due to which already removed dci client entry\nmight be accessed. This patch takes care of issue by\ntaking proper locking.\n\nCRs-Fixed: 2015892\nChange-Id: I4195c4c6198d85e96559f1728d74419527a76bc5\nSigned-off-by: Mohit Aggarwal <maggarwa@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/ae5355d3cf74f21fa057d9156e019b7566ea8b87"},{"sha":"316421f5bc3695e188af62ec990aec540bfe68b9","author":{"name":"Gaoxiang Chen","email":"e7c95b2efcc6251eae2b715eaa0e35cb73e46ad3@codeaurora.org"},"message":"msm: camera: fix off-by-one overflow in msm_isp_get_bufq\n\nIn msm_isp_get_bufq, if bufq_index equals buf_mgr->num_buf_q,\nit will pass the check, leading to off-by-one overflow\n(exceed the length of array by one element).\n\nCRs-Fixed: 2031677\nChange-Id: I7ea465897e2c37de6ca0155c3e225f1444b3cf13\nSigned-off-by: Gaoxiang Chen <gaochen@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/316421f5bc3695e188af62ec990aec540bfe68b9"},{"sha":"8dbae65410645e02eacff85fe7abad3dadc76a11","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"defconfig: disable cp_access\"","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/8dbae65410645e02eacff85fe7abad3dadc76a11"},{"sha":"ffd590eae18eadbd46c24451a1263b0d83911085","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Promotion of kernel.lnx.3.18.c5-170801.1.\n\nCRs      Change ID                                   Subject\n--------------------------------------------------------------------------------------------------------------\n1103788   Ib49412957f91ce65f4350c5c72358b1c53eed43e   defconfig: disable cp_access\n2060377   I00db78a42c86eef8a157b5b3547e4ca0006b0853   msm: camera: Make use of mutex lock to avoid race condit\n2064235   I5cf585ea87ef75fccae06da6cb5a6c16fc74eff3   msm: mdss: fix the use after free problem in rotator ioc\n\nChange-Id: I24fe7498f726c5b0fe45367f899492b986a6b57a\nCRs-Fixed: 1103788, 2064235, 2060377","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/ffd590eae18eadbd46c24451a1263b0d83911085"},{"sha":"efa2b4ca56f603f3b23e2171a71ae704f8485297","author":{"name":"Sarada Prasanna Garnayak","email":"5a6c89d8d2d571c394d8fd07c242c922ccf59e68@codeaurora.org"},"message":"cnss_pci: fix the race condition bug in WLAN firmware table config\n\nUpdate the synchronization process of the cnss platform driver\nmemory expansion and WLAN firmware table configuration from\nthe userspace through sysfs firmware update node.\n\nCRs-Fixed: 2071560\nChange-Id: I672ba84ad10c905be7855c1b8a930ac7adf349f1\nSigned-off-by: Sarada Prasanna Garnayak <sgarna@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/efa2b4ca56f603f3b23e2171a71ae704f8485297"},{"sha":"50c6482718b52ae559002639f4c9431fe15223d2","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"osq_lock: fix osq_lock queue corruption\"","distinct":true,"url":"https://api.github.com/repos/revjunkie/mido-note-4x/commits/50c6482718b52ae559002639f4c9431fe15223d2"}]}
{"actor":{"display_login":"revjunkie"}}