{"push_id":1708208633,"size":42,"distinct_size":42,"ref":"refs/heads/N-1","head":"790c120f80fc38739e79d33ff15e360c2b740001","before":"63385032f5af041917fc9488ab26791f0e236328","commits":[{"sha":"5a85ae564b5403d0a2b1601128e9c4a29b70b51a","author":{"name":"Karthikeyan Ramasubramanian","email":"f8c024263b29fe33b9929f0b5fb3a166c82f9fa1@codeaurora.org"},"message":"net: ipc_router: Register services only on client port\n\nAllowing services to be registered on a non-client port will cause either\nan existing service or a control port to be over-written. This will cause\nundefined functional behavior.\n\nAllow the services to be registered only on client ports.\n\nCRs-Fixed: 1101792\nBug: 33277611\nChange-Id: If6cfc75e9314204b7b44957f1598a8a2e1a45325\nSigned-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/5a85ae564b5403d0a2b1601128e9c4a29b70b51a"},{"sha":"efe4631f091f0f7f782b1ab3796ba45332620927","author":{"name":"Biswajit Paul","email":"7ee5649c8de55a61a3bbcbc7dcde16c04b2f65da@codeaurora.org"},"message":"msm: ipa: Update IPA rule temp buffer size\n\nIPA filtering and routing temp buffer size\nshould be big enough to contain the maximum possible\nrule being composed.\n\nBug: 33106520\nChange-Id: I659fd46ec1f44e68aedb9021962dd04de9d9cd57\nCRs-fixed: 1099598\nSigned-off-by: Ghanim Fodi <gfodi@codeaurora.org>\nSigned-off-by: Biswajit Paul <biswajitpaul@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/efe4631f091f0f7f782b1ab3796ba45332620927"},{"sha":"09f3f0bed0b222f61c202849e547667e567c523e","author":{"name":"Philip Pettersson","email":"a92d5039dce26639c800f4cf2f37bd0c3c2ae41c@gmail.com"},"message":"UPSTREAM: packet: fix race condition in packet_set_ring\n\n(cherry picked from commit 84ac7260236a49c79eede91617700174c2c19b0c)\n\nWhen packet_set_ring creates a ring buffer it will initialize a\nstruct timer_list if the packet version is TPACKET_V3. This value\ncan then be raced by a different thread calling setsockopt to\nset the version to TPACKET_V1 before packet_set_ring has finished.\n\nThis leads to a use-after-free on a function pointer in the\nstruct timer_list when the socket is closed as the previously\ninitialized timer will not be deleted.\n\nThe bug is fixed by taking lock_sock(sk) in packet_setsockopt when\nchanging the packet version while also taking the lock at the start\nof packet_set_ring.\n\nFixes: f6fb8f100b80 (\"af-packet: TPACKET_V3 flexible buffer implementation.\")\nSigned-off-by: Philip Pettersson <philip.pettersson@gmail.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nChange-Id: Ice451620ecf2c2a5ba3709f45fbb5f3f5c5bb389\nBug: 33358926","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/09f3f0bed0b222f61c202849e547667e567c523e"},{"sha":"370b0c611a1fe54fb54a6349dfcc674fcefd1954","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"UPSTREAM: net: avoid signed overflows for SO_{SND|RCV}BUFFORCE\n\n(cherry picked from commit b98b0bc8c431e3ceb4b26b0dfc8db509518fb290)\n\nCAP_NET_ADMIN users should not be allowed to set negative\nsk_sndbuf or sk_rcvbuf values, as it can lead to various memory\ncorruptions, crashes, OOM...\n\nNote that before commit 82981930125a (\"net: cleanups in\nsock_setsockopt()\"), the bug was even more serious, since SO_SNDBUF\nand SO_RCVBUF were vulnerable.\n\nThis needs to be backported to all known linux kernels.\n\nAgain, many thanks to syzkaller team for discovering this gem.\n\nChange-Id: I2b621c28c02267af5b34a379b2970fe5fb61a4f6\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nBug: 33363517","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/370b0c611a1fe54fb54a6349dfcc674fcefd1954"},{"sha":"037161c7fa8f872ab7d105623908dab2dd6551ea","author":{"name":"Guillaume Nault","email":"3f2beb9890afcf959ec304431b991035a559d9bd@alphalink.fr"},"message":"UPSTREAM: l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind()\n\n(cherry picked from commit 32c231164b762dddefa13af5a0101032c70b50ef)\n\nLock socket before checking the SOCK_ZAPPED flag in l2tp_ip6_bind().\nWithout lock, a concurrent call could modify the socket flags between\nthe sock_flag(sk, SOCK_ZAPPED) test and the lock_sock() call. This way,\na socket could be inserted twice in l2tp_ip6_bind_table. Releasing it\nwould then leave a stale pointer there, generating use-after-free\nerrors when walking through the list or modifying adjacent entries.\n\nBUG: KASAN: use-after-free in l2tp_ip6_close+0x22e/0x290 at addr ffff8800081b0ed8\nWrite of size 8 by task syz-executor/10987\nCPU: 0 PID: 10987 Comm: syz-executor Not tainted 4.8.0+ #39\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014\n ffff880031d97838 ffffffff829f835b ffff88001b5a1640 ffff8800081b0ec0\n ffff8800081b15a0 ffff8800081b6d20 ffff880031d97860 ffffffff8174d3cc\n ffff880031d978f0 ffff8800081b0e80 ffff88001b5a1640 ffff880031d978e0\nCall Trace:\n [<ffffffff829f835b>] dump_stack+0xb3/0x118 lib/dump_stack.c:15\n [<ffffffff8174d3cc>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:156\n [<     inline     >] print_address_description mm/kasan/report.c:194\n [<ffffffff8174d666>] kasan_report_error+0x1f6/0x4d0 mm/kasan/report.c:283\n [<     inline     >] kasan_report mm/kasan/report.c:303\n [<ffffffff8174db7e>] __asan_report_store8_noabort+0x3e/0x40 mm/kasan/report.c:329\n [<     inline     >] __write_once_size ./include/linux/compiler.h:249\n [<     inline     >] __hlist_del ./include/linux/list.h:622\n [<     inline     >] hlist_del_init ./include/linux/list.h:637\n [<ffffffff8579047e>] l2tp_ip6_close+0x22e/0x290 net/l2tp/l2tp_ip6.c:239\n [<ffffffff850b2dfd>] inet_release+0xed/0x1c0 net/ipv4/af_inet.c:415\n [<ffffffff851dc5a0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:422\n [<ffffffff84c4581d>] sock_release+0x8d/0x1d0 net/socket.c:570\n [<ffffffff84c45976>] sock_close+0x16/0x20 net/socket.c:1017\n [<ffffffff817a108c>] __fput+0x28c/0x780 fs/file_table.c:208\n [<ffffffff817a1605>] ____fput+0x15/0x20 fs/file_table.c:244\n [<ffffffff813774f9>] task_work_run+0xf9/0x170\n [<ffffffff81324aae>] do_exit+0x85e/0x2a00\n [<ffffffff81326dc8>] do_group_exit+0x108/0x330\n [<ffffffff81348cf7>] get_signal+0x617/0x17a0 kernel/signal.c:2307\n [<ffffffff811b49af>] do_signal+0x7f/0x18f0\n [<ffffffff810039bf>] exit_to_usermode_loop+0xbf/0x150 arch/x86/entry/common.c:156\n [<     inline     >] prepare_exit_to_usermode arch/x86/entry/common.c:190\n [<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0 arch/x86/entry/common.c:259\n [<ffffffff85e4d726>] entry_SYSCALL_64_fastpath+0xc4/0xc6\nObject at ffff8800081b0ec0, in cache L2TP/IPv6 size: 1448\nAllocated:\nPID = 10987\n [ 1116.897025] [<ffffffff811ddcb6>] save_stack_trace+0x16/0x20\n [ 1116.897025] [<ffffffff8174c736>] save_stack+0x46/0xd0\n [ 1116.897025] [<ffffffff8174c9ad>] kasan_kmalloc+0xad/0xe0\n [ 1116.897025] [<ffffffff8174cee2>] kasan_slab_alloc+0x12/0x20\n [ 1116.897025] [<     inline     >] slab_post_alloc_hook mm/slab.h:417\n [ 1116.897025] [<     inline     >] slab_alloc_node mm/slub.c:2708\n [ 1116.897025] [<     inline     >] slab_alloc mm/slub.c:2716\n [ 1116.897025] [<ffffffff817476a8>] kmem_cache_alloc+0xc8/0x2b0 mm/slub.c:2721\n [ 1116.897025] [<ffffffff84c4f6a9>] sk_prot_alloc+0x69/0x2b0 net/core/sock.c:1326\n [ 1116.897025] [<ffffffff84c58ac8>] sk_alloc+0x38/0xae0 net/core/sock.c:1388\n [ 1116.897025] [<ffffffff851ddf67>] inet6_create+0x2d7/0x1000 net/ipv6/af_inet6.c:182\n [ 1116.897025] [<ffffffff84c4af7b>] __sock_create+0x37b/0x640 net/socket.c:1153\n [ 1116.897025] [<     inline     >] sock_create net/socket.c:1193\n [ 1116.897025] [<     inline     >] SYSC_socket net/socket.c:1223\n [ 1116.897025] [<ffffffff84c4b46f>] SyS_socket+0xef/0x1b0 net/socket.c:1203\n [ 1116.897025] [<ffffffff85e4d685>] entry_SYSCALL_64_fastpath+0x23/0xc6\nFreed:\nPID = 10987\n [ 1116.897025] [<ffffffff811ddcb6>] save_stack_trace+0x16/0x20\n [ 1116.897025] [<ffffffff8174c736>] save_stack+0x46/0xd0\n [ 1116.897025] [<ffffffff8174cf61>] kasan_slab_free+0x71/0xb0\n [ 1116.897025] [<     inline     >] slab_free_hook mm/slub.c:1352\n [ 1116.897025] [<     inline     >] slab_free_freelist_hook mm/slub.c:1374\n [ 1116.897025] [<     inline     >] slab_free mm/slub.c:2951\n [ 1116.897025] [<ffffffff81748b28>] kmem_cache_free+0xc8/0x330 mm/slub.c:2973\n [ 1116.897025] [<     inline     >] sk_prot_free net/core/sock.c:1369\n [ 1116.897025] [<ffffffff84c541eb>] __sk_destruct+0x32b/0x4f0 net/core/sock.c:1444\n [ 1116.897025] [<ffffffff84c5aca4>] sk_destruct+0x44/0x80 net/core/sock.c:1452\n [ 1116.897025] [<ffffffff84c5ad33>] __sk_free+0x53/0x220 net/core/sock.c:1460\n [ 1116.897025] [<ffffffff84c5af23>] sk_free+0x23/0x30 net/core/sock.c:1471\n [ 1116.897025] [<ffffffff84c5cb6c>] sk_common_release+0x28c/0x3e0 ./include/net/sock.h:1589\n [ 1116.897025] [<ffffffff8579044e>] l2tp_ip6_close+0x1fe/0x290 net/l2tp/l2tp_ip6.c:243\n [ 1116.897025] [<ffffffff850b2dfd>] inet_release+0xed/0x1c0 net/ipv4/af_inet.c:415\n [ 1116.897025] [<ffffffff851dc5a0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:422\n [ 1116.897025] [<ffffffff84c4581d>] sock_release+0x8d/0x1d0 net/socket.c:570\n [ 1116.897025] [<ffffffff84c45976>] sock_close+0x16/0x20 net/socket.c:1017\n [ 1116.897025] [<ffffffff817a108c>] __fput+0x28c/0x780 fs/file_table.c:208\n [ 1116.897025] [<ffffffff817a1605>] ____fput+0x15/0x20 fs/file_table.c:244\n [ 1116.897025] [<ffffffff813774f9>] task_work_run+0xf9/0x170\n [ 1116.897025] [<ffffffff81324aae>] do_exit+0x85e/0x2a00\n [ 1116.897025] [<ffffffff81326dc8>] do_group_exit+0x108/0x330\n [ 1116.897025] [<ffffffff81348cf7>] get_signal+0x617/0x17a0 kernel/signal.c:2307\n [ 1116.897025] [<ffffffff811b49af>] do_signal+0x7f/0x18f0\n [ 1116.897025] [<ffffffff810039bf>] exit_to_usermode_loop+0xbf/0x150 arch/x86/entry/common.c:156\n [ 1116.897025] [<     inline     >] prepare_exit_to_usermode arch/x86/entry/common.c:190\n [ 1116.897025] [<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0 arch/x86/entry/common.c:259\n [ 1116.897025] [<ffffffff85e4d726>] entry_SYSCALL_64_fastpath+0xc4/0xc6\nMemory state around the buggy address:\n ffff8800081b0d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff8800081b0e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n>ffff8800081b0e80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb\n                                                    ^\n ffff8800081b0f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff8800081b0f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\n==================================================================\n\nThe same issue exists with l2tp_ip_bind() and l2tp_ip_bind_table.\n\nBug: 33753815\nChange-Id: I3313e481d3cdc4bc2c5f898f5ef933dbaf85374b\nFixes: c51ce49735c1 (\"l2tp: fix oops in L2TP IP sockets for connect() AF_UNSPEC case\")\nReported-by: Baozeng Ding <sploving1@gmail.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Baozeng Ding <sploving1@gmail.com>\nSigned-off-by: Guillaume Nault <g.nault@alphalink.fr>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/037161c7fa8f872ab7d105623908dab2dd6551ea"},{"sha":"4dbb902ba13648245676cd6daba08f3aed0dacff","author":{"name":"Subash Abhinov Kasiviswanathan","email":"cb27acb5bfbe78054ecbc5d329a00e60c1019de9@codeaurora.org"},"message":"net: rmnet_data: Fix incorrect netlink handling\n\nrmnet_data netlink handler currently does not check for the\nincoming process pid and instead just loops back the pid.\nA malicious root user could potentially send a message with\nsource pid 0 and this could cause rmnet_data to loop the message\nback till an out of memory situation occurs.\n\nrmnet_data also does not check for the message length of the\nincoming netlink messages and instead casts the netlink message\nwithout checking for the boundary.\n\nFix these two scenarios by adding the pid and message length checks\nrespectively.\n\nBug: 31252965\nCRs-Fixed: 1098801\nChange-Id: I172c1a7112e67e82959b397af7ddfd963d819bdc\nSigned-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/4dbb902ba13648245676cd6daba08f3aed0dacff"},{"sha":"64a013de4a3774d3d5f18df6485a08aeaf121868","author":{"name":"Steve Pfetsch","email":"bb211e4bef0918e20e6005fce72228c45515844d@google.com"},"message":"msm: kgsl: Reserve a context ID slot but don't populate immediately\n\nWhen creating a context allocate an ID but don't populate the slot\nwith the context pointer until we are done setup up the rest of the\nprocess. This avoids a race if somebody tries to free the same\nidentifier before the create operation is complete.\n\nBug: 31824853\nChange-Id: Ic0dedbadca5b4cc4ce567afad48a33078b549439","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/64a013de4a3774d3d5f18df6485a08aeaf121868"},{"sha":"4e9fbb4da550ccaa02030abd47db76559022a76b","author":{"name":"Daniel Rosenberg","email":"ba8cfe5d21fcfdde5eed8cabcaff0549d9612a2a@google.com"},"message":"ANDROID: ion: check for kref overflow\n\nUserspace can cause the kref to handles to increment\narbitrarily high. Ensure it does not overflow.\n\nSigned-off-by: Daniel Rosenberg <drosen@google.com>\n\nBug: 31992382\nTest: See bug for poc\nChange-Id: I6bff1df385742b1d836d43180dc87fadcea80782","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/4e9fbb4da550ccaa02030abd47db76559022a76b"},{"sha":"53d7de511238b84fb44fafdb1e234aa51c6d3428","author":{"name":"Krishnankutty Kolathappilly","email":"f9f7e39bce52d5931331fd99f82156a19f3a674c@codeaurora.org"},"message":"msm: camera: fix bound check of offset to avoid overread overwrite\n\nfix bound check of hw_cmd_p->offset in msm_jpeg_hw_exec_cmds\nto avoid overread overwrite.\n\nCRs-Fixed: 1088824\n\nBug: 32342399\nChange-Id: Ifaa4b5387d4285ddce16d8e745aa0500c64c568b\nSigned-off-by: Krishnankutty Kolathappilly <kkolatha@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/53d7de511238b84fb44fafdb1e234aa51c6d3428"},{"sha":"52debac37e46b1a2854ef54b8bdac6b60190260f","author":{"name":"Krishnankutty Kolathappilly","email":"f9f7e39bce52d5931331fd99f82156a19f3a674c@codeaurora.org"},"message":"msm: cpp: Fix for buffer overflow in cpp.\n\nFix for buffer overflow while handling ioctl.\nInstead of checking for length boundary, fix checks\nfor exact length.\n\nCRs-Fixed: 518731\nBug: 32709702\nChange-Id: I9002f84b219e8b06ae0672d87c2d999e728a75aa\nSigned-off-by: Krishnankutty Kolathappilly <kkolatha@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/52debac37e46b1a2854ef54b8bdac6b60190260f"},{"sha":"188c310189a2da13de0edc66f580a6788181eb55","author":{"name":"guyang","email":"91b4dd685d03da226887ec1c46361aeb0d74fa1c@codeaurora.org"},"message":"msm: camera: sensor: Validate eeprom_name string length\n\nValidate eeprom_name string length before copying into\nthe userspace buffer.\nIf more data than required is copied, userspace has the access to\nsome of kernel data which is not intended.\n\nCRs-Fixed: 1090007\nBug: 32720522\nChange-Id: Id40a287e0b1a93cc15d9b02c757fe9f347e285f2\nSigned-off-by: Rajesh Bondugula <rajeshb@codeaurora.org>\nSigned-off-by: VijayaKumar T M <vtmuni@codeaurora.org>\nSigned-off-by: Yang Guang <guyang@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/188c310189a2da13de0edc66f580a6788181eb55"},{"sha":"01a0544b466fe92389749cc7c421047391b1ae70","author":{"name":"Zhen Kong","email":"b999fb1d59364862997bac94d5b793be36d63b01@codeaurora.org"},"message":"msm: crypto: fix issues on digest buf and copy_from_user in qcedev.c\n\nMake the digest length not larger than the size of the buffer\nqcedev_areq.sha_op_req.digest; and use the checked variants of\nthe copy_from/to_user() APIs to avoid small race window of their\nunchecked variants.\n\nBug: 31750232\nChange-Id: I3db0c20ac5fa47ed278f3d60368c406f472430c1\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>\nSigned-off-by: Wei Wang <wvw@google.com>","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/01a0544b466fe92389749cc7c421047391b1ae70"},{"sha":"ed17190caddeb4c42b192381e3d7eb70eed99872","author":{"name":"Eric Laurent","email":"053c69dacca5c57f9158152124c32f27e884fe63@google.com"},"message":"Revert \"Revert \"Revert \"Fix backend connection to FE upon call disconnection\"\"\"\n\nThis reverts commit ebe4556a423deffa5f0f7b0ca81f69f466d99ca6.\n\nBug: 34184743\nBug: 29316883","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/ed17190caddeb4c42b192381e3d7eb70eed99872"},{"sha":"ae499664624f3ca27f20681477b6c747db4d23a1","author":{"name":"Lorenzo Colitti","email":"bb03c7a1072f7993eaae5ac54ef7bc06e4588478@google.com"},"message":"shamu: config: enable CONFIG_CRYPTO_SHA512 and savedefconfig\n\nBug: 28279646\nChange-Id: Id67023b166631d9b899bf2292b53d591944e8e23","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/ae499664624f3ca27f20681477b6c747db4d23a1"},{"sha":"8a78e9c22159df17085ad78372ec5b3f2f8264ad","author":{"name":"Insun Song","email":"45d44d5682fa0b63007f01ad2f8d1a80dd09e336@broadcom.com"},"message":"net: wireless: bcmdhd: fix buffer overrun in wl_android_set_roampref\n\nadded boundary check not to override allocated buffer.\nSpecially when user input corrupted or manipulated.\n\nSigned-off-by: Insun Song <insun.song@broadcom.com>\nChange-Id: Id6196da10111517696eda5f186b1e2dd19f66085\nBug: 34469904","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/8a78e9c22159df17085ad78372ec5b3f2f8264ad"},{"sha":"5be13fab6630275fc46c232780c3f764909f6a3e","author":{"name":"Neeraj Soni","email":"2be49f7b1e8bee370ca3efb735a27cb273e7e66a@codeaurora.org"},"message":"FROMLIST: qcrypto: protect potential integer overflow.\n\nAdding user passed parameters without check might\nlead to Integer overflow and unpredictable system\nbehaviour.\n\nBug: 34389927\nChange-Id: Iaf8259e3c4a157e1790f1447b1b62a646988b7c4\nSigned-off-by: Neeraj Soni <neersoni@codeaurora.org>\nSigned-off-by: Steve Pfetsch <spfetsch@google.com>\n(am from https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=bd9a8fc6d7f6bd1a0b936994630006de450df657)","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/5be13fab6630275fc46c232780c3f764909f6a3e"},{"sha":"584e106649a02a6e27c784326cfbb08110804cc6","author":{"name":"Sudhir Kohalli","email":"a5742d8f80f6bc0f6057f1af8af8e6564499dcd2@broadcom.com"},"message":"net: wireless: bcmdhd: Heap overflow in wl_run_escan.\n\n1) The default_chan_list buffer overflow is avoided by checking\nn_nodfs index does not exceed num_chans, which is the length\nof default_chan_list buffer.\n2) The SSID length check 32(max limit) is done and then the SSID\nname copied in extra buffer is null terminated. The extra buffer\nis allocated a length of of 33 in wl_iw_ioctl.c.\n3) Issue of chances of cumulative results->pkt_count length\nexceeding allocated memory length of results->total_count is\navoided in this fix. change_array is the destination array\nwhose length is allocated to results->total_count.\n\nSigned-off-by: Sudhir Kohalli <sudhir.kohalli@broadcom.com>\n\nBug: 34197514\nBug: 34199963\nBug: 34198729\n\nChange-Id: I0cd268ab696daac938a99f451607a3f4b2cfaed3","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/584e106649a02a6e27c784326cfbb08110804cc6"},{"sha":"370338f81a19d0611e7b62c3e649983102dd46b9","author":{"name":"Biswajit Paul","email":"7ee5649c8de55a61a3bbcbc7dcde16c04b2f65da@codeaurora.org"},"message":"crypto: msm: check integer overflow on total data len in qcedev.c\n\nqcedev_vbuf_ablk_cipher will calculate total data length. It starts\nwith the value of \"areq->cipher_op_req.byteoffset\", which is controlled\nby the user. Make change to check if this total data length has integer\noverflow issue in qcedev_check_cipher_params.\n\nBug: 33544431\nCRs-Fixed: 1103089\nChange-Id: Ice42dca6d47eb8febfe8a34e566c69e4799fab57\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>\nSigned-off-by: Biswajit Paul <biswajitpaul@codeaurora.org>\nSigned-off-by: Steve Pfetsch <spfetsch@google.com>","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/370338f81a19d0611e7b62c3e649983102dd46b9"},{"sha":"56525d5fd375eabef2bf598a6e8bc466dfd68f91","author":{"name":"Miklos Szeredi","email":"c27ee2952768e22f4d3ab9aec0e78ac5f4ddea98@suse.cz"},"message":"BACKPORT: fs: limit filesystem stacking depth\n\nAdd a simple read-only counter to super_block that indicates how deep this\nis in the stack of filesystems.  Previously ecryptfs was the only stackable\nfilesystem and it explicitly disallowed multiple layers of itself.\n\nOverlayfs, however, can be stacked recursively and also may be stacked\non top of ecryptfs or vice versa.\n\nTo limit the kernel stack usage we must limit the depth of the\nfilesystem stack.  Initially the limit is set to 2.\n\nSigned-off-by: Miklos Szeredi <mszeredi@suse.cz>\n\n(cherry picked from commit 69c433ed2ecd2d3264efd7afec4439524b319121)\n\nBug: 32761463\nChange-Id: I69b2fba2112db2ece09a1bf61a44f8fc4db00820","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/56525d5fd375eabef2bf598a6e8bc466dfd68f91"},{"sha":"57afd13b9969acd44b12f7a4be0c37cd5e16efbc","author":{"name":"Andrew Chant","email":"74abe530dd61f06b906af7d23d7dcf61131999f9@google.com"},"message":"sdcardfs: limit stacking depth\n\nLimit filesystem stacking to prevent stack overflow.\n\nBug: 32761463\nChange-Id: I8b1462b9c0d6c7f00cf110724ffb17e7f307c51e\nSigned-off-by: Andrew Chant <achant@google.com>","distinct":true,"url":"https://api.github.com/repos/rogersb11/android_kernel_moto_shamu/commits/57afd13b9969acd44b12f7a4be0c37cd5e16efbc"}]}
{"actor":{"display_login":"rogersb11"}}