{"push_id":1780689845,"size":130,"distinct_size":0,"ref":"refs/heads/cm-14.1","head":"c0640daadaa0dd14ec8d77665fedac83e917e91d","before":"345609d8ae9c30147c6568502bdfad0a1bf39514","commits":[{"sha":"90fbbe0c6a9da25121a55208e7855a1672fe70e6","author":{"name":"Mohit Aggarwal","email":"e312531ff0a491048a1f78294d19bb12f0137756@codeaurora.org"},"message":"diag: Set in_busy only after initialization of read buffers\n\nCurrently, there is a possibility that read buffers are\nnot initialized but diag ends up marking buffers busy and\nstops reading from peripheral, which leads to port loss.\nAlso reset the in_busy variable for the buffer that reads\nthe data from smd channel when diag smd state is closed.\n\nCRs-Fixed: 1093989\nChange-Id: I1990d0ded5a212c9185c149ac297a3630d64bc59\nSigned-off-by: Mohit Aggarwal <maggarwa@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/90fbbe0c6a9da25121a55208e7855a1672fe70e6"},{"sha":"88e85317ad4f8b8334e032e28e8a1e3dffb54ef6","author":{"name":"Subash Abhinov Kasiviswanathan","email":"cb27acb5bfbe78054ecbc5d329a00e60c1019de9@codeaurora.org"},"message":"xt_qtaguid: Fix kmemleak error in TIME_WAIT sockets\n\nThis reverts commit 4335ab135ed54a4 (\"xt_qtaguid: check xt_sock\nsocket before releasing\"). This commit causes kmemleak errors\nwith the following trace -\n\nunreferenced object (size 184):\n  comm \"softirq\", pid 0, jiffies 14724 (age 4906.640s)\n  hex dump (first 32 bytes):\n    3d 6e f5 25 0a be 6e 8a c9 d8 bb c2 00 50 72 cb  =n.%..n......Pr.\n    02 00 06 80 00 00 00 00 00 00 00 00 58 8a 42 c5  ............X.B.\n  backtrace:\n    inet_twsk_alloc+0x40/0x1e8\n    tcp_time_wait+0x48/0x1fc\n    tcp_rcv_state_process+0xa74/0xc10\n    tcp_v4_do_rcv+0x2c8/0x338\n    tcp_v4_rcv+0x4f8/0x8fc\n    ip_local_deliver_finish+0x130/0x2c0\n    ip_rcv_finish+0x2d0/0x348\n    __netif_receive_skb_core+0x710/0x7c4\n    netif_receive_skb_internal+0x60/0xac\n    __rmnet_deliver_skb+0x1ec/0x3f8\n    __netif_receive_skb_core+0x588/0x7c4\n    process_backlog+0x90/0x14c\n    net_rx_action+0xb4/0x234\n    __do_softirq+0x14c/0x370\n    irq_exit+0x84/0xe0\n    handle_IPI+0x120/0x354\n\nThis is because xt_qtaguid holds on to references incorrectly and\nnever releases the slab cache even after the time wait socket\ntimer expiry.\n\ninet_twsk_alloc TCP created tw atomic_read(&tw->tw_refcnt) 0, called\nfrom tcp_time_wait+0x48/0x1fc\ninet_twsk_alloc tw tw->tw_daddr 61.110.245.37 tw->tw_rcv_saddr\n10.190.110.138 tw->tw_sport 29387 tw->tw_dport 20480\ntcp_time_wait tw atomic_read(&tw->tw_refcnt) 3, called from\ntcp_rcv_state_process+0xa74/0xc10\ntcp_time_wait inet_twsk_schedule tw atomic_read (&tw->tw_refcnt) 4,\ncalled from tcp_rcv_state_process+0xa74/0xc10\ninet_twsk_put tw atomic_read(&tw->tw_refcnt) 4, called from\ntcp_time_wait+0x1b0/0x1fc\nxt_socket: xt_socket_get4_sk tw atomic_read(&tw->tw_refcnt) 4, called\nfrom qtaguid_mt+0x568/0x8bc\nxt_socket: xt_socket_get4_sk tw if (sk) atomic_read (&tw->tw_refcnt)\n5, called from qtaguid_mt+0x568/0x8bc\nxt_socket: xt_socket_get4_sk tw atomic_read(&tw->tw_refcnt) 5, called\nfrom qtaguid_mt+0x568/0x8bc\nxt_socket: xt_socket_get4_sk tw if (sk) atomic_read (&tw->tw_refcnt)\n6, called from qtaguid_mt+0x568/0x8bc\nxt_socket: xt_socket_get4_sk tw atomic_read(&tw->tw_refcnt) 6, called\nfrom qtaguid_mt+0x568/0x8bc\nxt_socket: xt_socket_get4_sk tw if (sk) atomic_read (&tw->tw_refcnt)\n7, called from qtaguid_mt+0x568/0x8bc\nxt_socket: xt_socket_get4_sk tw atomic_read(&tw->tw_refcnt) 7, called\nfrom qtaguid_mt+0x568/0x8bc\nxt_socket: xt_socket_get4_sk tw if (sk) atomic_read (&tw->tw_refcnt)\n8, called from qtaguid_mt+0x568/0x8bc\nxt_socket: xt_socket_get4_sk tw atomic_read(&tw->tw_refcnt) 8, called\nfrom qtaguid_mt+0x568/0x8bc\nxt_socket: xt_socket_get4_sk tw if (sk) atomic_read (&tw->tw_refcnt)\n9, called from qtaguid_mt+0x568/0x8bc\ninet_twsk_put tw atomic_read(&tw->tw_refcnt) 9, called from\ntcp_v4_rcv+0x8e0/0x8fc\ntw_timer_handler tw atomic_read(&tw->tw_refcnt) 8, called from\ncall_timer_fn+0x98/0x1e4\ninet_twsk_kill tw atomic_read(&tw->tw_refcnt) 8, called from\ncall_timer_fn+0x98/0x1e4\n__sock_put tw atomic_read(&tw->tw_refcnt) 8, called from\ncall_timer_fn+0x98/0x1e4\n__sock_put tw atomic_read(&tw->tw_refcnt) 7, called from\ninet_twsk_kill+0x104/0x148\ninet_twsk_put tw atomic_read(&tw->tw_refcnt) 6, called from\ncall_timer_fn+0x98/0x1e4\n\nCRs-Fixed: 1090436\nChange-Id: Ib53c51baf351d851c33c196564be43508f531996\nSigned-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/88e85317ad4f8b8334e032e28e8a1e3dffb54ef6"},{"sha":"e741ee698ecd32e5754e7461164bffee7d5acd98","author":{"name":"Manoj Prabhu B","email":"ddf4043a996bf7f608ab271ea96052c669b1253b@codeaurora.org"},"message":"diag: Clear masks upon logging exit\n\nThis patch clears the peripheral masks upon the mdlog exit\nand USB disconnection. This enables to keep the data and\ncmd channel open for read.\n\nCRs-Fixed: 1057143\nChange-Id: Ie6f19319b75f3bf389ddd5a8168fd3bcd3efbc8b\nSigned-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/e741ee698ecd32e5754e7461164bffee7d5acd98"},{"sha":"d1dd6f54ea8820abc88f03d1db213db0990fa631","author":{"name":"Ravi Kishore Tanuku","email":"951278bd0c5a54f6bb2366cc9e73359c7bdd57eb@codeaurora.org"},"message":"msm: camera: Add regulator enable and disable independent of CSID\n\nRegulator enable and disable of CSIPHY depends on the CSID module.\nMake the enable and disable of clk regulator independent of CSIPHY.\n\nCRs-Fixed: 1107702\nChange-Id: Iabb5eb28d63b34a4c3201c53be17054a1907f4fe\nSigned-off-by: Ravi Kishore Tanuku <rktanuku@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/d1dd6f54ea8820abc88f03d1db213db0990fa631"},{"sha":"9094b39181cce7de860307a0c10f51f4134b0091","author":{"name":"Sarada Prasanna Garnayak","email":"5a6c89d8d2d571c394d8fd07c242c922ccf59e68@codeaurora.org"},"message":"wcnss: fix the potential memory leak and heap overflow\n\nThe wcnss platform driver update the wlan calibration data\nby the user space wlan daemon. The wlan user space daemon store\nthe updated wlan calibration data reported by wlan firmware in\nuser space and write it back to the wcnss platform calibration\ndata buffer for the calibration data download and update.\n\nDuring the wlan calibration data store and retrieve operation\nthere are some potential race condition which leads to memory leak\nand buffer overflow during the context switch.\n\nFix the above issue by adding protection code and avoid usage of\nglobal pointer during the device file read and write operation.\n\nCRs-Fixed: 2015858\nChange-Id: Ib5b57eb86dcb4e6ed799b5222d06396eaabfaad3\nSigned-off-by: Sarada Prasanna Garnayak <sgarna@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/9094b39181cce7de860307a0c10f51f4134b0091"},{"sha":"5c7251c708443915f1ca61be1334888561f05ce4","author":{"name":"Harsh Sahu","email":"062485454ca52b6187093d2ba1bac5da25a47a5e@codeaurora.org"},"message":"msm: mdss: fix race condition during mdp debugfs release\n\nFix race condition in the release of the mdp debugfs functions\npanel_debug_base_release and mdss_debug_base_release by adding\nthe lock for unpreempted freeing of the buffer so that multiple\nconcurrent processes cannot affect the release which can possibly\nlead to use-after-free operation on the buffer.\n\nChange-Id: I9586081b65ae2eb0e7f6e30c606ee748ae9ef7e8\nSigned-off-by: Harsh Sahu <hsahu@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/5c7251c708443915f1ca61be1334888561f05ce4"},{"sha":"e0726342d9a3393c5ab6fa8ca141c1fed9392421","author":{"name":"Vijay Viswanath","email":"6c1ebe5cf4266454c737ed00e3cbb90f43c81fb5@codeaurora.org"},"message":"mmc: queue: Remove BUG_ON() in cmdq_thread\n\nIf any discard requests fails, the mmc driver should not cause kernel\npanic. The error handling and informing block layer about error will be\ndone by completion context.\n\nChange-Id: I0c88ad851ad12c392a557bcb94d3b21dfc62d1f8\nSigned-off-by: Vijay Viswanath <vviswana@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/e0726342d9a3393c5ab6fa8ca141c1fed9392421"},{"sha":"8812c0db4fdabb5c2d52304bb267cf13b2b93b4d","author":{"name":"Vijay Viswanath","email":"6c1ebe5cf4266454c737ed00e3cbb90f43c81fb5@codeaurora.org"},"message":"mmc: cmdq_hci: Avoid releasing clock twice during DCMD error\n\nWhen erase DCMD commands fail, a completion notification may get raised\nby host controller for the task in addition to error interrupt. This\ncan result in the done function of mmc request getting called twice\nand release the clock twice and mess up the clock request counter. The\ndone function should be called only once for DCMD commands except flush\ncommands.\n\nChange-Id: Ie3a96e48ca98872cf686049eb5caa060f143f9cb\nSigned-off-by: Vijay Viswanath <vviswana@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/8812c0db4fdabb5c2d52304bb267cf13b2b93b4d"},{"sha":"8dc6f45625620360685e1841613bb4f4a04df12d","author":{"name":"Zhen Kong","email":"b999fb1d59364862997bac94d5b793be36d63b01@codeaurora.org"},"message":"crypto: msm: check invalid src and dst vbuf in qcedev.c\n\nsrc and dst vbuf address and length are provided from userspace,\nand they are invalid if vbuf address is NULL but length is not zero.\nAdd additional checks in qcedev_check_cipher_params to prevent it.\n\nChange-Id: Iadc1a0c1c5b2f7a56acd03a23c08e45b5a671b19\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/8dc6f45625620360685e1841613bb4f4a04df12d"},{"sha":"28e1c1cb4f0839cecc5ed28c178f1f6fd253667c","author":{"name":"Siba Prasad","email":"a31d09afa8a8630808d21e5dc28a684eeb002b4c@codeaurora.org"},"message":"mmc: card: block: check the user controlled parameters to avoid overflow\n\nAccording to specs, some commands require a delay after\nissuing the command. idata->ic struct is received from\nuser in mmc_blk_ioctl_cmd(). So idata->ic.postsleep_min_us,\nidata->ic.postsleep_max_us are user controlled. If the min\nand max values are set such as max < min, then operation in\nthe function do_usleep_range will overflow. For avoiding this,\nput a condition for checking max < min. If the condition is\ntrue, then print the error message with respective values and\nreturn error.\n\nChange-Id: I3722b8527a7caa6a76dafb9fd23187e77f2478ee\nSigned-off-by: Siba Prasad <sibap@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/28e1c1cb4f0839cecc5ed28c178f1f6fd253667c"},{"sha":"6ad18713ff619fb3addf1719fddd6d49f7328248","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"crypto: msm: check invalid src and dst vbuf in qcedev.c\"","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/6ad18713ff619fb3addf1719fddd6d49f7328248"},{"sha":"1d8928e96614de19f6fb98f0a73171d3fbdeaac6","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"mmc: card: block: check the user controlled parameters to avoid overflow\"","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/1d8928e96614de19f6fb98f0a73171d3fbdeaac6"},{"sha":"7dd2c05b1e537f6d6ae559cf393b9a905c4be281","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"msm: camera: Add regulator enable and disable independent of CSID\"","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/7dd2c05b1e537f6d6ae559cf393b9a905c4be281"},{"sha":"5e01eacf7166bc2ae2cd8119c2798e69efcfa10a","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"wcnss: fix the potential memory leak and heap overflow\"","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/5e01eacf7166bc2ae2cd8119c2798e69efcfa10a"},{"sha":"98d58c75d63bf63bd7b48eae639f8c4255057e12","author":{"name":"Avaneesh Kumar Dwivedi","email":"b339f080ee8b04edc75ec63bdee32f79ce568df7@codeaurora.org"},"message":"soc: qcom: Skip clearing modem FW region post load failure\n\nIn existing implementation, we are clearing fw region when loading fails\nmidway. This is not in consonance with MBA design so differentiate\nbetween modem and other PIL modules. While at it, rectify the data type\nof subsys_state in qmi_client_info as well.\n\nChange-Id: I985456fca42346947eac24df5bf66599dcbf4c53\nSigned-off-by: Avaneesh Kumar Dwivedi <akdwived@codeaurora.org>\nSigned-off-by: Srinivasarao P <spathi@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/98d58c75d63bf63bd7b48eae639f8c4255057e12"},{"sha":"86e5f06e101197063fa309a0cc651fb729a83fdf","author":{"name":"Kishor PK","email":"59e3e0452a674ecf9c3b6490ddfc6768fdd530bb@codeaurora.org"},"message":"soc: qcom: pil: Avoid possible buffer overflow during Modem boot\n\nBuffer overflow can occur if MBA firmware size exceeds 1MB.\nSo validate size before copying the firmware.\n\nChange-Id: I2d5ffc1b9c6db7fd978cb1e4dbd07d283b186a80\nCRs-Fixed: 2001803\nSigned-off-by: Kishor PK <kpbhat@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/86e5f06e101197063fa309a0cc651fb729a83fdf"},{"sha":"1427228ecce16000d1f3b62c61af179aa9c230ff","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"mmc: cmdq_hci: Avoid releasing clock twice during DCMD error\"","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/1427228ecce16000d1f3b62c61af179aa9c230ff"},{"sha":"a3b381a3acb3b79969cb191915545ba11c0df6fa","author":{"name":"Shubhraprakash Das","email":"8a273a295bbc27cd2beb2e282ff0de1aefa8346b@codeaurora.org"},"message":"msm: camera: isp: Check userspace parameters\n\nCheck the user parameters passed to prevent buffer overflow.\n\nChange-Id: Ia8adc88d993db9e4314f3aa85ff5bbb6d7cef31e\nCRs-Fixed: 1097390\nSigned-off-by: Shubhraprakash Das <sadas@codeaurora.org>\nSigned-off-by: Meera Gande <mgande@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/a3b381a3acb3b79969cb191915545ba11c0df6fa"},{"sha":"5f65969ef5d27295c3ab7b479ad3eb9e390b4976","author":{"name":"Harsh Sahu","email":"062485454ca52b6187093d2ba1bac5da25a47a5e@codeaurora.org"},"message":"msm: mdss: Validating data values before passing on as operand\n\nmdss_mdp_dfps_update_params uses data as operand. Hence the values\nare validated against their max values allowed to avoid any overflow\nin this change.\n\nChange-Id: I630b9390a18446cd461154e31e08642a8ff06ed8\nSigned-off-by: Harsh Sahu <hsahu@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/5f65969ef5d27295c3ab7b479ad3eb9e390b4976"},{"sha":"90b5e9ca0b03e8ea4788fd23342b0a68ea4885e5","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"soc: qcom: Skip clearing modem FW region post load failure\"","distinct":false,"url":"https://api.github.com/repos/nvertigo/android_kernel_oneplus_msm8996/commits/90b5e9ca0b03e8ea4788fd23342b0a68ea4885e5"}]}
{"actor":{"display_login":"nvertigo"}}