{"push_id":1920178932,"size":13,"distinct_size":13,"ref":"refs/heads/mkn-mr1","head":"ffbb59535d2f6035cd74e94ec25ab01348051eb7","before":"13b4452baa3721921b7e26d068dc7c5d660a7be2","commits":[{"sha":"1af290d1e7d788fa38f23b807165998c970479fe","author":{"name":"Stuart Scott","email":"b77b697c61487cecba340e1b895b4971f4cb200d@google.com"},"message":"Merge android-msm-angler-3.10-nyc-mr2 into android-msm-angler-3.10-nyc-mr2-security-next\n\nJuly 2017","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/1af290d1e7d788fa38f23b807165998c970479fe"},{"sha":"e7fdc1ca00f1e589df8542af7e7acaaa87370625","author":{"name":"Insun Song","email":"45d44d5682fa0b63007f01ad2f8d1a80dd09e336@broadcom.com"},"message":"net: wireless: bcmdhd: additional length check for BRCM EVENT frame.\n\nThis is just for exceptional case where user has updated kernel to the\nlatest, but still used non-patched firmware. The non-patched firmware\ncould deliver ETHER_TYPE_BRCM packet to host.\n\nIf attacker inject packet with its header length forged, it could bypass\ncurrent host driver's length check routine and cause memory corruption.\n\nProposed fix is enhancing length check to validate its header length.\n\nChange-Id: I90fc5101bddfd1d427e0a52758ddf8bc16577555\nBug: 37168488\nSigned-off-by: Insun Song <insun.song@broadcom.com>","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/e7fdc1ca00f1e589df8542af7e7acaaa87370625"},{"sha":"8479c2bc60f5f2f6d72c41269e21a53e9d43a438","author":{"name":"Jin Qian","email":"0a9aa3d3574a19f4323dcc26c6c102ebcca97ce1@google.com"},"message":"UPSTREAM: f2fs: sanity check segment count\n\ncommit b9dd46188edc2f0d1f37328637860bb65a771124 upstream.\n\nF2FS uses 4 bytes to represent block address. As a result, supported\nsize of disk is 16 TB and it equals to 16 * 1024 * 1024 / 2 segments.\n\nSigned-off-by: Jin Qian <jinqian@google.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nBug: 36815012\nChange-Id: I30ea36df066bc07e32e767336b7cae12063fe415","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/8479c2bc60f5f2f6d72c41269e21a53e9d43a438"},{"sha":"0561402944df9d8590c18a90fe59f37e08be3227","author":{"name":"Dennis Cagle","email":"1c958d084f7278f93cbdf16f75fd9d20fa6ac1af@codeaurora.org"},"message":"qcdev: Check the digest length during the SHA operations\n\nCheck the digest length to avoid buffer overflow while\ndoing the SHA operations.\n\nBug: 36591162\nCRs-Fixed: 2045061\nChange-Id: I4d3fb20723f59e905a672edaf84ee5d0865905b1\nSigned-off-by: Brahmaji K <bkomma@codeaurora.org>\nSigned-off-by: Dennis Cagle <d-cagle@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/0561402944df9d8590c18a90fe59f37e08be3227"},{"sha":"d4e8bc6c31d63ff12617d2d9a087e1aec475dcba","author":{"name":"Jin Qian","email":"0a9aa3d3574a19f4323dcc26c6c102ebcca97ce1@android.com"},"message":"BACKPORT: f2fs: sanity check checkpoint segno and blkoff\n\nMake sure segno and blkoff read from raw image are valid.\n\nFixed conflicts due to missing commit 1e968fdfe69e\n(\"f2fs: introduce f2fs_cp_error for readability\") and commit 6bacf52fb58a\n(\"f2fs: add unlikely() macro for compiler more aggressively\").\n\n(url https://sourceforge.net/p/linux-f2fs/mailman/message/35835945)\n\nSigned-off-by: Jin Qian <jinqian@google.com>\nSigned-off-by: Siqi Lin <siqilin@google.com>\nBug: 36588520\nChange-Id: Iba66ab97d3d0870ea48b5ef192d9075f225a934a","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/d4e8bc6c31d63ff12617d2d9a087e1aec475dcba"},{"sha":"64b103bd5d954b712bd38aa91a34827f1b353594","author":{"name":"Sunil Khatri","email":"c2fa09c6a63ee27656efbed7bd5e770f84d009d0@codeaurora.org"},"message":"msm: kgsl: Fix the race between context create and destroy\n\nHold the context lock before updating the context id in\nparam->drawctxt_id to avoid race condition between context\ncreation and context destroy.\n\nBug: 36491445\nChange-Id: Ic26d3e5b68078c02d15c38080b1a262ea4b1f7fe\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/64b103bd5d954b712bd38aa91a34827f1b353594"},{"sha":"afba606957ecb1c03e46f72fbe27b9b11623d38d","author":{"name":"Thomas Gleixner","email":"352b5f5ba0189d2583768a9bb8247f98115b9038@linutronix.de"},"message":"UPSTREAM: timerfd: Protect the might cancel mechanism proper\n\n(cherry picked from commit 1e38da300e1e395a15048b0af1e5305bd91402f6)\n\nThe handling of the might_cancel queueing is not properly protected, so\nparallel operations on the file descriptor can race with each other and\nlead to list corruptions or use after free.\n\nProtect the context for these operations with a seperate lock.\n\nThe wait queue lock cannot be reused for this because that would create a\nlock inversion scenario vs. the cancel lock. Replacing might_cancel with an\natomic (atomic_t or atomic bit) does not help either because it still can\nrace vs. the actual list operation.\n\nBug: 36266767\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: \"linux-fsdevel@vger.kernel.org\"\nCc: syzkaller <syzkaller@googlegroups.com>\nCc: Al Viro <viro@zeniv.linux.org.uk>\nCc: linux-fsdevel@vger.kernel.org\nLink: http://lkml.kernel.org/r/alpine.DEB.2.20.1701311521430.3457@nanos\nChange-Id: I122753e0920e51757d3012cd1a133e823719be51","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/afba606957ecb1c03e46f72fbe27b9b11623d38d"},{"sha":"4d576a4311b83e89d457bdddb5e5ef6ad63b2749","author":{"name":"kunleiz","email":"d4e58ca4014670c4a37cca38404738a894db0b88@codeaurora.org"},"message":"ASoC: msm: qdspv2: add result check when audio process fail\n\nA audio_process_event_req is not always to success. Therefore,\ncheck the return value for audio_process_event_req, and\ninitializ usr_evt before using it.\n\nCRs-Fixed: 2029798\nBug: 35764875\nChange-Id: I4adf682575f5f9233a1a1a533f9c6361af8a5bcf\nSigned-off-by: kunleiz <kunleiz@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/4d576a4311b83e89d457bdddb5e5ef6ad63b2749"},{"sha":"ada4869e7da030f27d5904c156dc2fcdd070deaf","author":{"name":"Utkarsh Saxena","email":"a77f4916ff39fc133abd3bb49cf55a0c1b56ef54@codeaurora.org"},"message":"msm: ipa: Fix for missing int overflow check in the refcount library\n\nOverflow of reference counter can lead to memory leak.\n\nBefore incrementing the reference count, check with\nU32_MAX and return for error check.\n\nBug: 35467471\nChange-Id: Ib96d36574ee086ec73c9836110cb2c98e8ae3d66\nAcked-by: Mohammed Javid <mjavid@qti.qualcomm.com>\nSigned-off-by: Utkarsh Saxena <usaxena@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/ada4869e7da030f27d5904c156dc2fcdd070deaf"},{"sha":"5d70d641f4403b823310a29900b5ad264314a2ef","author":{"name":"Pratham Pratap","email":"6eaa4d07227fe665a92f21158a818077ad59715f@codeaurora.org"},"message":"USB: f_qc_rndis: Prevent use-after-free for _rndis_qc\n\nAssume that there are two threads, thread1 is setting\nvalue of _rndis_qc variable in rndis_qc_bind_config_vendor\nfunction. Thread2 jumps in and get the value of _rndis_qc\nin rndis_qc_open_dev function before it is freed in\nrndis_qc_bind_config_vendor function, since rndis_ipa_init\nor usb_add_function failed. Use-after-free will happen as\nThread2 is referencing freed objects. To prevent this\nspinlock is used where ever it is needed to protect\n_rndis_qc variable.\n\nBug: 35136547\nChange-Id: Ibfe10cedc18bcb19dd01cd2bec43a5554fd008bc\nSigned-off-by: Pratham Pratap <prathampratap@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/5d70d641f4403b823310a29900b5ad264314a2ef"},{"sha":"5b0be8f02fecc35f2a71fa3d5dfd0eead8de7bea","author":{"name":"Stuart Scott","email":"b77b697c61487cecba340e1b895b4971f4cb200d@google.com"},"message":"Merge android-msm-angler-3.10-nyc-mr2-security-next into android-msm-angler-3.10-nyc-mr2\n\nAugust 2017.1\n\nBug: 62368622\nChange-Id: I3df095e1732993310b28820c39435dd032f15f0e","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/5b0be8f02fecc35f2a71fa3d5dfd0eead8de7bea"},{"sha":"04d1557af1259b211609fa41adbe852b5f9cf2da","author":{"name":"razorloves","email":"1de006648111f4e78ad845b8c417635bfcddfae1@gmail.com"},"message":"Merge branch 'aosp/android-msm-angler-3.10-nougat-mr2' into cm-14.1\n\nN2G48C August 2017 android-7.1.2_r0.26\n\n  5d70d64 USB: f_qc_rndis: Prevent use-after-free for _rndis_qc\n  ada4869 msm: ipa: Fix for missing int overflow check in the refcount library\n  4d576a4 ASoC: msm: qdspv2: add result check when audio process fail\n  afba606 UPSTREAM: timerfd: Protect the might cancel mechanism proper\n  64b103b msm: kgsl: Fix the race between context create and destroy\n  d4e8bc6 BACKPORT: f2fs: sanity check checkpoint segno and blkoff\n  0561402 qcdev: Check the digest length during the SHA operations\n  8479c2b UPSTREAM: f2fs: sanity check segment count\n  e7fdc1c net: wireless: bcmdhd: additional length check for BRCM EVENT frame.\n\nChange-Id: I37e2c572c997a22ab3638a521d67d7261baf5d49","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/04d1557af1259b211609fa41adbe852b5f9cf2da"},{"sha":"ffbb59535d2f6035cd74e94ec25ab01348051eb7","author":{"name":"martincz","email":"9eccfaca879daa038a410859bd0ef76c6c204ee6@mokeedev.com"},"message":"Merge branch 'remote' into mkn-mr1","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_huawei_angler/commits/ffbb59535d2f6035cd74e94ec25ab01348051eb7"}]}
{"actor":{"display_login":"mokeeopensource"}}