{"push_id":1985770220,"size":42,"distinct_size":42,"ref":"refs/heads/o8x","head":"05fd89f2cdd2e193990f4e84f35c54670a9e64f4","before":"28abe4f8119639751da37a9126a940c7b2373099","commits":[{"sha":"a7d576e99545ebe4827fc67608b679046a942ec6","author":{"name":"Adrian Salido","email":"6d635a0a76d943c7a6d2808755e208535d850b07@google.com"},"message":"tracing: fix race condition reading saved tgids\n\nCommit 939c7a4f04fc (\"tracing: Introduce saved_cmdlines_size file\")\nintroduced ability to change saved cmdlines size. This resized saved\ncommand lines but missed resizing tgid mapping as well.\n\nAnother issue is that when the resize happens, it removes saved command\nlines and reallocates new memory for it. This introduced a race\ncondition when reading the global savecmd as this can be freed in the\nmiddle of accessing it causing a use after free access. Fix this by\nimplementing locking.\n\nSigned-off-by: Adrian Salido <salidoa@google.com>\nBug: 36007735\nChange-Id: I334791ac35f8bcbd34362ed112aa624275a46947","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/a7d576e99545ebe4827fc67608b679046a942ec6"},{"sha":"4ffd49a20850c217a6c3803a4082d572132938b6","author":{"name":"Insun Song","email":"45d44d5682fa0b63007f01ad2f8d1a80dd09e336@broadcom.com"},"message":"net: wireless: bcmdhd: adding boundary check in wl_notify_rx_mgmt_frame\n\nadded boundary check for input parameters not to corrupt kernel heap in\ncase user injected malformed input\n\nSigned-off-by: Insun Song <insun.song@broadcom.com>\nBug: 37306719\nChange-Id: I6dc12e9bcfce8f3b43ecf14bfd6976bf87afeaa5","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/4ffd49a20850c217a6c3803a4082d572132938b6"},{"sha":"c70a77b899180e48e35312cfc81018f7142ad7fd","author":{"name":"Insun Song","email":"45d44d5682fa0b63007f01ad2f8d1a80dd09e336@broadcom.com"},"message":"net: wireless: bcmdhd: add boundary check in dhd_rtt_event_handler\n\nadded boundary check for input parameters not to corrupt kernel heap in\ncase user injected malformed input\n\nSigned-off-by: Insun Song <insun.song@broadcom.com>\nBug: 37305578\nChange-Id: I92114d7166fb68d8d97b33ea214f80e8917794d1","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/c70a77b899180e48e35312cfc81018f7142ad7fd"},{"sha":"b4b63420abb3bd887215f94d9916949054f5c40d","author":{"name":"Insun Song","email":"45d44d5682fa0b63007f01ad2f8d1a80dd09e336@broadcom.com"},"message":"net: wireless: bcmdhd: adding boundary check for pfn events\n\nadding boundary check for bssid count in dhd_pno_process_epno_result\nand dhd_handle_hotlist_scan_evt function to prevent heap overflow.\n\nSigned-off-by: Insun Song <insun.song@broadcom.com>\nBug: 37722328\nBug: 37722970\nChange-Id: I1f0bc25ef4e7f5ba8f1aa9d9271919ee84d780a1","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/b4b63420abb3bd887215f94d9916949054f5c40d"},{"sha":"febdda507b3a8a9cd502589300bfeaaf2fe86645","author":{"name":"Insun Song","email":"45d44d5682fa0b63007f01ad2f8d1a80dd09e336@broadcom.com"},"message":"net: wireless: bcmdhd: adding boudary check in wl_escan_handler\n\nWLC_E_ESCAN_RESULT event could be manipulated especially two length field\ninside, one is for escan_result buffer length and another one is\nbss_info length, the forged fields may bypass current length check and\ncorrupt kernel heap memory.\n\nso added checking validation for two length fields in WLC_E_ESCAN_RESULT\nevent.\n\nSigned-off-by: Insun Song <insun.song@broadcom.com>\nBug: 37351060\nChange-Id: I31e9fccc48fc06278fb3a87a76ef7337296c2b0d","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/febdda507b3a8a9cd502589300bfeaaf2fe86645"},{"sha":"68155e8f45e0c4fd75d039766cd5d70342906b4b","author":{"name":"Sudhir Kohalli","email":"a5742d8f80f6bc0f6057f1af8af8e6564499dcd2@broadcom.com"},"message":"net: wireless: bcmdhd: add boundary check in GSCAN full result handler\n\nvalidtating each length fields before not to overflow allocated\ndata type. it prevent possiblity heap memory corrupted.\n\nSigned-off-by: Sudhir Kohalli <sudhir.kohalli@broadcom.com>\nBug: 37357704\nChange-Id: I7c04b93f3843c8100bd932fb9b7c67ef76b93050","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/68155e8f45e0c4fd75d039766cd5d70342906b4b"},{"sha":"f19ab2a54e5989144c08f99bb81a6cbedbf0951d","author":{"name":"Mark Zhang","email":"62b7f361e265a7e104f476900c58a6e14256ef39@nvidia.com"},"message":"drm/tegra: host1x: Check syncpt values in job\n\nThis patch fixes a security issue which a craft IOCTL has a syncpt\nvalue exceeds the host1x max syncpt number, which causes a kernel\ncrash in the end.\n\nBug: 34125224\n\nChange-Id: I99c5e745551c9c83dcb0fe8c91c6e849455dba02\nSigned-off-by: Mark Zhang <markz@nvidia.com>","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/f19ab2a54e5989144c08f99bb81a6cbedbf0951d"},{"sha":"7cb2397094e3862acc68241d3b8de829f0669aca","author":{"name":"Mark Zhang","email":"62b7f361e265a7e104f476900c58a6e14256ef39@nvidia.com"},"message":"drm/nouveau: Fix the race condition between gem unmap & gem close\n\nThis patch fixes a race condition betwen gem_unmap_work and\nnouveau_gem_object_close. Partner issue 38045794 has the detail\ndescriptions.\n\nThe root cause of the race is we don't have lock when nvbo->vma_immutable\nis true. To handle this, we add codes to check vma_immutable explicitly,\nthen remove the vma from the list to avoid the race which causes kernel\ncrashes.\n\nBug: 38045794\n\nChange-Id: I8a43d50eada6d99d9b9f9c99e76b54495af8cb6d\nSigned-off-by: Mark Zhang <markz@nvidia.com>","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/7cb2397094e3862acc68241d3b8de829f0669aca"},{"sha":"7aa74268bb07ba6479480f92ac6d480ba4908129","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"UPSTREAM: packet: fix races in fanout_add()\n\ncommit d199fab63c11998a602205f7ee7ff7c05c97164b upstream.\n\nMultiple threads can call fanout_add() at the same time.\n\nWe need to grab fanout_mutex earlier to avoid races that could\nlead to one thread freeing po->rollover that was set by another thread.\n\nDo the same in fanout_release(), for peace of mind, and to help us\nfinding lockdep issues earlier.\n\n[js] no rollover in 3.12\n\nFixes: dc99f600698d (\"packet: Add fanout support.\")\nFixes: 0648ab70afe6 (\"packet: rollover prepare: per-socket state\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Willem de Bruijn <willemb@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>\nSigned-off-by: Willy Tarreau <w@1wt.eu>\n(cherry picked from commit 2a272abc4e543f488b3a73292ee75a06f20d077a)\nBug: 37897645\nChange-Id: I3b021869ee26b88d10f4d6408ce34d351543ce74","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/7aa74268bb07ba6479480f92ac6d480ba4908129"},{"sha":"6c70e9dd9cfdbcfa79f6237f2b9da51fe278e6e8","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"ip6_gre: fix ip6gre_err() invalid reads\n\n[ Upstream commit 7892032cfe67f4bde6fc2ee967e45a8fbaf33756 ]\n\nAndrey Konovalov reported out of bound accesses in ip6gre_err()\n\nIf GRE flags contains GRE_KEY, the following expression\n*(((__be32 *)p) + (grehlen / 4) - 1)\n\naccesses data ~40 bytes after the expected point, since\ngrehlen includes the size of IPv6 headers.\n\nLet's use a \"struct gre_base_hdr *greh\" pointer to make this\ncode more readable.\n\np[1] becomes greh->protocol.\ngrhlen is the GRE header length.\n\nFixes: c12b395a4664 (\"gre: Support GRE over IPv6\")\nBug: 37871211\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nChange-Id: I1b8fbb6f297643f23053b01b083677eab7e1a2f1","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/6c70e9dd9cfdbcfa79f6237f2b9da51fe278e6e8"},{"sha":"227fe4a1aa98f5f65d6e8e413228ce1a16358e9c","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"tcp: avoid infinite loop in tcp_splice_read()\n\n[ Upstream commit ccf7abb93af09ad0868ae9033d1ca8108bdaec82 ]\n\nSplicing from TCP socket is vulnerable when a packet with URG flag is\nreceived and stored into receive queue.\n\n__tcp_splice_read() returns 0, and sk_wait_data() immediately\nreturns since there is the problematic skb in queue.\n\nThis is a nice way to burn cpu (aka infinite loop) and trigger\nsoft lockups.\n\nAgain, this gem was found by syzkaller tool.\n\nFixes: 9c55e01c0cc8 (\"[TCP]: Splice receive support.\")\nBug: 37901268\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Dmitry Vyukov  <dvyukov@google.com>\nCc: Willy Tarreau <w@1wt.eu>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nChange-Id: I7fe9d900d1794828cbb86fea7450068ea5fe1e50","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/227fe4a1aa98f5f65d6e8e413228ce1a16358e9c"},{"sha":"edcdbab435862718f2af95a804d52bef7f473699","author":{"name":"WANG Cong","email":"3f5d79d28d6d48052800caba9df0b30e06fefe41@gmail.com"},"message":"BACKPORT: ipv6/dccp: do not inherit ipv6_mc_list from parent\n\nLike commit 657831ffc38e (\"dccp/tcp: do not inherit mc_list from parent\")\nwe should clear ipv6_mc_list etc. for IPv6 sockets too.\n\nCc: Eric Dumazet <edumazet@google.com>\nBug: 62299478\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n(cherry picked from commit 83eaddab4378db256d00d295bda6ca997cd13a52)\nSigned-off-by: Connor O'Brien <connoro@google.com>\n\nChange-Id: I072f17a16ae8095c792ed05b73589a97c1d2a16b","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/edcdbab435862718f2af95a804d52bef7f473699"},{"sha":"770c610d3791e03201456d609927722f5ce04c04","author":{"name":"Konstantin Khlebnikov","email":"429fb17fca3f5b1f4e58138735393682c4928141@gmail.com"},"message":"mm: replace vma_lock_anon_vma with anon_vma_lock_read/write\n\n[ Upstream commit 12352d3cae2cebe18805a91fab34b534d7444231 ]\n\nSequence vma_lock_anon_vma() - vma_unlock_anon_vma() isn't safe if\nanon_vma appeared between lock and unlock.  We have to check anon_vma\nfirst or call anon_vma_prepare() to be sure that it's here.  There are\nonly few users of these legacy helpers.  Let's get rid of them.\n\nThis patch fixes anon_vma lock imbalance in validate_mm().  Write lock\nisn't required here, read lock is enough.\n\nAnd reorders expand_downwards/expand_upwards: security_mmap_addr() and\nwrapping-around check don't have to be under anon vma lock.\n\nLink: https://lkml.kernel.org/r/CACT4Y+Y908EjM2z=706dv4rV6dWtxTLK9nFg9_7DhRMLppBo2g@mail.gmail.com\nBug: 38413813\nSigned-off-by: Konstantin Khlebnikov <koct9i@gmail.com>\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nAcked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>\nCc: Andrea Arcangeli <aarcange@redhat.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>\nChange-Id: I071d77cfc4a20b91d5829a146401a52047d4540a","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/770c610d3791e03201456d609927722f5ce04c04"},{"sha":"d4e686e9647e0eeb6eadc9f4e1b511872fe8c6d2","author":{"name":"Linus Torvalds","email":"ead7104581934751970e9decb2db5deb20a9e407@linux-foundation.org"},"message":"UPSTREAM: vm: make stack guard page errors return VM_FAULT_SIGSEGV rather than SIGBUS\n\ncommit 9c145c56d0c8a0b62e48c8d71e055ad0fb2012ba upstream.\n\nThe stack guard page error case has long incorrectly caused a SIGBUS\nrather than a SIGSEGV, but nobody actually noticed until commit\nfee7e49d4514 (\"mm: propagate error from stack expansion even for guard\npage\") because that error case was never actually triggered in any\nnormal situations.\n\nNow that we actually report the error, people noticed the wrong signal\nthat resulted.  So far, only the test suite of libsigsegv seems to have\nactually cared, but there are real applications that use libsigsegv, so\nlet's not wait for any of those to break.\n\nReported-and-tested-by: Takashi Iwai <tiwai@suse.de>\nTested-by: Jan Engelhardt <jengelh@inai.de>\nAcked-by: Heiko Carstens <heiko.carstens@de.ibm.com> # \"s390 still compiles and boots\"\nCc: linux-arch@vger.kernel.org\nCc: stable@vger.kernel.org\nBug: 38413813\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\n(cherry picked from commit 1f74b26b0f118db0e658cbef2816d11d5ae0242c)\n\nChange-Id: Id8b7a8de22e050c45f2338bb80888d0e8da10f84\nSigned-off-by: Greg Hackmann <ghackmann@google.com>","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/d4e686e9647e0eeb6eadc9f4e1b511872fe8c6d2"},{"sha":"62c7630b4c5573015574dbe4ab0b7874be00dbc7","author":{"name":"Linus Torvalds","email":"ead7104581934751970e9decb2db5deb20a9e407@linux-foundation.org"},"message":"UPSTREAM: mm: propagate error from stack expansion even for guard page\n\ncommit fee7e49d45149fba60156f5b59014f764d3e3728 upstream.\n\nJay Foad reports that the address sanitizer test (asan) sometimes gets\nconfused by a stack pointer that ends up being outside the stack vma\nthat is reported by /proc/maps.\n\nThis happens due to an interaction between RLIMIT_STACK and the guard\npage: when we do the guard page check, we ignore the potential error\nfrom the stack expansion, which effectively results in a missing guard\npage, since the expected stack expansion won't have been done.\n\nAnd since /proc/maps explicitly ignores the guard page (commit\nd7824370e263: \"mm: fix up some user-visible effects of the stack guard\npage\"), the stack pointer ends up being outside the reported stack area.\n\nThis is the minimal patch: it just propagates the error.  It also\neffectively makes the guard page part of the stack limit, which in turn\nmeasn that the actual real stack is one page less than the stack limit.\n\nLet's see if anybody notices.  We could teach acct_stack_growth() to\nallow an extra page for a grow-up/grow-down stack in the rlimit test,\nbut I don't want to add more complexity if it isn't needed.\n\nReported-and-tested-by: Jay Foad <jay.foad@gmail.com>\nBug: 38413813\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\n(cherry picked from commit 88b5d12c6413c7b80c3df4527b09c9d5f65c1c0a)\n\nChange-Id: I9f3ed39d5e9665d3e2cd407c83af24ec69521b6d\nSigned-off-by: Greg Hackmann <ghackmann@google.com>","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/62c7630b4c5573015574dbe4ab0b7874be00dbc7"},{"sha":"8876d5e5305c022f62ee8b0581a3bbf4520382fe","author":{"name":"Hugh Dickins","email":"11bd16bbccd141ee47d9426ad06afbc74b915cf0@google.com"},"message":"mm: larger stack guard gap, between vmas\n\ncommit 1be7107fbe18eed3e319a6c3e83c78254b693acb upstream.\n\nStack guard page is a useful feature to reduce a risk of stack smashing\ninto a different mapping. We have been using a single page gap which\nis sufficient to prevent having stack adjacent to a different mapping.\nBut this seems to be insufficient in the light of the stack usage in\nuserspace. E.g. glibc uses as large as 64kB alloca() in many commonly\nused functions. Others use constructs liks gid_t buffer[NGROUPS_MAX]\nwhich is 256kB or stack strings with MAX_ARG_STRLEN.\n\nThis will become especially dangerous for suid binaries and the default\nno limit for the stack size limit because those applications can be\ntricked to consume a large portion of the stack and a single glibc call\ncould jump over the guard page. These attacks are not theoretical,\nunfortunatelly.\n\nMake those attacks less probable by increasing the stack guard gap\nto 1MB (on systems with 4k pages; but make it depend on the page size\nbecause systems with larger base pages might cap stack allocations in\nthe PAGE_SIZE units) which should cover larger alloca() and VLA stack\nallocations. It is obviously not a full fix because the problem is\nsomehow inherent, but it should reduce attack space a lot.\n\nOne could argue that the gap size should be configurable from userspace,\nbut that can be done later when somebody finds that the new 1MB is wrong\nfor some special case applications.  For now, add a kernel command line\noption (stack_guard_gap) to specify the stack gap size (in page units).\n\nImplementation wise, first delete all the old code for stack guard page:\nbecause although we could get away with accounting one extra page in a\nstack vma, accounting a larger gap can break userspace - case in point,\na program run with \"ulimit -S -v 20000\" failed when the 1MB gap was\ncounted for RLIMIT_AS; similar problems could come with RLIMIT_MLOCK\nand strict non-overcommit mode.\n\nInstead of keeping gap inside the stack vma, maintain the stack guard\ngap as a gap between vmas: using vm_start_gap() in place of vm_start\n(or vm_end_gap() in place of vm_end if VM_GROWSUP) in just those few\nplaces which need to respect the gap - mainly arch_get_unmapped_area(),\nand and the vma tree's subtree_gap support for that.\n\nOriginal-patch-by: Oleg Nesterov <oleg@redhat.com>\nOriginal-patch-by: Michal Hocko <mhocko@suse.com>\nBug: 38413813\nSigned-off-by: Hugh Dickins <hughd@google.com>\nAcked-by: Michal Hocko <mhocko@suse.com>\nTested-by: Helge Deller <deller@gmx.de> # parisc\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n[wt: backport to 4.11: adjust context]\n[wt: backport to 4.9: adjust context ; kernel doc was not in admin-guide]\n[wt: backport to 4.4: adjust context ; drop ppc hugetlb_radix changes]\n[wt: backport to 3.18: adjust context ; no FOLL_POPULATE ;\n     s390 uses generic arch_get_unmapped_area()]\nSigned-off-by: Willy Tarreau <w@1wt.eu>\n[gkh: minor build fixes for 3.18]\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nChange-Id: I5b84f3d9139991a4486c4b668f444df1197cc167","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/8876d5e5305c022f62ee8b0581a3bbf4520382fe"},{"sha":"20ab4a2af7e24af2b3fdd02935b5e8aafbe43fdc","author":{"name":"Hugh Dickins","email":"11bd16bbccd141ee47d9426ad06afbc74b915cf0@google.com"},"message":"mm: fix new crash in unmapped_area_topdown()\n\ncommit f4cb767d76cf7ee72f97dd76f6cfa6c76a5edc89 upstream.\n\nTrinity gets kernel BUG at mm/mmap.c:1963! in about 3 minutes of\nmmap testing.  That's the VM_BUG_ON(gap_end < gap_start) at the\nend of unmapped_area_topdown().  Linus points out how MAP_FIXED\n(which does not have to respect our stack guard gap intentions)\ncould result in gap_end below gap_start there.  Fix that, and\nthe similar case in its alternative, unmapped_area().\n\nFixes: 1be7107fbe18 (\"mm: larger stack guard gap, between vmas\")\nReported-by: Dave Jones <davej@codemonkey.org.uk>\nDebugged-by: Linus Torvalds <torvalds@linux-foundation.org>\nBug: 38413813\nSigned-off-by: Hugh Dickins <hughd@google.com>\nAcked-by: Michal Hocko <mhocko@suse.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nChange-Id: If0bcd9de541e901c506a2a0c4b6e4f308ddea681","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/20ab4a2af7e24af2b3fdd02935b5e8aafbe43fdc"},{"sha":"ba27b43e53dc8d151bd659877421bd11252e45cd","author":{"name":"Adrian Salido","email":"6d635a0a76d943c7a6d2808755e208535d850b07@google.com"},"message":"driver core: platform: fix race condition with driver_override\n\nThe driver_override implementation is susceptible to race condition when\ndifferent threads are reading vs storing a different driver override.\nAdd locking to avoid race condition.\n\nFixes: 3d713e0e382e (\"driver core: platform: add device binding path 'driver_override'\")\nCc: stable@vger.kernel.org\nBug: 35676417\nSigned-off-by: Adrian Salido <salidoa@google.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nChange-Id: I378bddb94afa3c21f1200f80ceacbbaca625cb75","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/ba27b43e53dc8d151bd659877421bd11252e45cd"},{"sha":"8b5098a3109d1fabeee5195b532382abb4b82012","author":{"name":"Adrian Salido","email":"6d635a0a76d943c7a6d2808755e208535d850b07@google.com"},"message":"Merge changes I378bddb9,If0bcd9de,I5b84f3d9,I9f3ed39d,Id8b7a8de, ... into android-chromeos-dragon-3.18\n\n* changes:\n  driver core: platform: fix race condition with driver_override\n  mm: fix new crash in unmapped_area_topdown()\n  mm: larger stack guard gap, between vmas\n  UPSTREAM: mm: propagate error from stack expansion even for guard page\n  UPSTREAM: vm: make stack guard page errors return VM_FAULT_SIGSEGV rather than SIGBUS\n  mm: replace vma_lock_anon_vma with anon_vma_lock_read/write\n  BACKPORT: ipv6/dccp: do not inherit ipv6_mc_list from parent\n  tcp: avoid infinite loop in tcp_splice_read()\n  ip6_gre: fix ip6gre_err() invalid reads\n  UPSTREAM: packet: fix races in fanout_add()\n  drm/nouveau: Fix the race condition between gem unmap & gem close\n  drm/tegra: host1x: Check syncpt values in job\n  net: wireless: bcmdhd: add boundary check in GSCAN full result handler\n  net: wireless: bcmdhd: adding boudary check in wl_escan_handler\n  net: wireless: bcmdhd: adding boundary check for pfn events\n  net: wireless: bcmdhd: add boundary check in dhd_rtt_event_handler\n  net: wireless: bcmdhd: adding boundary check in wl_notify_rx_mgmt_frame\n  tracing: fix race condition reading saved tgids","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/8b5098a3109d1fabeee5195b532382abb4b82012"},{"sha":"74c8d39ce922dd434a8a15eaa914967128ab5b35","author":{"name":"Adrian Salido","email":"6d635a0a76d943c7a6d2808755e208535d850b07@google.com"},"message":"drm/nouveau: replace bo list traversal with safe\n\nDuring mapping cleanup list is traversed and to remove all mappings and\nclear memory. When doing so the traversal needs to be using *_safe\nmethod to avoid use after free.\n\nBug: 38046353\nSigned-off-by: Adrian Salido <salidoa@google.com>\nChange-Id: Id08a3ccab5277004f5beef47681d601bf4edaca3","distinct":true,"url":"https://api.github.com/repos/UnicornioSucio/android_kernel_google_dragon/commits/74c8d39ce922dd434a8a15eaa914967128ab5b35"}]}
{"actor":{"display_login":"nychitman1"}}