{"push_id":1695841070,"size":61,"distinct_size":61,"ref":"refs/heads/cr-5.1","head":"25d941b87f03e977f7add63582ce47342d850b36","before":"ff9beb81abcf7f1ff4e827c920eb47f07d40870c","commits":[{"sha":"72ab96c5c1966296916827145e07a364e5cf6c8a","author":{"name":"Agrawal Ashish","email":"beec61756d83ba88d1ff81315ad83fedd155cc31@codeaurora.org"},"message":"msm: wlan: update regulatory database\n\nIncorporate the 2016-10-31 updates to the internal regulatory\ndatabase. Update countries Bahrain, Belize, Chile, Egypt, Honduras,\nIndia, S Korea, Nepal, Panama, Russia, Senegal, TT and UAE. Also\nupdate St. Kitts&Navis and St. Lucia dfs region.\n\nChange-Id: Ia151b2dd5229f07790ac961af298305b24e098fb\nCRs-Fixed: 1091511\nSigned-off-by: Amar Singhal <asinghal@codeaurora.org>\nSigned-off-by: Agrawal Ashish <ashishka@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/72ab96c5c1966296916827145e07a364e5cf6c8a"},{"sha":"4328b6bdd79fdf9c4d270abb70759a57c9e6ba04","author":{"name":"Surajit Podder","email":"bd4b22da1e643e39f4fdbfd69aeb723f9ce71dfd@codeaurora.org"},"message":"msm_vidc: Fix hang due to incorrect buffer unmap\n\nBuffers queued with the same index share extrdata plane\ninfo in dynamic buffer mode as well. When a buffer\nis dequeued while another buffer(queued earlier with the\nsame index)is held in driver due to fw ref, dqbuf ends\nup unmapping the old buffer, as the buffer_info used\nto unregister is the one used to access the extradata\nuvaddr, which happens to map to the old buffer as it is\nearlier in the list, and the extradata plane is processed\nlast.\n\nFix the issue by populating the plane uvaddr in reverse\norder, so that the correct buffer_info is unmapped.\n\nChange-Id: I15723cc13c582fd5970641d51ba46456935ab4fb\nSigned-off-by: Surajit Podder <spodder@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/4328b6bdd79fdf9c4d270abb70759a57c9e6ba04"},{"sha":"311115bd8a3bf2a1df01f6731e7fa84b6096c45e","author":{"name":"Andrew Chant","email":"74abe530dd61f06b906af7d23d7dcf61131999f9@google.com"},"message":"input: touchscreen: synaptics: Remove fw_update sysfs entries\n\nRemove the sysfs entrypoints to fw_update of synaptics driver.\n\nBUG: 32769717\nChange-Id: I710cb37a8b5382dce7aa6a1d8748be5853a18a7a\nGit-commit: 2615c5f302441568e6dd20007bc5246d72837e80\nGit-repo: https://android.googlesource.com/kernel/msm.git\nSigned-off-by: Andrew Chant <achant@google.com>\nSigned-off-by: Vevek Venkatesan <vevekv@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/311115bd8a3bf2a1df01f6731e7fa84b6096c45e"},{"sha":"7b6286ec94d8e5e180601dc4d1ad03f5354823b6","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"net: avoid signed overflows for SO_{SND|RCV}BUFFORCE\n\nCAP_NET_ADMIN users should not be allowed to set negative\nsk_sndbuf or sk_rcvbuf values, as it can lead to various memory\ncorruptions, crashes, OOM....\n\nNote that before commit 82981930125a (\"net: cleanups in\nsock_setsockopt()\"), the bug was even more serious, since SO_SNDBUF\nand SO_RCVBUF were vulnerable.\n\nThis needs to be backported to all known linux kernels.\n\nAgain, many thanks to syzkaller team for discovering this gem.\n\nChange-Id: Ia33fe0e157dc0a519d69cb9a6604a6049eb24ad7\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nGit-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\nGit-commit: b98b0bc8c431e3ceb4b26b0dfc8db509518fb290\nSigned-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/7b6286ec94d8e5e180601dc4d1ad03f5354823b6"},{"sha":"b127d75fba5099e95c30725cb6d1b26e319e6b56","author":{"name":"Andrew Chant","email":"74abe530dd61f06b906af7d23d7dcf61131999f9@google.com"},"message":"input: synaptics: put offset checks under mutex.\n\nPlace file offset validity checks under mutex.\n\nBUG: 33555878\nBUG: 33002026\n\nChange-Id: I1945cfc8af7d1a310ae0d7bbb85002d4c448f30b\nSigned-off-by: Andrew Chant <achant@google.com>\nGit-repo: https://android.googlesource.com/kernel/msm\nGit-commit: e1fb1600fc222337989e3084d68df929882deae5\nResolved minor merge conflict\nSigned-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/b127d75fba5099e95c30725cb6d1b26e319e6b56"},{"sha":"7670e3b4a14b9cf144d999f8deba3c57f10c3b0b","author":{"name":"Andrey Ryabinin","email":"93e46ad9a51c483bc64b86deb9d8d0d7dbbb3fe0@virtuozzo.com"},"message":"mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]\n\nThis fixes CVE-2016-8650.\n\nIf mpi_powm() is given a zero exponent, it wants to immediately return\neither 1 or 0, depending on the modulus.  However, if the result was\ninitalised with zero limb space, no limbs space is allocated and a\nNULL-pointer exception ensues.\n\nFix this by allocating a minimal amount of limb space for the result when\nthe 0-exponent case when the result is 1 and not touching the limb space\nwhen the result is 0.\n\nThis affects the use of RSA keys and X.509 certificates that carry them.\n\nBUG: unable to handle kernel NULL pointer dereference at           (null)\nIP: [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6\nPGD 0\nOops: 0002 [#1] SMP\nModules linked in:\nCPU: 3 PID: 3014 Comm: keyctl Not tainted 4.9.0-rc6-fscache+ #278\nHardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014\ntask: ffff8804011944c0 task.stack: ffff880401294000\nRIP: 0010:[<ffffffff8138ce5d>]  [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6\nRSP: 0018:ffff880401297ad8  EFLAGS: 00010212\nRAX: 0000000000000000 RBX: ffff88040868bec0 RCX: ffff88040868bba0\nRDX: ffff88040868b260 RSI: ffff88040868bec0 RDI: ffff88040868bee0\nRBP: ffff880401297ba8 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000047 R11: ffffffff8183b210 R12: 0000000000000000\nR13: ffff8804087c7600 R14: 000000000000001f R15: ffff880401297c50\nFS:  00007f7a7918c700(0000) GS:ffff88041fb80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 0000000401250000 CR4: 00000000001406e0\nStack:\n ffff88040868bec0 0000000000000020 ffff880401297b00 ffffffff81376cd4\n 0000000000000100 ffff880401297b10 ffffffff81376d12 ffff880401297b30\n ffffffff81376f37 0000000000000100 0000000000000000 ffff880401297ba8\nCall Trace:\n [<ffffffff81376cd4>] ? __sg_page_iter_next+0x43/0x66\n [<ffffffff81376d12>] ? sg_miter_get_next_page+0x1b/0x5d\n [<ffffffff81376f37>] ? sg_miter_next+0x17/0xbd\n [<ffffffff8138ba3a>] ? mpi_read_raw_from_sgl+0xf2/0x146\n [<ffffffff8132a95c>] rsa_verify+0x9d/0xee\n [<ffffffff8132acca>] ? pkcs1pad_sg_set_buf+0x2e/0xbb\n [<ffffffff8132af40>] pkcs1pad_verify+0xc0/0xe1\n [<ffffffff8133cb5e>] public_key_verify_signature+0x1b0/0x228\n [<ffffffff8133d974>] x509_check_for_self_signed+0xa1/0xc4\n [<ffffffff8133cdde>] x509_cert_parse+0x167/0x1a1\n [<ffffffff8133d609>] x509_key_preparse+0x21/0x1a1\n [<ffffffff8133c3d7>] asymmetric_key_preparse+0x34/0x61\n [<ffffffff812fc9f3>] key_create_or_update+0x145/0x399\n [<ffffffff812fe227>] SyS_add_key+0x154/0x19e\n [<ffffffff81001c2b>] do_syscall_64+0x80/0x191\n [<ffffffff816825e4>] entry_SYSCALL64_slow_path+0x25/0x25\nCode: 56 41 55 41 54 53 48 81 ec a8 00 00 00 44 8b 71 04 8b 42 04 4c 8b 67 18 45 85 f6 89 45 80 0f 84 b4 06 00 00 85 c0 75 2f 41 ff ce <49> c7 04 24 01 00 00 00 b0 01 75 0b 48 8b 41 18 48 83 38 01 0f\nRIP  [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6\n RSP <ffff880401297ad8>\nCR2: 0000000000000000\n---[ end trace d82015255d4a5d8d ]---\n\nBasically, this is a backport of a libgcrypt patch:\n\n\thttp://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=patch;h=6e1adb05d290aeeb1c230c763970695f4a538526\n\nChange-Id: I011db424f47dd96c0b6f39895610f8f8cbe92d0f\nFixes: cdec9cb5167a (\"crypto: GnuPG based MPI lib - source files (part 1)\")\nSigned-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\ncc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>\ncc: linux-ima-devel@lists.sourceforge.net\ncc: stable@vger.kernel.org\nSigned-off-by: James Morris <james.l.morris@oracle.com>\nGit-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\nGit-commit: f5527fffff3f002b0a6b376163613b82f69de073\nSigned-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/7670e3b4a14b9cf144d999f8deba3c57f10c3b0b"},{"sha":"4de99f0630b853021f5fdaac58ee310b3033f2a8","author":{"name":"Philip Pettersson","email":"a92d5039dce26639c800f4cf2f37bd0c3c2ae41c@gmail.com"},"message":"packet: fix race condition in packet_set_ring\n\nWhen packet_set_ring creates a ring buffer it will initialize a\nstruct timer_list if the packet version is TPACKET_V3. This value\ncan then be raced by a different thread calling setsockopt to\nset the version to TPACKET_V1 before packet_set_ring has finished.\n\nThis leads to a use-after-free on a function pointer in the\nstruct timer_list when the socket is closed as the previously\ninitialized timer will not be deleted.\n\nThe bug is fixed by taking lock_sock(sk) in packet_setsockopt when\nchanging the packet version while also taking the lock at the start\nof packet_set_ring.\n\nFixes: f6fb8f100b80 (\"af-packet: TPACKET_V3 flexible buffer implementation.\")\nSigned-off-by: Philip Pettersson <philip.pettersson@gmail.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nGit-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\nGit-commit: 84ac7260236a49c79eede91617700174c2c19b0c\n\nChange-Id: Ie8237badf9fec9558bb9be1e1bc19fa99d009d1c\nSigned-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/4de99f0630b853021f5fdaac58ee310b3033f2a8"},{"sha":"3ae87f0bef26c206c0a6945cbdfd9a39eb386879","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"net: avoid signed overflows for SO_{SND|RCV}BUFFORCE\"","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/3ae87f0bef26c206c0a6945cbdfd9a39eb386879"},{"sha":"214a86afac8c22077170c5e68dfe9a8f8d880e4a","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]\"","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/214a86afac8c22077170c5e68dfe9a8f8d880e4a"},{"sha":"6d4f99b84477015aeb6a9aa635bf591e91c1c706","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"packet: fix race condition in packet_set_ring\"","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/6d4f99b84477015aeb6a9aa635bf591e91c1c706"},{"sha":"729aa7f452b29c0f22c6bb511ada3aeb45a4df49","author":{"name":"Daniel Rosenberg","email":"ba8cfe5d21fcfdde5eed8cabcaff0549d9612a2a@google.com"},"message":"ANDROID: ion: check for kref overflow\n\nUserspace can cause the kref to handles to increment\narbitrarily high. Ensure it does not overflow.\n\nSigned-off-by: Daniel Rosenberg <drosen@google.com>\n\nBug: 31992382\nTest: See bug for poc\nChange-Id: I6bff1df385742b1d836d43180dc87fadcea80782\nGit-repo: https://android.googlesource.com/kernel/msm\nGit-commit: 0c702db4d90de88df11057bcf0d8fb2dfe741605\nSigned-off-by: Dennis Cagle <d-cagle@codeaurora.org>\nSigned-off-by: c_vkeert <vkeert@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/729aa7f452b29c0f22c6bb511ada3aeb45a4df49"},{"sha":"a79ac2e926cec9a5b53e726e6be3b1002676f5ce","author":{"name":"Jim Lin","email":"77b25b97cd7d28aafb9eda2031fed3d6cbe813ac@nvidia.com"},"message":"CHROMIUM: usb: gadget: configfs: Fix KASAN use-after-free\n\nWhen gadget is disconnected, running sequence is like this.\n. composite_disconnect\n. Call trace:\n  usb_string_copy+0xd0/0x128\n  gadget_config_name_configuration_store+0x4\n  gadget_config_name_attr_store+0x40/0x50\n  configfs_write_file+0x198/0x1f4\n  vfs_write+0x100/0x220\n  SyS_write+0x58/0xa8\n. configfs_composite_unbind\n. configfs_composite_bind\n\nIn configfs_composite_bind, it has\n\"cn->strings.s = cn->configuration;\"\n\nWhen usb_string_copy is invoked. it would\nallocate memory, copy input string, release previous pointed memory space,\nand use new allocated memory.\n\nWhen gadget is connected, host sends down request to get information.\nCall trace:\n  usb_gadget_get_string+0xec/0x168\n  lookup_string+0x64/0x98\n  composite_setup+0xa34/0x1ee8\n\nIf gadget is disconnected and connected quickly, in the failed case,\ncn->configuration memory has been released by usb_string_copy kfree but\nconfigfs_composite_bind hasn't been run in time to assign new allocated\n\"cn->configuration\" pointer to \"cn->strings.s\".\n\nWhen \"strlen(s->s) of usb_gadget_get_string is being executed, the dangling\nmemory is accessed, \"BUG: KASAN: use-after-free\" error occurs.\n\nBUG=chrome-os-partner:58412\nTEST=After smaug device was connected to ubuntu PC host, detached and attached\ntype-C cable quickly several times without seeing\n\"BUG: KASAN: use-after-free in usb_gadget_get_string\".\n\nChange-Id: I58240ee7c55ae8f8fb8597d14f09c5ac07abb032\nSigned-off-by: Jim Lin <jilin@nvidia.com>\nReviewed-on: https://chromium-review.googlesource.com/428059\nCommit-Ready: Jim Lin <jilin%nvidia.com@gtempaccount.com>\nTested-by: Jim Lin <jilin%nvidia.com@gtempaccount.com>\nReviewed-by: Adrian Salido <salidoa@google.com>\nReviewed-by: Benson Leung <bleung@chromium.org>\nGit-repo: https://chromium.googlesource.com/chromiumos/third_party/kernel\nGit-commit: a7b597d255d70f6f0c6bfdfb7e4e04f67fcebf9d\nSigned-off-by: Dennis Cagle <d-cagle@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/a79ac2e926cec9a5b53e726e6be3b1002676f5ce"},{"sha":"6cf228548077532f9fc0b4a9c712c7286a49858c","author":{"name":"Skylar Chang","email":"e55369b827ac1e5cdf23e9f11dabe26a7634de99@codeaurora.org"},"message":"msm: IPA: add the check on intf query\n\nThe ipa_ioc_query_intf_rx_props structure comes\nfrom the ioctl handler, and it is verified that\nthe size of rx buffer does not exceed the\nIPA_NUM_PROPS_MAX elements. It is also verified\nthat the \"entry->rx\" buffer does not exceed\nIPA_NUM_PROPS_MAX when \"entry\" is allocated.\nHowever, the sizes of the buffer \"rx->rx\" and\nthe buffer \"entry->rx\" are not guaranteed to\nbe the same and will lead memory corruption\nissue. The fix is to add the check before\nmemcpy.\n\nChange-Id: Idf5c2d32f47c1a1cffeaa5607193855188893ddb\nSigned-off-by: Skylar Chang <chiaweic@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/6cf228548077532f9fc0b4a9c712c7286a49858c"},{"sha":"093d6ca6c4f35f2ba6a989aa34030c312be8ce9c","author":{"name":"Senthil Kumar Rajagopal","email":"166aef960867a169c14020815ac85626369714fa@codeaurora.org"},"message":"msm: camera: isp: fix for out of bound access array\n\nThere is no bound check in stream_cfg_cmd->num_streams,\nin functions msm_isp_check_stream_cfg_cmd and\nmsm_isp_stats_update_cgc_override num_streams is used as\nthe index for stream_cfg_cmd->stream_handle array which\nhas a size of 15. Current code did not check the num_streams\nto make sure that did not exceed the array size\n\nCRs-Fixed: 2006015\n\nChange-Id: I7f195c764a4e6c12e4f7c680bc3c9aa7b078e625\nSigned-off-by: Senthil Kumar Rajagopal <skrajago@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/093d6ca6c4f35f2ba6a989aa34030c312be8ce9c"},{"sha":"7e5bf037b36c67ebf4e4db99217d284a5b947290","author":{"name":"Liangliang Lu","email":"f615cd9161b701e9f1351d8b7046d3f2d417e660@codeaurora.org"},"message":"usb: dwc3: Replace sscanf with kstrtou8_from_user\n\nVariable \"ubuf \" and \"buf\" may point to  kernel address, a malicious\nuser could use code logic to get kernel information. Use\nkstrtou8_from_user() which take care of copying buffer, and finding\nu8 value here.\n\nChange-Id: Ida147ab86b0185260d31b6025179a78de78d1553\nSigned-off-by: Liangliang Lu <luliang@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/7e5bf037b36c67ebf4e4db99217d284a5b947290"},{"sha":"cfa58c0cdc2b2977ce6b227e0ad73eb48f96329b","author":{"name":"Ingrid Gallardo","email":"f8768943cc1fe8d54da918ca5d2e69043d070211@codeaurora.org"},"message":"msm: mdss: fix race condition in mdp debugfs\n\nFix race condition in mdp debugfs properties\nduring the read and write of the panel and\nmdp registers. This race condition can cause\naccessing memory out of boundaries.\n\nChange-Id: I97a90a154237343d4aaf237c11f525bcc2c3a8e3\nSigned-off-by: Ingrid Gallardo <ingridg@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/cfa58c0cdc2b2977ce6b227e0ad73eb48f96329b"},{"sha":"8d8b3cdfe02fdbd95c252d99b61a4e643c8fc923","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"CHROMIUM: usb: gadget: configfs: Fix KASAN use-after-free\"","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/8d8b3cdfe02fdbd95c252d99b61a4e643c8fc923"},{"sha":"c03ebb839c5e985c122b8bb3b95f829f27966f8b","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"msm: IPA: add the check on intf query\"","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/c03ebb839c5e985c122b8bb3b95f829f27966f8b"},{"sha":"8f9074a07cab8ae3f773a792cfdb3254f83d6555","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"msm: camera: isp: fix for out of bound access array\"","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/8f9074a07cab8ae3f773a792cfdb3254f83d6555"},{"sha":"61928e7f49b8fd1b64281d0895a8361762cec8b4","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"usb: dwc3: Replace sscanf with kstrtou8_from_user\"","distinct":true,"url":"https://api.github.com/repos/CarbonROM/android_kernel_oneplus_msm8994/commits/61928e7f49b8fd1b64281d0895a8361762cec8b4"}]}
{"actor":{"display_login":"CarbonGerritBot"}}