{"push_id":2051445300,"size":120,"distinct_size":120,"ref":"refs/heads/bito-k","head":"83d2a4c0771fbca3ee86934e2bf10d221dedd1fa","before":"24114e5a5c3ea82e76a16ee52e1162240e3e0cc0","commits":[{"sha":"c65dfb535162135b931f70950ddb620b17999b39","author":{"name":"Liangliang Lu","email":"f615cd9161b701e9f1351d8b7046d3f2d417e660@codeaurora.org"},"message":"trace: ipc_logging: Avoid buffer overflow in ipc_log_string()\n\nIn ipc_log_string() the return value from vsnprintf(), data_size,\nis used to increment ectxt.offset. However, this length could\nactually be much larger than that of ectxt.buff itself. This is a\ntypical mistake of [v]snprintf() usage [1], in that it returns\nnot the number of characters written but how many characters\n*would* have been written regardless of whether it was truncated.\nThe result is that even though ectxt.buff itself is not overrun,\nthe incorrect size in ectxt.offset will be later used as the length\nparameter when memcpy()'ing to the ipc_log_page's data, overflowing\nthat memory and beyond. The write_page's write_offset would also\nindicate an out-of-bounds (greater than PAGE_SIZE) length.\n\nThe fix is simple: use vscnprintf() instead of vsnprintf().\n\n[1] https://lwn.net/Articles/69419/\n\nChange-Id: I2e9d44e74f5f30a009732e31a554d82e31946999\nSigned-off-by: Jack Pham <jackp@codeaurora.org>\nSigned-off-by: Liangliang Lu <luliang@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/c65dfb535162135b931f70950ddb620b17999b39"},{"sha":"089a1ad56c2c531aa42bafd3af9789dfee17b7e0","author":{"name":"Manoj Prabhu B","email":"ddf4043a996bf7f608ab271ea96052c669b1253b@codeaurora.org"},"message":"diag: Synchronize msg mask read and write on a peripheral\n\nThe patch synchronizes msg mask read and write on a peripheral\nby proper protection of mask_info and msg_mask_table_count.\n\nCRs-Fixed: 2042362, 2055291\nChange-Id: If136012855834b0b8cba91eb66bf711750e8f372\nSigned-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/089a1ad56c2c531aa42bafd3af9789dfee17b7e0"},{"sha":"e8015a1d5edcb406a15a677028587c13d515667a","author":{"name":"Rama Krishna Phani A","email":"d7355c0a2686697cab005054def6887aefe88adb@codeaurora.org"},"message":"thermal: tsens: Disable Tsens interrupts during driver initialization\n\nTSENS upper lower interrupt for all sensors will be enabled by\ndefault. Disable interrupts during driver initialization and enable\nthem based on client requirement.\n\nChange-Id: I7ad5d50ec9bb2a4c782787c7a1a6b8b42b1128fc\nSigned-off-by: Rama Krishna Phani A <rphani@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/e8015a1d5edcb406a15a677028587c13d515667a"},{"sha":"396e8a1d8b2fab2ada28ba300f3f54528a9a3dc7","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"trace: ipc_logging: Avoid buffer overflow in ipc_log_string()\"","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/396e8a1d8b2fab2ada28ba300f3f54528a9a3dc7"},{"sha":"9c5c248e04fa4b5a75df732784e3e662efd91b7d","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Promotion of kernel.lnx.3.18.c5-170815.\n\nCRs      Change ID                                   Subject\n--------------------------------------------------------------------------------------------------------------\n2000176   I2e9d44e74f5f30a009732e31a554d82e31946999   trace: ipc_logging: Avoid buffer overflow in ipc_log_str\n\nChange-Id: I5b2fb2181dd8176c6edf6042cf6bf00efdca3c0c\nCRs-Fixed: 2000176","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/9c5c248e04fa4b5a75df732784e3e662efd91b7d"},{"sha":"add9c95f647fee4102b671832307f1cb157c5386","author":{"name":"Haibin Liu","email":"43f1572e6a27c9c3904c7504ad3c52fadffcb9d7@codeaurora.org"},"message":"msm: sensor: Fix crash when ioctl VIDIOC_MSM_SENSOR_INIT_CFG\n\nIssue:\nthe invalid slave_info is used by msm_sensor_driver_probe.\nThis cause crash when ioctl VIDIOC_MSM_SENSOR_INIT_CFG repeatedly.\n\nFix:\n1) avoid the same msm_sd_subdev added into the ordered_sd_list.\n2) enlarge the buffer size for i2c addr and data.\n\nChange-Id: Idffcd3b82b9590dbfdcaf14b80668cc894178f54\nSigned-off-by: Haibin Liu <haibinl@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/add9c95f647fee4102b671832307f1cb157c5386"},{"sha":"25a1ee238e3053e3f5e6811ada7ebc1a5bff9784","author":{"name":"Divya Ojha","email":"adb4e6b5a390cf1c8a4310d9c2b75b6f6cb7bd3b@codeaurora.org"},"message":"ASoC: msm: qdsp6v2: Check out-of-bound access in put functions\n\nAdd out of bound access check in put function before accessing\nsoc_enum struct with mux as index.\n\nChange-Id: I257f8c3c46a480cc4057ab34760d1d7daa3a3d20\nSigned-off-by: Divya Ojha <dojha@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/25a1ee238e3053e3f5e6811ada7ebc1a5bff9784"},{"sha":"94ce6025b7d933435a5a589b863553be2b6017d9","author":{"name":"annamraj","email":"7a682bcda5ef05c5defc21be6262fc408a917b3e@codeaurora.org"},"message":"msm: camera: Avoid deadlock for vb2 operations using separate lock\n\nUse mutex lock for all VB2 operations, and use separatelock other\nthan used for stop streaming operation to avoid dead lock.\n\nChange-Id: Idba956e5e3bce48ee57eaa5984786ded218e32d5\nSigned-off-by: annamraj <annamraj@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/94ce6025b7d933435a5a589b863553be2b6017d9"},{"sha":"e5d491b37f17f51dad634193cf0dd701af49f2bc","author":{"name":"VijayaKumar T M","email":"1d0ce10e1a0c1123629a10b62c852901ec1872b2@codeaurora.org"},"message":"msm: sensor: Add mutex lock during ois power down operations\n\nProtecting operations performed during ois powerdown\nfrom race condition by adding mutex locks.\n\nCRs-Fixed: 2081806\nChange-Id: I27a735fd69d3e98fdd2ed48456336c560b6f3adc\nSigned-off-by: VijayaKumar T M <vtmuni@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/e5d491b37f17f51dad634193cf0dd701af49f2bc"},{"sha":"2e3328698d78dffc13d32d038a416a61fe6975d7","author":{"name":"Brahmaji K","email":"a46c808b4ebb2e07b21ac407e20a7b17e22e3539@codeaurora.org"},"message":"qseecom: Fix accessing userspace memory in kernel space\n\nUse put_user API to write the data from kernel space to\nuserspace to avoid accessing userspace memory directly\nin kernel space.\n\nChange-Id: I649fe2597e80ccad50cf16b355e220734810e94c\nSigned-off-by: Brahmaji K <bkomma@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/2e3328698d78dffc13d32d038a416a61fe6975d7"},{"sha":"d9a1d7beeb8ae747c528fcde6bd873df1b0083e3","author":{"name":"Krishna Manikandan","email":"09b83fdcc8acff41d1f94b5219f696bb563eee1a@codeaurora.org"},"message":"msm: mdss: Add check for ioctl calls\n\nA check is added to ensure that only the supported\nioctl calls are allowed to proceed further and\nall other ioctl calls are returned early.\n\nChange-Id: I30f69bc9c60384d01f990bd1830ddc1d8aa9241e\nSigned-off-by: Krishna Manikandan <mkrishn@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/d9a1d7beeb8ae747c528fcde6bd873df1b0083e3"},{"sha":"9dbac2ef055f9da912deecf7cccb26329da5694e","author":{"name":"Ashish Garg","email":"760bbae2b35b150b1e397dc846a861031ad13193@codeaurora.org"},"message":"msm: mdss: Check htotal for calculating programmable fetch\n\nFor calculating programmable fetch values, ensure htotal is\nnon-zero.\n\nChange-Id: Ib1f32f5f16aa97fb82c13c9020707245177067b9\nSigned-off-by: Ashish Garg <ashigarg@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/9dbac2ef055f9da912deecf7cccb26329da5694e"},{"sha":"e4909cd59cc271ac57e6d37111e3e67da50b4332","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"msm: camera: Avoid deadlock for vb2 operations using separate lock\"","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/e4909cd59cc271ac57e6d37111e3e67da50b4332"},{"sha":"11f2629523fe0cd6dc89397f85a2d39f68a17a21","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"ASoC: msm: qdsp6v2: Check out-of-bound access in put functions\"","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/11f2629523fe0cd6dc89397f85a2d39f68a17a21"},{"sha":"00fa1cd04bb8497c5ece456086e39217a67807f6","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"qseecom: Fix accessing userspace memory in kernel space\"","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/00fa1cd04bb8497c5ece456086e39217a67807f6"},{"sha":"578e1557fc7bf66c71a4dbcd7208b7f00b03450a","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"msm: sensor: Add mutex lock during ois power down operations\"","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/578e1557fc7bf66c71a4dbcd7208b7f00b03450a"},{"sha":"53a727800188250246ebc6f97a6d4378ee98fb22","author":{"name":"Sunil Khatri","email":"c2fa09c6a63ee27656efbed7bd5e770f84d009d0@codeaurora.org"},"message":"msm: kgsl: Fix the syncpoint_fence trace\n\nWe should have a corresponding syncpoint_fence trace\nfor every syncpoint_fence_expire trace. In case the\nfence is already signaled then make sure to have\nsyncpoint_fence trace before syncpoint_fence_expire\ntrace.\n\nAlso take an extra refcount for fence which will make\nsure that the fence pointer is valid in the trace even\nif the fence is signaled.\n\nChange-Id: I2fd8f91c800f89a4a64813a6908eaa0445cf548b\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/53a727800188250246ebc6f97a6d4378ee98fb22"},{"sha":"a577ecd078aec2287137a72d2b5af19ef39f3e58","author":{"name":"Sunil Khatri","email":"c2fa09c6a63ee27656efbed7bd5e770f84d009d0@codeaurora.org"},"message":"msm: kgsl: Protect the event->handle with spinlock\n\nevent->handle pointer can be used after free due to\nthe race condition between kgsl_sync_callback and\nkgsl_sync_fence_async_cancel.\n\nProtect the event->handle with a spinlock to\navoid concurrent access issues.\n\nChange-Id: I3719e401af9ece82ac68b72f2aef784c7fdc1104\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/a577ecd078aec2287137a72d2b5af19ef39f3e58"},{"sha":"627cf6c6db216e82fb6766d696a34046cda87035","author":{"name":"Mohammed Javid","email":"8ac1ea830510c533b5e712c0a9734492c55fa2d3@codeaurora.org"},"message":"msm:ipa: Fix to incorrect structure access\n\nAccessing of incorrect structure pointer is causing\nmemory out of bound access, fixed issue by accessing\nthe correct structure pointer.\n\nChange-Id: I3c2f5f7a97cac854093ef670184d06db4231f5e1\nAcked-by: Ashok Vuyyuru <avuyyuru@qti.qualcomm.com>\nSigned-off-by: Mohammed Javid <mjavid@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/627cf6c6db216e82fb6766d696a34046cda87035"},{"sha":"8f0ab2d63fbd695ffb387f4a3af25ae04993ef1e","author":{"name":"Kasin Li","email":"ffa56f7d367a72a5c260f6117e8c60fa1e9c3f0a@codeaurora.org"},"message":"drm/msm: Fix potential buffer overflow issue\n\nIn function submit_create, if nr is assigned with\nnegative value, the allocated buffer may be small\nthan intended.Using this buffer will lead to buffer\noverflow issue.\n\nChange-Id: I0b61cccffd836e2dd3c859446470af4b6451b9ed\nSigned-off-by: Kasin Li <donglil@codeaurora.org>\nSigned-off-by: Archana Sriram <apsrir@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/BitOBSessiOn/android_kernel_xiaomi_msm8996/commits/8f0ab2d63fbd695ffb387f4a3af25ae04993ef1e"}]}
{"actor":{"display_login":"BitOBSessiOn"}}