{"push_id":2179547523,"size":39,"distinct_size":1,"ref":"refs/heads/upstream_108","head":"597aa5cff810b95f4b6a4640f822d21915a85699","before":"6234a5714a279af7294e50efb738b58cd1421b2a","commits":[{"sha":"49a94690c77684b6debde38c30a1dde6d97516f9","author":{"name":"Siqi Lin","email":"05311c862ac5771ebcb1a0a3adac66d431c622e1@google.com"},"message":"Merge branch 'android-msm-angler-3.10-oc' into android-msm-angler-3.10-oc-security-next\n\nSeptember 2017.2\n\nBug: 63173776\nChange-Id: Ifc49a77b8eb9b469d33e05b5f3da166706a3f316\nSigned-off-by: Siqi Lin <siqilin@google.com>","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/49a94690c77684b6debde38c30a1dde6d97516f9"},{"sha":"cbd5a9340130272dd2aae0bd9a8b61516bc26da9","author":{"name":"Andrew Lehmer","email":"9018f1bcf42eaf693e0ffeae8e6dc2285c3cc65a@google.com"},"message":"Merge branch 'android-msm-angler-3.10-oc' into android-msm-angler-3.10-oc-security-next\n\nOctober 2017\n\nChange-Id: Idd0f8e94c8929de0d4babfa3d05b7a33e59f2d51\nSigned-off-by: Andrew Lehmer <alehmer@google.com>","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/cbd5a9340130272dd2aae0bd9a8b61516bc26da9"},{"sha":"30a02c52584d16178aa7971d4297ca1357901be3","author":{"name":"Andrew Lehmer","email":"9018f1bcf42eaf693e0ffeae8e6dc2285c3cc65a@google.com"},"message":"Merge branch 'android-msm-angler-3.10-oc' into android-msm-angler-3.10-oc-security-next\n\nChange-Id: I3cc5ee64c03dcd0afad297ca635faf6e89a1267d\nSigned-off-by: Andrew Lehmer <alehmer@google.com>","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/30a02c52584d16178aa7971d4297ca1357901be3"},{"sha":"6442d6bf47c5ec9d28c44716cf6a75348526e263","author":{"name":"Al Viro","email":"2a537e97523ffee458777df5f34a2f8c9964f945@zeniv.linux.org.uk"},"message":"Bluetooth: bnep: bnep_add_connection() should verify that it's dealing with l2cap socket\n\nsame story as cmtp\n\nBug: 33982955\nChange-Id: I60ce3e3b5a5a0e41ddaec155a0c6a46307eedeb7\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Marcel Holtmann <marcel@holtmann.org>","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/6442d6bf47c5ec9d28c44716cf6a75348526e263"},{"sha":"4c7961ac8bd9dc93921fa6eb06100279ace7b4f9","author":{"name":"Al Viro","email":"2a537e97523ffee458777df5f34a2f8c9964f945@zeniv.linux.org.uk"},"message":"Bluetooth: cmtp: cmtp_add_connection() should verify that it's dealing with l2cap socket\n\n... rather than relying on ciptool(8) never passing it anything else.  Give\nit e.g. an AF_UNIX connected socket (from socketpair(2)) and it'll oops,\ntrying to evaluate &l2cap_pi(sock->sk)->chan->dst...\n\nBug: 33982955\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Marcel Holtmann <marcel@holtmann.org>\nChange-Id: I078260c1b5be6a96b54c265da0236bf84842e450","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/4c7961ac8bd9dc93921fa6eb06100279ace7b4f9"},{"sha":"adfa0c9a99bf1b4baa623c74147a91ed8ef8a142","author":{"name":"Daniel Rosenberg","email":"ba8cfe5d21fcfdde5eed8cabcaff0549d9612a2a@google.com"},"message":"ANDROID: ion: Fix uninitialized variable\n\nChange-Id: Ia634b790661089ad01aca8e5975984435463d148\nSigned-off-by: Daniel Rosenberg <drosen@google.com>\nBug: 34276203","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/adfa0c9a99bf1b4baa623c74147a91ed8ef8a142"},{"sha":"cc0f30586b609d9e11dffd4629cd21c600f2863c","author":{"name":"annamraj","email":"7a682bcda5ef05c5defc21be6262fc408a917b3e@codeaurora.org"},"message":"msm: camera: Avoid deadlock for vb2 operations using separate lock\n\nUse mutex lock for all VB2 operations, and use separatelock other\nthan used for stop streaming operation to avoid dead lock.\n\nBug: 34329758\nChange-Id: Idba956e5e3bce48ee57eaa5984786ded218e32d5\nSigned-off-by: annamraj <annamraj@codeaurora.org>\nSigned-off-by: VijayaKumar T M <vtmuni@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/cc0f30586b609d9e11dffd4629cd21c600f2863c"},{"sha":"58bdb3fa2042392e5a5dee616cbc804d6df1bf06","author":{"name":"Daniel Mentz","email":"73d1f551dce9e87ef42f30e1b7f6cd7ff67898a3@google.com"},"message":"v4l2: Refactor, fix security bug in compat ioctl32\n\nThe 32-bit compat v4l2 ioctl is implemented based on its 64-bit\nequivalent. It converts 32-bit data structures into its 64-bit\nequivalents and needs to provide the data to the 64-bit ioctl in user\nspace memory which is commonly allocated using\ncompat_alloc_user_space(). However, due to how that function is\nimplemented, it can only be called a single time for every syscall\ninvocation.  Supposedly to avoid this limitation, the existing code uses\na mix of memory from the kernel stack and memory allocated through\ncompat_alloc_user_space(). Under normal circumstances, this would not\nwork, because the 64-bit ioctl expects all pointers to point to user\nspace memory. As a workaround, set_fs(KERNEL_DS) is called to\ntemporarily disable this extra safety check and allow kernel pointers.\nHowever, this might introduce a security vulnerability: The\nresult of the 32-bit to 64-bit conversion is writeable by user space\nbecause the output buffer has been allocated via\ncompat_alloc_user_space(). A malicious user space process could then\nmanipulate pointers inside this output buffer, and due to the previous\nset_fs(KERNEL_DS) call, functions like get_user() or put_user() no longer\nprevent kernel memory access.\n\nThe new approach is to pre-calculate the total amount of user space\nmemory that is needed, allocate it using compat_alloc_user_space() and\nthen divide up the allocated memory to accommodate all data structures\nthat need to be converted.\n\nAn alternative approach would have been to retain the union type karg\nthat they allocated on the kernel stack in do_video_ioctl(), copy all\ndata from user space into karg and then back to user space. However,\nwe decided against this approach because it does not align with other\ncompat syscall implementations. Instead, we tried to replicate the\nget_user/put_user pairs as found in other places in the kernel:\n\nif (get_user(clipcount, &up->clipcount) ||\n    put_user(clipcount, &kp->clipcount)) return -EFAULT;\n\nBUG: 34624167\nChange-Id: Ica92695d8ddf60c0a067ea2f833f22a71710932e\nSigned-off-by: Daniel Mentz <danielmentz@google.com>\nReported-by: C0RE Team","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/58bdb3fa2042392e5a5dee616cbc804d6df1bf06"},{"sha":"d1fa005f0ba8a97b3129ee97777f7d8f8c32a601","author":{"name":"Santhosh Behara","email":"7d43080c335d396ca4860dfebe9003104ec8d6dc@codeaurora.org"},"message":"msm: vidc: Squash the below changes\n\nmsm: vidc: Protect debug_buffer access in core_info_read with lock.\n\nSerialize core_info_read with lock so that multiple concurrent\nthreads do not cause the write to overflow. Also have the bound\ncheck to avoid overflow in write_str function.\n\nChange-Id: Ia18a4b94cafd69af1d367861f2499fc202f18e9f\n\nmsm: vidc: Allocate memory dynamically for debugfs info_reads\n\nUse dynamically allocated memory for constructing strings in\ncore_info_read & inst_info_read. This ensures that there is no\ncontention for a shared memory & hence avoids the requirement of\na lock. Allocate on demand, as the calls implement a debugfs\nfacility and hence rarely invoked. Statically allocated memory\notherwise remain idle.\n\nChange-Id: Ia18a4b94cafd69af1d367861f2499fc202f18e9f\n\nmsm: vidc: Use seq_file for debugfs interface\n\nPrint debug logs using seq_file, avoiding intermediate memory.\n\nBug: 35138888\n\nChange-Id: Ia18a4b94cafd69af1d367861f2499fc202f18e9f\n\nSigned-off-by: Abdulla Anam <abdullahanam@codeaurora.org>\nSigned-off-by: Sanjay Singh <sisanj@codeaurora.org>\nSigned-off-by: Surajit Podder <spodder@codeaurora.org>\nSigned-off-by: Santhosh Behara <santhoshbehara@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/d1fa005f0ba8a97b3129ee97777f7d8f8c32a601"},{"sha":"21e752fc1d9cda0272409c6b67ed36b35555c143","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"BACKPORT: ALSA: timer: Fix race between read and ioctl\n\nThe read from ALSA timer device, the function snd_timer_user_tread(),\nmay access to an uninitialized struct snd_timer_user fields when the\nread is concurrently performed while the ioctl like\nsnd_timer_user_tselect() is invoked.  We have already fixed the races\namong ioctls via a mutex, but we seem to have forgotten the race\nbetween read vs ioctl.\n\nThis patch simply applies (more exactly extends the already applied\nrange of) tu->ioctl_lock in snd_timer_user_tread() for closing the\nrace window.\n\nReported-by: Alexander Potapenko <glider@google.com>\nTested-by: Alexander Potapenko <glider@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\n(cherry picked from commit d11662f4f798b50d8c8743f433842c3e40fe3378)\nSigned-off-by: Connor O'Brien <connoro@google.com>\nBug: 62201221\n\nChange-Id: I67a3b5153c39ce9f6d7571b5aa8faabe5e3dbb83","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/21e752fc1d9cda0272409c6b67ed36b35555c143"},{"sha":"4e61984d39ef42d151f8285ba54521a9558565e0","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"UPSTREAM: ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT\n\nsnd_timer_user_tselect() reallocates the queue buffer dynamically, but\nit forgot to reset its indices.  Since the read may happen\nconcurrently with ioctl and snd_timer_user_tselect() allocates the\nbuffer via kmalloc(), this may lead to the leak of uninitialized\nkernel-space data, as spotted via KMSAN:\n\n  BUG: KMSAN: use of unitialized memory in snd_timer_user_read+0x6c4/0xa10\n  CPU: 0 PID: 1037 Comm: probe Not tainted 4.11.0-rc5+ #2739\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n  Call Trace:\n   __dump_stack lib/dump_stack.c:16\n   dump_stack+0x143/0x1b0 lib/dump_stack.c:52\n   kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:1007\n   kmsan_check_memory+0xc2/0x140 mm/kmsan/kmsan.c:1086\n   copy_to_user ./arch/x86/include/asm/uaccess.h:725\n   snd_timer_user_read+0x6c4/0xa10 sound/core/timer.c:2004\n   do_loop_readv_writev fs/read_write.c:716\n   __do_readv_writev+0x94c/0x1380 fs/read_write.c:864\n   do_readv_writev fs/read_write.c:894\n   vfs_readv fs/read_write.c:908\n   do_readv+0x52a/0x5d0 fs/read_write.c:934\n   SYSC_readv+0xb6/0xd0 fs/read_write.c:1021\n   SyS_readv+0x87/0xb0 fs/read_write.c:1018\n\nThis patch adds the missing reset of queue indices.  Together with the\nprevious fix for the ioctl/read race, we cover the whole problem.\n\nReported-by: Alexander Potapenko <glider@google.com>\nTested-by: Alexander Potapenko <glider@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\n(cherry picked from commit ba3021b2c79b2fa9114f92790a99deb27a65b728)\nSigned-off-by: Connor O'Brien <connoro@google.com>\nBug: 62201221\n\nChange-Id: I8d3d97bb0e6c2eefd050bf46b860dd603fe3f4c6","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/4e61984d39ef42d151f8285ba54521a9558565e0"},{"sha":"60ad62ebf6d9fc1fdc6ad2ad4a5b6579bf8618cb","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"UPSTREAM: ALSA: timer: Harden slave timer list handling\n\ncommit b5a663aa426f4884c71cd8580adae73f33570f0d upstream.\n\nA slave timer instance might be still accessible in a racy way while\noperating the master instance as it lacks of locking.  Since the\nmaster operation is mostly protected with timer->lock, we should cope\nwith it while changing the slave instance, too.  Also, some linked\nlists (active_list and ack_list) of slave instances aren't unlinked\nimmediately at stopping or closing, and this may lead to unexpected\naccesses.\n\nThis patch tries to address these issues.  It adds spin lock of\ntimer->lock (either from master or slave, which is equivalent) in a\nfew places.  For avoiding a deadlock, we ensure that the global\nslave_active_lock is always locked at first before each timer lock.\n\nAlso, ack and active_list of slave instances are properly unlinked at\nsnd_timer_stop() and snd_timer_close().\n\nLast but not least, remove the superfluous call of _snd_timer_stop()\nat removing slave links.  This is a noop, and calling it may confuse\nreaders wrt locking.  Further cleanup will follow in a later patch.\n\nActually we've got reports of use-after-free by syzkaller fuzzer, and\nthis hopefully fixes these issues.\n\nBug: 37240993\nChange-Id: I737999fb632f8597042af0c29f1c1984101529cf\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Siqi Lin <siqilin@google.com>","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/60ad62ebf6d9fc1fdc6ad2ad4a5b6579bf8618cb"},{"sha":"64c4227a16da4ed5a0ce70519f7b9250371d5df1","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"UPSTREAM: ALSA: timer: Fix wrong instance passed to slave callbacks\n\ncommit 117159f0b9d392fb433a7871426fad50317f06f7 upstream.\n\nIn snd_timer_notify1(), the wrong timer instance was passed for slave\nccallback function.  This leads to the access to the wrong data when\nan incompatible master is handled (e.g. the master is the sequencer\ntimer and the slave is a user timer), as spotted by syzkaller fuzzer.\n\nThis patch fixes that wrong assignment.\n\nBug: 37240993\nChange-Id: I7a9f258f13d500776725f2383136dabcb563a0d3\nBugLink: http://lkml.kernel.org/r/CACT4Y+Y_Bm+7epAb=8Wi=AaWd+DYS7qawX52qxdCfOfY49vozQ@mail.gmail.com\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Siqi Lin <siqilin@google.com>","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/64c4227a16da4ed5a0ce70519f7b9250371d5df1"},{"sha":"c1e018be61e060ed515e6a99f9d7cd700bcde511","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"BACKPORT: ALSA: timer: Handle disconnection more safely\n\n[ Upstream commit 230323dac060123c340cf75997971145a42661ee ]\n\nCurrently ALSA timer device doesn't take the disconnection into\naccount very well; it merely unlinks the timer device at disconnection\ncallback but does nothing else.  Because of this, when an application\naccessing the timer device is disconnected, it may release the\nresource before actually closed.  In most cases, it results in a\nwarning message indicating a leftover timer instance like:\n   ALSA: timer xxxx is busy?\nBut basically this is an open race.\n\nThis patch tries to address it.  The strategy is like other ALSA\ndevices: namely,\n- Manage card's refcount at each open/close\n- Wake up the pending tasks at disconnection\n- Check the shutdown flag appropriately at each possible call\n\nNote that this patch has one ugly hack to handle the wakeup of pending\ntasks.  It'd be cleaner to introduce a new disconnect op to\nsnd_timer_instance ops.  But since it would lead to internal ABI\nbreakage and it eventually increase my own work when backporting to\nstable kernels, I took a different path to implement locally in\ntimer.c.  A cleanup patch will follow at next for 4.5 kernel.\n\nBug: 37240993\nChange-Id: I05c7f0e7d28b63fc343091f800ceae9ec2afe4a4\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=109431\nCc: <stable@vger.kernel.org> # v3.15+\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: Siqi Lin <siqilin@google.com>\n(cherry picked from commit 230323dac060123c340cf75997971145a42661ee)","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/c1e018be61e060ed515e6a99f9d7cd700bcde511"},{"sha":"ecc778d1282d548dbc6d5593a12cfb11b4e505e4","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"BACKPORT: ALSA: timer: Fix race at concurrent reads\n\nsnd_timer_user_read() has a potential race among parallel reads, as\nqhead and qused are updated outside the critical section due to\ncopy_to_user() calls.  Move them into the critical section, and also\nsanitize the relevant code a bit.\n\nBug: 37240993\nChange-Id: I7358a57638ef23eb7f97341eaee1f0dd4ba2795a\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Siqi Lin <siqilin@google.com>\n(cherry picked from commit 4dff5c7b7093b19c19d3a100f8a3ad87cb7cd9e7)","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/ecc778d1282d548dbc6d5593a12cfb11b4e505e4"},{"sha":"7788324e738d5a20f5136962e0fcb7990be75a9a","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"UPSTREAM: ALSA: timer: Code cleanup\n\ncommit c3b1681375dc6e71d89a3ae00cc3ce9e775a8917 upstream.\n\nThis is a minor code cleanup without any functional changes:\n- Kill keep_flag argument from _snd_timer_stop(), as all callers pass\n  only it false.\n- Remove redundant NULL check in _snd_timer_stop().\n\nBug: 37240993\nChange-Id: Idc3778ca1cd62b8c22e2a57b3c1130fe7b3d13f6\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Siqi Lin <siqilin@google.com>","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/7788324e738d5a20f5136962e0fcb7990be75a9a"},{"sha":"6f0ad078ff0e4b1b342af1ca121ffb7e27708ce0","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"UPSTREAM: ALSA: timer: Fix link corruption due to double start or stop\n\ncommit f784beb75ce82f4136f8a0960d3ee872f7109e09 upstream.\n\nAlthough ALSA timer code got hardening for races, it still causes\nuse-after-free error.  This is however rather a corrupted linked list,\nnot actually the concurrent accesses.  Namely, when timer start is\ntriggered twice, list_add_tail() is called twice, too.  This ends\nup with the link corruption and triggers KASAN error.\n\nThe simplest fix would be replacing list_add_tail() with\nlist_move_tail(), but fundamentally it's the problem that we don't\ncheck the double start/stop correctly.  So, the right fix here is to\nadd the proper checks to snd_timer_start() and snd_timer_stop() (and\ntheir variants).\n\nBug: 37240993\nChange-Id: I86a327c4479fecf9b502ba6122c8ae67a2326754\nBugLink: http://lkml.kernel.org/r/CACT4Y+ZyPRoMQjmawbvmCEDrkBD2BQuH7R09=eOkf5ESK8kJAw@mail.gmail.com\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Siqi Lin <siqilin@google.com>","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/6f0ad078ff0e4b1b342af1ca121ffb7e27708ce0"},{"sha":"7624de5938a80db80bbc355afa57982329e2d03e","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"UPSTREAM: ALSA: timer: Fix race between stop and interrupt\n\ncommit ed8b1d6d2c741ab26d60d499d7fbb7ac801f0f51 upstream.\n\nA slave timer element also unlinks at snd_timer_stop() but it takes\nonly slave_active_lock.  When a slave is assigned to a master,\nhowever, this may become a race against the master's interrupt\nhandling, eventually resulting in a list corruption.  The actual bug\ncould be seen with a syzkaller fuzzer test case in BugLink below.\n\nAs a fix, we need to take timeri->timer->lock when timer isn't NULL,\ni.e. assigned to a master, while the assignment to a master itself is\nprotected by slave_active_lock.\n\nBug: 37240993\nChange-Id: Ib6eae144d5fdc92546d2210bcd6bc56454ad3e42\nBugLink: http://lkml.kernel.org/r/CACT4Y+Y_Bm+7epAb=8Wi=AaWd+DYS7qawX52qxdCfOfY49vozQ@mail.gmail.com\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Siqi Lin <siqilin@google.com>","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/7624de5938a80db80bbc355afa57982329e2d03e"},{"sha":"0ee2dead35c338844fe6e89b9cd540b329331a49","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"UPSTREAM: ALSA: timer: Call notifier in the same spinlock\n\nsnd_timer_notify1() is called outside the spinlock and it retakes the\nlock after the unlock.  This is rather racy, and it's safer to move\nsnd_timer_notify() call inside the main spinlock.\n\nThe patch also contains a slight refactoring / cleanup of the code.\nNow all start/stop/continue/pause look more symmetric and a bit better\nreadable.\n\nBug: 37240993\nChange-Id: Ib90099f88c8b04928a8cdd2808cd9e16da6d519c\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Siqi Lin <siqilin@google.com>","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/0ee2dead35c338844fe6e89b9cd540b329331a49"},{"sha":"aa469e2bae1d36ecc7cf8425577627dbc4641493","author":{"name":"Jerry Zhang","email":"ed118f6296c77633ddf296c0ad61cef8ada7486b@google.com"},"message":"ANDROID: usb: gadget: f_mtp: Return error if count is negative\n\nIf the user passes in a negative file size in a int64,\nthis will compare to be smaller than buffer length,\nand it will get truncated to form a read length that\nis larger than the buffer length.\n\nTo fix, return -EINVAL if the count argument is negative,\nso the loop will never happen.\n\nBug: 37429972\nTest: Test with PoC\nChange-Id: I5d52e38e6fbe2c17eb8c493f9eb81df6cfd780a4\nSigned-off-by: Jerry Zhang <zhangjerry@google.com>","distinct":false,"url":"https://api.github.com/repos/ezio84/abc_kernel_huawei_angler/commits/aa469e2bae1d36ecc7cf8425577627dbc4641493"}]}
{"actor":{"display_login":"ezio84"}}