{"push_id":1863908230,"size":114,"distinct_size":114,"ref":"refs/heads/px-0.2","head":"2d2352aaca6470baf8c2d0906a28146d76c11ffb","before":"55c4750bc21bd7e61aed861495570daa8c5b41f2","commits":[{"sha":"3c459473801c89407216aac901999c63d89e659c","author":{"name":"Seung-Woo Kim","email":"deea41885100c1970976e08c89d7c5783582068c@samsung.com"},"message":"UPSTREAM: regulator: core: Fix regualtor_ena_gpio_free not to access pin after freeing\n\nAfter freeing pin from regulator_ena_gpio_free, loop can access\nthe pin. So this patch fixes not to access pin after freeing.\n\nSigned-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\n(cherry picked from commit 60a2362f769cf549dc466134efe71c8bf9fbaaba)\nBug: 35399757\nChange-Id: I52ef20355f2fed4e1e81f727629260dedf2266a8","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/3c459473801c89407216aac901999c63d89e659c"},{"sha":"441bd8d46cda40895058f4ca9bb4edf1bfbc94fe","author":{"name":"Rohit kumar","email":"abfed2c299151715e755c999db9e510f8e7553be@samsung.com"},"message":"UPSTREAM: staging: ion: Fix error handling in ion_buffer_create\n\nThis patch fixes error handling case when buffer->pages allocation\nfails. Also, it removes unreachable code of checking ret variable\nalthough it is not updated.\n\nSigned-off-by: Rohit kumar <rohit.kr@samsung.com>\nReviewed-by: Laura Abbott <labbott@redhat.com>\nSuggested-by: Pintu Kumar <pintu.k@samsung.com>\nReviewed-by: Pintu Kumar <pintu.k@samsung.com>\nReviewed-by: Gioh Kim <gioh.kim@lge.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n(cherry picked from commit a56d092aa94ebcc9452ddaa47423b9a478aa6aa5)\nBug: 34283718\nChange-Id: Ic38b8e3ef0a21de4e38e58b4bb942535fe671ae5","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/441bd8d46cda40895058f4ca9bb4edf1bfbc94fe"},{"sha":"828ea88cf83d89aac9c72b3986c38902d8fb7cec","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: pcm : Call kill_fasync() in stream lock\n\ncommit 3aa02cb664c5fb1042958c8d1aa8c35055a2ebc4 upstream.\n\nCurrently kill_fasync() is called outside the stream lock in\nsnd_pcm_period_elapsed().  This is potentially racy, since the stream\nmay get released even during the irq handler is running.  Although\nsnd_pcm_release_substream() calls snd_pcm_drop(), this doesn't\nguarantee that the irq handler finishes, thus the kill_fasync() call\noutside the stream spin lock may be invoked after the substream is\ndetached, as recently reported by KASAN.\n\nAs a quick workaround, move kill_fasync() call inside the stream\nlock.  The fasync is rarely used interface, so this shouldn't have a\nbig impact from the performance POV.\n\nIdeally, we should implement some sync mechanism for the proper finish\nof stream and irq handler.  But this oneliner should suffice for most\ncases, so far.\n\nReported-by: Baozeng Ding <sploving1@gmail.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Willy Tarreau <w@1wt.eu>\nBug: 34068036\nChange-Id: I76537bedad967851b4c87ea142c7c5afeba99cfd","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/828ea88cf83d89aac9c72b3986c38902d8fb7cec"},{"sha":"3924db4103e2cb74426b543f4006404335322498","author":{"name":"Peter Zijlstra","email":"4d3106856cce90e8f40acc5180f60ddda3a23b6e@infradead.org"},"message":"perf: Tighten (and fix) the grouping condition\n\ncommit c3c87e770458aa004bd7ed3f29945ff436fd6511 upstream.\n\nThe fix from 9fc81d87420d (\"perf: Fix events installation during\nmoving group\") was incomplete in that it failed to recognise that\ncreating a group with events for different CPUs is semantically\nbroken -- they cannot be co-scheduled.\n\nFurthermore, it leads to real breakage where, when we create an event\nfor CPU Y and then migrate it to form a group on CPU X, the code gets\nconfused where the counter is programmed -- triggered in practice\nas well by me via the perf fuzzer.\n\nFix this by tightening the rules for creating groups. Only allow\ngrouping of counters that can be co-scheduled in the same context.\nThis means for the same task and/or the same cpu.\n\nFixes: 9fc81d87420d (\"perf: Fix events installation during moving group\")\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Arnaldo Carvalho de Melo <acme@kernel.org>\nCc: Jiri Olsa <jolsa@redhat.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nLink: http://lkml.kernel.org/r/20150123125834.090683288@infradead.org\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>\nBug: 34515362\nChange-Id: Ice29a6594b4f24d839b13dfaa3cc0b23079c867c","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/3924db4103e2cb74426b543f4006404335322498"},{"sha":"c7f2efaf7c87d4eb0c2efaeba4dbff55e345cb8d","author":{"name":"Nick Desaulniers","email":"b951273a67bf33267cd4dff69171cdef4e5efbe7@google.com"},"message":"tracing: do not leak kernel addresses\n\nThis likely breaks tracing tools like trace-cmd.  It logs in the same\nformat but now addresses are all 0x0.\n\nSigned-off-by: Nick Desaulniers <ndesaulniers@google.com>\nBug: 34277115\nChange-Id: Ifb0d4d2a184bf0d95726de05b1acee0287a375d9","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/c7f2efaf7c87d4eb0c2efaeba4dbff55e345cb8d"},{"sha":"8a475ed425fcbaffbc3fc9cc8f4086b3cae331b0","author":{"name":"Sri Krishna chowdary","email":"c0f938a5352381f83baf5c01508b6c85620825c9@nvidia.com"},"message":"video: tegra: nvmap: fix time-of-check,time-of-use vulnerability\n\nValidate the region specified by offset and size before performing\nthe operations like nvmap_prot_handle, nvmap_cache_maint and nvmap_handle_mk*.\n\nThis validation of offset and size once the values are in local variables\nguarantees that even though user space changes the values in user buffers,\nnvmap continues to perform operations with the contents that are validated.\n\nBug: 34113000\nNvBug 1862379\n\nSigned-off-by: Sri Krishna chowdary <schowdary@nvidia.com>\n(cherry picked from commit d930862c19f042a4d38228f537cce42b4a285390)\nSigned-off-by: Xia Yang <xiay@nvidia.com>\nChange-Id: I32786d26c269a95122fbaf0b91d6d090cba7388e","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/8a475ed425fcbaffbc3fc9cc8f4086b3cae331b0"},{"sha":"4cc129c974d653486d1c0d33a88dd12fe47c0536","author":{"name":"Amey Telawane","email":"13777422dfde799548206904658232ef44937ca5@codeaurora.org"},"message":"FROMLIST: trace: resolve stack corruption due to string copy\n\nhttps://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=2161ae9a70b12cf18ac8e5952a20161ffbccb477\n(Modified to place full buffer length in the hands of the strlcpy)\n\nStrcpy has no limit on string being copied which causes\nstack corruption leading to kernel panic. Use strlcpy to\nresolve the issue by providing length of string to be copied.\n\nCRs-fixed: 1048480\nBug: 35399704\nSigned-off-by: Amey Telawane <ameyt@codeaurora.org>\nChange-Id: Ib290b25f7e0ff96927b8530e5c078869441d409f","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/4cc129c974d653486d1c0d33a88dd12fe47c0536"},{"sha":"9785974363010110424ea81a9e63f2e9fee47077","author":{"name":"Robb Glasser","email":"b0c5b77df4bff135c4bb9b77cfba385da1f20c54@google.com"},"message":"Prevent heap overflow in uvc driver\n\nThe size of uvc_control_mapping is user controlled leading to a\npotential heap overflow in the uvc driver. This adds a check to verify\nthe user provided size fits within the bounds of the defined buffer\nsize.\n\nBug: 33300353\nChange-Id: If29c1b396633b6137966a12e38f6fd1841b045bd\nSigned-off-by: Robb Glasser <rglasser@google.com>","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/9785974363010110424ea81a9e63f2e9fee47077"},{"sha":"f99de0a97d983a6f69e7395ef8373d8ada1285a5","author":{"name":"Insun Song","email":"45d44d5682fa0b63007f01ad2f8d1a80dd09e336@broadcom.com"},"message":"net: wireless: bcmdhd: fix incorrect IOVAR buffer length use case\n\nThe buffer used by host driver for sending IOVAR request/response can\ndeliver some private kernel information to the dongle if it's not\nproperly uninitailized.\nthe fix is to redefine current IOVAR API to manage buffer length\ncorrectly. and updated all IOVAR caller instances.\n\nSigned-off-by: Insun Song <insun.song@broadcom.com>\nBug: 36000515\nChange-Id: Iff32f686980c8e837d695c617ab5b890d82871de","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/f99de0a97d983a6f69e7395ef8373d8ada1285a5"},{"sha":"93cfabdf14956b6b0cb49622806e631bb69b383b","author":{"name":"Andy Whitcroft","email":"4a4a9e194cc5d2585ac40c9d65b8b3b004616bed@canonical.com"},"message":"xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window\n\nWhen a new xfrm state is created during an XFRM_MSG_NEWSA call we validate\nthe user supplied replay_esn to ensure that the size is valid and to ensure\nthat the replay_window size is within the allocated buffer.  However later\nit is possible to update this replay_esn via a XFRM_MSG_NEWAE call.\nThere we again validate the size of the supplied buffer matches the\nexisting state and if so inject the contents.  We do not at this point\ncheck that the replay_window is within the allocated memory.  This leads\nto out-of-bounds reads and writes triggered by netlink packets.  This leads\nto memory corruption and the potential for priviledge escalation.\n\nWe already attempt to validate the incoming replay information in\nxfrm_new_ae() via xfrm_replay_verify_len().  This confirms that the\nuser is not trying to change the size of the replay state buffer which\nincludes the replay_esn.  It however does not check the replay_window\nremains within that buffer.  Add validation of the contained replay_window.\n\nAdditionally Kees Cook has pointed out that xfrm_replay_state_esn_len()\nis subject to wrapping issues.  To ensure we are correctly ensuring that\nthe two ESN structures are the same size compare both the overall size\nas reported by xfrm_replay_state_esn_len() and the internal length are\nthe same.\n\nCVE-2017-7184\nZDI-CAN-4586\nBug: 36565222\nSigned-off-by: Andy Whitcroft <apw@canonical.com>\nReviewed-by: Tyler Hicks <tyhicks@canonical.com>\nReviewed-by: John Johansen <john.johansen@canonical.com>\nReviewed-by: Kees Cook <keescook@chromium.org>\nChange-Id: I50d2766ab19fb182a5e75adf9e46ff043f2d99ea","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/93cfabdf14956b6b0cb49622806e631bb69b383b"},{"sha":"0a2199e7ff4e0ca0bfd8261b04d5e89d19302606","author":{"name":"Insun Song","email":"45d44d5682fa0b63007f01ad2f8d1a80dd09e336@broadcom.com"},"message":"net: wireless: bcmdhd: fix for IOVAR GET failed\n\nfound some case that IOVAR callers set response buffer not enough to\ncontain input command string + argument. so it finally fail in IOVAR\ntransaction by its shorter buffer length.\n\nproposed fix is taking care this case by providing enough local\nbuffer inside dhd_iovar, which enough to input/output.\n\nSigned-off-by: Insun Song <insun.song@broadcom.com>\nBug: 36000515\nChange-Id: I0afedcc29b05b12f42ebc619e6feeaa868fc00de","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/0a2199e7ff4e0ca0bfd8261b04d5e89d19302606"},{"sha":"34597d088801ad8060b45026df2435f52136032f","author":{"name":"Mark Salyzyn","email":"4814ffc71be21311f04ef34122c19152acc840c4@google.com"},"message":"flounder: FIQ and sysrq default deauthorized\n\n(cherry picked from commit c6389b11ae779d9f360d2c6555037e1d73c0fe1b)\n\nSigned-off-by: Mark Salyzyn <salyzyn@google.com>\nBug: 36101220\nChange-Id: I9f0ae9a9e3828dedf4b933bf1d752c98777cfa91","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/34597d088801ad8060b45026df2435f52136032f"},{"sha":"703b41c5433cd707edc0306a2d87a532fcdda847","author":{"name":"Andrew Chant","email":"74abe530dd61f06b906af7d23d7dcf61131999f9@google.com"},"message":"input: synaptics_dsx: validate bounds of intr_reg_num\n\n(cherry pick from commit 0c2d19ba23be8cf424ac9d74067039d237152dfc)\n\nValidate the intr_reg_num value returned by touchscreen\nto ensure no out of bounds access can occur.\n\nSigned-off-by: Andrew Chant <achant@google.com>\nBug: 35472278\nChange-Id: I22f5b67815fe7d448b5ed847e4e3d65af63bed84","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/703b41c5433cd707edc0306a2d87a532fcdda847"},{"sha":"d0fb858824cb587b290358843034c4bfc0728bb7","author":{"name":"Andy Chuang","email":"b80966eee27b04d916d2fef8f5502014e6cc0374@htc.com"},"message":"i2c: chip: CwMcuSensor: Fix Security Vulnerability\n\nactive_show: initialize data\n\nBug: 37280933\nSigned-off-by: Andy Chuang <andy_chuang@htc.com>\nChange-Id: Iabdf2225d9e64eef226d8e3d0fb678b8e835b714\n(cherry picked from commit 56120c0e5ddfc91783de1f6e4103c29135f89b75)","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/d0fb858824cb587b290358843034c4bfc0728bb7"},{"sha":"277fcbbf8321883f1db6a95958f17e08d7a8b3b9","author":{"name":"Andrey Konovalov","email":"acba6f9b010367f452595b80d6e1782629aa36cc@google.com"},"message":"BACKPORT: UPSTREAM: dccp: fix freeing skb too early for IPV6_RECVPKTINFO\n\nIn the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet\nis forcibly freed via __kfree_skb in dccp_rcv_state_process if\ndccp_v6_conn_request successfully returns.\n\nHowever, if IPV6_RECVPKTINFO is set on a socket, the address of the skb\nis saved to ireq->pktopts and the ref count for skb is incremented in\ndccp_v6_conn_request, so skb is still in use. Nevertheless, it gets freed\nin dccp_rcv_state_process.\n\nFix by calling consume_skb instead of doing goto discard and therefore\ncalling __kfree_skb.\n\nSimilar fixes for TCP:\n\nfb7e2399ec17f1004c0e0ccfd17439f8759ede01 [TCP]: skb is unexpectedly freed.\n0aea76d35c9651d55bbaf746e7914e5f9ae5a25d tcp: SYN packets are now\nsimply consumed\n\nSigned-off-by: Andrey Konovalov <andreyknvl@google.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nUpstream commit: 5edabca9d4cff7f1f2b68f0bac55ef99d9798ba4\nBug: 35784697\nChange-Id: I8613a901e1dad59335d56f58fa1b727ff449dba1","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/277fcbbf8321883f1db6a95958f17e08d7a8b3b9"},{"sha":"15cfbef59a5bb2235c1c938012e594ce02c61db1","author":{"name":"Geert Uytterhoeven","email":"6ab3568c168343bc5fcca77fbd6a3d6e63ce9838@linux-m68k.org"},"message":"UPSTREAM: char: Drop bogus dependency of DEVPORT on !M68K\n\n(cherry pick from commit 309124e2648d668a0c23539c5078815660a4a850)\n\nAccording to full-history-linux commit d3794f4fa7c3edc3 (\"[PATCH] M68k\nupdate (part 25)\"), port operations are allowed on m68k if CONFIG_ISA is\ndefined.\n\nHowever, commit 153dcc54df826d2f (\"[PATCH] mem driver: fix conditional\non isa i/o support\") accidentally changed an \"||\" into an \"&&\",\ndisabling it completely on m68k. This logic was retained when\nintroducing the DEVPORT symbol in commit 4f911d64e04a44c4 (\"Make\n/dev/port conditional on config symbol\").\n\nDrop the bogus dependency on !M68K to fix this.\n\nFixes: 153dcc54df826d2f (\"[PATCH] mem driver: fix conditional on isa i/o support\")\nSigned-off-by: Geert Uytterhoeven <geert@linux-m68k.org>\nTested-by: Al Stone <ahs3@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nBug: 37210310\nBug: 36604779\nChange-Id: I9139bd8a5a6e9e39c2e428bde23a7d9be07e2f91","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/15cfbef59a5bb2235c1c938012e594ce02c61db1"},{"sha":"b782e0c353156d1c946103c970f44a2adf3847dd","author":{"name":"Max Bires","email":"102f1af3c0fbbf60f83a5ad4e747d8b0816b7fc1@google.com"},"message":"UPSTREAM: char: lack of bool string made CONFIG_DEVPORT always on\n\n(cherry pick from commit f2cfa58b136e4b06a9b9db7af5ef62fbb5992f62)\n\nWithout a bool string present, using \"# CONFIG_DEVPORT is not set\" in\ndefconfig files would not actually unset devport. This esnured that\n/dev/port was always on, but there are reasons a user may wish to\ndisable it (smaller kernel, attack surface reduction) if it's not being\nused. Adding a message here in order to make this user visible.\n\nSigned-off-by: Max Bires <jbires@google.com>\nAcked-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nBug: 37210310\nBug: 36604779\nChange-Id: Ib1e947526f6c6f7cdf6389923287631056f32c36","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/b782e0c353156d1c946103c970f44a2adf3847dd"},{"sha":"242be00a475df51083c3ebc854a4fb2d7e333d2a","author":{"name":"Adrian Salido","email":"6d635a0a76d943c7a6d2808755e208535d850b07@google.com"},"message":"flounder_defconfig: Unsetting DEVPORT from config\n\n(cherry pick from commit 70b16b8e8ada345f6043f78e0cc7371bee5fb7e1)\n\n/dev/port is not used as shown by previous SELinux policy changes to\nblacklist it. It is being unset to reduce kernel size and attack\nsurface, mirroring the same chagnes done to DEVMEM and DEVKMEM.\n\nSigned-off-by: Adrian Salido <salidoa@google.com>\nSigned-off-by: Mark Salyzyn <salyzyn@google.com>\nBug: 37210310\nBug: 36604779\nChange-Id: Ied3c4cef06ed8c93884d83cf2d4931c366f91716","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/242be00a475df51083c3ebc854a4fb2d7e333d2a"},{"sha":"b7c30cdef95b490a0513fd0d64cc31173fd8e72b","author":{"name":"Stephen Smalley","email":"a113c662ba7e86bc1a8f97e28bfedcdc6b0de5bd@tycho.nsa.gov"},"message":"BACKPORT: UPSTREAM: selinux: fix off-by-one in setprocattr\n\nSELinux tries to support setting/clearing of /proc/pid/attr attributes\nfrom the shell by ignoring terminating newlines and treating an\nattribute value that begins with a NUL or newline as an attempt to\nclear the attribute.  However, the test for clearing attributes has\nalways been wrong; it has an off-by-one error, and this could further\nlead to reading past the end of the allocated buffer since commit\nbb646cdb12e75d82258c2f2e7746d5952d3e321a (\"proc_pid_attr_write():\nswitch to memdup_user()\").  Fix the off-by-one error.\n\nEven with this fix, setting and clearing /proc/pid/attr attributes\nfrom the shell is not straightforward since the interface does not\nsupport multiple write() calls (so shells that write the value and\nnewline separately will set and then immediately clear the attribute,\nrequiring use of echo -n to set the attribute), whereas trying to use\necho -n \"\" to clear the attribute causes the shell to skip the\nwrite() call altogether since POSIX says that a zero-length write\ncauses no side effects. Thus, one must use echo -n to set and echo\nwithout -n to clear, as in the following example:\n$ echo -n unconfined_u:object_r:user_home_t:s0 > /proc/$$/attr/fscreate\n$ cat /proc/$$/attr/fscreate\nunconfined_u:object_r:user_home_t:s0\n$ echo \"\" > /proc/$$/attr/fscreate\n$ cat /proc/$$/attr/fscreate\n\nNote the use of /proc/$$ rather than /proc/self, as otherwise\nthe cat command will read its own attribute value, not that of the shell.\n\nThere are no users of this facility to my knowledge; possibly we\nshould just get rid of it.\n\nUPDATE: Upon further investigation it appears that a local process\nwith the process:setfscreate permission can cause a kernel panic as a\nresult of this bug.  This patch fixes CVE-2017-2618.\n\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>\n[PM: added the update about CVE-2017-2618 to the commit description]\nCc: stable@vger.kernel.org # 3.5: d6ea83ec6864e\nSigned-off-by: Paul Moore <paul@paul-moore.com>\n\nSigned-off-by: James Morris <james.l.morris@oracle.com>\nBug: 35136920\nUpstream commit: 0c461cb727d146c9ef2d3e86214f498b78b7d125\n\nChange-Id: I41ba111bd79f6f60306316eb6de0425b1b7d8d19","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/b7c30cdef95b490a0513fd0d64cc31173fd8e72b"},{"sha":"4a6768a0ff59d54a8f74d983745b759c81251664","author":{"name":"razorloves","email":"1de006648111f4e78ad845b8c417635bfcddfae1@gmail.com"},"message":"Merge branch 'aosp/android-tegra-flounder-3.10-nougat-mr1.1' into cm-14.1\n\nN4F27B 7.1.1_r0.57 May 2017","distinct":true,"url":"https://api.github.com/repos/aopp/android_kernel_htc_flounder/commits/4a6768a0ff59d54a8f74d983745b759c81251664"}]}
{"actor":{"display_login":"tmossey"}}