{"push_id":1205369183,"size":29,"distinct_size":29,"ref":"refs/heads/cm","head":"aa0e7fd3a83b28503cd036f3db5e15f28f28593f","before":"7d320f3879ce168c7ca518d8c37a521036d1740d","commits":[{"sha":"55131a65a0de70d0af41fac8cfe67e7cd88652c5","author":{"name":"Pranav Vashi","email":"03be7ddd3681236397de02d2b35bff2ebe2e3300@gmail.com"},"message":"Bluetooth: Prevent Bluetooth L2CAP Remote Heap Memory Corruption\n\nA remote user can provide a small value for the command size field in\nthe command header of an l2cap configuration request, resulting in an\ninteger underflow when subtracting the size of the configuration request\nheader.  This results in copying a very large amount of data via\nmemcpy() and destroying the kernel heap.  Check for underflow.\n\nSigned-off-by: Pranav Vashi <neobuddy89@gmail.com>","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/55131a65a0de70d0af41fac8cfe67e7cd88652c5"},{"sha":"2708eb060ce305863df684c6ea079d5d4eb78722","author":{"name":"Pranav Vashi","email":"03be7ddd3681236397de02d2b35bff2ebe2e3300@gmail.com"},"message":"Bluetooth: Cancel power_on and power_off work\n\n* This is not exact upstream patch but replica\n  functions that will do similar function.\n\nSigned-off-by: Pranav Vashi <neobuddy89@gmail.com>","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/2708eb060ce305863df684c6ea079d5d4eb78722"},{"sha":"51fa8e3c87d2a6c2b896453ab48252ba5e3ec1a7","author":{"name":"Johan Hedberg","email":"96898026c3f4a50ee66f26e7291d450d5b98554a@intel.com"},"message":"Bluetooth: Fix missing length checks for L2CAP signalling PDUs\n\nThere has been code in place to check that the L2CAP length header\nmatches the amount of data received, but many PDU handlers have not been\nchecking that the data received actually matches that expected by the\nspecific PDU. This patch adds passing the length header to the specific\nhandler functions and ensures that those functions fail cleanly in the\ncase of an incorrect amount of data.\n\nSigned-off-by: Johan Hedberg <johan.hedberg@intel.com>\nSigned-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>\nSigned-off-by: John W. Linville <linville@tuxdriver.com>\n[bwh: Backported to 3.2:\n - Adjust context\n - Move uses of *req below the new check in l2cap_connect_req]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\n[wujg: Backported to 3.4:\n - Adjust context\n - Adjust l2cap_create_channel_rsp()'s parameters]\nSigned-off-by: Jianguo Wu <wujianguo@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n[neo: Adapt to msm-3.4]\nSigned-off-by: Pranav Vashi <neobuddy89@gmail.com>","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/51fa8e3c87d2a6c2b896453ab48252ba5e3ec1a7"},{"sha":"5f0a8da423bfe9f07b678d929cfd962e98d5125b","author":{"name":"Jaganath Kanakkassery","email":"b1803504bdc91c6b87292801bbc34df5d0b85920@samsung.com"},"message":"Bluetooth: Fix invalid length check in l2cap_information_rsp()\n\nThe length check is invalid since the length varies with type of\ninfo response.\n\nThis was introduced by the commit cb3b3152b2f5939d67005cff841a1ca748b19888\n\nBecause of this, l2cap info rsp is not handled and command reject is sent.\n\n> ACL data: handle 11 flags 0x02 dlen 16\n        L2CAP(s): Info rsp: type 2 result 0\n          Extended feature mask 0x00b8\n            Enhanced Retransmission mode\n            Streaming mode\n            FCS Option\n            Fixed Channels\n< ACL data: handle 11 flags 0x00 dlen 10\n        L2CAP(s): Command rej: reason 0\n          Command not understood\n\nCc: stable@vger.kernel.org\nSigned-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>\nSigned-off-by: Chan-Yeol Park <chanyeol.park@samsung.com>\nAcked-by: Johan Hedberg <johan.hedberg@intel.com>\nSigned-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>\nSigned-off-by: Pranav Vashi <neobuddy89@gmail.com>","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/5f0a8da423bfe9f07b678d929cfd962e98d5125b"},{"sha":"3eb1d4b3f66047bfb822cd58d29ba8dd2d0195c5","author":{"name":"Mathias Krause","email":"c0f5a800b69cdfd927790b9eec175d77c6a1b20d@googlemail.com"},"message":"Bluetooth: fix possible info leak in bt_sock_recvmsg()\n\nIn case the socket is already shutting down, bt_sock_recvmsg() returns\nwith 0 without updating msg_namelen leading to net/socket.c leaking the\nlocal, uninitialized sockaddr_storage variable to userland -- 128 bytes\nof kernel stack memory.\n\nFix this by moving the msg_namelen assignment in front of the shutdown\ntest.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Marcel Holtmann <marcel@holtmann.org>\nCc: Gustavo Padovan <gustavo@padovan.org>\nCc: Johan Hedberg <johan.hedberg@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Pranav Vashi <neobuddy89@gmail.com>","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/3eb1d4b3f66047bfb822cd58d29ba8dd2d0195c5"},{"sha":"266592ac42e99bac5635ca95a481d23634df5fbd","author":{"name":"anarkia1976","email":"078723513d34710cd351f8b6160a9737c59fdc4e@gmail.com"},"message":"toolchain: gcc: squashed fixes related to optimized toolchain\n\nMakefile: add Linaro goddess optimizations\n\ntoolchain: linaro: Fix a bunch of warnings and errors\n\nChange-Id: I74dc4a9a1c46a9d84d2a592d24a905b21aa87a15\n\ntoolchain: linaro: Fix a bunch of warnings and errors II\n\ntoolchain: linaro: fix uninitialized kbuf in sysctl.c for linaro optimizations\n\nChange-Id: Idd983e621b67d4016ff113b18de8f8a59bc70c85\n\ntoolchain: linaro: fix warning subbuf.pages may be used uninitialized\n\nChange-Id: I0aaa7ccb4a29ec58d7d05e24c19f22c8cc50c8cb\n\ntoolchain: linaro: fix ICE in fs/fs-writeback.c with gcc4.7\n\nfs/fs-writeback.c: In function 'bdi_writeback_thread':\nfs/fs-writeback.c:993:1: internal compiler error: in push_minipool_fix, at config/arm/arm.c:13180\nPlease submit a full bug report,\nwith preprocessed source if appropriate.\nSee <http://gcc.gnu.org/bugs.html> for instructions.\nmake[1]: *** [fs/fs-writeback.o] Error 1\nmake: *** [fs] Error 2\n\n$ arm-eabi-gcc -v\nUsing built-in specs.\nCOLLECT_GCC=/home/showp1984/WORK/toolchain/android-toolchain-eabi/bin/arm-eabi-gcc\nCOLLECT_LTO_WRAPPER=/home/showp1984/WORK/toolchain/android-toolchain-eabi/bin/../libexec/gcc/arm-eabi/4.7.2/lto-wrapper\nTarget: arm-eabi\nConfigured with: /mnt/jenkins/workspace/linaro-android_toolchain-4.7-2012.09/build/objdir/temp-src/gcc-linaro-4.7-2012.09/configure --prefix=/tmp/android-toolchain-eabi --host=x86_64-linux-gnu --build=x86_64-linux-gnu --with-gnu-as --with-gnu-ld --enable-languages=c,c++ --with-gmp=/mnt/jenkins/workspace/linaro-android_toolchain-4.7-2012.09/build/objdir/temp-install --with-mpfr=/mnt/jenkins/workspace/linaro-android_toolchain-4.7-2012.09/build/objdir/temp-install --with-mpc=/mnt/jenkins/workspace/linaro-android_toolchain-4.7-2012.09/build/objdir/temp-install --with-cloog=/mnt/jenkins/workspace/linaro-android_toolchain-4.7-2012.09/build/objdir/temp-install --with-ppl=/mnt/jenkins/workspace/linaro-android_toolchain-4.7-2012.09/build/objdir/temp-install --disable-ppl-version-check --disable-cloog-version-check --enable-cloog-backend=isl --with-host-libstdcxx='-static-libgcc -Wl,-Bstatic,-lstdc++,-Bdynamic -lm' --disable-libssp --disable-nls --disable-libmudflap --disable-shared --disable-sjlj-exceptions --disable-libquadmath --disable-libitm --disable-libatomic --with-float=soft --with-fpu=vfp --with-arch=armv5te --enable-target-optspace --prefix=/tmp/android-toolchain-eabi --disable-docs --disable-nls --with-gcc-version=linaro-4.7-2012.09 --with-binutils-version=2.23.51.0.3 --with-gmp-version=5.0.5 --with-mpfr-version=3.1.1 --with-mpc-version=1.0 --target=arm-eabi --enable-threads --enable-tls --disable-libgomp --disable-libstdc__-v3 --disable-libitm --disable-libatomic\nThread model: single\ngcc version 4.7.2 20120910 (prerelease) (Linaro GCC 4.7-2012.09)\n\nChange-Id: Ibf92c1f6d844368fe9da52315a975dc1928962a7\nSigned-off-by: Dennis Rassmann <showp1984@gmail.com>\n\ntoolchain: linaro: Fix a bunch of warnings and errors -O3\n\n- Fixes a bunch of initiliazed vars\n- Compile lib/bitmap.c with -Os due of a bug\n  Reference: https://code.google.com/p/bricked/source/detail?repo=tenderloin&r=cb8b2fe72f43c5146cb340abb2026810e50a23fc\n- Disable array-bounds warning on staging prima driver\n\nChange-Id: If17b3db45d8494bb5b5f8e13b8e8478e4fc9b10f\n\ntoolchain: linaro: fix warning: 'it.task' may be used uninitialized in this function\n\nSigned-off-by: Dennis Rassmann <showp1984@gmail.com>\n\ntoolchain: linaro: xc5000: fix warning 'quality' may be used uninitialized in this function\n\nSigned-off-by: Dennis Rassmann <showp1984@gmail.com>\n\ntoolchain: linaro: fix warning 'kernel_dev' may be used uninitialized in this function\n\nSigned-off-by: Dennis Rassmann <showp1984@gmail.com>\n\ntoolchain: linaro: fix 'warning: 'kernel_type' may be used uninitialized in this function\n\nSigned-off-by: Dennis Rassmann <showp1984@gmail.com>\n\ntoolchain: linaro: xc5000: fix warning 'frame_lines' may be used uninitialized in this function\n\nSigned-off-by: Dennis Rassmann <showp1984@gmail.com>\n\ntoolchain: linaro: l2cap_core: fix 'warning: '...' may be used uninitialized in this function\n\nSigned-off-by: Dennis Rassmann <showp1984@gmail.com>\n\nfix: kernel/auditsc.c:927:23: warning: 'state' may be used uninitialized in this function\n\nSigned-off-by: Dennis Rassmann <showp1984@gmail.com>\n\ndrivers/media/common/tuners/xc5000: fix 'warning: 'lock_status' may be used uninitialized in this function'\n\nSigned-off-by: Dennis Rassmann <showp1984@gmail.com>\n\ndrivers/media/common/tuners/xc5000: fix 'warning: 'adc_envelope' may be used uninitialized in this function'\n\nSigned-off-by: Dennis Rassmann <showp1984@gmail.com>\n\ndrivers/media/common/tuners/xc4000: fix 'warning: '...' may be used uninitialized in this function'\n\nSigned-off-by: Dennis Rassmann <showp1984@gmail.com>\n\ndrivers/usb/host/ehci-sched: fix: 'warning: 'c_mask' may be used uninitialized in this function'\n\nSigned-off-by: Dennis Rassmann <showp1984@gmail.com>\n\nfs/fuse/control: fix 'warning: 'val' may be used uninitialized in this function'\n\nSigned-off-by: Dennis Rassmann <showp1984@gmail.com>\n\nfs/jbd2/journal: fix: 'warning: 'blocknr' may be used uninitialized in this function'\n\nSigned-off-by: Dennis Rassmann <showp1984@gmail.com>\n\nnet/unix/af_unix: fix: 'warning: '...' may be used uninitialized in this function'\n\nSigned-off-by: Dennis Rassmann <showp1984@gmail.com>\n\nARM: compressed/head.S: work around new binutils warning\n\nIn August 2012, Matthew Gretton-Dann checked a change\ninto binutils labelled \"Error on obsolete & warn on\ndeprecated registers\", apparently as part of ARMv8\nsupport. Apparently, this was supposed to emit\nthe message \"Warning: This coprocessor register access\nis deprecated in ARMv8\" when using certain mcr/mrc\ninstructions and building for ARMv8. Unfortunately,\nthe message that is actually emitted appears to be\n'(null)', which is less helpful in comparison.\n\nEven more unfortunately, this is biting us on\nevery single kernel build with a new gas, because\narch/arm/boot/compressed/head.S and some other files\nin that directory are built with -march=all since\nkernel commit 80cec14a8 \"[ARM] Add -march=all to\nassembly file build in arch/arm/boot/compressed\"\nback in v2.6.28.\n\nThis patch reverts Russell's nice solution and\nreplaces it with a more complex one that sprinkles\n.arch statements inside of the head.S file in\nfunctions that are executed in different architecture\nlevels, which seems to solve the original problem\njust as well, and gets rid of the new one, too.\n\nWithout this patch, building anything results in:\n\narch/arm/boot/compressed/head.S: Assembler messages:\narch/arm/boot/compressed/head.S:565: Warning: (null)\narch/arm/boot/compressed/head.S:676: Warning: (null)\narch/arm/boot/compressed/head.S:698: Warning: (null)\narch/arm/boot/compressed/head.S:722: Warning: (null)\narch/arm/boot/compressed/head.S:726: Warning: (null)\narch/arm/boot/compressed/head.S:957: Warning: (null)\narch/arm/boot/compressed/head.S:996: Warning: (null)\narch/arm/boot/compressed/head.S:997: Warning: (null)\narch/arm/boot/compressed/head.S:1027: Warning: (null)\narch/arm/boot/compressed/head.S:1035: Warning: (null)\narch/arm/boot/compressed/head.S:1046: Warning: (null)\narch/arm/boot/compressed/head.S:1060: Warning: (null)\narch/arm/boot/compressed/head.S:1092: Warning: (null)\narch/arm/boot/compressed/head.S:1094: Warning: (null)\narch/arm/boot/compressed/head.S:1095: Warning: (null)\narch/arm/boot/compressed/head.S:1102: Warning: (null)\narch/arm/boot/compressed/head.S:1134: Warning: (null)\n\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nCc: Matthew Gretton-Dann <matthew.gretton-dann@arm.com>\nCc: Russell King <rmk+kernel@arm.linux.org.uk>\nSigned-off-by: Paul Beeler <sparksco@gmail.com>\n\nreturn_address.c: Fix warning - TODO: return_address should use unwind tables\n\nAdded Linaro 4.8.2 Fixes\n\narch: boot: target armv7-a\n\nmakefile: add -DNDEBUG to KBUILD_CFLAGS\n\ntransport.c: Fix warning: 'midQ' may be used uninitialized in this function\n\nepm_adc.c: Fix warning ‘*((void *)&adc_data+2)’ may be used uninitialized in this function\n\nkeystore.c: Fix warning ‘payload_len’ may be used uninitialized in this function\n\nFix gcc-4.9.0 miscompilation of load_balance() in scheduler\n\ncommit 2062afb4f804afef61cbe62a30cac9a46e58e067 upstream.\n\nMichel Dänzer and a couple of other people reported inexplicable random\noopses in the scheduler, and the cause turns out to be gcc mis-compiling\nthe load_balance() function when debugging is enabled.  The gcc bug\napparently goes back to gcc-4.5, but slight optimization changes means\nthat it now showed up as a problem in 4.9.0 and 4.9.1.\n\nThe instruction scheduling problem causes gcc to schedule a spill\noperation to before the stack frame has been created, which in turn can\ncorrupt the spilled value if an interrupt comes in.  There may be other\neffects of this bug too, but that's the code generation problem seen in\nMichel's case.\n\nThis is fixed in current gcc HEAD, but the workaround as suggested by\nMarkus Trippelsdorf is pretty simple: use -fno-var-tracking-assignments\nwhen compiling the kernel, which disables the gcc code that causes the\nproblem.  This can result in slightly worse debug information for\nvariable accesses, but that is infinitely preferable to actual code\ngeneration problems.\n\nDoing this unconditionally (not just for CONFIG_DEBUG_INFO) also allows\nnon-debug builds to verify that the debug build would be identical: we\ncan do\n\n    export GCC_COMPARE_DEBUG=1\n\nto make gcc internally verify that the result of the build is\nindependent of the \"-g\" flag (it will make the compiler build everything\ntwice, toggling the debug flag, and compare the results).\n\nWithout the \"-fno-var-tracking-assignments\" option, the build would fail\n(even with 4.8.3 that didn't show the actual stack frame bug) with a gcc\ncompare failure.\n\nSee also gcc bugzilla:\n\n  https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61801\n\nReported-by: Michel Dänzer <michel@daenzer.net>\nSuggested-by: Markus Trippelsdorf <markus@trippelsdorf.de>\nCc: Jakub Jelinek <jakub@redhat.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nmakefile: add to -Os -> call cc-disable-warning,maybe-uninitialized\n\nFixes for kernel compile w/ 4.8\n\nppp: ppp_generic.c: warning code may be used uninitialized in this function\n\nmach-msm: Kconfig: fix mistake into default settings\n\nsabermod: toolchian: Fix unitialized variables when compile with 4.9\n\nChange-Id: I874e273b691fb66d4eb769334a539de9db9b7834\n\nsabermod: toolchian: Fix unitialized variables for hub.c\n\nsabermod: makefile: reworked all flags for stability\n\n* Thanks a lot @fusionjack\n\ndrivers/video/msm/mdss/mdss_mdp_util.c: fix: warning: array subscript is below array bounds\n\nSigned-off-by: Dennis Rassmann <showp1984@gmail.com>\n\nsound/soc/msm/qdsp6v2/msm-pcm-routing-v2.c: fix: warning: array subscript is below array bounds\n\ndrivers/input/tablet/gtco.c: fix: 'warning: 'oldval[2]' may be used uninitialized in this function'\n\nSigned-off-by: Dennis Rassmann <showp1984@gmail.com>\n\nConflicts:\n\tMakefile\n\tarch/arm/boot/compressed/Makefile\n\tarch/arm/kernel/return_address.c\n\tfs/ecryptfs/keystore.c\n\nConflicts:\n\tarch/arm/mach-msm/Kconfig","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/266592ac42e99bac5635ca95a481d23634df5fbd"},{"sha":"fc74e226f060be5831a16b1d582d04383d6e633d","author":{"name":"Praveen Chidambaram","email":"5b8e7315e234ba06b92875954f8222e74109e23d@codeaurora.org"},"message":"arm: irq: Notify affinity change when migrating IRQs during hotplug\n\nHotplug causes IRQs affine to a core that is being taken down to migrate\nto an online core. This is done by directly calling the irq_set_affinity\nassociated with the irq_chip structure. Instead using the\nirq_set_affinity() api lets the notifications bubble through.\n\nChange-Id: I81340dc6643a8217518212b9fc949c9a808aea05\nSigned-off-by: Praveen Chidambaram <pchidamb@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/fc74e226f060be5831a16b1d582d04383d6e633d"},{"sha":"8ae4b876031448c6295be375631e8947173e14f5","author":{"name":"Peng Liu","email":"0dbd8d109f4fd581a261d165c84a6c6f6d9a95c9@motorola.com"},"message":"arm: irq: warn only when affinity really breaks\n\nFollowing change causes unnecessary warnings printed for those IRQ's\nwhich are affine to several CPU's when one of these CPU's is taken off\nline. It shouldn't be considered a broken affinity when one online\nCPU can satisfy the IRQ's affinity preference.\n\ncommit 0410136f260e3e580c556f0e8b9b66cad7a67449\nAuthor: Praveen Chidambaram <pchidamb@codeaurora.org>\nDate:   Mon Jun 23 08:58:08 2014 -0600\n\narm: irq: Notify affinity change when migrating IRQs during hotplug\n\nHotplug causes IRQs affine to a core that is being taken down to migrate\nto an online core. This is done by directly calling the irq_set_affinity\nassociated with the irq_chip structure. Instead using the\nirq_set_affinity() api lets the notifications bubble through.\n\nChange-Id: Id4ab4e751f647cbe07ab159f371a5ef94db988cf\nSigned-off-by: Peng Liu <a22543@motorola.com>\nReviewed-on: http://gerrit.mot.com/755421\nSLTApproved: Slta Waiver <sltawvr@motorola.com>\nSME-Granted: SME Approvals Granted\nTested-by: Jira Key <jirakey@motorola.com>\nReviewed-by: Lian-Wei Wang <lian-wei.wang@motorola.com>\nReviewed-by: Christopher Fries <cfries@motorola.com>\nSubmit-Approved: Jira Key <jirakey@motorola.com>","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/8ae4b876031448c6295be375631e8947173e14f5"},{"sha":"3542040a501efa71602c0619e9aaa1cdd4ebcd4d","author":{"name":"Jaeseong GIM","email":"26cd280f6e03b76486a38d6e2f8fa59da7f70f8f@lge.com"},"message":"persistent_ram: check PERSISTENT_RAM_SIG before writing\n\nif the PERSISTENT_RAM_SIG was corrupted, do not write something\nto the persistent_ram buffer. this may cause the abnormal crash.\n\nChange-Id: Ibd3082f7abeaa0e2e4b8f5022360977ec29add6f\n\npersistent_ram: fix wrong error code\n\nneed to be \"return -EINVAL\" on error\n\nChange-Id: Ie465ecc4ebf64e205994829af8b33481c6139b64","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/3542040a501efa71602c0619e9aaa1cdd4ebcd4d"},{"sha":"f437be2ed9cfede6e8cef5b011211d4abe1f8ce9","author":{"name":"Damir Didjusto","email":"8983791ae9b05648c1ee9759b688531bad755c37@codeaurora.org"},"message":"ASoC: msm: qdsp6v2: Add check for DSP status before using the size\n\nAdd the check for the DSP return status code before using the size\nto copy the data into the destination buffer. If the DSP returns\nan error, the size should not be used, error should be returned\ninstead.\n\nCRs-fixed: 668331\nChange-Id: Ia27de9f59fbd14ac5c829ba3f1d89a0175f7a7a1\nSigned-off-by: Damir Didjusto <damird@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/f437be2ed9cfede6e8cef5b011211d4abe1f8ce9"},{"sha":"6ed9f3623f1ad6fbea01f49903325edf73500f67","author":{"name":"Ben Romberger","email":"2772df8d823613470d53736f8956ebb045c68740@codeaurora.org"},"message":"ASoC: msm: Add bounds checking to ADM get params\n\nAdd additional bounds checking to ADM get params.\nValidate that all buffer sizes are valid before\ndereferencing.\n\n00b404eb had already added most of this change for\nthis kernel, so only add the missing check and\nclean up the whitespace a little.\n\nBUG=27947307\n\nChange-Id: Iae3643985b5b72b78606f4dff94f8068ee0ddc09","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/6ed9f3623f1ad6fbea01f49903325edf73500f67"},{"sha":"1b0fdab1aa64a222139756eedde9d9d6c4fc1083","author":{"name":"Julia Lawall","email":"5f26763d26f96d414e30b3f33734591afe022543@lip6.fr"},"message":"Input: aiptek - adjust error-handling code label\n\nAt the point of this error-handling code, aiptek->urb has been allocated,\nand it does not appear to be less necessary to free it here than in the\nerror-handling code just below.\n\nChange-Id: I1b07d7cd62a3df78759dd5a9a5ad27e58350df01\nSigned-off-by: Julia Lawall <Julia.Lawall@lip6.fr>\nSigned-off-by: Dmitry Torokhov <dtor@mail.ru>","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/1b0fdab1aa64a222139756eedde9d9d6c4fc1083"},{"sha":"71753562efb2690aae884845d8bf0d689d39482f","author":{"name":"Vladis Dronov","email":"41435c47c64e54f8ec26bbc1be6d7972ea4d40bd@redhat.com"},"message":"Input: aiptek - fix crash on detecting device without endpoints\n\nThe aiptek driver crashes in aiptek_probe() when a specially crafted USB\ndevice without endpoints is detected. This fix adds a check that the device\nhas proper configuration expected by the driver. Also an error return value\nis changed to more matching one in one of the error paths.\n\nChange-Id: I02fa4ffcbe9a71948947ef5baeb72632688d9d07\nReported-by: Ralf Spenneberg <ralf@spenneberg.net>\nSigned-off-by: Vladis Dronov <vdronov@redhat.com>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/71753562efb2690aae884845d8bf0d689d39482f"},{"sha":"b66444a85f46f0430e2aaca48b08175f8e1b915e","author":{"name":"Christophe Leroy","email":"039dabc4895565112aed26d4ec2b65f486237723@c-s.fr"},"message":"splice: sendfile() at once fails for big files\n\ncommit 0ff28d9f4674d781e492bcff6f32f0fe48cf0fed upstream.\n\nUsing sendfile with below small program to get MD5 sums of some files,\nit appear that big files (over 64kbytes with 4k pages system) get a\nwrong MD5 sum while small files get the correct sum.\nThis program uses sendfile() to send a file to an AF_ALG socket\nfor hashing.\n\n/* md5sum2.c */\n#include <stdio.h>\n#include <stdlib.h>\n#include <unistd.h>\n#include <string.h>\n#include <fcntl.h>\n#include <sys/socket.h>\n#include <sys/stat.h>\n#include <sys/types.h>\n#include <linux/if_alg.h>\n\nint main(int argc, char **argv)\n{\n\tint sk = socket(AF_ALG, SOCK_SEQPACKET, 0);\n\tstruct stat st;\n\tstruct sockaddr_alg sa = {\n\t\t.salg_family = AF_ALG,\n\t\t.salg_type = \"hash\",\n\t\t.salg_name = \"md5\",\n\t};\n\tint n;\n\n\tbind(sk, (struct sockaddr*)&sa, sizeof(sa));\n\n\tfor (n = 1; n < argc; n++) {\n\t\tint size;\n\t\tint offset = 0;\n\t\tchar buf[4096];\n\t\tint fd;\n\t\tint sko;\n\t\tint i;\n\n\t\tfd = open(argv[n], O_RDONLY);\n\t\tsko = accept(sk, NULL, 0);\n\t\tfstat(fd, &st);\n\t\tsize = st.st_size;\n\t\tsendfile(sko, fd, &offset, size);\n\t\tsize = read(sko, buf, sizeof(buf));\n\t\tfor (i = 0; i < size; i++)\n\t\t\tprintf(\"%2.2x\", buf[i]);\n\t\tprintf(\"  %s\\n\", argv[n]);\n\t\tclose(fd);\n\t\tclose(sko);\n\t}\n\texit(0);\n}\n\nTest below is done using official linux patch files. First result is\nwith a software based md5sum. Second result is with the program above.\n\nroot@vgoip:~# ls -l patch-3.6.*\n-rw-r--r--    1 root     root         64011 Aug 24 12:01 patch-3.6.2.gz\n-rw-r--r--    1 root     root         94131 Aug 24 12:01 patch-3.6.3.gz\n\nroot@vgoip:~# md5sum patch-3.6.*\nb3ffb9848196846f31b2ff133d2d6443  patch-3.6.2.gz\nc5e8f687878457db77cb7158c38a7e43  patch-3.6.3.gz\n\nroot@vgoip:~# ./md5sum2 patch-3.6.*\nb3ffb9848196846f31b2ff133d2d6443  patch-3.6.2.gz\n5fd77b24e68bb24dcc72d6e57c64790e  patch-3.6.3.gz\n\nAfter investivation, it appears that sendfile() sends the files by blocks\nof 64kbytes (16 times PAGE_SIZE). The problem is that at the end of each\nblock, the SPLICE_F_MORE flag is missing, therefore the hashing operation\nis reset as if it was the end of the file.\n\nThis patch adds SPLICE_F_MORE to the flags when more data is pending.\n\nWith the patch applied, we get the correct sums:\n\nroot@vgoip:~# md5sum patch-3.6.*\nb3ffb9848196846f31b2ff133d2d6443  patch-3.6.2.gz\nc5e8f687878457db77cb7158c38a7e43  patch-3.6.3.gz\n\nroot@vgoip:~# ./md5sum2 patch-3.6.*\nb3ffb9848196846f31b2ff133d2d6443  patch-3.6.2.gz\nc5e8f687878457db77cb7158c38a7e43  patch-3.6.3.gz\n\nSigned-off-by: Christophe Leroy <christophe.leroy@c-s.fr>\nSigned-off-by: Jens Axboe <axboe@fb.com>\nCc: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/b66444a85f46f0430e2aaca48b08175f8e1b915e"},{"sha":"488b1f1192dd17b189b532241fb6ff2297a75393","author":{"name":"Andy Lutomirski","email":"3cb7d5a8804519b67b2d7945dee31e85c91c02f9@kernel.org"},"message":"x86/iopl/64: Properly context-switch IOPL on Xen PV\n\ncommit b7a584598aea7ca73140cb87b40319944dd3393f upstream.\n\nOn Xen PV, regs->flags doesn't reliably reflect IOPL and the\nexit-to-userspace code doesn't change IOPL.  We need to context\nswitch it manually.\n\nI'm doing this without going through paravirt because this is\nspecific to Xen PV.  After the dust settles, we can merge this with\nthe 32-bit code, tidy up the iopl syscall implementation, and remove\nthe set_iopl pvop entirely.\n\nFixes XSA-171.\n\nReviewewd-by: Jan Beulich <JBeulich@suse.com>\nSigned-off-by: Andy Lutomirski <luto@kernel.org>\nCc: Andrew Cooper <andrew.cooper3@citrix.com>\nCc: Andy Lutomirski <luto@amacapital.net>\nCc: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nCc: Borislav Petkov <bp@alien8.de>\nCc: Brian Gerst <brgerst@gmail.com>\nCc: David Vrabel <david.vrabel@citrix.com>\nCc: Denys Vlasenko <dvlasenk@redhat.com>\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: Jan Beulich <JBeulich@suse.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nLink: http://lkml.kernel.org/r/693c3bd7aeb4d3c27c92c622b7d0f554a458173c.1458162709.git.luto@kernel.org\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\n[ kamal: backport to 3.19-stable: no X86_FEATURE_XENPV so just call\n  xen_pv_domain() directly ]\nAcked-by: Andy Lutomirski <luto <at> kernel.org>\nSigned-off-by: Kamal Mostafa <kamal <at> canonical.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/488b1f1192dd17b189b532241fb6ff2297a75393"},{"sha":"17e42614e65a0b1d18dfa294fa3fe999ee4867b2","author":{"name":"Ben Hutchings","email":"9c85637c38b80821c7bd8a03bde7b59da81ab77d@decadent.org.uk"},"message":"usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message\n\ncommit 5377adb092664d336ac212499961cac5e8728794 upstream.\n\nusb_parse_ss_endpoint_companion() now decodes the burst multiplier\ncorrectly in order to check that it's <= 3, but still uses the wrong\nexpression if warning that it's > 3.\n\nFixes: ff30cbc8da42 (\"usb: Use the USB_SS_MULT() macro to get the ...\")\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/17e42614e65a0b1d18dfa294fa3fe999ee4867b2"},{"sha":"85e7c3ca8835c2b6addd0560ab2ab8817867c450","author":{"name":"Peter Zijlstra","email":"4d3106856cce90e8f40acc5180f60ddda3a23b6e@infradead.org"},"message":"sched/core: Fix TASK_DEAD race in finish_task_switch()\n\ncommit 95913d97914f44db2b81271c2e2ebd4d2ac2df83 upstream.\n\nSo the problem this patch is trying to address is as follows:\n\n        CPU0                            CPU1\n\n        context_switch(A, B)\n                                        ttwu(A)\n                                          LOCK A->pi_lock\n                                          A->on_cpu == 0\n        finish_task_switch(A)\n          prev_state = A->state  <-.\n          WMB                      |\n          A->on_cpu = 0;           |\n          UNLOCK rq0->lock         |\n                                   |    context_switch(C, A)\n                                   `--  A->state = TASK_DEAD\n          prev_state == TASK_DEAD\n            put_task_struct(A)\n                                        context_switch(A, C)\n                                        finish_task_switch(A)\n                                          A->state == TASK_DEAD\n                                            put_task_struct(A)\n\nThe argument being that the WMB will allow the load of A->state on CPU0\nto cross over and observe CPU1's store of A->state, which will then\nresult in a double-drop and use-after-free.\n\nNow the comment states (and this was true once upon a long time ago)\nthat we need to observe A->state while holding rq->lock because that\nwill order us against the wakeup; however the wakeup will not in fact\nacquire (that) rq->lock; it takes A->pi_lock these days.\n\nWe can obviously fix this by upgrading the WMB to an MB, but that is\nexpensive, so we'd rather avoid that.\n\nThe alternative this patch takes is: smp_store_release(&A->on_cpu, 0),\nwhich avoids the MB on some archs, but not important ones like ARM.\n\nReported-by: Oleg Nesterov <oleg@redhat.com>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nAcked-by: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: linux-kernel@vger.kernel.org\nCc: manfred@colorfullife.com\nCc: will.deacon@arm.com\nFixes: e4a52bcb9a18 (\"sched: Remove rq->lock from the first half of ttwu()\")\nLink: http://lkml.kernel.org/r/20150929124509.GG3816@twins.programming.kicks-ass.net\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\n[lizf: Backported to 3.4: use smb_mb() instead of smp_store_release(), which\n is not defined in 3.4.y]\nSigned-off-by: Zefan Li <lizefan@huawei.com>","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/85e7c3ca8835c2b6addd0560ab2ab8817867c450"},{"sha":"06b48670679185431c43a1b2883126515d733c9f","author":{"name":"Doron Tsur","email":"05868328a31b4d868a76313f2e48c57180557da6@mellanox.com"},"message":"IB/cm: Fix rb-tree duplicate free and use-after-free\n\ncommit 0ca81a2840f77855bbad1b9f172c545c4dc9e6a4 upstream.\n\nib_send_cm_sidr_rep could sometimes erase the node from the sidr\n(depending on errors in the process). Since ib_send_cm_sidr_rep is\ncalled both from cm_sidr_req_handler and cm_destroy_id, cm_id_priv\ncould be either erased from the rb_tree twice or not erased at all.\nFixing that by making sure it's erased only once before freeing\ncm_id_priv.\n\nFixes: a977049dacde ('[PATCH] IB: Add the kernel CM implementation')\nSigned-off-by: Doron Tsur <doront@mellanox.com>\nSigned-off-by: Matan Barak <matanb@mellanox.com>\nSigned-off-by: Doug Ledford <dledford@redhat.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/06b48670679185431c43a1b2883126515d733c9f"},{"sha":"860e1b1ac4eb0fb448fe3ea8b5ed7261f05e2133","author":{"name":"Ard Biesheuvel","email":"80b89d4a5c0c8f00cebbb9c7d8a672c776f22af1@linaro.org"},"message":"ARM: 8429/1: disable GCC SRA optimization\n\ncommit a077224fd35b2f7fbc93f14cf67074fc792fbac2 upstream.\n\nWhile working on the 32-bit ARM port of UEFI, I noticed a strange\ncorruption in the kernel log. The following snprintf() statement\n(in drivers/firmware/efi/efi.c:efi_md_typeattr_format())\n\n\tsnprintf(pos, size, \"|%3s|%2s|%2s|%2s|%3s|%2s|%2s|%2s|%2s]\",\n\nwas producing the following output in the log:\n\n\t|    |   |   |   |    |WB|WT|WC|UC]\n\t|    |   |   |   |    |WB|WT|WC|UC]\n\t|    |   |   |   |    |WB|WT|WC|UC]\n\t|RUN|   |   |   |    |WB|WT|WC|UC]*\n\t|RUN|   |   |   |    |WB|WT|WC|UC]*\n\t|    |   |   |   |    |WB|WT|WC|UC]\n\t|RUN|   |   |   |    |WB|WT|WC|UC]*\n\t|    |   |   |   |    |WB|WT|WC|UC]\n\t|RUN|   |   |   |    |   |   |   |UC]\n\t|RUN|   |   |   |    |   |   |   |UC]\n\nAs it turns out, this is caused by incorrect code being emitted for\nthe string() function in lib/vsprintf.c. The following code\n\n\tif (!(spec.flags & LEFT)) {\n\t\twhile (len < spec.field_width--) {\n\t\t\tif (buf < end)\n\t\t\t\t*buf = ' ';\n\t\t\t++buf;\n\t\t}\n\t}\n\tfor (i = 0; i < len; ++i) {\n\t\tif (buf < end)\n\t\t\t*buf = *s;\n\t\t++buf; ++s;\n\t}\n\twhile (len < spec.field_width--) {\n\t\tif (buf < end)\n\t\t\t*buf = ' ';\n\t\t++buf;\n\t}\n\nwhen called with len == 0, triggers an issue in the GCC SRA optimization\npass (Scalar Replacement of Aggregates), which handles promotion of signed\nstruct members incorrectly. This is a known but as yet unresolved issue.\n(https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65932). In this particular\ncase, it is causing the second while loop to be executed erroneously a\nsingle time, causing the additional space characters to be printed.\n\nSo disable the optimization by passing -fno-ipa-sra.\n\nAcked-by: Nicolas Pitre <nico@linaro.org>\nSigned-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/860e1b1ac4eb0fb448fe3ea8b5ed7261f05e2133"},{"sha":"f24aaafa70e5f4b8f143993c55a0f89d4e941088","author":{"name":"Grant Likely","email":"15a470d40626c210e744e415735c8bda8fdbce03@linaro.org"},"message":"drivercore: Fix unregistration path of platform devices\n\ncommit 7f5dcaf1fdf289767a126a0a5cc3ef39b5254b06 upstream.\n\nThe unregister path of platform_device is broken. On registration, it\nwill register all resources with either a parent already set, or\ntype==IORESOURCE_{IO,MEM}. However, on unregister it will release\neverything with type==IORESOURCE_{IO,MEM}, but ignore the others. There\nare also cases where resources don't get registered in the first place,\nlike with devices created by of_platform_populate()*.\n\nFix the unregister path to be symmetrical with the register path by\nchecking the parent pointer instead of the type field to decide which\nresources to unregister. This is safe because the upshot of the\nregistration path algorithm is that registered resources have a parent\npointer, and non-registered resources do not.\n\n* It can be argued that of_platform_populate() should be registering\n  it's resources, and they argument has some merit. However, there are\n  quite a few platforms that end up broken if we try to do that due to\n  overlapping resources in the device tree. Until that is fixed, we need\n  to solve the immediate problem.\n\nCc: Pantelis Antoniou <pantelis.antoniou@konsulko.com>\nCc: Wolfram Sang <wsa@the-dreams.de>\nCc: Rob Herring <robh@kernel.org>\nCc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nCc: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>\nSigned-off-by: Grant Likely <grant.likely@linaro.org>\nTested-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>\nTested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>\nSigned-off-by: Rob Herring <robh@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","distinct":true,"url":"https://api.github.com/repos/shahan-mik3/android_kernel_xiaomi_cancro/commits/f24aaafa70e5f4b8f143993c55a0f89d4e941088"}]}
{"actor":{"display_login":"shahan-mik3"}}