{"push_id":1291731595,"size":52,"distinct_size":52,"ref":"refs/heads/LA.BR.1.3.2.c2","head":"5e64d19b6dc815bf0b39b56656933a0792450eb6","before":"cf6779a75b4f5307f6bd7ddf85a0102c028ff24c","commits":[{"sha":"3025dae57c241394d084d29cf9f99f7c1db68766","author":{"name":"Shankar Ravi","email":"06fe64500f039a9cf5db715f38ca0212434edd34@codeaurora.org"},"message":"msm: camera: sensor: Validate step_boundary\n\nstep_boundary can take values upto the total_steps\nValidate the step_boundary before consuming it.\nConvert the type of step_index and region_index to uint16_t\nstep_index and region_index cannot be negative.\n\nCRs-Fixed: 1001092\nChange-Id: I1f23fd6f28bb897824a1ef99a8873b9f986eee70\nSigned-off-by: Shankar Ravi <rshankar@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/3025dae57c241394d084d29cf9f99f7c1db68766"},{"sha":"ffff3dcdf70fc08e478fe7e6875e11f7c54344a1","author":{"name":"Al Viro","email":"2a537e97523ffee458777df5f34a2f8c9964f945@ZenIV.linux.org.uk"},"message":"net: validate the range we feed to iov_iter_init() in sys_sendto/sys_recvfrom\n\nChange-Id: I4c5bec76c5ddad99edb63a6e19566670e45bd458\nCc: stable@vger.kernel.org # v3.19\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nGit-commit: 4de930efc23b92ddf88ce91c405ee645fe6e27ea\nGit-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git\nSigned-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/ffff3dcdf70fc08e478fe7e6875e11f7c54344a1"},{"sha":"e86b67d0152e9837f5b0c45471f20be6e9b4eb7d","author":{"name":"Kangjie Lu","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"USB: usbfs: fix potential infoleak in devio\n\nThe stack object \"ci\" has a total size of 8 bytes. Its last 3 bytes\nare padding bytes which are not initialized and leaked to userland\nvia \"copy_to_user\".\n\nChange-Id: Iedd743ab04eb30b6133fc45bb549fcbae60c12fa\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nGit-commit: 681fef8380eb818c0b845fca5d2ab1dcbab114ee\nGit-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git\nSigned-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/e86b67d0152e9837f5b0c45471f20be6e9b4eb7d"},{"sha":"e3f1835de2195244d8cc59d33448bad6b90bec78","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: seq: Fix race at timer setup and close\n\nALSA sequencer code has an open race between the timer setup ioctl and\nthe close of the client.  This was triggered by syzkaller fuzzer, and\na use-after-free was caught there as a result.\n\nThis patch papers over it by adding a proper queue->timer_mutex lock\naround the timer-related calls in the relevant code path.\n\nChange-Id: I74a0789b15ad8c823adff8652498d95e3304b7a4\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nGit-commit: 3567eb6af614dac436c4b16a8d426f9faed639b3\nGit-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git\nSigned-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/e3f1835de2195244d8cc59d33448bad6b90bec78"},{"sha":"43c9a7e95159c0610602eced290270a211944bc2","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: timer: Fix race among timer ioctls\n\nALSA timer ioctls have an open race and this may lead to a\nuse-after-free of timer instance object.  A simplistic fix is to make\neach ioctl exclusive.  We have already tread_sem for controlling the\ntread, and extend this as a global mutex to be applied to each ioctl.\n\nThe downside is, of course, the worse concurrency.  But these ioctls\naren't to be parallel accessible, in anyway, so it should be fine to\nserialize there.\n\nChange-Id: Ic177ce2a35996d450cd2807aa22a69c8a90b1139\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nGit-commit: af368027a49a751d6ff4ee9e3f9961f35bb4fede\nGit-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git\nSigned-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/43c9a7e95159c0610602eced290270a211944bc2"},{"sha":"41296ee80411a1841553ce2b8a1f0b3d144aa99c","author":{"name":"Xiaojun Sang","email":"2dc0774bd7308bab634efe4d5a19a2fc19a72888@codeaurora.org"},"message":"ASoC: compress: fix unsigned integer overflow check\n\nParameter fragments and fragment_size are type of u32. U32_MAX is\nthe correct check.\n\nCRs-Fixed: 1014726\nChange-Id: Ia6d4755408646ac4a75724f3c6f2177651875da3\nSigned-off-by: Xiaojun Sang <xsang@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/41296ee80411a1841553ce2b8a1f0b3d144aa99c"},{"sha":"cf33c84928e5e88520f4193ef1ae68c08db78ea8","author":{"name":"Kangjie Lu","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"net: fix infoleak in rtnetlink\n\nThe stack object \"map\" has a total size of 32 bytes. Its last 4\nbytes are padding generated by compiler. These padding bytes are\nnot initialized and sent out via \"nla_put\".\n\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nGit-commit: 5f8e44741f9f216e33736ea4ec65ca9ac03036e6\nGit-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git\n[rsiddoji@codeaurora.org: backport of orginal fix]\nSigned-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>\nChange-Id: I98746b244c5b8b00234a773233cfb9c85613f920","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/cf33c84928e5e88520f4193ef1ae68c08db78ea8"},{"sha":"2bb95e4eb7ca98bfd293de3ca57f96eebc3fa1e2","author":{"name":"Kangjie Lu","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS\n\nThe stack object \"tread\" has a total size of 32 bytes. Its field\n\"event\" and \"val\" both contain 4 bytes padding. These 8 bytes\npadding bytes are sent to user without being initialized.\n\nChange-Id: Ief5bbada3a144447aaecc236f86aa91da968bb3f\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nGit-commit: cec8f96e49d9be372fdb0c3836dcf31ec71e457e\nGit-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git\nSigned-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/2bb95e4eb7ca98bfd293de3ca57f96eebc3fa1e2"},{"sha":"b35e0ad43da8d37a2b04107b6c9d8361d4ba8eb4","author":{"name":"Peter Hurley","email":"6214814a67b9688a08e8c6dc7fa5dee076dddc8d@hurleysoftware.com"},"message":"tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)\n\nioctl(TIOCGETD) retrieves the line discipline id directly from the\nldisc because the line discipline id (c_line) in termios is untrustworthy;\nuserspace may have set termios via ioctl(TCSETS*) without actually\nchanging the line discipline via ioctl(TIOCSETD).\n\nHowever, directly accessing the current ldisc via tty->ldisc is\nunsafe; the ldisc ptr dereferenced may be stale if the line discipline\nis changing via ioctl(TIOCSETD) or hangup.\n\nWait for the line discipline reference (just like read() or write())\nto retrieve the \"current\" line discipline id.\n\nCc: <stable@vger.kernel.org>\nSigned-off-by: Peter Hurley <peter@hurleysoftware.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n(cherry picked from commit 5c17c861a357e9458001f021a7afa7aab9937439)\nGit-Commit: 5c17c861a357e9458001f021a7afa7aab9937439\nGit-Repo: https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git\nChange-Id: I8ec4f695bfc8b2c2de2043868d60bf21e29684aa\nSigned-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>\nSigned-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/b35e0ad43da8d37a2b04107b6c9d8361d4ba8eb4"},{"sha":"d72c9eebc178ed7f0f21b7b6e8260316712de911","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"USB: usbfs: fix potential infoleak in devio\"","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/d72c9eebc178ed7f0f21b7b6e8260316712de911"},{"sha":"b47452ff2e7ea10cdd67a6f30ea79b3fe59aec65","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"ALSA: seq: Fix race at timer setup and close\"","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/b47452ff2e7ea10cdd67a6f30ea79b3fe59aec65"},{"sha":"f9fc1f5b4da625f53a167d13f36ba4c029de9b10","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"ALSA: timer: Fix race among timer ioctls\"","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/f9fc1f5b4da625f53a167d13f36ba4c029de9b10"},{"sha":"ddc8c7d661b9a6387b6756bb8956791beec0224e","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"net: fix infoleak in rtnetlink\"","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/ddc8c7d661b9a6387b6756bb8956791beec0224e"},{"sha":"e919c29655a27ef0fd7fbb3cacf8a379accf0644","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS\"","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/e919c29655a27ef0fd7fbb3cacf8a379accf0644"},{"sha":"caf415bc70416bcf2df16ca50a34b5fa33fc7624","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"ASoC: compress: fix unsigned integer overflow check\"","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/caf415bc70416bcf2df16ca50a34b5fa33fc7624"},{"sha":"3abc14f7d93303974c10d064717bf17ad799840b","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)\"","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/3abc14f7d93303974c10d064717bf17ad799840b"},{"sha":"d0da7b03d76bf891d98093d84a589bc28e7a08f1","author":{"name":"Mohamad Ayyash","email":"a63011e6db47c5624401b2ef01e42a84436c0cfe@google.com"},"message":"Replace %p with %pK to prevent leaking kernel address\n\nBUG: 27532522\nChange-Id: Ic0710a9a8cfc682acd88ecf3bbfeece2d798c4a4\nSigned-off-by: Mohamad Ayyash <mkayyash@google.com>","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/d0da7b03d76bf891d98093d84a589bc28e7a08f1"},{"sha":"9b7c269337e69136e9a0457bb907893da95b974b","author":{"name":"Srinivasarao P","email":"5838be2f68866147a6b98dc0567ce3ec89ebe5fc@codeaurora.org"},"message":"perf: duplicate deletion of perf event\n\na malicious app can open a perf event with constraint_duplicate\nbit set, disable the event, and close the fd.  On closing the fd,\nthe perf_release() modification causes the kernel to clean up\nthe event as if it still were enabled, leading to the event\nbeing removed from a list twice.\n\nCRs-Fixed: 977563\nChange-Id: I5fbec3722407d2f3d0ff0d9f7097c5889e31fd62\nSigned-off-by: Srinivasarao P <spathi@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/9b7c269337e69136e9a0457bb907893da95b974b"},{"sha":"0a4e175026ea5f36a6bf867581cca4d244ebc25a","author":{"name":"Swetha Chikkaboraiah","email":"2eb9be247ce09d2bd7d31120a8c862cbf14ba910@codeaurora.org"},"message":"msm: perf: Protect buffer overflow due to malicious user\n\nIn function krait_pmu_disable_event, parameter hwc comes from\nuserspace and is untrusted.The function krait_clearpmu is called\nafter the function get_krait_evtinfo.\nFunction get_krait_evtinfo as parameter krait_evt_type variable\nwhich is used to extract the groupcode(reg) which is bound to\n KRAIT_MAX_L1_REG (is 3). After validation,one code path modifies\ngroupcode(reg):If this code path executes, groupcode(reg) can be\n3,4, 5, or 6. In krait_clearpmu groupcode used to access array\nkrait_functions whose size is 3. Since groupcode can be 3,4,5,6\naccessing array krait_functions lead to bufferoverlflow.\nThis change will validate groupcode not to exceed 3.\n\nChange-Id: I48c92adda137d8a074b4e1a367a468195a810ca1\nCRs-fixed: 962450\nSigned-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/0a4e175026ea5f36a6bf867581cca4d244ebc25a"},{"sha":"c8c2d99e994badfd7b28408ac2cddaceab56d1d8","author":{"name":"Deva Ramasubramanian","email":"3d3b7edbac9b2886d40c9edd3584464c1b141343@codeaurora.org"},"message":"msm: vidc: Make buffer validity checks stronger\n\nCheck for the exact number of planes that we advertised to the client\nrather than the worst-case checks.\n\nChange-Id: Ibaf705367db98beb0e01bb2c3087126cf2ba73e8\nSigned-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/arter97/caf_msm-3.10/commits/c8c2d99e994badfd7b28408ac2cddaceab56d1d8"}]}
{"actor":{"display_login":"arter97"}}