{"push_id":1399517928,"size":69,"distinct_size":69,"ref":"refs/heads/cm-14.1-caf","head":"3197b00a757144efbce596845515f8d1c33548fc","before":"646abec7de38c3b0c20bf37dcf4172789817bcd4","commits":[{"sha":"0ac10a1506672e88874cd82a6acdc134ebba994a","author":{"name":"Mallikarjuna Reddy Amireddy","email":"64faf614dca1295989f342367ba1497c4cddcdee@codeaurora.org"},"message":"qseecom: Change format specifier %p to %pK\n\nFormat specifier %p can leak kernel addresses while not valuing the\nkptr_restrict system settings. When kptr_restrict is set to (1), kernel\npointers printed using the %pK format specifier will be replaced with 0's.\nSo that %pK will not leak kernel pointers to unprivileged users.\nSo change the format specifier from %p to %pK..\n\nDebugging Note : &pK prints only Zeros as address. if you need actual\naddress information, pls echo 0 to kptr_restrict..\n$ echo 0 > /proc/sys/kernel/kptr_restrict\n\nChange-Id: I0baf2be2d5a476e2e4267f20b99d0ddf5492469e\nSigned-off-by: Mallikarjuna Reddy Amireddy <mamire@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/0ac10a1506672e88874cd82a6acdc134ebba994a"},{"sha":"3c3a34db1602b1cbfc48e4cc03a2668c2010efcb","author":{"name":"Viraja Kommaraju","email":"54310e1e7dae6708f0a727bfb567356f20575a77@codeaurora.org"},"message":"ASoC: msm: qdsp6v2: Change audio drivers to use %pK\n\nChange all qdsp6v2 audio driver to use %pK instead\nof %p. %pK hides addresses when the users doesn't\nhave kernel permissions. If address information\nis needed echo 0 > /proc/sys/kernel/kptr_restrict.\n\nChange-Id: Ifcd61bd2615505be80dd834e9dbee9c22f3d72ac\nSigned-off-by: Viraja Kommaraju <virajak@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/3c3a34db1602b1cbfc48e4cc03a2668c2010efcb"},{"sha":"ba0157f4c17d9043e3f005c53a4f1dde2edbed1b","author":{"name":"Srinivasarao P","email":"5838be2f68866147a6b98dc0567ce3ec89ebe5fc@codeaurora.org"},"message":"msm : dma_test: Initialize newly allocated memory\n\nThe MSM_DMA_IOALLOC ioctl command allocates kernel memory and\nthis memory can be read back using the MSM_DMA_IORBUF ioctl command.\nThis memory is not zero-initialized and may contain sensitive data.\n\nChange-Id: I8c55d6fe500e7607690b89806715893783eecf9c\nSigned-off-by: Srinivasarao P <spathi@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/ba0157f4c17d9043e3f005c53a4f1dde2edbed1b"},{"sha":"c7fa51fcd5ed22d533770428c2581d4b5bdf956f","author":{"name":"Abhijeet Dharmapurikar","email":"89851c9dd36946171b4b1ff63e907369a9229a1f@codeaurora.org"},"message":"spmi: prevent showing the address of spmidev\n\nCreating devices with the address of the container spmidev  is not\nindicative of the actual hardware device it represents.\n\nInstead use an unique id to indicate the device it represents.\n\nCRs-Fixed: 1024197\nChange-Id: Id18e2a19f4fa1249901a3f275defa8f589270d69\nSigned-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/c7fa51fcd5ed22d533770428c2581d4b5bdf956f"},{"sha":"b4c0f1b049cf0b79e413402f75c62364d4c7f1e1","author":{"name":"Figo Wang","email":"10285b5ffa50547ef4e2e42bc03de5e27984a146@codeaurora.org"},"message":"msm: camera: Assign NULL after freeing memory\n\nIn msm_actuator we need to assign memory\npointer to  NULL after freeing that memory\nusing kfree.\n\nCRs-Fixed: 1051461\nChange-Id: I2dd5983f56367983eb3005e95bc1ed7ace7d2b66\nSigned-off-by: Figo Wang <figow@codeaurora.org>\nSigned-off-by: Venumadhav Kurva <kurva@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/b4c0f1b049cf0b79e413402f75c62364d4c7f1e1"},{"sha":"3c0f3e8b42145e45c21f787f0679f869010da255","author":{"name":"Zhen Kong","email":"b999fb1d59364862997bac94d5b793be36d63b01@codeaurora.org"},"message":"msm: crypto: Fix integer over flow check in qcedev driver\n\nInteger overflow check always fails when ULONG_MAX is used,\nas ULONG_MAX is 2^64-1, while req->data[i].len and total\narei uint32_t.. Make change to use U32_MAX instead of\nULONG_MAX.\n\nCRs-fixed: 1046507\nChange-Id: Iccf9c32400ecc7ffc0afae16f58c38e5d78a5b64\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/3c0f3e8b42145e45c21f787f0679f869010da255"},{"sha":"b71612abda8f82cb8d0bd1ada40d23a30a1d6964","author":{"name":"VijayaKumar T M","email":"1d0ce10e1a0c1123629a10b62c852901ec1872b2@codeaurora.org"},"message":"msm: camera: sensor: Fix use after free condition\n\nAdd a check to return value before calling csid config which will\notherwise lead to use after free scenario.\n\nCRs-Fixed: 1040857\nChange-Id: I4f4d9e38eeb537875e0d01de0e99913a44dd3f3f\nSigned-off-by: VijayaKumar T M <vtmuni@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/b71612abda8f82cb8d0bd1ada40d23a30a1d6964"},{"sha":"bfc154369b64379f0a68b0f2dc0a8a01f3d16870","author":{"name":"Abdulla Anam","email":"efb1225ca7011de81a67d3f5d80eb64b28b04983@codeaurora.org"},"message":"msm: vidc: use %pK instead of %p which respects kptr_restrict sysctl\n\nHide kernel pointers from unprivileged ussers by using %pK format-\nspecifier instead of %p. This respects the kptr_restrict sysctl\nsetting which is by default on. So by default %pK will print zeroes\nas address. echo 1 to kptr_restrict to print proper kernel addresses.\n\nCRs-Fixed: 987018\nChange-Id: I4772257a557c6730ecc0624cbc8e5614e893e9fd\nSigned-off-by: Abdulla Anam <abdullahanam@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/bfc154369b64379f0a68b0f2dc0a8a01f3d16870"},{"sha":"7d732f68cb9950bee8a871ea49e328dd1260a426","author":{"name":"Skylar Chang","email":"e55369b827ac1e5cdf23e9f11dabe26a7634de99@codeaurora.org"},"message":"msm: ipa: fix potential race condition ioctls\n\nThere are numerous potential race condition\nioctls in the IPA driver. The fix is to add\ncheck wherever it copies arguments from\nuser-space memory and process.\n\nChange-Id: I5a440f89153518507acdf5dad42625503732e59a\nSigned-off-by: Skylar Chang <chiaweic@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/7d732f68cb9950bee8a871ea49e328dd1260a426"},{"sha":"8fe43a74d3f11868f11959bb171138ec7737fc8f","author":{"name":"Zhen Kong","email":"b999fb1d59364862997bac94d5b793be36d63b01@codeaurora.org"},"message":"msm: crypto: Fix integer over flow check in qcrypto driver\n\nInteger overflow check is invalid when ULONG_MAX is used,\nas ULONG_MAX has typeof 'unsigned long', while req->assoclen,\nreq->crytlen, and qreq.ivsize are 'unsigned int'. Make change\nto use UINT_MAX instead of ULONG_MAX.\n\nCRs-fixed: 1050970\nChange-Id: I3782ea7ed2eaacdcad15b34e047a4699bf4f9e4f\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/8fe43a74d3f11868f11959bb171138ec7737fc8f"},{"sha":"b6db747ce9bf3f3a8cb86edab7b5c883968ae503","author":{"name":"Chris Lew","email":"92526cc55a75cd70ca3d87ac485ab5e1b38c8b7c@codeaurora.org"},"message":"msm: smp2p2: Fix kernel address leak\n\nChange format string to %pK instead of %p in the debug statements. This\nchange fixes kernel address leaks from the usage of %p.\n\nCRs-Fixed: 1052825\nChange-Id: Ic87320b47a97f265611e9fef602362cf118dff54\nSigned-off-by: Chris Lew <clew@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/b6db747ce9bf3f3a8cb86edab7b5c883968ae503"},{"sha":"ef608bbf4cf7ea1a7fb070a70fb91efecad4ceb8","author":{"name":"Trishansh Bhardwaj","email":"e6f3043187f404ce783dec579af51dccff5a72a4@codeaurora.org"},"message":"msm: camera: Fix memory read security flaw\n\nAdds bound check on reg_cfg_cmd->u.dmi_info.hi_tbl_offset.\n\nIOCTL VIDIOC_MSM_VFE_REG_CFG uses usersupplied value without\nperforming bounds check for following cmd_type.\nVFE_READ_DMI_16BIT\nVFE_READ_DMI_32BIT\nVFE_READ_DMI_64BIT\n\nChange-Id: I554c45ef3a172f5b5891b67a7e8e7a1f3f3882ed\nSigned-off-by: Trishansh Bhardwaj <tbhardwa@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/ef608bbf4cf7ea1a7fb070a70fb91efecad4ceb8"},{"sha":"49f07bb91871308b8c06ef1e58051049f6870921","author":{"name":"Suman Mukherjee","email":"e3ab071fd017dcf1d764b3b87de4a547154648cf@codeaurora.org"},"message":"msm: camera: isp: Fix warning and errors based on static analysis\n\nThis change fixes the warning/errors from static analysis\n\nConflicts:\n\tdrivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c\n\tdrivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c\n\tdrivers/media/platform/msm/camera_v2/isp/msm_isp_stats_util.c\n\tdrivers/media/platform/msm/camera_v2/isp/msm_isp_util.c\n\nCRs-fixed: 992942\nChange-Id: Iaf90ab4c1d17f903d03458d76cab1b4c0a5c8836\nSigned-off-by: Jing Zhou <jzhou70@codeaurora.org>\nSigned-off-by: Suman Mukherjee<sumam@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/49f07bb91871308b8c06ef1e58051049f6870921"},{"sha":"3f615a0a50bce62a89f9b1a7b204990782682cce","author":{"name":"Vasko Kalanoski","email":"be1f9066a41dc2a65144eca8f4098d397256f495@codeaurora.org"},"message":"msm: camera: restructure data handling to be more robust\n\nadd dynamic array allocation instead of static to prevent\nstack overflow.\n\nChange-Id: Id12ed5b01809021d2b1d1d71436f2523b575d9de\nSigned-off-by: Vasko Kalanoski <vaskok@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/3f615a0a50bce62a89f9b1a7b204990782682cce"},{"sha":"445eba65e5f7e7838fecec989198bac66f6a61a6","author":{"name":"Sudeep Yedalapure","email":"f6e7389587defbbcf1b8ae871af865708bb1dd22@codeaurora.org"},"message":"msm: kgsl: Change %p to %pK in debug messages\n\nThe format specifier %p can leak kernel addresses\nwhile not valuing the kptr_restrict system settings.\nUse %pK instead of %p, which evaluates whether\nkptr_restrict is set.\n\nChange-Id: I0778e43e0a03852ca2944377256a7b401586a747\nSigned-off-by: Divya Ponnusamy <pdivya@codeaurora.org>\nSigned-off-by: Sudeep Yedalapure <sudeepy@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/445eba65e5f7e7838fecec989198bac66f6a61a6"},{"sha":"61110ad7dbfa3a14cfe2064bded034ee7d473066","author":{"name":"Qiwei Liu","email":"3bd1f78861849e2e3f955696518e5452315a7f1c@codeaurora.org"},"message":"msm: vidc: replace the remaining %p with %pK\n\nHide kernel pointers from unprivileged ussers by using %pK format-\nspecifier instead of %p.\nReplace all remaining %p that were missed in previous change.\n\nCRs-Fixed: 1058665\nChange-Id: If1c6fa6cb7e7fa2b0f81c35c26ce0ae4c34da83f\nSigned-off-by: Qiwei Liu <qiweil@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/61110ad7dbfa3a14cfe2064bded034ee7d473066"},{"sha":"f221ddfeab1b2e5a3a2151d49a639555a1439d1f","author":{"name":"VijayaKumar T M","email":"1d0ce10e1a0c1123629a10b62c852901ec1872b2@codeaurora.org"},"message":"msm: sensor: Avoid potential stack overflow\n\nAdd a check to validate the user input data is not\ngreater than expected stack buffer size to avoid out\nof bounds array accesses\n\nCRs-Fixed: 1056307\nChange-Id: I8b31006772367a120828269243b1971d33a4d7d3\nSigned-off-by: VijayaKumar T M <vtmuni@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/f221ddfeab1b2e5a3a2151d49a639555a1439d1f"},{"sha":"6a764bf0a8a7423846ae04ea31d94d52fca552bc","author":{"name":"Samyukta Mogily","email":"f3e9e82d9071ed1971312af3d44d5d5d710a1cc8@codeaurora.org"},"message":"msm: camera: Restructure data handling to be more robust\n\nUse dynamic array allocation instead of static array to\nprevent stack overflow.\nUser-supplied number of bytes may result in integer overflow.\nTo fix this we check that the num_byte isn't above 8K size.\n\nCRs-Fixed: 1060554\nChange-Id: I407b5ec8cdc2ac7f3b491644418d3eb1101ce65a\nSigned-off-by: Samyukta Mogily <smogily@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/6a764bf0a8a7423846ae04ea31d94d52fca552bc"},{"sha":"92b1ab0ab88657abf12bed0cbb03ced2486645d5","author":{"name":"Walter Yang","email":"40fe51b379e199d64ef1e40a9ce78510baf47edf@codeaurora.org"},"message":"ASoC: msm: set pointers to NULL after kfree\n\nIn lsm-related driver files, some pointers are not set as NULL\nafter the memory is freed, which will leave many dangling pointers.\nSet them to NULL explicitly to avoid potential risk.\n\nCRs-Fixed: 880388\nChange-Id: I44925240705608510266a51225cc02611637c571\nSigned-off-by: Walter Yang <yandongy@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/92b1ab0ab88657abf12bed0cbb03ced2486645d5"},{"sha":"eb3d6b0e889cc43003c9bc2e768437de132195fa","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: x_tables: validate e->target_offset early\n\nWe should check that e->target_offset is sane before\nmark_source_chains gets called since it will fetch the target entry\nfor loop detection.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Dennis Cagle <d-cagle@codeaurora.org>\nGit-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git\nGit-commit: bdf533de6968e9686df777dc178486f600c6e617\n(cherry picked from commit bdf533de6968e9686df777dc178486f600c6e617)\nChange-Id: Id3ec56cdc333990d62c99d6c2e59dbcce633bcc1","distinct":true,"url":"https://api.github.com/repos/TaichiN/android_kernel_lge_hammerhead/commits/eb3d6b0e889cc43003c9bc2e768437de132195fa"}]}
{"actor":{"display_login":"TaichiN"}}