{"push_id":1331964475,"size":49,"distinct_size":49,"ref":"refs/heads/mm-6.0","head":"583640f30bee1eafef47e40e3afab20a72d63d44","before":"3916bde2dac0135110951df4ac4027028ec57168","commits":[{"sha":"72c7c03df79ea1c65df44e6a3b6ec7c297e6d849","author":{"name":"Swetha Chikkaboraiah","email":"2eb9be247ce09d2bd7d31120a8c862cbf14ba910@codeaurora.org"},"message":"msm: perf: Protect buffer overflow due to malicious user\n\nIn function krait_pmu_disable_event, parameter hwc comes from\nuserspace and is untrusted.The function krait_clearpmu is called\nafter the function get_krait_evtinfo.\nFunction get_krait_evtinfo as parameter krait_evt_type variable\nwhich is used to extract the groupcode(reg) which is bound to\n KRAIT_MAX_L1_REG (is 3). After validation,one code path modifies\ngroupcode(reg):If this code path executes, groupcode(reg) can be\n3,4, 5, or 6. In krait_clearpmu groupcode used to access array\nkrait_functions whose size is 3. Since groupcode can be 3,4,5,6\naccessing array krait_functions lead to bufferoverlflow.\nThis change will validate groupcode not to exceed 3.\n\nChange-Id: I48c92adda137d8a074b4e1a367a468195a810ca1\nCRs-fixed: 962450\nSigned-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/72c7c03df79ea1c65df44e6a3b6ec7c297e6d849"},{"sha":"1d9dbd38f9be7d783b8b67986cba14bb6e77f6b5","author":{"name":"Veera Sundaram Sankaran","email":"3287f11dd36ba2848f5a783a91dbc39d6db8456d@codeaurora.org"},"message":"msm: mdss: fix possible out-of-bounds and overflow issue in mdp debugfs\n\nThere are few cases where the count argument passed by the user\nspace is not validated, which can potentially lead to out of bounds\nor overflow issues. In some cases, kernel might copy more data than\nwhat is requested. Add necessary checks to avoid such cases.\n\nChange-Id: Ifa42fbd475665a0ca581c907ce5432584ea0e7ed\nSigned-off-by: Veera Sundaram Sankaran <veeras@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/1d9dbd38f9be7d783b8b67986cba14bb6e77f6b5"},{"sha":"b0f5d324858a1f58d5deac9bae9f00994d1c6460","author":{"name":"Arun KS","email":"840b6f7015f61debedeb9891b3e48dc51a152fd0@codeaurora.org"},"message":"msm: perf: Do not allocate new hw_event if event is duplicate.\n\nDuring a perf_event_enable, kernel/events/core.c calls pmu->add() which\nis platform implementation(arch/arm/kernel/perf_event.c). Due to the\nduplicate constraints, arch/arm/mach-msm/perf_event_msm_krait_l2.c\ndrivers marks the event as OFF but returns TRUE to perf_event.c which\ngoes ahead and allocates the hw_event and enables it.\n\nSince event is marked OFF, kernel events core will try to enable this event\nagain during next perf_event_enable. Which results in same event enabled\non multiple hw_events. But during the perf_release, event struct is freed\nand only one hw_event is released. This results in dereferencing the\ninvalid pointer and hence the crash.\n\nFix this by returning error in case of constraint event duplicate. Hence\navoiding the same event programmed on multiple hw event counters.\n\nChange-Id: Ia3360be027dfe87ac753191ffe7e0bc947e72455\nSigned-off-by: Arun KS <arunks@codeaurora.org>\nSigned-off-by: Chetan Ravindranath <cravin@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/b0f5d324858a1f58d5deac9bae9f00994d1c6460"},{"sha":"739fe5172be55c388a07fdbc016ac1921eb458aa","author":{"name":"Divya Ponnusamy","email":"499583450a0afa8f7b400d046a2396e658a503cf@codeaurora.org"},"message":"msm: kgsl: Avoid race condition in ioctl_syncsource_destroy\n\nIf the ioctl syncsource_destroy is accessed by parallel\nthreads, where the spinlock is acquired by threads after\ngetting syncsource, then the simultaneous processes try\nto remove the already destroyed syncsource->refcount by\nthe first thread that acquires this spinlock. This leads\nto race condition while removing syncsource->idr.\n\nAvoid separate lock inside getting syncsource, instead\nacquire spinlock before we get the syncsource in\ndestroy ioctl so that the threads access the spinlock\nand operate on syncsource without use-after-free issue.\n\nChange-Id: I6add3800c40cd09f6e6e0cf2720e69059bd83cbc\nSigned-off-by: Divya Ponnusamy <pdivya@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/739fe5172be55c388a07fdbc016ac1921eb458aa"},{"sha":"ee4bff20009707cb4aaa20a9acf47fa46540b0b6","author":{"name":"Sunil Khatri","email":"c2fa09c6a63ee27656efbed7bd5e770f84d009d0@codeaurora.org"},"message":"msm: kgsl: Defer adding the mem entry to a process\n\nIf we add the mem entry pointer in the process idr and rb tree\ntoo early, other threads can do operations on the entry by\nguessing the ID or GPU address before the object gets returned\nby the creating operation.\n\nAllocate an ID for the object but don't assign the pointer until\nright before the creating function returns ensuring that another\noperation can't access it until it is ready.\n\nCRs-Fixed: 1002974\nChange-Id: Ic0dedbadc0dd2125bd2a7bcc152972c0555e07f8\nSigned-off-by: Jordan Crouse <jcrouse@codeaurora.org>\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/ee4bff20009707cb4aaa20a9acf47fa46540b0b6"},{"sha":"d2f66309bcc9f0b7462d51a8f7b4ac4767a6e58c","author":{"name":"Karthikeyan Ramasubramanian","email":"f8c024263b29fe33b9929f0b5fb3a166c82f9fa1@codeaurora.org"},"message":"net: ipc_router: Bind only a client port as control port\n\nIPC Router binds any port as a control port and moves it from the client\nport list to control port list. Misbehaving clients can exploit this\nincorrect behavior.\n\nIPC Router to check if the port is a client port before binding it as a\ncontrol port.\n\nCRs-Fixed: 974577\nChange-Id: I9f189b76967d5f85750218a7cb6537d187a69663\nSigned-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/d2f66309bcc9f0b7462d51a8f7b4ac4767a6e58c"},{"sha":"cb5249f503fb7e4436b3f2e50159d2cdb017029b","author":{"name":"Arun Kumar Neelakantam","email":"c59c89ba80b317cf4f8ef53be86984ce5725515f@codeaurora.org"},"message":"net: ipc_router: fix leak of kernel memory to userspace\n\nThe service info structure is allocated with uninitialized memory for the\nmax number of services and returns the complete structure to the usersapce\nresulting in the information leak if lookup operation finds less number of\nservices than the requested number.\n\nCheck the minimum of requested and available services and copy the minimum\ninformation to the user-space.\n\nCRs-Fixed: 965934\nChange-Id: Ic97f875855fdc6440c1db1d8d0338ee8b03a9d0a\nSigned-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/cb5249f503fb7e4436b3f2e50159d2cdb017029b"},{"sha":"3c9c7f9a6134e74124eeafacd43523a0bb9d2ab6","author":{"name":"Sunil Khatri","email":"c2fa09c6a63ee27656efbed7bd5e770f84d009d0@codeaurora.org"},"message":"ashmem: Validate ashmem memory with fops pointer\n\nValidate the ashmem memory entry against f_op pointer\nrather then comparing its name with path of the dentry.\n\nThis is to avoid any invalid access to ashmem area in cases\nwhere some one deliberately set the dentry name to /ashmem.\n\nChange-Id: I74e50cd244f68cb13009cf2355e528485f4de34b\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/3c9c7f9a6134e74124eeafacd43523a0bb9d2ab6"},{"sha":"4a862f190c13a64c0b2d97a619d5dc0fd71d020c","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"msm: kgsl: Defer adding the mem entry to a process\"","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/4a862f190c13a64c0b2d97a619d5dc0fd71d020c"},{"sha":"546f3bb9ab8d469143bba530a2d78859870002af","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"net: ipc_router: fix leak of kernel memory to userspace\"","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/546f3bb9ab8d469143bba530a2d78859870002af"},{"sha":"3ee62de4652d6952b1421c5f601d969964210040","author":{"name":"Weiyin Jiang","email":"25745fd6cb0247e11bcb32583c6893d37cc23b30@codeaurora.org"},"message":"ASoC: msm: audio-effects: misc fixes in h/w accelerated effect\n\nAdding memory copy size check and integer overflow check in h/w\naccelerated effect driver.\n\nChange-Id: I17d4cc0a38770f0c5067fa8047cd63e7bf085e48\nCRs-Fixed: 1006609\nSigned-off-by: Weiyin Jiang <wjiang@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/3ee62de4652d6952b1421c5f601d969964210040"},{"sha":"934a9fdd1cf2924e5255882abe490543b52e2c24","author":{"name":"Vasily Kulikov","email":"ccbccc5c352121717f7abc1d3e03e5f120f0013d@openwall.com"},"message":"include/linux/poison.h: fix LIST_POISON{1,2} offset\n\nPoison pointer values should be small enough to find a room in\nnon-mmap'able/hardly-mmap'able space.  E.g.  on x86 \"poison pointer space\"\nis located starting from 0x0.  Given unprivileged users cannot mmap\nanything below mmap_min_addr, it should be safe to use poison pointers\nlower than mmap_min_addr.\n\nThe current poison pointer values of LIST_POISON{1,2} might be too big for\nmmap_min_addr values equal or less than 1 MB (common case, e.g.  Ubuntu\nuses only 0x10000).  There is little point to use such a big value given\nthe \"poison pointer space\" below 1 MB is not yet exhausted.  Changing it\nto a smaller value solves the problem for small mmap_min_addr setups.\n\nThe values are suggested by Solar Designer:\nhttp://www.openwall.com/lists/oss-security/2015/05/02/6\n\nChange-Id: I4aff5bf048c42d1ca6c94f356a987e4ada563398\nSigned-off-by: Vasily Kulikov <segoon@openwall.com>\nCc: Solar Designer <solar@openwall.com>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: \"Kirill A. Shutemov\" <kirill.shutemov@linux.intel.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nGit-commit: 8a5e5e02fc83aaf67053ab53b359af08c6c49aaf\nGit-repo: https://us.codeaurora.org/cgit/quic/la/kernel/msm\nCRs-Fixed: 987330\nSigned-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/934a9fdd1cf2924e5255882abe490543b52e2c24"},{"sha":"411e9feebe4ed363749fb290e53325c148718784","author":{"name":"Kishor PK","email":"59e3e0452a674ecf9c3b6490ddfc6768fdd530bb@codeaurora.org"},"message":"msm: perf: validate input argument of ev_constraints functions\n\nValidate input argument before writing into\npmu_constraints_codes array.\n\nCRs-Fixed: 975404\nChange-Id: Id68b1d2201ab1af783af2236833b1dc894e08cc7\nSigned-off-by: Kishor PK <kpbhat@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/411e9feebe4ed363749fb290e53325c148718784"},{"sha":"78cfb1474ca8fb2855852a7d70ee455c93a7b269","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"net: ipc_router: Bind only a client port as control port\"","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/78cfb1474ca8fb2855852a7d70ee455c93a7b269"},{"sha":"14fa40a9edddd6564af194c3eabec2d975c54887","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"ashmem: Validate ashmem memory with fops pointer\"","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/14fa40a9edddd6564af194c3eabec2d975c54887"},{"sha":"fb7676a68b07da3c673ca03d24c9dda16bbc26bd","author":{"name":"Mohamad Ayyash","email":"a63011e6db47c5624401b2ef01e42a84436c0cfe@google.com"},"message":"Replace %p with %pK to prevent leaking kernel address\n\nBUG: 27532522\nChange-Id: Ic0710a9a8cfc682acd88ecf3bbfeece2d798c4a4\nSigned-off-by: Mohamad Ayyash <mkayyash@google.com>","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/fb7676a68b07da3c673ca03d24c9dda16bbc26bd"},{"sha":"d7f27bc989a2d8bb8021e22417a3a5a8b1cfffe6","author":{"name":"Mahesh Sivasubramanian","email":"0535029a92723ceb00d858924ac46e7e0054d694@codeaurora.org"},"message":"msm: thermal: Add range checking for cluster_id\n\nThe cluster id flag is passed in from the userspace through ioctl\ninterface. Ensure correctness of cluster id to avoid out of bounds array\naccesses.\n\nCRS-fixed: 977508\nChange-Id: I778b962d347b90488b983a15087b13e90ad06688\nSigned-off-by: Mahesh Sivasubramanian <msivasub@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/d7f27bc989a2d8bb8021e22417a3a5a8b1cfffe6"},{"sha":"edebaef47e97911bc60c9dd67ad447deb4d37a15","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"include/linux/poison.h: fix LIST_POISON{1,2} offset\"","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/edebaef47e97911bc60c9dd67ad447deb4d37a15"},{"sha":"af459a48175af757f8c972becedb1f758883deb5","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"msm: perf: validate input argument of ev_constraints functions\"","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/af459a48175af757f8c972becedb1f758883deb5"},{"sha":"5408a51631a1177c530e875626da3ca2440e8a1c","author":{"name":"Al Viro","email":"2a537e97523ffee458777df5f34a2f8c9964f945@ZenIV.linux.org.uk"},"message":"net: validate the range we feed to iov_iter_init() in sys_sendto/sys_recvfrom\n\nb/28759139\nCc: stable@vger.kernel.org # v3.19\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Dennis Cagle <d-cagle@codeaurora.org>\nGit-commit: 4de930efc23b92ddf88ce91c405ee645fe6e27ea\nGit-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git\n(cherry picked from commit 4de930efc23b92ddf88ce91c405ee645fe6e27ea)\nChange-Id: I81577c193559f93826c5e85aa2cb06271340a2e8","distinct":true,"url":"https://api.github.com/repos/jeepers007/android_kernel_oneplus_msm8994-1/commits/5408a51631a1177c530e875626da3ca2440e8a1c"}]}
{"actor":{"display_login":"jeepers007"}}