{"push_id":1392398554,"size":35,"distinct_size":35,"ref":"refs/heads/android-msm-seed-3.10-nougat","head":"bf7b8837d1e1ee4191a0d887df2f7a431784faaf","before":"616a3554d11a7972b01baf556a6c9813f2945f4a","commits":[{"sha":"5faf3e460662d7dff13130b4163129cab2429d70","author":{"name":"Tim Murray","email":"1236fbd8e0651a86c12ed0f0b75aaeb5e5852ea8@google.com"},"message":"lowmemorykiller: account for unevictable pages\n\nlowmemorykiller was not taking into account unevictable pages when\ndeciding what level to kill. If significant amounts of memory were\npinned, this caused lowmemorykiller to effectively stop at a much higher\nlevel than it should.\n\nBug: 27434442\n\nChange-Id: I763ecbfef8c56d65bb8f6147ae810692bd81b6e2","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/5faf3e460662d7dff13130b4163129cab2429d70"},{"sha":"9f05f053a73f8907728125123b9bb756c5dc05d9","author":{"name":"Ariel Yin","email":"9308cd92d4904c8721204c41e9329abc3a43c10d@google.com"},"message":"Revert \"Asoc:msm:Added Buffer overflow check\"\n\nThis reverts commit 3283b7b812b9f11f590a5fb8142a82310168a166.\n\nChange-Id: Id7aa53a2d9c88af8009027a39f7ca8e31dc2b1df","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/9f05f053a73f8907728125123b9bb756c5dc05d9"},{"sha":"2dc9d94d5409679d0cbbcaebec5073188600bf22","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"UPSTREAM: tcp: fix use after free in tcp_xmit_retransmit_queue()\n\n(cherry picked from commit bb1fceca22492109be12640d49f5ea5a544c6bb4)\n\nWhen tcp_sendmsg() allocates a fresh and empty skb, it puts it at the\ntail of the write queue using tcp_add_write_queue_tail()\n\nThen it attempts to copy user data into this fresh skb.\n\nIf the copy fails, we undo the work and remove the fresh skb.\n\nUnfortunately, this undo lacks the change done to tp->highest_sack and\nwe can leave a dangling pointer (to a freed skb)\n\nLater, tcp_xmit_retransmit_queue() can dereference this pointer and\naccess freed memory. For regular kernels where memory is not unmapped,\nthis might cause SACK bugs because tcp_highest_sack_seq() is buggy,\nreturning garbage instead of tp->snd_nxt, but with various debug\nfeatures like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel.\n\nThis bug was found by Marco Grassi thanks to syzkaller.\n\nFixes: 6859d49475d4 (\"[TCP]: Abstract tp->highest_sack accessing & point to next skb\")\nReported-by: Marco Grassi <marco.gra@gmail.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>\nCc: Yuchung Cheng <ycheng@google.com>\nCc: Neal Cardwell <ncardwell@google.com>\nAcked-by: Neal Cardwell <ncardwell@google.com>\nReviewed-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nChange-Id: I58bb02d6e4e399612e8580b9e02d11e661df82f5\nBug: 31183296","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/2dc9d94d5409679d0cbbcaebec5073188600bf22"},{"sha":"f632377ff7cc7cf9ab39eb627d54ba993bef99e8","author":{"name":"Ariel Yin","email":"9308cd92d4904c8721204c41e9329abc3a43c10d@google.com"},"message":"perf: Fix race in swevent hash\nThere's a race on CPU unplug where we free the swevent hash array\nwhile it can still have events on. This will result in a\nuse-after-free which is BAD.\n\nSimply do not free the hash array on unplug. This leaves the thing\naround and no use-after-free takes place.\n\nWhen the last swevent dies, we do a for_each_possible_cpu() iteration\nanyway to clean these up, at which time we'll free it, so no leakage\nwill occur.\n\nChange-Id: I368c84b9d9c77c82121358a8fd29a5b012364321","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/f632377ff7cc7cf9ab39eb627d54ba993bef99e8"},{"sha":"044cd9327825c468ae6f150c547d33bc36771f01","author":{"name":"Mathias Krause","email":"c0f5a800b69cdfd927790b9eec175d77c6a1b20d@googlemail.com"},"message":"UPSTREAM: proc: prevent accessing /proc/<PID>/environ until it's ready\n\n(cherry picked from commit 8148a73c9901a8794a50f950083c00ccf97d43b3)\n\nIf /proc/<PID>/environ gets read before the envp[] array is fully set up\nin create_{aout,elf,elf_fdpic,flat}_tables(), we might end up trying to\nread more bytes than are actually written, as env_start will already be\nset but env_end will still be zero, making the range calculation\nunderflow, allowing to read beyond the end of what has been written.\n\nFix this as it is done for /proc/<PID>/cmdline by testing env_end for\nzero.  It is, apparently, intentionally set last in create_*_tables().\n\nThis bug was found by the PaX size_overflow plugin that detected the\narithmetic underflow of 'this_len = env_end - (env_start + src)' when\nenv_end is still zero.\n\nThe expected consequence is that userland trying to access\n/proc/<PID>/environ of a not yet fully set up process may get\ninconsistent data as we're in the middle of copying in the environment\nvariables.\n\nFixes: https://forums.grsecurity.net/viewtopic.php?f=3&t=4363\nFixes: https://bugzilla.kernel.org/show_bug.cgi?id=116461\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Emese Revfy <re.emese@gmail.com>\nCc: Pax Team <pageexec@freemail.hu>\nCc: Al Viro <viro@zeniv.linux.org.uk>\nCc: Mateusz Guzik <mguzik@redhat.com>\nCc: Alexey Dobriyan <adobriyan@gmail.com>\nCc: Cyrill Gorcunov <gorcunov@openvz.org>\nCc: Jarod Wilson <jarod@redhat.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nChange-Id: Ia2f58d48c15478ed4b6e237b63e704c70ff21e96\nBug: 30951939","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/044cd9327825c468ae6f150c547d33bc36771f01"},{"sha":"62f3b34f52bd3807a88af32fbdca59eca204a1e6","author":{"name":"Benjamin Tissoires","email":"ace37d3dd488d1f8efb492bba0263a7c3c3d861c@redhat.com"},"message":"UPSTREAM: HID: core: prevent out-of-bound readings\n\n(cherry picked from commit 50220dead1650609206efe91f0cc116132d59b3f)\n\nPlugging a Logitech DJ receiver with KASAN activated raises a bunch of\nout-of-bound readings.\n\nThe fields are allocated up to MAX_USAGE, meaning that potentially, we do\nnot have enough fields to fit the incoming values.\nAdd checks and silence KASAN.\n\nSigned-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>\nSigned-off-by: Jiri Kosina <jkosina@suse.cz>\nChange-Id: Iaf25e882a6696884439d7091b5fbb0b350d893d3\nBug: 30951261","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/62f3b34f52bd3807a88af32fbdca59eca204a1e6"},{"sha":"aecc351642a2ea1202ee45adb5ecabcfa23b98dd","author":{"name":"Peter Hurley","email":"6214814a67b9688a08e8c6dc7fa5dee076dddc8d@hurleysoftware.com"},"message":"BACKPORT: tty: Prevent ldisc drivers from re-using stale tty fields\n\n(cherry picked from commit dd42bf1197144ede075a9d4793123f7689e164bc)\n\nLine discipline drivers may mistakenly misuse ldisc-related fields\nwhen initializing. For example, a failure to initialize tty->receive_room\nin the N_GIGASET_M101 line discipline was recently found and fixed [1].\nNow, the N_X25 line discipline has been discovered accessing the previous\nline discipline's already-freed private data [2].\n\nHarden the ldisc interface against misuse by initializing revelant\ntty fields before instancing the new line discipline.\n\n[1]\n    commit fd98e9419d8d622a4de91f76b306af6aa627aa9c\n    Author: Tilman Schmidt <tilman@imap.cc>\n    Date:   Tue Jul 14 00:37:13 2015 +0200\n\n    isdn/gigaset: reset tty->receive_room when attaching ser_gigaset\n\n[2] Report from Sasha Levin <sasha.levin@oracle.com>\n    [  634.336761] ==================================================================\n    [  634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0\n    [  634.339558] Read of size 4 by task syzkaller_execu/8981\n    [  634.340359] =============================================================================\n    [  634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected\n    ...\n    [  634.405018] Call Trace:\n    [  634.405277] dump_stack (lib/dump_stack.c:52)\n    [  634.405775] print_trailer (mm/slub.c:655)\n    [  634.406361] object_err (mm/slub.c:662)\n    [  634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)\n    [  634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)\n    [  634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))\n    [  634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)\n    [  634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)\n    [  634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)\n    [  634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)\n    [  634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)\n    [  634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)\n\nCc: Tilman Schmidt <tilman@imap.cc>\nCc: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: Peter Hurley <peter@hurleysoftware.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nChange-Id: Ibed6feadfb9706d478f93feec3b240aecfc64af3\nBug: 30951112","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/aecc351642a2ea1202ee45adb5ecabcfa23b98dd"},{"sha":"afd9f43711bc744d7b913d76cc6e3ce0bd585224","author":{"name":"Omar Sandoval","email":"39102d44aa5274bc7139838962c296ef0b609c1e@fb.com"},"message":"UPSTREAM: block: fix use-after-free in sys_ioprio_get()\n\n(cherry picked from commit 8ba8682107ee2ca3347354e018865d8e1967c5f4)\n\nget_task_ioprio() accesses the task->io_context without holding the task\nlock and thus can race with exit_io_context(), leading to a\nuse-after-free. The reproducer below hits this within a few seconds on\nmy 4-core QEMU VM:\n\nint main(int argc, char **argv)\n{\n\tpid_t pid, child;\n\tlong nproc, i;\n\n\t/* ioprio_set(IOPRIO_WHO_PROCESS, 0, IOPRIO_PRIO_VALUE(IOPRIO_CLASS_IDLE, 0)); */\n\tsyscall(SYS_ioprio_set, 1, 0, 0x6000);\n\n\tnproc = sysconf(_SC_NPROCESSORS_ONLN);\n\n\tfor (i = 0; i < nproc; i++) {\n\t\tpid = fork();\n\t\tassert(pid != -1);\n\t\tif (pid == 0) {\n\t\t\tfor (;;) {\n\t\t\t\tpid = fork();\n\t\t\t\tassert(pid != -1);\n\t\t\t\tif (pid == 0) {\n\t\t\t\t\t_exit(0);\n\t\t\t\t} else {\n\t\t\t\t\tchild = wait(NULL);\n\t\t\t\t\tassert(child == pid);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tpid = fork();\n\t\tassert(pid != -1);\n\t\tif (pid == 0) {\n\t\t\tfor (;;) {\n\t\t\t\t/* ioprio_get(IOPRIO_WHO_PGRP, 0); */\n\t\t\t\tsyscall(SYS_ioprio_get, 2, 0);\n\t\t\t}\n\t\t}\n\t}\n\n\tfor (;;) {\n\t\t/* ioprio_get(IOPRIO_WHO_PGRP, 0); */\n\t\tsyscall(SYS_ioprio_get, 2, 0);\n\t}\n\n\treturn 0;\n}\n\nThis gets us KASAN dumps like this:\n\n[   35.526914] ==================================================================\n[   35.530009] BUG: KASAN: out-of-bounds in get_task_ioprio+0x7b/0x90 at addr ffff880066f34e6c\n[   35.530009] Read of size 2 by task ioprio-gpf/363\n[   35.530009] =============================================================================\n[   35.530009] BUG blkdev_ioc (Not tainted): kasan: bad access detected\n[   35.530009] -----------------------------------------------------------------------------\n\n[   35.530009] Disabling lock debugging due to kernel taint\n[   35.530009] INFO: Allocated in create_task_io_context+0x2b/0x370 age=0 cpu=0 pid=360\n[   35.530009] \t___slab_alloc+0x55d/0x5a0\n[   35.530009] \t__slab_alloc.isra.20+0x2b/0x40\n[   35.530009] \tkmem_cache_alloc_node+0x84/0x200\n[   35.530009] \tcreate_task_io_context+0x2b/0x370\n[   35.530009] \tget_task_io_context+0x92/0xb0\n[   35.530009] \tcopy_process.part.8+0x5029/0x5660\n[   35.530009] \t_do_fork+0x155/0x7e0\n[   35.530009] \tSyS_clone+0x19/0x20\n[   35.530009] \tdo_syscall_64+0x195/0x3a0\n[   35.530009] \treturn_from_SYSCALL_64+0x0/0x6a\n[   35.530009] INFO: Freed in put_io_context+0xe7/0x120 age=0 cpu=0 pid=1060\n[   35.530009] \t__slab_free+0x27b/0x3d0\n[   35.530009] \tkmem_cache_free+0x1fb/0x220\n[   35.530009] \tput_io_context+0xe7/0x120\n[   35.530009] \tput_io_context_active+0x238/0x380\n[   35.530009] \texit_io_context+0x66/0x80\n[   35.530009] \tdo_exit+0x158e/0x2b90\n[   35.530009] \tdo_group_exit+0xe5/0x2b0\n[   35.530009] \tSyS_exit_group+0x1d/0x20\n[   35.530009] \tentry_SYSCALL_64_fastpath+0x1a/0xa4\n[   35.530009] INFO: Slab 0xffffea00019bcd00 objects=20 used=4 fp=0xffff880066f34ff0 flags=0x1fffe0000004080\n[   35.530009] INFO: Object 0xffff880066f34e58 @offset=3672 fp=0x0000000000000001\n[   35.530009] ==================================================================\n\nFix it by grabbing the task lock while we poke at the io_context.\n\nCc: stable@vger.kernel.org\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Omar Sandoval <osandov@fb.com>\nSigned-off-by: Jens Axboe <axboe@fb.com>\nChange-Id: I3f5858cc9a1b9d4124ae7a6578660dec219d2c57\nBug: 30946378","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/afd9f43711bc744d7b913d76cc6e3ce0bd585224"},{"sha":"1353685f1f4148660a75bee4593cac65603b64f6","author":{"name":"Mauro Carvalho Chehab","email":"ea19850a825a0b2eb1de0168fb2a06f5170bd9e2@osg.samsung.com"},"message":"UPSTREAM: [media] xc2028: avoid use after free\n\n(cherry picked from commit 8dfbcc4351a0b6d2f2d77f367552f48ffefafe18)\n\nIf struct xc2028_config is passed without a firmware name,\nthe following trouble may happen:\n\n[11009.907205] xc2028 5-0061: type set to XCeive xc2028/xc3028 tuner\n[11009.907491] ==================================================================\n[11009.907750] BUG: KASAN: use-after-free in strcmp+0x96/0xb0 at addr ffff8803bd78ab40\n[11009.907992] Read of size 1 by task modprobe/28992\n[11009.907994] =============================================================================\n[11009.907997] BUG kmalloc-16 (Tainted: G        W      ): kasan: bad access detected\n[11009.907999] -----------------------------------------------------------------------------\n\n[11009.908008] INFO: Allocated in xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd] age=0 cpu=3 pid=28992\n[11009.908012] \t___slab_alloc+0x581/0x5b0\n[11009.908014] \t__slab_alloc+0x51/0x90\n[11009.908017] \t__kmalloc+0x27b/0x350\n[11009.908022] \txhci_urb_enqueue+0x214/0x14c0 [xhci_hcd]\n[11009.908026] \tusb_hcd_submit_urb+0x1e8/0x1c60\n[11009.908029] \tusb_submit_urb+0xb0e/0x1200\n[11009.908032] \tusb_serial_generic_write_start+0xb6/0x4c0\n[11009.908035] \tusb_serial_generic_write+0x92/0xc0\n[11009.908039] \tusb_console_write+0x38a/0x560\n[11009.908045] \tcall_console_drivers.constprop.14+0x1ee/0x2c0\n[11009.908051] \tconsole_unlock+0x40d/0x900\n[11009.908056] \tvprintk_emit+0x4b4/0x830\n[11009.908061] \tvprintk_default+0x1f/0x30\n[11009.908064] \tprintk+0x99/0xb5\n[11009.908067] \tkasan_report_error+0x10a/0x550\n[11009.908070] \t__asan_report_load1_noabort+0x43/0x50\n[11009.908074] INFO: Freed in xc2028_set_config+0x90/0x630 [tuner_xc2028] age=1 cpu=3 pid=28992\n[11009.908077] \t__slab_free+0x2ec/0x460\n[11009.908080] \tkfree+0x266/0x280\n[11009.908083] \txc2028_set_config+0x90/0x630 [tuner_xc2028]\n[11009.908086] \txc2028_attach+0x310/0x8a0 [tuner_xc2028]\n[11009.908090] \tem28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb]\n[11009.908094] \tem28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb]\n[11009.908098] \tem28xx_dvb_init+0x81/0x8a [em28xx_dvb]\n[11009.908101] \tem28xx_register_extension+0xd9/0x190 [em28xx]\n[11009.908105] \tem28xx_dvb_register+0x10/0x1000 [em28xx_dvb]\n[11009.908108] \tdo_one_initcall+0x141/0x300\n[11009.908111] \tdo_init_module+0x1d0/0x5ad\n[11009.908114] \tload_module+0x6666/0x9ba0\n[11009.908117] \tSyS_finit_module+0x108/0x130\n[11009.908120] \tentry_SYSCALL_64_fastpath+0x16/0x76\n[11009.908123] INFO: Slab 0xffffea000ef5e280 objects=25 used=25 fp=0x          (null) flags=0x2ffff8000004080\n[11009.908126] INFO: Object 0xffff8803bd78ab40 @offset=2880 fp=0x0000000000000001\n\n[11009.908130] Bytes b4 ffff8803bd78ab30: 01 00 00 00 2a 07 00 00 9d 28 00 00 01 00 00 00  ....*....(......\n[11009.908133] Object ffff8803bd78ab40: 01 00 00 00 00 00 00 00 b0 1d c3 6a 00 88 ff ff  ...........j....\n[11009.908137] CPU: 3 PID: 28992 Comm: modprobe Tainted: G    B   W       4.5.0-rc1+ #43\n[11009.908140] Hardware name:                  /NUC5i7RYB, BIOS RYBDWi35.86A.0350.2015.0812.1722 08/12/2015\n[11009.908142]  ffff8803bd78a000 ffff8802c273f1b8 ffffffff81932007 ffff8803c6407a80\n[11009.908148]  ffff8802c273f1e8 ffffffff81556759 ffff8803c6407a80 ffffea000ef5e280\n[11009.908153]  ffff8803bd78ab40 dffffc0000000000 ffff8802c273f210 ffffffff8155ccb4\n[11009.908158] Call Trace:\n[11009.908162]  [<ffffffff81932007>] dump_stack+0x4b/0x64\n[11009.908165]  [<ffffffff81556759>] print_trailer+0xf9/0x150\n[11009.908168]  [<ffffffff8155ccb4>] object_err+0x34/0x40\n[11009.908171]  [<ffffffff8155f260>] kasan_report_error+0x230/0x550\n[11009.908175]  [<ffffffff81237d71>] ? trace_hardirqs_off_caller+0x21/0x290\n[11009.908179]  [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50\n[11009.908182]  [<ffffffff8155f5c3>] __asan_report_load1_noabort+0x43/0x50\n[11009.908185]  [<ffffffff8155ea00>] ? __asan_register_globals+0x50/0xa0\n[11009.908189]  [<ffffffff8194cea6>] ? strcmp+0x96/0xb0\n[11009.908192]  [<ffffffff8194cea6>] strcmp+0x96/0xb0\n[11009.908196]  [<ffffffffa13ba4ac>] xc2028_set_config+0x15c/0x630 [tuner_xc2028]\n[11009.908200]  [<ffffffffa13bac90>] xc2028_attach+0x310/0x8a0 [tuner_xc2028]\n[11009.908203]  [<ffffffff8155ea78>] ? memset+0x28/0x30\n[11009.908206]  [<ffffffffa13ba980>] ? xc2028_set_config+0x630/0x630 [tuner_xc2028]\n[11009.908211]  [<ffffffffa157a59a>] em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb]\n[11009.908215]  [<ffffffffa157aa2a>] ? em28xx_dvb_init.part.3+0x37c/0x5cf4 [em28xx_dvb]\n[11009.908219]  [<ffffffffa157a3a1>] ? hauppauge_hvr930c_init+0x487/0x487 [em28xx_dvb]\n[11009.908222]  [<ffffffffa01795ac>] ? lgdt330x_attach+0x1cc/0x370 [lgdt330x]\n[11009.908226]  [<ffffffffa01793e0>] ? i2c_read_demod_bytes.isra.2+0x210/0x210 [lgdt330x]\n[11009.908230]  [<ffffffff812e87d0>] ? ref_module.part.15+0x10/0x10\n[11009.908233]  [<ffffffff812e56e0>] ? module_assert_mutex_or_preempt+0x80/0x80\n[11009.908238]  [<ffffffffa157af92>] em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb]\n[11009.908242]  [<ffffffffa157a6ae>] ? em28xx_attach_xc3028.constprop.7+0x30d/0x30d [em28xx_dvb]\n[11009.908245]  [<ffffffff8195222d>] ? string+0x14d/0x1f0\n[11009.908249]  [<ffffffff8195381f>] ? symbol_string+0xff/0x1a0\n[11009.908253]  [<ffffffff81953720>] ? uuid_string+0x6f0/0x6f0\n[11009.908257]  [<ffffffff811a775e>] ? __kernel_text_address+0x7e/0xa0\n[11009.908260]  [<ffffffff8104b02f>] ? print_context_stack+0x7f/0xf0\n[11009.908264]  [<ffffffff812e9846>] ? __module_address+0xb6/0x360\n[11009.908268]  [<ffffffff8137fdc9>] ? is_ftrace_trampoline+0x99/0xe0\n[11009.908271]  [<ffffffff811a775e>] ? __kernel_text_address+0x7e/0xa0\n[11009.908275]  [<ffffffff81240a70>] ? debug_check_no_locks_freed+0x290/0x290\n[11009.908278]  [<ffffffff8104a24b>] ? dump_trace+0x11b/0x300\n[11009.908282]  [<ffffffffa13e8143>] ? em28xx_register_extension+0x23/0x190 [em28xx]\n[11009.908285]  [<ffffffff81237d71>] ? trace_hardirqs_off_caller+0x21/0x290\n[11009.908289]  [<ffffffff8123ff56>] ? trace_hardirqs_on_caller+0x16/0x590\n[11009.908292]  [<ffffffff812404dd>] ? trace_hardirqs_on+0xd/0x10\n[11009.908296]  [<ffffffffa13e8143>] ? em28xx_register_extension+0x23/0x190 [em28xx]\n[11009.908299]  [<ffffffff822dcbb0>] ? mutex_trylock+0x400/0x400\n[11009.908302]  [<ffffffff810021a1>] ? do_one_initcall+0x131/0x300\n[11009.908306]  [<ffffffff81296dc7>] ? call_rcu_sched+0x17/0x20\n[11009.908309]  [<ffffffff8159e708>] ? put_object+0x48/0x70\n[11009.908314]  [<ffffffffa1579f11>] em28xx_dvb_init+0x81/0x8a [em28xx_dvb]\n[11009.908317]  [<ffffffffa13e81f9>] em28xx_register_extension+0xd9/0x190 [em28xx]\n[11009.908320]  [<ffffffffa0150000>] ? 0xffffffffa0150000\n[11009.908324]  [<ffffffffa0150010>] em28xx_dvb_register+0x10/0x1000 [em28xx_dvb]\n[11009.908327]  [<ffffffff810021b1>] do_one_initcall+0x141/0x300\n[11009.908330]  [<ffffffff81002070>] ? try_to_run_init_process+0x40/0x40\n[11009.908333]  [<ffffffff8123ff56>] ? trace_hardirqs_on_caller+0x16/0x590\n[11009.908337]  [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50\n[11009.908340]  [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50\n[11009.908343]  [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50\n[11009.908346]  [<ffffffff8155ea37>] ? __asan_register_globals+0x87/0xa0\n[11009.908350]  [<ffffffff8144da7b>] do_init_module+0x1d0/0x5ad\n[11009.908353]  [<ffffffff812f2626>] load_module+0x6666/0x9ba0\n[11009.908356]  [<ffffffff812e9c90>] ? symbol_put_addr+0x50/0x50\n[11009.908361]  [<ffffffffa1580037>] ? em28xx_dvb_init.part.3+0x5989/0x5cf4 [em28xx_dvb]\n[11009.908366]  [<ffffffff812ebfc0>] ? module_frob_arch_sections+0x20/0x20\n[11009.908369]  [<ffffffff815bc940>] ? open_exec+0x50/0x50\n[11009.908374]  [<ffffffff811671bb>] ? ns_capable+0x5b/0xd0\n[11009.908377]  [<ffffffff812f5e58>] SyS_finit_module+0x108/0x130\n[11009.908379]  [<ffffffff812f5d50>] ? SyS_init_module+0x1f0/0x1f0\n[11009.908383]  [<ffffffff81004044>] ? lockdep_sys_exit_thunk+0x12/0x14\n[11009.908394]  [<ffffffff822e6936>] entry_SYSCALL_64_fastpath+0x16/0x76\n[11009.908396] Memory state around the buggy address:\n[11009.908398]  ffff8803bd78aa00: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[11009.908401]  ffff8803bd78aa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[11009.908403] >ffff8803bd78ab00: fc fc fc fc fc fc fc fc 00 00 fc fc fc fc fc fc\n[11009.908405]                                            ^\n[11009.908407]  ffff8803bd78ab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[11009.908409]  ffff8803bd78ac00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[11009.908411] ==================================================================\n\nIn order to avoid it, let's set the cached value of the firmware\nname to NULL after freeing it. While here, return an error if\nthe memory allocation fails.\n\nSigned-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>\nChange-Id: I945c841dcfb45de2056267e4aa50bbe176b527cf\nBug: 30946097","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/1353685f1f4148660a75bee4593cac65603b64f6"},{"sha":"456da5b9830b0f8853ee1e7aca76c32f29845045","author":{"name":"Dan Carpenter","email":"60b2bf2bc0bec4ca4a4b046ca7ef9255248abff8@oracle.com"},"message":"UPSTREAM: [media] xc2028: unlock on error in xc2028_set_config()\n\n(cherry picked from commit 210bd104c6acd31c3c6b8b075b3f12d4a9f6b60d)\n\nWe have to unlock before returning -ENOMEM.\n\nFixes: 8dfbcc4351a0 ('[media] xc2028: avoid use after free')\n\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>\nChange-Id: I7b6ba9fde5c6e29467e6de23d398af2fe56e2547\nBug: 30946097","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/456da5b9830b0f8853ee1e7aca76c32f29845045"},{"sha":"b9bcc3d1ec134c3b7f10b77218e056ec2493d42c","author":{"name":"Vegard Nossum","email":"9c44e0ed746b5c309b0bf31e4bae8fb5eb72beb1@oracle.com"},"message":"UPSTREAM: block: fix use-after-free in seq file\n\n(cherry picked from commit 77da160530dd1dc94f6ae15a981f24e5f0021e84)\n\nI got a KASAN report of use-after-free:\n\n    ==================================================================\n    BUG: KASAN: use-after-free in klist_iter_exit+0x61/0x70 at addr ffff8800b6581508\n    Read of size 8 by task trinity-c1/315\n    =============================================================================\n    BUG kmalloc-32 (Not tainted): kasan: bad access detected\n    -----------------------------------------------------------------------------\n\n    Disabling lock debugging due to kernel taint\n    INFO: Allocated in disk_seqf_start+0x66/0x110 age=144 cpu=1 pid=315\n            ___slab_alloc+0x4f1/0x520\n            __slab_alloc.isra.58+0x56/0x80\n            kmem_cache_alloc_trace+0x260/0x2a0\n            disk_seqf_start+0x66/0x110\n            traverse+0x176/0x860\n            seq_read+0x7e3/0x11a0\n            proc_reg_read+0xbc/0x180\n            do_loop_readv_writev+0x134/0x210\n            do_readv_writev+0x565/0x660\n            vfs_readv+0x67/0xa0\n            do_preadv+0x126/0x170\n            SyS_preadv+0xc/0x10\n            do_syscall_64+0x1a1/0x460\n            return_from_SYSCALL_64+0x0/0x6a\n    INFO: Freed in disk_seqf_stop+0x42/0x50 age=160 cpu=1 pid=315\n            __slab_free+0x17a/0x2c0\n            kfree+0x20a/0x220\n            disk_seqf_stop+0x42/0x50\n            traverse+0x3b5/0x860\n            seq_read+0x7e3/0x11a0\n            proc_reg_read+0xbc/0x180\n            do_loop_readv_writev+0x134/0x210\n            do_readv_writev+0x565/0x660\n            vfs_readv+0x67/0xa0\n            do_preadv+0x126/0x170\n            SyS_preadv+0xc/0x10\n            do_syscall_64+0x1a1/0x460\n            return_from_SYSCALL_64+0x0/0x6a\n\n    CPU: 1 PID: 315 Comm: trinity-c1 Tainted: G    B           4.7.0+ #62\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014\n     ffffea0002d96000 ffff880119b9f918 ffffffff81d6ce81 ffff88011a804480\n     ffff8800b6581500 ffff880119b9f948 ffffffff8146c7bd ffff88011a804480\n     ffffea0002d96000 ffff8800b6581500 fffffffffffffff4 ffff880119b9f970\n    Call Trace:\n     [<ffffffff81d6ce81>] dump_stack+0x65/0x84\n     [<ffffffff8146c7bd>] print_trailer+0x10d/0x1a0\n     [<ffffffff814704ff>] object_err+0x2f/0x40\n     [<ffffffff814754d1>] kasan_report_error+0x221/0x520\n     [<ffffffff8147590e>] __asan_report_load8_noabort+0x3e/0x40\n     [<ffffffff83888161>] klist_iter_exit+0x61/0x70\n     [<ffffffff82404389>] class_dev_iter_exit+0x9/0x10\n     [<ffffffff81d2e8ea>] disk_seqf_stop+0x3a/0x50\n     [<ffffffff8151f812>] seq_read+0x4b2/0x11a0\n     [<ffffffff815f8fdc>] proc_reg_read+0xbc/0x180\n     [<ffffffff814b24e4>] do_loop_readv_writev+0x134/0x210\n     [<ffffffff814b4c45>] do_readv_writev+0x565/0x660\n     [<ffffffff814b8a17>] vfs_readv+0x67/0xa0\n     [<ffffffff814b8de6>] do_preadv+0x126/0x170\n     [<ffffffff814b92ec>] SyS_preadv+0xc/0x10\n\nThis problem can occur in the following situation:\n\nopen()\n - pread()\n    - .seq_start()\n       - iter = kmalloc() // succeeds\n       - seqf->private = iter\n    - .seq_stop()\n       - kfree(seqf->private)\n - pread()\n    - .seq_start()\n       - iter = kmalloc() // fails\n    - .seq_stop()\n       - class_dev_iter_exit(seqf->private) // boom! old pointer\n\nAs the comment in disk_seqf_stop() says, stop is called even if start\nfailed, so we need to reinitialise the private pointer to NULL when seq\niteration stops.\n\nAn alternative would be to set the private pointer to NULL when the\nkmalloc() in disk_seqf_start() fails.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Vegard Nossum <vegard.nossum@oracle.com>\nAcked-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Jens Axboe <axboe@fb.com>\nChange-Id: I07b33f4b38341f60a37806cdd45b0a0c3ab4d84d\nBug: 30942273","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/b9bcc3d1ec134c3b7f10b77218e056ec2493d42c"},{"sha":"c3735f8c07de25d808c7a705e64ed7748b4ff6d7","author":{"name":"Min Chong","email":"80b2cbf0ce2195028a61ea55fdb7b840626629d5@google.com"},"message":"input: synaptics_dsx: add checks of user input data\n\nAdd checks of the user input count to avoid possible heap overflow\n\nSigned-off-by: Min Chong <mchong@google.com>\nBug: 30937462\nChange-Id: I6fc8323cbcf395a2c24e49e65cc7012709d031a2","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/c3735f8c07de25d808c7a705e64ed7748b4ff6d7"},{"sha":"e9854972632fe3c91f9a2232cd572acab856990a","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"BACKPORT: ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()\n\n(cherry picked from commit 902eb7fd1e4af3ac69b9b30f8373f118c92b9729)\n\nJust a minor code cleanup: unify the error paths.\n\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nChange-Id: I8253a86235df2ac1258153c9e128fa158527567f\nBug: 30952477","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/e9854972632fe3c91f9a2232cd572acab856990a"},{"sha":"8fe4af55f5de066ffebdb3c0d0c0a1c28e537ebe","author":{"name":"vivek mehta","email":"46298864fe14f825b17ffcd41039a9c3fac6322b@codeaurora.org"},"message":"misc: qcom: qdsp6v2: initialize wma_config_32\n\nNot all memebers of wma_config_32 are set before they are used which\nmight lead to invalid values being passed and used. To fix this issue\ninitialize all member variables of struct wma_config_32 to 0 before\nassigning specific values individually.\n\nChange-Id: Ibb082ce691625527e9a9ffd4978dea7ba4df9e84\nSigned-off-by: Siena Richard <sienar@codeaurora.org>\nSigned-off-by: vivek mehta <mvivek@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/8fe4af55f5de066ffebdb3c0d0c0a1c28e537ebe"},{"sha":"3815fd39cbd37868859aeef27b1613456510a885","author":{"name":"Biswajit Paul","email":"7ee5649c8de55a61a3bbcbc7dcde16c04b2f65da@codeaurora.org"},"message":"msm: camera: Restructure data handling to be more robust\n\nUse dynamic array allocation instead of static array to\nprevent stack overflow.\nUser-supplied number of bytes may result in integer overflow.\nTo fix this we check that the num_byte isn't above 8K size.\n\nBug: 30559423\nCRs-Fixed: 1060554\nChange-Id: I9b05b846e5cc3a62b1a0a67be529f09abc764796\nSigned-off-by: VijayaKumar T M <vtmuni@codeaurora.org>\nSigned-off-by: Biswajit Paul <biswajitpaul@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/3815fd39cbd37868859aeef27b1613456510a885"},{"sha":"b460ce984071590150eb7edbec85c155804dee75","author":{"name":"Biswajit Paul","email":"7ee5649c8de55a61a3bbcbc7dcde16c04b2f65da@codeaurora.org"},"message":"msm: sensor: Avoid potential stack overflow\n\nAdd a check to validate the user input data is not\ngreater than expected stack buffer size to avoid out\nof bounds array accesses\n\nBug: 30143904\nCRs-Fixed: 1056307\nChange-Id: I8b31006772367a120828269243b1971d33a4d7d3\nSigned-off-by: VijayaKumar T M <vtmuni@codeaurora.org>\nSigned-off-by: Biswajit Paul <biswajitpaul@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/b460ce984071590150eb7edbec85c155804dee75"},{"sha":"f4a38f4888bb411afc9f3bce701f8e21a3d8db02","author":{"name":"Ariel Yin","email":"9308cd92d4904c8721204c41e9329abc3a43c10d@google.com"},"message":"qcedev: Validate Source and Destination addresses\n\nSource and Destination addresses passed by user space apps/clients\nare validated independent of type of operation to mitigate kernel\naddress space exploitation.\n\nBug: 30034511\nCRs-Fixed: 1050538\nChange-Id: I9ecb0103d7a73eedb2e0d1db1d5613b18dd77e59\nSigned-off-by: AnilKumar Chimata <anilc@codeaurora.org>\nSigned-off-by: Biswajit Paul <biswajitpaul@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/f4a38f4888bb411afc9f3bce701f8e21a3d8db02"},{"sha":"c2e8d08c6d0e7f8efc0d96c858ded4091d2b74f1","author":{"name":"vivek mehta","email":"46298864fe14f825b17ffcd41039a9c3fac6322b@codeaurora.org"},"message":"ASoC: msm: initialize the params array before using it\n\nThe params array is used without initialization, which may cause\nsecurity issues. Initialize it as all zero after the definition.\n\nbug: 30902162\nChange-Id: If462fe3d82f139d72547f82dc7eb564f83cb35bf\nSigned-off-by: vivek mehta <mvivek@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/c2e8d08c6d0e7f8efc0d96c858ded4091d2b74f1"},{"sha":"6efd447d8703295dddaec6d2b97099ac47c19386","author":{"name":"Ariel Yin","email":"9308cd92d4904c8721204c41e9329abc3a43c10d@google.com"},"message":"misc: qcom: qdsp6v2: initialize config_32\n\nNot all members of config_32 are set before they are used which\nmight lead to invalid values being passed and used. To fix this issue\ninitialize all member variables of struct config_32 to 0 before\nassigning specific values individually.\n\nBug: 30741851\nChange-Id: Ifea3a6e8bf45481c65a4455ee64318304798fee2\nSigned-off-by: vivek mehta <mvivek@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/6efd447d8703295dddaec6d2b97099ac47c19386"},{"sha":"be018a70d8cca057575c2f893fee7eab504b9765","author":{"name":"Ariel Yin","email":"9308cd92d4904c8721204c41e9329abc3a43c10d@google.com"},"message":"msm: crypto: Fix integer over flow check in qcrypto driver\n\nInteger overflow check is invalid when ULONG_MAX is used,\nas ULONG_MAX has typeof 'unsigned long', while req->assoclen,\nreq->crytlen, and qreq.ivsize are 'unsigned int'. Make change\nto use UINT_MAX instead of ULONG_MAX.\n\nBug: 30515053\nCRs-fixed: 1050970\nChange-Id: I3782ea7ed2eaacdcad15b34e047a4699bf4f9e4f\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>\nSigned-off-by: Biswajit Paul <biswajitpaul@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Flash-Kernel/android-kernel-msm/commits/be018a70d8cca057575c2f893fee7eab504b9765"}]}
{"actor":{"display_login":"nathanchance"}}