{"push_id":1293925757,"size":24,"distinct_size":24,"ref":"refs/heads/android-m","head":"32c626d9ca868578accfba1a73d15da371383792","before":"201b200117096337356ea14d851178291dbc42d4","commits":[{"sha":"cd93a57238d83d3e39167f5b125e63ab0b082059","author":{"name":"Patrick Daly","email":"78479ab4153ef5619bc927755d9ca2e5cd01b75a@codeaurora.org"},"message":"UPSTREAM: ASoC: wcd9xxx: Fix unprotected userspace access\n\nProtect against memory faults while accessing userspace addresses.\n\nChange-Id: I1433bac73d24d428749558e530e6869c2e5ee98f\nSigned-off-by: Patrick Daly <pdaly@codeaurora.org>\nBug: 29512527","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/cd93a57238d83d3e39167f5b125e63ab0b082059"},{"sha":"93da96c6e804c9e022e1f68491b0dab37224c7e3","author":{"name":"Jerry Lee","email":"c7189381eb74de1157e4e1bcfabd4200913e39e2@broadcom.com"},"message":"net: wireless: bcmdhd: security vulnerability - protect array overflow in PNO\n\nProtect array overflow in parsing PNO batching cmd\nBug: 29009982\n\nChange-Id: I4e36f580336cacd6e3efcb8caf91eef33003753b\nSigned-off-by: Jerry Lee <jerrylee@broadcom.com>","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/93da96c6e804c9e022e1f68491b0dab37224c7e3"},{"sha":"914bf377204167ebea3d9ebbf58ac440596eafe1","author":{"name":"Biswajit Paul","email":"7ee5649c8de55a61a3bbcbc7dcde16c04b2f65da@codeaurora.org"},"message":"spmi: prevent showing the address of spmidev\n\nCreating devices with the address of the container spmidev is not\nindicative of the actual hardware device it represents.\n\nInstead use an unique id to indicate the device it represents.\n\nBug: 28760543\nCRs-Fixed: 1024197\nChange-Id: Id18e2a19f4fa1249901a3f275defa8f589270d69\nSigned-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>\nSigned-off-by: Biswajit Paul <biswajitpaul@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/914bf377204167ebea3d9ebbf58ac440596eafe1"},{"sha":"441f25c9cac272ee5407ebc0b8d29f8e0fd68078","author":{"name":"vivek mehta","email":"46298864fe14f825b17ffcd41039a9c3fac6322b@codeaurora.org"},"message":"ASoC: msm: qdsp6v2: check param length for EAC3 format\n\nInitialize param length with user space argument and\ncheck the condition for maximum length in\nSND_AUDIOCODEC_EAC3 format.\n\nBUG 28868303\n\nSigned-off-by: vivek mehta <mvivek@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/441f25c9cac272ee5407ebc0b8d29f8e0fd68078"},{"sha":"59f8c7754a43ffb362fcec7f99cd94a3dab16f81","author":{"name":"David Howells","email":"358fdf7bce8223edb2a0d846104bf62a286894d5@redhat.com"},"message":"BACKPORT: ASN.1: Fix non-match detection failure on data overrun\n\nIf the ASN.1 decoder is asked to parse a sequence of objects, non-optional\nmatches get skipped if there's no more data to be had rather than a\ndata-overrun error being reported.\n\nThis is due to the code segment that decides whether to skip optional\nmatches (ie. matches that could get ignored because an element is marked\nOPTIONAL in the grammar) due to a lack of data also skips non-optional\nelements if the data pointer has reached the end of the buffer.\n\nThis can be tested with the data decoder for the new RSA akcipher algorithm\nthat takes three non-optional integers.  Currently, it skips the last\ninteger if there is insufficient data.\n\nWithout the fix, #defining DEBUG in asn1_decoder.c will show something\nlike:\n\n\tnext_op: pc=0/13 dp=0/270 C=0 J=0\n\t- match? 30 30 00\n\t- TAG: 30 266 CONS\n\tnext_op: pc=2/13 dp=4/270 C=1 J=0\n\t- match? 02 02 00\n\t- TAG: 02 257\n\t- LEAF: 257\n\tnext_op: pc=5/13 dp=265/270 C=1 J=0\n\t- match? 02 02 00\n\t- TAG: 02 3\n\t- LEAF: 3\n\tnext_op: pc=8/13 dp=270/270 C=1 J=0\n\tnext_op: pc=11/13 dp=270/270 C=1 J=0\n\t- end cons t=4 dp=270 l=270/270\n\nThe next_op line for pc=8/13 should be followed by a match line.\n\nThis is not exploitable for X.509 certificates by means of shortening the\nmessage and fixing up the ASN.1 CONS tags because:\n\n (1) The relevant records being built up are cleared before use.\n\n (2) If the message is shortened sufficiently to remove the public key, the\n     ASN.1 parse of the RSA key will fail quickly due to a lack of data.\n\n (3) Extracted signature data is either turned into MPIs (which cope with a\n     0 length) or is simpler integers specifying algoritms and suchlike\n     (which can validly be 0); and\n\n (4) The AKID and SKID extensions are optional and their removal is handled\n     without risking passing a NULL to asymmetric_key_generate_id().\n\n (5) If the certificate is truncated sufficiently to remove the subject,\n     issuer or serialNumber then the ASN.1 decoder will fail with a 'Cons\n     stack underflow' return.\n\nThis is not exploitable for PKCS#7 messages by means of removal of elements\nfrom such a message from the tail end of a sequence:\n\n (1) Any shortened X.509 certs embedded in the PKCS#7 message are survivable\n     as detailed above.\n\n (2) The message digest content isn't used if it shows a NULL pointer,\n     similarly, the authattrs aren't used if that shows a NULL pointer.\n\n (3) A missing signature results in a NULL MPI - which the MPI routines deal\n     with.\n\n (4) If data is NULL, it is expected that the message has detached content and\n     that is handled appropriately.\n\n (5) If the serialNumber is excised, the unconditional action associated\n     with it will pick up the containing SEQUENCE instead, so no NULL\n     pointer will be seen here.\n\n     If both the issuer and the serialNumber are excised, the ASN.1 decode\n     will fail with an 'Unexpected tag' return.\n\n     In either case, there's no way to get to asymmetric_key_generate_id()\n     with a NULL pointer.\n\n (6) Other fields are decoded to simple integers.  Shortening the message\n     to omit an algorithm ID field will cause checks on this to fail early\n     in the verification process.\n\nThis can also be tested by snipping objects off of the end of the ASN.1 stream\nsuch that mandatory tags are removed - or even from the end of internal\nSEQUENCEs.  If any mandatory tag is missing, the error EBADMSG *should* be\nproduced.  Without this patch ERANGE or ENOPKG might be produced or the parse\nmay apparently succeed, perhaps with ENOKEY or EKEYREJECTED being produced\nlater, depending on what gets snipped.\n\nJust snipping off the final BIT_STRING or OCTET_STRING from either sample\nshould be a start since both are mandatory and neither will cause an EBADMSG\nwithout the patches\n\nReported-by: Marcel Holtmann <marcel@holtmann.org>\nSigned-off-by: David Howells <dhowells@redhat.com>\nTested-by: Marcel Holtmann <marcel@holtmann.org>\nReviewed-by: David Woodhouse <David.Woodhouse@intel.com>\n\nBug: 28751627\n(cherry picked from commit 0d62e9dd6da45bbf0f33a8617afc5fe774c8f45f)\nSigned-off-by: Aarthi Thiruvengadam <athiru@google.com>\nChange-Id: Iaa02c662e60cf169b88fada050b887cad1b1c58f","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/59f8c7754a43ffb362fcec7f99cd94a3dab16f81"},{"sha":"6ff7d6e6a7305f6f203ee27b47b83c4423c9454c","author":{"name":"Rainer Weikusat","email":"83eef5bb46142d818cc9ec09a206a7f5abed4070@mobileactivedefense.com"},"message":"BACKPORT: unix: avoid use-after-free in ep_remove_wait_queue\n\nRainer Weikusat <rweikusat@mobileactivedefense.com> writes:\nAn AF_UNIX datagram socket being the client in an n:1 association with\nsome server socket is only allowed to send messages to the server if the\nreceive queue of this socket contains at most sk_max_ack_backlog\ndatagrams. This implies that prospective writers might be forced to go\nto sleep despite none of the message presently enqueued on the server\nreceive queue were sent by them. In order to ensure that these will be\nwoken up once space becomes again available, the present unix_dgram_poll\nroutine does a second sock_poll_wait call with the peer_wait wait queue\nof the server socket as queue argument (unix_dgram_recvmsg does a wake\nup on this queue after a datagram was received). This is inherently\nproblematic because the server socket is only guaranteed to remain alive\nfor as long as the client still holds a reference to it. In case the\nconnection is dissolved via connect or by the dead peer detection logic\nin unix_dgram_sendmsg, the server socket may be freed despite \"the\npolling mechanism\" (in particular, epoll) still has a pointer to the\ncorresponding peer_wait queue. There's no way to forcibly deregister a\nwait queue with epoll.\n\nBased on an idea by Jason Baron, the patch below changes the code such\nthat a wait_queue_t belonging to the client socket is enqueued on the\npeer_wait queue of the server whenever the peer receive queue full\ncondition is detected by either a sendmsg or a poll. A wake up on the\npeer queue is then relayed to the ordinary wait queue of the client\nsocket via wake function. The connection to the peer wait queue is again\ndissolved if either a wake up is about to be relayed or the client\nsocket reconnects or a dead peer is detected or the client socket is\nitself closed. This enables removing the second sock_poll_wait from\nunix_dgram_poll, thus avoiding the use-after-free, while still ensuring\nthat no blocked writer sleeps forever.\n\nSigned-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com>\nFixes: ec0d215f9420 (\"af_unix: fix 'poll for write'/connected DGRAM sockets\")\nReviewed-by: Jason Baron <jbaron@akamai.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n\nBug: 29119002\n(cherry picked from commit 7d267278a9ece963d77eefec61630223fce08c6c)\nSigned-off-by: Aarthi Thiruvengadam <athiru@google.com>\n\nChange-Id: Ia374ee061195088f8c777940baa75cedbe897f4e","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/6ff7d6e6a7305f6f203ee27b47b83c4423c9454c"},{"sha":"b6e74ac51b94a94f1bd3e0e8866aae526a6505aa","author":{"name":"David Howells","email":"358fdf7bce8223edb2a0d846104bf62a286894d5@redhat.com"},"message":"UPSTREAM: KEYS: Fix ASN.1 indefinite length object parsing\n\nThis fixes CVE-2016-0758.\n\nIn the ASN.1 decoder, when the length field of an ASN.1 value is extracted,\nit isn't validated against the remaining amount of data before being added\nto the cursor.  With a sufficiently large size indicated, the check:\n\n\tdatalen - dp < 2\n\nmay then fail due to integer overflow.\n\nFix this by checking the length indicated against the amount of remaining\ndata in both places a definite length is determined.\n\nWhilst we're at it, make the following changes:\n\n (1) Check the maximum size of extended length does not exceed the capacity\n     of the variable it's being stored in (len) rather than the type that\n     variable is assumed to be (size_t).\n\n (2) Compare the EOC tag to the symbolic constant ASN1_EOC rather than the\n     integer 0.\n\n (3) To reduce confusion, move the initialisation of len outside of:\n\n\tfor (len = 0; n > 0; n--) {\n\n     since it doesn't have anything to do with the loop counter n.\n\nBug: 29814470\n(cherry picked from commit 23c8a812dc3c621009e4f0e5342aa4e2ede1ceaa)\n\nChange-Id: I09dc91c698365cff384560a6b41e4b3207597ce6\nSigned-off-by: David Howells <dhowells@redhat.com>\nReviewed-by: Mimi Zohar <zohar@linux.vnet.ibm.com>\nAcked-by: David Woodhouse <David.Woodhouse@intel.com>\nAcked-by: Peter Jones <pjones@redhat.com>","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/b6e74ac51b94a94f1bd3e0e8866aae526a6505aa"},{"sha":"14d3d1756fb25015e016710f61a73f51909bb87d","author":{"name":"Biswajit Paul","email":"7ee5649c8de55a61a3bbcbc7dcde16c04b2f65da@codeaurora.org"},"message":"msm-core: debug: Fix the number of arguments for sysfs nodes\n\nPtable and enable node parses the input arguments incorrectly. Parse the\ninput message into exact number of arguments that are required for the\nrespective nodes.\n\nBug: 28967028\nCRs-fixed: 1032875\nChange-Id: I881f18217b703a497efa4799288dee39a28ea8ab\nSigned-off-by: Archana Sathyakumar <asathyak@codeaurora.org>\nSigned-off-by: Biswajit Paul <biswajitpaul@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/14d3d1756fb25015e016710f61a73f51909bb87d"},{"sha":"d15d646291926b05d0aae54de411baa906f5f905","author":{"name":"Srinivasarao P","email":"5838be2f68866147a6b98dc0567ce3ec89ebe5fc@codeaurora.org"},"message":"qcom: ssr: Fix possible overflow when copying firmware name\n\nArray overflow can occur in firmware_name_store(), if the variable\nbuf contains the string larger than size of subsys->desc->fw_name\n\nBug: 28675151\nChange-Id: Ice39d7a1eb0b5f53125cc5d528021a99b9f7ff90\nSigned-off-by: Srinivasarao P <spathi@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/d15d646291926b05d0aae54de411baa906f5f905"},{"sha":"e62372bff806de2f43e972ed633980c63704e67e","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"UPSTREAM: netfilter: x_tables: fix unconditional helper\n\nBen Hawkes says:\n\n In the mark_source_chains function (net/ipv4/netfilter/ip_tables.c) it\n is possible for a user-supplied ipt_entry structure to have a large\n next_offset field. This field is not bounds checked prior to writing a\n counter value at the supplied offset.\n\nProblem is that mark_source_chains should not have been called --\nthe rule doesn't have a next entry, so its supposed to return\nan absolute verdict of either ACCEPT or DROP.\n\nHowever, the function conditional() doesn't work as the name implies.\nIt only checks that the rule is using wildcard address matching.\n\nHowever, an unconditional rule must also not be using any matches\n(no -m args).\n\nThe underflow validator only checked the addresses, therefore\npassing the 'unconditional absolute verdict' test, while\nmark_source_chains also tested for presence of matches, and thus\nproceeeded to the next (not-existent) rule.\n\nUnify this so that all the callers have same idea of 'unconditional rule'.\n\nBug: 28940694\n\nReported-by: Ben Hawkes <hawkes@google.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\n(cherry picked from commit 54d83fc74aa9ec72794373cb47432c5f7fb1a309)\n\nChange-Id: I47ec0713ac563ac244200c7b2c54f09a91aceabc","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/e62372bff806de2f43e972ed633980c63704e67e"},{"sha":"a3b998c722e135c234db5f984b572236527f364b","author":{"name":"Guillaume Nault","email":"3f2beb9890afcf959ec304431b991035a559d9bd@alphalink.fr"},"message":"UPSTREAM: ppp: take reference on channels netns\n\nLet channels hold a reference on their network namespace.\nSome channel types, like ppp_async and ppp_synctty, can have their\nuserspace controller running in a different namespace. Therefore they\ncan't rely on them to preclude their netns from being removed from\nunder them.\n\n==================================================================\nBUG: KASAN: use-after-free in ppp_unregister_channel+0x372/0x3a0 at\naddr ffff880064e217e0\nRead of size 8 by task syz-executor/11581\n=============================================================================\nBUG net_namespace (Not tainted): kasan: bad access detected\n-----------------------------------------------------------------------------\n\nDisabling lock debugging due to kernel taint\nINFO: Allocated in copy_net_ns+0x6b/0x1a0 age=92569 cpu=3 pid=6906\n[<      none      >] ___slab_alloc+0x4c7/0x500 kernel/mm/slub.c:2440\n[<      none      >] __slab_alloc+0x4c/0x90 kernel/mm/slub.c:2469\n[<     inline     >] slab_alloc_node kernel/mm/slub.c:2532\n[<     inline     >] slab_alloc kernel/mm/slub.c:2574\n[<      none      >] kmem_cache_alloc+0x23a/0x2b0 kernel/mm/slub.c:2579\n[<     inline     >] kmem_cache_zalloc kernel/include/linux/slab.h:597\n[<     inline     >] net_alloc kernel/net/core/net_namespace.c:325\n[<      none      >] copy_net_ns+0x6b/0x1a0 kernel/net/core/net_namespace.c:360\n[<      none      >] create_new_namespaces+0x2f6/0x610 kernel/kernel/nsproxy.c:95\n[<      none      >] copy_namespaces+0x297/0x320 kernel/kernel/nsproxy.c:150\n[<      none      >] copy_process.part.35+0x1bf4/0x5760 kernel/kernel/fork.c:1451\n[<     inline     >] copy_process kernel/kernel/fork.c:1274\n[<      none      >] _do_fork+0x1bc/0xcb0 kernel/kernel/fork.c:1723\n[<     inline     >] SYSC_clone kernel/kernel/fork.c:1832\n[<      none      >] SyS_clone+0x37/0x50 kernel/kernel/fork.c:1826\n[<      none      >] entry_SYSCALL_64_fastpath+0x16/0x7a kernel/arch/x86/entry/entry_64.S:185\n\nINFO: Freed in net_drop_ns+0x67/0x80 age=575 cpu=2 pid=2631\n[<      none      >] __slab_free+0x1fc/0x320 kernel/mm/slub.c:2650\n[<     inline     >] slab_free kernel/mm/slub.c:2805\n[<      none      >] kmem_cache_free+0x2a0/0x330 kernel/mm/slub.c:2814\n[<     inline     >] net_free kernel/net/core/net_namespace.c:341\n[<      none      >] net_drop_ns+0x67/0x80 kernel/net/core/net_namespace.c:348\n[<      none      >] cleanup_net+0x4e5/0x600 kernel/net/core/net_namespace.c:448\n[<      none      >] process_one_work+0x794/0x1440 kernel/kernel/workqueue.c:2036\n[<      none      >] worker_thread+0xdb/0xfc0 kernel/kernel/workqueue.c:2170\n[<      none      >] kthread+0x23f/0x2d0 kernel/drivers/block/aoe/aoecmd.c:1303\n[<      none      >] ret_from_fork+0x3f/0x70 kernel/arch/x86/entry/entry_64.S:468\nINFO: Slab 0xffffea0001938800 objects=3 used=0 fp=0xffff880064e20000\nflags=0x5fffc0000004080\nINFO: Object 0xffff880064e20000 @offset=0 fp=0xffff880064e24200\n\nCPU: 1 PID: 11581 Comm: syz-executor Tainted: G    B           4.4.0+\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nrel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014\n 00000000ffffffff ffff8800662c7790 ffffffff8292049d ffff88003e36a300\n ffff880064e20000 ffff880064e20000 ffff8800662c77c0 ffffffff816f2054\n ffff88003e36a300 ffffea0001938800 ffff880064e20000 0000000000000000\nCall Trace:\n [<     inline     >] __dump_stack kernel/lib/dump_stack.c:15\n [<ffffffff8292049d>] dump_stack+0x6f/0xa2 kernel/lib/dump_stack.c:50\n [<ffffffff816f2054>] print_trailer+0xf4/0x150 kernel/mm/slub.c:654\n [<ffffffff816f875f>] object_err+0x2f/0x40 kernel/mm/slub.c:661\n [<     inline     >] print_address_description kernel/mm/kasan/report.c:138\n [<ffffffff816fb0c5>] kasan_report_error+0x215/0x530 kernel/mm/kasan/report.c:236\n [<     inline     >] kasan_report kernel/mm/kasan/report.c:259\n [<ffffffff816fb4de>] __asan_report_load8_noabort+0x3e/0x40 kernel/mm/kasan/report.c:280\n [<     inline     >] ? ppp_pernet kernel/include/linux/compiler.h:218\n [<ffffffff83ad71b2>] ? ppp_unregister_channel+0x372/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392\n [<     inline     >] ppp_pernet kernel/include/linux/compiler.h:218\n [<ffffffff83ad71b2>] ppp_unregister_channel+0x372/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392\n [<     inline     >] ? ppp_pernet kernel/drivers/net/ppp/ppp_generic.c:293\n [<ffffffff83ad6f26>] ? ppp_unregister_channel+0xe6/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392\n [<ffffffff83ae18f3>] ppp_asynctty_close+0xa3/0x130 kernel/drivers/net/ppp/ppp_async.c:241\n [<ffffffff83ae1850>] ? async_lcp_peek+0x5b0/0x5b0 kernel/drivers/net/ppp/ppp_async.c:1000\n [<ffffffff82c33239>] tty_ldisc_close.isra.1+0x99/0xe0 kernel/drivers/tty/tty_ldisc.c:478\n [<ffffffff82c332c0>] tty_ldisc_kill+0x40/0x170 kernel/drivers/tty/tty_ldisc.c:744\n [<ffffffff82c34943>] tty_ldisc_release+0x1b3/0x260 kernel/drivers/tty/tty_ldisc.c:772\n [<ffffffff82c1ef21>] tty_release+0xac1/0x13e0 kernel/drivers/tty/tty_io.c:1901\n [<ffffffff82c1e460>] ? release_tty+0x320/0x320 kernel/drivers/tty/tty_io.c:1688\n [<ffffffff8174de36>] __fput+0x236/0x780 kernel/fs/file_table.c:208\n [<ffffffff8174e405>] ____fput+0x15/0x20 kernel/fs/file_table.c:244\n [<ffffffff813595ab>] task_work_run+0x16b/0x200 kernel/kernel/task_work.c:115\n [<     inline     >] exit_task_work kernel/include/linux/task_work.h:21\n [<ffffffff81307105>] do_exit+0x8b5/0x2c60 kernel/kernel/exit.c:750\n [<ffffffff813fdd20>] ? debug_check_no_locks_freed+0x290/0x290 kernel/kernel/locking/lockdep.c:4123\n [<ffffffff81306850>] ? mm_update_next_owner+0x6f0/0x6f0 kernel/kernel/exit.c:357\n [<ffffffff813215e6>] ? __dequeue_signal+0x136/0x470 kernel/kernel/signal.c:550\n [<ffffffff8132067b>] ? recalc_sigpending_tsk+0x13b/0x180 kernel/kernel/signal.c:145\n [<ffffffff81309628>] do_group_exit+0x108/0x330 kernel/kernel/exit.c:880\n [<ffffffff8132b9d4>] get_signal+0x5e4/0x14f0 kernel/kernel/signal.c:2307\n [<     inline     >] ? kretprobe_table_lock kernel/kernel/kprobes.c:1113\n [<ffffffff8151d355>] ? kprobe_flush_task+0xb5/0x450 kernel/kernel/kprobes.c:1158\n [<ffffffff8115f7d3>] do_signal+0x83/0x1c90 kernel/arch/x86/kernel/signal.c:712\n [<ffffffff8151d2a0>] ? recycle_rp_inst+0x310/0x310 kernel/include/linux/list.h:655\n [<ffffffff8115f750>] ? setup_sigcontext+0x780/0x780 kernel/arch/x86/kernel/signal.c:165\n [<ffffffff81380864>] ? finish_task_switch+0x424/0x5f0 kernel/kernel/sched/core.c:2692\n [<     inline     >] ? finish_lock_switch kernel/kernel/sched/sched.h:1099\n [<ffffffff81380560>] ? finish_task_switch+0x120/0x5f0 kernel/kernel/sched/core.c:2678\n [<     inline     >] ? context_switch kernel/kernel/sched/core.c:2807\n [<ffffffff85d794e9>] ? __schedule+0x919/0x1bd0 kernel/kernel/sched/core.c:3283\n [<ffffffff81003901>] exit_to_usermode_loop+0xf1/0x1a0 kernel/arch/x86/entry/common.c:247\n [<     inline     >] prepare_exit_to_usermode kernel/arch/x86/entry/common.c:282\n [<ffffffff810062ef>] syscall_return_slowpath+0x19f/0x210 kernel/arch/x86/entry/common.c:344\n [<ffffffff85d88022>] int_ret_from_sys_call+0x25/0x9f kernel/arch/x86/entry/entry_64.S:281\nMemory state around the buggy address:\n ffff880064e21680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff880064e21700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n>ffff880064e21780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                                                       ^\n ffff880064e21800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff880064e21880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n==================================================================\n\nBug:28979703\n\nFixes: 273ec51dd7ce (\"net: ppp_generic - introduce net-namespace functionality v2\")\nReported-by: Baozeng Ding <sploving1@gmail.com>\nSigned-off-by: Guillaume Nault <g.nault@alphalink.fr>\nReviewed-by: Cyrill Gorcunov <gorcunov@openvz.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n(cherry picked from commit 1f461dcdd296eecedaffffc6bae2bfa90bd7eb89)\n\nChange-Id: Ib5a54fc1814b96ce6ebefcc6f63dfa92880503c0","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/a3b998c722e135c234db5f984b572236527f364b"},{"sha":"5bb7c78a4ea18fe5bde3d801bc62148c24e98e07","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"UPSTREAM: udp: fix behavior of wrong checksums\n\nWe have two problems in UDP stack related to bogus checksums :\n\n1) We return -EAGAIN to application even if receive queue is not empty.\n   This breaks applications using edge trigger epoll()\n\n2) Under UDP flood, we can loop forever without yielding to other\n   processes, potentially hanging the host, especially on non SMP.\n\nThis patch is an attempt to make things better.\n\nWe might in the future add extra support for rt applications\nwanting to better control time spent doing a recv() in a hostile\nenvironment. For example we could validate checksums before queuing\npackets in socket receive queue.\n\nBug:29507402\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Willem de Bruijn <willemb@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n(cherry picked from commit beb39db59d14990e401e235faf66a6b9b31240b0)\n\nChange-Id: I0096f0660d8951184f3a3b49a78702924f766cea","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/5bb7c78a4ea18fe5bde3d801bc62148c24e98e07"},{"sha":"662e9d1b56b9acb1db6ec8b4a99cb1fa41bae3b1","author":{"name":"D.S. Ljungmark","email":"90b90c9ed2527ed6116e074badaa5dbbc994f848@modio.se"},"message":"UPSTREAM: ipv6: Don't reduce hop limit for an interface\n\nA local route may have a lower hop_limit set than global routes do.\n\nRFC 3756, Section 4.2.7, \"Parameter Spoofing\"\n\n>   1.  The attacker includes a Current Hop Limit of one or another small\n>       number which the attacker knows will cause legitimate packets to\n>       be dropped before they reach their destination.\n\n>   As an example, one possible approach to mitigate this threat is to\n>   ignore very small hop limits.  The nodes could implement a\n>   configurable minimum hop limit, and ignore attempts to set it below\n>   said limit.\n\nBug: 29409847\n\nSigned-off-by: D.S. Ljungmark <ljungmark@modio.se>\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n(cherry picked from commit 6fd99094de2b83d1d4c8457f2c83483b2828e75a)\n\nChange-Id: I24ee5723e4bcb3fbdbf4308531ab58e9ff215e82","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/662e9d1b56b9acb1db6ec8b4a99cb1fa41bae3b1"},{"sha":"0a5929a7194755f1cacfc5d5a249db03f428ef45","author":{"name":"Yueyao (Nathan) Zhu","email":"71687de50d3bae713a1b948ffc376a1195ddea07@google.com"},"message":"BACKPORT: KEYS: potential uninitialized variable\n\nBug: 29823941\n\nIf __key_link_begin() failed then \"edit\" would be uninitialized.  I've\nadded a check to fix that.\n\nThis allows a random user to crash the kernel, though it's quite\ndifficult to achieve.  There are three ways it can be done as the user\nwould have to cause an error to occur in __key_link():\n\n (1) Cause the kernel to run out of memory.  In practice, this is difficult\n     to achieve without ENOMEM cropping up elsewhere and aborting the\n     attempt.\n\n (2) Revoke the destination keyring between the keyring ID being looked up\n     and it being tested for revocation.  In practice, this is difficult to\n     time correctly because the KEYCTL_REJECT function can only be used\n     from the request-key upcall process.  Further, users can only make use\n     of what's in /sbin/request-key.conf, though this does including a\n     rejection debugging test - which means that the destination keyring\n     has to be the caller's session keyring in practice.\n\n (3) Have just enough key quota available to create a key, a new session\n     keyring for the upcall and a link in the session keyring, but not then\n     sufficient quota to create a link in the nominated destination keyring\n     so that it fails with EDQUOT.\n\nThe bug can be triggered using option (3) above using something like the\nfollowing:\n\n\techo 80 >/proc/sys/kernel/keys/root_maxbytes\n\tkeyctl request2 user debug:fred negate @t\n\nThe above sets the quota to something much lower (80) to make the bug\neasier to trigger, but this is dependent on the system.  Note also that\nthe name of the keyring created contains a random number that may be\nbetween 1 and 10 characters in size, so may throw the test off by\nchanging the amount of quota used.\n\nAssuming the failure occurs, something like the following will be seen:\n\n\tkfree_debugcheck: out of range ptr 6b6b6b6b6b6b6b68h\n\t------------[ cut here ]------------\n\tkernel BUG at ../mm/slab.c:2821!\n\t...\n\tRIP: 0010:[<ffffffff811600f9>] kfree_debugcheck+0x20/0x25\n\tRSP: 0018:ffff8804014a7de8  EFLAGS: 00010092\n\tRAX: 0000000000000034 RBX: 6b6b6b6b6b6b6b68 RCX: 0000000000000000\n\tRDX: 0000000000040001 RSI: 00000000000000f6 RDI: 0000000000000300\n\tRBP: ffff8804014a7df0 R08: 0000000000000001 R09: 0000000000000000\n\tR10: ffff8804014a7e68 R11: 0000000000000054 R12: 0000000000000202\n\tR13: ffffffff81318a66 R14: 0000000000000000 R15: 0000000000000001\n\t...\n\tCall Trace:\n\t  kfree+0xde/0x1bc\n\t  assoc_array_cancel_edit+0x1f/0x36\n\t  __key_link_end+0x55/0x63\n\t  key_reject_and_link+0x124/0x155\n\t  keyctl_reject_key+0xb6/0xe0\n\t  keyctl_negate_key+0x10/0x12\n\t  SyS_keyctl+0x9f/0xe7\n\t  do_syscall_64+0x63/0x13a\n\t  entry_SYSCALL64_slow_path+0x25/0x25\n\nFixes: f70e2e06196a ('KEYS: Do preallocation for __key_link()')\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\ncc: stable@vger.kernel.org\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n\n(cherry picked from commit 38327424b40bcebe2de92d07312c89360ac9229a)\n\nChange-Id: Id5227d10418d076c4e2a2e264d6e067efdfc4866","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/0a5929a7194755f1cacfc5d5a249db03f428ef45"},{"sha":"77ce241f4cd511f73f6b3324d0428d4bc599537a","author":{"name":"Yueyao (Nathan) Zhu","email":"71687de50d3bae713a1b948ffc376a1195ddea07@google.com"},"message":"BACKPORT: cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind\n\nBug: 28744625\n\nusbnet_link_change will call schedule_work and should be\navoided if bind is failing. Otherwise we will end up with\nscheduled work referring to a netdev which has gone away.\n\nInstead of making the call conditional, we can just defer\nit to usbnet_probe, using the driver_info flag made for\nthis purpose.\n\n(cherry picked from commit 4d06dd537f95683aba3651098ae288b7cbff8274)\n\nChange-Id: Ifdaef6225c90a5b7185e37619f4a68d6aebbeb5f","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/77ce241f4cd511f73f6b3324d0428d4bc599537a"},{"sha":"ca6a813217580509998d12344651bf02e13972ab","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"UPSTREAM: netfilter: x_tables: make sure e->next_offset covers remaining blob size\n\nOtherwise this function may read data beyond the ruleset blob.\n\nBug: 29637687\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\n(cherry picked from commit 6e94e0cfb0887e4013b3b930fa6ab1fe6bb6ba91)\n\nChange-Id: I8e5e01af575991c4648633f64a1142915a6a12aa","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/ca6a813217580509998d12344651bf02e13972ab"},{"sha":"6cb1c81da5fe1493c54f7fc0ff91ca3f12caf961","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"BACKPORT: netfilter: x_tables: validate e->target_offset early\n\n(cherry picked from commit bdf533de6968e9686df777dc178486f600c6e617)\n\nWe should check that e->target_offset is sane before\nmark_source_chains gets called since it will fetch the target entry\nfor loop detection.\n\nBug: 29637687\n\nChange-Id: Ida3d7055b4905cf4c18550f3989f529a8ff5e8a9\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Mekala Natarajan <mnatarajan@google.com>","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/6cb1c81da5fe1493c54f7fc0ff91ca3f12caf961"},{"sha":"e76614baa9e8afc5faed0c285b9312af55c2885a","author":{"name":"Biswajit Paul","email":"7ee5649c8de55a61a3bbcbc7dcde16c04b2f65da@codeaurora.org"},"message":"msm: camera: Fix memory read by adding bounds check\n\nAdds bound check on reg_cfg_cmd->u.dmi_info.hi_tbl_offset.\n\nIOCTL VIDIOC_MSM_VFE_REG_CFG uses usersupplied value without\nperforming bounds check for following cmd_type.\nVFE_READ_DMI_16BIT\nVFE_READ_DMI_32BIT\nVFE_READ_DMI_64BIT\n\nBug: 28815326\nCRs-Fixed: 1034641\nChange-Id: I554c45ef3a172f5b5891b67a7e8e7a1f3f3882ed\nSigned-off-by: Trishansh Bhardwaj <tbhardwa@codeaurora.org>\nSigned-off-by: Biswajit Paul <biswajitpaul@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/e76614baa9e8afc5faed0c285b9312af55c2885a"},{"sha":"9f9a2753e0500b0f91a7ab801e5e66a5059a8db3","author":{"name":"Biswajit Paul","email":"7ee5649c8de55a61a3bbcbc7dcde16c04b2f65da@codeaurora.org"},"message":"msm: ipa: fix potential race condition ioctls\n\nThere are numerous potential race condition\nioctls in the IPA driver. The fix is to add\ncheck wherever it copies arguments from\nuser-space memory and process.\n\nBug: 28919863\nCRs-Fixed: 1037897\nChange-Id: I5a440f89153518507acdf5dad42625503732e59a\nSigned-off-by: Skylar Chang <chiaweic@codeaurora.org>\nSigned-off-by: Biswajit Paul <biswajitpaul@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/9f9a2753e0500b0f91a7ab801e5e66a5059a8db3"},{"sha":"c080885c15add03f31ab920ba85e107ff6d8c0c2","author":{"name":"Nick Desaulniers","email":"b951273a67bf33267cd4dff69171cdef4e5efbe7@google.com"},"message":"fs: ext4: disable support for fallocate FALLOC_FL_PUNCH_HOLE\n\nBug: 28760453\nChange-Id: I019c2de559db9e4b95860ab852211b456d78c4ca\nSigned-off-by: Nick Desaulniers <ndesaulniers@google.com>","distinct":true,"url":"https://api.github.com/repos/purity-devices/android_kernel_huawei_angler/commits/c080885c15add03f31ab920ba85e107ff6d8c0c2"}]}
{"actor":{"display_login":"AndroidRul3z"}}