{"push_id":1281787940,"size":52,"distinct_size":52,"ref":"refs/heads/caf/3.10/LA.BR.1.3.3.c3","head":"2769c6cf6e40580eaf0a714581dc845ac79a2419","before":"5d9a1748b13e859222481193683ddd590f7b3bf5","commits":[{"sha":"af874097a459c5614d592d85500df6f492e540db","author":{"name":"Sunil Khatri","email":"c2fa09c6a63ee27656efbed7bd5e770f84d009d0@codeaurora.org"},"message":"msm: kgsl: Defer adding the mem entry to a process\n\nIf we add the mem entry pointer in the process idr and rb tree\ntoo early, other threads can do operations on the entry by\nguessing the ID or GPU address before the object gets returned\nby the creating operation.\n\nAllocate an ID for the object but don't assign the pointer until\nright before the creating function returns ensuring that another\noperation can't access it until it is ready.\n\nCRs-Fixed: 1002974\nChange-Id: Ic0dedbadc0dd2125bd2a7bcc152972c0555e07f8\nSigned-off-by: Jordan Crouse <jcrouse@codeaurora.org>\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/af874097a459c5614d592d85500df6f492e540db"},{"sha":"0e13de84697687ded0df006a22a91f97ffcf0f6b","author":{"name":"Mohamad Ayyash","email":"a63011e6db47c5624401b2ef01e42a84436c0cfe@google.com"},"message":"Replace %p with %pK to prevent leaking kernel address\n\nBUG: 27532522\nChange-Id: Ic0710a9a8cfc682acd88ecf3bbfeece2d798c4a4\nSigned-off-by: Mohamad Ayyash <mkayyash@google.com>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/0e13de84697687ded0df006a22a91f97ffcf0f6b"},{"sha":"1245f5d4a22a0e11af0820393baa75b1c2023533","author":{"name":"Arun Kumar Neelakantam","email":"c59c89ba80b317cf4f8ef53be86984ce5725515f@codeaurora.org"},"message":"net: ipc_router: fix leak of kernel memory to userspace\n\nThe service info structure is allocated with uninitialized memory for the\nmax number of services and returns the complete structure to the usersapce\nresulting in the information leak if lookup operation finds less number of\nservices than the requested number.\n\nCheck the minimum of requested and available services and copy the minimum\ninformation to the user-space.\n\nCRs-Fixed: 965934\nChange-Id: Ic97f875855fdc6440c1db1d8d0338ee8b03a9d0a\nSigned-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/1245f5d4a22a0e11af0820393baa75b1c2023533"},{"sha":"fb18a9af81eac51d7e2e322572b1546d690657ee","author":{"name":"Divya Ponnusamy","email":"499583450a0afa8f7b400d046a2396e658a503cf@codeaurora.org"},"message":"msm: kgsl: Avoid race condition in ioctl_syncsource_destroy\n\nIf the ioctl syncsource_destroy is accessed by parallel\nthreads, where the spinlock is acquired by threads after\ngetting syncsource, then the simultaneous processes try\nto remove the already destroyed syncsource->refcount by\nthe first thread that acquires this spinlock. This leads\nto race condition while removing syncsource->idr.\n\nAvoid separate lock inside getting syncsource, instead\nacquire spinlock before we get the syncsource in\ndestroy ioctl so that the threads access the spinlock\nand operate on syncsource without use-after-free issue.\n\nChange-Id: I6add3800c40cd09f6e6e0cf2720e69059bd83cbc\nSigned-off-by: Divya Ponnusamy <pdivya@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/fb18a9af81eac51d7e2e322572b1546d690657ee"},{"sha":"19ea812cf2c03da66f946ab4e8b7c5db6e98898a","author":{"name":"Karthikeyan Ramasubramanian","email":"f8c024263b29fe33b9929f0b5fb3a166c82f9fa1@codeaurora.org"},"message":"net: ipc_router: Bind only a client port as control port\n\nIPC Router binds any port as a control port and moves it from the client\nport list to control port list. Misbehaving clients can exploit this\nincorrect behavior.\n\nIPC Router to check if the port is a client port before binding it as a\ncontrol port.\n\nCRs-Fixed: 974577\nChange-Id: I9f189b76967d5f85750218a7cb6537d187a69663\nSigned-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/19ea812cf2c03da66f946ab4e8b7c5db6e98898a"},{"sha":"5d9629ce841b0769d37a780845c5daafbfda41f7","author":{"name":"Tarun Karra","email":"2510a0714f96c923ea81ac473307af04ae122ae5@codeaurora.org"},"message":"msm: kgsl: verify user memory permissions before mapping to GPU driver\n\nFor user memory of type KGSL_USER_MEM_TYPE_ADDR mapped to GPU driver\nverify permissions and map GPU permissions same as CPU permissions.\nIf elevated permissions are requested return an error to prevent\nprivilege escalation. Without this check user could map readonly\nmemory into GPU driver as readwrite and gain elevated privilege.\n\nWrite permissions check is currently inverted causing readonly\nuser pages to be mapped as readwrite in GPU driver. Fix this\ncheck to map readonly pages as readonly.\n\nCRs-Fixed: 988993\nChange-Id: I0e097d7e4e4c414c0849e33bcc61a26fb94291ad\nSigned-off-by: Tarun Karra <tkarra@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/5d9629ce841b0769d37a780845c5daafbfda41f7"},{"sha":"84ac7bde07bf80ecc8c1591d361b13b191acc8f2","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"msm: kgsl: Avoid race condition in ioctl_syncsource_destroy\"","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/84ac7bde07bf80ecc8c1591d361b13b191acc8f2"},{"sha":"e035ecef30279036dcfd513fc8bf880f86047ef6","author":{"name":"Sunil Khatri","email":"c2fa09c6a63ee27656efbed7bd5e770f84d009d0@codeaurora.org"},"message":"ashmem: Validate ashmem memory with fops pointer\n\nValidate the ashmem memory entry against f_op pointer\nrather then comparing its name with path of the dentry.\n\nThis is to avoid any invalid access to ashmem area in cases\nwhere some one deliberately set the dentry name to /ashmem.\n\nChange-Id: I74e50cd244f68cb13009cf2355e528485f4de34b\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/e035ecef30279036dcfd513fc8bf880f86047ef6"},{"sha":"e2137441e889705e4517d26422c2115ab66f4dbc","author":{"name":"Weiyin Jiang","email":"25745fd6cb0247e11bcb32583c6893d37cc23b30@codeaurora.org"},"message":"ASoC: msm: audio-effects: fix stack overread and heap overwrite\n\nFix overwrite of updt_params allocated in heap, and stack overread\nwhere param pointer is passed from user space.\n\nCRs-Fixed: 989628\nChange-Id: Ida8bdb7da2fcb97023dce3b6eafe4b899a51cb66\nSigned-off-by: Weiyin Jiang <wjiang@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/e2137441e889705e4517d26422c2115ab66f4dbc"},{"sha":"723655f449997a859c0cba5e70daa3dbbf2549f5","author":{"name":"Veera Sundaram Sankaran","email":"3287f11dd36ba2848f5a783a91dbc39d6db8456d@codeaurora.org"},"message":"msm: mdss: fix possible out-of-bounds and overflow issue in mdp debugfs\n\nThere are few cases where the count argument passed by the user\nspace is not validated, which can potentially lead to out of\nbounds or overflow issues. In some cases, kernel might copy\nmore data than what is requested. Add necessary checks to\navoid such cases.\n\nChange-Id: Ifa42fbd475665a0ca581c907ce5432584ea0e7ed\nSigned-off-by: Veera Sundaram Sankaran <veeras@codeaurora.org>\nSigned-off-by: Raghavendra Ambadas <rambad@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/723655f449997a859c0cba5e70daa3dbbf2549f5"},{"sha":"a739e3134296248325f941bc172c03a0515b1a46","author":{"name":"Arun KS","email":"840b6f7015f61debedeb9891b3e48dc51a152fd0@codeaurora.org"},"message":"msm: perf: Do not allocate new hw_event if event is duplicate.\n\nDuring a perf_event_enable, kernel/events/core.c calls pmu->add() which\nis platform implementation(arch/arm/kernel/perf_event.c). Due to the\nduplicate constraints, arch/arm/mach-msm/perf_event_msm_krait_l2.c\ndrivers marks the event as OFF but returns TRUE to perf_event.c which\ngoes ahead and allocates the hw_event and enables it.\n\nSince event is marked OFF, kernel events core will try to enable this event\nagain during next perf_event_enable. Which results in same event enabled\non multiple hw_events. But during the perf_release, event struct is freed\nand only one hw_event is released. This results in dereferencing the\ninvalid pointer and hence the crash.\n\nFix this by returning error in case of constraint event duplicate. Hence\navoiding the same event programmed on multiple hw event counters.\n\nChange-Id: Ia3360be027dfe87ac753191ffe7e0bc947e72455\nSigned-off-by: Arun KS <arunks@codeaurora.org>\nSigned-off-by: Chetan Ravindranath <cravin@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/a739e3134296248325f941bc172c03a0515b1a46"},{"sha":"81a6392d45d9b5e5160d6603dbf67efcd4cd9ee8","author":{"name":"Manu Gautam","email":"876e9847b0240db58d29900a57b080fdd1e2cc11@codeaurora.org"},"message":"usb: f_serial: Check for SMD data length in GSER_IOCTL\n\nIf user tries to send SMD data more than the driver\nbuffer can handle then fail the same and print\nerror message. This smd_write is exposed to userspace\nthrough ioctl using a misc device.\n\nChange-Id: Ie8a1c1c0799cd10cef512ad6b1e1e95001dd43b2\nSigned-off-by: Manu Gautam <mgautam@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/81a6392d45d9b5e5160d6603dbf67efcd4cd9ee8"},{"sha":"b642c8ef6cc89f2f8f039151e40b6e01f274648a","author":{"name":"Vijayavardhan Vennapusa","email":"fd1e89cda16e187a1514e87daf32db280e01223d@codeaurora.org"},"message":"USB: dwc3: debugfs: Add boundary check in dwc3_store_ep_num()\n\nUser can pass arguments as part of write to requests and endpoint number\nwill be calculated based on the arguments. There is a chance that driver\ncan access ep structue that is not allocated due to invalid arguments\npassed by user. Hence fix the issue by having check and return error in\ncase of invalid arguments.\n\nChange-Id: I060ea878b55ce0f9983b91c50e58718c8a2c2fa1\nSigned-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/b642c8ef6cc89f2f8f039151e40b6e01f274648a"},{"sha":"a43a9bf53e1b599d800731b74060d8f25134bd0a","author":{"name":"Weiyin Jiang","email":"25745fd6cb0247e11bcb32583c6893d37cc23b30@codeaurora.org"},"message":"ASoC: msm: audio-effects: misc fixes in h/w accelerated effect\n\nAdding memory copy size check and integer overflow check in h/w\naccelerated effect driver.\n\nChange-Id: I17d4cc0a38770f0c5067fa8047cd63e7bf085e48\nCRs-Fixed: 1006609\nSigned-off-by: Weiyin Jiang <wjiang@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/a43a9bf53e1b599d800731b74060d8f25134bd0a"},{"sha":"b8c0c17de7f1cd36985bc25f72f51a0dab689ba8","author":{"name":"Ashish Jain","email":"3e10641df9807bff93b1e25d356444d11eb9880f@codeaurora.org"},"message":"ASoC: msm: qdsp6v2: DAP: Fix buffer overflow\n\nAdd check to avoid out of bound access.\nCheck return value of get_user api.\n\nCRs-Fixed: 997025\nChange-Id: Ibbace116ac206007fa1928555838285304737737\nSigned-off-by: Ashish Jain <ashishj@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/b8c0c17de7f1cd36985bc25f72f51a0dab689ba8"},{"sha":"8e8176879ee459ac510d6a22858a0ccc500b1272","author":{"name":"Srinivasarao P","email":"5838be2f68866147a6b98dc0567ce3ec89ebe5fc@codeaurora.org"},"message":"perf: duplicate deletion of perf event\n\na malicious app can open a perf event with constraint_duplicate\nbit set, disable the event, and close the fd.  On closing the fd,\nthe perf_release() modification causes the kernel to clean up\nthe event as if it still were enabled, leading to the event\nbeing removed from a list twice.\n\nCRs-Fixed: 977563\nChange-Id: I5fbec3722407d2f3d0ff0d9f7097c5889e31fd62\nSigned-off-by: Srinivasarao P <spathi@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/8e8176879ee459ac510d6a22858a0ccc500b1272"},{"sha":"f31e1e265f9e379d8bf03e53c9cc7fc7d9c91fb0","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"msm: kgsl: verify user memory permissions before mapping to GPU driver\"","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/f31e1e265f9e379d8bf03e53c9cc7fc7d9c91fb0"},{"sha":"ce43aa4668d0a16ab2c234bb34cb50dd37c59e74","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"ASoC: msm: audio-effects: fix stack overread and heap overwrite\"","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/ce43aa4668d0a16ab2c234bb34cb50dd37c59e74"},{"sha":"b3e55591bb96ab930a5cf8e463afd9796ef49903","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"ASoC: msm: qdsp6v2: DAP: Fix buffer overflow\"","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/b3e55591bb96ab930a5cf8e463afd9796ef49903"},{"sha":"42396fdbaf5bb95c05a1629f249f43900cd02dfa","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"msm: mdss: fix possible out-of-bounds and overflow issue in mdp debugfs\"","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/42396fdbaf5bb95c05a1629f249f43900cd02dfa"}]}
{"actor":{"display_login":"dianlujitao"}}