{"push_id":1278781253,"size":20,"distinct_size":0,"ref":"refs/heads/caf/3.10/caf/aosp-common/android-4.4","head":"4547c0f93518197834f7fc11c6558b566b7e14c8","before":"aa3cda16a57e73e9fc269e1de1eb3c35f3f0ed20","commits":[{"sha":"1a0cf8ace145843e5d2af961078e0ee4eccf3588","author":{"name":"Winter Wang","email":"7f6b4eab9aaacc1d9fdcf42ec8b7abaf69224bee@nxp.com"},"message":"UPSTREAM: usb: gadget: configfs: add mutex lock before unregister gadget\n\nThere may be a race condition if f_fs calls unregister_gadget_item in\nffs_closed() when unregister_gadget is called by UDC store at the same time.\nthis leads to a kernel NULL pointer dereference:\n\n[  310.644928] Unable to handle kernel NULL pointer dereference at virtual address 00000004\n[  310.645053] init: Service 'adbd' is being killed...\n[  310.658938] pgd = c9528000\n[  310.662515] [00000004] *pgd=19451831, *pte=00000000, *ppte=00000000\n[  310.669702] Internal error: Oops: 817 [#1] PREEMPT SMP ARM\n[  310.675211] Modules linked in:\n[  310.678294] CPU: 0 PID: 1537 Comm: ->transport Not tainted 4.1.15-03725-g793404c #2\n[  310.685958] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)\n[  310.692493] task: c8e24200 ti: c945e000 task.ti: c945e000\n[  310.697911] PC is at usb_gadget_unregister_driver+0xb4/0xd0\n[  310.703502] LR is at __mutex_lock_slowpath+0x10c/0x16c\n[  310.708648] pc : [<c075efc0>]    lr : [<c0bfb0bc>]    psr: 600f0113\n<snip..>\n[  311.565585] [<c075efc0>] (usb_gadget_unregister_driver) from [<c075e2b8>] (unregister_gadget_item+0x1c/0x34)\n[  311.575426] [<c075e2b8>] (unregister_gadget_item) from [<c076fcc8>] (ffs_closed+0x8c/0x9c)\n[  311.583702] [<c076fcc8>] (ffs_closed) from [<c07736b8>] (ffs_data_reset+0xc/0xa0)\n[  311.591194] [<c07736b8>] (ffs_data_reset) from [<c07738ac>] (ffs_data_closed+0x90/0xd0)\n[  311.599208] [<c07738ac>] (ffs_data_closed) from [<c07738f8>] (ffs_ep0_release+0xc/0x14)\n[  311.607224] [<c07738f8>] (ffs_ep0_release) from [<c023e030>] (__fput+0x80/0x1d0)\n[  311.614635] [<c023e030>] (__fput) from [<c014e688>] (task_work_run+0xb0/0xe8)\n[  311.621788] [<c014e688>] (task_work_run) from [<c010afdc>] (do_work_pending+0x7c/0xa4)\n[  311.629718] [<c010afdc>] (do_work_pending) from [<c010770c>] (work_pending+0xc/0x20)\n\nfor functions using functionFS, i.e. android adbd will close /dev/usb-ffs/adb/ep0\nwhen usb IO thread fails, but switch adb from on to off also triggers write\n\"none\" > UDC. These 2 operations both call unregister_gadget, which will lead\nto the panic above.\n\nadd a mutex before calling unregister_gadget for api used in f_fs.\n\nSigned-off-by: Winter Wang <wente.wang@nxp.com>\nSigned-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/1a0cf8ace145843e5d2af961078e0ee4eccf3588"},{"sha":"ca9b7b070b5833b9a7f4282df8a8484e5498630f","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"UPSTREAM: tcp: make challenge acks less predictable\n\n(cherry picked from commit 75ff39ccc1bd5d3c455b6822ab09e533c551f758)\n\nYue Cao claims that current host rate limiting of challenge ACKS\n(RFC 5961) could leak enough information to allow a patient attacker\nto hijack TCP sessions. He will soon provide details in an academic\npaper.\n\nThis patch increases the default limit from 100 to 1000, and adds\nsome randomization so that the attacker can no longer hijack\nsessions without spending a considerable amount of probes.\n\nBased on initial analysis and patch from Linus.\n\nNote that we also have per socket rate limiting, so it is tempting\nto remove the host limit in the future.\n\nv2: randomize the count of challenge acks per second, not the period.\n\nFixes: 282f23c6ee34 (\"tcp: implement RFC 5961 3.2\")\nReported-by: Yue Cao <ycao009@ucr.edu>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSuggested-by: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Yuchung Cheng <ycheng@google.com>\nCc: Neal Cardwell <ncardwell@google.com>\nAcked-by: Neal Cardwell <ncardwell@google.com>\nAcked-by: Yuchung Cheng <ycheng@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nChange-Id: Ib46ba66f5e4a5a7c81bfccd7b0aa83c3d9e1b3bb\nBug: 30809774","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/ca9b7b070b5833b9a7f4282df8a8484e5498630f"},{"sha":"a20900c4aa3596f6318568a662c71e0943b2bbd9","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"UPSTREAM: ALSA: timer: Fix race among timer ioctls\n\n(cherry picked from commit af368027a49a751d6ff4ee9e3f9961f35bb4fede)\n\nALSA timer ioctls have an open race and this may lead to a\nuse-after-free of timer instance object.  A simplistic fix is to make\neach ioctl exclusive.  We have already tread_sem for controlling the\ntread, and extend this as a global mutex to be applied to each ioctl.\n\nThe downside is, of course, the worse concurrency.  But these ioctls\naren't to be parallel accessible, in anyway, so it should be fine to\nserialize there.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nChange-Id: I1ac52f1cba5e7408fd88c8fc1c30ca2e83967ebb\nBug: 28694392","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/a20900c4aa3596f6318568a662c71e0943b2bbd9"},{"sha":"50acf9e6e34a14148d6a8c715c79b1cb013f4f3d","author":{"name":"Rainer Weikusat","email":"83eef5bb46142d818cc9ec09a206a7f5abed4070@mobileactivedefense.com"},"message":"UPSTREAM: af_unix: Guard against other == sk in unix_dgram_sendmsg\n\n(cherry picked from commit a5527dda344fff0514b7989ef7a755729769daa1)\n\nThe unix_dgram_sendmsg routine use the following test\n\nif (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {\n\nto determine if sk and other are in an n:1 association (either\nestablished via connect or by using sendto to send messages to an\nunrelated socket identified by address). This isn't correct as the\nspecified address could have been bound to the sending socket itself or\nbecause this socket could have been connected to itself by the time of\nthe unix_peer_get but disconnected before the unix_state_lock(other). In\nboth cases, the if-block would be entered despite other == sk which\nmight either block the sender unintentionally or lead to trying to unlock\nthe same spin lock twice for a non-blocking send. Add a other != sk\ncheck to guard against this.\n\nFixes: 7d267278a9ec (\"unix: avoid use-after-free in ep_remove_wait_queue\")\nReported-By: Philipp Hahn <pmhahn@pmhahn.de>\nSigned-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com>\nTested-by: Philipp Hahn <pmhahn@pmhahn.de>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n\nChange-Id: I4ebef6a390df3487903b166b837e34c653e01cb2\nSigned-off-by: Amit Pundir <amit.pundir@linaro.org>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/50acf9e6e34a14148d6a8c715c79b1cb013f4f3d"},{"sha":"8d525c512280bb7d8218fd59c04de985b1886eca","author":{"name":"Mohan Srinivasan","email":"76ae3671df82656714c80c28fc330098a2a73865@google.com"},"message":"Android: MMC/UFS IO Latency Histograms.\n\nThis patch adds a new sysfs node (latency_hist) and reports IO\n(svc time) latency histograms. Disabled by default, can be enabled\nby echoing 0 into latency_hist, stats can be cleared by writing 2\ninto latency_hist.\n\nBug: 30677035\nChange-Id: I625938135ea33e6e87cf6af1fc7edc136d8b4b32\nSigned-off-by: Mohan Srinivasan <srmohan@google.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/8d525c512280bb7d8218fd59c04de985b1886eca"},{"sha":"1c6df5fdcb19a03fb6b652090b4b968a6377fb14","author":{"name":"Mohamad Ayyash","email":"a63011e6db47c5624401b2ef01e42a84436c0cfe@google.com"},"message":"Revert \"Android: MMC/UFS IO Latency Histograms.\"\n\nThis reverts commit 8d525c512280bb7d8218fd59c04de985b1886eca.\n\nChange-Id: I69350b98d9de9b1c9f591e03a90f133e328ba72a","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/1c6df5fdcb19a03fb6b652090b4b968a6377fb14"},{"sha":"8a58605e4661d18b4e09f1385fe22b1e83cd2cb6","author":{"name":"Badhri Jagan Sridharan","email":"cdd32e903b63821e79f87a1fa9b017fa31cbb189@google.com"},"message":"ANDROID: dm: android-verity: Allow android-verity to be compiled as an independent module\n\nExports the device mapper callbacks of linear and dm-verity-target\nmethods.\n\nSigned-off-by: Badhri Jagan Sridharan <Badhri@google.com>\nChange-Id: I0358be0615c431dce3cc78575aaac4ccfe3aacd7","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/8a58605e4661d18b4e09f1385fe22b1e83cd2cb6"},{"sha":"8f5bf76871c346bfc4fed9fcf85eff79948aade2","author":{"name":"Hannes Frederic Sowa","email":"384333b8ca49bccf53afadd43ca0007cb9efc1df@stressinduktion.org"},"message":"ipv6: fix endianness error in icmpv6_err\n\nIPv6 ping socket error handler doesn't correctly convert the new 32 bit\nmtu to host endianness before using.\n\n[Cherry-pick of net dcb94b88c09ce82a80e188d49bcffdc83ba215a6]\n\nBug: 29370996\nChange-Id: Iea0ca79f16c2a1366d82b3b0a3097093d18da8b7\nCc: Lorenzo Colitti <lorenzo@google.com>\nFixes: 6d0bfe22611602f (\"net: ipv6: Add IPv6 support to the ping socket.\")\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nAcked-by: Lorenzo Colitti <lorenzo@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/8f5bf76871c346bfc4fed9fcf85eff79948aade2"},{"sha":"75c591ea5787a59e69c8d2b803a7f4f0c29ec34e","author":{"name":"Lorenzo Colitti","email":"bb03c7a1072f7993eaae5ac54ef7bc06e4588478@google.com"},"message":"net: ipv6: Fix ping to link-local addresses.\n\nping_v6_sendmsg does not set flowi6_oif in response to\nsin6_scope_id or sk_bound_dev_if, so it is not possible to use\nthese APIs to ping an IPv6 address on a different interface.\nInstead, it sets flowi6_iif, which is incorrect but harmless.\n\nStop setting flowi6_iif, and support various ways of setting oif\nin the same priority order used by udpv6_sendmsg.\n\n[Backport of net 5e457896986e16c440c97bb94b9ccd95dd157292]\n\nBug: 29370996\nChange-Id: Ibe1b9434c00ed96f1e30acb110734c6570b087b8\nTested: https://android-review.googlesource.com/#/c/254470/\nSigned-off-by: Lorenzo Colitti <lorenzo@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/75c591ea5787a59e69c8d2b803a7f4f0c29ec34e"},{"sha":"3228c5eb7af2b4cb981706b88ed3c3e81ab8e80a","author":{"name":"Peter Zijlstra","email":"4d3106856cce90e8f40acc5180f60ddda3a23b6e@infradead.org"},"message":"RFC: FROMLIST: locking/percpu-rwsem: Optimize readers and reduce global impact\n\nCurrently the percpu-rwsem switches to (global) atomic ops while a\nwriter is waiting; which could be quite a while and slows down\nreleasing the readers.\n\nThis patch cures this problem by ordering the reader-state vs\nreader-count (see the comments in __percpu_down_read() and\npercpu_down_write()). This changes a global atomic op into a full\nmemory barrier, which doesn't have the global cacheline contention.\n\nThis also enables using the percpu-rwsem with rcu_sync disabled in order\nto bias the implementation differently, reducing the writer latency by\nadding some cost to readers.\n\nMailing-list-URL: https://lkml.org/lkml/2016/8/9/181\nCc: Paul McKenney <paulmck@linux.vnet.ibm.com>\nReviewed-by: Oleg Nesterov <oleg@redhat.com>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\n[jstultz: Backported to 4.4]\nChange-Id: I8ea04b4dca2ec36f1c2469eccafde1423490572f\nSigned-off-by: John Stultz <john.stultz@linaro.org>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/3228c5eb7af2b4cb981706b88ed3c3e81ab8e80a"},{"sha":"0c3240a1ef2e840aaa17f593326e3642bc857aa7","author":{"name":"Peter Zijlstra","email":"4d3106856cce90e8f40acc5180f60ddda3a23b6e@infradead.org"},"message":"RFC: FROMLIST: cgroup: avoid synchronize_sched() in __cgroup_procs_write()\n\nThe current percpu-rwsem read side is entirely free of serializing insns\nat the cost of having a synchronize_sched() in the write path.\n\nThe latency of the synchronize_sched() is too high for cgroups. The\ncommit 1ed1328792ff talks about the write path being a fairly cold path\nbut this is not the case for Android which moves task to the foreground\ncgroup and back around binder IPC calls from foreground processes to\nbackground processes, so it is significantly hotter than human initiated\noperations.\n\nSwitch cgroup_threadgroup_rwsem into the slow mode for now to avoid the\nproblem, hopefully it should not be that slow after another commit\n80127a39681b (\"locking/percpu-rwsem: Optimize readers and reduce global\nimpact\").\n\nWe could just add rcu_sync_enter() into cgroup_init() but we do not want\nanother synchronize_sched() at boot time, so this patch adds the new helper\nwhich doesn't block but currently can only be called before the first use.\n\nCc: Tejun Heo <tj@kernel.org>\nCc: Paul McKenney <paulmck@linux.vnet.ibm.com>\nReported-by: John Stultz <john.stultz@linaro.org>\nReported-by: Dmitry Shmidt <dimitrysh@google.com>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nSigned-off-by: Oleg Nesterov <oleg@redhat.com>\n[jstultz: backported to 4.4]\nChange-Id: I34aa9c394d3052779b56976693e96d861bd255f2\nMailing-list-URL: https://lkml.org/lkml/2016/8/11/557\nSigned-off-by: John Stultz <john.stultz@linaro.org>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/0c3240a1ef2e840aaa17f593326e3642bc857aa7"},{"sha":"e91f1799ff2cc3883907b5f3e141507f9716ff0e","author":{"name":"Balbir Singh","email":"daca7b412031fb0e95d58c31aac905f736b2d1c1@gmail.com"},"message":"RFC: FROMLIST: cgroup: reduce read locked section of cgroup_threadgroup_rwsem during fork\n\ncgroup_threadgroup_rwsem is acquired in read mode during process exit\nand fork.  It is also grabbed in write mode during\n__cgroups_proc_write().  I've recently run into a scenario with lots\nof memory pressure and OOM and I am beginning to see\n\nsystemd\n\n __switch_to+0x1f8/0x350\n __schedule+0x30c/0x990\n schedule+0x48/0xc0\n percpu_down_write+0x114/0x170\n __cgroup_procs_write.isra.12+0xb8/0x3c0\n cgroup_file_write+0x74/0x1a0\n kernfs_fop_write+0x188/0x200\n __vfs_write+0x6c/0xe0\n vfs_write+0xc0/0x230\n SyS_write+0x6c/0x110\n system_call+0x38/0xb4\n\nThis thread is waiting on the reader of cgroup_threadgroup_rwsem to\nexit.  The reader itself is under memory pressure and has gone into\nreclaim after fork. There are times the reader also ends up waiting on\noom_lock as well.\n\n __switch_to+0x1f8/0x350\n __schedule+0x30c/0x990\n schedule+0x48/0xc0\n jbd2_log_wait_commit+0xd4/0x180\n ext4_evict_inode+0x88/0x5c0\n evict+0xf8/0x2a0\n dispose_list+0x50/0x80\n prune_icache_sb+0x6c/0x90\n super_cache_scan+0x190/0x210\n shrink_slab.part.15+0x22c/0x4c0\n shrink_zone+0x288/0x3c0\n do_try_to_free_pages+0x1dc/0x590\n try_to_free_pages+0xdc/0x260\n __alloc_pages_nodemask+0x72c/0xc90\n alloc_pages_current+0xb4/0x1a0\n page_table_alloc+0xc0/0x170\n __pte_alloc+0x58/0x1f0\n copy_page_range+0x4ec/0x950\n copy_process.isra.5+0x15a0/0x1870\n _do_fork+0xa8/0x4b0\n ppc_clone+0x8/0xc\n\nIn the meanwhile, all processes exiting/forking are blocked almost\nstalling the system.\n\nThis patch moves the threadgroup_change_begin from before\ncgroup_fork() to just before cgroup_canfork().  There is no nee to\nworry about threadgroup changes till the task is actually added to the\nthreadgroup.  This avoids having to call reclaim with\ncgroup_threadgroup_rwsem held.\n\ntj: Subject and description edits.\n\nSigned-off-by: Balbir Singh <bsingharora@gmail.com>\nAcked-by: Zefan Li <lizefan@huawei.com>\nCc: Oleg Nesterov <oleg@redhat.com>\nCc: Andrew Morton <akpm@linux-foundation.org>\nCc: stable@vger.kernel.org # v4.2+\nSigned-off-by: Tejun Heo <tj@kernel.org>\n[jstultz: Cherry-picked from:\n git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git 568ac888215c7f]\nChange-Id: Ie8ece84fb613cf6a7b08cea1468473a8df2b9661\nSigned-off-by: John Stultz <john.stultz@linaro.org>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/e91f1799ff2cc3883907b5f3e141507f9716ff0e"},{"sha":"ba52437821164deacf9af90d559f2e3f4888ff28","author":{"name":"Jason Baron","email":"623d78bc3405eaae037ff64ede55814f5ac5c013@akamai.com"},"message":"BACKPORT: tcp: enable per-socket rate limiting of all 'challenge acks'\n\n(cherry picked from commit 083ae308280d13d187512b9babe3454342a7987e)\n\nThe per-socket rate limit for 'challenge acks' was introduced in the\ncontext of limiting ack loops:\n\ncommit f2b2c582e824 (\"tcp: mitigate ACK loops for connections as tcp_sock\")\n\nAnd I think it can be extended to rate limit all 'challenge acks' on a\nper-socket basis.\n\nSince we have the global tcp_challenge_ack_limit, this patch allows for\ntcp_challenge_ack_limit to be set to a large value and effectively rely on\nthe per-socket limit, or set tcp_challenge_ack_limit to a lower value and\nstill prevents a single connections from consuming the entire challenge ack\nquota.\n\nIt further moves in the direction of eliminating the global limit at some\npoint, as Eric Dumazet has suggested. This a follow-up to:\nSubject: tcp: make challenge acks less predictable\n\nCc: Eric Dumazet <edumazet@google.com>\nCc: David S. Miller <davem@davemloft.net>\nCc: Neal Cardwell <ncardwell@google.com>\nCc: Yuchung Cheng <ycheng@google.com>\nCc: Yue Cao <ycao009@ucr.edu>\nSigned-off-by: Jason Baron <jbaron@akamai.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n\nChange-Id: I622d5ae96e9387e775a0196c892d8d0e1a5564a7\nSigned-off-by: Amit Pundir <amit.pundir@linaro.org>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/ba52437821164deacf9af90d559f2e3f4888ff28"},{"sha":"258a8f519a47a2b3c0a42940182715fc0de690e7","author":{"name":"Badhri Jagan Sridharan","email":"cdd32e903b63821e79f87a1fa9b017fa31cbb189@google.com"},"message":"UPSTREAM: Input: powermate - fix oops with malicious USB descriptors\n\nThe powermate driver expects at least one valid USB endpoint in its\nprobe function.  If given malicious descriptors that specify 0 for\nthe number of endpoints, it will crash.  Validate the number of\nendpoints on the interface before using them.\n\nThe full report for this issue can be found here:\nhttp://seclists.org/bugtraq/2016/Mar/85\n\nBUG: 28242610\n\nReported-by: Ralf Spenneberg <ralf@spenneberg.net>\nSigned-off-by: Josh Boyer <jwboyer@fedoraproject.org>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Badhri Jagan Sridharan <Badhri@google.com>\nChange-Id: I1cb956a35f3bba73324240d5bd0a029f49d3c456","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/258a8f519a47a2b3c0a42940182715fc0de690e7"},{"sha":"125d90ca2fd862ecb119a085d95f813a6263d218","author":{"name":"Badhri Jagan Sridharan","email":"cdd32e903b63821e79f87a1fa9b017fa31cbb189@google.com"},"message":"UPSTREAM: USB: cypress_m8: add endpoint sanity check\n\ncommit c55aee1bf0e6b6feec8b2927b43f7a09a6d5f754 upstream.\n\nAn attack using missing endpoints exists.\n\nCVE-2016-3137\n\nBUG: 28242610\nSigned-off-by: Oliver Neukum <ONeukum@suse.com>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Badhri Jagan Sridharan <Badhri@google.com>\nChange-Id: I1cc7957a5924175d24f12fdc41162ece67c907e5","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/125d90ca2fd862ecb119a085d95f813a6263d218"},{"sha":"ee5c7a9739c6ddd0d54385c313b5d6f87652cd63","author":{"name":"Badhri Jagan Sridharan","email":"cdd32e903b63821e79f87a1fa9b017fa31cbb189@google.com"},"message":"UPSTREAM: USB: mct_u232: add sanity checking in probe\n\ncommit 4e9a0b05257f29cf4b75f3209243ed71614d062e upstream.\n\nAn attack using the lack of sanity checking in probe is known. This\npatch checks for the existence of a second port.\n\nCVE-2016-3136\nBUG: 28242610\nSigned-off-by: Oliver Neukum <ONeukum@suse.com>\n[johan: add error message ]\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nSigned-off-by: Badhri Jagan Sridharan <Badhri@google.com>\nChange-Id: I284ad648c2087c34a098d67e0cc6d948a568413c","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/ee5c7a9739c6ddd0d54385c313b5d6f87652cd63"},{"sha":"ae6790121ceb4608e1a1dec10e285c8d661463d5","author":{"name":"Badhri Jagan Sridharan","email":"cdd32e903b63821e79f87a1fa9b017fa31cbb189@google.com"},"message":"UPSTREAM: USB: usb_driver_claim_interface: add sanity checking\n\ncommit 0b818e3956fc1ad976bee791eadcbb3b5fec5bfd upstream.\n\nAttacks that trick drivers into passing a NULL pointer\nto usb_driver_claim_interface() using forged descriptors are\nknown. This thwarts them by sanity checking.\n\nBUG: 28242610\n\nSigned-off-by: Oliver Neukum <ONeukum@suse.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Badhri Jagan Sridharan <Badhri@google.com>\nChange-Id: Ib43ec5edb156985a9db941785a313f6801df092a","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/ae6790121ceb4608e1a1dec10e285c8d661463d5"},{"sha":"b24e99b3ae1e3860d374d0ed497a371100533e83","author":{"name":"Badhri Jagan Sridharan","email":"cdd32e903b63821e79f87a1fa9b017fa31cbb189@google.com"},"message":"UPSTREAM: USB: iowarrior: fix oops with malicious USB descriptors\n\ncommit 4ec0ef3a82125efc36173062a50624550a900ae0 upstream.\n\nThe iowarrior driver expects at least one valid endpoint.  If given\nmalicious descriptors that specify 0 for the number of endpoints,\nit will crash in the probe function.  Ensure there is at least\none endpoint on the interface before using it.\n\nThe full report of this issue can be found here:\nhttp://seclists.org/bugtraq/2016/Mar/87\n\nBUG: 28242610\n\nReported-by: Ralf Spenneberg <ralf@spenneberg.net>\nSigned-off-by: Josh Boyer <jwboyer@fedoraproject.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Badhri Jagan Sridharan <Badhri@google.com>\nChange-Id: If5161c23928e9ef77cb3359cba9b36622b1908df","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/b24e99b3ae1e3860d374d0ed497a371100533e83"},{"sha":"6087158f06e3cc66897cb4571cb673ac9fffb12d","author":{"name":"Badhri Jagan Sridharan","email":"cdd32e903b63821e79f87a1fa9b017fa31cbb189@google.com"},"message":"UPSTREAM: USB: cdc-acm: more sanity checking\n\ncommit 8835ba4a39cf53f705417b3b3a94eb067673f2c9 upstream.\n\nAn attack has become available which pretends to be a quirky\ndevice circumventing normal sanity checks and crashes the kernel\nby an insufficient number of interfaces. This patch adds a check\nto the code path for quirky devices.\n\nBUG: 28242610\n\nSigned-off-by: Oliver Neukum <ONeukum@suse.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Badhri Jagan Sridharan <Badhri@google.com>\nChange-Id: I9a5f7f3c704b65e866335054f470451fcfae9d1c","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/6087158f06e3cc66897cb4571cb673ac9fffb12d"},{"sha":"4547c0f93518197834f7fc11c6558b566b7e14c8","author":{"name":"Guenter Roeck","email":"7c621546fcd82a30ce1e07800fe6f19f4640b7e8@chromium.org"},"message":"ANDROID: rcu_sync: Export rcu_sync_lockdep_assert\n\nx86_64:allmodconfig fails to build with the following error.\n\nERROR: \"rcu_sync_lockdep_assert\" [kernel/locking/locktorture.ko] undefined!\n\nIntroduced by commit 3228c5eb7af2 (\"RFC: FROMLIST: locking/percpu-rwsem:\nOptimize readers and reduce global impact\"). The applied upstream version\nexports the missing symbol, so let's do the same.\n\nChange-Id: If4e516715c3415fe8c82090f287174857561550d\nFixes: 3228c5eb7af2 (\"RFC: FROMLIST: locking/percpu-rwsem: Optimize ...\")\nSigned-off-by: Guenter Roeck <groeck@chromium.org>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/4547c0f93518197834f7fc11c6558b566b7e14c8"}]}
{"actor":{"display_login":"Rashed97"}}