{"push_id":1248810112,"size":34,"distinct_size":34,"ref":"refs/heads/caf/aosp-new/android-msm-shamu-3.10-marshmallow-mr1","head":"41f1de6b3cf867f472bba80752d375cd9c6bfe4a","before":"8292fe595c99ccbcb5e73debdba21d5f1ad91ef6","commits":[{"sha":"3c8d6db74c1ff8ffa35dc2412ccb5b8a87ea2237","author":{"name":"Greg Kroah-Hartman","email":"4931344b09d7a7d3573e8b1ebec918e229ead9bf@google.com"},"message":"AIO: properly check iovec sizes\n\ncommit ff19ac8fb71e8a2bf07d61b959062998139c1104 upstream\n\nIn Linus's tree, the iovec code has been reworked massively, but in\nolder kernels the AIO layer should be checking this before passing the\nrequest on to other layers.\n\nMany thanks to Ben Hawkes of Google Project Zero for pointing out the\nissue.\n\nBug: 28588279\n\nReported-by: Ben Hawkes <hawkes@google.com>\nAcked-by: Benjamin LaHaise <bcrl@kvack.org>\nTested-by: Willy Tarreau <w@1wt.eu>\n[backported to 3.10 - willy]\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@google.com>\n\nChange-Id: Id11bb629bd6afaf09b9db5a944e2d060972bc0f1","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/3c8d6db74c1ff8ffa35dc2412ccb5b8a87ea2237"},{"sha":"f54224a6ac85c7bd7dbd7e98a8c395b4f9ca53a2","author":{"name":"Tarun Karra","email":"2510a0714f96c923ea81ac473307af04ae122ae5@codeaurora.org"},"message":"msm: kgsl: verify user memory permissions before mapping to GPU driver\n\nFor user memory of type KGSL_USER_MEM_TYPE_ADDR mapped to GPU driver\nverify permissions and map GPU permissions same as CPU permissions.\nIf elevated permissions are requested return an error to prevent\nprivilege escalation. Without this check user could map readonly\nmemory into GPU driver as readwrite and gain elevated privilege.\n\nWrite permissions check is currently inverted causing readonly\nuser pages to be mapped as readwrite in GPU driver. Fix this\ncheck to map readonly pages as readonly.\n\nBug: 28305757\nCRs-Fixed: 988993\nChange-Id: I0e097d7e4e4c414c0849e33bcc61a26fb94291ad\nSigned-off-by: Tarun Karra <tkarra@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/f54224a6ac85c7bd7dbd7e98a8c395b4f9ca53a2"},{"sha":"5792724f8b9b665f93406a0ac3a011e5bc9b9b12","author":{"name":"Rajesh Bondugula","email":"3062b73d3088701829fade9d0214b3b9a768fa40@codeaurora.org"},"message":"msm: camera: sensor: Validate step_boundary\n\nstep_boundary can take values upto the total_steps\nValidate the step_boundary before consuming it.\nConvert the type of step_index and region_index to uint16_t\nstep_index and region_index cannot be negative.\n\nBug: 27890772\n\nCRs-Fixed: 1001092\nChange-Id: I1f23fd6f28bb897824a1ef99a8873b9f986eee70\nSigned-off-by: Rajesh Bondugula <rajeshb@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/5792724f8b9b665f93406a0ac3a011e5bc9b9b12"},{"sha":"789db4852686518ce9937a9f9acac6712bd9686c","author":{"name":"Vijayavardhan Vennapusa","email":"fd1e89cda16e187a1514e87daf32db280e01223d@qti.qualcomm.com"},"message":"USB: dwc3: debugfs: Add boundary check in dwc3_store_ep_num()\n\nUser can pass arguments as part of write to requests and endpoint number\nwill be calculated based on the arguments. There is a chance that driver\ncan access ep structue that is not allocated due to invalid arguments\npassed by user. Hence fix the issue by having check and return error in\ncase of invalid arguments.\n\nBug: 28172322\n\nChange-Id: I060ea878b55ce0f9983b91c50e58718c8a2c2fa1\nSigned-off-by: Vijayavardhan Vennapusa <vvreddy@qti.qualcomm.com>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/789db4852686518ce9937a9f9acac6712bd9686c"},{"sha":"7722d899a60d76f8b113aafe8c2ae1c768094393","author":{"name":"Alan Stern","email":"5c4cbde65af01ad64f5b2177d0cd78ab5b01e5a1@rowland.harvard.edu"},"message":"USB: fix invalid memory access in hub_activate()\n\nCommit 8520f38099cc (\"USB: change hub initialization sleeps to\ndelayed_work\") changed the hub_activate() routine to make part of it\nrun in a workqueue.  However, the commit failed to take a reference to\nthe usb_hub structure or to lock the hub interface while doing so.  As\na result, if a hub is plugged in and quickly unplugged before the work\nroutine can run, the routine will try to access memory that has been\ndeallocated.  Or, if the hub is unplugged while the routine is\nrunning, the memory may be deallocated while it is in active use.\n\nThis patch fixes the problem by taking a reference to the usb_hub at\nthe start of hub_activate() and releasing it at the end (when the work\nis finished), and by locking the hub interface while the work routine\nis running.  It also adds a check at the start of the routine to see\nif the hub has already been disconnected, in which nothing should be\ndone.\n\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-by: Alexandru Cornea <alexandru.cornea@intel.com>\nTested-by: Alexandru Cornea <alexandru.cornea@intel.com>\nFixes: 8520f38099cc (\"USB: change hub initialization sleeps to delayed_work\")\nCC: <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nBug: 28712303\nChange-Id: Ie696f13c4fa28dd549d459ea607cf27b53610be6","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/7722d899a60d76f8b113aafe8c2ae1c768094393"},{"sha":"ffd47b5402629a1b3424890c62b94e73f4c2e45f","author":{"name":"Veena Sambasivan","email":"f3dea2712a9835ef757537fe50b353b17bceb98a@codeaurora.org"},"message":"msm: perf: Do not allocate new hw_event if event is duplicate.\n\nDuring a perf_event_enable, kernel/events/core.c calls pmu->add() which\nis platform implementation(arch/arm/kernel/perf_event.c). Due to the\nduplicate constraints, arch/arm/mach-msm/perf_event_msm_krait_l2.c\ndrivers marks the event as OFF but returns TRUE to perf_event.c which\ngoes ahead and allocates the hw_event and enables it.\nSince event is marked OFF, kernel events core will try to enable this event\nagain during next perf_event_enable. Which results in same event enabled\non multiple hw_events. But during the perf_release, event struct is freed\nand only one hw_event is released. This results in dereferencing the\ninvalid pointer and hence the crash.\nFix this by returning error in case of constraint event duplicate. Hence\navoiding the same event programmed on multiple hw event counters.\n\nbug: 28172137\nChange-Id: Ia3360be027dfe87ac753191ffe7e0bc947e72455\nSigned-off-by: Arun KS <arunks@codeaurora.org>\nSigned-off-by: Veena Sambasivan <veenas@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/ffd47b5402629a1b3424890c62b94e73f4c2e45f"},{"sha":"264ff71a20f0c4e087f198617f1f4d63f4058a06","author":{"name":"Mohamad Ayyash","email":"a63011e6db47c5624401b2ef01e42a84436c0cfe@google.com"},"message":"Don't show empty tag stats for unprivileged uids\n\nBUG: 27577101\nBUG: 27532522\nChange-Id: I890831a72e5ad4485fdf30e51a146712b18052ed\nSigned-off-by: Mohamad Ayyash <mkayyash@google.com","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/264ff71a20f0c4e087f198617f1f4d63f4058a06"},{"sha":"cbe73be6be508bf9edc595cd84526f1df3147e93","author":{"name":"Peter Hurley","email":"6214814a67b9688a08e8c6dc7fa5dee076dddc8d@hurleysoftware.com"},"message":"tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)\n\nioctl(TIOCGETD) retrieves the line discipline id directly from the\nldisc because the line discipline id (c_line) in termios is untrustworthy;\nuserspace may have set termios via ioctl(TCSETS*) without actually\nchanging the line discipline via ioctl(TIOCSETD).\n\nHowever, directly accessing the current ldisc via tty->ldisc is\nunsafe; the ldisc ptr dereferenced may be stale if the line discipline\nis changing via ioctl(TIOCSETD) or hangup.\n\nWait for the line discipline reference (just like read() or write())\nto retrieve the \"current\" line discipline id.\n\nBug: 28409131\n\nCc: <stable@vger.kernel.org>\nSigned-off-by: Peter Hurley <peter@hurleysoftware.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n(cherry picked from commit d1b8ab1f2d9a46b4f98c2378f8d597460d8466d6)\n\nChange-Id: I22a697959ce0a1ed7209fd9d9ecd12ac69cec987","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/cbe73be6be508bf9edc595cd84526f1df3147e93"},{"sha":"edbe4c67fc0f0914a91fa64fb48d4e7e069d949b","author":{"name":"vivek mehta","email":"46298864fe14f825b17ffcd41039a9c3fac6322b@codeaurora.org"},"message":"ASoC: msm: audio-effects: misc fixes in h/w accelerated effect\n\nAdding integer overflow check in h/w accelerated effect driver.\n\nBug: 28470967\nChange-Id: I17d4cc0a38770f0c5067fa8047cd63e7bf085e48\nCRs-Fixed: 1006609\nSigned-off-by: Weiyin Jiang <wjiang@codeaurora.org>\nSigned-off-by: vivek mehta <mvivek@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/edbe4c67fc0f0914a91fa64fb48d4e7e069d949b"},{"sha":"094303210a20c0fe6f00853ca313857312471668","author":{"name":"Jerry Lee","email":"c7189381eb74de1157e4e1bcfabd4200913e39e2@broadcom.com"},"message":"net: wireless: bcmdhd: security enhancement for BRCM ether type\n\nstrict ckeckup for type and event data length\n\nRequired FW for bcm4356/bcm4354 >= 7.35.101.3 (CL/603540)\nBUG=26492805\n\nChange-Id: I64c2b90d6747f8966495363c2424d6b18f9fb7cb\nSigned-off-by: Jerry Lee <jerrylee@broadcom.com>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/094303210a20c0fe6f00853ca313857312471668"},{"sha":"49163060a69b9734c77e6f71d5813372195012d4","author":{"name":"Iliya Varadzhakov","email":"103f20c78ff83a30c56f50bd35935cc6e07ea5b3@codeaurora.org"},"message":"msm: cpp: Update iommu handling\n\nCPP has to check for stream state before operate iommu\ncontexts.\n\nBug: 28814652\n\nChange-Id: I5af5d126ba929f943be815fb51f69fdb09f53d43\nSigned-off-by: Iliya Varadzhakov <ivarad@codeaurora.org>\nSigned-off-by: Yueyao (Nathan) Zhu <yueyao@google.com>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/49163060a69b9734c77e6f71d5813372195012d4"},{"sha":"d7025279924cab0da7a6d591a670dd22a08d7824","author":{"name":"Ravi Aravamudhan","email":"5977b599b75e70f4ec45e109575e7026e5d3cd3d@codeaurora.org"},"message":"diag: Make fixes to diag_switch_logging\n\nDiag driver holds on to the socket process task structure even\nafter signaling the process to exit. This patch clears the internal\nhandle after signaling.\n\nbug: 28803962\nChange-Id: I642fb595fc2caebc6f2f5419efed4fb560e4e4db\nSigned-off-by: Ravi Aravamudhan <aravamud@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/d7025279924cab0da7a6d591a670dd22a08d7824"},{"sha":"9c1e353897decb0a1c0533f02020a810bf3fb871","author":{"name":"Biswajit Paul","email":"7ee5649c8de55a61a3bbcbc7dcde16c04b2f65da@codeaurora.org"},"message":"kernel: Restrict permissions of /proc/iomem.\n\nThe permissions of /proc/iomem currently are -r--r--r--. Everyone can\nsee its content. As iomem contains information about the physical memory\ncontent of the device, restrict the information only to root.\n\nChange-Id: If0be35c3fac5274151bea87b738a48e6ec0ae891\nbug: 28814213\nCRs-Fixed: 786116\nSigned-off-by: Biswajit Paul <biswajitpaul@codeaurora.org>\nSigned-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/9c1e353897decb0a1c0533f02020a810bf3fb871"},{"sha":"00241c31cbde567c9b7b76a00700abb8051e984b","author":{"name":"Mohit Aggarwal","email":"e312531ff0a491048a1f78294d19bb12f0137756@codeaurora.org"},"message":"diag: Fix possible underflow/overflow issues\n\nAdd check in order to fix possible integer underflow\nduring HDLC encoding which may lead to buffer\noverflow. Also added check for packet length to\navoid buffer overflow.\n\nBug: 28767796\nChange-Id: I6dfe890c9db521c9144f05155c50b289c83b5b8f\nSigned-off-by: Mohit Aggarwal <maggarwa@codeaurora.org>\nSigned-off-by: Yuan Lin <yualin@google.com>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/00241c31cbde567c9b7b76a00700abb8051e984b"},{"sha":"225110e5d12605fe1e33ee848ce51a79ca898506","author":{"name":"Petar Sivenov","email":"2be1604930a0846ac26dc8b6cacfffe1fd435c04@codeaurora.org"},"message":"msm:camera:isp: fix array index bound checks\n\nThis change fixes several incorrect or missing array index bound checks.\n\nBug: 28814502\nChange-Id: Icd96555c01330ec11e94c6173d8df1973fe39c33\nSigned-off-by: Petar Sivenov <psiven@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/225110e5d12605fe1e33ee848ce51a79ca898506"},{"sha":"e222362e7dcd5f40f30a623f315139611519d639","author":{"name":"Sreesudhan Ramakrish Ramkumar","email":"0d41d9390c333e77464df58e64adb45a145c91fe@codeaurora.org"},"message":"msm: camera: isp: Validate input parameters in ioctl handler\n\nValidate reg_offset, data_offset, hi_tbl_offset, lo_tbl_offset\nand len parameters before consuming to avoid invalid register access\nand invalid memory access.\n\nBug: 28804030\nChange-Id: Ib0c1fd2b640576cadfc50fbb6485be6160a51deb\nSigned-off-by: Sreesudhan Ramakrish Ramkumar <srramku@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/e222362e7dcd5f40f30a623f315139611519d639"},{"sha":"d36b8965839941679d1c40a288bff4aab32dda3e","author":{"name":"Sreesudhan Ramakrish Ramkumar","email":"0d41d9390c333e77464df58e64adb45a145c91fe@codeaurora.org"},"message":"msm: camera: isp: Validate input parameter for vfe_write and vfe_read\n\nValidate input parameters for read and write operations in vfe to\nensure operations are performed within vfe register boundary and\nwithin structure limits passed by caller.\n\nBug: 28804030\nChange-Id: If3719de65b32773c2b6ff904da76a951dbfb11eb\nSigned-off-by: Sreesudhan Ramakrish Ramkumar <srramku@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/d36b8965839941679d1c40a288bff4aab32dda3e"},{"sha":"616883bd72b3178bcdbe4957b8e74107c9d643d4","author":{"name":"Mekala Natarajan","email":"0558ba8c534cac4c2ed9b1300fa6b191bf8701a5@google.com"},"message":"ASoC: q6lsm: Add check for integer overflow\n\nDuring sound model registration, the total memory size needed by the\nsound model data is the sum of sound model length, number of zero\npadding bytes and the calibration size. It is possible this sum\ncan result into integer overflow causing difficult to debug issues.\nAdd check for integer overflow to avoid such possible issues.\n\nCRs-fixed: 792367\nBug: 28813987\nChange-Id: I9f451aa308214a4eac42b82e2abf1375c858ff30\nSigned-off-by: Bhalchandra Gajare <gajare@codeaurora.org>\nSigned-off-by: Mekala Natarajan <mnatarajan@google.com>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/616883bd72b3178bcdbe4957b8e74107c9d643d4"},{"sha":"7ecd350303cd1caa0979bed003c0c197aafe137d","author":{"name":"Sunil Khatri","email":"c2fa09c6a63ee27656efbed7bd5e770f84d009d0@codeaurora.org"},"message":"msm: kgsl: Defer adding the mem entry to a process\n\nIf we add the mem entry pointer in the process idr and rb tree\ntoo early, other threads can do operations on the entry by\nguessing the ID or GPU address before the object gets returned\nby the creating operation.\n\nAllocate an ID for the object but don't assign the pointer until\nright before the creating function returns ensuring that another\noperation can't access it until it is ready.\n\nBug: 28026365\nBug: 28377352\nCRs-Fixed: 1002974\nChange-Id: Ic0dedbadc0dd2125bd2a7bcc152972c0555e07f8\nSigned-off-by: Jordan Crouse <jcrouse@codeaurora.org>\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>\nSigned-off-by: Santhosh Punugu <spunug@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/7ecd350303cd1caa0979bed003c0c197aafe137d"},{"sha":"b2f280870dabaf0a0b1fceab1445001fd1406ff7","author":{"name":"Kangjie Lu","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"USB: usbfs: fix potential infoleak in devio\n\nThe stack object “ci” has a total size of 8 bytes. Its last 3 bytes\nare padding bytes which are not initialized and leaked to userland\nvia “copy_to_user”.\n\nBug: 28619695\nChange-Id: I170754d659d0891c075f85211b5e3970b114f097\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.10/commits/b2f280870dabaf0a0b1fceab1445001fd1406ff7"}]}
{"actor":{"display_login":"Rashed97"}}