{"push_id":1154952361,"size":10,"distinct_size":0,"ref":"refs/heads/aosp/android-3.18","head":"71a50776c381cb2a57b7df1b9820f92e6bb08219","before":"91bd6b66f3060ae26b9c1f04319394690cc27038","commits":[{"sha":"8c69da180422faad35003b3996d3adcef54db007","author":{"name":"Peter Hurley","email":"6214814a67b9688a08e8c6dc7fa5dee076dddc8d@hurleysoftware.com"},"message":"UPSTREAM: tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)\n\n(cherry pick from commit 5c17c861a357e9458001f021a7afa7aab9937439)\n\nioctl(TIOCGETD) retrieves the line discipline id directly from the\nldisc because the line discipline id (c_line) in termios is untrustworthy;\nuserspace may have set termios via ioctl(TCSETS*) without actually\nchanging the line discipline via ioctl(TIOCSETD).\n\nHowever, directly accessing the current ldisc via tty->ldisc is\nunsafe; the ldisc ptr dereferenced may be stale if the line discipline\nis changing via ioctl(TIOCSETD) or hangup.\n\nWait for the line discipline reference (just like read() or write())\nto retrieve the \"current\" line discipline id.\n\nCc: <stable@vger.kernel.org>\nSigned-off-by: Peter Hurley <peter@hurleysoftware.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nBug: 28409131\nChange-Id: If4be351f4d62f07a054b4822dfa743a68811c921","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/8c69da180422faad35003b3996d3adcef54db007"},{"sha":"0bec9701b94804e772aa1f98347651368ede1867","author":{"name":"Alan Stern","email":"5c4cbde65af01ad64f5b2177d0cd78ab5b01e5a1@rowland.harvard.edu"},"message":"UPSTREAM: USB: fix invalid memory access in hub_activate()\n\n(cherry pick from commit e50293ef9775c5f1cf3fcc093037dd6a8c5684ea)\n\nCommit 8520f38099cc (\"USB: change hub initialization sleeps to\ndelayed_work\") changed the hub_activate() routine to make part of it\nrun in a workqueue.  However, the commit failed to take a reference to\nthe usb_hub structure or to lock the hub interface while doing so.  As\na result, if a hub is plugged in and quickly unplugged before the work\nroutine can run, the routine will try to access memory that has been\ndeallocated.  Or, if the hub is unplugged while the routine is\nrunning, the memory may be deallocated while it is in active use.\n\nThis patch fixes the problem by taking a reference to the usb_hub at\nthe start of hub_activate() and releasing it at the end (when the work\nis finished), and by locking the hub interface while the work routine\nis running.  It also adds a check at the start of the routine to see\nif the hub has already been disconnected, in which nothing should be\ndone.\n\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-by: Alexandru Cornea <alexandru.cornea@intel.com>\nTested-by: Alexandru Cornea <alexandru.cornea@intel.com>\nFixes: 8520f38099cc (\"USB: change hub initialization sleeps to delayed_work\")\nCC: <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nBug: 28712303\nChange-Id: I33d3a93968122b8a58911a2edf4cea65d49134b5","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/0bec9701b94804e772aa1f98347651368ede1867"},{"sha":"108aec56a072e3eda977a51cedbe09e25f9cd10e","author":{"name":"Winter Wang","email":"7f6b4eab9aaacc1d9fdcf42ec8b7abaf69224bee@nxp.com"},"message":"ANDROID: usb: gadget: f_midi: set fi->f to NULL when free f_midi function\n\nfi->f is set in f_midi's alloc_func, need to clean this to\nNULL in free_func, otherwise on ConfigFS's function switch,\nmidi->usb_function it self is freed, fi->f will be a wild\npointer and run into below kernel panic:\n---------------\n[   58.950628] Unable to handle kernel paging request at virtual address 63697664\n[   58.957869] pgd = c0004000\n[   58.960583] [63697664] *pgd=00000000\n[   58.964185] Internal error: Oops: 80000005 [#1] PREEMPT SMP ARM\n[   58.970111] Modules linked in:\n[   58.973191] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.1.15-03504-g34c857c-dirty #89\n[   58.981024] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)\n[   58.987557] task: c110bd70 ti: c1100000 task.ti: c1100000\n[   58.992962] PC is at 0x63697664\n[   58.996120] LR is at android_setup+0x78/0x138\n<..snip..>\n[   60.044980] 1fc0: ffffffff ffffffff c1000684 00000000 00000000 c108ecd0 c11f7294 c11039c0\n[   60.053181] 1fe0: c108eccc c110d148 1000406a 412fc09a 00000000 1000807c 00000000 00000000\n[   60.061420] [<c073b1fc>] (android_setup) from [<c0730490>] (udc_irq+0x758/0x1034)\n[   60.068951] [<c0730490>] (udc_irq) from [<c017c650>] (handle_irq_event_percpu+0x50/0x254)\n[   60.077165] [<c017c650>] (handle_irq_event_percpu) from [<c017c890>] (handle_irq_event+0x3c/0x5c)\n[   60.086072] [<c017c890>] (handle_irq_event) from [<c017f3ec>] (handle_fasteoi_irq+0xe0/0x198)\n[   60.094630] [<c017f3ec>] (handle_fasteoi_irq) from [<c017bcfc>] (generic_handle_irq+0x2c/0x3c)\n[   60.103271] [<c017bcfc>] (generic_handle_irq) from [<c017bfb8>] (__handle_domain_irq+0x7c/0xec)\n[   60.112000] [<c017bfb8>] (__handle_domain_irq) from [<c0101450>] (gic_handle_irq+0x24/0x5c)\n--------------\n\nSigned-off-by: Winter Wang <wente.wang@nxp.com>","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/108aec56a072e3eda977a51cedbe09e25f9cd10e"},{"sha":"5364b5ca0b1a12a58283b51408e43fc36d4e4fe7","author":{"name":"Badhri Jagan Sridharan","email":"cdd32e903b63821e79f87a1fa9b017fa31cbb189@google.com"},"message":"ANDROID: dm: fix signature verification flag\n\nThe bug was that the signature verification was only\nhappening when verity was disabled. It should always\nhappen when verity is enabled.\n\nSigned-off-by: Badhri Jagan Sridharan <Badhri@google.com>\nChange-Id: I2d9354e240d36ea06fc68c2d18d8e87b823a4c2f","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/5364b5ca0b1a12a58283b51408e43fc36d4e4fe7"},{"sha":"c5c74d0327729f35b576564976885596c6d0e7fb","author":{"name":"Badhri Jagan Sridharan","email":"cdd32e903b63821e79f87a1fa9b017fa31cbb189@google.com"},"message":"ANDROID: dm: use default verity public key\n\nIf the dm-android-verity target does not provide a default\nkey try using the default public key from the system keyring.\nThe defualt verity keyid is passed as a kernel command line\nargument veritykeyid=.\n\nThe order of the dm-android-verity params have been reversed\nto facilitate the change.\n\nOld format example:\ndm=\"system none ro,0 1 android-verity Android:#7e4333f9bba00adfe0ede979e28ed1920492b40f /dev/mmcblk0p43\"\n\nNew formats supported:\ndm=\"system none ro,0 1 android-verity /dev/mmcblk0p43 Android:#7e4333f9bba00adfe0ede979e28ed1920492b40f\"\n\n(or)\n\ndm=\"system none ro,0 1 android-verity /dev/mmcblk0p43\"\nwhen veritykeyid= is set in the kernel command line.\n\nBUG: 28384658\nSigned-off-by: Badhri Jagan Sridharan <Badhri@google.com>\nChange-Id: I506c89b053d835ab579e703eef2bc1f8487250de","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/c5c74d0327729f35b576564976885596c6d0e7fb"},{"sha":"925d82a466131093dee9a301372f4c29a28d948b","author":{"name":"Ben Hutchings","email":"9c85637c38b80821c7bd8a03bde7b59da81ab77d@decadent.org.uk"},"message":"BACKPORT: perf tools: Document the perf sysctls\n\nperf_event_paranoid was only documented in source code and a perf error\nmessage.  Copy the documentation from the error message to\nDocumentation/sysctl/kernel.txt.\n\nperf_cpu_time_max_percent was already documented but missing from the\nlist at the top, so add it there.\n\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: linux-doc@vger.kernel.org\nLink: http://lkml.kernel.org/r/20160119213515.GG2637@decadent.org.uk\n[ Remove reference to external Documentation file, provide info inline, as before ]\nSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>\n\nBug: 29054680\nChange-Id: I13e73cfb2ad761c94762d0c8196df7725abdf5c5","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/925d82a466131093dee9a301372f4c29a28d948b"},{"sha":"012b0adcf7299f6509d4984cf46ee11e6eaed4e4","author":{"name":"Jeff Vander Stoep","email":"3c7c1df314a95c4ce859cc668e778f3e3567dbe8@google.com"},"message":"FROMLIST: security,perf: Allow further restriction of perf_event_open\n\nWhen kernel.perf_event_open is set to 3 (or greater), disallow all\naccess to performance events by users without CAP_SYS_ADMIN.\nAdd a Kconfig symbol CONFIG_SECURITY_PERF_EVENTS_RESTRICT that\nmakes this value the default.\n\nThis is based on a similar feature in grsecurity\n(CONFIG_GRKERNSEC_PERF_HARDEN).  This version doesn't include making\nthe variable read-only.  It also allows enabling further restriction\nat run-time regardless of whether the default is changed.\n\nhttps://lkml.org/lkml/2016/1/11/587\n\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\n\nBug: 29054680\nChange-Id: Iff5bff4fc1042e85866df9faa01bce8d04335ab8","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/012b0adcf7299f6509d4984cf46ee11e6eaed4e4"},{"sha":"15c897f31ba18f67559d6b7f1a6afa855baa756c","author":{"name":"Jeff Vander Stoep","email":"3c7c1df314a95c4ce859cc668e778f3e3567dbe8@google.com"},"message":"ANDROID: restrict access to perf events\n\nAdd:\nCONFIG_SECURITY_PERF_EVENTS_RESTRICT=y\n\nto android-base.cfg\n\nThe kernel.perf_event_paranoid sysctl is set to 3 by default.\nNo unprivileged use of the perf_event_open syscall will be\npermitted unless it is changed.\n\nBug: 29054680\nChange-Id: Ie7512259150e146d8e382dc64d40e8faaa438917","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/15c897f31ba18f67559d6b7f1a6afa855baa756c"},{"sha":"21c0fe9f24b7707d2b49401f8c740c3e35c580ea","author":{"name":"Sami Tolvanen","email":"9f0303389a1ac2af7ba4adda4588b4df51d7c737@google.com"},"message":"ANDROID: dm verity fec: limit error correction recursion\n\nIf verity tree itself is sufficiently corrupted in addition to data\nblocks, it's possible for error correction to end up in a deep recursive\nerror correction loop that eventually causes a kernel panic as follows:\n\n[   14.728962] [<ffffffc0008c1a14>] verity_fec_decode+0xa8/0x138\n[   14.734691] [<ffffffc0008c3ee0>] verity_verify_level+0x11c/0x180\n[   14.740681] [<ffffffc0008c482c>] verity_hash_for_block+0x88/0xe0\n[   14.746671] [<ffffffc0008c1508>] fec_decode_rsb+0x318/0x75c\n[   14.752226] [<ffffffc0008c1a14>] verity_fec_decode+0xa8/0x138\n[   14.757956] [<ffffffc0008c3ee0>] verity_verify_level+0x11c/0x180\n[   14.763944] [<ffffffc0008c482c>] verity_hash_for_block+0x88/0xe0\n\nThis change limits the recursion to a reasonable level during a single\nI/O operation.\n\nBug: 28943429\nSigned-off-by: Sami Tolvanen <samitolvanen@google.com>\nChange-Id: I0a7ebff331d259c59a5e03c81918cc1613c3a766\n(cherry picked from commit f4b9e40597e73942d2286a73463c55f26f61bfa7)","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/21c0fe9f24b7707d2b49401f8c740c3e35c580ea"},{"sha":"71a50776c381cb2a57b7df1b9820f92e6bb08219","author":{"name":"Sami Tolvanen","email":"9f0303389a1ac2af7ba4adda4588b4df51d7c737@google.com"},"message":"ANDROID: dm verity fec: add missing release from fec_ktype\n\nAdd a release function to allow destroying the dm-verity device.\n\nBug: 27928374\nSigned-off-by: Sami Tolvanen <samitolvanen@google.com>\nChange-Id: Ic0f7c17e4889c5580d70b52d9a709a37165a5747\n(cherry picked from commit 0039ccf47c8f99888f7b71b2a36a68a027fbe357)","distinct":false,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/71a50776c381cb2a57b7df1b9820f92e6bb08219"}]}
{"actor":{"display_login":"dianlujitao"}}