{"push_id":1357929069,"size":16,"distinct_size":11,"ref":"refs/heads/boeffla13.0_l494a9","head":"d9b96f814c7911d18ee537c417b437a115ff15d4","before":"78b172118502ee809a126c35896ec279dc6e1cbb","commits":[{"sha":"b0f47960344d9e4a836559bcb34a3ce42e9a6e31","author":{"name":"andip71","email":"e6ecbe9226906ebc6c74fcf434eb9f5addb9e0e0@gmx.de"},"message":"Boeffla ramfs: Update busybox to version 1.25.1 (self-compiled Boeffla version)","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-s3/commits/b0f47960344d9e4a836559bcb34a3ce42e9a6e31"},{"sha":"9914621db8540c1968c41d41b836f8faf86a9fc8","author":{"name":"andip71","email":"e6ecbe9226906ebc6c74fcf434eb9f5addb9e0e0@gmx.de"},"message":"bbuild: remove last hardcoded architecture piece","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-s3/commits/9914621db8540c1968c41d41b836f8faf86a9fc8"},{"sha":"a590d5a1d1973ea228d1628b50f6b64404b012d5","author":{"name":"andip71","email":"e6ecbe9226906ebc6c74fcf434eb9f5addb9e0e0@gmx.de"},"message":"bbuild: configurable dtbtool","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-s3/commits/a590d5a1d1973ea228d1628b50f6b64404b012d5"},{"sha":"f7dc6fa6af0c1b162a1332d6cd283023bfb8e683","author":{"name":"Nick Desaulniers","email":"b951273a67bf33267cd4dff69171cdef4e5efbe7@google.com"},"message":"Squash CM commits\n\nbinder: prevent kptr leak by using %pK format specifier\n\nWorks in conjunction with kptr_restrict.\nBug: 30143283\n\nChange-Id: I2b3ce22f4e206e74614d51453a1d59b7080ab05a\n\nnet: Fix use after free in the recvmmsg exit path\n\nThe syzkaller fuzzer hit the following use-after-free:\n\n  Call Trace:\n   [<ffffffff8175ea0e>] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:295\n   [<ffffffff851cc31a>] __sys_recvmmsg+0x6fa/0x7f0 net/socket.c:2261\n   [<     inline     >] SYSC_recvmmsg net/socket.c:2281\n   [<ffffffff851cc57f>] SyS_recvmmsg+0x16f/0x180 net/socket.c:2270\n   [<ffffffff86332bb6>] entry_SYSCALL_64_fastpath+0x16/0x7a\n  arch/x86/entry/entry_64.S:185\n\nAnd, as Dmitry rightly assessed, that is because we can drop the\nreference and then touch it when the underlying recvmsg calls return\nsome packets and then hit an error, which will make recvmmsg to set\nsock->sk->sk_err, oops, fix it.\n\nReported-and-Tested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: Alexander Potapenko <glider@google.com>\nCc: Eric Dumazet <edumazet@google.com>\nCc: Kostya Serebryany <kcc@google.com>\nCc: Sasha Levin <sasha.levin@oracle.com>\nFixes: a2e2725541fa (\"net: Introduce recvmmsg socket syscall\")\nhttp://lkml.kernel.org/r/20160122211644.GC2470@redhat.com\nSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n\nChange-Id: Ie3b6ee89ad3e8cd3a0fe8f50f74aaa4834d0b4ca\n\nnet: Fix use after free in the recvmmsg exit path\n\nThe syzkaller fuzzer hit the following use-after-free:\n\n  Call Trace:\n   [<ffffffff8175ea0e>] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:295\n   [<ffffffff851cc31a>] __sys_recvmmsg+0x6fa/0x7f0 net/socket.c:2261\n   [<     inline     >] SYSC_recvmmsg net/socket.c:2281\n   [<ffffffff851cc57f>] SyS_recvmmsg+0x16f/0x180 net/socket.c:2270\n   [<ffffffff86332bb6>] entry_SYSCALL_64_fastpath+0x16/0x7a\n  arch/x86/entry/entry_64.S:185\n\nAnd, as Dmitry rightly assessed, that is because we can drop the\nreference and then touch it when the underlying recvmsg calls return\nsome packets and then hit an error, which will make recvmmsg to set\nsock->sk->sk_err, oops, fix it.\n\nReported-and-Tested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: Alexander Potapenko <glider@google.com>\nCc: Eric Dumazet <edumazet@google.com>\nCc: Kostya Serebryany <kcc@google.com>\nCc: Sasha Levin <sasha.levin@oracle.com>\nFixes: a2e2725541fa (\"net: Introduce recvmmsg socket syscall\")\nhttp://lkml.kernel.org/r/20160122211644.GC2470@redhat.com\nSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n\nChange-Id: Ie3b6ee89ad3e8cd3a0fe8f50f74aaa4834d0b4ca\n\nfs: ext4: disable support for fallocate FALLOC_FL_PUNCH_HOLE\n\nBug: 28760453\nChange-Id: I019c2de559db9e4b95860ab852211b456d78c4ca\nSigned-off-by: Nick Desaulniers <ndesaulniers@google.com>\n\nUPSTREAM: ALSA: control: Fix replacing user controls\n\n(cherry pick from commit 82262a46627bebb0febcc26664746c25cef08563)\n\nThere are two issues with the current implementation for replacing user\ncontrols. The first is that the code does not check if the control is\nactually a user control and neither does it check if the control is\nowned by the process that tries to remove it. That allows userspace\napplications to remove arbitrary controls, which can cause a user after\nfree if a for example a driver does not expect a control to be removed\nfrom under its feed.\n\nThe second issue is that on one hand when a control is replaced the\nuser_ctl_count limit is not checked and on the other hand the\nuser_ctl_count is increased (even though the number of user controls\ndoes not change). This allows userspace, once the user_ctl_count limit\nhas been reached, to repeatedly replace a control until user_ctl_count\noverflows. Once that happens new controls can be added effectively\nbypassing the user_ctl_count limit.\n\nBoth issues can be fixed by instead of open-coding the removal of the\ncontrol that is to be replaced to use snd_ctl_remove_user_ctl(). This\nfunction does proper permission checks as well as decrements\nuser_ctl_count after the control has been removed.\n\nNote that by using snd_ctl_remove_user_ctl() the check which returns\n-EBUSY at beginning of the function if the control already exists is\nremoved. This is not a problem though since the check is quite\nuseless, because the lock that is protecting the control list is\nreleased between the check and before adding the new control to the\nlist, which means that it is possible that a different control with\nthe same settings is added to the list after the check. Luckily there\nis another check that is done while holding the lock in snd_ctl_add(),\nso we'll rely on that to make sure that the same control is not added\ntwice.\n\nSigned-off-by: Lars-Peter Clausen <lars@metafoo.de>\nAcked-by: Jaroslav Kysela <perex@perex.cz>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nChange-Id: I0b183e2d52afe8e747f59e1ecca6f6fbbac2d016\nBug: 29916012\n\nReplace %p with %pK to prevent leaking kernel address\n\nBUG: 27532522\nChange-Id: Ic0710a9a8cfc682acd88ecf3bbfeece2d798c4a4\nSigned-off-by: Mohamad Ayyash <mkayyash@google.com>\n\nfix infoleak in rtnetlink\n\nthe stack object “map” has a total size of 32 bytes. Its last 4\nbytes are padding generated by compiler. These padding bytes are\nnot initialized and sent out via “nla_put”\n\nBug: 28620102\n\nChange-Id: I13da380c6fe8abca49e3cf9f05293c02b44d2e5e\nSigned-off-by: kangjie <kangjielu@gmail.com>\n\ntcp: fix use after free in tcp_xmit_retransmit_queue()\n\nWhen tcp_sendmsg() allocates a fresh and empty skb, it puts it at the\ntail of the write queue using tcp_add_write_queue_tail()\n\nThen it attempts to copy user data into this fresh skb.\n\nIf the copy fails, we undo the work and remove the fresh skb.\n\nUnfortunately, this undo lacks the change done to tp->highest_sack and\nwe can leave a dangling pointer (to a freed skb)\n\nLater, tcp_xmit_retransmit_queue() can dereference this pointer and\naccess freed memory. For regular kernels where memory is not unmapped,\nthis might cause SACK bugs because tcp_highest_sack_seq() is buggy,\nreturning garbage instead of tp->snd_nxt, but with various debug\nfeatures like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel.\n\nThis bug was found by Marco Grassi thanks to syzkaller.\n\nChange-Id: I264f97d30d0a623011d9ee811c63fa0e0c2149a2\nFixes: 6859d49475d4 (\"[TCP]: Abstract tp->highest_sack accessing & point to next skb\")\nReported-by: Marco Grassi <marco.gra@gmail.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>\nCc: Yuchung Cheng <ycheng@google.com>\nCc: Neal Cardwell <ncardwell@google.com>\nAcked-by: Neal Cardwell <ncardwell@google.com>\nReviewed-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-s3/commits/f7dc6fa6af0c1b162a1332d6cd283023bfb8e683"},{"sha":"bff2035174398b67df7337b958cdb725e031121c","author":{"name":"andip71","email":"e6ecbe9226906ebc6c74fcf434eb9f5addb9e0e0@gmx.de"},"message":"Release tag: 5.2-beta3","distinct":false,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-s3/commits/bff2035174398b67df7337b958cdb725e031121c"},{"sha":"97ab587eb6b88c1decc7e1cac0ec9b494f3e7a60","author":{"name":"ZaneZam","email":"ca7a87512c42f7ce48fd0e6c9f7827f25ffab673@yahoo.com"},"message":"Revert \"Makefile: Revert back to original Makefile\"\n\nThis reverts commit ec62152e8a3c96477875417dff8c2b4ecfb4c5fd.","distinct":true,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-s3/commits/97ab587eb6b88c1decc7e1cac0ec9b494f3e7a60"},{"sha":"9e2cd564b899938c4942cf780be225c6f97c2f51","author":{"name":"ZaneZam","email":"ca7a87512c42f7ce48fd0e6c9f7827f25ffab673@yahoo.com"},"message":"ehci-s5p: fix section mismatch in EHCI USB host drivers if compiling for arm","distinct":true,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-s3/commits/9e2cd564b899938c4942cf780be225c6f97c2f51"},{"sha":"ebcdc446be6434dce29ad1f87e087cf91e732283","author":{"name":"ZaneZam","email":"ca7a87512c42f7ce48fd0e6c9f7827f25ffab673@yahoo.com"},"message":"toolchain: switch to linaro toolchain (plus optimized compiler flags)","distinct":true,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-s3/commits/ebcdc446be6434dce29ad1f87e087cf91e732283"},{"sha":"37f9510c0475113ca531ed9ca0911ef468bd4fd4","author":{"name":"ZaneZam","email":"ca7a87512c42f7ce48fd0e6c9f7827f25ffab673@yahoo.com"},"message":"boeffla_defconfig: switch to LZMA compression for ramdisk to reduce image size","distinct":true,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-s3/commits/37f9510c0475113ca531ed9ca0911ef468bd4fd4"},{"sha":"4b461a960cb58e6122342b3902d7dc9a4008a7ed","author":{"name":"ZaneZam","email":"ca7a87512c42f7ce48fd0e6c9f7827f25ffab673@yahoo.com"},"message":"toolchain: switch to Linaro 4.9.3-2015.01","distinct":true,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-s3/commits/4b461a960cb58e6122342b3902d7dc9a4008a7ed"},{"sha":"9fafcd2d9d8acc515b704e5e2029c28329af0558","author":{"name":"ZaneZam","email":"ca7a87512c42f7ce48fd0e6c9f7827f25ffab673@yahoo.com"},"message":"toolchain: new directory for toolchains after build envoirment changes","distinct":true,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-s3/commits/9fafcd2d9d8acc515b704e5e2029c28329af0558"},{"sha":"26628208d433cfc49b7e6528cc461bcb66bdff79","author":{"name":"ZaneZam","email":"ca7a87512c42f7ce48fd0e6c9f7827f25ffab673@yahoo.com"},"message":"toolchain: switch to Linaro 4.9.4-2015.06\n\nCredits to Christopher83 for the prebuild toolchain","distinct":true,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-s3/commits/26628208d433cfc49b7e6528cc461bcb66bdff79"},{"sha":"04a52a1f92f90ce1223b29668a3b3473a71d2582","author":{"name":"ZaneZam","email":"ca7a87512c42f7ce48fd0e6c9f7827f25ffab673@yahoo.com"},"message":"toolchain: back to -O2 due to stability issues","distinct":true,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-s3/commits/04a52a1f92f90ce1223b29668a3b3473a71d2582"},{"sha":"6ea115d92b5485a52c908efb8f94cf4ba7b16bdc","author":{"name":"ZaneZam","email":"ca7a87512c42f7ce48fd0e6c9f7827f25ffab673@yahoo.com"},"message":"toolchain: add graphite optimizations","distinct":true,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-s3/commits/6ea115d92b5485a52c908efb8f94cf4ba7b16bdc"},{"sha":"081c0dfd056605ea1d3aa1f200646d0228c978a8","author":{"name":"ZaneZam","email":"ca7a87512c42f7ce48fd0e6c9f7827f25ffab673@yahoo.com"},"message":"Revert \"boeffla_defconfig: switch to LZMA compression for ramdisk to reduce image size\"\n\nThis reverts commit a59966c817b5493863a0c874c1c2fc04fbdc831a.","distinct":true,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-s3/commits/081c0dfd056605ea1d3aa1f200646d0228c978a8"},{"sha":"d9b96f814c7911d18ee537c417b437a115ff15d4","author":{"name":"ZaneZam","email":"ca7a87512c42f7ce48fd0e6c9f7827f25ffab673@yahoo.com"},"message":"Makefile: Revert back to original ARCH and CROSS_COMPILE settings (Sync with Boeffla Kernel build process)","distinct":true,"url":"https://api.github.com/repos/zanezam/boeffla-kernel-cm-s3/commits/d9b96f814c7911d18ee537c417b437a115ff15d4"}]}
{"actor":{"display_login":"zanezam"}}