{"push_id":1097811586,"size":9,"distinct_size":9,"ref":"refs/heads/cm-13.0-new3","head":"cbfb16be9645cea222d23ef6d00f1831df25956b","before":"0135cf0711d2fbd13bdd19a2804208d9b45e9072","commits":[{"sha":"ac620e9e2baaa5ca23cdb3c2ad76834718aa7465","author":{"email":"577f74ec3f2c8a155237d5ad42a70103d17f8313@codeaurora.org","name":"Vikram Mulukutla"},"message":"arm: mach-msm: pil-msa: Set the strongly-ordered attribute on DMA allocations\n\nTo completely eliminate the possibility of speculative\naccesses on DMA memory, set the strongly-ordered attribute\non all such allocations.\n\nChange-Id: I4bad68eeae33aaebb4b1a30ab7a0ba133c6a0343\nSigned-off-by: Vikram Mulukutla <markivx@codeaurora.org>\nSigned-off-by: Srinivasarao P <spathi@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/SpotComms/android_kernel_oneplus_msm8974/commits/ac620e9e2baaa5ca23cdb3c2ad76834718aa7465"},{"sha":"fef6f014744367c07ef898c05ed99f9f4e9da53e","author":{"email":"65efa573cf8fdf8b25a9125c7117aec7f4e9e3b0@spotco.us","name":"Tad"},"message":"Merge branch 'cm-13.0' of git://github.com/CyanogenMod/android_kernel_oneplus_msm8974 into cm-13.0-new3","distinct":true,"url":"https://api.github.com/repos/SpotComms/android_kernel_oneplus_msm8974/commits/fef6f014744367c07ef898c05ed99f9f4e9da53e"},{"sha":"53e34df36fb30351640fc9e2efb2120af82ef02c","author":{"email":"248dd96652a047b675d8f9c63c018de72461a2f7@gmail.com","name":"Andrey Konovalov"},"message":"ALSA: usb-audio: avoid freeing umidi object twice\n\nThe 'umidi' object will be free'd on the error path by snd_usbmidi_free()\nwhen tearing down the rawmidi interface. So we shouldn't try to free it\nin snd_usbmidi_create() after having registered the rawmidi interface.\n\nFound by KASAN.\n\nChange-Id: I8534867beeac111370017ef246adc17e23e1a3b1\nSigned-off-by: Andrey Konovalov <andreyknvl@gmail.com>\nAcked-by: Clemens Ladisch <clemens@ladisch.de>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/SpotComms/android_kernel_oneplus_msm8974/commits/53e34df36fb30351640fc9e2efb2120af82ef02c"},{"sha":"fa8011e5ea1281e614f3b07309c92662e8c1d566","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ALSA: timer: Fix double unlink of active_list\n\nALSA timer instance object has a couple of linked lists and they are\nunlinked unconditionally at snd_timer_stop().  Meanwhile\nsnd_timer_interrupt() unlinks it, but it calls list_del() which leaves\nthe element list itself unchanged.  This ends up with unlinking twice,\nand it was caught by syzkaller fuzzer.\n\nThe fix is to use list_del_init() variant properly there, too.\n\nChange-Id: I95e2ab06180dfe43fb6b7c2875a866b53ca245ce\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/SpotComms/android_kernel_oneplus_msm8974/commits/fa8011e5ea1281e614f3b07309c92662e8c1d566"},{"sha":"88c4d9f988c4331c391bf902e04fc2910bb9131c","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ALSA: timer: Fix race among timer ioctls\n\nALSA timer ioctls have an open race and this may lead to a\nuse-after-free of timer instance object.  A simplistic fix is to make\neach ioctl exclusive.  We have already tread_sem for controlling the\ntread, and extend this as a global mutex to be applied to each ioctl.\n\nThe downside is, of course, the worse concurrency.  But these ioctls\naren't to be parallel accessible, in anyway, so it should be fine to\nserialize there.\n\nChange-Id: Iaa21b00f62e02cc58e346a29846e0fce6536e860\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/SpotComms/android_kernel_oneplus_msm8974/commits/88c4d9f988c4331c391bf902e04fc2910bb9131c"},{"sha":"8a6783447616dcc4f0c66c5487a513be3c559a98","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ALSA: timer: Harden slave timer list handling\n\nA slave timer instance might be still accessible in a racy way while\noperating the master instance as it lacks of locking.  Since the\nmaster operation is mostly protected with timer->lock, we should cope\nwith it while changing the slave instance, too.  Also, some linked\nlists (active_list and ack_list) of slave instances aren't unlinked\nimmediately at stopping or closing, and this may lead to unexpected\naccesses.\n\nThis patch tries to address these issues.  It adds spin lock of\ntimer->lock (either from master or slave, which is equivalent) in a\nfew places.  For avoiding a deadlock, we ensure that the global\nslave_active_lock is always locked at first before each timer lock.\n\nAlso, ack and active_list of slave instances are properly unlinked at\nsnd_timer_stop() and snd_timer_close().\n\nLast but not least, remove the superfluous call of _snd_timer_stop()\nat removing slave links.  This is a noop, and calling it may confuse\nreaders wrt locking.  Further cleanup will follow in a later patch.\n\nActually we've got reports of use-after-free by syzkaller fuzzer, and\nthis hopefully fixes these issues.\n\nChange-Id: I572878b909dda522dbedc84633414185802bc974\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/SpotComms/android_kernel_oneplus_msm8974/commits/8a6783447616dcc4f0c66c5487a513be3c559a98"},{"sha":"9a1e3902c1b250de99bf959101c2f504abe7499a","author":{"email":"aff024fe4ab0fece4091de044c58c9ae4233383a@1wt.eu","name":"Willy Tarreau"},"message":"pipe: limit the per-user amount of pages allocated in pipes\n\nOn no-so-small systems, it is possible for a single process to cause an\nOOM condition by filling large pipes with data that are never read. A\ntypical process filling 4000 pipes with 1 MB of data will use 4 GB of\nmemory. On small systems it may be tricky to set the pipe max size to\nprevent this from happening.\n\nThis patch makes it possible to enforce a per-user soft limit above\nwhich new pipes will be limited to a single page, effectively limiting\nthem to 4 kB each, as well as a hard limit above which no new pipes may\nbe created for this user. This has the effect of protecting the system\nagainst memory abuse without hurting other users, and still allowing\npipes to work correctly though with less data at once.\n\nThe limit are controlled by two new sysctls : pipe-user-pages-soft, and\npipe-user-pages-hard. Both may be disabled by setting them to zero. The\ndefault soft limit allows the default number of FDs per process (1024)\nto create pipes of the default size (64kB), thus reaching a limit of 64MB\nbefore starting to create only smaller pipes. With 256 processes limited\nto 1024 FDs each, this results in 1024*64kB + (256*1024 - 1024) * 4kB =\n1084 MB of memory allocated for a user. The hard limit is disabled by\ndefault to avoid breaking existing applications that make intensive use\nof pipes (eg: for splicing).\n\nReported-by: socketpair@gmail.com\nReported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>\nMitigates: CVE-2013-4312 (Linux 2.0+)\nSuggested-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\n\nConflicts:\n\tDocumentation/sysctl/fs.txt\n\tfs/pipe.c\n\tinclude/linux/sched.h\n\nChange-Id: Ic7c678af18129943e16715fdaa64a97a7f0854be","distinct":true,"url":"https://api.github.com/repos/SpotComms/android_kernel_oneplus_msm8974/commits/9a1e3902c1b250de99bf959101c2f504abe7499a"},{"sha":"a12f94c43748e7e9a7e833a657721a0568c3cfc5","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ALSA: hrtimer: Fix stall by hrtimer_cancel()\n\nhrtimer_cancel() waits for the completion from the callback, thus it\nmust not be called inside the callback itself.  This was already a\nproblem in the past with ALSA hrtimer driver, and the early commit\n[fcfdebe70759: ALSA: hrtimer - Fix lock-up] tried to address it.\n\nHowever, the previous fix is still insufficient: it may still cause a\nlockup when the ALSA timer instance reprograms itself in its callback.\nThen it invokes the start function even in snd_timer_interrupt() that\nis called in hrtimer callback itself, results in a CPU stall.  This is\nno hypothetical problem but actually triggered by syzkaller fuzzer.\n\nThis patch tries to fix the issue again.  Now we call\nhrtimer_try_to_cancel() at both start and stop functions so that it\nwon't fall into a deadlock, yet giving some chance to cancel the queue\nif the functions have been called outside the callback.  The proper\nhrtimer_cancel() is called in anyway at closing, so this should be\nenough.\n\nChange-Id: Id6224b2a3ade0d217e891e6af09744df4d0b2e5c\nReported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/SpotComms/android_kernel_oneplus_msm8974/commits/a12f94c43748e7e9a7e833a657721a0568c3cfc5"},{"sha":"cbfb16be9645cea222d23ef6d00f1831df25956b","author":{"email":"65efa573cf8fdf8b25a9125c7117aec7f4e9e3b0@spotco.us","name":"Tad"},"message":"git pull cm cm-13.0Merge branch 'cm-13.0' of\ngit://github.com/CyanogenMod/android_kernel_oneplus_msm8974 into\ncm-13.0-new3","distinct":true,"url":"https://api.github.com/repos/SpotComms/android_kernel_oneplus_msm8974/commits/cbfb16be9645cea222d23ef6d00f1831df25956b"}]}