{"push_id":1377166274,"size":13,"distinct_size":13,"ref":"refs/heads/cm-14.1","head":"7c46b7bc9c5fffe8ea53df1cadb3b5a00add937c","before":"58a100462afbd4d7cb7ff677d049adeec4b497b5","commits":[{"sha":"86361446a854b6c8ae5f7eec9c2aa17095617ca4","author":{"name":"Anand Kumar","email":"1d08b5946e05cef0db4a400554fc1c110a207fc7@codeaurora.org"},"message":"wcnss: Avoid user buffer overloading for write cal data\n\ncompare size of allocated cal data buffer from heap\nand count bytes provided to write by user to avoid\nheap overflow for write cal data.\n\nChange-Id: Id70c3230f761385489e5e94c613f4519239dfb1f\nCRs-Fixed: 1032174\nSigned-off-by: Anand Kumar <anandkumar@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_sony_msm8930/commits/86361446a854b6c8ae5f7eec9c2aa17095617ca4"},{"sha":"9b273cbe5580cd97c1873b5bb411792ae97b90b2","author":{"name":"Srinivasarao P","email":"5838be2f68866147a6b98dc0567ce3ec89ebe5fc@codeaurora.org"},"message":"perf: duplicate deletion of perf event\n\na malicious app can open a perf event with constraint_duplicate\nbit set, disable the event, and close the fd.  On closing the fd,\nthe perf_release() modification causes the kernel to clean up\nthe event as if it still were enabled, leading to the event\nbeing removed from a list twice.\n\nCRs-Fixed: 977563\nChange-Id: I5fbec3722407d2f3d0ff0d9f7097c5889e31fd62\nSigned-off-by: Srinivasarao P <spathi@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_sony_msm8930/commits/9b273cbe5580cd97c1873b5bb411792ae97b90b2"},{"sha":"266295f694f1d4eef9ca09dd953ac099c517e45a","author":{"name":"Nick Desaulniers","email":"b951273a67bf33267cd4dff69171cdef4e5efbe7@google.com"},"message":"binder: prevent kptr leak by using %pK format specifier\n\nWorks in conjunction with kptr_restrict.\nBug: 30143283\n\nChange-Id: I2b3ce22f4e206e74614d51453a1d59b7080ab05a","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_sony_msm8930/commits/266295f694f1d4eef9ca09dd953ac099c517e45a"},{"sha":"0600608c4596f8e14ea4760b56e6d32a46e54623","author":{"name":"Nick Desaulniers","email":"b951273a67bf33267cd4dff69171cdef4e5efbe7@google.com"},"message":"fs: ext4: disable support for fallocate FALLOC_FL_PUNCH_HOLE\n\nBug: 28760453\nChange-Id: I019c2de559db9e4b95860ab852211b456d78c4ca\nSigned-off-by: Nick Desaulniers <ndesaulniers@google.com>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_sony_msm8930/commits/0600608c4596f8e14ea4760b56e6d32a46e54623"},{"sha":"ee3529e6241ca6a5681ffabd2acb2836246157e0","author":{"name":"Mohamad Ayyash","email":"a63011e6db47c5624401b2ef01e42a84436c0cfe@google.com"},"message":"Don't show empty tag stats for unprivileged uids\n\nBUG: 27577101\nBUG: 27532522\nChange-Id: Iea78a20e11a9b0d132673554434d473918b981f5\nSigned-off-by: Mohamad Ayyash <mkayyash@google.com>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_sony_msm8930/commits/ee3529e6241ca6a5681ffabd2acb2836246157e0"},{"sha":"441b28c52c3c834ca88649cbc4a8aaa3dcbc0078","author":{"name":"kangjie","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"fix infoleak in rtnetlink\n\nthe stack object “map” has a total size of 32 bytes. Its last 4\nbytes are padding generated by compiler. These padding bytes are\nnot initialized and sent out via “nla_put”\n\nBug: 28620102\n\nChange-Id: I13da380c6fe8abca49e3cf9f05293c02b44d2e5e\nSigned-off-by: kangjie <kangjielu@gmail.com>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_sony_msm8930/commits/441b28c52c3c834ca88649cbc4a8aaa3dcbc0078"},{"sha":"ea9141f7f411e859bbca311ef238af125fa9a22b","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"tcp: fix use after free in tcp_xmit_retransmit_queue()\n\nWhen tcp_sendmsg() allocates a fresh and empty skb, it puts it at the\ntail of the write queue using tcp_add_write_queue_tail()\n\nThen it attempts to copy user data into this fresh skb.\n\nIf the copy fails, we undo the work and remove the fresh skb.\n\nUnfortunately, this undo lacks the change done to tp->highest_sack and\nwe can leave a dangling pointer (to a freed skb)\n\nLater, tcp_xmit_retransmit_queue() can dereference this pointer and\naccess freed memory. For regular kernels where memory is not unmapped,\nthis might cause SACK bugs because tcp_highest_sack_seq() is buggy,\nreturning garbage instead of tp->snd_nxt, but with various debug\nfeatures like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel.\n\nThis bug was found by Marco Grassi thanks to syzkaller.\n\nChange-Id: I264f97d30d0a623011d9ee811c63fa0e0c2149a2\nFixes: 6859d49475d4 (\"[TCP]: Abstract tp->highest_sack accessing & point to next skb\")\nReported-by: Marco Grassi <marco.gra@gmail.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>\nCc: Yuchung Cheng <ycheng@google.com>\nCc: Neal Cardwell <ncardwell@google.com>\nAcked-by: Neal Cardwell <ncardwell@google.com>\nReviewed-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_sony_msm8930/commits/ea9141f7f411e859bbca311ef238af125fa9a22b"},{"sha":"6624f8c49215ad7dc138108acbfbfdfd3fcd515a","author":{"name":"David Howells","email":"358fdf7bce8223edb2a0d846104bf62a286894d5@redhat.com"},"message":"KEYS: Fix short sprintf buffer in /proc/keys show function\n\nFix a short sprintf buffer in proc_keys_show().  If the gcc stack protector\nis turned on, this can cause a panic due to stack corruption.\n\nThe problem is that xbuf[] is not big enough to hold a 64-bit timeout\nrendered as weeks:\n\n\t(gdb) p 0xffffffffffffffffULL/(60*60*24*7)\n\t$2 = 30500568904943\n\nThat's 14 chars plus NUL, not 11 chars plus NUL.\n\nExpand the buffer to 16 chars.\n\nI think the unpatched code apparently works if the stack-protector is not\nenabled because on a 32-bit machine the buffer won't be overflowed and on a\n64-bit machine there's a 64-bit aligned pointer at one side and an int that\nisn't checked again on the other side.\n\nThe panic incurred looks something like:\n\nKernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff81352ebe\nCPU: 0 PID: 1692 Comm: reproducer Not tainted 4.7.2-201.fc24.x86_64 #1\nHardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\n 0000000000000086 00000000fbbd2679 ffff8800a044bc00 ffffffff813d941f\n ffffffff81a28d58 ffff8800a044bc98 ffff8800a044bc88 ffffffff811b2cb6\n ffff880000000010 ffff8800a044bc98 ffff8800a044bc30 00000000fbbd2679\nCall Trace:\n [<ffffffff813d941f>] dump_stack+0x63/0x84\n [<ffffffff811b2cb6>] panic+0xde/0x22a\n [<ffffffff81352ebe>] ? proc_keys_show+0x3ce/0x3d0\n [<ffffffff8109f7f9>] __stack_chk_fail+0x19/0x30\n [<ffffffff81352ebe>] proc_keys_show+0x3ce/0x3d0\n [<ffffffff81350410>] ? key_validate+0x50/0x50\n [<ffffffff8134db30>] ? key_default_cmp+0x20/0x20\n [<ffffffff8126b31c>] seq_read+0x2cc/0x390\n [<ffffffff812b6b12>] proc_reg_read+0x42/0x70\n [<ffffffff81244fc7>] __vfs_read+0x37/0x150\n [<ffffffff81357020>] ? security_file_permission+0xa0/0xc0\n [<ffffffff81246156>] vfs_read+0x96/0x130\n [<ffffffff81247635>] SyS_read+0x55/0xc0\n [<ffffffff817eb872>] entry_SYSCALL_64_fastpath+0x1a/0xa4\n\nChange-Id: I0787d5a38c730ecb75d3c08f28f0ab36295d59e7\nReported-by: Ondrej Kozina <okozina@redhat.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nTested-by: Ondrej Kozina <okozina@redhat.com>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_sony_msm8930/commits/6624f8c49215ad7dc138108acbfbfdfd3fcd515a"},{"sha":"4c5c5d15a5db4939191c289cdd3a0af883a32a63","author":{"name":"Linus Torvalds","email":"ead7104581934751970e9decb2db5deb20a9e407@linux-foundation.org"},"message":"BACKPORT: mm: remove gup_flags FOLL_WRITE games from __get_user_pages()\n\ncommit 19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619 upstream.\n\nThis is an ancient bug that was actually attempted to be fixed once\n(badly) by me eleven years ago in commit 4ceb5db9757a (\"Fix\nget_user_pages() race for write access\") but that was then undone due to\nproblems on s390 by commit f33ea7f404e5 (\"fix get_user_pages bug\").\n\nIn the meantime, the s390 situation has long been fixed, and we can now\nfix it by checking the pte_dirty() bit properly (and do it better).  The\ns390 dirty bit was implemented in abf09bed3cce (\"s390/mm: implement\nsoftware dirty bits\") which made it into v3.9.  Earlier kernels will\nhave to look at the page state itself.\n\nAlso, the VM has become more scalable, and what used a purely\ntheoretical race back then has become easier to trigger.\n\nTo fix it, we introduce a new internal FOLL_COW flag to mark the \"yes,\nwe already did a COW\" rather than play racy games with FOLL_WRITE that\nis very fundamental, and then use the pte dirty flag to validate that\nthe FOLL_COW flag is still valid.\n\nChange-Id: I06c15f5676ea9c51e0da139f50f707c2ac279f76\nReported-and-tested-by: Phil \"not Paul\" Oester <kernel@linuxace.com>\nAcked-by: Hugh Dickins <hughd@google.com>\nReviewed-by: Michal Hocko <mhocko@suse.com>\nCc: Andy Lutomirski <luto@kernel.org>\nCc: Kees Cook <keescook@chromium.org>\nCc: Oleg Nesterov <oleg@redhat.com>\nCc: Willy Tarreau <w@1wt.eu>\nCc: Nick Piggin <npiggin@gmail.com>\nCc: Greg Thelen <gthelen@google.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n[wt: s/gup.c/memory.c; s/follow_page_pte/follow_page_mask;\n     s/faultin_page/__get_user_page]\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_sony_msm8930/commits/4c5c5d15a5db4939191c289cdd3a0af883a32a63"},{"sha":"305aed4e04ebb64ed26076c5f9b4daaaa13c7b11","author":{"name":"Julia Lawall","email":"5f26763d26f96d414e30b3f33734591afe022543@lip6.fr"},"message":"Input: aiptek - adjust error-handling code label\n\nAt the point of this error-handling code, aiptek->urb has been allocated,\nand it does not appear to be less necessary to free it here than in the\nerror-handling code just below.\n\nChange-Id: I1b07d7cd62a3df78759dd5a9a5ad27e58350df01\nSigned-off-by: Julia Lawall <Julia.Lawall@lip6.fr>\nSigned-off-by: Dmitry Torokhov <dtor@mail.ru>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_sony_msm8930/commits/305aed4e04ebb64ed26076c5f9b4daaaa13c7b11"},{"sha":"8ca021485ec0b0f6e6be7da2e2b1cc7460b6e186","author":{"name":"Vladis Dronov","email":"41435c47c64e54f8ec26bbc1be6d7972ea4d40bd@redhat.com"},"message":"Input: aiptek - fix crash on detecting device without endpoints\n\nThe aiptek driver crashes in aiptek_probe() when a specially crafted USB\ndevice without endpoints is detected. This fix adds a check that the device\nhas proper configuration expected by the driver. Also an error return value\nis changed to more matching one in one of the error paths.\n\nChange-Id: I02fa4ffcbe9a71948947ef5baeb72632688d9d07\nReported-by: Ralf Spenneberg <ralf@spenneberg.net>\nSigned-off-by: Vladis Dronov <vdronov@redhat.com>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_sony_msm8930/commits/8ca021485ec0b0f6e6be7da2e2b1cc7460b6e186"},{"sha":"d088ceb87185a5d5e38d8d490a1ab3e30bbc4cd9","author":{"name":"Veena Sambasivan","email":"f3dea2712a9835ef757537fe50b353b17bceb98a@codeaurora.org"},"message":"msm: perf: Do not allocate new hw_event if event is duplicate.\n\nDuring a perf_event_enable, kernel/events/core.c calls pmu->add() which\nis platform implementation(arch/arm/kernel/perf_event.c). Due to the\nduplicate constraints, arch/arm/mach-msm/perf_event_msm_krait_l2.c\ndrivers marks the event as OFF but returns TRUE to perf_event.c which\ngoes ahead and allocates the hw_event and enables it.\nSince event is marked OFF, kernel events core will try to enable this event\nagain during next perf_event_enable. Which results in same event enabled\non multiple hw_events. But during the perf_release, event struct is freed\nand only one hw_event is released. This results in dereferencing the\ninvalid pointer and hence the crash.\nFix this by returning error in case of constraint event duplicate. Hence\navoiding the same event programmed on multiple hw event counters.\n\nbug: 28172137\nChange-Id: Ia3360be027dfe87ac753191ffe7e0bc947e72455\nSigned-off-by: Arun KS <arunks@codeaurora.org>\nSigned-off-by: Veena Sambasivan <veenas@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_sony_msm8930/commits/d088ceb87185a5d5e38d8d490a1ab3e30bbc4cd9"},{"sha":"7c46b7bc9c5fffe8ea53df1cadb3b5a00add937c","author":{"name":"Mahesh A Saptasagar","email":"c7c8a57a635ed86f40d484125aa6c1bd041a6586@qti.qualcomm.com"},"message":"wlan: Validate ioctls for valid input length\n\nReturn failure to applications if ioctl is invoked with arguments\nof improper length.\n\nChange-Id: I01589f37996510ee130485ef43e1f36811692e28\nCRs-Fixed: 930542","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_sony_msm8930/commits/7c46b7bc9c5fffe8ea53df1cadb3b5a00add937c"}]}
{"actor":{"display_login":"cm-gerrit"}}