{"push_id":1219787600,"size":76,"distinct_size":76,"ref":"refs/heads/32.2.A.0.253_RyTek","head":"7af3eb6c824ab713f6f8390ccfde02a64f4263c1","before":"14240b2c76d186a3d897b8547655d6241411773b","commits":[{"sha":"d8857bd24ccbdfe40f8ef98f0b88b6d3a52554d6","author":{"name":"RyTek","email":"42991bb8fb19d0c99aac44966730928c391ac567@outlook.com"},"message":"msm8994 overclocking","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/d8857bd24ccbdfe40f8ef98f0b88b6d3a52554d6"},{"sha":"ebd4bb7151a6ead18ab7f070e6bd03132de156c4","author":{"name":"RyTek","email":"42991bb8fb19d0c99aac44966730928c391ac567@outlook.com"},"message":"Update common_diffconfig","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/ebd4bb7151a6ead18ab7f070e6bd03132de156c4"},{"sha":"1c889ee8d793f1e2b15a389d440063d4d9dafe2a","author":{"name":"Sabrina Dubroca","email":"4970d9e510e008c61ce99b43933c9aaa332864d8@queasysnail.net"},"message":"net: add length argument to skb_copy_and_csum_datagram_iovec\n\nWithout this length argument, we can read past the end of the iovec in\nmemcpy_toiovec because we have no way of knowing the total length of the\niovec's buffers.\n\nThis is needed for stable kernels where 89c22d8c3b27 (\"net: Fix skb\ncsum races when peeking\") has been backported but that don't have the\nioviter conversion, which is almost all the stable trees <= 3.18.\n\nThis also fixes a kernel crash for NFS servers when the client uses\n -onfsvers=3,proto=udp to mount the export.\n\nSigned-off-by: Sabrina Dubroca <sd@queasysnail.net>\nReviewed-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\n[bwh: Backported to 3.2: adjust context in include/linux/skbuff.h]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\n(cherry picked from commit 127500d724f8c43f452610c9080444eedb5eaa6c)\n\nChange-Id: I711c8dac5686c8b18cfea4262e24731ea695701b\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/1c889ee8d793f1e2b15a389d440063d4d9dafe2a"},{"sha":"4ada35c7a98bfc1f9fa11079233517c5a6027a39","author":{"name":"Benjamin Randazzo","email":"1732970c1f51020a107e1f6d2aa981e54dceaf3d@randazzo.fr"},"message":"md: use kzalloc() when bitmap is disabled\n\ncommit b6878d9e03043695dbf3fa1caa6dfc09db225b16 upstream.\n\nIn drivers/md/md.c get_bitmap_file() uses kmalloc() for creating a\nmdu_bitmap_file_t called \"file\".\n\n5769         file = kmalloc(sizeof(*file), GFP_NOIO);\n5770         if (!file)\n5771                 return -ENOMEM;\n\nThis structure is copied to user space at the end of the function.\n\n5786         if (err == 0 &&\n5787             copy_to_user(arg, file, sizeof(*file)))\n5788                 err = -EFAULT\n\nBut if bitmap is disabled only the first byte of \"file\" is initialized\nwith zero, so it's possible to read some bytes (up to 4095) of kernel\nspace memory from user space. This is an information leak.\n\n5775         /* bitmap disabled, zero the first byte and copy out */\n5776         if (!mddev->bitmap_info.file)\n5777                 file->pathname[0] = '\\0';\n\nChange-Id: I8b8d2d5175c74576022eb3f69a465de0d57b866e\nSigned-off-by: Benjamin Randazzo <benjamin@randazzo.fr>\nSigned-off-by: NeilBrown <neilb@suse.com>\n[bwh: Backported to 3.2: patch both possible allocation calls]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/4ada35c7a98bfc1f9fa11079233517c5a6027a39"},{"sha":"c7c506952341c3301f11d88324c29c76b9eaf932","author":{"name":"David Howells","email":"358fdf7bce8223edb2a0d846104bf62a286894d5@redhat.com"},"message":"KEYS: Fix handling of stored error in a negatively instantiated user key\n\ncommit 096fe9eaea40a17e125569f9e657e34cdb6d73bd upstream.\n\nIf a user key gets negatively instantiated, an error code is cached in the\npayload area.  A negatively instantiated key may be then be positively\ninstantiated by updating it with valid data.  However, the ->update key\ntype method must be aware that the error code may be there.\n\nThe following may be used to trigger the bug in the user key type:\n\n    keyctl request2 user user \"\" @u\n    keyctl add user user \"a\" @u\n\nwhich manifests itself as:\n\n\tBUG: unable to handle kernel paging request at 00000000ffffff8a\n\tIP: [<ffffffff810a376f>] __call_rcu.constprop.76+0x1f/0x280 kernel/rcu/tree.c:3046\n\tPGD 7cc30067 PUD 0\n\tOops: 0002 [#1] SMP\n\tModules linked in:\n\tCPU: 3 PID: 2644 Comm: a.out Not tainted 4.3.0+ #49\n\tHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n\ttask: ffff88003ddea700 ti: ffff88003dd88000 task.ti: ffff88003dd88000\n\tRIP: 0010:[<ffffffff810a376f>]  [<ffffffff810a376f>] __call_rcu.constprop.76+0x1f/0x280\n\t [<ffffffff810a376f>] __call_rcu.constprop.76+0x1f/0x280 kernel/rcu/tree.c:3046\n\tRSP: 0018:ffff88003dd8bdb0  EFLAGS: 00010246\n\tRAX: 00000000ffffff82 RBX: 0000000000000000 RCX: 0000000000000001\n\tRDX: ffffffff81e3fe40 RSI: 0000000000000000 RDI: 00000000ffffff82\n\tRBP: ffff88003dd8bde0 R08: ffff88007d2d2da0 R09: 0000000000000000\n\tR10: 0000000000000000 R11: ffff88003e8073c0 R12: 00000000ffffff82\n\tR13: ffff88003dd8be68 R14: ffff88007d027600 R15: ffff88003ddea700\n\tFS:  0000000000b92880(0063) GS:ffff88007fd00000(0000) knlGS:0000000000000000\n\tCS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n\tCR2: 00000000ffffff8a CR3: 000000007cc5f000 CR4: 00000000000006e0\n\tStack:\n\t ffff88003dd8bdf0 ffffffff81160a8a 0000000000000000 00000000ffffff82\n\t ffff88003dd8be68 ffff88007d027600 ffff88003dd8bdf0 ffffffff810a39e5\n\t ffff88003dd8be20 ffffffff812a31ab ffff88007d027600 ffff88007d027620\n\tCall Trace:\n\t [<ffffffff810a39e5>] kfree_call_rcu+0x15/0x20 kernel/rcu/tree.c:3136\n\t [<ffffffff812a31ab>] user_update+0x8b/0xb0 security/keys/user_defined.c:129\n\t [<     inline     >] __key_update security/keys/key.c:730\n\t [<ffffffff8129e5c1>] key_create_or_update+0x291/0x440 security/keys/key.c:908\n\t [<     inline     >] SYSC_add_key security/keys/keyctl.c:125\n\t [<ffffffff8129fc21>] SyS_add_key+0x101/0x1e0 security/keys/keyctl.c:60\n\t [<ffffffff8185f617>] entry_SYSCALL_64_fastpath+0x12/0x6a arch/x86/entry/entry_64.S:185\n\nNote the error code (-ENOKEY) in EDX.\n\nA similar bug can be tripped by:\n\n    keyctl request2 trusted user \"\" @u\n    keyctl add trusted user \"a\" @u\n\nThis should also affect encrypted keys - but that has to be correctly\nparameterised or it will fail with EINVAL before getting to the bit that\nwill crashes.\n\nChange-Id: I6bb9e983c2d5aa37f5cd2ba78436336311c2fe61\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nAcked-by: Mimi Zohar <zohar@linux.vnet.ibm.com>\nSigned-off-by: James Morris <james.l.morris@oracle.com>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/c7c506952341c3301f11d88324c29c76b9eaf932"},{"sha":"da607cab372b653c358a52489f932cb5f9a3994a","author":{"name":"Marcelo Leitner","email":"b3eee6f47d823c4a37944c0e1e38042365283bcf@redhat.com"},"message":"ipv6: addrconf: validate new MTU before applying it\n\n[ Upstream commit 77751427a1ff25b27d47a4c36b12c3c8667855ac ]\n\nCurrently we don't check if the new MTU is valid or not and this allows\none to configure a smaller than minimum allowed by RFCs or even bigger\nthan interface own MTU, which is a problem as it may lead to packet\ndrops.\n\nIf you have a daemon like NetworkManager running, this may be exploited\nby remote attackers by forging RA packets with an invalid MTU, possibly\nleading to a DoS. (NetworkManager currently only validates for values\ntoo small, but not for too big ones.)\n\nThe fix is just to make sure the new value is valid. That is, between\nIPV6_MIN_MTU and interface's MTU.\n\nNote that similar check is already performed at\nndisc_router_discovery(), for when kernel itself parses the RA.\n\nChange-Id: I81435e47e768a83f312b8ae2a2cfb9ace91dfcc4\nSigned-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com>\nSigned-off-by: Sabrina Dubroca <sd@queasysnail.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/da607cab372b653c358a52489f932cb5f9a3994a"},{"sha":"b8eb68242d0ce6a763e4fa14a160f172f5297d95","author":{"name":"David S. Miller","email":"79caf591e37e1438a2d55ae59670d5cd0d717764@davemloft.net"},"message":"bluetooth: Validate socket address length in sco_sock_bind().\n\nChange-Id: I890640975f1af64f71947b6a1820249e08f6375b\nSigned-off-by: David S. Miller <davem@davemloft.net>\n(cherry picked from commit b257dc35e191b065f5dc462831e6a68626e1c771)","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/b8eb68242d0ce6a763e4fa14a160f172f5297d95"},{"sha":"122654bbbc177397a156f95450c60ea8036fd088","author":{"name":"Andrey Konovalov","email":"acba6f9b010367f452595b80d6e1782629aa36cc@gmail.com"},"message":"ALSA: usb-audio: avoid freeing umidi object twice\n\n[ Upstream commit 07d86ca93db7e5cdf4743564d98292042ec21af7 ]\n\nThe 'umidi' object will be free'd on the error path by snd_usbmidi_free()\nwhen tearing down the rawmidi interface. So we shouldn't try to free it\nin snd_usbmidi_create() after having registered the rawmidi interface.\n\nFound by KASAN.\n\nChange-Id: I85e5a246c6564fe120c589b325d7bb9943b97cff\nSigned-off-by: Andrey Konovalov <andreyknvl@gmail.com>\nAcked-by: Clemens Ladisch <clemens@ladisch.de>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/122654bbbc177397a156f95450c60ea8036fd088"},{"sha":"a409a5a85d7990287f8ba149e892befe32dfa70a","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: timer: Fix double unlink of active_list\n\n[ Upstream commit ee8413b01045c74340aa13ad5bdf905de32be736 ]\n\nALSA timer instance object has a couple of linked lists and they are\nunlinked unconditionally at snd_timer_stop().  Meanwhile\nsnd_timer_interrupt() unlinks it, but it calls list_del() which leaves\nthe element list itself unchanged.  This ends up with unlinking twice,\nand it was caught by syzkaller fuzzer.\n\nThe fix is to use list_del_init() variant properly there, too.\n\nChange-Id: I63cb9be7c2b391389079b834aa73212a737a8a61\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/a409a5a85d7990287f8ba149e892befe32dfa70a"},{"sha":"2d6f5f8edc0353eaa1625ab8cd37072e4b8ba8a6","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: timer: Fix race among timer ioctls\n\ncommit af368027a49a751d6ff4ee9e3f9961f35bb4fede upstream.\n\nALSA timer ioctls have an open race and this may lead to a\nuse-after-free of timer instance object.  A simplistic fix is to make\neach ioctl exclusive.  We have already tread_sem for controlling the\ntread, and extend this as a global mutex to be applied to each ioctl.\n\nThe downside is, of course, the worse concurrency.  But these ioctls\naren't to be parallel accessible, in anyway, so it should be fine to\nserialize there.\n\nChange-Id: I7f2b1c9912350189480094a23bf58f5c7fffaf69\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/2d6f5f8edc0353eaa1625ab8cd37072e4b8ba8a6"},{"sha":"da2e9fb6f0428c3d40d0812a4169fcac9fd9d51e","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"UPSTREAM: ALSA: timer: Harden slave timer list handling\n\n(cherry pick from commit b5a663aa426f4884c71cd8580adae73f33570f0d)\n\nA slave timer instance might be still accessible in a racy way while\noperating the master instance as it lacks of locking.  Since the\nmaster operation is mostly protected with timer->lock, we should cope\nwith it while changing the slave instance, too.  Also, some linked\nlists (active_list and ack_list) of slave instances aren't unlinked\nimmediately at stopping or closing, and this may lead to unexpected\naccesses.\n\nThis patch tries to address these issues.  It adds spin lock of\ntimer->lock (either from master or slave, which is equivalent) in a\nfew places.  For avoiding a deadlock, we ensure that the global\nslave_active_lock is always locked at first before each timer lock.\n\nAlso, ack and active_list of slave instances are properly unlinked at\nsnd_timer_stop() and snd_timer_close().\n\nLast but not least, remove the superfluous call of _snd_timer_stop()\nat removing slave links.  This is a noop, and calling it may confuse\nreaders wrt locking.  Further cleanup will follow in a later patch.\n\nActually we've got reports of use-after-free by syzkaller fuzzer, and\nthis hopefully fixes these issues.\n\nChange-Id: I8113daeefbe62e27f54e1560e66a972046caed14\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nBug: 26636060","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/da2e9fb6f0428c3d40d0812a4169fcac9fd9d51e"},{"sha":"8340d6d1b2fe1b01e6b45006ffbf400225cab7d1","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: hrtimer: Fix stall by hrtimer_cancel()\n\nhrtimer_cancel() waits for the completion from the callback, thus it\nmust not be called inside the callback itself.  This was already a\nproblem in the past with ALSA hrtimer driver, and the early commit\n[fcfdebe70759: ALSA: hrtimer - Fix lock-up] tried to address it.\n\nHowever, the previous fix is still insufficient: it may still cause a\nlockup when the ALSA timer instance reprograms itself in its callback.\nThen it invokes the start function even in snd_timer_interrupt() that\nis called in hrtimer callback itself, results in a CPU stall.  This is\nno hypothetical problem but actually triggered by syzkaller fuzzer.\n\nThis patch tries to fix the issue again.  Now we call\nhrtimer_try_to_cancel() at both start and stop functions so that it\nwon't fall into a deadlock, yet giving some chance to cancel the queue\nif the functions have been called outside the callback.  The proper\nhrtimer_cancel() is called in anyway at closing, so this should be\nenough.\n\nChange-Id: I7b16144b6974be65c6cb68a2cef5eb98f6907739\nReported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/8340d6d1b2fe1b01e6b45006ffbf400225cab7d1"},{"sha":"f2d61484693895c1327f93d6f3c4ea3b19492c12","author":{"name":"Oliver Neukum","email":"af55dedc0d50bd691239218b486da844e4a16906@suse.com"},"message":"usbnet: cleanup after bind() in probe()\n\ncommit 1666984c8625b3db19a9abc298931d35ab7bc64b upstream.\n\nIn case bind() works, but a later error forces bailing\nin probe() in error cases work and a timer may be scheduled.\nThey must be killed. This fixes an error case related to\nthe double free reported in\nhttp://www.spinics.net/lists/netdev/msg367669.html\nand needs to go on top of Linus' fix to cdc-ncm.\n\nChange-Id: Icf39706e5182b109c3c891cbe984de1e14b450e1\nSigned-off-by: Oliver Neukum <ONeukum@suse.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/f2d61484693895c1327f93d6f3c4ea3b19492c12"},{"sha":"84a392ade7f836919baa6a9d15d3b0dc07cfe05a","author":{"name":"Oliver Neukum","email":"af55dedc0d50bd691239218b486da844e4a16906@suse.com"},"message":"USB: cdc-acm: more sanity checking\n\nAn attack has become available which pretends to be a quirky\ndevice circumventing normal sanity checks and crashes the kernel\nby an insufficient number of interfaces. This patch adds a check\nto the code path for quirky devices.\n\nBug: 28259323\nChange-Id: Ic94fd0edb7af353aae011a8b55b6acd26096164d\nSigned-off-by: Oliver Neukum <ONeukum@suse.com>\nCC: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/84a392ade7f836919baa6a9d15d3b0dc07cfe05a"},{"sha":"2487cfc2dc27eca9ff777953f733dace41851692","author":{"name":"David S. Miller","email":"79caf591e37e1438a2d55ae59670d5cd0d717764@davemloft.net"},"message":"ipv4: Don't do expensive useless work during inetdev destroy.\n\nWhen an inetdev is destroyed, every address assigned to the interface\nis removed.  And in this scenerio we do two pointless things which can\nbe very expensive if the number of assigned interfaces is large:\n\n1) Address promotion.  We are deleting all addresses, so there is no\n   point in doing this.\n\n2) A full nf conntrack table purge for every address.  We only need to\n   do this once, as is already caught by the existing\n   masq_dev_notifier so masq_inet_event() can skip this.\n\nChange-Id: I4b2a3ed665543728451c21465fb90ec89f739135\nReported-by: Solar Designer <solar@openwall.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nTested-by: Cyrill Gorcunov <gorcunov@openvz.org>","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/2487cfc2dc27eca9ff777953f733dace41851692"},{"sha":"de5633669dac512852e03e483146629091748535","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: x_tables: fix unconditional helper\n\nBen Hawkes says:\n\n In the mark_source_chains function (net/ipv4/netfilter/ip_tables.c) it\n is possible for a user-supplied ipt_entry structure to have a large\n next_offset field. This field is not bounds checked prior to writing a\n counter value at the supplied offset.\n\nProblem is that mark_source_chains should not have been called --\nthe rule doesn't have a next entry, so its supposed to return\nan absolute verdict of either ACCEPT or DROP.\n\nHowever, the function conditional() doesn't work as the name implies.\nIt only checks that the rule is using wildcard address matching.\n\nHowever, an unconditional rule must also not be using any matches\n(no -m args).\n\nThe underflow validator only checked the addresses, therefore\npassing the 'unconditional absolute verdict' test, while\nmark_source_chains also tested for presence of matches, and thus\nproceeeded to the next (not-existent) rule.\n\nUnify this so that all the callers have same idea of 'unconditional rule'.\n\nChange-Id: Id2b4779f2e41b1a82b1d266bb9e11118c4428afc\nReported-by: Ben Hawkes <hawkes@google.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/de5633669dac512852e03e483146629091748535"},{"sha":"c7836afcd0f9ef1f7599a3ff6256cfa38db58b1b","author":{"name":"Vladis Dronov","email":"41435c47c64e54f8ec26bbc1be6d7972ea4d40bd@redhat.com"},"message":"Input: aiptek - fix crash on detecting device without endpoints\n\nThe aiptek driver crashes in aiptek_probe() when a specially crafted USB\ndevice without endpoints is detected. This fix adds a check that the device\nhas proper configuration expected by the driver. Also an error return value\nis changed to more matching one in one of the error paths.\n\nChange-Id: I02fa4ffcbe9a71948947ef5baeb72632688d9d07\nReported-by: Ralf Spenneberg <ralf@spenneberg.net>\nSigned-off-by: Vladis Dronov <vdronov@redhat.com>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/c7836afcd0f9ef1f7599a3ff6256cfa38db58b1b"},{"sha":"04db3b79f62f12130bdedfdd9200cdff7aaececc","author":{"name":"Kangjie Lu","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS\n\nThe stack object “tread” has a total size of 32 bytes. Its field\n“event” and “val” both contain 4 bytes padding. These 8 bytes\npadding bytes are sent to user without being initialized.\n\nChange-Id: Ibf2868136a538eed0f2e75395a5f14a8608dd86d\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/04db3b79f62f12130bdedfdd9200cdff7aaececc"},{"sha":"10e74e32a684bbb47cce6d1be2ba072d798757b3","author":{"name":"Kangjie Lu","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"ALSA: timer: Fix leak in events via snd_timer_user_ccallback\n\nThe stack object “r1” has a total size of 32 bytes. Its field\n“event” and “val” both contain 4 bytes padding. These 8 bytes\npadding bytes are sent to user without being initialized.\n\nChange-Id: I5ece63432f6ca6251fa31c046c211c8c03313a59\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/10e74e32a684bbb47cce6d1be2ba072d798757b3"},{"sha":"0b7d95da7b4a6d482621254031482ba441fc8007","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: x_tables: check for size overflow\n\nBen Hawkes says:\n integer overflow in xt_alloc_table_info, which on 32-bit systems can\n lead to small structure allocation and a copy_from_user based heap\n corruption.\n\nChange-Id: I13c554c630651a37e3f6a195e9a5f40cddcb29a1\nReported-by: Ben Hawkes <hawkes@google.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":true,"url":"https://api.github.com/repos/RyTekk/sony_kernel_kitakami_8994/commits/0b7d95da7b4a6d482621254031482ba441fc8007"}]}
{"actor":{"display_login":"RyTekk"}}