{"push_id":1230177971,"size":18,"distinct_size":18,"ref":"refs/heads/mm2","head":"2525aa1e00dcadb84547ff03b77510da03f80979","before":"82c0cce390edffbc5b550724badee35d88ce028a","commits":[{"sha":"4a37c8b137fc8a2d506ccea93ce7ad6fd5aafdf0","author":{"name":"Kangjie Lu","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"UPSTREAM: USB: usbfs: fix potential infoleak in devio\n\n(cherry pick from commit 681fef8380eb818c0b845fca5d2ab1dcbab114ee)\n\nThe stack object “ci” has a total size of 8 bytes. Its last 3 bytes\nare padding bytes which are not initialized and leaked to userland\nvia “copy_to_user”.\n\nBug: 28619695\nChange-Id: I170754d659d0891c075f85211b5e3970b114f097\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/PureNexusProject/android_kernel_htc_flounder/commits/4a37c8b137fc8a2d506ccea93ce7ad6fd5aafdf0"},{"sha":"95bf4a1f90104dff303c001f7997777288932882","author":{"name":"Kangjie Lu","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"UPSTREAM: net: fix infoleak in rtnetlink\n\n(cherry pick from commit f9d691421747048d814785136d187595483bab4a)\n\ncommit 5f8e44741f9f216e33736ea4ec65ca9ac03036e6 upstream.\n\nThe stack object \"map\" has a total size of 32 bytes. Its last 4\nbytes are padding generated by compiler. These padding bytes are\nnot initialized and sent out via \"nla_put\"\n\nChange-Id: I13da380c6fe8abca49e3cf9f05293c02b44d2e5e\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/PureNexusProject/android_kernel_htc_flounder/commits/95bf4a1f90104dff303c001f7997777288932882"},{"sha":"cc52b1c1c3de9660b50c0bd299bd8d16ec94ef56","author":{"name":"Al Viro","email":"2a537e97523ffee458777df5f34a2f8c9964f945@ZenIV.linux.org.uk"},"message":"UPSTREAM: net: validate the range we feed to iov_iter_init() in sys_sendto/sys_recvfrom\n\n(cherry pick from commit 4de930efc23b92ddf88ce91c405ee645fe6e27ea)\n\nBug: 28759139\nChange-Id: I561a14b514d714838ef539a94275b117d7f475f4\nCc: stable@vger.kernel.org # v3.19\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/PureNexusProject/android_kernel_htc_flounder/commits/cc52b1c1c3de9660b50c0bd299bd8d16ec94ef56"},{"sha":"4e2cd697e717226dd2bcfde776dcd9150fbfc387","author":{"name":"Mark Salyzyn","email":"4814ffc71be21311f04ef34122c19152acc840c4@google.com"},"message":"flounder_defconfig: restrict access to perf events\n\n(cherry pick from commit d042dd6db92cd82088ce1b8e0d8278be774a5d3e)\n\nThe kernel.perf_event_paranoid_sysctl is set to 3 by default.\nNo unprivileged use of the perf_event_open syscall will be\npermitted unless it is changed.\n\nSigned-off-by: Mark Salyzyn <salyzyn@google.com>\nBug: 29054680\nBug: 29119870\nChange-Id: I446a21bac48f6c18ab652772c400ae13b7454764","distinct":true,"url":"https://api.github.com/repos/PureNexusProject/android_kernel_htc_flounder/commits/4e2cd697e717226dd2bcfde776dcd9150fbfc387"},{"sha":"22454d5bcfaa951168901e02156077c732f43d11","author":{"name":"Praveen Kumar Reddy M.V","email":"535deab358d2c822960ac0b5ddb9dad0f4fe2f98@nvidia.com"},"message":"tegra: nvavp: Fix buffer overflow issue\n\nFixed possible buffer overflow issue in func\nnvavp_pushbuffer_update().\n\nBug: 28871433\nNvBug 1774401\n\nChange-Id: Id0dec1cbf91d492335d0809c3c0bf146f6cb9d3d\nSigned-off-by: Praveen Kumar Reddy M.V. <pkreddy@nvidia.com>\n(cherry picked from commit ee1e48fa39e58bff973987b3c12f751a530c567c)\nSigned-off-by: Xia Yang <xiay@nvidia.com>\n(cherry picked from commit 009c238499cf4a356aa12462d0841dc63178ecb2)","distinct":true,"url":"https://api.github.com/repos/PureNexusProject/android_kernel_htc_flounder/commits/22454d5bcfaa951168901e02156077c732f43d11"},{"sha":"5daf4a5354583a70b810d011fa31a2927387cb7c","author":{"name":"Soumen Kumar Dey","email":"0242020441c83fd5dfcfc423ce4aefdd25858320@nvidia.com"},"message":"nvavp: Add mutex lock for all avp submit\n\nAdd mutex lock for nvavp_submit to avoid race condition.\n\nBug: 28919417\nNvBug 1775299\n\nChange-Id: I11a66a58a1f048d6a0ee5aa949f852bfef56dc07\nSigned-off-by: Soumen Kumar Dey <sdey@nvidia.com>\n(cherry picked from commit 5e455460bbd61fc84ea6e4283d4af099fc7a1a50)\nSigned-off-by: Xia Yang <xiay@nvidia.com>\n(cherry picked from commit 1d11adf92ee25aa090e5faab18bb86b7154d3f62)","distinct":true,"url":"https://api.github.com/repos/PureNexusProject/android_kernel_htc_flounder/commits/5daf4a5354583a70b810d011fa31a2927387cb7c"},{"sha":"4f386bf30204d902593eb39fa4692390c3ac6880","author":{"name":"Dan Carpenter","email":"60b2bf2bc0bec4ca4a4b046ca7ef9255248abff8@oracle.com"},"message":"UPSTREAM: ALSA: compress: fix an integer overflow check\n\nI previously added an integer overflow check here but looking at it now,\nit's still buggy.\n\nThe bug happens in snd_compr_allocate_buffer().  We multiply\n\".fragments\" and \".fragment_size\" and that doesn't overflow but then we\nsave it in an unsigned int so it truncates the high bits away and we\nallocate a smaller than expected size.\n\nFixes: b35cc8225845 ('ALSA: compress_core: integer overflow in snd_compr_allocate_buffer()')\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nBug: 28592007\nChange-Id: I3ef098ada955449fdd109d37b2176da849dd26af\nSigned-off-by: Thierry Strudel <tstrudel@google.com>\n(cherry picked from commit 6215e5ede23285ddfee10d2e4ba0cc2d4c046205)","distinct":true,"url":"https://api.github.com/repos/PureNexusProject/android_kernel_htc_flounder/commits/4f386bf30204d902593eb39fa4692390c3ac6880"},{"sha":"55f8abc4a1a1cdd059ec7a81b35765713ca68bef","author":{"name":"Kangjie Lu","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"UPSTREAM: ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS\n\nThe stack object “tread” has a total size of 32 bytes. Its field\n“event” and “val” both contain 4 bytes padding. These 8 bytes\npadding bytes are sent to user without being initialized.\n\nBug: 28980557\nChange-Id: Ib66cfcc1e36025255d7f518f3df2c39a21858886\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Siqi Lin <siqilin@google.com>\n(cherry picked from commit cec8f96e49d9be372fdb0c3836dcf31ec71e457e)","distinct":true,"url":"https://api.github.com/repos/PureNexusProject/android_kernel_htc_flounder/commits/55f8abc4a1a1cdd059ec7a81b35765713ca68bef"},{"sha":"b420b930aa28cfe107d9309eaac06a5d3fc1874c","author":{"name":"Kangjie Lu","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"UPSTREAM: ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt\n\nThe stack object “r1” has a total size of 32 bytes. Its field\n“event” and “val” both contain 4 bytes padding. These 8 bytes\npadding bytes are sent to user without being initialized.\n\nBug: 28980217\nChange-Id: I2bef279bbaa1f20ea831d364b3a4a09a27f07025\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Siqi Lin <siqilin@google.com>\n(cherry picked from commit e4ec8cc8039a7063e24204299b462bd1383184a5)","distinct":true,"url":"https://api.github.com/repos/PureNexusProject/android_kernel_htc_flounder/commits/b420b930aa28cfe107d9309eaac06a5d3fc1874c"},{"sha":"70f93e7ebbaee008cc70ff3e86bcbcbfe141afac","author":{"name":"Kangjie Lu","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"UPSTREAM: ALSA: timer: Fix leak in events via snd_timer_user_ccallback\n\nThe stack object “r1” has a total size of 32 bytes. Its field\n“event” and “val” both contain 4 bytes padding. These 8 bytes\npadding bytes are sent to user without being initialized.\n\nBug: 28980217\nChange-Id: Iff69ca708e0022ce9301efae798798b9bfcf9e25\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Siqi Lin <siqilin@google.com>\n(cherry picked from commit a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6)","distinct":true,"url":"https://api.github.com/repos/PureNexusProject/android_kernel_htc_flounder/commits/70f93e7ebbaee008cc70ff3e86bcbcbfe141afac"},{"sha":"bca99ca5d4dc25de49455725f154cf7a7e78a4f0","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"ipv6: add complete rcu protection around np->opt\n\n[ Upstream commit 45f6fad84cc305103b28d73482b344d7f5b76f39 ]\n\nThis patch addresses multiple problems :\n\nUDP/RAW sendmsg() need to get a stable struct ipv6_txoptions\nwhile socket is not locked : Other threads can change np->opt\nconcurrently. Dmitry posted a syzkaller\n(http://github.com/google/syzkaller) program desmonstrating\nuse-after-free.\n\nStarting with TCP/DCCP lockless listeners, tcp_v6_syn_recv_sock()\nand dccp_v6_request_recv_sock() also need to use RCU protection\nto dereference np->opt once (before calling ipv6_dup_options())\n\nThis patch adds full RCU protection to np->opt\n\nBUG: 28746669\n\nChange-Id: I83ba467e37fc49caf9e50e6ff3e4f13ce2538adc\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/PureNexusProject/android_kernel_htc_flounder/commits/bca99ca5d4dc25de49455725f154cf7a7e78a4f0"},{"sha":"ed00374f519f09a2fb8065f8523e311cc7b92309","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"UPSTREAM: ALSA: timer: Fix race among timer ioctls\n\nALSA timer ioctls have an open race and this may lead to a\nuse-after-free of timer instance object.  A simplistic fix is to make\neach ioctl exclusive.  We have already tread_sem for controlling the\ntread, and extend this as a global mutex to be applied to each ioctl.\n\nThe downside is, of course, the worse concurrency.  But these ioctls\naren't to be parallel accessible, in anyway, so it should be fine to\nserialize there.\n\nBug: 28694392\nChange-Id: I1ac52f1cba5e7408fd88c8fc1c30ca2e83967ebb\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Siqi Lin <siqilin@google.com>\n(cherry picked from commit f368027a49a751d6ff4ee9e3f9961f35bb4fede)","distinct":true,"url":"https://api.github.com/repos/PureNexusProject/android_kernel_htc_flounder/commits/ed00374f519f09a2fb8065f8523e311cc7b92309"},{"sha":"bc0ff3098c0c4e807c6a3373b68773a9931b8869","author":{"name":"Mark Salyzyn","email":"4814ffc71be21311f04ef34122c19152acc840c4@google.com"},"message":"ANDROID: gk20a: variable used uninitialized error\n\nResolve build error utilizing updated compilers,\nprint errors if queue is corrupted.\n\nBug: 25450439\nSigned-off-by: Mark Salyzyn <salyzyn@google.com>\nChange-Id: I5d84ae62c13a7c38ae6aa6edd2a1c6e00f1a25db","distinct":true,"url":"https://api.github.com/repos/PureNexusProject/android_kernel_htc_flounder/commits/bc0ff3098c0c4e807c6a3373b68773a9931b8869"},{"sha":"48cf16b550297c59b28a21df0e7ebba8f25a6344","author":{"name":"Ben Hutchings","email":"9c85637c38b80821c7bd8a03bde7b59da81ab77d@decadent.org.uk"},"message":"BACKPORT: perf tools: Document the perf sysctls\n\nperf_event_paranoid was only documented in source code and a perf error\nmessage.  Copy the documentation from the error message to\nDocumentation/sysctl/kernel.txt.\n\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: linux-doc@vger.kernel.org\nLink: http://lkml.kernel.org/r/20160119213515.GG2637@decadent.org.uk\n[ Remove reference to external Documentation file, provide info inline, as before ]\nSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>\n\nBug: 29054680\nChange-Id: I13e73cfb2ad761c94762d0c8196df7725abdf5c5","distinct":true,"url":"https://api.github.com/repos/PureNexusProject/android_kernel_htc_flounder/commits/48cf16b550297c59b28a21df0e7ebba8f25a6344"},{"sha":"b27e6111e5149624717ab4d73c64e4f221fdadd0","author":{"name":"Jeff Vander Stoep","email":"3c7c1df314a95c4ce859cc668e778f3e3567dbe8@google.com"},"message":"FROMLIST: security,perf: Allow further restriction of perf_event_open\n\nWhen kernel.perf_event_open is set to 3 (or greater), disallow all\naccess to performance events by users without CAP_SYS_ADMIN.\nAdd a Kconfig symbol CONFIG_SECURITY_PERF_EVENTS_RESTRICT that\nmakes this value the default.\n\nThis is based on a similar feature in grsecurity\n(CONFIG_GRKERNSEC_PERF_HARDEN).  This version doesn't include making\nthe variable read-only.  It also allows enabling further restriction\nat run-time regardless of whether the default is changed.\n\nhttps://lkml.org/lkml/2016/1/11/587\n\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\n\nBug: 29054680\nChange-Id: Iff5bff4fc1042e85866df9faa01bce8d04335ab8","distinct":true,"url":"https://api.github.com/repos/PureNexusProject/android_kernel_htc_flounder/commits/b27e6111e5149624717ab4d73c64e4f221fdadd0"},{"sha":"91f55d36b40d4efddf159cf1db28f9a0b982ab4a","author":{"name":"Jeff Vander Stoep","email":"3c7c1df314a95c4ce859cc668e778f3e3567dbe8@google.com"},"message":"ANDROID: restrict access to perf events\n\nAdd:\nCONFIG_SECURITY_PERF_EVENTS_RESTRICT=y\n\nto android-base.cfg\n\nThe kernel.perf_event_paranoid sysctl is set to 3 by default.\nNo unprivileged use of the perf_event_open syscall will be\npermitted unless it is changed.\n\nBug: 29054680\nChange-Id: Ie7512259150e146d8e382dc64d40e8faaa438917","distinct":true,"url":"https://api.github.com/repos/PureNexusProject/android_kernel_htc_flounder/commits/91f55d36b40d4efddf159cf1db28f9a0b982ab4a"},{"sha":"21b359193429f10d553aa98c28e967729f9a0a3d","author":{"name":"Oliver Neukum","email":"af55dedc0d50bd691239218b486da844e4a16906@suse.com"},"message":"UPSTREAM: usbnet: cleanup after bind() in probe()\n\n(cherry pick from commit 1666984c8625b3db19a9abc298931d35ab7bc64b)\n\nIn case bind() works, but a later error forces bailing\nin probe() in error cases work and a timer may be scheduled.\nThey must be killed. This fixes an error case related to\nthe double free reported in\nhttp://www.spinics.net/lists/netdev/msg367669.html\nand needs to go on top of Linus' fix to cdc-ncm.\n\nSigned-off-by: Oliver Neukum <ONeukum@suse.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nBug: 28744625\nChange-Id: Iea3e44261c5d1849e12ccf198a73157f0a8f3653","distinct":true,"url":"https://api.github.com/repos/PureNexusProject/android_kernel_htc_flounder/commits/21b359193429f10d553aa98c28e967729f9a0a3d"},{"sha":"2525aa1e00dcadb84547ff03b77510da03f80979","author":{"name":"beanstown106","email":"66ec548cacc11a88c7b522c6f7568dd195ae8c63@gmail.com"},"message":"Merge branch 'android-tegra-flounder-3.10-marshmallow-mr2' of https://android.googlesource.com/kernel/tegra into mm2","distinct":true,"url":"https://api.github.com/repos/PureNexusProject/android_kernel_htc_flounder/commits/2525aa1e00dcadb84547ff03b77510da03f80979"}]}
{"actor":{"display_login":"beanstown106"}}