{"push_id":1214813352,"size":12,"distinct_size":12,"ref":"refs/heads/caf/3.10/caf/aosp-new/android-msm-seed-3.10-marshmallow-mr2","head":"5eccc5e94789b19ebe239305c7ea2168520cefa7","before":"8a5d2914c3649e2a83be48957724fd181d00dc1e","commits":[{"sha":"2eb06ce8f63203f311e499e4b0682ae08446096f","author":{"name":"Mohamad Ayyash","email":"a63011e6db47c5624401b2ef01e42a84436c0cfe@google.com"},"message":"Don't show empty tag stats for unprivileged uids\n\nBUG: 27577101\nBUG: 27532522\nSigned-off-by: Mohamad Ayyash <mkayyash@google.com>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/2eb06ce8f63203f311e499e4b0682ae08446096f"},{"sha":"d5866ed66dc8a9ef7fcc3f987b39c2bc32566b0f","author":{"name":"Veena Sambasivan","email":"f3dea2712a9835ef757537fe50b353b17bceb98a@codeaurora.org"},"message":"usb: f_serial: Check for SMD data length in GSER_IOCTL\n\nIf user tries to send SMD data more than the driver\nbuffer can handle then fail the same and print\nerror message. This smd_write is exposed to userspace\nthrough ioctl using a misc device.\n\nBug: 27657963\n\nChange-Id: Ie8a1c1c0799cd10cef512ad6b1e1e95001dd43b2\nSigned-off-by: Manu Gautam <mgautam@codeaurora.org>\nSigned-off-by: Veena Sambasivan <veenas@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/d5866ed66dc8a9ef7fcc3f987b39c2bc32566b0f"},{"sha":"5be72149e72cff6c5d0d48c92dac255d20074465","author":{"name":"Rajesh Bondugula","email":"3062b73d3088701829fade9d0214b3b9a768fa40@codeaurora.org"},"message":"msm: camera: sensor: Validate step_boundary\n\nstep_boundary can take values upto the total_steps\nValidate the step_boundary before consuming it.\nConvert the type of step_index and region_index to uint16_t\nstep_index and region_index cannot be negative.\n\nCRs-Fixed: 1001092\nChange-Id: I1f23fd6f28bb897824a1ef99a8873b9f986eee70\nSigned-off-by: Rajesh Bondugula <rajeshb@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/5be72149e72cff6c5d0d48c92dac255d20074465"},{"sha":"3a0dde8af415b3ab8b5b6ba7631eecb10c7d7705","author":{"name":"Veena Sambasivan","email":"f3dea2712a9835ef757537fe50b353b17bceb98a@codeaurora.org"},"message":"msm: perf: Do not allocate new hw_event if event is duplicate.\n\nDuring a perf_event_enable, kernel/events/core.c calls pmu->add() which\nis platform implementation(arch/arm/kernel/perf_event.c). Due to the\nduplicate constraints, arch/arm/mach-msm/perf_event_msm_krait_l2.c\ndrivers marks the event as OFF but returns TRUE to perf_event.c which\ngoes ahead and allocates the hw_event and enables it.\nSince event is marked OFF, kernel events core will try to enable this event\nagain during next perf_event_enable. Which results in same event enabled\non multiple hw_events. But during the perf_release, event struct is freed\nand only one hw_event is released. This results in dereferencing the\ninvalid pointer and hence the crash.\nFix this by returning error in case of constraint event duplicate. Hence\navoiding the same event programmed on multiple hw event counters.\n\nChange-Id: Ia3360be027dfe87ac753191ffe7e0bc947e72455\nSigned-off-by: Arun KS <arunks@codeaurora.org>\nSigned-off-by: Veena Sambasivan <veenas@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/3a0dde8af415b3ab8b5b6ba7631eecb10c7d7705"},{"sha":"c154cda2cbcfa3dde79c49730028496dc25bedc8","author":{"name":"Vijayavardhan Vennapusa","email":"fd1e89cda16e187a1514e87daf32db280e01223d@qti.qualcomm.com"},"message":"USB: dwc3: debugfs: Add boundary check in dwc3_store_ep_num()\n\nUser can pass arguments as part of write to requests and endpoint number\nwill be calculated based on the arguments. There is a chance that driver\ncan access ep structue that is not allocated due to invalid arguments\npassed by user. Hence fix the issue by having check and return error in\ncase of invalid arguments.\n\nBug: 28172322\n\nChange-Id: I060ea878b55ce0f9983b91c50e58718c8a2c2fa1\nSigned-off-by: Vijayavardhan Vennapusa <vvreddy@qti.qualcomm.com>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/c154cda2cbcfa3dde79c49730028496dc25bedc8"},{"sha":"fbe71f5c566f3ce78646250c25423daa47d554ba","author":{"name":"Peter Hurley","email":"6214814a67b9688a08e8c6dc7fa5dee076dddc8d@hurleysoftware.com"},"message":"UPSTREAM: tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)\n\n(cherry pick from commit 5c17c861a357e9458001f021a7afa7aab9937439)\n\nioctl(TIOCGETD) retrieves the line discipline id directly from the\nldisc because the line discipline id (c_line) in termios is untrustworthy;\nuserspace may have set termios via ioctl(TCSETS*) without actually\nchanging the line discipline via ioctl(TIOCSETD).\n\nHowever, directly accessing the current ldisc via tty->ldisc is\nunsafe; the ldisc ptr dereferenced may be stale if the line discipline\nis changing via ioctl(TIOCSETD) or hangup.\n\nWait for the line discipline reference (just like read() or write())\nto retrieve the \"current\" line discipline id.\n\nCc: <stable@vger.kernel.org>\nSigned-off-by: Peter Hurley <peter@hurleysoftware.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nBug: 28409131\nChange-Id: I8e0a1c6cd51f2cc05ee45995c7ac05cd770c650b","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/fbe71f5c566f3ce78646250c25423daa47d554ba"},{"sha":"3430d9ba50eede8cb78c835ba4c36b8949e70a4e","author":{"name":"Thierry Strudel","email":"d91a09988021b738ebcc7e5a85aaf180a4dfaa4b@google.com"},"message":"Revert \"arm64: Introduce execute-only page access permissions\"\n\nThis reverts commit f72129c2203e0e7f4381411a9060c6d46f71ce1b.\n\nBug: 28557020\nChange-Id: I4e5bde6b9ee86ce27692add6da7e4dc3dc9751d6\nSigned-off-by: Thierry Strudel <tstrudel@google.com>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/3430d9ba50eede8cb78c835ba4c36b8949e70a4e"},{"sha":"b3d0634b622f3ec9d08d936e088b8794902311ce","author":{"name":"Hariprasad Dhalinarasimha","email":"1b0234d10fa6a32f4176db93c1130dd297aace29@codeaurora.org"},"message":"qseecom: Validate the incoming length from user space\n\nCheck if there is no integer overflow before using req_len and\nresp_len (received from user space). If an overflow is detected\nthen exit the operation.\n\nBug: 28571496\nChange-Id: I0459a6992bb3b280db42be63a275c55fa6105b1c\nSigned-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/b3d0634b622f3ec9d08d936e088b8794902311ce"},{"sha":"290d34f9bf6d7498755e6a73619abcf37a3c0e4d","author":{"name":"Greg Kroah-Hartman","email":"4931344b09d7a7d3573e8b1ebec918e229ead9bf@google.com"},"message":"AIO: properly check iovec sizes\n\ncommit ff19ac8fb71e8a2bf07d61b959062998139c1104 upstream\n\nIn Linus's tree, the iovec code has been reworked massively, but in\nolder kernels the AIO layer should be checking this before passing the\nrequest on to other layers.\n\nMany thanks to Ben Hawkes of Google Project Zero for pointing out the\nissue.\n\nBug: 28588279\n\nReported-by: Ben Hawkes <hawkes@google.com>\nAcked-by: Benjamin LaHaise <bcrl@kvack.org>\nTested-by: Willy Tarreau <w@1wt.eu>\n[backported to 3.10 - willy]\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@google.com>\n\nChange-Id: Icf8b8d26a52ed579075e86d58e637cf510749307","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/290d34f9bf6d7498755e6a73619abcf37a3c0e4d"},{"sha":"363fb3525fb16baf58a4fe0adb3c78742b81fba7","author":{"name":"Alan Stern","email":"5c4cbde65af01ad64f5b2177d0cd78ab5b01e5a1@rowland.harvard.edu"},"message":"UPSTREAM: USB: fix invalid memory access in hub_activate()\n\n(cherry pick from commit e50293ef9775c5f1cf3fcc093037dd6a8c5684ea)\n\nCommit 8520f38099cc (\"USB: change hub initialization sleeps to\ndelayed_work\") changed the hub_activate() routine to make part of it\nrun in a workqueue.  However, the commit failed to take a reference to\nthe usb_hub structure or to lock the hub interface while doing so.  As\na result, if a hub is plugged in and quickly unplugged before the work\nroutine can run, the routine will try to access memory that has been\ndeallocated.  Or, if the hub is unplugged while the routine is\nrunning, the memory may be deallocated while it is in active use.\n\nThis patch fixes the problem by taking a reference to the usb_hub at\nthe start of hub_activate() and releasing it at the end (when the work\nis finished), and by locking the hub interface while the work routine\nis running.  It also adds a check at the start of the routine to see\nif the hub has already been disconnected, in which nothing should be\ndone.\n\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-by: Alexandru Cornea <alexandru.cornea@intel.com>\nTested-by: Alexandru Cornea <alexandru.cornea@intel.com>\nFixes: 8520f38099cc (\"USB: change hub initialization sleeps to delayed_work\")\nCC: <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nBug: 28712303\nChange-Id: Id91be8695d4dc68d726dc0d87504912dd85915d0","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/363fb3525fb16baf58a4fe0adb3c78742b81fba7"},{"sha":"1b92b5163feaa8b365e22b704304c367eb34afee","author":{"name":"Divya Ponnusamy","email":"499583450a0afa8f7b400d046a2396e658a503cf@codeaurora.org"},"message":"msm: kgsl: Avoid race condition in ioctl_syncsource_destroy\n\nIf the ioctl syncsource_destroy is accessed by parallel\nthreads, where the spinlock is acquired by threads after\ngetting syncsource, then the simultaneous processes try\nto remove the already destroyed syncsource->refcount by\nthe first thread that acquires this spinlock. This leads\nto race condition while removing syncsource->idr.\n\nAvoid separate lock inside getting syncsource, instead\nacquire spinlock before we get the syncsource in\ndestroy ioctl so that the threads access the spinlock\nand operate on syncsource without use-after-free issue.\n\nChange-Id: I6add3800c40cd09f6e6e0cf2720e69059bd83cbc\nSigned-off-by: Divya Ponnusamy <pdivya@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/1b92b5163feaa8b365e22b704304c367eb34afee"},{"sha":"5eccc5e94789b19ebe239305c7ea2168520cefa7","author":{"name":"yanghong1","email":"803eee56e2aa2f204c8d16f58fb6dca499fc691e@longcheer.net"},"message":"TP: update booyi-himax firmware to 0x17\n\n- fix new tp slow reaction problem\n- fix tp auto-jump with 10 points\n\nbug:29118543\n\nChange-Id: I2a3d515fda2b460b9c0fc2e9e803273e7a94f13b\nSigned-off-by: yanghong1 <yanghong1@longcheer.net>","distinct":true,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/5eccc5e94789b19ebe239305c7ea2168520cefa7"}]}
{"actor":{"display_login":"Rashed97"}}