{"push_id":1093327075,"size":6,"distinct_size":6,"ref":"refs/heads/cm-13.0","head":"4f654a6234528fee57a41390058c6995f4ab1b39","before":"9558a8e87349d30e94ae3d5f525e27ad4b580fe2","commits":[{"sha":"9a4cdfab0c38b3b4b972f20fa5a0d25d8c9ec028","author":{"email":"08a5689cdd3bf9d633b44aeb360c64ba4fe5af27@google.com","name":"Badhri Jagan Sridharan"},"message":"usb: phy: Dual role sysfs class definition\n\nThis CL adds a new class to monitor and change\ndual role usb ports from userspace. The usb\nphy drivers can register to the dual_role_usb\nclass and expose the capabilities of the ports.\nThe phy drivers can decide on whether a specific\nattribute can be changed from userspace by\nchoosing to implement the appropriate callback.\n\nSigned-off-by: Badhri Jagan Sridharan <badhri@google.com>\nBug: 21615151\nChange-Id: I121b4a94437972b5abe8f781e3007efa8531978","distinct":true,"url":"https://api.github.com/repos/Grace5921/android_kernel_a7elte/commits/9a4cdfab0c38b3b4b972f20fa5a0d25d8c9ec028"},{"sha":"bcaa1f675b713c73cbdaf01e45cd9ffb960a4606","author":{"email":"a4a7d486fe874593b021ebde938f459c081be043@linaro.org","name":"Amit Pundir"},"message":"usb: phy: fix dual role sysfs build if kernel modules are supported\n\nAdd a missing \";\" after EXPORT_SYMBOL() otherwise we run\ninto following build error if Kernel Modules are supported:\n----------\n  CC      drivers/usb/phy/class-dual-role.o\ndrivers/usb/phy/class-dual-role.c:91:1: error: expected ',' or ';' before 'int'\n int dual_role_get_property(struct dual_role_phy_instance *dual_role,\n ^\nmake[3]: *** [drivers/usb/phy/class-dual-role.o] Error 1\n----------\n\nSigned-off-by: Amit Pundir <amit.pundir@linaro.org>\n(cherry picked from commit 9ff158f4c245c2fecb1489a4aae62ca67c0846a1)\n\nChange-Id: I7ec77584b3a753448ddc50a74204a20f4636f8a4","distinct":true,"url":"https://api.github.com/repos/Grace5921/android_kernel_a7elte/commits/bcaa1f675b713c73cbdaf01e45cd9ffb960a4606"},{"sha":"50b2a2fb10e7d0ac079f1dfc6f932458b33a38a5","author":{"email":"e2bfaa8b522ad2b3c4a1c86442cc7f7aa55b5234@google.com","name":"Martijn Coenen"},"message":"lowmemorykiller: trace kill events.\n\nAllows for capturing lmk kill events and\ntheir rationale.\n\nChange-Id: Ibe215db5bb9806fc550c72c0b9832c85cbd56bf6\nSigned-off-by: Martijn Coenen <maco@google.com>","distinct":true,"url":"https://api.github.com/repos/Grace5921/android_kernel_a7elte/commits/50b2a2fb10e7d0ac079f1dfc6f932458b33a38a5"},{"sha":"451cff8f2362209f5ce06b714d875f5265316108","author":{"email":"4aa5652442886f3c4e77d3a743dc27e129c1613f@hp.com","name":"Davidlohr Bueso"},"message":"ipc: fix race with LSMs\n\n(cherry pick commit 53dad6d3a8e5ac1af8bacc6ac2134ae1a8b085f1)\n\nCurrently, IPC mechanisms do security and auditing related checks under\nRCU.  However, since security modules can free the security structure,\nfor example, through selinux_[sem,msg_queue,shm]_free_security(), we can\nrace if the structure is freed before other tasks are done with it,\ncreating a use-after-free condition.  Manfred illustrates this nicely,\nfor instance with shared mem and selinux:\n\n -> do_shmat calls rcu_read_lock()\n -> do_shmat calls shm_object_check().\n     Checks that the object is still valid - but doesn't acquire any locks.\n     Then it returns.\n -> do_shmat calls security_shm_shmat (e.g. selinux_shm_shmat)\n -> selinux_shm_shmat calls ipc_has_perm()\n -> ipc_has_perm accesses ipc_perms->security\n\nshm_close()\n -> shm_close acquires rw_mutex & shm_lock\n -> shm_close calls shm_destroy\n -> shm_destroy calls security_shm_free (e.g. selinux_shm_free_security)\n -> selinux_shm_free_security calls ipc_free_security(&shp->shm_perm)\n -> ipc_free_security calls kfree(ipc_perms->security)\n\nThis patch delays the freeing of the security structures after all RCU\nreaders are done.  Furthermore it aligns the security life cycle with\nthat of the rest of IPC - freeing them based on the reference counter.\nFor situations where we need not free security, the current behavior is\nkept.  Linus states:\n\n \"... the old behavior was suspect for another reason too: having the\n  security blob go away from under a user sounds like it could cause\n  various other problems anyway, so I think the old code was at least\n  _prone_ to bugs even if it didn't have catastrophic behavior.\"\n\nI have tested this patch with IPC testcases from LTP on both my\nquad-core laptop and on a 64 core NUMA server.  In both cases selinux is\nenabled, and tests pass for both voluntary and forced preemption models.\nWhile the mentioned races are theoretical (at least no one as reported\nthem), I wanted to make sure that this new logic doesn't break anything\nwe weren't aware of.\n\nSuggested-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Davidlohr Bueso <davidlohr@hp.com>\nAcked-by: Manfred Spraul <manfred@colorfullife.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Mark Salyzyn <salyzyn@google.com>\nBug: 24551430\nChange-Id: I255ae96b5d7b4ec8d3a5fdf6d280925a99472d85","distinct":true,"url":"https://api.github.com/repos/Grace5921/android_kernel_a7elte/commits/451cff8f2362209f5ce06b714d875f5265316108"},{"sha":"5265d80fa842a7c76850eae651cc2f87ea073ff2","author":{"email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org","name":"Linus Torvalds"},"message":"Initialize msg/shm IPC objects before doing ipc_addid()\n\n(cherry pick from commit b9a532277938798b53178d5a66af6e2915cb27cf)\n\nAs reported by Dmitry Vyukov, we really shouldn't do ipc_addid() before\nhaving initialized the IPC object state.  Yes, we initialize the IPC\nobject in a locked state, but with all the lockless RCU lookup work,\nthat IPC object lock no longer means that the state cannot be seen.\n\nWe already did this for the IPC semaphore code (see commit e8577d1f0329:\n\"ipc/sem.c: fully initialize sem_array before making it visible\") but we\nclearly forgot about msg and shm.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nCc: Manfred Spraul <manfred@colorfullife.com>\nCc: Davidlohr Bueso <dbueso@suse.de>\nCc: stable@vger.kernel.org\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Mark Salyzyn <salyzyn@google.com>\nBug: 24551430\nChange-Id: Ic7b980a6f2a79eb3c04fc43b6531c396645af1db","distinct":true,"url":"https://api.github.com/repos/Grace5921/android_kernel_a7elte/commits/5265d80fa842a7c76850eae651cc2f87ea073ff2"},{"sha":"4f654a6234528fee57a41390058c6995f4ab1b39","author":{"email":"e4eddfaff1fc5d7affa656f47ee4d83207ccac30@colorfullife.com","name":"Manfred Spraul"},"message":"ipc/sem.c: fully initialize sem_array before making it visible\n\n(cherry pick from commit e8577d1f0329d4842e8302e289fb2c22156abef4)\n\nipc_addid() makes a new ipc identifier visible to everyone.  New objects\nstart as locked, so that the caller can complete the initialization\nafter the call.  Within struct sem_array, at least sma->sem_base and\nsma->sem_nsems are accessed without any locks, therefore this approach\ndoesn't work.\n\nThus: Move the ipc_addid() to the end of the initialization.\n\nSigned-off-by: Manfred Spraul <manfred@colorfullife.com>\nReported-by: Rik van Riel <riel@redhat.com>\nAcked-by: Rik van Riel <riel@redhat.com>\nAcked-by: Davidlohr Bueso <dave@stgolabs.net>\nAcked-by: Rafael Aquini <aquini@redhat.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Mark Salyzyn <salyzyn@google.com>\nBug: 24551430\nChange-Id: I36a8cc2281dfd68e9a399695f1d7e7b038e105d0","distinct":true,"url":"https://api.github.com/repos/Grace5921/android_kernel_a7elte/commits/4f654a6234528fee57a41390058c6995f4ab1b39"}]}