{"push_id":1397639408,"size":3,"distinct_size":3,"ref":"refs/heads/aosp/LA.UM.5.5.r1_Google","head":"c63ff15a7cfac131438e09600abbf580ef6eec58","before":"41f475849ae8eaf32bea90cbee32c1a5688c8408","commits":[{"sha":"f1b3e70b2d36875663a12585758e1ea0494ac7fc","author":{"name":"Lars-Peter Clausen","email":"7f698333860e9f21dcc513102ebee3bcaf8d683e@metafoo.de"},"message":"BACKPORT: usb: gadget: f_fs: Fix use-after-free\n\n(cherry picked from commit 38740a5b87d53ceb89eb2c970150f6e94e00373a)\n\nWhen using asynchronous read or write operations on the USB endpoints the\nissuer of the IO request is notified by calling the ki_complete() callback\nof the submitted kiocb when the URB has been completed.\n\nCalling this ki_complete() callback will free kiocb. Make sure that the\nstructure is no longer accessed beyond that point, otherwise undefined\nbehaviour might occur.\n\nFixes: 2e4c7553cd6f (\"usb: gadget: f_fs: add aio support\")\nCc: <stable@vger.kernel.org> # v3.15+\nSigned-off-by: Lars-Peter Clausen <lars@metafoo.de>\nSigned-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>\nChange-Id: I3c7b643f6440c4fb6160a57c1058523030b46a6c\nBug: 30950866","distinct":true,"url":"https://api.github.com/repos/pablomh/kernel/commits/f1b3e70b2d36875663a12585758e1ea0494ac7fc"},{"sha":"6722b499c58393406cf30567685f11b67e2d5e45","author":{"name":"Peter Zijlstra","email":"4d3106856cce90e8f40acc5180f60ddda3a23b6e@infradead.org"},"message":"UPSTREAM: perf: Fix race in swevent hash\n\n(cherry picked from commit 12ca6ad2e3a896256f086497a7c7406a547ee373)\n\nThere's a race on CPU unplug where we free the swevent hash array\nwhile it can still have events on. This will result in a\nuse-after-free which is BAD.\n\nSimply do not free the hash array on unplug. This leaves the thing\naround and no use-after-free takes place.\n\nWhen the last swevent dies, we do a for_each_possible_cpu() iteration\nanyway to clean these up, at which time we'll free it, so no leakage\nwill occur.\n\nReported-by: Sasha Levin <sasha.levin@oracle.com>\nTested-by: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Arnaldo Carvalho de Melo <acme@redhat.com>\nCc: Frederic Weisbecker <fweisbec@gmail.com>\nCc: Jiri Olsa <jolsa@redhat.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Stephane Eranian <eranian@google.com>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Vince Weaver <vincent.weaver@maine.edu>\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nChange-Id: I4972ce74211b6504ff61325c4a4f7b088306d1f9\nBug: 30952077\nSigned-off-by: Yueyao (Nathan) Zhu <yueyao@google.com>","distinct":true,"url":"https://api.github.com/repos/pablomh/kernel/commits/6722b499c58393406cf30567685f11b67e2d5e45"},{"sha":"c63ff15a7cfac131438e09600abbf580ef6eec58","author":{"name":"Lukas Czerner","email":"6fc09532a9146f7083562515354b6edd42e64baf@redhat.com"},"message":"UPSTREAM: ext4: fix potential use after free in __ext4_journal_stop\n\nThere is a use-after-free possibility in __ext4_journal_stop() in the\ncase that we free the handle in the first jbd2_journal_stop() because\nwe're referencing handle->h_err afterwards. This was introduced in\n9705acd63b125dee8b15c705216d7186daea4625 and it is wrong. Fix it by\nstoring the handle->h_err value beforehand and avoid referencing\npotentially freed handle.\n\nFixes: 9705acd63b125dee8b15c705216d7186daea4625\nSigned-off-by: Lukas Czerner <lczerner@redhat.com>\nReviewed-by: Andreas Dilger <adilger@dilger.ca>\nCc: stable@vger.kernel.org\nSigned-off-by: Steve Pfetsch <spfetsch@google.com>\n(cherry picked from commit 6934da9238da947628be83635e365df41064b09b)\nBug: 30952474\nChange-Id: Ic8490cb55cb42ccb47c4dc6a819a3bc4fad6246f","distinct":true,"url":"https://api.github.com/repos/pablomh/kernel/commits/c63ff15a7cfac131438e09600abbf580ef6eec58"}]}
{"actor":{"display_login":"pablomh"}}