{"push_id":1466805630,"size":273,"distinct_size":86,"ref":"refs/heads/APSS.FSM.3.0","head":"7e147f4532394f06c3d7bce9cc6e682785754e45","before":"b8aaeb38b626894c8b32fd9cced97d284ea7d786","commits":[{"sha":"5499d3f92d3948b066b44a7d4341ae10922e138a","author":{"name":"Sivanesan Rajapupathi","email":"5b8835fd513552ead6e01f1ac89e81c1d3d2d225@codeaurora.org"},"message":"msm: fsm9010: Resized and rebased the debug dump regions\n\nThe Debug Dump memory was not sufficient to house all of the dump\ndata created by the remote processors when they crashed.  Increased\nthe size of these memory regions.\n\nChange-Id: I2e880f72bd3fd2e4b883ed652817dad14986b612\nAcked-by: Brian Costello <bcostell@qti.qualcomm.com>\nSigned-off-by: Sivanesan Rajapupathi <srajap@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/5499d3f92d3948b066b44a7d4341ae10922e138a"},{"sha":"a840f974ff5cce38704a0ec41ba32fa2584f47be","author":{"name":"Carter Cooper","email":"4b93d7d4a3b9ec5fa2fac4cd74295bbd71be23d2@codeaurora.org"},"message":"msm: kgsl: Verify the pointer isn't NULL before using it for kref\n\nProbably overkill, but ensure that the struct pointer we are going\nto dereference to send into kref calls is valid before we dereference.\n\nChange-Id: I308176df9f7476a2a9f1357612381a93160ad698\nSigned-off-by: Carter Cooper <ccooper@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/a840f974ff5cce38704a0ec41ba32fa2584f47be"},{"sha":"83ec9471bd7c8ebf1d4a0c620ba1a6b349b172f3","author":{"name":"Divya Ponnusamy","email":"499583450a0afa8f7b400d046a2396e658a503cf@codeaurora.org"},"message":"msm: kgsl: Avoid race condition in ioctl_syncsource_destroy\n\nIf the ioctl syncsource_destroy is accessed by parallel\nthreads, where the spinlock is acquired by threads after\ngetting syncsource, then the simultaneous processes try\nto remove the already destroyed syncsource->refcount by\nthe first thread that acquires this spinlock. This leads\nto race condition while removing syncsource->idr.\n\nAvoid separate lock inside getting syncsource, instead\nacquire spinlock before we get the syncsource in\ndestroy ioctl so that the threads access the spinlock\nand operate on syncsource without use-after-free issue.\n\nChange-Id: I6add3800c40cd09f6e6e0cf2720e69059bd83cbc\nSigned-off-by: Divya Ponnusamy <pdivya@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/83ec9471bd7c8ebf1d4a0c620ba1a6b349b172f3"},{"sha":"63ebf37900f96a790af9c0a821f1a783eaa422ca","author":{"name":"Sunil Khatri","email":"c2fa09c6a63ee27656efbed7bd5e770f84d009d0@codeaurora.org"},"message":"ashmem: Validate ashmem memory with fops pointer\n\nValidate the ashmem memory entry against f_op pointer\nrather then comparing its name with path of the dentry.\n\nThis is to avoid any invalid access to ashmem area in cases\nwhere some one deliberately set the dentry name to /ashmem.\n\nChange-Id: I74e50cd244f68cb13009cf2355e528485f4de34b\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/63ebf37900f96a790af9c0a821f1a783eaa422ca"},{"sha":"107624c258cb9236fa494a08c9523018576fafc9","author":{"name":"Sunil Khatri","email":"c2fa09c6a63ee27656efbed7bd5e770f84d009d0@codeaurora.org"},"message":"msm: kgsl: Defer adding the mem entry to a process\n\nIf we add the mem entry pointer in the process idr and rb tree\ntoo early, other threads can do operations on the entry by\nguessing the ID or GPU address before the object gets returned\nby the creating operation.\n\nAllocate an ID for the object but don't assign the pointer until\nright before the creating function returns ensuring that another\noperation can't access it until it is ready.\n\nCRs-Fixed: 1002974\nChange-Id: Ic0dedbadc0dd2125bd2a7bcc152972c0555e07f8\nSigned-off-by: Jordan Crouse <jcrouse@codeaurora.org>\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>\nSigned-off-by: Santhosh Punugu <spunug@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/107624c258cb9236fa494a08c9523018576fafc9"},{"sha":"34c7af60c7d3979aa7592ddf9be783b9e26ddd1f","author":{"name":"Divya Ponnusamy","email":"499583450a0afa8f7b400d046a2396e658a503cf@codeaurora.org"},"message":"staging: android: Change %p to %pK in debug messages\n\nThe format specifier %p can leak kernel addresses\nwhile not valuing the kptr_restrict system settings.\nUse %pK instead of %p, which also evaluates whether\nkptr_restrict is set.\n\nChange-Id: Ib1adf14e9620ad7b1bd3e962001c852610210d46\nSigned-off-by: Divya Ponnusamy <pdivya@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/34c7af60c7d3979aa7592ddf9be783b9e26ddd1f"},{"sha":"ac1ef63bca045a5c7a0077aab14166fcb4ab7d1e","author":{"name":"Sunil Khatri","email":"c2fa09c6a63ee27656efbed7bd5e770f84d009d0@codeaurora.org"},"message":"msm: kgsl: Check the address range before mapping to GPU\n\nValidate the GPU address range for memory mapping request\nfor user allocated buffers before setting the bitmap.\n\nThis is applicable to the memory mapping specifically\nwhen user have used USE_CPU_MAP flag.\n\nChange-Id: I7fd30789329939f89b5486d59bdee920616cc6df\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/ac1ef63bca045a5c7a0077aab14166fcb4ab7d1e"},{"sha":"cabeb903b4a9414ff11800e47dda0ac959ca0915","author":{"name":"Tarun Karra","email":"2510a0714f96c923ea81ac473307af04ae122ae5@codeaurora.org"},"message":"msm: kgsl: verify user memory permissions before mapping to GPU driver\n\nFor user memory of type KGSL_USER_MEM_TYPE_ADDR mapped to GPU driver\nverify permissions and map GPU permissions same as CPU permissions.\nIf elevated permissions are requested return an error to prevent\nprivilege escalation. Without this check user could map readonly\nmemory into GPU driver as readwrite and gain elevated privilege.\n\nWrite permissions check is currently inverted causing readonly\nuser pages to be mapped as readwrite in GPU driver. Fix this\ncheck to map readonly pages as readonly.\n\nCRs-Fixed: 988993\nChange-Id: I0e097d7e4e4c414c0849e33bcc61a26fb94291ad\nSigned-off-by: Tarun Karra <tkarra@codeaurora.org>\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/cabeb903b4a9414ff11800e47dda0ac959ca0915"},{"sha":"a5a3e9d287b6e635149df30329213126a4168e4b","author":{"name":"Mallikarjuna Reddy Amireddy","email":"64faf614dca1295989f342367ba1497c4cddcdee@codeaurora.org"},"message":"qseecom: Change format specifier %p to %pK\n\nFormat specifier %p can leak kernel addresses while not valuing the\nkptr_restrict system settings. When kptr_restrict is set to (1), kernel\npointers printed using the %pK format specifier will be replaced with 0's.\nSo that %pK will not leak kernel pointers to unprivileged users.\nSo change the format specifier from %p to %pK.\n\nDebugging Note : &pK prints only Zeros as address. if you need actual\naddress information, pls echo 0 to kptr_restrict.\n$ echo 0 > /proc/sys/kernel/kptr_restrict\n\nChange-Id: I0baf2be2d5a476e2e4267f20b99d0ddf5492469e\nSigned-off-by: Mallikarjuna Reddy Amireddy <mamire@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/a5a3e9d287b6e635149df30329213126a4168e4b"},{"sha":"ec74ed3a659b26b1b1f338e44eafe6ef67c40f7a","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"qseecom: Change format specifier %p to %pK\"","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/ec74ed3a659b26b1b1f338e44eafe6ef67c40f7a"},{"sha":"bfa4eb8bca169a02f4ba1fc2f3acdccf6081da31","author":{"name":"Sivanesan Rajapupathi","email":"5b8835fd513552ead6e01f1ac89e81c1d3d2d225@codeaurora.org"},"message":"msm: vidc: Make buffer validity checks stronger\n\nCheck for the exact number of planes that we advertised to the client\nrather than the worst-case checks.\n\nChange-Id: Ibaf705367db98beb0e01bb2c3087126cf2ba73e8\nSigned-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>\nSigned-off-by: Sivanesan Rajapupathi <srajap@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/bfa4eb8bca169a02f4ba1fc2f3acdccf6081da31"},{"sha":"61095a8a82a0a34fd67af82b1a28b5a850a021ca","author":{"name":"Vasily Kulikov","email":"ccbccc5c352121717f7abc1d3e03e5f120f0013d@openwall.com"},"message":"include/linux/poison.h: fix LIST_POISON{1,2} offset\n\nPoison pointer values should be small enough to find a room in\nnon-mmap'able/hardly-mmap'able space.  E.g.  on x86 \"poison pointer space\"\nis located starting from 0x0.  Given unprivileged users cannot mmap\nanything below mmap_min_addr, it should be safe to use poison pointers\nlower than mmap_min_addr.\n\nThe current poison pointer values of LIST_POISON{1,2} might be too big for\nmmap_min_addr values equal or less than 1 MB (common case, e.g.  Ubuntu\nuses only 0x10000).  There is little point to use such a big value given\nthe \"poison pointer space\" below 1 MB is not yet exhausted.  Changing it\nto a smaller value solves the problem for small mmap_min_addr setups.\n\nThe values are suggested by Solar Designer:\nhttp://www.openwall.com/lists/oss-security/2015/05/02/6\n\nChange-Id: I4aff5bf048c42d1ca6c94f356a987e4ada563398\nSigned-off-by: Vasily Kulikov <segoon@openwall.com>\nCc: Solar Designer <solar@openwall.com>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: \"Kirill A. Shutemov\" <kirill.shutemov@linux.intel.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nGit-commit: 8a5e5e02fc83aaf67053ab53b359af08c6c49aaf\nGit-repo: https://us.codeaurora.org/cgit/quic/la/kernel/msm\nCRs-Fixed: 987330\nSigned-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/61095a8a82a0a34fd67af82b1a28b5a850a021ca"},{"sha":"75d876bc1447b88ea93bb2eb8ab7550bece6886c","author":{"name":"Ben Hutchings","email":"9c85637c38b80821c7bd8a03bde7b59da81ab77d@decadent.org.uk"},"message":"pipe: Fix buffer offset after partially failed read\n\nQuoting the RHEL advisory:\n\n> It was found that the fix for CVE-2015-1805 incorrectly kept buffer\n> offset and buffer length in sync on a failed atomic read, potentially\n> resulting in a pipe buffer state corruption. A local, unprivileged user\n> could use this flaw to crash the system or leak kernel memory to user\n> space. (CVE-2016-0774, Moderate)\n\nThe same flawed fix was applied to stable branches from 2.6.32.y to\n3.14.y inclusive, and I was able to reproduce the issue on 3.2.y.\nWe need to give pipe_iov_copy_to_user() a separate offset variable\nand only update the buffer offset if it succeeds.\n\nReferences: https://rhn.redhat.com/errata/RHSA-2016-0103.html\ncherry picked from commit feae3ca2e5e1a8f44aa6290255d3d9709985d0b2)\nGit-commit: feae3ca2e5e1a8f44aa6290255d3d9709985d0b2\nGit-repo  : https://android.googlesource.com/kernel/common\nchange-Id: I988802f38acf40c7671fa0978880928b02d29b56\nSigned-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/75d876bc1447b88ea93bb2eb8ab7550bece6886c"},{"sha":"3e3e5e1513a3a80b051e826a1b7168b19265bdfe","author":{"name":"Anand Kumar","email":"1d08b5946e05cef0db4a400554fc1c110a207fc7@codeaurora.org"},"message":"wcnss: Avoid user buffer overloading for write cal data\n\ncompare size of allocated cal data buffer from heap\nand count bytes provided to write by user to avoid\nheap overflow for write cal data.\n\nChange-Id: Id70c3230f761385489e5e94c613f4519239dfb1f\nCRs-Fixed: 1032174\nSigned-off-by: Anand Kumar <anandkumar@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/3e3e5e1513a3a80b051e826a1b7168b19265bdfe"},{"sha":"cb2b4c49c38e0e34b1faeda093d979a242f9027d","author":{"name":"Greg Kroah-Hartman","email":"4931344b09d7a7d3573e8b1ebec918e229ead9bf@linuxfoundation.org"},"message":"AIO: properly check iovec sizes\n\nIn Linus's tree, the iovec code has been reworked massively, but in\nolder kernels the AIO layer should be checking this before passing the\nrequest on to other layers.\n\nMany thanks to Ben Hawkes of Google Project Zero for pointing out the\nissue.\n\nChange-Id: I625e1b4376bb2342d6c5f88eb3f202e99a0c5b07\nReported-by: Ben Hawkes <hawkes@google.com>\nAcked-by: Benjamin LaHaise <bcrl@kvack.org>\nTested-by: Willy Tarreau <w@1wt.eu>\n[backported to 3.10 - willy]\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nGit-commit: 8a5e5e02fc83aaf67053ab53b359af08c6c49aaf\nGit-repo: https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git\nSigned-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/cb2b4c49c38e0e34b1faeda093d979a242f9027d"},{"sha":"39f48aaa31ee89950c4614424462343858bfc551","author":{"name":"Srinivasarao P","email":"5838be2f68866147a6b98dc0567ce3ec89ebe5fc@codeaurora.org"},"message":"msm: dma_test: Initialize newly allocated memory\n\nThe MSM_DMA_IOALLOC ioctl command allocates kernel memory and\nthis memory can be read back using the MSM_DMA_IORBUF ioctl command.\nThis memory is not zero-initialized and may contain sensitive data.\n\nChange-Id: I8c55d6fe500e7607690b89806715893783eecf9c\nSigned-off-by: Srinivasarao P <spathi@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/39f48aaa31ee89950c4614424462343858bfc551"},{"sha":"d0755b15df65fd23054fac0c3b2f817098282942","author":{"name":"Zhen Kong","email":"b999fb1d59364862997bac94d5b793be36d63b01@codeaurora.org"},"message":"msm: crypto: Fix integer over flow check in qcedev driver\n\nInteger overflow check always fails when ULONG_MAX is used,\nas ULONG_MAX is 2^64-1, while req->data[i].len and total\nare uint32_t. Make change to use U32_MAX instead of\nULONG_MAX.\n\nCRs-fixed: 1046507\nChange-Id: Iccf9c32400ecc7ffc0afae16f58c38e5d78a5b64\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/d0755b15df65fd23054fac0c3b2f817098282942"},{"sha":"a6614efb3c3356f8eae7391946a42ea0d9e577b2","author":{"name":"Rajesh Bondugula","email":"3062b73d3088701829fade9d0214b3b9a768fa40@codeaurora.org"},"message":"msm: camera: sensor: Validate step_boundary\n\nstep_boundary can take values upto the total_steps\nValidate the step_boundary before consuming it.\nConvert the type of step_index and region_index to uint16_t\nstep_index and region_index cannot be negative.\n\nCRs-Fixed: 1001092\nChange-Id: I1f23fd6f28bb897824a1ef99a8873b9f986eee70\nSigned-off-by: Rajesh Bondugula <rajeshb@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/a6614efb3c3356f8eae7391946a42ea0d9e577b2"},{"sha":"9e3b853b3dc083b4f7b05fd1689ec3ec44b07442","author":{"name":"Vijayavardhan Vennapusa","email":"fd1e89cda16e187a1514e87daf32db280e01223d@codeaurora.org"},"message":"USB: dwc3: debugfs: Add boundary check in dwc3_store_ep_num()\n\nUser can pass arguments as part of write to requests and endpoint number\nwill be calculated based on the arguments. There is a chance that driver\ncan access ep structue that is not allocated due to invalid arguments\npassed by user. Hence fix the issue by having check and return error in\ncase of invalid arguments.\n\nChange-Id: I060ea878b55ce0f9983b91c50e58718c8a2c2fa1\nSigned-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/9e3b853b3dc083b4f7b05fd1689ec3ec44b07442"},{"sha":"45215c31c9992cb519df8df9493a1fee13366733","author":{"name":"Ping Li","email":"ae02d191d70685958f382c54e0edcb6e92d3ef8d@codeaurora.org"},"message":"msm: mdss: Fix memory leak in panel_debugfs_create_array func\n\nFix the potential memory leak in panel_debugfs_create_array func\nby freeing the allocated memory in error return case.\n\nCRs-Fixed: 1005536\nChange-Id: If2bf7dbe7caedfa42337639fea739974f99960b4\nSigned-off-by: Ping Li <pingli@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unoffical/kernel-msm-3.10/commits/45215c31c9992cb519df8df9493a1fee13366733"}]}
{"actor":{"display_login":"Mazda--"}}