{"push_id":1408529915,"size":14,"distinct_size":14,"ref":"refs/heads/cm-14.1","head":"c9114fcef08c261fbd3d7738b986ee0c8f80e83b","before":"aef5237d48563cd1215f85c5fa9fab077161ed81","commits":[{"sha":"aa9be19bf125b1f9e2ebd6f3e39b08103bc2febd","author":{"name":"DerRomtester","email":"5a7bee8e18a3828b401fbfa95c3aec5077e32adc@gmail.com"},"message":"Revert \"BACKPORT: ARM: 8235/1: Support for the PXN CPU feature on ARMv7\"\n\nThis reverts commit 78629f4bfce3d766a17dc1e6fc4120517f5287b2.","distinct":true,"url":"https://api.github.com/repos/DerRomtester/android_kernel_oneplus_msm8974/commits/aa9be19bf125b1f9e2ebd6f3e39b08103bc2febd"},{"sha":"89b934d375642d2bf0dd629eba9896ce75f77a5f","author":{"name":"Marek Szyprowski","email":"4d0ab7dac85d754388f4be3549f400e336faa58a@samsung.com"},"message":"arm64: dma-mapping: always clear allocated buffers\n\n[ Upstream commit 6829e274a623187c24f7cfc0e3d35f25d087fcc5 ]\n\nBuffers allocated by dma_alloc_coherent() are always zeroed on Alpha,\nARM (32bit), MIPS, PowerPC, x86/x86_64 and probably other architectures.\nIt turned out that some drivers rely on this 'feature'. Allocated buffer\nmight be also exposed to userspace with dma_mmap() call, so clearing it\nis desired from security point of view to avoid exposing random memory\nto userspace. This patch unifies dma_alloc_coherent() behavior on ARM64\narchitecture with other implementations by unconditionally zeroing\nallocated buffer.\n\nBug: 29795245\nCRs-Fixed: 1041735\nChange-Id: I74bf024e0f603ca8c0b05430dc2ee154d579cfb2\nCc: <stable@vger.kernel.org> # v3.14+\nSigned-off-by: Marek Szyprowski <m.szyprowski@samsung.com>\nSigned-off-by: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>\nGit-commit: a142e9641dcbead2c8845c949ad518acac96ed28\nGit-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\n[lmark@codeaurora.org: resolve merge conflicts]\nSigned-off-by: Liam Mark <lmark@codeaurora.org>\n(cherry picked from commit 146dc676724b7bef0a0a7e64a1bb2f6972da1028)","distinct":true,"url":"https://api.github.com/repos/DerRomtester/android_kernel_oneplus_msm8974/commits/89b934d375642d2bf0dd629eba9896ce75f77a5f"},{"sha":"33d10f5ca0abdf1fd8c81103697d4876ddd838a4","author":{"name":"Arve Hjønnevåg","email":"252c00e8bf89f12b2f75a1e0ab87a5ad019cda88@android.com"},"message":"ANDROID: binder: Add strong ref checks\n\nPrevent using a binder_ref with only weak references where a strong\nreference is required.\n\nBUG: 30445380\nChange-Id: I66c15b066808f28bd27bfe50fd0e03ff45a09fca\nSigned-off-by: Arve Hjønnevåg <arve@android.com>\n(cherry picked from commit 69c402e390dddcd3da5a89d18e04b2a3ab93ddae)","distinct":true,"url":"https://api.github.com/repos/DerRomtester/android_kernel_oneplus_msm8974/commits/33d10f5ca0abdf1fd8c81103697d4876ddd838a4"},{"sha":"9f8eb04b3bd4a98cdfb950b28cbe0ca9dbed5354","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"af_unix: speedup /proc/net/unix\n\n/proc/net/unix has quadratic behavior, and can hold unix_table_lock for\na while if high number of unix sockets are alive. (90 ms for 200k\nsockets...)\n\nWe already have a hash table, so its quite easy to use it.\n\nProblem is unbound sockets are still hashed in a single hash slot\n(unix_socket_table[UNIX_HASH_TABLE])\n\nThis patch also spreads unbound sockets to 256 hash slots, to speedup\nboth /proc/net/unix and unix_diag.\n\nTime to read /proc/net/unix with 200k unix sockets :\n(time dd if=/proc/net/unix of=/dev/null bs=4k)\n\nbefore : 520 secs\nafter : 2 secs\n\nChange-Id: Idf8ee4b6fe9c066483f4e1376714fa2b4ff573e6\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Steven Whitehouse <swhiteho@redhat.com>\nCc: Pavel Emelyanov <xemul@parallels.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nGit-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git\nGit-commit: 7123aaa3a1416529ce461e98108e6b343b294643\n(cherry picked from commit 53e0149cb0e095061ba781669af2ba828e42a59f)","distinct":true,"url":"https://api.github.com/repos/DerRomtester/android_kernel_oneplus_msm8974/commits/9f8eb04b3bd4a98cdfb950b28cbe0ca9dbed5354"},{"sha":"16b4ae53e9b452c778f9b927b23a04d8acbd6be1","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()\n\nJust a minor code cleanup: unify the error paths.\n\nChange-Id: I31346b08ed1024819c58eff797c63bb42c283512\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/DerRomtester/android_kernel_oneplus_msm8974/commits/16b4ae53e9b452c778f9b927b23a04d8acbd6be1"},{"sha":"1b3b5189af50151c0e3e1f5acb295815895cf36a","author":{"name":"Vladis Dronov","email":"41435c47c64e54f8ec26bbc1be6d7972ea4d40bd@redhat.com"},"message":"ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call\n\ncreate_fixed_stream_quirk(), snd_usb_parse_audio_interface() and\ncreate_uaxx_quirk() functions allocate the audioformat object by themselves\nand free it upon error before returning. However, once the object is linked\nto a stream, it's freed again in snd_usb_audio_pcm_free(), thus it'll be\ndouble-freed, eventually resulting in a memory corruption.\n\nThis patch fixes these failures in the error paths by unlinking the audioformat\nobject before freeing it.\n\nBased on a patch by Takashi Iwai <tiwai@suse.de>\n\n[Note for stable backports:\n this patch requires the commit 902eb7fd1e4a ('ALSA: usb-audio: Minor\n code cleanup in create_fixed_stream_quirk()')]\n\nChange-Id: I129dc4f3b0ae4cb6f790c16d24dd768c9ee06822\nBugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283358\nReported-by: Ralf Spenneberg <ralf@spenneberg.net>\nCc: <stable@vger.kernel.org> # see the note above\nSigned-off-by: Vladis Dronov <vdronov@redhat.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/DerRomtester/android_kernel_oneplus_msm8974/commits/1b3b5189af50151c0e3e1f5acb295815895cf36a"},{"sha":"d20995d53dc8f2819cc2c8c0b00f83153110f3e8","author":{"name":"Peter Zijlstra","email":"4d3106856cce90e8f40acc5180f60ddda3a23b6e@infradead.org"},"message":"perf: Fix race in swevent hash\n\nThere's a race on CPU unplug where we free the swevent hash array\nwhile it can still have events on. This will result in a\nuse-after-free which is BAD.\n\nSimply do not free the hash array on unplug. This leaves the thing\naround and no use-after-free takes place.\n\nWhen the last swevent dies, we do a for_each_possible_cpu() iteration\nanyway to clean these up, at which time we'll free it, so no leakage\nwill occur.\n\nChange-Id: I751faf3215bbdaa6b6358f3a752bdd24126cfa0b\nReported-by: Sasha Levin <sasha.levin@oracle.com>\nTested-by: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Arnaldo Carvalho de Melo <acme@redhat.com>\nCc: Frederic Weisbecker <fweisbec@gmail.com>\nCc: Jiri Olsa <jolsa@redhat.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Stephane Eranian <eranian@google.com>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Vince Weaver <vincent.weaver@maine.edu>\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/DerRomtester/android_kernel_oneplus_msm8974/commits/d20995d53dc8f2819cc2c8c0b00f83153110f3e8"},{"sha":"70058fe09fe30232dfb958f4a55ef1b994aee19e","author":{"name":"Paul Moore","email":"54f65660711c038b3360dd7288dc12347ae58ba3@paul-moore.com"},"message":"BACKPORT: audit: fix a double fetch in audit_log_single_execve_arg()\n\n(cherry picked from commit 43761473c254b45883a64441dd0bc85a42f3645c)\n\nThere is a double fetch problem in audit_log_single_execve_arg()\nwhere we first check the execve(2) argumnets for any \"bad\" characters\nwhich would require hex encoding and then re-fetch the arguments for\nlogging in the audit record[1].  Of course this leaves a window of\nopportunity for an unsavory application to munge with the data.\n\nThis patch reworks things by only fetching the argument data once[2]\ninto a buffer where it is scanned and logged into the audit\nrecords(s).  In addition to fixing the double fetch, this patch\nimproves on the original code in a few other ways: better handling\nof large arguments which require encoding, stricter record length\nchecking, and some performance improvements (completely unverified,\nbut we got rid of some strlen() calls, that's got to be a good\nthing).\n\nAs part of the development of this patch, I've also created a basic\nregression test for the audit-testsuite, the test can be tracked on\nGitHub at the following link:\n\n * https://github.com/linux-audit/audit-testsuite/issues/25\n\n[1] If you pay careful attention, there is actually a triple fetch\nproblem due to a strnlen_user() call at the top of the function.\n\n[2] This is a tiny white lie, we do make a call to strnlen_user()\nprior to fetching the argument data.  I don't like it, but due to the\nway the audit record is structured we really have no choice unless we\ncopy the entire argument at once (which would require a rather\nwasteful allocation).  The good news is that with this patch the\nkernel no longer relies on this strnlen_user() value for anything\nbeyond recording it in the log, we also update it with a trustworthy\nvalue whenever possible.\n\nReported-by: Pengfei Wang <wpengfeinudt@gmail.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Paul Moore <paul@paul-moore.com>\nChange-Id: I10e979e94605e3cf8d461e3e521f8f9837228aa5\nBug: 30956807","distinct":true,"url":"https://api.github.com/repos/DerRomtester/android_kernel_oneplus_msm8974/commits/70058fe09fe30232dfb958f4a55ef1b994aee19e"},{"sha":"e379571247784effb39628a112819d80a12806f2","author":{"name":"AnilKumar Chimata","email":"854bb27c381db2dfaf01c50430201bb7d5894768@codeaurora.org"},"message":"qcedev: Validate Source and Destination addresses\n\nSource and Destination addresses passed by user space apps/clients\nare validated independent of type of operation to mitigate kernel\naddress space exploitation.\n\nChange-Id: If831275cdcc96cb0bf829fc62056e408accbfcca\nSigned-off-by: AnilKumar Chimata <anilc@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/DerRomtester/android_kernel_oneplus_msm8974/commits/e379571247784effb39628a112819d80a12806f2"},{"sha":"218183b33cefb5b504b2a7326256acb4d2f475ed","author":{"name":"Zhen Kong","email":"b999fb1d59364862997bac94d5b793be36d63b01@codeaurora.org"},"message":"msm: crypto: Fix integer over flow check in qcrypto driver\n\nInteger overflow check is invalid when ULONG_MAX is used,\nas ULONG_MAX has typeof 'unsigned long', while req->assoclen,\nreq->crytlen, and qreq.ivsize are 'unsigned int'. Make change\nto use UINT_MAX instead of ULONG_MAX.\n\nCRs-fixed: 1050970\nChange-Id: I3782ea7ed2eaacdcad15b34e047a4699bf4f9e4f\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/DerRomtester/android_kernel_oneplus_msm8974/commits/218183b33cefb5b504b2a7326256acb4d2f475ed"},{"sha":"001f7f45764090401ceefb205bc1b925540478bc","author":{"name":"Peter Hurley","email":"6214814a67b9688a08e8c6dc7fa5dee076dddc8d@hurleysoftware.com"},"message":"BACKPORT: tty: Prevent ldisc drivers from re-using stale tty fields\n\n(cherry picked from commit dd42bf1197144ede075a9d4793123f7689e164bc)\n\nLine discipline drivers may mistakenly misuse ldisc-related fields\nwhen initializing. For example, a failure to initialize tty->receive_room\nin the N_GIGASET_M101 line discipline was recently found and fixed [1].\nNow, the N_X25 line discipline has been discovered accessing the previous\nline discipline's already-freed private data [2].\n\nHarden the ldisc interface against misuse by initializing revelant\ntty fields before instancing the new line discipline.\n\n[1]\n    commit fd98e9419d8d622a4de91f76b306af6aa627aa9c\n    Author: Tilman Schmidt <tilman@imap.cc>\n    Date:   Tue Jul 14 00:37:13 2015 +0200\n\n    isdn/gigaset: reset tty->receive_room when attaching ser_gigaset\n\n[2] Report from Sasha Levin <sasha.levin@oracle.com>\n    [  634.336761] ==================================================================\n    [  634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0\n    [  634.339558] Read of size 4 by task syzkaller_execu/8981\n    [  634.340359] =============================================================================\n    [  634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected\n    ...\n    [  634.405018] Call Trace:\n    [  634.405277] dump_stack (lib/dump_stack.c:52)\n    [  634.405775] print_trailer (mm/slub.c:655)\n    [  634.406361] object_err (mm/slub.c:662)\n    [  634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)\n    [  634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)\n    [  634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))\n    [  634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)\n    [  634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)\n    [  634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)\n    [  634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)\n    [  634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)\n    [  634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)\n\nCc: Tilman Schmidt <tilman@imap.cc>\nCc: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: Peter Hurley <peter@hurleysoftware.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nChange-Id: Ibed6feadfb9706d478f93feec3b240aecfc64af3\nBug: 30951112","distinct":true,"url":"https://api.github.com/repos/DerRomtester/android_kernel_oneplus_msm8974/commits/001f7f45764090401ceefb205bc1b925540478bc"},{"sha":"7597d4d09f0ee972799ca90cac316aee19887313","author":{"name":"Benjamin Tissoires","email":"ace37d3dd488d1f8efb492bba0263a7c3c3d861c@redhat.com"},"message":"HID: core: prevent out-of-bound readings\n\nPlugging a Logitech DJ receiver with KASAN activated raises a bunch of\nout-of-bound readings.\n\nThe fields are allocated up to MAX_USAGE, meaning that potentially, we do\nnot have enough fields to fit the incoming values.\nAdd checks and silence KASAN.\n\nChange-Id: I11d44957b450a3eda258c05f9e833c71a079e83c\nSigned-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>\nSigned-off-by: Jiri Kosina <jkosina@suse.cz>","distinct":true,"url":"https://api.github.com/repos/DerRomtester/android_kernel_oneplus_msm8974/commits/7597d4d09f0ee972799ca90cac316aee19887313"},{"sha":"0b06bb6ef3c74227cae06f070b287286292c3127","author":{"name":"Liam Mark","email":"db460ca79fa3459eb33cde4b2632331670821bd4@codeaurora.org"},"message":"ion: disable system contig heap\n\nA malicious application can take advantage of the ION contig heap to\ncreate a specific memory chunk size to exercise a rowhammer attack on the\nphysical hardware.\nSo remove support for the ION contig heap.\n\nChange-Id: Ide4ba53befe57a73424d3db2644babecf7f14a48\nSigned-off-by: Liam Mark <lmark@codeaurora.org>\nSigned-off-by: Prakash Gupta <guptap@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/DerRomtester/android_kernel_oneplus_msm8974/commits/0b06bb6ef3c74227cae06f070b287286292c3127"},{"sha":"c9114fcef08c261fbd3d7738b986ee0c8f80e83b","author":{"name":"DerRomtester","email":"5a7bee8e18a3828b401fbfa95c3aec5077e32adc@gmail.com"},"message":"Merge remote-tracking branch 'cm/cm-14.1' into cm-14.1","distinct":true,"url":"https://api.github.com/repos/DerRomtester/android_kernel_oneplus_msm8974/commits/c9114fcef08c261fbd3d7738b986ee0c8f80e83b"}]}
{"actor":{"display_login":"DerRomtester"}}