{"push_id":1026366847,"size":4,"distinct_size":4,"ref":"refs/heads/caf/aosp-common/android-3.14","head":"8bea127404cc60fc9bc46c45520e4e5189b617b0","before":"cd86e965c896db0e39f73a9a389c482bf2a82a11","commits":[{"sha":"5610402d594b59f8a94faacae6c42be9c6eb8136","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"UPSTREAM: ALSA: timer: Harden slave timer list handling\n\n(cherry pick from commit b5a663aa426f4884c71cd8580adae73f33570f0d)\n\nA slave timer instance might be still accessible in a racy way while\noperating the master instance as it lacks of locking.  Since the\nmaster operation is mostly protected with timer->lock, we should cope\nwith it while changing the slave instance, too.  Also, some linked\nlists (active_list and ack_list) of slave instances aren't unlinked\nimmediately at stopping or closing, and this may lead to unexpected\naccesses.\n\nThis patch tries to address these issues.  It adds spin lock of\ntimer->lock (either from master or slave, which is equivalent) in a\nfew places.  For avoiding a deadlock, we ensure that the global\nslave_active_lock is always locked at first before each timer lock.\n\nAlso, ack and active_list of slave instances are properly unlinked at\nsnd_timer_stop() and snd_timer_close().\n\nLast but not least, remove the superfluous call of _snd_timer_stop()\nat removing slave links.  This is a noop, and calling it may confuse\nreaders wrt locking.  Further cleanup will follow in a later patch.\n\nActually we've got reports of use-after-free by syzkaller fuzzer, and\nthis hopefully fixes these issues.\n\nChange-Id: I62e7f671a298e70fe6e6e64ddc3ff92106d2adf8\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nBug: 26636060","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.10/commits/5610402d594b59f8a94faacae6c42be9c6eb8136"},{"sha":"b75f241096abf3c3c0f38c55f1054ec10d130511","author":{"email":"3d7fb1b6dbdb0fd749b2e96c177c958476ba6bbb@gmail.com","name":"Matthew Moeller"},"message":"ANDROID: usb: u_ether: Add missing rx_work init\n\ncommit 398a708ed5f3ef771d96dfb9b95b5d5170d17eb7\nusb: u_ether: Add workqueue as bottom half handler for rx data path\n\nset up a worker for the rx data path but missed a case where the\nwork_struct needed to be initialized.\n\nThis patch adds the missing 'INIT_WORK'\n\nChange-Id: I2daabd39d35b3e17a3054837282d649d9c78a0aa\nSigned-off-by: Matthew Moeller <moeller.matt@gmail.com>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.10/commits/b75f241096abf3c3c0f38c55f1054ec10d130511"},{"sha":"ec72752934a3e4a9aa2b161382a54b6efd998e7b","author":{"email":"3d479b85ea8c465591772958e9b4342563a1d10a@google.com","name":"dcashman"},"message":"FROMLIST: drivers: char: random: add get_random_long()\n\n(cherry picked from commit https://lkml.org/lkml/2016/2/4/831)\n\nd07e22597d1d355 (\"mm: mmap: add new /proc tunable for mmap_base ASLR\")\nadded the ability to choose from a range of values to use for entropy\ncount in generating the random offset to the mmap_base address.  The\nmaximum value on this range was set to 32 bits for 64-bit x86 systems, but\nthis value could be increased further, requiring more than the 32 bits of\nrandomness provided by get_random_int(), as is already possible for arm64.\nAdd a new function: get_random_long() which more naturally fits with the\nmmap usage of get_random_int() but operates exactly the same as\nget_random_int().\n\nAlso, fix the shifting constant in mmap_rnd() to be an unsigned long so\nthat values greater than 31 bits generate an appropriate mask without\noverflow.  This is especially important on x86, as its shift instruction\nuses a 5-bit mask for the shift operand, which meant that any value for\nmmap_rnd_bits over 31 acts as a no-op and effectively disables mmap_base\nrandomization.\n\nFinally, replace calls to get_random_int() with get_random_long() where\nappropriate.\n\nBug: 26963541\nSigned-off-by: Daniel Cashman <dcashman@android.com>\nSigned-off-by: Daniel Cashman <dcashman@google.com>\nChange-Id: I27433243d547465fffde4c44b7e439166d04ef7e","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.10/commits/ec72752934a3e4a9aa2b161382a54b6efd998e7b"},{"sha":"8bea127404cc60fc9bc46c45520e4e5189b617b0","author":{"email":"3d479b85ea8c465591772958e9b4342563a1d10a@google.com","name":"dcashman"},"message":"BACKPORT: FROMLIST: mm: ASLR: use get_random_long()\n\n(cherry picked from commit https://lkml.org/lkml/2016/2/4/833)\n\nReplace calls to get_random_int() followed by a cast to (unsigned long)\nwith calls to get_random_long().  Also address shifting bug which, in case\nof x86 removed entropy mask for mmap_rnd_bits values > 31 bits.\n\nBug: 26963541\nSigned-off-by: Daniel Cashman <dcashman@android.com>\nSigned-off-by: Daniel Cashman <dcashman@google.com>\nChange-Id: Ifff5dc2507401501a203fe4670c24dcd4d4de3f5","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.10/commits/8bea127404cc60fc9bc46c45520e4e5189b617b0"}]}