{"push_id":1348857249,"size":15,"distinct_size":15,"ref":"refs/heads/aosp-new/android-msm-shamu-3.10-marshmallow-mr1","head":"b162aae6d2f3223e6bc971fa9fc31647b1fde08e","before":"3d4b4ed1fe0d195e9f0c8d6c9dcdda0de8cbc723","commits":[{"sha":"b82ef25b64f64ffdb3c6840077dd643abcefc4dd","author":{"name":"Patrick Tjin","email":"46d88a89e92edd8988129e9c71eaf27efb6541ae@google.com"},"message":"usb: gadget: f_usbnet: zero out CRC padding\n\nZero out CRC padding to prevent leaking of uninitialized data\n\nBug: 29914434\n\nChange-Id: Iba84c2078449468b1d37bf122267773169780a3b\nSigned-off-by: Patrick Tjin <pattjin@google.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/b82ef25b64f64ffdb3c6840077dd643abcefc4dd"},{"sha":"be588ca11dcf2c0cca1a02c4c0a179f87eddc2ec","author":{"name":"Yuan Lin","email":"510df78bd986b566844f5063b854cc1cdb03e723@google.com"},"message":"ASoC: check for null function pointer for dummy device read/write\n\nAdding check for null function pointer for dummy sound driver\nread/write to prevent kernel panic.\n\nBug: 28838221\nChange-Id: I32548a7e37869a17a5f88c646ddbfb8243cadcc0\nSigned-off-by: Yuan Lin <yualin@google.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/be588ca11dcf2c0cca1a02c4c0a179f87eddc2ec"},{"sha":"061687d324fd6855effb2663a79c34951585e3bf","author":{"name":"Arnaldo Carvalho de Melo","email":"7310a59577712e001e6abd523e66592d8f2dc989@redhat.com"},"message":"UPSTREAM: net: Fix use after free in the recvmmsg exit path\n\n(cherry picked from commit 34b88a68f26a75e4fded796f1a49c40f82234b7d)\n\nThe syzkaller fuzzer hit the following use-after-free:\n\n  Call Trace:\n   [<ffffffff8175ea0e>] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:295\n   [<ffffffff851cc31a>] __sys_recvmmsg+0x6fa/0x7f0 net/socket.c:2261\n   [<     inline     >] SYSC_recvmmsg net/socket.c:2281\n   [<ffffffff851cc57f>] SyS_recvmmsg+0x16f/0x180 net/socket.c:2270\n   [<ffffffff86332bb6>] entry_SYSCALL_64_fastpath+0x16/0x7a\n  arch/x86/entry/entry_64.S:185\n\nAnd, as Dmitry rightly assessed, that is because we can drop the\nreference and then touch it when the underlying recvmsg calls return\nsome packets and then hit an error, which will make recvmmsg to set\nsock->sk->sk_err, oops, fix it.\n\nReported-and-Tested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: Alexander Potapenko <glider@google.com>\nCc: Eric Dumazet <edumazet@google.com>\nCc: Kostya Serebryany <kcc@google.com>\nCc: Sasha Levin <sasha.levin@oracle.com>\nFixes: a2e2725541fa (\"net: Introduce recvmmsg socket syscall\")\nhttp://lkml.kernel.org/r/20160122211644.GC2470@redhat.com\nSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>\nChange-Id: I2adb0faf595b7b634d9b739dfdd1a47109e20ecb\nBug: 30515201","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/061687d324fd6855effb2663a79c34951585e3bf"},{"sha":"8b1dafa2a5cd525f2faf19f68db4b1febeb5b9c8","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"BACKPORT: tcp: make challenge acks less predictable\n\n(cherry picked from commit 75ff39ccc1bd5d3c455b6822ab09e533c551f758)\n\nYue Cao claims that current host rate limiting of challenge ACKS\n(RFC 5961) could leak enough information to allow a patient attacker\nto hijack TCP sessions. He will soon provide details in an academic\npaper.\n\nThis patch increases the default limit from 100 to 1000, and adds\nsome randomization so that the attacker can no longer hijack\nsessions without spending a considerable amount of probes.\n\nBased on initial analysis and patch from Linus.\n\nNote that we also have per socket rate limiting, so it is tempting\nto remove the host limit in the future.\n\nv2: randomize the count of challenge acks per second, not the period.\n\nFixes: 282f23c6ee34 (\"tcp: implement RFC 5961 3.2\")\nReported-by: Yue Cao <ycao009@ucr.edu>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSuggested-by: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Yuchung Cheng <ycheng@google.com>\nCc: Neal Cardwell <ncardwell@google.com>\nAcked-by: Neal Cardwell <ncardwell@google.com>\nAcked-by: Yuchung Cheng <ycheng@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nChange-Id: Ib46ba66f5e4a5a7c81bfccd7b0aa83c3d9e1b3bb\nBug: 30809774","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/8b1dafa2a5cd525f2faf19f68db4b1febeb5b9c8"},{"sha":"45a381a38540db7621da248d996b1efe961bdd10","author":{"name":"Nick Desaulniers","email":"b951273a67bf33267cd4dff69171cdef4e5efbe7@google.com"},"message":"binder: prevent kptr leak by using %pK format specifier\n\nWorks in conjunction with kptr_restrict.\nBug: 30143283\n\nChange-Id: I2b3ce22f4e206e74614d51453a1d59b7080ab05a","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/45a381a38540db7621da248d996b1efe961bdd10"},{"sha":"c210f9f994df51515fe0c956d13e3f2b63cf9fe2","author":{"name":"Marek Szyprowski","email":"4d0ab7dac85d754388f4be3549f400e336faa58a@samsung.com"},"message":"arm64: dma-mapping: always clear allocated buffers\n\n[ Upstream commit 6829e274a623187c24f7cfc0e3d35f25d087fcc5 ]\n\nBuffers allocated by dma_alloc_coherent() are always zeroed on Alpha,\nARM (32bit), MIPS, PowerPC, x86/x86_64 and probably other architectures.\nIt turned out that some drivers rely on this 'feature'. Allocated buffer\nmight be also exposed to userspace with dma_mmap() call, so clearing it\nis desired from security point of view to avoid exposing random memory\nto userspace. This patch unifies dma_alloc_coherent() behavior on ARM64\narchitecture with other implementations by unconditionally zeroing\nallocated buffer.\n\nBug: 29795245\nCRs-Fixed: 1041735\nChange-Id: I74bf024e0f603ca8c0b05430dc2ee154d579cfb2\nCc: <stable@vger.kernel.org> # v3.14+\nSigned-off-by: Marek Szyprowski <m.szyprowski@samsung.com>\nSigned-off-by: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>\nGit-commit: a142e9641dcbead2c8845c949ad518acac96ed28\nGit-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\n[lmark@codeaurora.org: resolve merge conflicts]\nSigned-off-by: Liam Mark <lmark@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/c210f9f994df51515fe0c956d13e3f2b63cf9fe2"},{"sha":"2bb100e026b936a2fcf68f3e42c27e8624b3ae63","author":{"name":"Biswajit Paul","email":"7ee5649c8de55a61a3bbcbc7dcde16c04b2f65da@codeaurora.org"},"message":"msm: crypto: Fix integer overflow check in qcedev driver\n\nInteger overflow check always fails when ULONG_MAX is used,\nas ULONG_MAX is 2^64-1, while req->data[i].len and total\nare uint32_t. Make change to use U32_MAX instead of\nULONG_MAX.\n\nBug: 29999665\nCRs-fixed: 1046507\nChange-Id: Iccf9c32400ecc7ffc0afae16f58c38e5d78a5b64\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>\nSigned-off-by: Mekala Natarajan <mekalan@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/2bb100e026b936a2fcf68f3e42c27e8624b3ae63"},{"sha":"ee519781a1c67e404002e667738b13f743b02336","author":{"name":"Divya Ponnusamy","email":"499583450a0afa8f7b400d046a2396e658a503cf@codeaurora.org"},"message":"staging: android: Change %p to %pK in debug messages\n\nThe format specifier %p can leak kernel addresses\nwhile not valuing the kptr_restrict system settings.\nUse %pK instead of %p, which also evaluates whether\nkptr_restrict is set.\n\nBug: 30148243\nChange-Id: Ib1adf14e9620ad7b1bd3e962001c852610210d46\nSigned-off-by: Divya Ponnusamy <pdivya@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/ee519781a1c67e404002e667738b13f743b02336"},{"sha":"e0a25b6e9ea5f53493da50d006ac008ed470f505","author":{"name":"Biswajit Paul","email":"7ee5649c8de55a61a3bbcbc7dcde16c04b2f65da@codeaurora.org"},"message":"msm: camera: sensor: Fix use after free condition\n\nAdd a check to return value before calling csid config which will\notherwise lead to use after free scenario.\n\nBug: 29513227\nChange-Id: I230ae06474332bbb23c7169423447766f5e2cf0b\nCRs-Fixed: 1040857\nSigned-off-by: VijayaKumar T M <vtmuni@codeaurora.org>\nSigned-off-by: Biswajit Paul <biswajitpaul@codeaurora.org>\nSigned-off-by: Yueyao (Nathan) Zhu <yueyao@google.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/e0a25b6e9ea5f53493da50d006ac008ed470f505"},{"sha":"242bf797a8596139999e0853920cede98e757a01","author":{"name":"Vasko Kalanoski","email":"be1f9066a41dc2a65144eca8f4098d397256f495@codeaurora.org"},"message":"msm: camera: restructure data handling to be more robust\n\nadd dynamic array allocation instead of static to prevent\nstack overflow.\n\nBug: 30102557\nChange-Id: I364a5ed1842757a45bcfa34cf7d2bd9436095779\nSigned-off-by: Vasko Kalanoski <vaskok@codeaurora.org>\nSigned-off-by: Yueyao (Nathan) Zhu <yueyao@google.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/242bf797a8596139999e0853920cede98e757a01"},{"sha":"a2f16b1ac1abd91442fde4df175ca7d1ee85a03c","author":{"name":"Ping Li","email":"ae02d191d70685958f382c54e0edcb6e92d3ef8d@codeaurora.org"},"message":"msm: mdss: Correct block id check for mdss_mdp_misr_table\n\nDISPLAY_MISR_LCDC block doesn't have corresponding mdss_mdp_misr_table,\nthis change corrects the block id check for mdss_mdp_misr_table.\n\nBug: 30874196\nCRs-Fixed: 1001224\nChange-Id: I74b03c31542d4b239eb2ffdc4dc6345dff5eab86\nSigned-off-by: Ping Li <pingli@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/a2f16b1ac1abd91442fde4df175ca7d1ee85a03c"},{"sha":"5b5e3e89ce2a629e875bebfef40ad22d555fb8b8","author":{"name":"Biswajit Paul","email":"7ee5649c8de55a61a3bbcbc7dcde16c04b2f65da@codeaurora.org"},"message":"qseecom: validate the inputs of __qseecom_send_modfd_resp\n\nThe resp_len and resp_buf_ptr of qseecom_send_modfd_listener_resp\nare not checked, then an userspace application that manipulates\nresp_len can corrupt the kernel memory. Thus make changes to\nvalidate these parameters.\n\nBug: 29157595\nCRs-fixed: 1036418\nChange-Id: Id43ec6b55b332d0dac09a9abb998a410f49b44f7\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>\nSigned-off-by: Biswajit Paul <biswajitpaul@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/5b5e3e89ce2a629e875bebfef40ad22d555fb8b8"},{"sha":"4e950472a280a8427f301a2f227f3e108f8c1cc4","author":{"name":"Arve Hjønnevåg","email":"252c00e8bf89f12b2f75a1e0ab87a5ad019cda88@android.com"},"message":"ANDROID: binder: Add strong ref checks\n\nPrevent using a binder_ref with only weak references where a strong\nreference is required.\n\nBUG: 30445380\nChange-Id: I66c15b066808f28bd27bfe50fd0e03ff45a09fca\nSigned-off-by: Arve Hjønnevåg <arve@android.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/4e950472a280a8427f301a2f227f3e108f8c1cc4"},{"sha":"11032d745836280574827bb1db5e64a94945180e","author":{"name":"Arve Hjønnevåg","email":"252c00e8bf89f12b2f75a1e0ab87a5ad019cda88@android.com"},"message":"ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct\n\nPrevents leaking pointers between processes\n\nBUG: 30768347\nChange-Id: Id898076926f658a1b8b27a3ccb848756b36de4ca\nSigned-off-by: Arve Hjønnevåg <arve@android.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/11032d745836280574827bb1db5e64a94945180e"},{"sha":"b162aae6d2f3223e6bc971fa9fc31647b1fde08e","author":{"name":"Naseer Ahmed","email":"48d133d773bac78f5175746a53642d188d5bcf5d@codeaurora.org"},"message":"msm: mdss: Fix to validate data copied from user space\n\nThe overlay zorder values copied from user space are used\nas index in left_lm_zo_cnt and right_lm_zo_cnt. This fix\nwill validate the overlay zorder value copied from user\nspace to not go beyond MDSS_MDP_MAX_STAGE, thus preventing\nany arbitrary increments in kernel memory.\n\nBug: 30019716\nCRs-Fixed: 1049232\nChange-Id: Ie8e65ce9f58cb357204bfa4c6a6e0fccec82d5ba\nSigned-off-by: Shalini Krishnamoorthi <shakri@codeaurora.org>\nSigned-off-by: Naseer Ahmed <naseer@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/b162aae6d2f3223e6bc971fa9fc31647b1fde08e"}]}
{"actor":{"display_login":"mifl"}}