{"push_id":1195187882,"size":29,"distinct_size":0,"ref":"refs/heads/caf/aosp-new/android-msm-flo-3.4-marshmallow-mr1","head":"1fc765b172d54a2776c1eaaf86e28b4f8a9f451d","before":"1683ab87bd6b54dee21a4c55cd3067f3513ac8cd","commits":[{"sha":"19676e8954dbffc5a036ffa32284aa8b9fe5b89a","author":{"name":"Arun Khandavalli","email":"0094dff51b23ffbedb6db9bd30a91715335956f4@qti.qualcomm.com"},"message":"wlan: validate essid length before processing scan req\n\nPresently we are not validating the length of the essid received\nand directly copying the buffer without size checking.\nPerform bound checking before processing the scan req.\n\nChange-Id: I786e4feb67bf039df3d217138a412da54f51787d\nCRs-fixed: 890228\nBug: 27773913","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/19676e8954dbffc5a036ffa32284aa8b9fe5b89a"},{"sha":"72d3908cc1bcb075015f1b86001f4292ac41d38a","author":{"name":"Mahesh A Saptasagar","email":"c7c8a57a635ed86f40d484125aa6c1bd041a6586@qti.qualcomm.com"},"message":"qcacld 2.0: Validate ioctls for valid input length\nprima to qcacld-2.0 propagation\n\nReturn failure to applications if ioctl is invoked with arguments\nof improper length.\n\nBug: 27104184\nChange-Id: I4459c5f39ca9c7a852772913578bd2122cb73879","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/72d3908cc1bcb075015f1b86001f4292ac41d38a"},{"sha":"cbd741f1c3ba36032110f90324b2d9e5d325da3b","author":{"name":"Suman Mukherjee","email":"e3ab071fd017dcf1d764b3b87de4a547154648cf@codeaurora.org"},"message":"msm: camera: ispif: Validate VFE num input during reset\n\nUserspace supplies the actual number of used VFEs in session to ISPIF.\nValidate the userspace input value and if found to be invalid, return\nerror.\n\nBUG=27600832\n\nChange-Id: I91944434e9a83d34af765c40bf8ad297a09ce2f5","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/cbd741f1c3ba36032110f90324b2d9e5d325da3b"},{"sha":"769f7f5144991fab0cdbd84cff65bf38fefb1e98","author":{"name":"Jerry Lee","email":"c7189381eb74de1157e4e1bcfabd4200913e39e2@broadcom.com"},"message":"net: wireless: bcmdhd: check privilege on priv cmd\n\n  check net admin capability for ioctl calls\n\nBUG=26425765\n\nChange-Id: Idae75c9fc530add3ead3508d25e994bbfec9a6de","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/769f7f5144991fab0cdbd84cff65bf38fefb1e98"},{"sha":"a2d9b94c20fbe282153bbec28f270e7f66b84bd4","author":{"name":"Arif Hussain","email":"0627784cb4738ba1b0c40d68a8941ddd52daff4a@qca.qualcomm.com"},"message":"Few IOCTL's SET command's uses ODD number,\nso we cannot utilize kernel facility \"extra\".\nWe need to copy the user data in kernel buffer\nusing copy_from_user function.\n\nChange-Id: I550bf90fbbacb9d5ac4187ed423fca90fafccad1\nCRs-Fixed: 596898\nBug: 27777501","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/a2d9b94c20fbe282153bbec28f270e7f66b84bd4"},{"sha":"fc976934bdaae62880d41e31682007603e19d697","author":{"name":"Girish Gowli","email":"772b19b4f49a5075e3786ee13058c4d57daa4e36@qti.qualcomm.com"},"message":"wlan: Deprecate all WAPI ioctls\n\nALL WAPI ioctls WLAN_PRIV_SET_WAPI_MODE, WLAN_PRIV_GET_WAPI_MODE\nWLAN_PRIV_SET_WAPI_ASSOC_INFO, WLAN_PRIV_SET_WAPI_KEY,\nWLAN_PRIV_SET_WAPI_BKID, WLAN_PRIV_GET_WAPI_BKID are not being\nused, hence removing the source code related to all these ioctls\n\nChange-Id: I204cd579b4e29df7e995f30cc0aa8612bc7965ee\nCRs-Fixed: 677410\nBug: 27776888","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/fc976934bdaae62880d41e31682007603e19d697"},{"sha":"2c357471623af6de30bc7c8d892b50409339a0bf","author":{"name":"Arif Hussain","email":"0627784cb4738ba1b0c40d68a8941ddd52daff4a@qca.qualcomm.com"},"message":"wlan: wlan_hdd_wext Userspace data copy fix\n\nUse copy_to_user and copy_from_user for\ncopying data to/from user space\n\nChange-Id: I98fb6352b654af8f78160738e7ccd902c3c70031\nCRs-Fixed: 561028\nCRs-Fixed: 605932\nBug: 27662174\nBug: 27777162","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/2c357471623af6de30bc7c8d892b50409339a0bf"},{"sha":"09a22c66ac761c2b33b46080a731bea47fd477fa","author":{"name":"Rajesh Kemisetti","email":"eb3c69d0c46395023fcec2d6245f10d8d8475c76@codeaurora.org"},"message":"msm: kgsl: Add missing checks for alloc size and sglen\n\nIn _kgsl_sharedmem_page_alloc():\n\n- Make len of type size_t to be in line with size.\n- Check for boundary limits of requested alloc size before honoring.\n- Make sure sglen is greater than zero before marking it as end\nof sg list.\n\nBug: 27475454\nChange-Id: I5389bcef3478f2ccf2be5f719049867496235f28\nSigned-off-by: Yuan Lin <yualin@google.com>","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/09a22c66ac761c2b33b46080a731bea47fd477fa"},{"sha":"b350fa1d76b6101ca3ed3c7320e484b4d808a807","author":{"name":"Arif Hussain","email":"0627784cb4738ba1b0c40d68a8941ddd52daff4a@qca.qualcomm.com"},"message":"wlan: Userspace data copy fix\n\nUse copy_to_user and copy_from_user for\ncopying data to/from user space.\n\nChange-Id: I07ed5361b439f4bcd61bbf693cc17c950f5b2660\nCRs-Fixed: 561022","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/b350fa1d76b6101ca3ed3c7320e484b4d808a807"},{"sha":"0ac643ae44db9006ad2e72767c642b4fb6bfa393","author":{"name":"Hariprasad Dhalinarasimha","email":"1b0234d10fa6a32f4176db93c1130dd297aace29@codeaurora.org"},"message":"qseecom: Change __copy_from_user to copy_from_user\n\n__copy_from_user does not do address check, so use\ncopy_from_user instead.\n\nBug: 28469042\nChange-Id: I575c0f3c44b55a521c0d42828988c518c0640a29\nCRs-Fixed: 545747\nSigned-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/0ac643ae44db9006ad2e72767c642b4fb6bfa393"},{"sha":"18cd721872df8fc2a2291d95317cc2102d368cd1","author":{"name":"Shalabh Jain","email":"8add006504fba7989a4012e3c2625ceadea19166@codeaurora.org"},"message":"Add bounds check before copying data to prevent buffer overflow.\n\nBug: 28410333\nChange-Id: I47b9685b1ab13c4863fb6db62bbb9497a00b36da\nSigned-off-by: Shalabh Jain <shalabhj@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/18cd721872df8fc2a2291d95317cc2102d368cd1"},{"sha":"82e4047ad3d23b6ff86ada83c0fafdae08af6220","author":{"name":"Karthikeyan Ramasubramanian","email":"f8c024263b29fe33b9929f0b5fb3a166c82f9fa1@codeaurora.org"},"message":"msm: ipc: Add check to avoid integer & buffer overflow\n\nIn IPC Router configure security rule operation, add check to avoid\ninteger overflow and hence a buffer overflow.\n\nBug: 28430703\nCRs-Fixed: 457405\nChange-Id: I5448e14242be764a7b7adfe650b2c9124701c2c5\nSigned-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/82e4047ad3d23b6ff86ada83c0fafdae08af6220"},{"sha":"93999e61f43978e7adfcae7bbdcc6c258fa36182","author":{"name":"Karthikeyan Ramasubramanian","email":"f8c024263b29fe33b9929f0b5fb3a166c82f9fa1@codeaurora.org"},"message":"msm: ipc: Detect integer overflow before it happens\n\nAs per ANSI C Standard document, integer overflow is an undefined\nbehavior. So update the code to detect integer overflow before it happens.\n\nBug: 28430703\nCRs-Fixed: 491629\nChange-Id: Ifd90c05266477c7734710bb94b9021f8bb9ab761\nSigned-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/93999e61f43978e7adfcae7bbdcc6c258fa36182"},{"sha":"451ba15d80d8868176ed3df57917519298b29cff","author":{"name":"Hariram Purushothaman","email":"4ecdb2ffeda476fa6a459a512ea3936133a93d90@codeaurora.org"},"message":"msm: camera: Fix various small issues in Actuator driver\n\nBound check and validate userspace parameters direction,\nnumber of steps and direction sign. Also fix possible\nmemory leak in certain error cases.\n\nBug: 28431531\nCRs-Fixed: 511349\nChange-Id: Icaa324468574494fb40f2de78e522090806744cb\nSigned-off-by: Hariram Purushothaman <hpurus@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/451ba15d80d8868176ed3df57917519298b29cff"},{"sha":"2021b895cbf382349c381726f2b2115e89a848b3","author":{"name":"Nick Desaulniers","email":"b951273a67bf33267cd4dff69171cdef4e5efbe7@google.com"},"message":"msm: camera: Fix various small issues in cci driver\n\nRemove some unused ioctl exposed, Also add\nsome bound checks for ioctl user params.\n\nBug: 28441831\nChange-Id: Ifdd441fdb25fd20b005c4e4e1ebe4e203f1216ac\nCRs-Fixed: 511382\nSigned-off-by: Hariram Purushothaman <hpurus@codeaurora.org>\nSigned-off-by: Shuzhen Wang <shuzhenw@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/2021b895cbf382349c381726f2b2115e89a848b3"},{"sha":"8064a62b276fb3c7f2396718a754fb1ef5f2e6aa","author":{"name":"Nick Desaulniers","email":"b951273a67bf33267cd4dff69171cdef4e5efbe7@google.com"},"message":"From a7502f4f801bb95bff73617309835bb7a016cde5 Mon Sep 17 00:00:00 2001 From: Xu Han <hanxu@codeaurora.org> Date: Wed, 25 Sep 2013 15:28:32 -0700 Subject: msm: camera: Checking an enum value greater than zero\n\nAn enum value cci_i2c_master is not checked to be greater than 0.\nAdd the check.\n\nBug: 28441831\nChange-Id: Ibe75ab7155def45d81b8127c5eda3fa2ed570bce\nSigned-off-by: Xu Han <hanxu@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/8064a62b276fb3c7f2396718a754fb1ef5f2e6aa"},{"sha":"f60163662536d3945af39015dbb2e3053a98933a","author":{"name":"Nick Desaulniers","email":"b951273a67bf33267cd4dff69171cdef4e5efbe7@google.com"},"message":"diag: Fix for diag debugfs buffer overflow\n\nDiag debugfs buffer has potential buffer overflow scenario which can\ncause\nmemory corruption. Added safeguard to prevent this.\n\nCrs-fixed: 585147\nChange-Id: Ie1f099bb4bb626adff99ae225966aef70c1bc15e\nSigned-off-by: Sreelakshmi Gownipalli <sgownipa@codeaurora.org>\n\nBug: 28442449","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/f60163662536d3945af39015dbb2e3053a98933a"},{"sha":"6e653fff37e8790711b78c8431f43703d28623d5","author":{"name":"Vasko Kalanoski","email":"be1f9066a41dc2a65144eca8f4098d397256f495@codeaurora.org"},"message":"msm: actuator: fix to prevent kernel heap buffer overflow\n\nfix to prevent kernel heap buffer overflow allows user\ncontrolled data to be written to the heap via the\nmsm_camera actuator IOCTLs\n\nBug: 28557260\nChange-Id: I4458831e28e0081fb2f5ae55506be866100e1b4f\nSigned-off-by: Vasko Kalanoski <vaskok@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/6e653fff37e8790711b78c8431f43703d28623d5"},{"sha":"37836aa8ad1420a4b25977d45613d08a3eb70a29","author":{"name":"Hariprasad Dhalinarasimha","email":"1b0234d10fa6a32f4176db93c1130dd297aace29@codeaurora.org"},"message":"qseecom: Validate the incoming length from user space\n\nCheck if there is no integer overflow before using req_len and\nresp_len (received from user space). If an overflow is detected\nthen exit the operation.\n\nBug: 28571496\nChange-Id: I0459a6992bb3b280db42be63a275c55fa6105b1c\nSigned-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/37836aa8ad1420a4b25977d45613d08a3eb70a29"},{"sha":"26eed7f7a23dae13d4fd8e2aebce7888f1bff547","author":{"name":"Pachika, Vikas Reddy","email":"8821744ebe8d0f32b08066e25a7eb37b551b968f@codeaurora.org"},"message":"msm: vidc: Validate userspace buffer count before using it\n\nValidate the number of buffers count variable before\nusing it to avoid structure overflow error.\n\nBug: 28598501\n\nChange-Id: I61582c93e0f26ec6842e437134fb8a42bdbc36ff\nCRs-fixed: 563654\nSigned-off-by: Pachika, Vikas Reddy <vpachi@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/olivieer/kernel_msm-3.10/commits/26eed7f7a23dae13d4fd8e2aebce7888f1bff547"}]}
{"actor":{"display_login":"pepe-bot"}}