{"push_id":1478161540,"size":107,"distinct_size":107,"ref":"refs/heads/caf/aosp-new/android-msm-shamrock-3.10-nougat-release","head":"c6d78666950ce8cdb90ed3a2151866d0cf911255","before":"e6dbd012322c0d4b211e23268abc5c9647421c78","commits":[{"sha":"8163dc85502bf40f84dc01059f4403ee84896691","author":{"name":"Shigeru\\ Murai","email":"55d72bb5d7ff90ca99e53ca8744bbd76be6e2f8c@list.sharp.co.jp"},"message":"ASoc: dapm: Fix race condition with dapm mutex lock\n\nIn headset usecase, observe race condition for\ndapm mutex lock. snd_soc_dapm_put_pin_switch,\nsnd_soc_dapm_force_enable_pin, snd_soc_dapm_set_pin\nAPIs are updated to handle the lock correctly.\n\nChange-Id: I8a30865e82b58138ae1195c32e8c7ffd3f87bd5e","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/8163dc85502bf40f84dc01059f4403ee84896691"},{"sha":"c65fd843a0ed1f87c4b5723d90684de0a74fa10e","author":{"name":"Shigeru\\ Murai","email":"55d72bb5d7ff90ca99e53ca8744bbd76be6e2f8c@list.sharp.co.jp"},"message":"ASoc: wcd-mbhc: Disable the rejudge from headphone to lineout only for eve\n\nFor eve, we disabled lineout report for digital TV antenna.\nBut this causes that eve can't detect actual lineout cable.\nSo, only for eve, we disable the rejudge from headphone to lineout.\n\nChange-Id: If162da6ea4c673092fbdd25b9e36a54c1a507355","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/c65fd843a0ed1f87c4b5723d90684de0a74fa10e"},{"sha":"231c45f0a7f7150a146839d29b54a6ba5a56ca4f","author":{"name":"Sivacharan Paka","email":"ae521fe640878fa036f5db9f021f78203c4ac3e4@qti.qualcomm.com"},"message":"KEYS: Fix ASN.1 indefinite length object parsing\nThis fixes CVE-2016-0758.\n\nIn the ASN.1 decoder, when the length field of an ASN.1 value is extracted,\nit isn't validated against the remaining amount of data before being added\nto the cursor.  With a sufficiently large size indicated, the check:\n\n\tdatalen - dp < 2\n\nmay then fail due to integer overflow.\n\nFix this by checking the length indicated against the amount of remaining\ndata in both places a definite length is determined.\n\nWhilst we're at it, make the following changes:\n\n (1) Check the maximum size of extended length does not exceed the capacity\n     of the variable it's being stored in (len) rather than the type that\n     variable is assumed to be (size_t).\n\n (2) Compare the EOC tag to the symbolic constant ASN1_EOC rather than the\n     integer 0.\n\n (3) To reduce confusion, move the initialisation of len outside of:\n\n\tfor (len = 0; n > 0; n--) {\n\n     since it doesn't have anything to do with the loop counter n.\n\nChange-Id: I97544bd3bd6ccdf9316aa196cd367f1361fb4226\nSigned-off-by: David Howells <dhowells@redhat.com>\nReviewed-by: Mimi Zohar <zohar@linux.vnet.ibm.com>\nAcked-by: David Woodhouse <David.Woodhouse@intel.com>\nAcked-by: Peter Jones <pjones@redhat.com>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/231c45f0a7f7150a146839d29b54a6ba5a56ca4f"},{"sha":"3c5631c25909a6b7fee5389389bbd5a2fefba185","author":{"name":"Sivacharan Paka","email":"ae521fe640878fa036f5db9f021f78203c4ac3e4@qti.qualcomm.com"},"message":"arm64: perf: reject groups spanning multiple HW PMUs\nThe perf core implicitly rejects events spanning multiple HW PMUs, as in\nthese cases the event->ctx will differ. However this validation is\nperformed after pmu::event_init() is called in perf_init_event(), and\nthus pmu::event_init() may be called with a group leader from a\ndifferent HW PMU.\n\nThe ARM64 PMU driver does not take this fact into account, and when\nvalidating groups assumes that it can call to_arm_pmu(event->pmu) for\nany HW event. When the event in question is from another HW PMU this is\nwrong, and results in dereferencing garbage.\n\nThis patch updates the ARM64 PMU driver to first test for and reject\nevents from other PMUs, moving the to_arm_pmu and related logic after\nthis test. Fixes a crash triggered by perf_fuzzer on Linux-4.0-rc2, with\na CCI PMU present:\n\nBad mode in Synchronous Abort handler detected, code 0x86000006 -- IABT (current EL)\nCPU: 0 PID: 1371 Comm: perf_fuzzer Not tainted 3.19.0+ #249\nHardware name: V2F-1XV7 Cortex-A53x2 SMM (DT)\ntask: ffffffc07c73a280 ti: ffffffc07b0a0000 task.ti: ffffffc07b0a0000\nPC is at 0x0\nLR is at validate_event+0x90/0xa8\npc : [<0000000000000000>] lr : [<ffffffc000090228>] pstate: 00000145\nsp : ffffffc07b0a3ba0\n\n[<          (null)>]           (null)\n[<ffffffc0000907d8>] armpmu_event_init+0x174/0x3cc\n[<ffffffc00015d870>] perf_try_init_event+0x34/0x70\n[<ffffffc000164094>] perf_init_event+0xe0/0x10c\n[<ffffffc000164348>] perf_event_alloc+0x288/0x358\n[<ffffffc000164c5c>] SyS_perf_event_open+0x464/0x98c\nCode: bad PC value\n\nAlso cleans up the code to use the arm_pmu only when we know\nthat we are dealing with an arm pmu event.\n\nChange-Id: I120c9f131601569e3161d09f8a4bc9306a16000d\nCc: Will Deacon <will.deacon@arm.com>\nAcked-by: Mark Rutland <mark.rutland@arm.com>\nAcked-by: Peter Ziljstra (Intel) <peterz@infradead.org>\nSigned-off-by: Suzuki K. Poulose <suzuki.poulose@arm.com>\nSigned-off-by: Will Deacon <will.deacon@arm.com>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/3c5631c25909a6b7fee5389389bbd5a2fefba185"},{"sha":"2412903182da498c871086a8a00e9dc519c2dbeb","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"ASoC: msm-lsm-client: free lsm client data in msm_lsm_close\n\nCurrently lsm client data is deallocated when q6lsm_open() fails\nwhich can cause memory corruption if lsm client data is accessed\nafter freed. Fix this issue by deallocating the client data only\nin msm_lsm_close().\n\nChange-Id: If048c26a0ffd8a346a28622183cbf2ba1e7e5ff3\nSigned-off-by: Vidyakumar Athota <vathota@codeaurora.org>\n\nSigned-off-by: Sivacharan Paka <sipaka@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/2412903182da498c871086a8a00e9dc519c2dbeb"},{"sha":"c70e508616bbdd756c217f5a4b97c0d35bf08b3e","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"ASoC : msm: qdsp6v2: Add size check in audio cal ioctl\n\nFor the audio get calibration ioctl compare the allocated\nbuffer size to the size of the header and cal type header\nto ensure the buffer is big enough.\n\nCRs-Fixed: 1038127\nChange-Id: I851b4454e8420706ad3263d67e892720d46e5718\nSigned-off-by: Ben Romberger <bromberg@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/c70e508616bbdd756c217f5a4b97c0d35bf08b3e"},{"sha":"32484e7956f6c6435af5f14e3260abda5f3311f2","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"ASoC: msm-lsm-client: free lsm client data in msm_lsm_close\n\nCurrently lsm client data is deallocated when q6lsm_open() fails\nwhich can cause memory corruption if lsm client data is accessed\nafter freed. Fix this issue by deallocating the client data only\nin msm_lsm_close().\n\nChange-Id: If048c26a0ffd8a346a28622183cbf2ba1e7e5ff3\nSigned-off-by: Vidyakumar Athota <vathota@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/32484e7956f6c6435af5f14e3260abda5f3311f2"},{"sha":"82f3bc07eba60b4f8256d6fc29eec28c7033a1dd","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"misc: qcom: qdsp6v2: Add missing initialization\n\nUse vars in driver context after proper initialization\n\nChange-Id: I3e59e27534b8e1088d74b42c72e0075d2fe910e6\nSigned-off-by: Haynes Mathew George <hgeorge@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/82f3bc07eba60b4f8256d6fc29eec28c7033a1dd"},{"sha":"a1cf14b07efeca5b6ee1be92d7e4a0fc8cf48b59","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"ASoC: msm: qdsp6v2: DAP: Allocate param buffer with correct size\n\nSize of param buffer should be big enough to hold param length\nof data and param payload.\n\nCRs-Fixed: 1033525\nChange-Id: I6fa58f87a7c7df5f0485ea5b368ea090eb8bedb4\nSigned-off-by: Ashish Jain <ashishj@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/a1cf14b07efeca5b6ee1be92d7e4a0fc8cf48b59"},{"sha":"5fe79068771e6275ade379bdd4acaa9b2cdba285","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"ASoC: msm: qdsp6v2: DAP: Add check to validate param length\n\nTo avoid buffer overflow, validate input length used to\nfetch visualizer data.\n\nCRs-Fixed: 1033540\nChange-Id: I445d1ba3bce47308bc31ae24a70d5ee358f22a2d\nSigned-off-by: Ashish Jain <ashishj@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/5fe79068771e6275ade379bdd4acaa9b2cdba285"},{"sha":"2665307392ae6629a19b362b9d0b411430f404ce","author":{"name":"Sivacharan Paka","email":"ae521fe640878fa036f5db9f021f78203c4ac3e4@qti.qualcomm.com"},"message":"wcnss: Avoid user buffer overloading for write cal data\n\ncompare size of allocated cal data buffer from heap\nand count bytes provided to write by user to avoid\nheap overflow for write cal data.\nChange-Id: Id70c3230f761385489e5e94c613f4519239dfb1f\nCRs-Fixed: 1032174\nSigned-off-by: Anand Kumar <anandkumar@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/2665307392ae6629a19b362b9d0b411430f404ce"},{"sha":"bfff4f6704140e78b07439fc6bfa1cda83922b05","author":{"name":"Sivacharan Paka","email":"ae521fe640878fa036f5db9f021f78203c4ac3e4@qti.qualcomm.com"},"message":"wlan: Resolve buffer overflow issue while processing GET_CFG IOCTL\n\nqcacld-2.0 to prima propagation\nThere is a possibility of buffer overflow while processing\nGET_CFG IOCTL to retrieve ini parameters from a global array,\nbecause of invalid if condition.\nResolve buffer overflow issue by correcting if condition.\nChange-Id: I8881abde0b543d7b1562968ecbb6240a0ca552a3\nCRs-Fixed: 1000853","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/bfff4f6704140e78b07439fc6bfa1cda83922b05"},{"sha":"aeba55168fbe96f3ecb22f02f102164017eb9857","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"msm: camera: sensor: Fix use after free condition\n\nAdd a check to return value before calling csid config which will\notherwise lead to use after free scenario.\nCRs-Fixed: 1040857\nChange-Id: I4f4d9e38eeb537875e0d01de0e99913a44dd3f3f\nSigned-off-by: VijayaKumar T M <vtmuni@codeaurora.org>\nSigned-off-by: Suman Mukherjee <sumam@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/aeba55168fbe96f3ecb22f02f102164017eb9857"},{"sha":"a3aaad33eb3c10e8f56ab03260846f519368d492","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"ASoC: msm: qdsp6v2: DAP: Add check to validate data length\n\nValidate input data length to ensure only relevant data\nis copied.\n\nCRs-Fixed: 1027585\nChange-Id: I67eb4f162f944bbf4d9e55fb8fe93759e6b8ff91\nSigned-off-by: Ashish Jain <ashishj@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/a3aaad33eb3c10e8f56ab03260846f519368d492"},{"sha":"f0cac931f43b36c1069231925ed8de5aea7f0992","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"qseecom: validate the inputs of __qseecom_send_modfd_resp\n\nThe resp_len and resp_buf_ptr of qseecom_send_modfd_listener_resp\nare not checked, then an userspace application that manipulates\nresp_len can corrupt the kernel memory. Thus make changes to\nvalidate these parameters.\n\nCRs-fixed: 1036418\nChange-Id: Id43ec6b55b332d0dac09a9abb998a410f49b44f7\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/f0cac931f43b36c1069231925ed8de5aea7f0992"},{"sha":"5dd7535943766a46b520c46156e03c8cbc892c26","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"msm: crypto: Fix integer over flow check in qcedev driver\n\nInteger overflow check always fails when ULONG_MAX is used,\nas ULONG_MAX is 2^64-1, while req->data[i].len and total\nare uint32_t. Make change to use U32_MAX instead of\nULONG_MAX.\n\nCRs-fixed: 1046507\nChange-Id: Iccf9c32400ecc7ffc0afae16f58c38e5d78a5b64\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/5dd7535943766a46b520c46156e03c8cbc892c26"},{"sha":"1ba3396a4518caa4a55a145adedec6a89a6d4ae6","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"msm: mdss: Fix to validate data copied from user space\n\nThe overlay zorder values copied from user space are used\nas index in left_lm_zo_cnt and right_lm_zo_cnt. This fix\nwill validate the overlay zorder value copied from user\nspace to not go beyond MDSS_MDP_MAX_STAGE, thus preventing\nany arbitrary increments in kernel memory.\n\nCRs-Fixed: 1049232\nChange-Id: Ie8e65ce9f58cb357204bfa4c6a6e0fccec82d5ba\nSigned-off-by: Shalini Krishnamoorthi <shakri@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/1ba3396a4518caa4a55a145adedec6a89a6d4ae6"},{"sha":"2b1e41276b05e3a429b7b314ffb5fb9a12b929d4","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"msm: mdss: Correct block id check for mdss_mdp_misr_table\n\nDISPLAY_MISR_LCDC block doesn't have corresponding mdss_mdp_misr_table,\nthis change corrects the block id check for mdss_mdp_misr_table.\n\nCRs-Fixed: 1001224\nChange-Id: I74b03c31542d4b239eb2ffdc4dc6345dff5eab86\nSigned-off-by: Ping Li <pingli@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/2b1e41276b05e3a429b7b314ffb5fb9a12b929d4"},{"sha":"d94ce66f6b379004d9d0336ccee971d43d5aa5cc","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"msm: ipa: handle information leak on ADD_FLT_RULE_INDEX ioctl\n\nIPA might have Information leak and device crash due to\nkernel heap overread in IPA driver when processing\nWAN_IOC_ADD_FLT_RULE_INDEX ioctl. The fix is to add\ncheck on max number of filter rules send to modem.\n\nChange-Id: I454e04d05cfcb7af8fc4bd2b4a1bade55c4684d0\nSigned-off-by: Skylar Chang <chiaweic@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/d94ce66f6b379004d9d0336ccee971d43d5aa5cc"},{"sha":"9581cfa91b71175b9a24a957b1fad178fdabbdb2","author":{"name":"Sivacharan Paka","email":"4edb53c871f4c7fc74a0f0029286c1066690fa65@codeaurora.org"},"message":"drivers: soc: Add buffer overflow check for svc send request\n\nAdd buffer overflow check in voice_svc_send_req.\n\nCRs-fixed: 1010081\nChange-Id: I4ae703334b0cf04f327b392bc9cd6febd4ad32f2\nSigned-off-by: Josh Kirsch <jkirsch@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/9581cfa91b71175b9a24a957b1fad178fdabbdb2"}]}
{"actor":{"display_login":"Jackeagle"}}