{"push_id":1343143463,"size":35,"distinct_size":35,"ref":"refs/heads/cm-13.0","head":"3a43f4bc8b580255b4550ccde0a70264b86fa3be","before":"b9edb43c825f61866c459e079e79297154e07300","commits":[{"sha":"a0e1b2255010ba282dca7a99e1f43aafe40f4532","author":{"name":"Yuan Lin","email":"510df78bd986b566844f5063b854cc1cdb03e723@google.com"},"message":"ASoC: check for null function pointer for dummy device read/write\n\nAdding check for null function pointer for dummy sound driver\nread/write to prevent kernel panic.\n\nIssue: CYNGNOS-3304\nBug: 28838221\nChange-Id: I32548a7e37869a17a5f88c646ddbfb8243cadcc0\nSigned-off-by: Yuan Lin <yualin@google.com>","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/a0e1b2255010ba282dca7a99e1f43aafe40f4532"},{"sha":"7d2c3f56d428ed977a90b6621e636c5758204928","author":{"name":"Marcos Marado","email":"87740393d46478c60618dbd4deb982e6dcf856b8@cyngn.com"},"message":"synaptics_dsx: fix elevation of privilege vuln\n\nAn elevation of privilege vulnerability in the Synaptics touchscreen\ndriver could enable a local malicious application to execute\narbitrary code within the context of the kernel. This issue is rated\nas High because it first requires compromising a privileged process.\n\nThis is CVE 2016 3940.\n\nIssue: CYNGNOS-3304\nChange-Id: Ic6c2a5399965d9f305a95861ab329c3e94cc975a","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/7d2c3f56d428ed977a90b6621e636c5758204928"},{"sha":"178c623e6637268bcf4f5a92372b1bc5c2c59d0c","author":{"name":"Marcos Marado","email":"87740393d46478c60618dbd4deb982e6dcf856b8@cyngn.com"},"message":"binder: fix information disclosure vulnerability\n\nAn information disclosure vulnerability could enable a local malicious\napplication to access data outside of its permission levels. This\nissue is rated as Moderate because it first requires compromising a\nprivileged process.\n\nCVE_2016_6683\n\nIssue: CYNGNOS-3304\nChange-Id: I0318f5c9dbc8704a6fa3fbe1c14bca1a5244b810","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/178c623e6637268bcf4f5a92372b1bc5c2c59d0c"},{"sha":"b9ac74db0274da224fb50e3c342a9bb0a767bd56","author":{"name":"Divya Ponnusamy","email":"499583450a0afa8f7b400d046a2396e658a503cf@codeaurora.org"},"message":"staging: android: Change %p to %pK in debug messages\n\nThe format specifier %p can leak kernel addresses\nwhile not valuing the kptr_restrict system settings.\nUse %pK instead of %p, which also evaluates whether\nkptr_restrict is set.\n\nBug: 30148243\nIssue: CYNGNOS-3304\nChange-Id: Ib1adf14e9620ad7b1bd3e962001c852610210d46\nSigned-off-by: Divya Ponnusamy <pdivya@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/b9ac74db0274da224fb50e3c342a9bb0a767bd56"},{"sha":"7a7707580f684c17b9a923f184bca526e533570a","author":{"name":"Jaganath Kanakkassery","email":"b1803504bdc91c6b87292801bbc34df5d0b85920@samsung.com"},"message":"BACKPORT: Bluetooth: Fix potential NULL dereference in RFCOMM bind callback\n\n(cherry picked from 951b6a0717db97ce420547222647bcc40bf1eacd)\n\naddr can be NULL and it should not be dereferenced before NULL checking.\n\nIssue: CYNGNOS-3304\nSigned-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>\nSigned-off-by: Marcel Holtmann <marcel@holtmann.org>\nChange-Id: I18bda54bb1427d9443a39a04a5c551720118dc26\nBug: 30149612","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/7a7707580f684c17b9a923f184bca526e533570a"},{"sha":"536e426df85ac9b3ba390c820cbdfcaf439d9b7c","author":{"name":"Marcos Marado","email":"87740393d46478c60618dbd4deb982e6dcf856b8@cyngn.com"},"message":"binder: privilege elevation vuln. in system_server\n\nAn elevation of privilege vulnerability in system_server could enable\nlocal malicious application to execute arbitrary code within the\ncontext of a privileged process. This issue is rated as High because\nit could be used to gain local access to elevated capabilities, which\nare not normally accessible to a third-party application.\n\nCVE_2016_6674\nIssue: CYNGNOS-3304\n\nChange-Id: Icc60d83aefdc55fb3502544cc00c7a4bbc0060b8","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/536e426df85ac9b3ba390c820cbdfcaf439d9b7c"},{"sha":"7804a85b30946e6ec62cce057c4fb9fc1c0dc87d","author":{"name":"Marcos Marado","email":"87740393d46478c60618dbd4deb982e6dcf856b8@cyngn.com"},"message":"synaptics: elevation of privilege vulnerability\n\nAn elevation of privilege vulnerability in the Synaptics touchscreen\ndriver could enable a local malicious application to execute\narbitrary code within the context of the kernel. This issue is rated\nas High because it first requires compromising a privileged process.\n\nCVE_2016_6672\nIssue: CYNGNOS-3304\n\nChange-Id: If27ed96bc9b04954fb3b054df4ba1a1795db70da","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/7804a85b30946e6ec62cce057c4fb9fc1c0dc87d"},{"sha":"f6945465e2056e92d4ee205d5db7c2f5196f0bbd","author":{"name":"Marcos Marado","email":"87740393d46478c60618dbd4deb982e6dcf856b8@cyngn.com"},"message":"binder: Information disclosure vulnerability\n\nAn information disclosure vulnerability in Binder could enable a local\nmalicious application to access data outside of its permission levels.\nThis issue is rated as Moderate because it first requires compromising\na privileged process.\n\nCVE_2016_6689\nIssue: CYNGNOS-3304\n\nChange-Id: Ie26fa668f232dbd453fdc5aeb38eb8071eac19e9","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/f6945465e2056e92d4ee205d5db7c2f5196f0bbd"},{"sha":"9f4d0e78e28d9120534412c08b53c935866200fd","author":{"name":"Skylar Chang","email":"e55369b827ac1e5cdf23e9f11dabe26a7634de99@codeaurora.org"},"message":"msm: ipa: handle information leak on ADD_FLT_RULE_INDEX ioctl\n\nIPA might have Information leak and device crash due to\nkernel heap overread in IPA driver when processing\nWAN_IOC_ADD_FLT_RULE_INDEX ioctl. The fix is to add\ncheck on max number of filter rules send to modem.\n\nIssue: CYNGNOS-3304\nChange-Id: I454e04d05cfcb7af8fc4bd2b4a1bade55c4684d0\nSigned-off-by: Skylar Chang <chiaweic@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/9f4d0e78e28d9120534412c08b53c935866200fd"},{"sha":"c4f56a1e33eb808cfda87913f3deb487f8ca995c","author":{"name":"Edward Wang","email":"204e260ebf13aafabdfe6a0d2b70f137bb2e608e@cyngn.com"},"message":"ARM: dts: ql790: update for HQ kionix accel sensor\n\nChange-Id: I78c576251f36be3955542a7a498af538771abddb","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/c4f56a1e33eb808cfda87913f3deb487f8ca995c"},{"sha":"8a7b38d5ab6ee49910c3d2612ee63a937e6f2b18","author":{"name":"Zhen Kong","email":"b999fb1d59364862997bac94d5b793be36d63b01@codeaurora.org"},"message":"msm: crypto: Fix integer over flow check in qcrypto driver\n\nInteger overflow check is invalid when ULONG_MAX is used,\nas ULONG_MAX has typeof 'unsigned long', while req->assoclen,\nreq->crytlen, and qreq.ivsize are 'unsigned int'. Make change\nto use UINT_MAX instead of ULONG_MAX.\n\nIssue: CYNGNOS-3304\nCRs-fixed: 1050970\nChange-Id: I3782ea7ed2eaacdcad15b34e047a4699bf4f9e4f\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/8a7b38d5ab6ee49910c3d2612ee63a937e6f2b18"},{"sha":"e38b38b6cba95d049d9c5d7c846ef8dd5d37aad7","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"tcp: fix use after free in tcp_xmit_retransmit_queue()\n\nWhen tcp_sendmsg() allocates a fresh and empty skb, it puts it at the\ntail of the write queue using tcp_add_write_queue_tail()\n\nThen it attempts to copy user data into this fresh skb.\n\nIf the copy fails, we undo the work and remove the fresh skb.\n\nUnfortunately, this undo lacks the change done to tp->highest_sack and\nwe can leave a dangling pointer (to a freed skb)\n\nLater, tcp_xmit_retransmit_queue() can dereference this pointer and\naccess freed memory. For regular kernels where memory is not unmapped,\nthis might cause SACK bugs because tcp_highest_sack_seq() is buggy,\nreturning garbage instead of tp->snd_nxt, but with various debug\nfeatures like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel.\n\nThis bug was found by Marco Grassi thanks to syzkaller.\n\nIssue: CYNGNOS-3304\nChange-Id: Id55b41e162fbc9c09b8fc6f5f9f6f453d818e556\nFixes: 6859d49475d4 (\"[TCP]: Abstract tp->highest_sack accessing & point to next skb\")\nReported-by: Marco Grassi <marco.gra@gmail.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>\nCc: Yuchung Cheng <ycheng@google.com>\nCc: Neal Cardwell <ncardwell@google.com>\nAcked-by: Neal Cardwell <ncardwell@google.com>\nReviewed-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/e38b38b6cba95d049d9c5d7c846ef8dd5d37aad7"},{"sha":"7ea1380a79a953bb840402ce76d1d46a6b6719b6","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()\n\nJust a minor code cleanup: unify the error paths.\n\nIssue: CYNGNOS-3304\n\nChange-Id: I31346b08ed1024819c58eff797c63bb42c283512\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/7ea1380a79a953bb840402ce76d1d46a6b6719b6"},{"sha":"f9cee297d5d90d083f61d7975e76ad870e122d36","author":{"name":"Vladis Dronov","email":"41435c47c64e54f8ec26bbc1be6d7972ea4d40bd@redhat.com"},"message":"ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call\n\ncreate_fixed_stream_quirk(), snd_usb_parse_audio_interface() and\ncreate_uaxx_quirk() functions allocate the audioformat object by themselves\nand free it upon error before returning. However, once the object is linked\nto a stream, it's freed again in snd_usb_audio_pcm_free(), thus it'll be\ndouble-freed, eventually resulting in a memory corruption.\n\nThis patch fixes these failures in the error paths by unlinking the audioformat\nobject before freeing it.\n\nBased on a patch by Takashi Iwai <tiwai@suse.de>\n\n[Note for stable backports:\n this patch requires the commit 902eb7fd1e4a ('ALSA: usb-audio: Minor\n code cleanup in create_fixed_stream_quirk()')]\n\nIssue: CYNGNOS-3304\nChange-Id: I1d4b48f35f3c7402f95615ea5d6beb7bd4ff2afb\nBugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283358\nReported-by: Ralf Spenneberg <ralf@spenneberg.net>\nCc: <stable@vger.kernel.org> # see the note above\nSigned-off-by: Vladis Dronov <vdronov@redhat.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/f9cee297d5d90d083f61d7975e76ad870e122d36"},{"sha":"fc83b850ccfd20f4bcc1e208a9e5af6aba07c962","author":{"name":"Vegard Nossum","email":"9c44e0ed746b5c309b0bf31e4bae8fb5eb72beb1@oracle.com"},"message":"block: fix use-after-free in seq file\n\nI got a KASAN report of use-after-free:\n\n    ==================================================================\n    BUG: KASAN: use-after-free in klist_iter_exit+0x61/0x70 at addr ffff8800b6581508\n    Read of size 8 by task trinity-c1/315\n    =============================================================================\n    BUG kmalloc-32 (Not tainted): kasan: bad access detected\n    -----------------------------------------------------------------------------\n\n    Disabling lock debugging due to kernel taint\n    INFO: Allocated in disk_seqf_start+0x66/0x110 age=144 cpu=1 pid=315\n            ___slab_alloc+0x4f1/0x520\n            __slab_alloc.isra.58+0x56/0x80\n            kmem_cache_alloc_trace+0x260/0x2a0\n            disk_seqf_start+0x66/0x110\n            traverse+0x176/0x860\n            seq_read+0x7e3/0x11a0\n            proc_reg_read+0xbc/0x180\n            do_loop_readv_writev+0x134/0x210\n            do_readv_writev+0x565/0x660\n            vfs_readv+0x67/0xa0\n            do_preadv+0x126/0x170\n            SyS_preadv+0xc/0x10\n            do_syscall_64+0x1a1/0x460\n            return_from_SYSCALL_64+0x0/0x6a\n    INFO: Freed in disk_seqf_stop+0x42/0x50 age=160 cpu=1 pid=315\n            __slab_free+0x17a/0x2c0\n            kfree+0x20a/0x220\n            disk_seqf_stop+0x42/0x50\n            traverse+0x3b5/0x860\n            seq_read+0x7e3/0x11a0\n            proc_reg_read+0xbc/0x180\n            do_loop_readv_writev+0x134/0x210\n            do_readv_writev+0x565/0x660\n            vfs_readv+0x67/0xa0\n            do_preadv+0x126/0x170\n            SyS_preadv+0xc/0x10\n            do_syscall_64+0x1a1/0x460\n            return_from_SYSCALL_64+0x0/0x6a\n\n    CPU: 1 PID: 315 Comm: trinity-c1 Tainted: G    B           4.7.0+ #62\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014\n     ffffea0002d96000 ffff880119b9f918 ffffffff81d6ce81 ffff88011a804480\n     ffff8800b6581500 ffff880119b9f948 ffffffff8146c7bd ffff88011a804480\n     ffffea0002d96000 ffff8800b6581500 fffffffffffffff4 ffff880119b9f970\n    Call Trace:\n     [<ffffffff81d6ce81>] dump_stack+0x65/0x84\n     [<ffffffff8146c7bd>] print_trailer+0x10d/0x1a0\n     [<ffffffff814704ff>] object_err+0x2f/0x40\n     [<ffffffff814754d1>] kasan_report_error+0x221/0x520\n     [<ffffffff8147590e>] __asan_report_load8_noabort+0x3e/0x40\n     [<ffffffff83888161>] klist_iter_exit+0x61/0x70\n     [<ffffffff82404389>] class_dev_iter_exit+0x9/0x10\n     [<ffffffff81d2e8ea>] disk_seqf_stop+0x3a/0x50\n     [<ffffffff8151f812>] seq_read+0x4b2/0x11a0\n     [<ffffffff815f8fdc>] proc_reg_read+0xbc/0x180\n     [<ffffffff814b24e4>] do_loop_readv_writev+0x134/0x210\n     [<ffffffff814b4c45>] do_readv_writev+0x565/0x660\n     [<ffffffff814b8a17>] vfs_readv+0x67/0xa0\n     [<ffffffff814b8de6>] do_preadv+0x126/0x170\n     [<ffffffff814b92ec>] SyS_preadv+0xc/0x10\n\nThis problem can occur in the following situation:\n\nopen()\n - pread()\n    - .seq_start()\n       - iter = kmalloc() // succeeds\n       - seqf->private = iter\n    - .seq_stop()\n       - kfree(seqf->private)\n - pread()\n    - .seq_start()\n       - iter = kmalloc() // fails\n    - .seq_stop()\n       - class_dev_iter_exit(seqf->private) // boom! old pointer\n\nAs the comment in disk_seqf_stop() says, stop is called even if start\nfailed, so we need to reinitialise the private pointer to NULL when seq\niteration stops.\n\nAn alternative would be to set the private pointer to NULL when the\nkmalloc() in disk_seqf_start() fails.\n\nIssue: CYNGNOS-3304\nChange-Id: Ida3734d79884aef56563cfa0d474d5a1c6104fb6\nCc: stable@vger.kernel.org\nSigned-off-by: Vegard Nossum <vegard.nossum@oracle.com>\nAcked-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Jens Axboe <axboe@fb.com>","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/fc83b850ccfd20f4bcc1e208a9e5af6aba07c962"},{"sha":"cea67eaf9de893504ba119822f10ab4205e68dc9","author":{"name":"Omar Sandoval","email":"39102d44aa5274bc7139838962c296ef0b609c1e@fb.com"},"message":"block: fix use-after-free in sys_ioprio_get()\n\nget_task_ioprio() accesses the task->io_context without holding the task\nlock and thus can race with exit_io_context(), leading to a\nuse-after-free. The reproducer below hits this within a few seconds on\nmy 4-core QEMU VM:\n\nint main(int argc, char **argv)\n{\n\tpid_t pid, child;\n\tlong nproc, i;\n\n\t/* ioprio_set(IOPRIO_WHO_PROCESS, 0, IOPRIO_PRIO_VALUE(IOPRIO_CLASS_IDLE, 0)); */\n\tsyscall(SYS_ioprio_set, 1, 0, 0x6000);\n\n\tnproc = sysconf(_SC_NPROCESSORS_ONLN);\n\n\tfor (i = 0; i < nproc; i++) {\n\t\tpid = fork();\n\t\tassert(pid != -1);\n\t\tif (pid == 0) {\n\t\t\tfor (;;) {\n\t\t\t\tpid = fork();\n\t\t\t\tassert(pid != -1);\n\t\t\t\tif (pid == 0) {\n\t\t\t\t\t_exit(0);\n\t\t\t\t} else {\n\t\t\t\t\tchild = wait(NULL);\n\t\t\t\t\tassert(child == pid);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tpid = fork();\n\t\tassert(pid != -1);\n\t\tif (pid == 0) {\n\t\t\tfor (;;) {\n\t\t\t\t/* ioprio_get(IOPRIO_WHO_PGRP, 0); */\n\t\t\t\tsyscall(SYS_ioprio_get, 2, 0);\n\t\t\t}\n\t\t}\n\t}\n\n\tfor (;;) {\n\t\t/* ioprio_get(IOPRIO_WHO_PGRP, 0); */\n\t\tsyscall(SYS_ioprio_get, 2, 0);\n\t}\n\n\treturn 0;\n}\n\nThis gets us KASAN dumps like this:\n\n[   35.526914] ==================================================================\n[   35.530009] BUG: KASAN: out-of-bounds in get_task_ioprio+0x7b/0x90 at addr ffff880066f34e6c\n[   35.530009] Read of size 2 by task ioprio-gpf/363\n[   35.530009] =============================================================================\n[   35.530009] BUG blkdev_ioc (Not tainted): kasan: bad access detected\n[   35.530009] -----------------------------------------------------------------------------\n\n[   35.530009] Disabling lock debugging due to kernel taint\n[   35.530009] INFO: Allocated in create_task_io_context+0x2b/0x370 age=0 cpu=0 pid=360\n[   35.530009] \t___slab_alloc+0x55d/0x5a0\n[   35.530009] \t__slab_alloc.isra.20+0x2b/0x40\n[   35.530009] \tkmem_cache_alloc_node+0x84/0x200\n[   35.530009] \tcreate_task_io_context+0x2b/0x370\n[   35.530009] \tget_task_io_context+0x92/0xb0\n[   35.530009] \tcopy_process.part.8+0x5029/0x5660\n[   35.530009] \t_do_fork+0x155/0x7e0\n[   35.530009] \tSyS_clone+0x19/0x20\n[   35.530009] \tdo_syscall_64+0x195/0x3a0\n[   35.530009] \treturn_from_SYSCALL_64+0x0/0x6a\n[   35.530009] INFO: Freed in put_io_context+0xe7/0x120 age=0 cpu=0 pid=1060\n[   35.530009] \t__slab_free+0x27b/0x3d0\n[   35.530009] \tkmem_cache_free+0x1fb/0x220\n[   35.530009] \tput_io_context+0xe7/0x120\n[   35.530009] \tput_io_context_active+0x238/0x380\n[   35.530009] \texit_io_context+0x66/0x80\n[   35.530009] \tdo_exit+0x158e/0x2b90\n[   35.530009] \tdo_group_exit+0xe5/0x2b0\n[   35.530009] \tSyS_exit_group+0x1d/0x20\n[   35.530009] \tentry_SYSCALL_64_fastpath+0x1a/0xa4\n[   35.530009] INFO: Slab 0xffffea00019bcd00 objects=20 used=4 fp=0xffff880066f34ff0 flags=0x1fffe0000004080\n[   35.530009] INFO: Object 0xffff880066f34e58 @offset=3672 fp=0x0000000000000001\n[   35.530009] ==================================================================\n\nFix it by grabbing the task lock while we poke at the io_context.\n\nIssue: CYNGNOS-3304\nChange-Id: I5af09d3e17d57cae7832c1d1fe8759c96a7260d5\nCc: stable@vger.kernel.org\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Omar Sandoval <osandov@fb.com>\nSigned-off-by: Jens Axboe <axboe@fb.com>","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/cea67eaf9de893504ba119822f10ab4205e68dc9"},{"sha":"5f83c16464dffcf535b261fddcdc8734625f28d6","author":{"name":"Lukas Czerner","email":"6fc09532a9146f7083562515354b6edd42e64baf@redhat.com"},"message":"ext4: fix potential use after free in __ext4_journal_stop\n\nThere is a use-after-free possibility in __ext4_journal_stop() in the\ncase that we free the handle in the first jbd2_journal_stop() because\nwe're referencing handle->h_err afterwards. This was introduced in\n9705acd63b125dee8b15c705216d7186daea4625 and it is wrong. Fix it by\nstoring the handle->h_err value beforehand and avoid referencing\npotentially freed handle.\n\nIssue: CYNGNOS-3304\nChange-Id: I6e969a7f6214479d6b60627307327e5b720e338c\nFixes: 9705acd63b125dee8b15c705216d7186daea4625\nSigned-off-by: Lukas Czerner <lczerner@redhat.com>\nReviewed-by: Andreas Dilger <adilger@dilger.ca>\nCc: stable@vger.kernel.org","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/5f83c16464dffcf535b261fddcdc8734625f28d6"},{"sha":"26cc9cc5090bd8ba01938f001ca6f9d777dea771","author":{"name":"Calvin Owens","email":"114f95235b01701def87f33797e11d10e01315ab@fb.com"},"message":"sg: Fix double-free when drives detach during SG_IO\n\nIn sg_common_write(), we free the block request and return -ENODEV if\nthe device is detached in the middle of the SG_IO ioctl().\n\nUnfortunately, sg_finish_rem_req() also tries to free srp->rq, so we\nend up freeing rq->cmd in the already free rq object, and then free\nthe object itself out from under the current user.\n\nThis ends up corrupting random memory via the list_head on the rq\nobject. The most common crash trace I saw is this:\n\n  ------------[ cut here ]------------\n  kernel BUG at block/blk-core.c:1420!\n  Call Trace:\n  [<ffffffff81281eab>] blk_put_request+0x5b/0x80\n  [<ffffffffa0069e5b>] sg_finish_rem_req+0x6b/0x120 [sg]\n  [<ffffffffa006bcb9>] sg_common_write.isra.14+0x459/0x5a0 [sg]\n  [<ffffffff8125b328>] ? selinux_file_alloc_security+0x48/0x70\n  [<ffffffffa006bf95>] sg_new_write.isra.17+0x195/0x2d0 [sg]\n  [<ffffffffa006cef4>] sg_ioctl+0x644/0xdb0 [sg]\n  [<ffffffff81170f80>] do_vfs_ioctl+0x90/0x520\n  [<ffffffff81258967>] ? file_has_perm+0x97/0xb0\n  [<ffffffff811714a1>] SyS_ioctl+0x91/0xb0\n  [<ffffffff81602afb>] tracesys+0xdd/0xe2\n    RIP [<ffffffff81281e04>] __blk_put_request+0x154/0x1a0\n\nThe solution is straightforward: just set srp->rq to NULL in the\nfailure branch so that sg_finish_rem_req() doesn't attempt to re-free\nit.\n\nAdditionally, since sg_rq_end_io() will never be called on the object\nwhen this happens, we need to free memory backing ->cmd if it isn't\nembedded in the object itself.\n\nKASAN was extremely helpful in finding the root cause of this bug.\n\nIssue: CYNGNOS-3304\nChange-Id: I8143627b9cad2f4f9d1d48a3ac53492ee89c8aa3\nSigned-off-by: Calvin Owens <calvinowens@fb.com>\nAcked-by: Douglas Gilbert <dgilbert@interlog.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/26cc9cc5090bd8ba01938f001ca6f9d777dea771"},{"sha":"6905f89ec2db818b02f516b26aa2ffc5d1e2c5e2","author":{"name":"Mauro Carvalho Chehab","email":"ea19850a825a0b2eb1de0168fb2a06f5170bd9e2@osg.samsung.com"},"message":"xc2028: avoid use after free\n\nIf struct xc2028_config is passed without a firmware name,\nthe following trouble may happen:\n\n[11009.907205] xc2028 5-0061: type set to XCeive xc2028/xc3028 tuner\n[11009.907491] ==================================================================\n[11009.907750] BUG: KASAN: use-after-free in strcmp+0x96/0xb0 at addr ffff8803bd78ab40\n[11009.907992] Read of size 1 by task modprobe/28992\n[11009.907994] =============================================================================\n[11009.907997] BUG kmalloc-16 (Tainted: G        W      ): kasan: bad access detected\n[11009.907999] -----------------------------------------------------------------------------\n\n[11009.908008] INFO: Allocated in xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd] age=0 cpu=3 pid=28992\n[11009.908012] \t___slab_alloc+0x581/0x5b0\n[11009.908014] \t__slab_alloc+0x51/0x90\n[11009.908017] \t__kmalloc+0x27b/0x350\n[11009.908022] \txhci_urb_enqueue+0x214/0x14c0 [xhci_hcd]\n[11009.908026] \tusb_hcd_submit_urb+0x1e8/0x1c60\n[11009.908029] \tusb_submit_urb+0xb0e/0x1200\n[11009.908032] \tusb_serial_generic_write_start+0xb6/0x4c0\n[11009.908035] \tusb_serial_generic_write+0x92/0xc0\n[11009.908039] \tusb_console_write+0x38a/0x560\n[11009.908045] \tcall_console_drivers.constprop.14+0x1ee/0x2c0\n[11009.908051] \tconsole_unlock+0x40d/0x900\n[11009.908056] \tvprintk_emit+0x4b4/0x830\n[11009.908061] \tvprintk_default+0x1f/0x30\n[11009.908064] \tprintk+0x99/0xb5\n[11009.908067] \tkasan_report_error+0x10a/0x550\n[11009.908070] \t__asan_report_load1_noabort+0x43/0x50\n[11009.908074] INFO: Freed in xc2028_set_config+0x90/0x630 [tuner_xc2028] age=1 cpu=3 pid=28992\n[11009.908077] \t__slab_free+0x2ec/0x460\n[11009.908080] \tkfree+0x266/0x280\n[11009.908083] \txc2028_set_config+0x90/0x630 [tuner_xc2028]\n[11009.908086] \txc2028_attach+0x310/0x8a0 [tuner_xc2028]\n[11009.908090] \tem28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb]\n[11009.908094] \tem28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb]\n[11009.908098] \tem28xx_dvb_init+0x81/0x8a [em28xx_dvb]\n[11009.908101] \tem28xx_register_extension+0xd9/0x190 [em28xx]\n[11009.908105] \tem28xx_dvb_register+0x10/0x1000 [em28xx_dvb]\n[11009.908108] \tdo_one_initcall+0x141/0x300\n[11009.908111] \tdo_init_module+0x1d0/0x5ad\n[11009.908114] \tload_module+0x6666/0x9ba0\n[11009.908117] \tSyS_finit_module+0x108/0x130\n[11009.908120] \tentry_SYSCALL_64_fastpath+0x16/0x76\n[11009.908123] INFO: Slab 0xffffea000ef5e280 objects=25 used=25 fp=0x          (null) flags=0x2ffff8000004080\n[11009.908126] INFO: Object 0xffff8803bd78ab40 @offset=2880 fp=0x0000000000000001\n\n[11009.908130] Bytes b4 ffff8803bd78ab30: 01 00 00 00 2a 07 00 00 9d 28 00 00 01 00 00 00  ....*....(......\n[11009.908133] Object ffff8803bd78ab40: 01 00 00 00 00 00 00 00 b0 1d c3 6a 00 88 ff ff  ...........j....\n[11009.908137] CPU: 3 PID: 28992 Comm: modprobe Tainted: G    B   W       4.5.0-rc1+ #43\n[11009.908140] Hardware name:                  /NUC5i7RYB, BIOS RYBDWi35.86A.0350.2015.0812.1722 08/12/2015\n[11009.908142]  ffff8803bd78a000 ffff8802c273f1b8 ffffffff81932007 ffff8803c6407a80\n[11009.908148]  ffff8802c273f1e8 ffffffff81556759 ffff8803c6407a80 ffffea000ef5e280\n[11009.908153]  ffff8803bd78ab40 dffffc0000000000 ffff8802c273f210 ffffffff8155ccb4\n[11009.908158] Call Trace:\n[11009.908162]  [<ffffffff81932007>] dump_stack+0x4b/0x64\n[11009.908165]  [<ffffffff81556759>] print_trailer+0xf9/0x150\n[11009.908168]  [<ffffffff8155ccb4>] object_err+0x34/0x40\n[11009.908171]  [<ffffffff8155f260>] kasan_report_error+0x230/0x550\n[11009.908175]  [<ffffffff81237d71>] ? trace_hardirqs_off_caller+0x21/0x290\n[11009.908179]  [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50\n[11009.908182]  [<ffffffff8155f5c3>] __asan_report_load1_noabort+0x43/0x50\n[11009.908185]  [<ffffffff8155ea00>] ? __asan_register_globals+0x50/0xa0\n[11009.908189]  [<ffffffff8194cea6>] ? strcmp+0x96/0xb0\n[11009.908192]  [<ffffffff8194cea6>] strcmp+0x96/0xb0\n[11009.908196]  [<ffffffffa13ba4ac>] xc2028_set_config+0x15c/0x630 [tuner_xc2028]\n[11009.908200]  [<ffffffffa13bac90>] xc2028_attach+0x310/0x8a0 [tuner_xc2028]\n[11009.908203]  [<ffffffff8155ea78>] ? memset+0x28/0x30\n[11009.908206]  [<ffffffffa13ba980>] ? xc2028_set_config+0x630/0x630 [tuner_xc2028]\n[11009.908211]  [<ffffffffa157a59a>] em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb]\n[11009.908215]  [<ffffffffa157aa2a>] ? em28xx_dvb_init.part.3+0x37c/0x5cf4 [em28xx_dvb]\n[11009.908219]  [<ffffffffa157a3a1>] ? hauppauge_hvr930c_init+0x487/0x487 [em28xx_dvb]\n[11009.908222]  [<ffffffffa01795ac>] ? lgdt330x_attach+0x1cc/0x370 [lgdt330x]\n[11009.908226]  [<ffffffffa01793e0>] ? i2c_read_demod_bytes.isra.2+0x210/0x210 [lgdt330x]\n[11009.908230]  [<ffffffff812e87d0>] ? ref_module.part.15+0x10/0x10\n[11009.908233]  [<ffffffff812e56e0>] ? module_assert_mutex_or_preempt+0x80/0x80\n[11009.908238]  [<ffffffffa157af92>] em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb]\n[11009.908242]  [<ffffffffa157a6ae>] ? em28xx_attach_xc3028.constprop.7+0x30d/0x30d [em28xx_dvb]\n[11009.908245]  [<ffffffff8195222d>] ? string+0x14d/0x1f0\n[11009.908249]  [<ffffffff8195381f>] ? symbol_string+0xff/0x1a0\n[11009.908253]  [<ffffffff81953720>] ? uuid_string+0x6f0/0x6f0\n[11009.908257]  [<ffffffff811a775e>] ? __kernel_text_address+0x7e/0xa0\n[11009.908260]  [<ffffffff8104b02f>] ? print_context_stack+0x7f/0xf0\n[11009.908264]  [<ffffffff812e9846>] ? __module_address+0xb6/0x360\n[11009.908268]  [<ffffffff8137fdc9>] ? is_ftrace_trampoline+0x99/0xe0\n[11009.908271]  [<ffffffff811a775e>] ? __kernel_text_address+0x7e/0xa0\n[11009.908275]  [<ffffffff81240a70>] ? debug_check_no_locks_freed+0x290/0x290\n[11009.908278]  [<ffffffff8104a24b>] ? dump_trace+0x11b/0x300\n[11009.908282]  [<ffffffffa13e8143>] ? em28xx_register_extension+0x23/0x190 [em28xx]\n[11009.908285]  [<ffffffff81237d71>] ? trace_hardirqs_off_caller+0x21/0x290\n[11009.908289]  [<ffffffff8123ff56>] ? trace_hardirqs_on_caller+0x16/0x590\n[11009.908292]  [<ffffffff812404dd>] ? trace_hardirqs_on+0xd/0x10\n[11009.908296]  [<ffffffffa13e8143>] ? em28xx_register_extension+0x23/0x190 [em28xx]\n[11009.908299]  [<ffffffff822dcbb0>] ? mutex_trylock+0x400/0x400\n[11009.908302]  [<ffffffff810021a1>] ? do_one_initcall+0x131/0x300\n[11009.908306]  [<ffffffff81296dc7>] ? call_rcu_sched+0x17/0x20\n[11009.908309]  [<ffffffff8159e708>] ? put_object+0x48/0x70\n[11009.908314]  [<ffffffffa1579f11>] em28xx_dvb_init+0x81/0x8a [em28xx_dvb]\n[11009.908317]  [<ffffffffa13e81f9>] em28xx_register_extension+0xd9/0x190 [em28xx]\n[11009.908320]  [<ffffffffa0150000>] ? 0xffffffffa0150000\n[11009.908324]  [<ffffffffa0150010>] em28xx_dvb_register+0x10/0x1000 [em28xx_dvb]\n[11009.908327]  [<ffffffff810021b1>] do_one_initcall+0x141/0x300\n[11009.908330]  [<ffffffff81002070>] ? try_to_run_init_process+0x40/0x40\n[11009.908333]  [<ffffffff8123ff56>] ? trace_hardirqs_on_caller+0x16/0x590\n[11009.908337]  [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50\n[11009.908340]  [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50\n[11009.908343]  [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50\n[11009.908346]  [<ffffffff8155ea37>] ? __asan_register_globals+0x87/0xa0\n[11009.908350]  [<ffffffff8144da7b>] do_init_module+0x1d0/0x5ad\n[11009.908353]  [<ffffffff812f2626>] load_module+0x6666/0x9ba0\n[11009.908356]  [<ffffffff812e9c90>] ? symbol_put_addr+0x50/0x50\n[11009.908361]  [<ffffffffa1580037>] ? em28xx_dvb_init.part.3+0x5989/0x5cf4 [em28xx_dvb]\n[11009.908366]  [<ffffffff812ebfc0>] ? module_frob_arch_sections+0x20/0x20\n[11009.908369]  [<ffffffff815bc940>] ? open_exec+0x50/0x50\n[11009.908374]  [<ffffffff811671bb>] ? ns_capable+0x5b/0xd0\n[11009.908377]  [<ffffffff812f5e58>] SyS_finit_module+0x108/0x130\n[11009.908379]  [<ffffffff812f5d50>] ? SyS_init_module+0x1f0/0x1f0\n[11009.908383]  [<ffffffff81004044>] ? lockdep_sys_exit_thunk+0x12/0x14\n[11009.908394]  [<ffffffff822e6936>] entry_SYSCALL_64_fastpath+0x16/0x76\n[11009.908396] Memory state around the buggy address:\n[11009.908398]  ffff8803bd78aa00: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[11009.908401]  ffff8803bd78aa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[11009.908403] >ffff8803bd78ab00: fc fc fc fc fc fc fc fc 00 00 fc fc fc fc fc fc\n[11009.908405]                                            ^\n[11009.908407]  ffff8803bd78ab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[11009.908409]  ffff8803bd78ac00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[11009.908411] ==================================================================\n\nIn order to avoid it, let's set the cached value of the firmware\nname to NULL after freeing it. While here, return an error if\nthe memory allocation fails.\n\nIssue: CYNGNOS-3304\n\nChange-Id: I8681491173707c704a0746ab126884026b3462f8\nSigned-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/6905f89ec2db818b02f516b26aa2ffc5d1e2c5e2"},{"sha":"a46fb829427cf318c0e36343f4c15830d46d191e","author":{"name":"Rainer Weikusat","email":"83eef5bb46142d818cc9ec09a206a7f5abed4070@mobileactivedefense.com"},"message":"af_unix: Guard against other == sk in unix_dgram_sendmsg\n\nThe unix_dgram_sendmsg routine use the following test\n\nif (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {\n\nto determine if sk and other are in an n:1 association (either\nestablished via connect or by using sendto to send messages to an\nunrelated socket identified by address). This isn't correct as the\nspecified address could have been bound to the sending socket itself or\nbecause this socket could have been connected to itself by the time of\nthe unix_peer_get but disconnected before the unix_state_lock(other). In\nboth cases, the if-block would be entered despite other == sk which\nmight either block the sender unintentionally or lead to trying to unlock\nthe same spin lock twice for a non-blocking send. Add a other != sk\ncheck to guard against this.\n\nIssue: CYNGNOS-3304\nChange-Id: I5c2468b5c50496c54b11fd16371746a5fba6afdd\nFixes: 7d267278a9ec (\"unix: avoid use-after-free in ep_remove_wait_queue\")\nReported-By: Philipp Hahn <pmhahn@pmhahn.de>\nSigned-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com>\nTested-by: Philipp Hahn <pmhahn@pmhahn.de>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/BenefitA3/android_kernel_ark_msm8916/commits/a46fb829427cf318c0e36343f4c15830d46d191e"}]}
{"actor":{"display_login":"lolmaxlik"}}