{"push_id":1118511567,"size":10,"distinct_size":10,"ref":"refs/heads/cm-13.0","head":"87434ade64375bf3fa150e84b5eb95e8cae419ad","before":"697702c8b5b38eb4fc63f29a7592d1eaed5e7f5d","commits":[{"sha":"5b0f2c1febbbdb5c170f0608a32f7ae01be0159b","author":{"email":"625600233cb3bcab32268c17610882e0fdaed295@cyngn.com","name":"Scott Mertz"},"message":"video: mdss: remove erroneous mutex_unlock\n\nNoticed the following warning:\nWARNING: at ../../../../../../kernel/oneplus/msm8974/drivers/video/msm/mdss/mdss_livedisplay.c:145 mdss_livedisplay_worker+0x494/0x580()\n[<c0110b0c>] (unwind_backtrace+0x0/0x160) from [<c01c0f8c>] (warn_slowpath_null+0x40/0x64)\n[<c01c0f8c>] (warn_slowpath_null+0x40/0x64) from [<c04d03f0>] (mdss_livedisplay_worker+0x494/0x580)\n[<c04d03f0>] (mdss_livedisplay_worker+0x494/0x580) from [<c01df1b8>] (process_one_work+0x174/0x4f4)\n[<c01df1b8>] (process_one_work+0x174/0x4f4) from [<c01dfd7c>] (worker_thread+0x1ac/0x44c)\n[<c01dfd7c>] (worker_thread+0x1ac/0x44c) from [<c01e6598>] (kthread+0xc8/0xd4)\n[<c01e6598>] (kthread+0xc8/0xd4) from [<c010a824>] (kernel_thread_exit+0x0/0x8)\n\nOPO-713\nChange-Id: I51d0ac0298a0f879638cabe89f3d338b08d09b6b","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_oppo_msm8974/commits/5b0f2c1febbbdb5c170f0608a32f7ae01be0159b"},{"sha":"7b19eac8d6bcd227a2619c887724ff7705534e96","author":{"email":"45d857216ef082c1ddfd5d3991b4f3d23f51761f@arcor.de","name":"fluxi"},"message":"mm: swap: Actually set QUEUE_FLAG_FAST bit\n\nThis got lost in commit 699e3e8a. Without this flag,\nwe're not setting SWP_FAST.\n\nChange-Id: Ic2acd9250ab0c6ce93e5ce6f75b58435c47ad678","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_oppo_msm8974/commits/7b19eac8d6bcd227a2619c887724ff7705534e96"},{"sha":"fd77a1f82b282cdc473acb5803bc67a8b38846f0","author":{"email":"3d4a3affaf9163789962e9770780389962bda29d@lip6.fr","name":"Julia Lawall"},"message":"Input: aiptek - adjust error-handling code label\n\nAt the point of this error-handling code, aiptek->urb has been allocated,\nand it does not appear to be less necessary to free it here than in the\nerror-handling code just below.\n\nChange-Id: I1b07d7cd62a3df78759dd5a9a5ad27e58350df01\nSigned-off-by: Julia Lawall <Julia.Lawall@lip6.fr>\nSigned-off-by: Dmitry Torokhov <dtor@mail.ru>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_oppo_msm8974/commits/fd77a1f82b282cdc473acb5803bc67a8b38846f0"},{"sha":"f94f9571a2c7153fe18e654ca7166c77f376cfbc","author":{"email":"f82da8db93e4ada738df910dc39037dfa2de78b0@redhat.com","name":"Vladis Dronov"},"message":"Input: aiptek - fix crash on detecting device without endpoints\n\nThe aiptek driver crashes in aiptek_probe() when a specially crafted USB\ndevice without endpoints is detected. This fix adds a check that the device\nhas proper configuration expected by the driver. Also an error return value\nis changed to more matching one in one of the error paths.\n\nChange-Id: I02fa4ffcbe9a71948947ef5baeb72632688d9d07\nReported-by: Ralf Spenneberg <ralf@spenneberg.net>\nSigned-off-by: Vladis Dronov <vdronov@redhat.com>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_oppo_msm8974/commits/f94f9571a2c7153fe18e654ca7166c77f376cfbc"},{"sha":"5b21a3bd9e6bd4ba8cc6e86099151245861d3f9f","author":{"email":"d682d9a73926732be72927b9dbc460d79c7dc22c@gmail.com","name":"Kangjie Lu"},"message":"ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS\n\nThe stack object “tread” has a total size of 32 bytes. Its field\n“event” and “val” both contain 4 bytes padding. These 8 bytes\npadding bytes are sent to user without being initialized.\n\nChange-Id: Ibf2868136a538eed0f2e75395a5f14a8608dd86d\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_oppo_msm8974/commits/5b21a3bd9e6bd4ba8cc6e86099151245861d3f9f"},{"sha":"cc29f6bda2ca4934204ecd03a6a3d52430c22a4b","author":{"email":"d682d9a73926732be72927b9dbc460d79c7dc22c@gmail.com","name":"Kangjie Lu"},"message":"ALSA: timer: Fix leak in events via snd_timer_user_ccallback\n\nThe stack object “r1” has a total size of 32 bytes. Its field\n“event” and “val” both contain 4 bytes padding. These 8 bytes\npadding bytes are sent to user without being initialized.\n\nChange-Id: I5ece63432f6ca6251fa31c046c211c8c03313a59\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_oppo_msm8974/commits/cc29f6bda2ca4934204ecd03a6a3d52430c22a4b"},{"sha":"c8cdaaca625516140093c92fb97493ba676d313f","author":{"email":"d682d9a73926732be72927b9dbc460d79c7dc22c@gmail.com","name":"Kangjie Lu"},"message":"ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt\n\nThe stack object “r1” has a total size of 32 bytes. Its field\n“event” and “val” both contain 4 bytes padding. These 8 bytes\npadding bytes are sent to user without being initialized.\n\nChange-Id: Ie3dcdee7da8ad292712814e8402c571a717ab8d1\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_oppo_msm8974/commits/c8cdaaca625516140093c92fb97493ba676d313f"},{"sha":"a51b6f8e7c02826164b240fd85a52797d211383a","author":{"email":"cef439e78636cdab99cd2923826c5065a0743e5b@strlen.de","name":"Florian Westphal"},"message":"netfilter: x_tables: check for size overflow\n\nBen Hawkes says:\n integer overflow in xt_alloc_table_info, which on 32-bit systems can\n lead to small structure allocation and a copy_from_user based heap\n corruption.\n\nChange-Id: I13c554c630651a37e3f6a195e9a5f40cddcb29a1\nReported-by: Ben Hawkes <hawkes@google.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_oppo_msm8974/commits/a51b6f8e7c02826164b240fd85a52797d211383a"},{"sha":"5a5567366ac6dce12988d067a8c7a46c7ab82ca0","author":{"email":"c9cf31cb6c9821bed82e940f06145b026ca536b5@alphalink.fr","name":"Guillaume Nault"},"message":"ppp: take reference on channels netns\n\nLet channels hold a reference on their network namespace.\nSome channel types, like ppp_async and ppp_synctty, can have their\nuserspace controller running in a different namespace. Therefore they\ncan't rely on them to preclude their netns from being removed from\nunder them.\n\n==================================================================\nBUG: KASAN: use-after-free in ppp_unregister_channel+0x372/0x3a0 at\naddr ffff880064e217e0\nRead of size 8 by task syz-executor/11581\n=============================================================================\nBUG net_namespace (Not tainted): kasan: bad access detected\n-----------------------------------------------------------------------------\n\nDisabling lock debugging due to kernel taint\nINFO: Allocated in copy_net_ns+0x6b/0x1a0 age=92569 cpu=3 pid=6906\n[<      none      >] ___slab_alloc+0x4c7/0x500 kernel/mm/slub.c:2440\n[<      none      >] __slab_alloc+0x4c/0x90 kernel/mm/slub.c:2469\n[<     inline     >] slab_alloc_node kernel/mm/slub.c:2532\n[<     inline     >] slab_alloc kernel/mm/slub.c:2574\n[<      none      >] kmem_cache_alloc+0x23a/0x2b0 kernel/mm/slub.c:2579\n[<     inline     >] kmem_cache_zalloc kernel/include/linux/slab.h:597\n[<     inline     >] net_alloc kernel/net/core/net_namespace.c:325\n[<      none      >] copy_net_ns+0x6b/0x1a0 kernel/net/core/net_namespace.c:360\n[<      none      >] create_new_namespaces+0x2f6/0x610 kernel/kernel/nsproxy.c:95\n[<      none      >] copy_namespaces+0x297/0x320 kernel/kernel/nsproxy.c:150\n[<      none      >] copy_process.part.35+0x1bf4/0x5760 kernel/kernel/fork.c:1451\n[<     inline     >] copy_process kernel/kernel/fork.c:1274\n[<      none      >] _do_fork+0x1bc/0xcb0 kernel/kernel/fork.c:1723\n[<     inline     >] SYSC_clone kernel/kernel/fork.c:1832\n[<      none      >] SyS_clone+0x37/0x50 kernel/kernel/fork.c:1826\n[<      none      >] entry_SYSCALL_64_fastpath+0x16/0x7a kernel/arch/x86/entry/entry_64.S:185\n\nINFO: Freed in net_drop_ns+0x67/0x80 age=575 cpu=2 pid=2631\n[<      none      >] __slab_free+0x1fc/0x320 kernel/mm/slub.c:2650\n[<     inline     >] slab_free kernel/mm/slub.c:2805\n[<      none      >] kmem_cache_free+0x2a0/0x330 kernel/mm/slub.c:2814\n[<     inline     >] net_free kernel/net/core/net_namespace.c:341\n[<      none      >] net_drop_ns+0x67/0x80 kernel/net/core/net_namespace.c:348\n[<      none      >] cleanup_net+0x4e5/0x600 kernel/net/core/net_namespace.c:448\n[<      none      >] process_one_work+0x794/0x1440 kernel/kernel/workqueue.c:2036\n[<      none      >] worker_thread+0xdb/0xfc0 kernel/kernel/workqueue.c:2170\n[<      none      >] kthread+0x23f/0x2d0 kernel/drivers/block/aoe/aoecmd.c:1303\n[<      none      >] ret_from_fork+0x3f/0x70 kernel/arch/x86/entry/entry_64.S:468\nINFO: Slab 0xffffea0001938800 objects=3 used=0 fp=0xffff880064e20000\nflags=0x5fffc0000004080\nINFO: Object 0xffff880064e20000 @offset=0 fp=0xffff880064e24200\n\nCPU: 1 PID: 11581 Comm: syz-executor Tainted: G    B           4.4.0+\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nrel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014\n 00000000ffffffff ffff8800662c7790 ffffffff8292049d ffff88003e36a300\n ffff880064e20000 ffff880064e20000 ffff8800662c77c0 ffffffff816f2054\n ffff88003e36a300 ffffea0001938800 ffff880064e20000 0000000000000000\nCall Trace:\n [<     inline     >] __dump_stack kernel/lib/dump_stack.c:15\n [<ffffffff8292049d>] dump_stack+0x6f/0xa2 kernel/lib/dump_stack.c:50\n [<ffffffff816f2054>] print_trailer+0xf4/0x150 kernel/mm/slub.c:654\n [<ffffffff816f875f>] object_err+0x2f/0x40 kernel/mm/slub.c:661\n [<     inline     >] print_address_description kernel/mm/kasan/report.c:138\n [<ffffffff816fb0c5>] kasan_report_error+0x215/0x530 kernel/mm/kasan/report.c:236\n [<     inline     >] kasan_report kernel/mm/kasan/report.c:259\n [<ffffffff816fb4de>] __asan_report_load8_noabort+0x3e/0x40 kernel/mm/kasan/report.c:280\n [<     inline     >] ? ppp_pernet kernel/include/linux/compiler.h:218\n [<ffffffff83ad71b2>] ? ppp_unregister_channel+0x372/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392\n [<     inline     >] ppp_pernet kernel/include/linux/compiler.h:218\n [<ffffffff83ad71b2>] ppp_unregister_channel+0x372/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392\n [<     inline     >] ? ppp_pernet kernel/drivers/net/ppp/ppp_generic.c:293\n [<ffffffff83ad6f26>] ? ppp_unregister_channel+0xe6/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392\n [<ffffffff83ae18f3>] ppp_asynctty_close+0xa3/0x130 kernel/drivers/net/ppp/ppp_async.c:241\n [<ffffffff83ae1850>] ? async_lcp_peek+0x5b0/0x5b0 kernel/drivers/net/ppp/ppp_async.c:1000\n [<ffffffff82c33239>] tty_ldisc_close.isra.1+0x99/0xe0 kernel/drivers/tty/tty_ldisc.c:478\n [<ffffffff82c332c0>] tty_ldisc_kill+0x40/0x170 kernel/drivers/tty/tty_ldisc.c:744\n [<ffffffff82c34943>] tty_ldisc_release+0x1b3/0x260 kernel/drivers/tty/tty_ldisc.c:772\n [<ffffffff82c1ef21>] tty_release+0xac1/0x13e0 kernel/drivers/tty/tty_io.c:1901\n [<ffffffff82c1e460>] ? release_tty+0x320/0x320 kernel/drivers/tty/tty_io.c:1688\n [<ffffffff8174de36>] __fput+0x236/0x780 kernel/fs/file_table.c:208\n [<ffffffff8174e405>] ____fput+0x15/0x20 kernel/fs/file_table.c:244\n [<ffffffff813595ab>] task_work_run+0x16b/0x200 kernel/kernel/task_work.c:115\n [<     inline     >] exit_task_work kernel/include/linux/task_work.h:21\n [<ffffffff81307105>] do_exit+0x8b5/0x2c60 kernel/kernel/exit.c:750\n [<ffffffff813fdd20>] ? debug_check_no_locks_freed+0x290/0x290 kernel/kernel/locking/lockdep.c:4123\n [<ffffffff81306850>] ? mm_update_next_owner+0x6f0/0x6f0 kernel/kernel/exit.c:357\n [<ffffffff813215e6>] ? __dequeue_signal+0x136/0x470 kernel/kernel/signal.c:550\n [<ffffffff8132067b>] ? recalc_sigpending_tsk+0x13b/0x180 kernel/kernel/signal.c:145\n [<ffffffff81309628>] do_group_exit+0x108/0x330 kernel/kernel/exit.c:880\n [<ffffffff8132b9d4>] get_signal+0x5e4/0x14f0 kernel/kernel/signal.c:2307\n [<     inline     >] ? kretprobe_table_lock kernel/kernel/kprobes.c:1113\n [<ffffffff8151d355>] ? kprobe_flush_task+0xb5/0x450 kernel/kernel/kprobes.c:1158\n [<ffffffff8115f7d3>] do_signal+0x83/0x1c90 kernel/arch/x86/kernel/signal.c:712\n [<ffffffff8151d2a0>] ? recycle_rp_inst+0x310/0x310 kernel/include/linux/list.h:655\n [<ffffffff8115f750>] ? setup_sigcontext+0x780/0x780 kernel/arch/x86/kernel/signal.c:165\n [<ffffffff81380864>] ? finish_task_switch+0x424/0x5f0 kernel/kernel/sched/core.c:2692\n [<     inline     >] ? finish_lock_switch kernel/kernel/sched/sched.h:1099\n [<ffffffff81380560>] ? finish_task_switch+0x120/0x5f0 kernel/kernel/sched/core.c:2678\n [<     inline     >] ? context_switch kernel/kernel/sched/core.c:2807\n [<ffffffff85d794e9>] ? __schedule+0x919/0x1bd0 kernel/kernel/sched/core.c:3283\n [<ffffffff81003901>] exit_to_usermode_loop+0xf1/0x1a0 kernel/arch/x86/entry/common.c:247\n [<     inline     >] prepare_exit_to_usermode kernel/arch/x86/entry/common.c:282\n [<ffffffff810062ef>] syscall_return_slowpath+0x19f/0x210 kernel/arch/x86/entry/common.c:344\n [<ffffffff85d88022>] int_ret_from_sys_call+0x25/0x9f kernel/arch/x86/entry/entry_64.S:281\nMemory state around the buggy address:\n ffff880064e21680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff880064e21700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n>ffff880064e21780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                                                       ^\n ffff880064e21800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff880064e21880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n==================================================================\n\nChange-Id: I591b30eafa1b57bd2e211e1f33c39128702ff0b0\nFixes: 273ec51dd7ce (\"net: ppp_generic - introduce net-namespace functionality v2\")\nReported-by: Baozeng Ding <sploving1@gmail.com>\nSigned-off-by: Guillaume Nault <g.nault@alphalink.fr>\nReviewed-by: Cyrill Gorcunov <gorcunov@openvz.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_oppo_msm8974/commits/5a5567366ac6dce12988d067a8c7a46c7ab82ca0"},{"sha":"87434ade64375bf3fa150e84b5eb95e8cae419ad","author":{"email":"9defb1d2166fe02be9724618510318ef57e74e91@cyanogenmod.org","name":"Michael Bestas"},"message":"Merge branch 'cm-13.0' of git://github.com/CyanogenMod/android_kernel_oneplus_msm8974 into cm-13.0\n\nConflicts:\n    drivers/video/msm/mdss/mdss_livedisplay.c\n\nChange-Id: I97ae6e0f56f83fdbda6158b644ddbc18998eb898","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_oppo_msm8974/commits/87434ade64375bf3fa150e84b5eb95e8cae419ad"}]}