{"push_id":1363571854,"size":3,"distinct_size":3,"ref":"refs/heads/cm-14.0","head":"8b987418607ec7592d7af788efe898a5d7fcf0a0","before":"1eab6780d0b996381da21b3f7254d5a92805abd3","commits":[{"sha":"57f7ed617e36bf1248892275e71d87344c40ecf2","author":{"name":"Wish Wu","email":"cd67b24af583b4d661412a728d8f43bb8356688d@gmail.com"},"message":"msm: null pointer dereferencing\n\nPrevent unintended kernel NULL pointer dereferencing.\n\nOrignal code:\n  hlist_del_rcu(&event->hlist_entry);\n\nFix: Adding pointer check:\n  if(!hlist_unhashed(&p_event->hlist_entry))\n    hlist_del_rcu(&p_event->hlist_entry);\n\nBug: 25364034\nChange-Id: Ieda6d8f4bb567827fa6c7709e9e729905c6c3882\nSigned-off-by: Yuan Lin <yualin@google.com>","distinct":true,"url":"https://api.github.com/repos/ivanich/android_kernel_htc_pyramid/commits/57f7ed617e36bf1248892275e71d87344c40ecf2"},{"sha":"41271d270832a8207db764ea4a98ba2b9b20de31","author":{"name":"Srinivasarao P","email":"5838be2f68866147a6b98dc0567ce3ec89ebe5fc@codeaurora.org"},"message":"perf: duplicate deletion of perf event\n\na malicious app can open a perf event with constraint_duplicate\nbit set, disable the event, and close the fd.  On closing the fd,\nthe perf_release() modification causes the kernel to clean up\nthe event as if it still were enabled, leading to the event\nbeing removed from a list twice.\n\nCRs-Fixed: 977563\nChange-Id: I5fbec3722407d2f3d0ff0d9f7097c5889e31fd62\nSigned-off-by: Srinivasarao P <spathi@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/ivanich/android_kernel_htc_pyramid/commits/41271d270832a8207db764ea4a98ba2b9b20de31"},{"sha":"8b987418607ec7592d7af788efe898a5d7fcf0a0","author":{"name":"Veena Sambasivan","email":"f3dea2712a9835ef757537fe50b353b17bceb98a@codeaurora.org"},"message":"msm: perf: Do not allocate new hw_event if event is duplicate.\n\nDuring a perf_event_enable, kernel/events/core.c calls pmu->add() which\nis platform implementation(arch/arm/kernel/perf_event.c). Due to the\nduplicate constraints, arch/arm/mach-msm/perf_event_msm_krait_l2.c\ndrivers marks the event as OFF but returns TRUE to perf_event.c which\ngoes ahead and allocates the hw_event and enables it.\nSince event is marked OFF, kernel events core will try to enable this event\nagain during next perf_event_enable. Which results in same event enabled\non multiple hw_events. But during the perf_release, event struct is freed\nand only one hw_event is released. This results in dereferencing the\ninvalid pointer and hence the crash.\nFix this by returning error in case of constraint event duplicate. Hence\navoiding the same event programmed on multiple hw event counters.\n\nbug: 28172137\nChange-Id: Ia3360be027dfe87ac753191ffe7e0bc947e72455\nSigned-off-by: Arun KS <arunks@codeaurora.org>\nSigned-off-by: Veena Sambasivan <veenas@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/ivanich/android_kernel_htc_pyramid/commits/8b987418607ec7592d7af788efe898a5d7fcf0a0"}]}
{"actor":{"display_login":"ivanich"}}