{"push_id":1201826614,"size":3,"distinct_size":3,"ref":"refs/heads/stable/cm-13.0-ZNH2K","head":"5816ff376f65938b0b94aae5efb5a9ac5985c37f","before":"1fa3a772f403fdbac3e8b335c5b05a39c1eba8fe","commits":[{"sha":"a075faee1dcb3fa4634a2f718515895f069a8efa","author":{"name":"Mohamad Ayyash","email":"a63011e6db47c5624401b2ef01e42a84436c0cfe@google.com"},"message":"Replace %p with %pK to prevent leaking kernel address\n\nHAM-1355\nBUG: 27532522\nChange-Id: Ic0710a9a8cfc682acd88ecf3bbfeece2d798c4a4\nSigned-off-by: Mohamad Ayyash <mkayyash@google.com>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_cyanogen_msm8974/commits/a075faee1dcb3fa4634a2f718515895f069a8efa"},{"sha":"d9f1dbd6567e012410a6c33db1d9d460a93b87ee","author":{"name":"Alan Stern","email":"5c4cbde65af01ad64f5b2177d0cd78ab5b01e5a1@rowland.harvard.edu"},"message":"USB: fix invalid memory access in hub_activate()\n\nHAM-1355\nCommit 8520f38099cc (\"USB: change hub initialization sleeps to\ndelayed_work\") changed the hub_activate() routine to make part of it\nrun in a workqueue.  However, the commit failed to take a reference to\nthe usb_hub structure or to lock the hub interface while doing so.  As\na result, if a hub is plugged in and quickly unplugged before the work\nroutine can run, the routine will try to access memory that has been\ndeallocated.  Or, if the hub is unplugged while the routine is\nrunning, the memory may be deallocated while it is in active use.\n\nThis patch fixes the problem by taking a reference to the usb_hub at\nthe start of hub_activate() and releasing it at the end (when the work\nis finished), and by locking the hub interface while the work routine\nis running.  It also adds a check at the start of the routine to see\nif the hub has already been disconnected, in which nothing should be\ndone.\n\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-by: Alexandru Cornea <alexandru.cornea@intel.com>\nTested-by: Alexandru Cornea <alexandru.cornea@intel.com>\nFixes: 8520f38099cc (\"USB: change hub initialization sleeps to delayed_work\")\nCC: <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nBug: 28712303\nChange-Id: Ie696f13c4fa28dd549d459ea607cf27b53610be6","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_cyanogen_msm8974/commits/d9f1dbd6567e012410a6c33db1d9d460a93b87ee"},{"sha":"5816ff376f65938b0b94aae5efb5a9ac5985c37f","author":{"name":"Veena Sambasivan","email":"f3dea2712a9835ef757537fe50b353b17bceb98a@codeaurora.org"},"message":"msm: perf: Do not allocate new hw_event if event is duplicate.\n\nHAM-1355\nDuring a perf_event_enable, kernel/events/core.c calls pmu->add() which\nis platform implementation(arch/arm/kernel/perf_event.c). Due to the\nduplicate constraints, arch/arm/mach-msm/perf_event_msm_krait_l2.c\ndrivers marks the event as OFF but returns TRUE to perf_event.c which\ngoes ahead and allocates the hw_event and enables it.\nSince event is marked OFF, kernel events core will try to enable this event\nagain during next perf_event_enable. Which results in same event enabled\non multiple hw_events. But during the perf_release, event struct is freed\nand only one hw_event is released. This results in dereferencing the\ninvalid pointer and hence the crash.\nFix this by returning error in case of constraint event duplicate. Hence\navoiding the same event programmed on multiple hw event counters.\n\nbug: 28172137\nChange-Id: Ia3360be027dfe87ac753191ffe7e0bc947e72455\nSigned-off-by: Arun KS <arunks@codeaurora.org>\nSigned-off-by: Veena Sambasivan <veenas@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_cyanogen_msm8974/commits/5816ff376f65938b0b94aae5efb5a9ac5985c37f"}]}
{"actor":{"display_login":"cm-gerrit"}}