{"push_id":1281787423,"size":40,"distinct_size":40,"ref":"refs/heads/LE.BR.1.2.1.1_1","head":"87d016a2f8e3c766cef70c8bad04cee4ae4da1c8","before":"2b8b733604571b7ae794a36700c70e1077e4383b","commits":[{"sha":"df85771d95bbf5b0484e69557d20457399ae3044","author":{"name":"Ashish Jain","email":"3e10641df9807bff93b1e25d356444d11eb9880f@codeaurora.org"},"message":"ASoC: msm: qdsp6v2: DAP: Update check to validate data length\n\nA big negative data length value can bypass the current check,\nupdate the condition to ensure that only valid data length is used\nto copy the params.\n\nCRs-Fixed: 1041130\nChange-Id: I6e1a58e901e4c042acfb0ab0a6223dec2949aefe\nSigned-off-by: Ashish Jain <ashishj@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/df85771d95bbf5b0484e69557d20457399ae3044"},{"sha":"d770c13d3241c8c2d24e13c748c6a6ad3eb52016","author":{"name":"Ben Romberger","email":"2772df8d823613470d53736f8956ebb045c68740@codeaurora.org"},"message":"ASoC: msm: qdsp6v2: Add size check in audio cal ioctl\n\nFor the audio get calibration ioctl compare the allocated\nbuffer size to the size of the header and cal type header\nto ensure the buffer is big enough.\n\nChange-Id: I851b4454e8420706ad3263d67e892720d46e5718\nSigned-off-by: Ben Romberger <bromberg@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/d770c13d3241c8c2d24e13c748c6a6ad3eb52016"},{"sha":"9ac59baf32625d0891c329c7414ebb8c62221a58","author":{"name":"Mohamad Ayyash","email":"a63011e6db47c5624401b2ef01e42a84436c0cfe@google.com"},"message":"Replace %p with %pK to prevent leaking kernel address\n\nBUG: 27532522\nChange-Id: Ic0710a9a8cfc682acd88ecf3bbfeece2d798c4a4\nSigned-off-by: Mohamad Ayyash <mkayyash@google.com>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/9ac59baf32625d0891c329c7414ebb8c62221a58"},{"sha":"f56a23da8b6fe96e597c64e5a71026bd8395f422","author":{"name":"Zhen Kong","email":"b999fb1d59364862997bac94d5b793be36d63b01@codeaurora.org"},"message":"qseecom: validate the inputs of __qseecom_send_modfd_resp\n\nThe resp_len and resp_buf_ptr of qseecom_send_modfd_listener_resp\nare not checked, then an userspace application that manipulates\nresp_len can corrupt the kernel memory. Thus make changes to\nvalidate these parameters.\n\nCRs-fixed: 1036418\nChange-Id: Id43ec6b55b332d0dac09a9abb998a410f49b44f7\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/f56a23da8b6fe96e597c64e5a71026bd8395f422"},{"sha":"3006e31b614e0ee945f822766cb9cfb3837c26c3","author":{"name":"Anirudh Ghayal","email":"5becd45b0fc8301765457bc64a4c39e9b591e592@codeaurora.org"},"message":"ARM: dts: mdm:  Use the correct key for MX floor-voting on 9x07\n\nThe MX floor regulator incorrectly uses the 'vlvl' key\ninstead of 'vfl'. This  prevents MX voltage from lowering\ndown when APPS is in sleep. Fix it.\n\nCRs-Fixed: 1047978\nChange-Id: I0731714fcfacb027e8a1dc457db2ca1d0eb1dbf3\nSigned-off-by: Anirudh Ghayal <aghayal@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/3006e31b614e0ee945f822766cb9cfb3837c26c3"},{"sha":"831ca370db3ee008ade34b796af2592da5fe0ce9","author":{"name":"Divya Ponnusamy","email":"499583450a0afa8f7b400d046a2396e658a503cf@codeaurora.org"},"message":"msm: kgsl: Avoid race condition in ioctl_syncsource_destroy\n\nIf the ioctl syncsource_destroy is accessed by parallel\nthreads, where the spinlock is acquired by threads after\ngetting syncsource, then the simultaneous processes try\nto remove the already destroyed syncsource->refcount by\nthe first thread that acquires this spinlock. This leads\nto race condition while removing syncsource->idr.\n\nAvoid separate lock inside getting syncsource, instead\nacquire spinlock before we get the syncsource in\ndestroy ioctl so that the threads access the spinlock\nand operate on syncsource without use-after-free issue.\n\nChange-Id: I6add3800c40cd09f6e6e0cf2720e69059bd83cbc\nSigned-off-by: Divya Ponnusamy <pdivya@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/831ca370db3ee008ade34b796af2592da5fe0ce9"},{"sha":"76dda836a130f4bd17f8cc3effa7be3b73742a9e","author":{"name":"Subash Abhinov Kasiviswanathan","email":"cb27acb5bfbe78054ecbc5d329a00e60c1019de9@codeaurora.org"},"message":"net: Warn for cloned packets in ingress path on SMP systems only\n\nGRO is currently enabled only on SMP systems so move the check for\ncloned packets from commit b8a7d12f33ecba4 (\"net: Warn for cloned\npackets in ingress path\") within CONFIG_RPS to prevent printing an\nunnecessary warning on single core systems.\n\nCRs-Fixed: 1006937\nChange-Id: Ib8cb979136def6696861a7835bcde763dabe874f\nSigned-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/76dda836a130f4bd17f8cc3effa7be3b73742a9e"},{"sha":"c6ceea1968f435fe5b2d297e6bd9ef6ff0b5f954","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"msm: kgsl: Avoid race condition in ioctl_syncsource_destroy\"","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/c6ceea1968f435fe5b2d297e6bd9ef6ff0b5f954"},{"sha":"1a5ba4282fd8830144e29db38024b907d39a2ebb","author":{"name":"Zhen Kong","email":"b999fb1d59364862997bac94d5b793be36d63b01@codeaurora.org"},"message":"msm: crypto: Fix integer over flow check in qcedev driver\n\nInteger overflow check always fails when ULONG_MAX is used,\nas ULONG_MAX is 2^64-1, while req->data[i].len and total\nare uint32_t. Make change to use U32_MAX instead of\nULONG_MAX.\n\nCRs-fixed: 1046507\nChange-Id: Iccf9c32400ecc7ffc0afae16f58c38e5d78a5b64\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/1a5ba4282fd8830144e29db38024b907d39a2ebb"},{"sha":"e02f8e9d9cfd7567e03a39dfa3e70654c0a10cef","author":{"name":"Weiyin Jiang","email":"25745fd6cb0247e11bcb32583c6893d37cc23b30@codeaurora.org"},"message":"ASoC: msm: audio-effects: fix stack overread and heap overwrite\n\nFix overwrite of updt_params allocated in heap, and stack overread\nwhere param pointer is passed from user space.\n\nCRs-Fixed: 989628\nChange-Id: Ida8bdb7da2fcb97023dce3b6eafe4b899a51cb66\nSigned-off-by: Weiyin Jiang <wjiang@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/e02f8e9d9cfd7567e03a39dfa3e70654c0a10cef"},{"sha":"15cbf210f741db1530e13fbeef1750f92f5eaba1","author":{"name":"Archana Sathyakumar","email":"6054debbcb7576ec7b47ce6bff79807b2445c0d4@codeaurora.org"},"message":"msm-core: debug: Fix the number of arguments for sysfs nodes\n\nPtable and enable node parses the input arguments incorrectly. Parse the\ninput message into exact number of arguments that are required for the\nrespective nodes.\n\nCRs-fixed: 1032875\nChange-Id: I881f18217b703a497efa4799288dee39a28ea8ab\nSigned-off-by: Archana Sathyakumar <asathyak@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/15cbf210f741db1530e13fbeef1750f92f5eaba1"},{"sha":"cc1d52fc5dd89b626af0429835ba05808f45c2dd","author":{"name":"Zhen Kong","email":"b999fb1d59364862997bac94d5b793be36d63b01@codeaurora.org"},"message":"msm: crypto: Fix integer over flow check in qcrypto driver\n\nInteger overflow check is invalid when ULONG_MAX is used,\nas ULONG_MAX has typeof 'unsigned long', while req->assoclen,\nreq->crytlen, and qreq.ivsize are 'unsigned int'. Make change\nto use UINT_MAX instead of ULONG_MAX.\n\nCRs-fixed: 1050970\nChange-Id: I3782ea7ed2eaacdcad15b34e047a4699bf4f9e4f\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/cc1d52fc5dd89b626af0429835ba05808f45c2dd"},{"sha":"6f35b34ed224604bd7b2c018a31ad41b66702f18","author":{"name":"Peter Hurley","email":"6214814a67b9688a08e8c6dc7fa5dee076dddc8d@hurleysoftware.com"},"message":"tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)\n\nioctl(TIOCGETD) retrieves the line discipline id directly from the\nldisc because the line discipline id (c_line) in termios is untrustworthy;\nuserspace may have set termios via ioctl(TCSETS*) without actually\nchanging the line discipline via ioctl(TIOCSETD).\n\nHowever, directly accessing the current ldisc via tty->ldisc is\nunsafe; the ldisc ptr dereferenced may be stale if the line discipline\nis changing via ioctl(TIOCSETD) or hangup.\n\nWait for the line discipline reference (just like read() or write())\nto retrieve the \"current\" line discipline id.\n\nChange-Id: I7b2e474af7e1885a1ca7e277ee7478a3c0ec01a7\nCc: <stable@vger.kernel.org>\nSigned-off-by: Peter Hurley <peter@hurleysoftware.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nGit-commit: 5c17c861a357e9458001f021a7afa7aab9937439\nGit-repo: https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git\nSigned-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/6f35b34ed224604bd7b2c018a31ad41b66702f18"},{"sha":"5c498fb763b639b802c32c7f7bcbda703954b87b","author":{"name":"Alan Stern","email":"5c4cbde65af01ad64f5b2177d0cd78ab5b01e5a1@rowland.harvard.edu"},"message":"USB: fix invalid memory access in hub_activate()\n\nCommit 8520f38099cc (\"USB: change hub initialization sleeps to\ndelayed_work\") changed the hub_activate() routine to make part of it\nrun in a workqueue.  However, the commit failed to take a reference to\nthe usb_hub structure or to lock the hub interface while doing so.  As\na result, if a hub is plugged in and quickly unplugged before the work\nroutine can run, the routine will try to access memory that has been\ndeallocated.  Or, if the hub is unplugged while the routine is\nrunning, the memory may be deallocated while it is in active use.\n\nThis patch fixes the problem by taking a reference to the usb_hub at\nthe start of hub_activate() and releasing it at the end (when the work\nis finished), and by locking the hub interface while the work routine\nis running.  It also adds a check at the start of the routine to see\nif the hub has already been disconnected, in which nothing should be\ndone.\n\nChange-Id: I1e5a67d22a5b61898e5a2aab8ea87b0c08e1130c\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-by: Alexandru Cornea <alexandru.cornea@intel.com>\nTested-by: Alexandru Cornea <alexandru.cornea@intel.com>\nFixes: 8520f38099cc (\"USB: change hub initialization sleeps to delayed_work\")\nCC: <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nGit-commit: e50293ef9775c5f1cf3fcc093037dd6a8c5684ea\nGit-repo:  https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git\nSigned-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/5c498fb763b639b802c32c7f7bcbda703954b87b"},{"sha":"1a322f76bf00aeb3786163ce6508ac61bc0d79cd","author":{"name":"Mark Salyzyn","email":"4814ffc71be21311f04ef34122c19152acc840c4@google.com"},"message":"BACKPORT: f2fs: add a max block check for get_data_block_bmap\n\n(cherry pick from commit 179448bfe4cd201e98e728391c6b01b25c849fe8)\n\nThis patch adds a max block check for get_data_block_bmap.\n\nTrinity test program will send a block number as parameter into\nioctl_fibmap, which will be used in get_node_path(), when the block\nnumber large than f2fs max blocks, it will trigger kernel bug.\n\nSigned-off-by: Yunlei He <heyunlei@huawei.com>\nSigned-off-by: Xue Liu <liuxueliu.liu@huawei.com>\n[Jaegeuk Kim: fix missing condition, pointed by Chao Yu]\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\nBug: 28271368\n\n(cherry pick from commit 3c714201e02ec08652be4b9544a5267e79bde3a9)\nChange-Id: Ifea304827826d8e85873532a49998f481b3873fd\nSigned-off-by: Dennis Cagle <d-cagle@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/1a322f76bf00aeb3786163ce6508ac61bc0d79cd"},{"sha":"4df71eeaeaafd597d39284cd76ee6686ebf9be9c","author":{"name":"Dennis Cagle","email":"1c958d084f7278f93cbdf16f75fd9d20fa6ac1af@codeaurora.org"},"message":"adf: Zero out the mapping data\n\nThe adf_device_post_nocopy function eventually calls the\ndma_buf_attach and dma_buf_map_attachment functions. If the\ndma_buf_attach function succeeds but the dma_buf_map_attachment\nfunction fails, both the adf_buffer_map function and the\nadf_device_post_nocopy function will call the dma_buf_detach\nfunction to tear down the same dma-buf attachment.\n\nb/28447556\nChange-Id: I8eb40486496fe2a2ae5dfa1be4b76a4af0d6b827\nSigned-off-by: Dennis Cagle <d-cagle@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/4df71eeaeaafd597d39284cd76ee6686ebf9be9c"},{"sha":"467c81f9736b1ebc8d4ba70f9221bba02425ca10","author":{"name":"Shalini Krishnamoorthi","email":"f5fc90e27afdf4d7398abeb8beba3e9bbce40de2@codeaurora.org"},"message":"msm: mdss: Fix to validate data copied from user space\n\nThe overlay zorder values copied from user space are used\nas index in left_lm_zo_cnt and right_lm_zo_cnt. This fix\nwill validate the overlay zorder value copied from user\nspace to not go beyond MDSS_MDP_MAX_STAGE, thus preventing\nany arbitrary increments in kernel memory.\n\nCRs-Fixed: 1049232\nChange-Id: Ie8e65ce9f58cb357204bfa4c6a6e0fccec82d5ba\nSigned-off-by: Shalini Krishnamoorthi <shakri@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/467c81f9736b1ebc8d4ba70f9221bba02425ca10"},{"sha":"1cb7a0a5e1cce5a50170bd25ed60832960cc3e41","author":{"name":"Haynes Mathew George","email":"743fd3b7a7b823012cb281bd6850f81948644248@codeaurora.org"},"message":"misc: qcom: qdsp6v2: Add missing initialization\n\nUse variables in driver context after proper initialization\n\nCRs-Fixed: 1049521, 1049615\nChange-Id: I3e59e27534b8e1088d74b42c72e0075d2fe910e6\nSigned-off-by: Haynes Mathew George <hgeorge@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/1cb7a0a5e1cce5a50170bd25ed60832960cc3e41"},{"sha":"8439089995ac444e359b7a8e60c1197a1f495508","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"net: Warn for cloned packets in ingress path on SMP systems only\"","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/8439089995ac444e359b7a8e60c1197a1f495508"},{"sha":"8c1c2374d6dcf3e8c2354ad28548e40cf33acb81","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"msm: crypto: Fix integer over flow check in qcedev driver\"","distinct":true,"url":"https://api.github.com/repos/dianlujitao/CAF_kernel_msm-3.18/commits/8c1c2374d6dcf3e8c2354ad28548e40cf33acb81"}]}
{"actor":{"display_login":"dianlujitao"}}