{"push_id":1472168576,"size":740,"distinct_size":740,"ref":"refs/heads/xz","head":"daf2fa030d9bdca893fe15bd01a5896169f96579","before":"51044c1110bcd5960d40f808479046c8b65a9a9c","commits":[{"sha":"530c01b2ae47a0ee796e6a3b8d16af7c62a4e042","author":{"name":"Jeff Vander Stoep","email":"3c7c1df314a95c4ce859cc668e778f3e3567dbe8@google.com"},"message":"Revert \"SELinux: ss: Fix policy write for ioctl operations\"\n\nThis reverts commit 8cdfb356b51e29494ca0b9e4e86727d6f841a52d.\n\nBug: 22846070\nChange-Id: I4dd2fd5a1d7fb3ae8f74a5decdf8fb9d5cd43def\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>\nSigned-off-by: Bharat Pawar <bpawar@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/530c01b2ae47a0ee796e6a3b8d16af7c62a4e042"},{"sha":"a6cd5b2cd1ed50afc0b68fc7c9b559f07a78cc44","author":{"name":"Aravind Asam","email":"ba17b29c9bfd3e51f807c8d5720ad694644370fa@codeaurora.org"},"message":"Revert \"SELinux: use deletion-safe iterator to free list\"\n\nThis reverts commit e623b152f30f6f1204919315df37244d69e5d55e.\n\nChange-Id: I8e8903786da86cbe4206c18f817fbb54db229472\nSigned-off-by: Aravind Asam <aasam@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/a6cd5b2cd1ed50afc0b68fc7c9b559f07a78cc44"},{"sha":"8dc5e8040395b27452e978db989e47c10548d1ba","author":{"name":"Aravind Asam","email":"ba17b29c9bfd3e51f807c8d5720ad694644370fa@codeaurora.org"},"message":"Revert \"SELinux: per-command whitelisting of ioctls\"\n\nThis reverts commit ba733f9857b966459316d0cd33b8da2e22f62d7d.\n\nChange-Id: Ie4d3e904160195dafd93a59a25d56b1449e8fc86\nSigned-off-by: Aravind Asam <aasam@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/8dc5e8040395b27452e978db989e47c10548d1ba"},{"sha":"f101ada17295203bd91e4889a28cf81a85d6247b","author":{"name":"Jeff Vander Stoep","email":"3c7c1df314a95c4ce859cc668e778f3e3567dbe8@google.com"},"message":"selinux: remove unnecessary pointer reassignment\n\n(cherry pick from commit 83d4a806ae46397f606de7376b831524bd3a21e5)\n\nCommit f01e1af445fa (\"selinux: don't pass in NULL avd to avc_has_perm_noaudit\")\nmade this pointer reassignment unnecessary. Avd should continue to reference\nthe stack-based copy.\n\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>\nAcked-by: Stephen Smalley <sds@tycho.nsa.gov>\n[PM: tweaked subject line]\nSigned-off-by: Paul Moore <pmoore@redhat.com>\nBug: 22846070\nChange-Id: I8fcba45a5acc4de862bd5b3f07bf4980f67133c4\nGit-commit: b1b3844449d596e5f25f591d89611c7e57d32610\nGit-repo: https://android.googlesource.com/kernel/common/\nSigned-off-by: David Ng <dave@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/f101ada17295203bd91e4889a28cf81a85d6247b"},{"sha":"7fd3daa33a003d28e4210365f7a5336fe3e69ea8","author":{"name":"Jeff Vander Stoep","email":"3c7c1df314a95c4ce859cc668e778f3e3567dbe8@google.com"},"message":"selinux: extended permissions for ioctls\n\n(cherry picked from commit fa1aa143ac4a682c7f5fd52a3cf05f5a6fe44a0a)\n\nAdd extended permissions logic to selinux. Extended permissions\nprovides additional permissions in 256 bit increments. Extend the\ngeneric ioctl permission check to use the extended permissions for\nper-command filtering. Source/target/class sets including the ioctl\npermission may additionally include a set of commands. Example:\n\nallowxperm <source> <target>:<class> ioctl unpriv_app_socket_cmds\nauditallowxperm <source> <target>:<class> ioctl priv_gpu_cmds\n\nWhere unpriv_app_socket_cmds and priv_gpu_cmds are macros\nrepresenting commonly granted sets of ioctl commands.\n\nWhen ioctl commands are omitted only the permissions are checked.\nThis feature is intended to provide finer granularity for the ioctl\npermission that may be too imprecise. For example, the same driver\nmay use ioctls to provide important and benign functionality such as\ndriver version or socket type as well as dangerous capabilities such\nas debugging features, read/write/execute to physical memory or\naccess to sensitive data. Per-command filtering provides a mechanism\nto reduce the attack surface of the kernel, and limit applications\nto the subset of commands required.\n\nThe format of the policy binary has been modified to include ioctl\ncommands, and the policy version number has been incremented to\nPOLICYDB_VERSION_XPERMS_IOCTL=30 to account for the format\nchange.\n\nThe extended permissions logic is deliberately generic to allow\ncomponents to be reused e.g. netlink filters\n\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>\nAcked-by: Nick Kralevich <nnk@google.com>\nSigned-off-by: Paul Moore <pmoore@redhat.com>\nBug: 22846070\nChange-Id: I7c6bdc0362657b47aa1388936c5a1300bc5c0b42\nGit-commit: 05b7da58527ef14001fe2b6e8de6b01d895d4429\nGit-repo: https://android.googlesource.com/kernel/common/\nSigned-off-by: David Ng <dave@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/7fd3daa33a003d28e4210365f7a5336fe3e69ea8"},{"sha":"a80f15e11b3d1d75097ef62f22d0350423359c6f","author":{"name":"Mark Salyzyn","email":"4814ffc71be21311f04ef34122c19152acc840c4@google.com"},"message":"pstore: selinux: add security in-core xattr support for pstore and debugfs\n\n- add \"pstore\" and \"debugfs\" to list of in-core exceptions\n- change fstype checks to boolean equation\n- change from strncmp to strcmp for checking\n\n(Cherry Pick from commit 2294d499b7969df3838becf5e58bf16b0e3c86c8)\n\nSigned-off-by: Mark Salyzyn <salyzyn@google.com>\nSigned-off-by: Bharat Pawar <bpawar@codeaurora.org>\nBug: 18917345\nBug: 18935184\nChange-Id: Ib648f30ce4b5d6c96f11465836d6fee89bec1c72","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/a80f15e11b3d1d75097ef62f22d0350423359c6f"},{"sha":"11d80e6cbf595a0ab6403b3eb55273ea6cf55206","author":{"name":"Jeff Vander Stoep","email":"3c7c1df314a95c4ce859cc668e778f3e3567dbe8@google.com"},"message":"selinux: Android kernel compatibility with M userspace\n\nNOT intended for new Android devices - this commit is unnecessary\nfor a target device that does not have a previous M variant.\n\nDO NOT upstream. Android only.\n\nMotivation:\n\nThis commit mitigates a mismatch between selinux kernel and\nselinux userspace. The selinux ioctl white-listing binary policy\nformat that was accepted into Android M differs slightly from what\nwas later accepted into the upstream kernel. This leaves Android\nmaster branch kernels incompatible with Android M releases. This\npatch restores backwards compatibility. This is important because:\n\n1. kernels may be updated on a different cycle than the rest of the\n   OS e.g. security patching.\n2. Android M bringup may still be ongoing for some devices. The\n   same kernel should work for both M and master.\n\nBackwards compatibility is achieved by checking for an Android M\npolicy characteristic during initial policy read and converting to\nupstream policy format. The inverse conversion is done for policy\nwrite as required for CTS testing\n\nBug: 22846070\nChange-Id: I2f1ee2eee402f37cf3c9df9f9e03c1b9ddec1929\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>\nSigned-off-by: Bharat Pawar <bpawar@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/11d80e6cbf595a0ab6403b3eb55273ea6cf55206"},{"sha":"8807ad32392d4a9ed0a66a337f66421921779de8","author":{"name":"Aravind Asam","email":"ba17b29c9bfd3e51f807c8d5720ad694644370fa@codeaurora.org"},"message":"selinux: do not check open perm on ftruncate call\n\nUse the ATTR_FILE attribute to distinguish between truncate()\nand ftruncate() system calls. The two other cases where\ndo_truncate is called with a filp (and therefore ATTR_FILE is set)\nare for coredump files and for open(O_TRUNC). In both of those cases\nthe open permission has already been checked during file open and\ntherefore does not need to be repeated.\n\nCommit 95dbf739313f (\"SELinux: check OPEN on truncate calls\")\nfixed a major issue where domains were allowed to truncate files\nwithout the open permission. However, it introduced a new bug where\na domain with the write permission can no longer ftruncate files\nwithout the open permission, even when they receive an already open\nfile.\n\n(cherry picked from commit b21800f304392ee5d20f411c37470183cc779f11)\n\nBug: 22567870\nChange-Id: I2525a0e244c8d635b2d0c1f966071edbb365a43a\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>\nAcked-by: Stephen Smalley <sds@tycho.nsa.gov>\nSigned-off-by: Paul Moore <pmoore@redhat.com>\nGit-commit: e9e500827b871459306974c32a0b6398375ce7d5\nGit-repo: https://android.googlesource.com/kernel/common/\nSigned-off-by: David Ng <dave@codeaurora.org>\nSigned-off-by: Aravind Asam <aasam@codeaurora.org>\nSigned-off-by: Bharat Pawar <bpawar@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/8807ad32392d4a9ed0a66a337f66421921779de8"},{"sha":"54114c228181f69fcd3f009275f70034259d0ebe","author":{"name":"Stephen Smalley","email":"a113c662ba7e86bc1a8f97e28bfedcdc6b0de5bd@tycho.nsa.gov"},"message":"UPSTREAM: selinux: fix bug in conditional rules handling\n\n(cherry picked from commit commit f3bef67992e8698897b584616535803887c4a73e).\n\ncommit fa1aa143ac4a (\"selinux: extended permissions for ioctls\")\nintroduced a bug into the handling of conditional rules, skipping the\nprocessing entirely when the caller does not provide an extended\npermissions (xperms) structure.  Access checks from userspace using\n/sys/fs/selinux/access do not include such a structure since that\ninterface does not presently expose extended permission information.\nAs a result, conditional rules were being ignored entirely on userspace\naccess requests, producing denials when access was allowed by\nconditional rules in the policy.  Fix the bug by only skipping\ncomputation of extended permissions in this situation, not the entire\nconditional rules processing.\n\nChange-Id: I24f39e3907d0b00a4194e15a4472e8d859508fa9\nReported-by: Laurent Bigonville <bigon@debian.org>\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>\n[PM: fixed long lines in patch description]\nCc: stable@vger.kernel.org # 4.3\nSigned-off-by: Paul Moore <pmoore@redhat.com>\nGit-commit: bd8d3dd3ae35f283f3b76e47b9762225c9f7d46c\nGit-repo: https://android.googlesource.com/kernel/common/\nSigned-off-by: David Ng <dave@codeaurora.org>\nSigned-off-by: Bharat Pawar <bpawar@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/54114c228181f69fcd3f009275f70034259d0ebe"},{"sha":"a1bd77c4885dcf6047d50a9f16c26da9dfdcb2b7","author":{"name":"Se Wang (Patrick) Oh","email":"1601fcf1961c6cf2d9004dabb5cab361cf16ec34@codeaurora.org"},"message":"qcom: scm: Support register x6 to pass the session id\n\nNon-atomic scm call which could be interrupted, trustzone will store\nthe session id in a register(x6) which will be used when trustzone resumes\nthe call.\nTo avoid x6 being used by compiler, HLOS now uses it to send a zero before\nmaking scm call.\nThis is the same change as in the 32bit scm call.\n\nChange-Id: If7a3ee28bdbf22acf447531603819a6f4f1603ca\nSigned-off-by: Se Wang (Patrick) Oh <sewango@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/a1bd77c4885dcf6047d50a9f16c26da9dfdcb2b7"},{"sha":"6547abe0405080cb2452b58d9a224cc2c4d76a0c","author":{"name":"Ravinder Konka","email":"f05fdaa02ca937694501c840aa393545f762a759@codeaurora.org"},"message":"rmnet_data : Changes to support Scatter Gather and GSO.\n\nThis patch enables hardware device features such as\nNETIF_F_SG NETIF_F_GSO NETIF_F_GSO_UDP_TUNNEL\nNETIF_F_GSO_UDP_TUNNEL_CSUM. This patch also ensures\nto skip padding(to align length to word boundaries)\nfor outgoing  non linear skbs.\n\nThis patch also adds a new ioctl interface\nRMNET_IOCTL_GET_SG_SUPPORT  to query the physical\nnetwork devices for Scatter Gather support.\n\nChange-Id: I9788d75c249ab2dac5b598dad131c0692ed84e4d\nAcked-by: Abhishek Chauhan <abchauha@qti.qualcomm.com>\nSigned-off-by: Ravinder Konka <rkonka@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/6547abe0405080cb2452b58d9a224cc2c4d76a0c"},{"sha":"766ff9ddd9f73192483a4dc6c33f18ce91cef287","author":{"name":"Manaf Meethalavalappu Pallikunhi","email":"c206658a52c2fe0fb598c46fb7b56eaea5d1c35e@codeaurora.org"},"message":"msm: limits: Check user buffer size before copying to local buffer\n\nUser input data is passed in from userspace through debugfs interface\nof supply lm core to validate supply lm core functionality. Ensure\nuser buffer size is not greater than expected stack buffer size\nto avoid out of bounds array accesses.\n\nChange-Id: I5a93774855241b50895c5e2b3ff939e4c33a0185\nSigned-off-by: Manaf Meethalavalappu Pallikunhi <manafm@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/766ff9ddd9f73192483a4dc6c33f18ce91cef287"},{"sha":"07201b733d0facb9d57872280886e99891573285","author":{"name":"Tarun Karra","email":"2510a0714f96c923ea81ac473307af04ae122ae5@codeaurora.org"},"message":"msm: kgsl: verify user memory permissions before mapping to GPU driver\n\nFor user memory of type KGSL_USER_MEM_TYPE_ADDR mapped to GPU driver\nverify permissions and map GPU permissions same as CPU permissions.\nIf elevated permissions are requested return an error to prevent\nprivilege escalation. Without this check user could map readonly\nmemory into GPU driver as readwrite and gain elevated privilege.\n\nWrite permissions check is currently inverted causing readonly\nuser pages to be mapped as readwrite in GPU driver. Fix this\ncheck to map readonly pages as readonly.\n\nCRs-Fixed: 988993\nChange-Id: I0e097d7e4e4c414c0849e33bcc61a26fb94291ad\nSigned-off-by: Tarun Karra <tkarra@codeaurora.org>\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/07201b733d0facb9d57872280886e99891573285"},{"sha":"d5422b95ffdac87ad73c7765e35300fa748f6b1f","author":{"name":"Patrick Daly","email":"78479ab4153ef5619bc927755d9ca2e5cd01b75a@codeaurora.org"},"message":"ASoC: msm: qdsp6v2: DAP: Fix unprotected userspace access\n\nUse get_user() & friends to access userspace addresses.\n\nChange-Id: I9741a60e53f6253da27913175e9b8c4abbf50db9\nSigned-off-by: Patrick Daly <pdaly@codeaurora.org>\nSigned-off-by: Pradnya Chaphekar <pradnyac@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/d5422b95ffdac87ad73c7765e35300fa748f6b1f"},{"sha":"231725b18952f93c933c13d08e74dfc08bf2efa7","author":{"name":"Manu Gautam","email":"876e9847b0240db58d29900a57b080fdd1e2cc11@codeaurora.org"},"message":"usb: f_serial: Check for SMD data length in GSER_IOCTL\n\nIf user tries to send SMD data more than the driver\nbuffer can handle then fail the same and print\nerror message. This smd_write is exposed to userspace\nthrough ioctl using a misc device.\n\nChange-Id: Ie8a1c1c0799cd10cef512ad6b1e1e95001dd43b2\nSigned-off-by: Manu Gautam <mgautam@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/231725b18952f93c933c13d08e74dfc08bf2efa7"},{"sha":"6659219256b61b5517adc784fcfd8199d38b0429","author":{"name":"Veera Sundaram Sankaran","email":"3287f11dd36ba2848f5a783a91dbc39d6db8456d@codeaurora.org"},"message":"msm: mdss: fix possible out-of-bounds and overflow issue in mdp debugfs\n\nThere are few cases where the count argument passed by the user\nspace is not validated, which can potentially lead to out of bounds\nor overflow issues. In some cases, kernel might copy more data than\nwhat is requested. Add necessary checks to avoid such cases.\n\nChange-Id: Ifa42fbd475665a0ca581c907ce5432584ea0e7ed\nSigned-off-by: Veera Sundaram Sankaran <veeras@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/6659219256b61b5517adc784fcfd8199d38b0429"},{"sha":"fd5e077e09de3d549c5bb8de9cdb4dfca6ff2bd8","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"msm: kgsl: verify user memory permissions before mapping to GPU driver\"","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/fd5e077e09de3d549c5bb8de9cdb4dfca6ff2bd8"},{"sha":"6b53462e628e08310ad8ac3e65d599c2143ae6c8","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"usb: f_serial: Check for SMD data length in GSER_IOCTL\"","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/6b53462e628e08310ad8ac3e65d599c2143ae6c8"},{"sha":"32a4ea56e3ff08bebeb8fe49150cdc1527bd89d3","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"msm: mdss: fix possible out-of-bounds and overflow issue in mdp debugfs\"","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/32a4ea56e3ff08bebeb8fe49150cdc1527bd89d3"},{"sha":"d88726a8e51b8d58dc7cc1a17fe623f5f0c21bb3","author":{"name":"Manaf Meethalavalappu Pallikunhi","email":"c206658a52c2fe0fb598c46fb7b56eaea5d1c35e@codeaurora.org"},"message":"msm: limits: Check user buffer size before copying to local buffer\n\nUser input data is passed in from userspace through debugfs interface\nof supply lm core to validate supply lm core functionality. Ensure\nuser buffer size is not greater than expected stack buffer size\nto avoid out of bounds array accesses.\n\nChange-Id: I5a93774855241b50895c5e2b3ff939e4c33a0185\nSigned-off-by: Manaf Meethalavalappu Pallikunhi <manafm@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/appu7/android_kernel_cyanogen_msm8916/commits/d88726a8e51b8d58dc7cc1a17fe623f5f0c21bb3"}]}
{"actor":{"display_login":"appu7"}}