{"push_id":2332537460,"size":66,"distinct_size":66,"ref":"refs/heads/cm-14.1","head":"89dea374cfad80f86091a4026c300a8dcba7a43f","before":"7b06e2e8390e6ad8b0f4502915cc523d55e8e293","commits":[{"sha":"14dbb58840f352ccc683fb18491c1980dd86add1","author":{"name":"Trishansh Bhardwaj","email":"e6f3043187f404ce783dec579af51dccff5a72a4@codeaurora.org"},"message":"msm: camera: Prevent use-after-free in v4l2_event_subscribe.\n\nIf same event is unsubscribed before v4l2_event_subscribe returned,\nThen function v4l2_event_subscribe have possibility use-after-free.\n\nSerialize msm_subscribe_event and msm_unsubscribe_event to\nprevent parallel invocation of v4l2_event_subscribe and\nv4l2_event_unsubscribe.\n\nChange-Id: I321fc66a9acbfb6e511b553be4cedffd26a558db\nSigned-off-by: Trishansh Bhardwaj <tbhardwa@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/14dbb58840f352ccc683fb18491c1980dd86add1"},{"sha":"6aba39b8893f15aea18d4da6372ce2a9f69db5ce","author":{"name":"Gabriel Krisman Bertazi","email":"70c508657631d6f248acc0b255cbde9f133e6554@linux.vnet.ibm.com"},"message":"xhci: Cleanup only when releasing primary hcd\n\nUnder stress occasions some TI devices might not return early when\nreading the status register during the quirk invocation of xhci_irq made\nby usb_hcd_pci_remove.  This means that instead of returning, we end up\nhandling this interruption in the middle of a shutdown.  Since\nxhci->event_ring has already been freed in xhci_mem_cleanup, we end up\naccessing freed memory, causing the Oops below.\n\ncommit 8c24d6d7b09d (\"usb: xhci: stop everything on the first call to\nxhci_stop\") is the one that changed the instant in which we clean up the\nevent queue when stopping a device.  Before, we didn't call\nxhci_mem_cleanup at the first time xhci_stop is executed (for the shared\nHCD), instead, we only did it after the invocation for the primary HCD,\nmuch later at the removal path.  The code flow for this oops looks like\nthis:\n\nxhci_pci_remove()\n\tusb_remove_hcd(xhci->shared)\n\t        xhci_stop(xhci->shared)\n \t\t\txhci_halt()\n\t\t\txhci_mem_cleanup(xhci);  // Free the event_queue\n\tusb_hcd_pci_remove(primary)\n\t\txhci_irq()  // Access the event_queue if STS_EINT is set. Crash.\n\t\txhci_stop()\n\t\t\txhci_halt()\n\t\t\t// return early\n\nThe fix modifies xhci_stop to only cleanup the xhci data when releasing\nthe primary HCD.  This way, we still have the event_queue configured\nwhen invoking xhci_irq.  We still halt the device on the first call to\nxhci_stop, though.\n\nI could reproduce this issue several times on the mainline kernel by\ndoing a bind-unbind stress test with a specific storage gadget attached.\nI also ran the same test over-night with my patch applied and didn't\nobserve the issue anymore.\n\n[  113.334124] Unable to handle kernel paging request for data at address\n\t\t0x00000028\n[  113.335514] Faulting instruction address: 0xd00000000d4f767c\n[  113.336839] Oops: Kernel access of bad area, sig: 11 [#1]\n[  113.338214] SMP NR_CPUS=1024 NUMA PowerNV\n\n[c000000efe47ba90] c000000000720850 usb_hcd_irq+0x50/0x80\n[c000000efe47bac0] c00000000073d328 usb_hcd_pci_remove+0x68/0x1f0\n[c000000efe47bb00] d00000000daf0128 xhci_pci_remove+0x78/0xb0\n[xhci_pci]\n[c000000efe47bb30] c00000000055cf70 pci_device_remove+0x70/0x110\n[c000000efe47bb70] c00000000061c6bc __device_release_driver+0xbc/0x190\n[c000000efe47bba0] c00000000061c7d0 device_release_driver+0x40/0x70\n[c000000efe47bbd0] c000000000619510 unbind_store+0x120/0x150\n[c000000efe47bc20] c0000000006183c4 drv_attr_store+0x64/0xa0\n[c000000efe47bc60] c00000000039f1d0 sysfs_kf_write+0x80/0xb0\n[c000000efe47bca0] c00000000039e14c kernfs_fop_write+0x18c/0x1f0\n[c000000efe47bcf0] c0000000002e962c __vfs_write+0x6c/0x190\n[c000000efe47bd90] c0000000002eab40 vfs_write+0xc0/0x200\n[c000000efe47bde0] c0000000002ec85c SyS_write+0x6c/0x110\n[c000000efe47be30] c000000000009260 system_call+0x38/0x108\n\nChange-Id: I987ae6f8b54b6488b1668df5c67628f17e828863\nSigned-off-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>\nCc: Roger Quadros <rogerq@ti.com>\nCc: joel@jms.id.au\nCc: stable@vger.kernel.org\nReviewed-by: Roger Quadros <rogerq@ti.com>\nCc: <stable@vger.kernel.org> #v4.3+\nTested-by: Joel Stanley <joel@jms.id.au>\nSigned-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nGit-commit: 27a41a83ec54d0edfcaf079310244e7f013a7701\nGit-Repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\n[prathampratap@codeaurora.org: resolve trivial merge conflicts]\nSigned-off-by: Pratham Pratap <prathampratap@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/6aba39b8893f15aea18d4da6372ce2a9f69db5ce"},{"sha":"4a626bab49ace3f629ff604106b32de083b69a82","author":{"name":"Sreelakshmi Gownipalli","email":"b0170ba8f80ed49c9a6426fea524971da1a50b2a@codeaurora.org"},"message":"diag: Free the memory in diagfwd_peripheral_exit()\n\nIn diagfwd_peripheral_exit() free the memory associated with\nearly_init_info.\n\nChange-Id: I862b6d806d67dad38316f1608827a4bf6f5a691f\nSigned-off-by: Sreelakshmi Gownipalli <sgownipa@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/4a626bab49ace3f629ff604106b32de083b69a82"},{"sha":"583b3ac105e5cecbd71aafad7551c364925a119b","author":{"name":"Sayali Lokhande","email":"69bdb3f673903ab593c6aff183ab96fbbf388b75@codeaurora.org"},"message":"scsi: ufs: Fix off-by-one bug in ufs debugfs driver\n\nWhen getting string from userspace by simple_write_to_buffer\nin ufs_qcom_dbg_testbus_cfg_write() function, null byte may\nbe written out of bounds of configuration buffer if return\nvalue is same as size of buffer, causing off-by-one bug.\nThis change passes correct available size of configuration\nbuffer to simple_write_to_buffer function.\n\nChange-Id: If6085e806aa34622a9a57b02f563869c51011d2f\nSigned-off-by: Sayali Lokhande <sayalil@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/583b3ac105e5cecbd71aafad7551c364925a119b"},{"sha":"f0b6305ef831777bb044b147f4acb7de20f6b187","author":{"name":"c_mtharu","email":"aa9512e60afeb012884fbcd0d8b622f313e75f09@codeaurora.org"},"message":"msm: ADSPRPC: validate context pointer with magic number\n\nValidate context pointer using magic number instead of searching\nthrough context list. It removes the usage of spin lock in interrupt\nhandler for avoiding deadlock and reducing latency.\n\nChange-Id: I2492a7984a8d6545618a9cfb7a2d239d03ddd5a2\nAcked-by: Viswanatham Paduchuri <vpaduchu@qti.qualcomm.com>\nSigned-off-by: Tharun Kumar Merugu <mtharu@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/f0b6305ef831777bb044b147f4acb7de20f6b187"},{"sha":"7e385e1dc10f4c80992b20cd17955134823a3e46","author":{"name":"Karthikeyan Mani","email":"12d00abfab8c146011b7d9f7e4dde0b037cbdbfd@codeaurora.org"},"message":"ALSA: pcm: remove SNDRV_PCM_IOCTL1_INFO internal command\n\nDrivers can implement 'struct snd_pcm_ops.ioctl' to handle some requests\nfrom ALSA PCM core. These requests are internal purpose in kernel land.\nUsually common set of operations are used for it.\n\nSNDRV_PCM_IOCTL1_INFO is one of the requests. According to code comment,\nit has been obsoleted in the old days.\n\nWe can see old releases in ftp.alsa-project.org. The command was firstly\nintroduced in v0.5.0 release as SND_PCM_IOCTL1_INFO, to allow drivers to\nfill data of 'struct snd_pcm_channel_info' type. In v0.9.0 release,\nthis was obsoleted by the other commands for ioctl(2) such as\nSNDRV_PCM_IOCTL_CHANNEL_INFO.\n\nThis commit removes the long-abandoned command, bye.\n\nCRs-fixed: 2112663\nChange-Id: I17d9c0a759fce81d3dc9b9375f5d5f35dac583b8\nSigned-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nGit-commit: e11f0f90a626f93899687b1cc909ee37dd6c5809\nGit-repo: git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git\nSigned-off-by: Karthikeyan Mani <kmani@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/7e385e1dc10f4c80992b20cd17955134823a3e46"},{"sha":"9e10c81ff9cc3dcfe17158701dfb08c06f3861ee","author":{"name":"Banajit Goswami","email":"d9f3b0ac7d3275ff534aa3f7cbf6fa940e574816@codeaurora.org"},"message":"ALSA: pcm: remove unused variable from snd_pcm_info()\n\nRemove unused 'runtime' variable from function snd_pcm_info().\nThe last usage of this variable was removed with the\n'commit e11f0f90a626f9 (\"ALSA: pcm: remove SNDRV_PCM_IOCTL1_INFO\ninternal command\")'.\n\nChange-Id: I3964d84f7cced811d15ff45a1c31cc28d20dc721\nSigned-off-by: Banajit Goswami <bgoswami@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/9e10c81ff9cc3dcfe17158701dfb08c06f3861ee"},{"sha":"0c1d220da66ca4d201cceaed03cb595d649e57ef","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"msm: ADSPRPC: validate context pointer with magic number\"","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/0c1d220da66ca4d201cceaed03cb595d649e57ef"},{"sha":"296eb7452db8b6fdf892a5b5b269191ad1ec4562","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Promotion of kernel.lnx.3.18.c5-171208.\n\nCRs      Change ID                                   Subject\n--------------------------------------------------------------------------------------------------------------\n2143070   I2492a7984a8d6545618a9cfb7a2d239d03ddd5a2   msm: ADSPRPC: validate context pointer with magic number\n2143495   If6085e806aa34622a9a57b02f563869c51011d2f   scsi: ufs: Fix off-by-one bug in ufs debugfs driver\n\nChange-Id: I6695df6ceb8337562c2c170a64c25998335a9389\nCRs-Fixed: 2143070, 2143495","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/296eb7452db8b6fdf892a5b5b269191ad1ec4562"},{"sha":"355851cff91d47e2d99cbc96f728dbbcf80f9d69","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"xhci: Cleanup only when releasing primary hcd\"","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/355851cff91d47e2d99cbc96f728dbbcf80f9d69"},{"sha":"c5ddc5980fe5c810b1b02b9ef0e7bd21335ea350","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Promotion of kernel.lnx.3.18.c5-171211.\n\nCRs      Change ID                                   Subject\n--------------------------------------------------------------------------------------------------------------\n2074270   I987ae6f8b54b6488b1668df5c67628f17e828863   xhci: Cleanup only when releasing primary hcd\n\nChange-Id: I743e86e5529afb1fb6fd052a5c35f16d85542b68\nCRs-Fixed: 2074270","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/c5ddc5980fe5c810b1b02b9ef0e7bd21335ea350"},{"sha":"ef8b11ac771aea9351e90ac6def8b78372430254","author":{"name":"Miaoqing Pan","email":"b5eade11f2a68aa4c7c043330ed198c6df904cff@codeaurora.org"},"message":"ath9k: fix tx99 use after free\n\nOne scenario that could lead to UAF is two threads writing\nsimultaneously to the \"tx99\" debug file. One of them would\nset the \"start\" value to true and follow to ath9k_tx99_init().\nInside the function it would set the sc->tx99_state to true\nafter allocating sc->tx99skb. Then, the other thread would\nexecute write_file_tx99() and call ath9k_tx99_deinit().\nsc->tx99_skb would be freed. After that, the first thread\nwould continue inside ath9k_tx99_init() and call\nr = ath9k_tx99_send(sc, sc->tx99_skb, &txctl);\nthat would make use of the freed sc->tx99_skb memory.\n\nCRs-Fixed: 2031398\nChange-Id: I28b0b6375847a0a5f864c52e3886e352932edc41\nSigned-off-by: Miaoqing Pan <miaoqing@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/ef8b11ac771aea9351e90ac6def8b78372430254"},{"sha":"696405a5e8f9d0c9dd81c450731fb0885944ec54","author":{"name":"Mohammed Javid","email":"8ac1ea830510c533b5e712c0a9734492c55fa2d3@codeaurora.org"},"message":"msm:ipa: Fix to slab out of bounds access\n\nAccessing of incorrect structure pointer is causing\nslab-out-of-bounds access, fixed issue by accessing\nthe correct structure pointer.\n\nChange-Id: I23d3c9afbbabba88be92ef5cae83c4708a211e88\nAcked-by: Ashok Vuyyuru <avuyyuru@qti.qualcomm.com>\nSigned-off-by: Mohammed Javid <mjavid@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/696405a5e8f9d0c9dd81c450731fb0885944ec54"},{"sha":"da07dcc9dc0402c4842d365c9b063c192e43d1f3","author":{"name":"Aditya Bavanari","email":"4fb56751cf34f724162f8562c5ab898252a5ada1@codeaurora.org"},"message":"ASoC: msm: qdsp6v2: Set freed pointers to NULL\n\nSet freed pointers to NULL to avoid double free\nin msm_compr_playback_open and msm_compr_playback_free\nfunctions of the compress driver.\n\nCRs-Fixed: 2142216\nChange-Id: Ifd011dd85dd9f610c7b69dd460f73d26e006cd66\nSigned-off-by: Aditya Bavanari <abavanar@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/da07dcc9dc0402c4842d365c9b063c192e43d1f3"},{"sha":"96ac55a5d6874430402fe804e00a45e75846d50e","author":{"name":"peter chang","email":"205f7fecd39118de4f141e4c6f6cb27449604edc@google.com"},"message":"scsi: sg: check length passed to SG_NEXT_CMD_LEN\n\ncommit bf33f87dd04c371ea33feb821b60d63d754e3124 upstream.\n\nThe user can control the size of the next command passed along, but the\nvalue passed to the ioctl isn't checked against the usable max command\nsize.\n\nChange-Id: Ib063fb80955665638b3e402993cbbd8c41932fac\nSigned-off-by: Peter Chang <dpf@google.com>\nAcked-by: Douglas Gilbert <dgilbert@interlog.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nGit-commit: bf33f87dd04c371ea33feb821b60d63d754e3124\nGit-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\nSigned-off-by: Sayali Lokhande <sayalil@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/96ac55a5d6874430402fe804e00a45e75846d50e"},{"sha":"7e9930bca8355f533c499d27776895bf454b80c1","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Promotion of kernel.lnx.3.18.c5-171214.\n\nCRs      Change ID                                   Subject\n--------------------------------------------------------------------------------------------------------------\n2120436   Ib063fb80955665638b3e402993cbbd8c41932fac   scsi: sg: check length passed to SG_NEXT_CMD_LEN\n\nChange-Id: Iaa932d4404451cd7e719c0bf751ee74fb5322b02\nCRs-Fixed: 2120436","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/7e9930bca8355f533c499d27776895bf454b80c1"},{"sha":"445ee60da50573c7d494b19564a8b98864f6b1aa","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"diag: Free the memory in diagfwd_peripheral_exit()\"","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/445ee60da50573c7d494b19564a8b98864f6b1aa"},{"sha":"17e8dbd8803dc8e46850fc70d77d09948a88e7cc","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"ALSA: pcm: remove unused variable from snd_pcm_info()\"","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/17e8dbd8803dc8e46850fc70d77d09948a88e7cc"},{"sha":"489e90c0f60d2e989113d70911be4b6e3456ed0d","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"ath9k: fix tx99 use after free\"","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/489e90c0f60d2e989113d70911be4b6e3456ed0d"},{"sha":"8c1880b2f6a390f0e5fcf22f0d6bcfb3ed2f8c8e","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@quicinc.com"},"message":"Merge \"msm:ipa: Fix to slab out of bounds access\"","distinct":true,"url":"https://api.github.com/repos/delaya73/android_kernel_oneplus_msm8996/commits/8c1880b2f6a390f0e5fcf22f0d6bcfb3ed2f8c8e"}]}
{"actor":{"display_login":"delaya73"}}