{"push_id":2754756279,"size":280,"distinct_size":2,"ref":"refs/heads/caf-8.1-cp","head":"fcc88226307c4ed05923dbc890b85ba28fc737fe","before":"6688c494067de80a799104871710489ac30fb0b8","commits":[{"sha":"9ca78a40248bd0a54fb3925516e1b795409e6105","author":{"name":"Vijayavardhan Vennapusa","email":"76e30dc6511df6537bc8f74ebde59f1a6034d162@codeaurora.org"},"message":"USB: f_accessory: Check dev pointer before decoding ctrl request\n\nIn case of poweroff charging mode, accessory function instance\nis not created and due to this, _acc_dev will be NULL. If target\nis connected to Accessory dock in poweroff charging mode, there\nis a chance dev pointer is accessed, which is NULL. Hence add a\ncheck before processing control request and return error if it is\nNULL.\n\nChange-Id: I4f1deb9d764b8c0bd1d7837cbc43a2933167f568\nSigned-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/9ca78a40248bd0a54fb3925516e1b795409e6105"},{"sha":"2350901bcac3590b0264e3080ae907fdf9d98af3","author":{"name":"Takashi Iwai","email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de"},"message":"ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor\n\nWhen a USB-audio device receives a maliciously adjusted or corrupted\nbuffer descriptor, the USB-audio driver may access an out-of-bounce\nvalue at its parser.  This was detected by syzkaller, something like:\n\n  BUG: KASAN: slab-out-of-bounds in usb_audio_probe+0x27b2/0x2ab0\n  Read of size 1 at addr ffff88006b83a9e8 by task kworker/0:1/24\n  CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.14.0-rc1-42251-gebb2c2437d80 #224\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n  Workqueue: usb_hub_wq hub_event\n  Call Trace:\n   __dump_stack lib/dump_stack.c:16\n   dump_stack+0x292/0x395 lib/dump_stack.c:52\n   print_address_description+0x78/0x280 mm/kasan/report.c:252\n   kasan_report_error mm/kasan/report.c:351\n   kasan_report+0x22f/0x340 mm/kasan/report.c:409\n   __asan_report_load1_noabort+0x19/0x20 mm/kasan/report.c:427\n   snd_usb_create_streams sound/usb/card.c:248\n   usb_audio_probe+0x27b2/0x2ab0 sound/usb/card.c:605\n   usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361\n   really_probe drivers/base/dd.c:413\n   driver_probe_device+0x610/0xa00 drivers/base/dd.c:557\n   __device_attach_driver+0x230/0x290 drivers/base/dd.c:653\n   bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463\n   __device_attach+0x26e/0x3d0 drivers/base/dd.c:710\n   device_initial_probe+0x1f/0x30 drivers/base/dd.c:757\n   bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523\n   device_add+0xd0b/0x1660 drivers/base/core.c:1835\n   usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932\n   generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174\n   usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266\n   really_probe drivers/base/dd.c:413\n   driver_probe_device+0x610/0xa00 drivers/base/dd.c:557\n   __device_attach_driver+0x230/0x290 drivers/base/dd.c:653\n   bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463\n   __device_attach+0x26e/0x3d0 drivers/base/dd.c:710\n   device_initial_probe+0x1f/0x30 drivers/base/dd.c:757\n   bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523\n   device_add+0xd0b/0x1660 drivers/base/core.c:1835\n   usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457\n   hub_port_connect drivers/usb/core/hub.c:4903\n   hub_port_connect_change drivers/usb/core/hub.c:5009\n   port_event drivers/usb/core/hub.c:5115\n   hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195\n   process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119\n   worker_thread+0x221/0x1850 kernel/workqueue.c:2253\n   kthread+0x3a1/0x470 kernel/kthread.c:231\n   ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431\n\nThis patch adds the checks of out-of-bounce accesses at appropriate\nplaces and bails out when it goes out of the given buffer.\n\nChange-Id: Ib6aecf7269c30fdb60c70f5bef3ef45ffb4e9577\nGit-commit: bfc81a8bc18e3c4ba0cbaa7666ff76be2f998991\nGit-repo: https://github.com/torvalds/linux\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>\nSigned-off-by: Ajay Agarwal <ajaya@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/2350901bcac3590b0264e3080ae907fdf9d98af3"},{"sha":"0a5cd899a684f6d531ecd61610f38faa33deab98","author":{"name":"Takashi Iwai","email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de"},"message":"ALSA: usb-audio: Kill stray URB at exiting\n\nUSB-audio driver may leave a stray URB for the mixer interrupt when it\nexits by some error during probe.  This leads to a use-after-free\nerror as spotted by syzkaller like:\n  ==================================================================\n  BUG: KASAN: use-after-free in snd_usb_mixer_interrupt+0x604/0x6f0\n  Call Trace:\n   <IRQ>\n   __dump_stack lib/dump_stack.c:16\n   dump_stack+0x292/0x395 lib/dump_stack.c:52\n   print_address_description+0x78/0x280 mm/kasan/report.c:252\n   kasan_report_error mm/kasan/report.c:351\n   kasan_report+0x23d/0x350 mm/kasan/report.c:409\n   __asan_report_load8_noabort+0x19/0x20 mm/kasan/report.c:430\n   snd_usb_mixer_interrupt+0x604/0x6f0 sound/usb/mixer.c:2490\n   __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779\n   ....\n\n  Allocated by task 1484:\n   save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59\n   save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n   set_track mm/kasan/kasan.c:459\n   kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551\n   kmem_cache_alloc_trace+0x11e/0x2d0 mm/slub.c:2772\n   kmalloc ./include/linux/slab.h:493\n   kzalloc ./include/linux/slab.h:666\n   snd_usb_create_mixer+0x145/0x1010 sound/usb/mixer.c:2540\n   create_standard_mixer_quirk+0x58/0x80 sound/usb/quirks.c:516\n   snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560\n   create_composite_quirk+0x1c4/0x3e0 sound/usb/quirks.c:59\n   snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560\n   usb_audio_probe+0x1040/0x2c10 sound/usb/card.c:618\n   ....\n\n  Freed by task 1484:\n   save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59\n   save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n   set_track mm/kasan/kasan.c:459\n   kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:524\n   slab_free_hook mm/slub.c:1390\n   slab_free_freelist_hook mm/slub.c:1412\n   slab_free mm/slub.c:2988\n   kfree+0xf6/0x2f0 mm/slub.c:3919\n   snd_usb_mixer_free+0x11a/0x160 sound/usb/mixer.c:2244\n   snd_usb_mixer_dev_free+0x36/0x50 sound/usb/mixer.c:2250\n   __snd_device_free+0x1ff/0x380 sound/core/device.c:91\n   snd_device_free_all+0x8f/0xe0 sound/core/device.c:244\n   snd_card_do_free sound/core/init.c:461\n   release_card_device+0x47/0x170 sound/core/init.c:181\n   device_release+0x13f/0x210 drivers/base/core.c:814\n   ....\n\nActually such a URB is killed properly at disconnection when the\ndevice gets probed successfully, and what we need is to apply it for\nthe error-path, too.\n\nIn this patch, we apply snd_usb_mixer_disconnect() at releasing.\nAlso introduce a new flag, disconnected, to struct usb_mixer_interface\nfor not performing the disconnection procedure twice.\n\nChange-Id: Ic8b1b10a13b8369e12324210a8351b4ec0335218\nGit-commit: 124751d5e63c823092060074bd0abaae61aaa9c4\nGit-repo: https://github.com/torvalds/linux/commit\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>\nSigned-off-by: Ajay Agarwal <ajaya@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/0a5cd899a684f6d531ecd61610f38faa33deab98"},{"sha":"f9abab6787057aafc322d906809199e0e13654af","author":{"name":"Johan Hovold","email":"759412786bc533369b22377bf83fb9056c5b25b2@kernel.org"},"message":"USB: serial: console: fix use-after-free after failed setup\n\nMake sure to reset the USB-console port pointer when console setup fails\nin order to avoid having the struct usb_serial be prematurely freed by\nthe console code when the device is later disconnected.\n\nChange-Id: I4521740cfd288e745474d0de819a8304b72a2159\nGit-commit: 299d7572e46f98534033a9e65973f13ad1ce9047\nGit-repo: https://github.com/torvalds/linux/commit\nFixes: 73e487fdb75f (\"[PATCH] USB console: fix disconnection issues\")\nCc: stable <stable@vger.kernel.org>\t# 2.6.18\nAcked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/f9abab6787057aafc322d906809199e0e13654af"},{"sha":"b211b051d7ca226d96b70defe10ac318f768b5b2","author":{"name":"Arun Kumar Neelakantam","email":"e36519ed998e577ca4306dc3c35b89f0bef834f3@codeaurora.org"},"message":"net: ipc_router: Fix buffer overflow during memcpy\n\nThe increment logic of u64 pointer in skb_copy_to_log_buf() leads to\nbuffer overflow.\n\nModify the proto type of skb_copy_to_log_buf() function to accept\nonly unsigned char pointer.\n\nCRs-Fixed: 2212592\nChange-Id: I8affff1316656c1060ec57f2fb10b46f85314358\nSigned-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/b211b051d7ca226d96b70defe10ac318f768b5b2"},{"sha":"8c99e75b1a743f281b566e5c1eac03f2e7c5fcca","author":{"name":"Vijay Navnath Kamble","email":"08879ef1bf78cc5d46c46268d9279b177ff8fb9e@codeaurora.org"},"message":"ARM: dts: msm: Add DT support for apq8053-lite FEP v2\n\nAdd DT support for apq8053-lite FEP v2 with Mini CCB.\nSupports 8\" Innolux panel by default.\n\nChange-Id: Iab7ba5a04e61778520c877d4b6cb40530056180c\nSigned-off-by: Vijay Navnath Kamble <vkambl@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/8c99e75b1a743f281b566e5c1eac03f2e7c5fcca"},{"sha":"f318d804e53add0ecb40fd086c7390a3b570cdc1","author":{"name":"Sumit Agrawal","email":"088e984c216af7cc9a21c11d051bdf8e15b2a347@codeaurora.org"},"message":"ARM: dts: msm: Add DT support for apq8053-lite FEP v2 with Ext Codec\n\nAdd DT support for apq8053-lite based SOM with miniCCB and\nexternal codec.\n\nChange-Id: If3501eff82887b334ac44ebef8bbcb89021fe32a\nSigned-off-by: Sumit Agrawal <agsumit@codeaurora.org>\n(cherry picked from commit 400ad4d7ece548aa6d0f942d05b367824aa0233e)","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/f318d804e53add0ecb40fd086c7390a3b570cdc1"},{"sha":"72faa21ab84069290ed33da4d7400528cd5ab107","author":{"name":"Vijay Navnath Kamble","email":"08879ef1bf78cc5d46c46268d9279b177ff8fb9e@codeaurora.org"},"message":"ARM: dts: msm: Display bringup changes for apq8053-lite FEP v2 with miniCCB\n\nTurn on PM8953_L4 power. This powers the MIPI_DSI switch on the miniCCB.\nChange GPIO 141 to output low. This sets MIPI-DSI switch to route MIPI\nDSI to the LCD connector (original state : 141 input, L4 off)\n\nChange-Id: I87e9912463f98d6926c96762b6e6421c6e606e81\nSigned-off-by: Vijay Navnath Kamble <vkambl@codeaurora.org>\n(cherry picked from commit 4066a9c08709c26edc7087b8ba9ee4742e634478)","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/72faa21ab84069290ed33da4d7400528cd5ab107"},{"sha":"67e9e4986157d2d4429941aff469a511a23dcc08","author":{"name":"Linux Build Service Account","email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost"},"message":"Merge \"ARM: dts: msm: Add DT support for apq8053-lite FEP v2\"","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/67e9e4986157d2d4429941aff469a511a23dcc08"},{"sha":"1f59c248e69381607a233a6269df51f4036aa9d0","author":{"name":"Vijay Kumar TM","email":"efda3827f26fc0947468389a4b426cf884d1f840@codeaurora.org"},"message":"mm-camera2:isp2: Release buffer lock after use\n\nAt start axi stream, we are acquiring the\nbuffer lock and releasing after completing\nthe stream configuration operations. In case\nof live snapshot,this is causing the buffer\noperations to halt and leading to sof freeze.\n\nCRs-Fixed: 2149998\nChange-Id: I7f57c8befc85c105a5690ac71e0276f42b9f1929\nSigned-off-by: Meera Gande <mgande@codeaurora.org>\nSigned-off-by: Vijay Kumar TM <vtmuni@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/1f59c248e69381607a233a6269df51f4036aa9d0"},{"sha":"55a7089104587e924b2e5b35e0cf927f90bb0260","author":{"name":"Gerrit - the friendly Code Review server","email":"3697fa5d1b229f59097c7d14eeabccb8d36f99e1@localhost"},"message":"Merge changes  into msm-3.18.c10","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/55a7089104587e924b2e5b35e0cf927f90bb0260"},{"sha":"071d65da40bfdca6d412e345467d214eb87a3422","author":{"name":"Linux Build Service Account","email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost"},"message":"Merge \"ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor\"","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/071d65da40bfdca6d412e345467d214eb87a3422"},{"sha":"41914a578df7442dd79d5fa9e689a33d1cc38ea8","author":{"name":"Linux Build Service Account","email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost"},"message":"Merge \"ALSA: usb-audio: Kill stray URB at exiting\"","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/41914a578df7442dd79d5fa9e689a33d1cc38ea8"},{"sha":"5525b6c4fca848c79a563f4a71b367551a09fbf3","author":{"name":"Linux Build Service Account","email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost"},"message":"Merge \"USB: serial: console: fix use-after-free after failed setup\"","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/5525b6c4fca848c79a563f4a71b367551a09fbf3"},{"sha":"ba64953a82940a41227cfed639ec4a7d5b5ac344","author":{"name":"Linux Build Service Account","email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost"},"message":"Merge \"net: ipc_router: Fix buffer overflow during memcpy\"","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/ba64953a82940a41227cfed639ec4a7d5b5ac344"},{"sha":"03df36a432741c02bf0904995cb7a6d6cd39ca33","author":{"name":"Linux Build Service Account","email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost"},"message":"Merge \"ARM: dts: msm: Add DT support for apq8053-lite FEP v2 with Ext Codec\"","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/03df36a432741c02bf0904995cb7a6d6cd39ca33"},{"sha":"e05ac4aa2a9f3085b9ee5e91dc0378e2aeab4ecd","author":{"name":"Mao Jinlong","email":"2d76d89be837c33b95aa60637c0160a62fde50dc@codeaurora.org"},"message":"rtc: Disable alarm irq if alarm time is in the past\n\nIf device is boot up by rtc alarm, the alarm irq will still be\nenabled and the alarm time is smaller than current rtc time before\nany alarm is set or canceled. If device is powered off now, it will\nboot up automatically as the alarm irq is enabled.\n\nSo disable alarm irq if alarm is enabled and alarm time is in the\npast.\n\nCRs-Fixed: 2109666\nChange-Id: Ie60bd1222a400cd45a6c5a385faa70190fbe7e3c\nSigned-off-by: Mao Jinlong <jinlmao@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/e05ac4aa2a9f3085b9ee5e91dc0378e2aeab4ecd"},{"sha":"1415acefe77fb165c8a635f213d015894f8d2736","author":{"name":"Suman Mukherjee","email":"f7ebc6130fec7b99e7cb686969fd71e3ac56502b@codeaurora.org"},"message":"msm: camera: enable eeprom functionality on 8909\n\nAdding required changes to support multi module eeprom\ndesign.\n\nChange-Id: I1c927e1a12f3c850ef2ef3b6f4a953f13c12205e\nSigned-off-by: Vijay kumar Tumati <vtumati@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/1415acefe77fb165c8a635f213d015894f8d2736"},{"sha":"fbe663f06de79dee7d8bef94b08cea69e84fe3d5","author":{"name":"Linux Build Service Account","email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost"},"message":"Merge \"ARM: dts: msm: Display bringup changes for apq8053-lite FEP v2 with miniCCB\"","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/fbe663f06de79dee7d8bef94b08cea69e84fe3d5"},{"sha":"b80f941031fa12e25230ac3b3268116ca839ce10","author":{"name":"Linux Build Service Account","email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost"},"message":"Merge \"rtc: Disable alarm irq if alarm time is in the past\"","distinct":false,"url":"https://api.github.com/repos/dencel007/santoni_kernel_phantom_rebase/commits/b80f941031fa12e25230ac3b3268116ca839ce10"}]}
{"actor":{"display_login":"dencel007"}}