{"push_id":2433756276,"size":57,"distinct_size":57,"ref":"refs/heads/dev/O","head":"da1cf569f559988abea4c42b3d5247fb5622e49e","before":"c1b9a0f064b41b29a5be8c5ad0fd8bcedfbe96e2","commits":[{"sha":"7a6fc1653679ee1c40eca337922457476cfd88a3","author":{"name":"Sahitya Tummala","email":"b7bf508aab3e5632db28abf288bf9b4635713caf@codeaurora.org"},"message":"defconfig: msm8937: Disable unnecessary configs\n\nDisable unnecessary configs to reduce memory foot print.\n\nChange-Id: Iafd3af46a1a42c82274d014a7e6bce8e562fabda\nSigned-off-by: Sahitya Tummala <stummala@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/7a6fc1653679ee1c40eca337922457476cfd88a3"},{"sha":"5c41200a2399251c90abdee7a6d70036ca629e01","author":{"name":"Gustavo Solaira","email":"d7fc32bfef4bd66bbdcfb935f3379366876f72ad@codeaurora.org"},"message":"ARM: dts: msm: Disable K61 SPI-CAN on mdm9650 CV2X\n\nDisable K61 SPI-CAN device node on mdm9650 CV2X boards.\n\nChange-Id: If7b9be932d4211134f9c3291e2fdc718ec3aa484\nSigned-off-by: Gustavo Solaira <gustavos@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/5c41200a2399251c90abdee7a6d70036ca629e01"},{"sha":"f9e785730b21f63ad673eec7dfc3aea0f09eda7e","author":{"name":"Gustavo Solaira","email":"d7fc32bfef4bd66bbdcfb935f3379366876f72ad@codeaurora.org"},"message":"ARM: dts: msm: Remove unneeded sharedmem definition in mdm9650 CV2X\n\nRemove unneeded definition in mdm9650 CV2X since it's not needed\nfor NAND based targets.\n\nChange-Id: I1131a875978b833f594dd51569903aca8a289f5a\nSigned-off-by: Gustavo Solaira <gustavos@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/f9e785730b21f63ad673eec7dfc3aea0f09eda7e"},{"sha":"9511e6fd49a860e4a8dedf887ad148cc77583a96","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"ARM: dts: msm: Disable K61 SPI-CAN on mdm9650 CV2X\"","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/9511e6fd49a860e4a8dedf887ad148cc77583a96"},{"sha":"68c107d987f393e8d75834e2695c6d4b4e54a156","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"ARM: dts: msm: Remove unneeded sharedmem definition in mdm9650 CV2X\"","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/68c107d987f393e8d75834e2695c6d4b4e54a156"},{"sha":"afcfc272bc2662367f45dcdf8f270b709576ea1a","author":{"name":"Fenglin Wu","email":"65ea2b13f3d47b62872a3092ae73a33c559c384e@codeaurora.org"},"message":"power_supply: Add REAL_TYPE power_supply_property\n\nAdd REAL_TYPE power_supply property to record the real time charger\ntype.\n\nChange-Id: I5fb2e3e3e782bcac0f8dd6071a830bcf370ebbd4\nSigned-off-by: Fenglin Wu <fenglinw@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/afcfc272bc2662367f45dcdf8f270b709576ea1a"},{"sha":"73e857e0d991e31d39113c3b099dc379ecbc8e56","author":{"name":"Fenglin Wu","email":"65ea2b13f3d47b62872a3092ae73a33c559c384e@codeaurora.org"},"message":"power: qpnp-smbcharger: Report charger types in REAL_TYPE property\n\nUse POWER_SUPPLY_PROP_REAL_TYPE property to report charger types between\ncharger and USB drivers. Update usb_psy POWER_SUPPLY_PROP_TYPE property\nto POWER_SUPPLY_TYPE_USB_DCP if it is HVDCP/HVDCP3 type and ignore\nreporting POWER_SUPPLY_TYPE_UNKNOWN. This helps the battery HAL to\nrecongize HVDCP/HVDCP3 as AC chargers.\n\nChange-Id: Id0116608270dd8c608136d5dede5a09f3538e128\nSigned-off-by: Fenglin Wu <fenglinw@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/73e857e0d991e31d39113c3b099dc379ecbc8e56"},{"sha":"8e83f023409591b26300c19566562adb95479601","author":{"name":"Vikash Garodia","email":"276c47ccdf06f857f3c86ba08d9275c9d67e8d0a@codeaurora.org"},"message":"msm: vidc: Handle perf mode configuration\n\nHost will set the Venus firmware in below modes\n1. If the load of current video session exceeds\nthe venus capability, video driver sets power\nsave mode for that session.\n2. If an usecase is recommended to run in power\nsave mode to get power benefits, video driver\nconfigures the session in power save mode.\n3. If any V4L2 client makes an explicit call to\nconfigure the usecase in a certain perf mode,\nvideo driver sets the same to venus firmware,\nunless restricted by core capability.\n\nCRs-Fixed: 1106972\nChange-Id: Ib8be6c9af1508389edc9cb6444531c6e711b6a11\nSigned-off-by: Vikash Garodia <vgarodia@codeaurora.org>\nSigned-off-by: Sanjay Singh <sisanj@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/8e83f023409591b26300c19566562adb95479601"},{"sha":"33f9492c9496e7ed01d3c6c58bb417f0a5bc3b0f","author":{"name":"Carter Cooper","email":"4b93d7d4a3b9ec5fa2fac4cd74295bbd71be23d2@codeaurora.org"},"message":"msm: kgsl: Properly remove ref count on gpuobj_sync failure\n\nThe user can pass bad data into kgsl_ioctl_gpuobj_sync(). If\n_copy_from_user() fails do to bad data, undo any current\nreferences taken through this ioctl call.\n\nChange-Id: I56195520b9dadba20ee419658fc2cbb282b8449c\nSigned-off-by: Carter Cooper <ccooper@codeaurora.org>\nSigned-off-by: samit vats <svats@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/33f9492c9496e7ed01d3c6c58bb417f0a5bc3b0f"},{"sha":"d6f2095d9080517ff501ef14bf69b6264333bda4","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"power_supply: Add REAL_TYPE power_supply_property\"","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/d6f2095d9080517ff501ef14bf69b6264333bda4"},{"sha":"f984f62a46ec04c44aed621d78c40c587c537f2e","author":{"name":"Herbert Xu","email":"b06c1e85ee1d40a691f7eaf317640579555a220e@gondor.apana.org.au"},"message":"crypto: algif_skcipher - Load TX SG list after waiting\n\nWe need to load the TX SG list in sendmsg(2) after waiting for\nincoming data, not before.\n\nconnoro@google.com: backport to 3.18,where the relevant logic is\nlocated in skcipher_recvmsg() rather than skcipher_recvmsg_sync()\n\nChange-Id: I4e18b385fe50c844cd62a2eb20122036ea4dfe09\nGit-commit: 36c84b22ac8aa041cbdfbe48a55ebb32e3521704\nGit-repo: https://android.googlesource.com/kernel/common.git\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Connor O'Brien <connoro@google.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Kishor PK <kpbhat@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/f984f62a46ec04c44aed621d78c40c587c537f2e"},{"sha":"a1eb4aa3cb55a4a0fd7d379c4a215e30eb6f308a","author":{"name":"Wei Li","email":"b86bd80801680da6257da9bd3954027e5dcd979b@huawei.com"},"message":"angler: remove 'reboot edl' interface for security\n\nRemoved edl interface for security reasons.\n\nBUG: 63100473\nChange-Id: I9bdcb6b9794e2bc59c6557b6160cf964cc61265c\nGit-commit: 6bf0876eb2a65282d796620ef2c640a86a61df82\nGit-repo: https://android.googlesource.com/kernel/common.git\nSigned-off-by: Kishor PK <kpbhat@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/a1eb4aa3cb55a4a0fd7d379c4a215e30eb6f308a"},{"sha":"d0fb9ef535ef1ff52425228749293b7c72e49783","author":{"name":"Chenbo Feng","email":"41ff9ca698b527685d468e528334a344f4fd728b@google.com"},"message":"ANDROID: qtaguid: Fix the UAF probelm with tag_ref_tree\n\nWhen multiple threads is trying to tag/delete the same socket at the\nsame time, there is a chance the tag_ref_entry of the target socket to\nbe null before the uid_tag_data entry is freed. It is caused by the\nctrl_cmd_tag function where it doesn't correctly grab the spinlocks\nwhen tagging a socket.\n\nSigned-off-by: Chenbo Feng <fengc@google.com>\nBug: 65853158\nChange-Id: I5d89885918054cf835370a52bff2d693362ac5f0\nGit-repo: https://android.googlesource.com/kernel/msm\nGit-commit: a6661da56dc61b67cc65222b71896a775ceb17be\nSigned-off-by: Dennis Cagle <dcagle@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/d0fb9ef535ef1ff52425228749293b7c72e49783"},{"sha":"10ab8293da3849b14e5efb4a0fc83f24aa73eade","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: seq: Fix use-after-free at creating a port\n\ncommit 71105998845fb012937332fe2e806d443c09e026 upstream.\n\nThere is a potential race window opened at creating and deleting a\nport via ioctl, as spotted by fuzzing.  snd_seq_create_port() creates\na port object and returns its pointer, but it doesn't take the\nrefcount, thus it can be deleted immediately by another thread.\nMeanwhile, snd_seq_ioctl_create_port() still calls the function\nsnd_seq_system_client_ev_port_start() with the created port object\nthat is being deleted, and this triggers use-after-free like:\n\n BUG: KASAN: use-after-free in snd_seq_ioctl_create_port+0x504/0x630 [snd_seq] at addr ffff8801f2241cb1\n =============================================================================\n BUG kmalloc-512 (Tainted: G    B          ): kasan: bad access detected\n -----------------------------------------------------------------------------\n INFO: Allocated in snd_seq_create_port+0x94/0x9b0 [snd_seq] age=1 cpu=3 pid=4511\n \t___slab_alloc+0x425/0x460\n \t__slab_alloc+0x20/0x40\n  \tkmem_cache_alloc_trace+0x150/0x190\n\tsnd_seq_create_port+0x94/0x9b0 [snd_seq]\n\tsnd_seq_ioctl_create_port+0xd1/0x630 [snd_seq]\n \tsnd_seq_do_ioctl+0x11c/0x190 [snd_seq]\n \tsnd_seq_ioctl+0x40/0x80 [snd_seq]\n \tdo_vfs_ioctl+0x54b/0xda0\n \tSyS_ioctl+0x79/0x90\n \tentry_SYSCALL_64_fastpath+0x16/0x75\n INFO: Freed in port_delete+0x136/0x1a0 [snd_seq] age=1 cpu=2 pid=4717\n \t__slab_free+0x204/0x310\n \tkfree+0x15f/0x180\n \tport_delete+0x136/0x1a0 [snd_seq]\n \tsnd_seq_delete_port+0x235/0x350 [snd_seq]\n \tsnd_seq_ioctl_delete_port+0xc8/0x180 [snd_seq]\n \tsnd_seq_do_ioctl+0x11c/0x190 [snd_seq]\n \tsnd_seq_ioctl+0x40/0x80 [snd_seq]\n \tdo_vfs_ioctl+0x54b/0xda0\n \tSyS_ioctl+0x79/0x90\n \tentry_SYSCALL_64_fastpath+0x16/0x75\n Call Trace:\n  [<ffffffff81b03781>] dump_stack+0x63/0x82\n  [<ffffffff81531b3b>] print_trailer+0xfb/0x160\n  [<ffffffff81536db4>] object_err+0x34/0x40\n  [<ffffffff815392d3>] kasan_report.part.2+0x223/0x520\n  [<ffffffffa07aadf4>] ? snd_seq_ioctl_create_port+0x504/0x630 [snd_seq]\n  [<ffffffff815395fe>] __asan_report_load1_noabort+0x2e/0x30\n  [<ffffffffa07aadf4>] snd_seq_ioctl_create_port+0x504/0x630 [snd_seq]\n  [<ffffffffa07aa8f0>] ? snd_seq_ioctl_delete_port+0x180/0x180 [snd_seq]\n  [<ffffffff8136be50>] ? taskstats_exit+0xbc0/0xbc0\n  [<ffffffffa07abc5c>] snd_seq_do_ioctl+0x11c/0x190 [snd_seq]\n  [<ffffffffa07abd10>] snd_seq_ioctl+0x40/0x80 [snd_seq]\n  [<ffffffff8136d433>] ? acct_account_cputime+0x63/0x80\n  [<ffffffff815b515b>] do_vfs_ioctl+0x54b/0xda0\n  .....\n\nWe may fix this in a few different ways, and in this patch, it's fixed\nsimply by taking the refcount properly at snd_seq_create_port() and\nletting the caller unref the object after use.  Also, there is another\npotential use-after-free by sprintf() call in snd_seq_create_port(),\nand this is moved inside the lock.\n\nThis fix covers CVE-2017-15265.\n\nChange-Id: Ie430b35a73063929d037d93b777901f223fc4b5b\nGit-commit: 23709ae9b61429502fcd4686e7a97333f3b3544a\nGit-repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git\nReported-and-tested-by: Michael23 Yu <ycqzsy@gmail.com>\nSuggested-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/10ab8293da3849b14e5efb4a0fc83f24aa73eade"},{"sha":"b68f2a9039dee58229778a01f1521b3fc696b529","author":{"name":"Daniel Rosenberg","email":"ba8cfe5d21fcfdde5eed8cabcaff0549d9612a2a@google.com"},"message":"ANDROID: sound: rawmidi: Hold lock around realloc\n\nThe SNDRV_RAWMIDI_STREAM_{OUTPUT,INPUT} ioctls may reallocate\nruntime->buffer while other kernel threads are accessing it.  If the\nunderlying krealloc() call frees the original buffer, then this can turn\ninto a use-after-free.\n\nMost of these accesses happen while the thread is holding runtime->lock,\nand can be fixed by just holding the same lock while replacing\nruntime->buffer, however we can't hold this spinlock while\nsnd_rawmidi_kernel_{read1,write1} are copying to/from userspace.  We\nneed to add and acquire a new mutex to prevent this from happening\nconcurrently with reallocation.  We hold this mutex during the entire\nreallocation process, to also prevent multiple concurrent reallocations\nleading to a double-free.\n\nSigned-off-by: Daniel Rosenberg <drosen@google.com>\nbug: 64315347\nChange-Id: I05764d4f1a38f373eb7c0ac1c98607ee5ff0eded\n[dcagle@codeaurora.org: Resolve trivial merge conflict]\nGit-repo: https://android.googlesource.com/kernel/msm\nGit-commit: d7193540482d11ff0ad3a07fc18717811641c6eb\nSigned-off-by: Dennis Cagle <dcagle@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/b68f2a9039dee58229778a01f1521b3fc696b529"},{"sha":"d421a9bb541913b513e99ee08838b83909b7b86f","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"power: qpnp-smbcharger: Report charger types in REAL_TYPE property\"","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/d421a9bb541913b513e99ee08838b83909b7b86f"},{"sha":"ab670d35874696c5cfae76b8e3f4ec69c3fd29d5","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"ALSA: seq: Fix use-after-free at creating a port\"","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/ab670d35874696c5cfae76b8e3f4ec69c3fd29d5"},{"sha":"4659914851fea237ab294554a52d8294c3364b24","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"ANDROID: sound: rawmidi: Hold lock around realloc\"","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/4659914851fea237ab294554a52d8294c3364b24"},{"sha":"b7d21b00e701a1f7a33bce20dcbd72e42ae6d7a1","author":{"name":"Linux Build Service Account","email":"2384cb4e42a14e5d91b44a81612a69803086d401@localhost"},"message":"Merge \"ANDROID: qtaguid: Fix the UAF probelm with tag_ref_tree\"","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/b7d21b00e701a1f7a33bce20dcbd72e42ae6d7a1"},{"sha":"d19b1e6936917448aaa9616272497c8c8aff7012","author":{"name":"Ghanim Fodi","email":"53432ca6c36875fe62c204f44969e75fcbf314f6@codeaurora.org"},"message":"msm: ipa: Prevent deletion of the default route rule\n\nThe first APPS default routing table rule is installed\nat the IPA driver initialization. To prevent routing\nexception, this rule cannot be deleted by user application.\nThis change prevents deleting this rule.\n\nChange-Id: Ia27434fd24a15fea5956018a1271b11bbe227df7\nCRs-fixed: 2165859\nSigned-off-by: Ghanim Fodi <gfodi@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Zephoro/radiumkernel_oreo/commits/d19b1e6936917448aaa9616272497c8c8aff7012"}]}
{"actor":{"display_login":"Zephoro"}}