{"push_id":3121683264,"size":43,"distinct_size":43,"ref":"refs/heads/fuck","head":"1d37832889964fa53248da6103abc36986b9e502","before":"54dfa4cc545ffd0a06cf91dfe3be8d7552339c7a","commits":[{"sha":"8e76284893fa0a9950af7de1276e29eb7c948f14","author":{"name":"Sultan Alsawaf","email":"3aa1af0b84637f6957d3e83d52f23fe513bfe974@gmail.com"},"message":"diag: Remove incorrect kfree in diag_debugfs_init error path\n\nThis kfree can only ever be invoked when dci_traffic is NULL (since that's\nwhat it's initialized to as a global variable), so remove it entirely.\nkfree rejects NULL pointers, so this was not a hazard.\n\nChange-Id: Ib9fad387d81772e97ff1ad4fe4b7e5d4cd7ad5ca\nSigned-off-by: Sultan Alsawaf <sultanxda@gmail.com>\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/8e76284893fa0a9950af7de1276e29eb7c948f14"},{"sha":"0de1f574f05b7e691db0e0440b11ef21c77fc08d","author":{"name":"Sultan Alsawaf","email":"3aa1af0b84637f6957d3e83d52f23fe513bfe974@gmail.com"},"message":"ASoC: core: Don't assign an out-of-bounds address to rtd_aux\n\nWhen card->num_aux_devs is zero, card->rtd_aux is assigned an out-of-bounds\naddress.\n\nThis was found by KASan at runtime:\n==================================================================\nBUG: KASAN: slab-out-of-bounds in msm_audrx_init+0xaa8/0xba4 at addr ffffffc14021ec18\nRead of size 8 by task kworker/u8:9/264\npage:ffffffbdc5008000 count:1 mapcount:0 mapping:          (null) index:0x0\nflags: 0x4000000000004000(head)\npage dumped because: kasan: bad access detected\nCPU: 3 PID: 264 Comm: kworker/u8:9 Tainted: G    B   W      3.18.31-Sultan #39\nHardware name: Qualcomm Technologies, Inc. MSM 8996 v3.0 + PMI8996 MTP (DT)\nWorkqueue: deferwq deferred_probe_work_func\nCall trace:\n[<ffffffc00008a7bc>] dump_backtrace+0x0/0x298\n[<ffffffc00008aa68>] show_stack+0x14/0x1c\n[<ffffffc000fa8134>] dump_stack+0x98/0xc0\n[<ffffffc0001b1a44>] kasan_report+0x3a4/0x4e8\n[<ffffffc0001b115c>] __asan_load8+0x24/0x7c\n[<ffffffc000cf47b4>] msm_audrx_init+0xaa8/0xba4\n[<ffffffc000c293f4>] snd_soc_register_card+0x10ac/0x1c04\n[<ffffffc000cf564c>] msm8996_asoc_machine_probe+0xd9c/0xf1c\n[<ffffffc000670a8c>] platform_drv_probe+0x50/0xa4\n[<ffffffc00066ecd4>] driver_probe_device+0x114/0x2e0\n[<ffffffc00066eee0>] __device_attach+0x40/0x64\n[<ffffffc00066cf20>] bus_for_each_drv+0xac/0xdc\n[<ffffffc00066f058>] device_attach+0x94/0xc0\n[<ffffffc00066d218>] bus_probe_device+0x48/0xf0\n[<ffffffc00066e53c>] deferred_probe_work_func+0xa0/0xd0\n[<ffffffc0000c229c>] process_one_work+0x324/0x50c\n[<ffffffc0000c2928>] worker_thread+0x4a4/0x624\n[<ffffffc0000c9808>] kthread+0x138/0x14c\nMemory state around the buggy address:\n ffffffc14021eb00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe\n ffffffc14021eb80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe\n >ffffffc14021ec00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe\n                             ^\n ffffffc14021ec80: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe\n ffffffc14021ed00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe\n==================================================================\n\nChange-Id: I3674d2984a762271cd94236e3565096128317f44\nSigned-off-by: Sultan Alsawaf <sultanxda@gmail.com>\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/0de1f574f05b7e691db0e0440b11ef21c77fc08d"},{"sha":"9e1e4ba46196ee5ed19f3eb928b16362e5f17276","author":{"name":"Jin Qian","email":"a4a9764687115057dfb6081f6c434bf20156ee3b@google.com"},"message":"ANDROID: ext4: don't put symlink in pagecache into highmem\n\nThis is a partial backport of 21fc61c73c3903c4c312d0802da01ec2b323d174.\n\next4_encrypted_follow_link uses kmap() for cpage\n  caddr = kmap(cpage);\n\n_ext4_fname_disk_to_usr calls virt_to_page on the kmapped address.\n  _ext4_fname_disk_to_usr()\n    ext4_fname_decrypt()\n      sg_init_one()\n        sg_init_one(&src_sg, iname->name, iname->len);\n          sg_set_page(sg, virt_to_page(buf), buflen, offset_in_page(buf));\n\nBug: 71602077\nChange-Id: If86e58dd6126dbe5dd6a234d7ffe71bb638a07cd\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Jin Qian <jinqian@google.com>\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/9e1e4ba46196ee5ed19f3eb928b16362e5f17276"},{"sha":"09ad942526f0dea16acf271c0438a93072982a3d","author":{"name":"Albert I","email":"7cf16edb3302849659d40dee85bb90fa0dabc5c1@outlook.co.id"},"message":"binder: Reset to Google's common kernel as per cfc6468d52f1\n\nChange-Id: I5bccb42ff3aa08f2590788a7530b41d916994383\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/09ad942526f0dea16acf271c0438a93072982a3d"},{"sha":"86378a6b7e1ae96b962f0f8c64ee2fb5618b68ef","author":{"name":"Sherry Yang","email":"36132a8a753457574e39a2c44a4b14a2782ad82e@android.com"},"message":"FROMLIST: android: binder: Drop lru lock in isolate callback\n\n(from https://patchwork.kernel.org/patch/9945123/)\n\nDrop the global lru lock in isolate callback\nbefore calling zap_page_range which calls\ncond_resched, and re-acquire the global lru\nlock before returning. Also change return\ncode to LRU_REMOVED_RETRY.\n\nUse mmput_async when fail to acquire mmap sem\nin an atomic context.\n\nFix \"BUG: sleeping function called from invalid context\"\nerrors when CONFIG_DEBUG_ATOMIC_SLEEP is enabled.\n\nBug: 63926541\nFixes: f2517eb76f1f2 (\"android: binder: Add global lru shrinker to binder\")\nChange-Id: Iacbacd26c0326e20baebe193551324859300f7f6\nReported-by: Kyle Yan <kyan@codeaurora.org>\nAcked-by: Arve Hjønnevåg <arve@android.com>\nSigned-off-by: Sherry Yang <sherryy@android.com>\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/86378a6b7e1ae96b962f0f8c64ee2fb5618b68ef"},{"sha":"ffbf39b2b9756ded9a9377d3faad00465ba41444","author":{"name":"Sherry Yang","email":"36132a8a753457574e39a2c44a4b14a2782ad82e@android.com"},"message":"FROMLIST: android: binder: Remove unused vma argument\n\n(from https://patchwork.kernel.org/patch/9954123/)\n\nThe vma argument in update_page_range is no longer\nused after 74310e06 (\"android: binder: Move buffer\nout of area shared with user space\"), since mmap_handler\nno longer calls update_page_range with a vma.\n\nTest: ran binderLibTest, throughputtest, interfacetest and mempressure\nBug: 36007193\nChange-Id: Ibd6f24c11750f8f7e6ed56e40dd18c08e02ace25\nAcked-by: Arve Hjønnevåg <arve@android.com>\nSigned-off-by: Sherry Yang <sherryy@android.com>\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/ffbf39b2b9756ded9a9377d3faad00465ba41444"},{"sha":"2de88b6d08f987e03aef810e50006195baa5d0a0","author":{"name":"Sherry Yang","email":"36132a8a753457574e39a2c44a4b14a2782ad82e@android.com"},"message":"FROMLIST: android: binder: Don't get mm from task\n\n(from https://patchwork.kernel.org/patch/9954125/)\n\nUse binder_alloc struct's mm_struct rather than getting\na reference to the mm struct through get_task_mm to\navoid a potential deadlock between lru lock, task lock and\ndentry lock, since a thread can be holding the task lock\nand the dentry lock while trying to acquire the lru lock.\n\nTest: ran binderLibTest, throughputtest, interfacetest and mempressure\nBug: 63926541\nChange-Id: Icc661404eb7a4a2ecc5234b1bf8f0104665f9b45\nAcked-by: Arve Hjønnevåg <arve@android.com>\nSigned-off-by: Sherry Yang <sherryy@android.com>\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/2de88b6d08f987e03aef810e50006195baa5d0a0"},{"sha":"c7f8e1bf19270f5d83d47b93d6ddabc9359428cd","author":{"name":"Todd Kjos","email":"8be399b0cc2f31b2ed16702a88343f61fd6797ee@google.com"},"message":"FROMLIST: binder: fix use-after-free in binder_transaction()\n\n(from https://patchwork.kernel.org/patch/9978801/)\n\nUser-space normally keeps the node alive when creating a transaction\nsince it has a reference to the target. The local strong ref keeps it\nalive if the sending process dies before the target process processes\nthe transaction. If the source process is malicious or has a reference\ncounting bug, this can fail.\n\nIn this case, when we attempt to decrement the node in the failure\npath, the node has already been freed.\n\nThis is fixed by taking a tmpref on the node while constructing\nthe transaction. To avoid re-acquiring the node lock and inner\nproc lock to increment the proc's tmpref, a helper is used that\ndoes the ref increments on both the node and proc.\n\nBug: 66899329\nChange-Id: Iad40e1e0bccee88234900494fb52a510a37fe8d7\nSigned-off-by: Todd Kjos <tkjos@google.com>\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/c7f8e1bf19270f5d83d47b93d6ddabc9359428cd"},{"sha":"8173f9b9ab92395153849748ea9eea0986e7c43a","author":{"name":"Martijn Coenen","email":"e2bfaa8b522ad2b3c4a1c86442cc7f7aa55b5234@google.com"},"message":"ANDROID: binder: Add tracing for binder priority inheritance.\n\nBug: 34461621\nChange-Id: I5ebb1c0c49fd42a89ee250a1d70221f767c82c7c\nSigned-off-by: Martijn Coenen <maco@google.com>\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/8173f9b9ab92395153849748ea9eea0986e7c43a"},{"sha":"030e961860f5ea94fa7c6685cac667aa267786a7","author":{"name":"Martijn Coenen","email":"e2bfaa8b522ad2b3c4a1c86442cc7f7aa55b5234@android.com"},"message":"ANDROID: binder: fix transaction leak.\n\nIf a call to put_user() fails, we failed to\nproperly free a transaction and send a failed\nreply (if necessary).\n\nBug: 63117588\nTest: binderLibTest\n\nChange-Id: Ia98db8cd82ce354a4cdc8811c969988d585c7e31\nSigned-off-by: Martijn Coenen <maco@android.com>\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/030e961860f5ea94fa7c6685cac667aa267786a7"},{"sha":"7256ce89eafae8632d51fa888ef274fc2a2eb76e","author":{"name":"Ganesh Mahendran","email":"6c55b1e1f53a3eae8a57c94118796a0d4fab02ed@gmail.com"},"message":"ANDROID: binder: init desired_prio.sched_policy before use it\n\nIn function binder_transaction_priority(), we access\ndesired_prio before initialzing it.\n\nThis patch fix this.\n\nChange-Id: I9d14d50f9a128010476a65b52631630899a44633\nSigned-off-by: Ganesh Mahendran <opensource.ganesh@gmail.com>\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/7256ce89eafae8632d51fa888ef274fc2a2eb76e"},{"sha":"2102a2ea1a5bbe1af17384d2db2d3f96a59a5233","author":{"name":"Ganesh Mahendran","email":"6c55b1e1f53a3eae8a57c94118796a0d4fab02ed@gmail.com"},"message":"ANDROID: binder: fix node sched policy calculation\n\nWe should use FLAT_BINDER_FLAG_SCHED_POLICY_MASK as\nthe mask to calculate sched policy.\n\nChange-Id: Ic252fd7c68495830690130d792802c02f99fc8fc\nSigned-off-by: Ganesh Mahendran <opensource.ganesh@gmail.com>\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/2102a2ea1a5bbe1af17384d2db2d3f96a59a5233"},{"sha":"8aa4e42ba7cd5235bf779c1535069fef93f99958","author":{"name":"Sherry Yang","email":"36132a8a753457574e39a2c44a4b14a2782ad82e@android.com"},"message":"FROMLIST: android: binder: Change binder_shrinker to static\n\n(from https://patchwork.kernel.org/patch/9990321/)\n\nbinder_shrinker struct is not used anywhere outside of\nbinder_alloc.c and should be static.\n\nBug: 63926541\nChange-Id: I7a13d4ddbaaf3721cddfe1d860e34c7be80dd082\nAcked-by: Arve Hjønnevåg <arve@android.com>\nSigned-off-by: Sherry Yang <sherryy@android.com>\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/8aa4e42ba7cd5235bf779c1535069fef93f99958"},{"sha":"c9e0479cd37287fa3a4149ba5dd644146d55821a","author":{"name":"Sherry Yang","email":"36132a8a753457574e39a2c44a4b14a2782ad82e@android.com"},"message":"FROMLIST: android: binder: Fix null ptr dereference in debug msg\n\n(from https://patchwork.kernel.org/patch/9990323/)\n\nDon't access next->data in kernel debug message when the\nnext buffer is null.\n\nBug: 36007193\nChange-Id: Ib8240d7e9a7087a2256e88c0ae84b9df0f2d0224\nAcked-by: Arve Hjønnevåg <arve@android.com>\nSigned-off-by: Sherry Yang <sherryy@android.com>\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/c9e0479cd37287fa3a4149ba5dd644146d55821a"},{"sha":"a3a4175d9545607531a352ee8349272456c3ce08","author":{"name":"Martijn Coenen","email":"e2bfaa8b522ad2b3c4a1c86442cc7f7aa55b5234@android.com"},"message":"ANDROID: binder: Add thread->process_todo flag.\n\nThis flag determines whether the thread should currently\nprocess the work in the thread->todo worklist.\n\nThe prime usecase for this is improving the performance\nof synchronous transactions: all synchronous transactions\npost a BR_TRANSACTION_COMPLETE to the calling thread,\nbut there's no reason to return that command to userspace\nright away - userspace anyway needs to wait for the reply.\n\nLikewise, a synchronous transaction that contains a binder\nobject can cause a BC_ACQUIRE/BC_INCREFS to be returned to\nuserspace; since the caller must anyway hold a strong/weak\nref for the duration of the call, postponing these commands\nuntil the reply comes in is not a problem.\n\nNote that this flag is not used to determine whether a\nthread can handle process work; a thread should never pick\nup process work when thread work is still pending.\n\nBefore patch:\n------------------------------------------------------------------\nBenchmark                           Time           CPU Iterations\n------------------------------------------------------------------\nBM_sendVec_binderize/4          45959 ns      20288 ns      34351\nBM_sendVec_binderize/8          45603 ns      20080 ns      34909\nBM_sendVec_binderize/16         45528 ns      20113 ns      34863\nBM_sendVec_binderize/32         45551 ns      20122 ns      34881\nBM_sendVec_binderize/64         45701 ns      20183 ns      34864\nBM_sendVec_binderize/128        45824 ns      20250 ns      34576\nBM_sendVec_binderize/256        45695 ns      20171 ns      34759\nBM_sendVec_binderize/512        45743 ns      20211 ns      34489\nBM_sendVec_binderize/1024       46169 ns      20430 ns      34081\n\nAfter patch:\n------------------------------------------------------------------\nBenchmark                           Time           CPU Iterations\n------------------------------------------------------------------\nBM_sendVec_binderize/4          42939 ns      17262 ns      40653\nBM_sendVec_binderize/8          42823 ns      17243 ns      40671\nBM_sendVec_binderize/16         42898 ns      17243 ns      40594\nBM_sendVec_binderize/32         42838 ns      17267 ns      40527\nBM_sendVec_binderize/64         42854 ns      17249 ns      40379\nBM_sendVec_binderize/128        42881 ns      17288 ns      40427\nBM_sendVec_binderize/256        42917 ns      17297 ns      40429\nBM_sendVec_binderize/512        43184 ns      17395 ns      40411\nBM_sendVec_binderize/1024       43119 ns      17357 ns      40432\n\nSigned-off-by: Martijn Coenen <maco@android.com>\n\nChange-Id: Ia70287066d62aba64e98ac44ff1214e37ca75693\n\nSigned-off-by: Albert I <krascgq@outlook.co.id>\n\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/a3a4175d9545607531a352ee8349272456c3ce08"},{"sha":"d15ef67efb316cd73ebcfbda6dcddb6028bf8d3b","author":{"name":"Martijn Coenen","email":"e2bfaa8b522ad2b3c4a1c86442cc7f7aa55b5234@android.com"},"message":"ANDROID: binder: show high watermark of alloc->pages.\n\nShow the high watermark of the index into the alloc->pages\narray, to facilitate sizing the buffer on a per-process\nbasis.\n\nChange-Id: I2b40cd16628e0ee45216c51dc9b3c5b0c862032e\nSigned-off-by: Martijn Coenen <maco@android.com>\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/d15ef67efb316cd73ebcfbda6dcddb6028bf8d3b"},{"sha":"9bb13be0ff70917c47d18e667c8e69597521a62c","author":{"name":"Martijn Coenen","email":"e2bfaa8b522ad2b3c4a1c86442cc7f7aa55b5234@android.com"},"message":"ANDROID: binder: clarify deferred thread work.\n\nRename the function to more accurately reflect what\nit does, and add a comment explaining why we use it.\n\nChange-Id: I8d011c017dfc6e24b5b54fc462578f8e153e5926\nSigned-off-by: Martijn Coenen <maco@android.com>\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/9bb13be0ff70917c47d18e667c8e69597521a62c"},{"sha":"482251305703d08540796657a93714c3a24efe23","author":{"name":"Martijn Coenen","email":"e2bfaa8b522ad2b3c4a1c86442cc7f7aa55b5234@google.com"},"message":"UPSTREAM: android: binder: fix type mismatch warning\n\nAllowing binder to expose the 64-bit API on 32-bit kernels caused a\nbuild warning:\n\ndrivers/android/binder.c: In function\n'binder_transaction_buffer_release':\ndrivers/android/binder.c:2220:15: error: cast to pointer from integer of\ndifferent size [-Werror=int-to-pointer-cast]\n    fd_array = (u32 *)(parent_buffer + fda->parent_offset);\n               ^\ndrivers/android/binder.c: In function 'binder_translate_fd_array':\ndrivers/android/binder.c:2445:13: error: cast to pointer from integer of\ndifferent size [-Werror=int-to-pointer-cast]\n  fd_array = (u32 *)(parent_buffer + fda->parent_offset);\n             ^\ndrivers/android/binder.c: In function 'binder_fixup_parent':\ndrivers/android/binder.c:2511:18: error: cast to pointer from integer of\ndifferent size [-Werror=int-to-pointer-cast]\n\nThis adds extra type casts to avoid the warning.\n\nHowever, there is another problem with the Kconfig option: turning\nit on or off creates two incompatible ABI versions, a kernel that\nhas this enabled cannot run user space that was built without it\nor vice versa. A better solution might be to leave the option hidden\nuntil the binder code is fixed to deal with both ABI versions.\n\nFixes: e8d2ed7db7c3 (\"Revert \"staging: Fix build issues with new binder\nAPI\"\")\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n(cherry picked from commit 1c363eaece2752c5f8b1b874cb4ae435de06aa66)\n\nChange-Id: Id09185a6f86905926699e92a2b30201b8a5e83e5\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/482251305703d08540796657a93714c3a24efe23"},{"sha":"ad25105e8fbda00b0f2229969115c55a65189b70","author":{"name":"Martijn Coenen","email":"e2bfaa8b522ad2b3c4a1c86442cc7f7aa55b5234@android.com"},"message":"ANDROID: binder: Remove obsolete proc waitqueue.\n\nIt was no longer being used.\n\nChange-Id: I7fc42b76f688a459ad990f59fbd7006b96bb91a6\nSigned-off-by: Martijn Coenen <maco@android.com>\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/ad25105e8fbda00b0f2229969115c55a65189b70"},{"sha":"0be695fe37e9bcc5cc6b6ec55a5fe76f1c6c0936","author":{"name":"Martijn Coenen","email":"e2bfaa8b522ad2b3c4a1c86442cc7f7aa55b5234@android.com"},"message":"UPSTREAM: ANDROID: binder: remove waitqueue when thread exits.\n\nbinder_poll() passes the thread->wait waitqueue that\ncan be slept on for work. When a thread that uses\nepoll explicitly exits using BINDER_THREAD_EXIT,\nthe waitqueue is freed, but it is never removed\nfrom the corresponding epoll data structure. When\nthe process subsequently exits, the epoll cleanup\ncode tries to access the waitlist, which results in\na use-after-free.\n\nPrevent this by using POLLFREE when the thread exits.\n\n(cherry picked from commit f5cb779ba16334b45ba8946d6bfa6d9834d1527f)\n\nChange-Id: Ib34b1cbb8ab2192d78c3d9956b2f963a66ecad2e\nSigned-off-by: Martijn Coenen <maco@android.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nCc: stable <stable@vger.kernel.org> # 4.14\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Albert I <krascgq@outlook.co.id>","distinct":true,"url":"https://api.github.com/repos/davidtrpcevski/android_kernel_xiaomi_msm8953/commits/0be695fe37e9bcc5cc6b6ec55a5fe76f1c6c0936"}]}
{"actor":{"display_login":"davidtrpcevski"}}