{"push_id":2738291162,"size":11,"distinct_size":11,"ref":"refs/heads/lineage-15.1","head":"776c804552d8b82dcb90a63be312d3198a76499f","before":"2026b7e1a6eb6e1e576430002c96be9af80371f3","commits":[{"sha":"d91199d777e405910f1476c09194cb306b948f6e","author":{"name":"Jerry Zhang","email":"197e2d05aab4646f19868e9232aea398cb9a923b@google.com"},"message":"ANDROID: usb: gadget: f_mtp: Return error if count is negative\n\nIf the user passes in a negative file size in a int64,\nthis will compare to be smaller than buffer length,\nand it will get truncated to form a read length that\nis larger than the buffer length.\n\nTo fix, return -EINVAL if the count argument is negative,\nso the loop will never happen.\n\nBug: 37429972\nTest: Test with PoC\nChange-Id: I5d52e38e6fbe2c17eb8c493f9eb81df6cfd780a4\nSigned-off-by: Jerry Zhang <zhangjerry@google.com>","distinct":true,"url":"https://api.github.com/repos/AdrianDC/android_kernel_sony_msm8x60/commits/d91199d777e405910f1476c09194cb306b948f6e"},{"sha":"5ce418bae62e75a31a35c3b5132b12759e4d4a42","author":{"name":"Steven Rostedt (Red Hat)","email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org"},"message":"UPSTREAM: tracing: Fix trace_printk() to print when not using bprintk()\n\nThe trace_printk() code will allocate extra buffers if the compile detects\nthat a trace_printk() is used. To do this, the format of the trace_printk()\nis saved to the __trace_printk_fmt section, and if that section is bigger\nthan zero, the buffers are allocated (along with a message that this has\nhappened).\n\nIf trace_printk() uses a format that is not a constant, and thus something\nnot guaranteed to be around when the print happens, the compiler optimizes\nthe fmt out, as it is not used, and the __trace_printk_fmt section is not\nfilled. This means the kernel will not allocate the special buffers needed\nfor the trace_printk() and the trace_printk() will not write anything to the\ntracing buffer.\n\nAdding a \"__used\" to the variable in the __trace_printk_fmt section will\nkeep it around, even though it is set to NULL. This will keep the string\nfrom being printed in the debugfs/tracing/printk_formats section as it is\nnot needed.\n\nReported-by: Vlastimil Babka <vbabka@suse.cz>\nFixes: 07d777fe8c398 \"tracing: Add percpu buffers for trace_printk()\"\nCc: stable@vger.kernel.org # v3.5+\nBug: 34277115\nSigned-off-by: Steven Rostedt <rostedt@goodmis.org>\nChange-Id: I10ce56caa41c7644d9d290d9ed272a6d156c938c","distinct":true,"url":"https://api.github.com/repos/AdrianDC/android_kernel_sony_msm8x60/commits/5ce418bae62e75a31a35c3b5132b12759e4d4a42"},{"sha":"0dd39c92f15d408346ca0329d1d3427520d08e7e","author":{"name":"Nick Desaulniers","email":"00198f13417fb2e066da5908d444d839551c0414@google.com"},"message":"tracing: do not leak kernel addresses\n\nThis likely breaks tracing tools like trace-cmd.  It logs in the same\nformat but now addresses are all 0x0.\n\nBug: 34277115\nChange-Id: Ifb0d4d2a184bf0d95726de05b1acee0287a375d9","distinct":true,"url":"https://api.github.com/repos/AdrianDC/android_kernel_sony_msm8x60/commits/0dd39c92f15d408346ca0329d1d3427520d08e7e"},{"sha":"459a2fa94277fe0b5b39bde38f7c9ee442265259","author":{"name":"kunleiz","email":"c711bd7816f421f5ad4d9d64c2a2bdfeede2130a@codeaurora.org"},"message":"ASoC: msm: qdspv2: add result check when audio process fail\n\nA audio_process_event_req is not always to success. Therefore,\ncheck the return value for audio_process_event_req, and\ninitializ usr_evt before using it.\n\nCRs-Fixed: 2029798\nBug: 35764875\nChange-Id: I4adf682575f5f9233a1a1a533f9c6361af8a5bcf\nSigned-off-by: kunleiz <kunleiz@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/AdrianDC/android_kernel_sony_msm8x60/commits/459a2fa94277fe0b5b39bde38f7c9ee442265259"},{"sha":"3b20adae08180f58bab2b3c7bc6bc2ee0759d72c","author":{"name":"Robb Glasser","email":"9ecc576b8388c8171b9eb7e0233e0f449288d4a9@google.com"},"message":"ALSA: pcm: prevent UAF in snd_pcm_info\n\nWhen the device descriptor is closed, the `substream->runtime` pointer\nis freed. But another thread may be in the ioctl handler, case\nSNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which\ncalls snd_pcm_info() which accesses the now freed `substream->runtime`.\n\nBug: 36006981\nSigned-off-by: Robb Glasser <rglasser@google.com>\nSigned-off-by: Nick Desaulniers <ndesaulniers@google.com>\nChange-Id: I445d24bc21dc0af6d9522a8daabe64969042236a","distinct":true,"url":"https://api.github.com/repos/AdrianDC/android_kernel_sony_msm8x60/commits/3b20adae08180f58bab2b3c7bc6bc2ee0759d72c"},{"sha":"90d38f708b7db3ce20218b8f44385b2e32aa0ecd","author":{"name":"Jianqiang Zhao","email":"fdb54448506a52884e0b08116be9a553f45b31cf@gmail.com"},"message":"ANDROID: input: keychord: fix race condition bug\n\nChange-Id: I9c7c759c99e21cad9a7f9a09128122bf6ae11302\nSigned-off-by: Jianqiang Zhao <zhaojianqiang1@gmail.com>\nBug: 36006779","distinct":true,"url":"https://api.github.com/repos/AdrianDC/android_kernel_sony_msm8x60/commits/90d38f708b7db3ce20218b8f44385b2e32aa0ecd"},{"sha":"614a3bb93723a32a6fd73724bc494ad77e881d9d","author":{"name":"Mohit Aggarwal","email":"737cf11f75b3d20108609115774263d19d6cdb46@codeaurora.org"},"message":"diag: Synchronize command registration table access\n\nCurrently, command registration table is being read\nin debugfs without any protection which may lead to\naccess of stale entries. The patch takes care of the\nissue by adding proper protection.\n\nCRs-Fixed: 2032672\nBug: 63868628\nChange-Id: I6ae058c16873f9ed52ae6516a1a70fd6d2d0da80\nSigned-off-by: Mohit Aggarwal <maggarwa@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/AdrianDC/android_kernel_sony_msm8x60/commits/614a3bb93723a32a6fd73724bc494ad77e881d9d"},{"sha":"9ec8962de97d5b8fb69d0ef43dda7b9244a2af2e","author":{"name":"Willem de Bruijn","email":"1ee125182537a91f90180f97fc3b3cb011bdf78a@google.com"},"message":"packet: fix tp_reserve race in packet_set_ring\n\n[ Upstream commit c27927e372f0785f3303e8fad94b85945e2c97b7 ]\n\nUpdates to tp_reserve can race with reads of the field in\npacket_set_ring. Avoid this by holding the socket lock during\nupdates in setsockopt PACKET_RESERVE.\n\nThis bug was discovered by syzkaller.\n\nChange-Id: I557aa47ec38ae72bc6e5f48086a161784ab3171a\nGit-commit: 63364a508d24944abb0975bd823cb11367c56283\nGit-repo: https://android.googlesource.com/kernel/msm\nFixes: 8913336a7e8d (\"packet: add PACKET_RESERVE sockopt\")\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: Willem de Bruijn <willemb@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Chennuru Rajeshwar Reddy <rchenn@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/AdrianDC/android_kernel_sony_msm8x60/commits/9ec8962de97d5b8fb69d0ef43dda7b9244a2af2e"},{"sha":"38a5fab5a93814b0445e81e2c64d68aad8b28686","author":{"name":"Xin Long","email":"ed9bd6f22d2a1e0b1507d3ddc300dc248265d19a@gmail.com"},"message":"sctp: do not peel off an assoc from one netns to another one\n\nNow when peeling off an association to the sock in another netns, all\ntransports in this assoc are not to be rehashed and keep use the old\nkey in hashtable.\n\nAs a transport uses sk->net as the hash key to insert into hashtable,\nit would miss removing these transports from hashtable due to the new\nnetns when closing the sock and all transports are being freeed, then\nlater an use-after-free issue could be caused when looking up an asoc\nand dereferencing those transports.\n\nThis is a very old issue since very beginning, ChunYu found it with\nsyzkaller fuzz testing with this series:\n\n  socket$inet6_sctp()\n  bind$inet6()\n  sendto$inet6()\n  unshare(0x40000000)\n  getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST()\n  getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF()\n\nThis patch is to block this call when peeling one assoc off from one\nnetns to another one, so that the netns of all transport would not\ngo out-sync with the key in hashtable.\n\nNote that this patch didn't fix it by rehashing transports, as it's\ndifficult to handle the situation when the tuple is already in use\nin the new netns. Besides, no one would like to peel off one assoc\nto another netns, considering ipaddrs, ifaces, etc. are usually\ndifferent.\n\nReported-by: ChunYu Wang <chunwang@redhat.com>\nSigned-off-by: Xin Long <lucien.xin@gmail.com>\nAcked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>\nAcked-by: Neil Horman <nhorman@tuxdriver.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nCVE-2017-15115\nSigned-off-by: Kevin F. Haggerty <haggertk@lineageos.org>\n\nChange-Id: Ic4bee33fc4b0de04ef3c417e08c64c78ada809ce","distinct":true,"url":"https://api.github.com/repos/AdrianDC/android_kernel_sony_msm8x60/commits/38a5fab5a93814b0445e81e2c64d68aad8b28686"},{"sha":"24fdc7baf9830f6f06ed05aabd9e22f3e7809838","author":{"name":"Marissa Wall","email":"dfdd147e0d31ffa94f60174fe3bbdbabee0568c5@google.com"},"message":"BACKPORT: packet: in packet_do_bind, test fanout with bind_lock held\n\n[ Upstream commit 4971613c1639d8e5f102c4e797c3bf8f83a5a69e ]\n\nOnce a socket has po->fanout set, it remains a member of the group\nuntil it is destroyed. The prot_hook must be constant and identical\nacross sockets in the group.\n\nIf fanout_add races with packet_do_bind between the test of po->fanout\nand taking the lock, the bind call may make type or dev inconsistent\nwith that of the fanout group.\n\nHold po->bind_lock when testing po->fanout to avoid this race.\n\nI had to introduce artificial delay (local_bh_enable) to actually\nobserve the race.\n\nBug: 69160446\nFixes: dc99f600698d (\"packet: Add fanout support.\")\nChange-Id: I899f9b6bcbd1d4b033388ef22c472857574bfc30\nSigned-off-by: Willem de Bruijn <willemb@google.com>\nReviewed-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Marissa Wall <marissaw@google.com>\nSigned-off-by: Siqi Lin <siqilin@google.com>","distinct":true,"url":"https://api.github.com/repos/AdrianDC/android_kernel_sony_msm8x60/commits/24fdc7baf9830f6f06ed05aabd9e22f3e7809838"},{"sha":"776c804552d8b82dcb90a63be312d3198a76499f","author":{"name":"Ben Hutchings","email":"73675debcd8a436be48ec22211dcf44fe0df0a64@decadent.org.uk"},"message":"ipsec: Fix aborted xfrm policy dump crash\n\ncommit 1137b5e2529a8f5ca8ee709288ecba3e68044df2 upstream.\n\nThis is a fix for CVE-2017-16939 suitable for older stable branches.\nThe upstream fix is commit 1137b5e2529a8f5ca8ee709288ecba3e68044df2,\nfrom which the following explanation is taken:\n\n    An independent security researcher, Mohamed Ghannam, has reported\n    this vulnerability to Beyond Security's SecuriTeam Secure Disclosure\n    program.\n\n    The xfrm_dump_policy_done function expects xfrm_dump_policy to\n    have been called at least once or it will crash.  This can be\n    triggered if a dump fails because the target socket's receive\n    buffer is full.\n\nIt was not possible to define a 'start' callback for netlink dumps\nuntil Linux 4.5, so instead add a check for the initialisation flag in\nthe 'done' callback.\n\nChange-Id: Id8a129889b11800178c37374ff9fee5af68ccff9\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/AdrianDC/android_kernel_sony_msm8x60/commits/776c804552d8b82dcb90a63be312d3198a76499f"}]}
{"actor":{"display_login":"AdrianDC"}}