{"push_id":2668298320,"size":174,"distinct_size":174,"ref":"refs/heads/nougat-mr2","head":"f67547d01b3b6162b307ea004e24072a668164bb","before":"f63cca14386d1aa97261134de42ec74eca678457","commits":[{"sha":"aed2b24b339676b269d3fcfdda005790a4454609","author":{"name":"Andrew Chant","email":"a416ae3c2187a33b5cbc589c826e72eb7a23c996@google.com"},"message":"input: synaptics_dsx: valid bounds of intr_reg_num\n\nValidate the intr_reg_num value returned by touchscreen\nto ensure no out of bounds access can occur.\n\nBug: 35472278\nChange-Id: If98e7091bf938061ac1b473ec652a620f118dbf0\nSigned-off-by: Andrew Chant <achant@google.com>","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/aed2b24b339676b269d3fcfdda005790a4454609"},{"sha":"bfce7bc0529fef1d23b870ae646f3cda5cb4d80f","author":{"name":"Rashi Bindra","email":"74327777b3b89493c4273e66d147348728525902@codeaurora.org"},"message":"ARM: dts: msm: Add support for FHD+ Video mode panel on msm8953\n\nAdd changes to add panel init sequence, on/off commands and other\npanel properties for FHD+ Video Mode Panel.\n\nChange-Id: Icb72bc4c9300a753de741155cb292d7b5a5f9325\nSigned-off-by: Rashi Bindra <rbindra@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/bfce7bc0529fef1d23b870ae646f3cda5cb4d80f"},{"sha":"9f35e4f41cb3d4958b0f2393e36cff2a6dcc1f81","author":{"name":"Michael Adisumarta","email":"0c8b28c5ace03f018b542cc8d8360f4aa0434b23@codeaurora.org"},"message":"msm: ipa: dynamic memory leak fix\n\nThis is a fix for dynamic memory leak seen with incorrectly\nallocating memory of a different size than with intended\nsize.\n\nChange-Id: I821442ee6728ea90ceab7644e194f4e06369333a\nAcked-by: Jyothi Jayanthi <jyothij@qti.qualcomm.com>\nSigned-off-by: Michael Adisumarta <madisuma@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/9f35e4f41cb3d4958b0f2393e36cff2a6dcc1f81"},{"sha":"761028f21c7ca81dc0ee0e1d8395d668beba4b52","author":{"name":"Daniel Rosenberg","email":"b28fe47f344ea47a742972f6caa7ef1537d21708@google.com"},"message":"ANDROID: ion: Fix uninitialized variable\n\nFix an uninitialized variable in user_ion_handle_put_nolock.\n\nBug: 34276203\n\nChange-Id: Ia634b790661089ad01aca8e5975984435463d148\nGit-commit: f39208009937c45a5f1b74e36bcccc78b517933a\nSigned-off-by: Daniel Rosenberg <drosen@google.com>\nSigned-off-by: Dennis Cagle <d-cagle@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/761028f21c7ca81dc0ee0e1d8395d668beba4b52"},{"sha":"e15f66a9d7ff65ad62407857aab4fac8132d06bd","author":{"name":"Al Viro","email":"de609eb4d5d70b1d38ec6642adbfc33a2781f63c@zeniv.linux.org.uk"},"message":"dentry name snapshots\n\ntake_dentry_name_snapshot() takes a safe snapshot of dentry name;\nif the name is a short one, it gets copied into caller-supplied\nstructure, otherwise an extra reference to external name is grabbed\n(those are never modified). In either case the pointer to stable\nstring is stored into the same structure.\n\ndentry must be held by the caller of take_dentry_name_snapshot(),\nbut may be freely dropped afterwards - the snapshot will stay\nuntil destroyed by release_dentry_name_snapshot().\n\nIntended use:\n\tstruct name_snapshot s;\n\n\ttake_dentry_name_snapshot(&s, dentry);\n\t...\n\taccess s.name\n\t...\n\trelease_dentry_name_snapshot(&s);\n\nReplaces fsnotify_oldname_...(), gets used in fsnotify to obtain the name\nto pass down with event.\n\nChange-Id: Id5068d1b405a87794ca58a64a83f86696b313523\nGit-commit: 49d31c2f389acfe83417083e1208422b4091cd9\nGit-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>\nSigned-off-by: Kishor PK <kpbhat@codeaurora.org>\n(cherry picked from commit 3c9248d714c4782338ad1fc8789858d6738ba401)","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/e15f66a9d7ff65ad62407857aab4fac8132d06bd"},{"sha":"6b7979ea7a6b37fb5a9c64a42e3dd6ad7c8b61ed","author":{"name":"Xiaoyu Ye","email":"bd4cc91f45fbb3c286a5cd4d3845a9caca4fd834@codeaurora.org"},"message":"ASoC: wcd_cpe_core: add size check for WDSP ELF files\n\nAdd size check to make sure the data sizes from WDSP\nELF metadata and the split firmware ELF are the same.\n\nChange-Id: Ic2f7dc04dfc95608302cba23461c519378619db0\nSigned-off-by: Xiaoyu Ye <benyxy@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/6b7979ea7a6b37fb5a9c64a42e3dd6ad7c8b61ed"},{"sha":"2f9522c439efdd379c0c7fdd3bb900f5f3d88678","author":{"name":"Vijayavardhan Vennapusa","email":"76e30dc6511df6537bc8f74ebde59f1a6034d162@codeaurora.org"},"message":"dwc3: debugfs: Add check for length before copy data from userspace\n\nAdd boundary check before copying data from userspace buffer to dwc3\nlocal buffer. The third parameter passed to copy_from_user() should be\nminimum of the two values between userpsace buffer size count and\n(local_buffer size - 1). The last one byte in local_buffer should be\nreserved for null terminator.\n\nChange-Id: I9b2e3db4d5ad6b5f14515cadafa6264f9e8b786c\nSigned-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/2f9522c439efdd379c0c7fdd3bb900f5f3d88678"},{"sha":"a5c3ace441c99e8abcaa8fc40d7f0a6549b0fb3b","author":{"name":"Mayank Rana","email":"c0579117a9883a806771b33bfb04b3440dbd27bf@codeaurora.org"},"message":"usb: f_gsi: Use required RNDIS IAD descriptors with full speed descriptors\n\ngsi_eth_fs_function is array of pointers to set of RNDIS interface\nrelated descriptors. gsi_eth_fs_function's first descriptor is\npointing itself instead of required RNDIS IAD descriptor. This\nresults into out-of-bound read access while copying these set of\ndescriptors with usb_copy_descriptors() API. Fix this issue by\nusing required RNDIS IAD descriptor here.\n\nChange-Id: Ic604221febc43eb8a22d8de99fb8cead74e13b41\nSigned-off-by: Mayank Rana <mrana@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/a5c3ace441c99e8abcaa8fc40d7f0a6549b0fb3b"},{"sha":"a3f49d49bf1a91961b797faad2c84702cc35965d","author":{"name":"Sudarshan Rajagopalan","email":"aa548738f8059d4f79d1db035ed9886edaa032ef@codeaurora.org"},"message":"ashmem: add mutex to set size ioctl\n\nThe ioctl of ashmem is an unlocked method, hence each of its command\nfunctions must have its own locking. Since asma->size is used at different\ncritical sections, it must remain unchanged until the end of the critical\nsection that is being executed.\n\nChange-Id: I804604667a25976334c174ba33601bed35df3755\nSigned-off-by: Sudarshan Rajagopalan <sudaraja@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/a3f49d49bf1a91961b797faad2c84702cc35965d"},{"sha":"cb599c74b8ab9d83bbd21c9b4e2930f3691d19a4","author":{"name":"Linus Torvalds","email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org"},"message":"Sanitize 'move_pages()' permission checks\n\ncommit 197e7e521384a23b9e585178f3f11c9fa08274b9 upstream.\n\nThe 'move_paghes()' system call was introduced long long ago with the\nsame permission checks as for sending a signal (except using\nCAP_SYS_NICE instead of CAP_SYS_KILL for the overriding capability).\n\nThat turns out to not be a great choice - while the system call really\nonly moves physical page allocations around (and you need other\ncapabilities to do a lot of it), you can check the return value to map\nout some the virtual address choices and defeat ASLR of a binary that\nstill shares your uid.\n\nSo change the access checks to the more common 'ptrace_may_access()'\nmodel instead.\n\nThis tightens the access checks for the uid, and also effectively\nchanges the CAP_SYS_NICE check to CAP_SYS_PTRACE, but it's unlikely that\nanybody really _uses_ this legacy system call any more (we hav ebetter\nNUMA placement models these days), so I expect nobody to notice.\n\nFamous last words.\n\nChange-Id: Id36c585bebfe03ede374af497471d212f0eafece\nGit-commit: 197e7e521384a23b9e585178f3f11c9fa08274b9\nReported-by: Otto Ebeling <otto.ebeling@iki.fi>\nAcked-by: Eric W. Biederman <ebiederm@xmission.com>\n\tCc: Willy Tarreau <w@1wt.eu>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Kishor PK <kpbhat@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/cb599c74b8ab9d83bbd21c9b4e2930f3691d19a4"},{"sha":"d2417c0241513477d5e45fa455841992dc749997","author":{"name":"Herbert Xu","email":"ef65de1c7be0aa837fe7b25ba9a7739905af6a55@gondor.apana.org.au"},"message":"crypto: algif_skcipher - Load TX SG list after waiting\n\nWe need to load the TX SG list in sendmsg(2) after waiting for\nincoming data, not before.\n\nconnoro@google.com: backport to 3.18,where the relevant logic is\nlocated in skcipher_recvmsg() rather than skcipher_recvmsg_sync()\n\nChange-Id: I4e18b385fe50c844cd62a2eb20122036ea4dfe09\nGit-commit: 36c84b22ac8aa041cbdfbe48a55ebb32e3521704\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Connor O'Brien <connoro@google.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Kishor PK <kpbhat@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/d2417c0241513477d5e45fa455841992dc749997"},{"sha":"19d5a14c4fd33103d96377ac0a8f1762e796f383","author":{"name":"Mohammed Javid","email":"2b7eec3af960ef4273dd3b88330f3f3064fd7247@codeaurora.org"},"message":"msm: ipa: dynamic memory leak fix\n\nThis is a fix for dynamic memory leak seen with incorrectly\nallocating memory of a different size than with intended\nsize.\n\nChange-Id: I350719dadad9fd5c7f35a334e81c8d9f2298f888\nAcked-by: Jyothi Jayanthi <jyothij@qti.qualcomm.com>\nAcked-by: Ashok Vuyyuru <avuyyuru@qti.qualcomm.com>\nSigned-off-by: Michael Adisumarta <madisuma@codeaurora.org>\nSigned-off-by: Mohammed Javid <mjavid@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/19d5a14c4fd33103d96377ac0a8f1762e796f383"},{"sha":"c6841d29b9be9c7bbde6e7968e2f131d3431d3de","author":{"name":"Mohammed Javid","email":"2b7eec3af960ef4273dd3b88330f3f3064fd7247@codeaurora.org"},"message":"msm: ipa: Fix to unsigned integer underflow\n\nAdded code changes to fix the unsigned integer underflow\nleads to accessing unmapped memory.\n\nChange-Id: I8148aebd3597ec6ae8c184199afe816f3d80636e\nAcked-by: Ashok Vuyyuru <avuyyuru@qti.qualcomm.com>\nSigned-off-by: Mohammed Javid <mjavid@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/c6841d29b9be9c7bbde6e7968e2f131d3431d3de"},{"sha":"98e29bc3f95e3c7484f24dedce37696f47297173","author":{"name":"Meng Wang","email":"34e2ec70b176ebd61c5c1381eefc007b50021aa3@codeaurora.org"},"message":"ASoC: msm: qdspv2: add spin lock to protect ac\n\nac could get freed during the execution of q6asm_callback.\nAnd kernel panic happens. Add spinlock to protect ac to avoid\nkernel panic.\n\nChange-Id: Ie49c8a3979231552ba7d5f207aab0d95ffdc2a72\nSigned-off-by: Meng Wang <mwang@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/98e29bc3f95e3c7484f24dedce37696f47297173"},{"sha":"541ed7772ba64d6e821d42f0243dcb926059280f","author":{"name":"Haibin Liu","email":"c003eb6ad2720d82257d79d7ef119d634381496e@codeaurora.org"},"message":"msm: sensor: actuator: fix out of bound read for region params\n\nIssue:\nthe region index is not validated against the region size.\nthis cause out-of-bound read on the KASAN kernel.\n\nFix:\nAdd restriction that region index smaller than region size.\n\nCRs-Fixed: 2153841\nChange-Id: I141bba45662769f0661c947fb642c2671578f32e\nSigned-off-by: Haibin Liu <haibinl@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/541ed7772ba64d6e821d42f0243dcb926059280f"},{"sha":"113eaf7550b38966c769105081b5ab67a4c61ca4","author":{"name":"smanag","email":"186e7356f934358edb5f6b05018df524a47f0599@codeaurora.org"},"message":"drivers: soc: Synchronize apr callback and voice svc release\n\nIssue is seen when apr callback is received while voice_svc_release\nis in process of freeing the driver private data.\nAvoid invalid access of private data pointer by putting\nthe callback and release functions in the same locked context.\n\nChange-Id: I93af13cab0a3c7e653a9bc9fa7f4f86bfa0502df\nSigned-off-by: smanag <smanag@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/113eaf7550b38966c769105081b5ab67a4c61ca4"},{"sha":"30e88b5ff62da8932bcfe8f4e85a15dd43c40f3d","author":{"name":"David Dai","email":"501c81517d628d2e07ccb24262fb2ff62e844a5c@codeaurora.org"},"message":"dev_freq: devfreq_spdm: add null terminator to prevent OOB access\n\nAdd null terminator to end of buffered copied from user to prevent\nover reading.\n\nChange-Id: I80cfcb087ea2c335fd65d8fcdaf372c7d34a533d\nSigned-off-by: David Dai <daidavid1@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/30e88b5ff62da8932bcfe8f4e85a15dd43c40f3d"},{"sha":"c125b6419471131c5f57a24a5db441e3087febcc","author":{"name":"Carter Cooper","email":"ff1e5ded47dd5c88716d0ac2f671fd3e0c0ebc6d@codeaurora.org"},"message":"msm: kgsl: Properly remove ref count on gpuobj_sync failure\n\nThe user can pass bad data into kgsl_ioctl_gpuobj_sync(). If\n_copy_from_user() fails do to bad data, undo any current\nreferences taken through this ioctl call.\n\nChange-Id: I56195520b9dadba20ee419658fc2cbb282b8449c\nSigned-off-by: Carter Cooper <ccooper@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/c125b6419471131c5f57a24a5db441e3087febcc"},{"sha":"99ff5c77b8429d32653e78a3e9e7f53fcbb73acd","author":{"name":"Sreelakshmi Gownipalli","email":"ca39c2cc03944f28ff9ea61882d0995994b72dbb@codeaurora.org"},"message":"diag: Protect the decrement of number of diag clients\n\nIn diagchar_open() protect the decrement of number of diag clients\nso that there will be no race conditions while reading the value\nfrom other functions.\n\nChange-Id: I0e2fb5331eec9c7bba39e7d881b69559256833a3\nSigned-off-by: Sreelakshmi Gownipalli <sgownipa@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/99ff5c77b8429d32653e78a3e9e7f53fcbb73acd"},{"sha":"025e172967b14df93ba6d2d9458c4b131a2e8d8a","author":{"name":"Sreelakshmi Gownipalli","email":"ca39c2cc03944f28ff9ea61882d0995994b72dbb@codeaurora.org"},"message":"diag: Add conditional check for len in dci_process_ctrl_status()\n\nAdd correct conditional check for len in dci_process_ctrl_status() to\nprevent buffer overflow.\n\nChange-Id: Id73ed1c8b104428eceef0544ce2858160cc08fd2\nSigned-off-by: Sreelakshmi Gownipalli <sgownipa@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/anonfbi/android_kernel_leeco_msm8996-1/commits/025e172967b14df93ba6d2d9458c4b131a2e8d8a"}]}
{"actor":{"display_login":"anonfbi"}}