{"push_id":2550899218,"size":24,"distinct_size":1,"ref":"refs/heads/8.1.0-hardcore13","head":"4c5f6194697d26913469be603e62aa672aef0800","before":"515aa8887cd142c332f1fae2faaf1a2580157e60","commits":[{"sha":"a2f546c47087eea7f310828c1370fb8404aa8e71","author":{"name":"Siyuan Zhou","email":"acb1b78987d938b581f2c950dc0d46ddfc3af037@google.com"},"message":"Merge branch 'android-msm-bullhead-3.10' into android-msm-bullhead-3.10-security-next\n\nApril 2018.2\nBug: 74613955\n\nSigned-off-by: Siyuan Zhou <siyuanzhou@google.com>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/a2f546c47087eea7f310828c1370fb8404aa8e71"},{"sha":"5577a4f4583cf07f970bd8e40df913cc94ef9792","author":{"name":"hqu","email":"4bd3251ec3623605d04dfd615206b43356e6b7f9@codeaurora.org"},"message":"qcacld-2.0: Add mutex lock for proc handlers\n\nIt will have race condition issue when multiple\nthreads access some fields of global shared\nvariable ctl concurrently.\n\nFix is to add mutex lock for proc handlers.\n\nBug: 35470735\nChange-Id: Ifba428ae6544ccbdae0547a63972ab241ae68d7c\nCRs-Fixed: 2173232\nSigned-off-by: Ahmed ElArabawy <arabawy@google.com>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/5577a4f4583cf07f970bd8e40df913cc94ef9792"},{"sha":"e747b22fdc48a5a147864cbf4f8c95355bd4a0bd","author":{"name":"Haibin Liu","email":"c003eb6ad2720d82257d79d7ef119d634381496e@qti.qualcomm.com"},"message":"msm: sensor: actuator: avoid accessing out of bound memory\n\nIssue:\nWhen total_steps is updated, after that, copy_from_user\nfails with an error, then, i2c_reg_tbl is not allocated.\nIn this case, when calling msm_actuator_parse_i2c_params,\nit lead to out-of-bound memory write.\n\nFix:\n1) Assign total_steps to zero when error from copying.\n2) Add NULL pointer check for i2c tbl.\n\nCRs-Fixed: 2111672\nBug: 65122765\nChange-Id: Ib9dcb182356e2df8078c131edfd0791fa95a35e0\nSigned-off-by: Haibin Liu <haibinl@codeaurora.org>\nSigned-off-by: VijayaKumar T M <vtmuni@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/e747b22fdc48a5a147864cbf4f8c95355bd4a0bd"},{"sha":"3c12c8a121020116ccb16289a9a21da469681a7b","author":{"name":"Haibin Liu","email":"c003eb6ad2720d82257d79d7ef119d634381496e@codeaurora.org"},"message":"msm: sensor: actuator: check NULL pointer for actuator ctrl\n\nAdd NULL pointer checking for actuator ctrl.\n\nCRs-Fixed: 2152399\nBug: 65122765\nChange-Id: I2e206516e5ea1383c7396625455e1d7403df51cf\nSigned-off-by: Haibin Liu <haibinl@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/3c12c8a121020116ccb16289a9a21da469681a7b"},{"sha":"88130cb77f080b0a2779e25efd54d8d500c1161c","author":{"name":"Rajesh Bondugula","email":"59532d39ef436d420533e69095c106b6a8b3ecfe@codeaurora.org"},"message":"msm: camera: sensor: Validate destination step position\n\ndest_step_position is sent from userspace and is used in\nkernel to calculate the final DAC value.\ndest_step_position must be validated against total steps.\nActuator will have an unexpected behavior if lens value is\nprogramed to actuator based on invalid dest_step_position.\n\nCRs-Fixed: 1102580\nBug: 65122765\nChange-Id: Idcd97043d3bd583d8577233d446a99d1829a4ee6\nSigned-off-by: Rajesh Bondugula <rajeshb@codeaurora.org>\nSigned-off-by: VijayaKumar T M <vtmuni@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/88130cb77f080b0a2779e25efd54d8d500c1161c"},{"sha":"5339a138ca82cdb36921216bf258e4db69b068cb","author":{"name":"Haibin Liu","email":"c003eb6ad2720d82257d79d7ef119d634381496e@codeaurora.org"},"message":"msm: sensor: actuator: add null pointer check for i2c array\n\nIssue:\ni2c_reg_tbl may be null under error condition when set param.\nthen, other actuator function still may use the i2c_reg_tbl as null.\nFix:\n1) the assignment total_steps follow on kmalloc buffer.\n2) Add NULL pointer check for i2c tbl.\n\nCRs-Fixed: 2152401\nBug: 65122765\nChange-Id: Ieec3d88e6dae0177787da0906f53d59ac4f5a624\nSigned-off-by: Haibin Liu <haibinl@codeaurora.org>\nSigned-off-by: VijayaKumar T M <vtmuni@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/5339a138ca82cdb36921216bf258e4db69b068cb"},{"sha":"cb9cb79750eb2a7324476cdfa549482f65e9ce5f","author":{"name":"Haibin Liu","email":"c003eb6ad2720d82257d79d7ef119d634381496e@codeaurora.org"},"message":"msm: sensor: actuator: fix out of bound read for region params\n\nIssue:\nthe region index is not validated against the region size.\nthis cause out-of-bound read on the KASAN kernel.\n\nFix:\nAdd restriction that region index smaller than region size.\n\nCRs-Fixed: 2153841\nBug: 65122765\nChange-Id: I141bba45662769f0661c947fb642c2671578f32e\nSigned-off-by: Haibin Liu <haibinl@codeaurora.org>\nSigned-off-by: VijayaKumar T M <vtmuni@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/cb9cb79750eb2a7324476cdfa549482f65e9ce5f"},{"sha":"1b1e6586e98801a14021b6a6d5e62a19560e7a5a","author":{"name":"Dmitry Torokhov","email":"6b8646d310837fed93a129ed3c979b90c7f2674f@gmail.com"},"message":"Input: gtco - fix potential out-of-bound access\n\ncommit a50829479f58416a013a4ccca791336af3c584c7 upstream.\n\nparse_hid_report_descriptor() has a while (i < length) loop, which\nonly guarantees that there's at least 1 byte in the buffer, but the\nloop body can read multiple bytes which causes out-of-bounds access.\n\nBug: 69916367\nChange-Id: Ic6a2fda77685b90d7642c09b20f5d57d6d48b726\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nReviewed-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Siqi Lin <siqilin@google.com>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/1b1e6586e98801a14021b6a6d5e62a19560e7a5a"},{"sha":"f2b84d261b9c6700bd39d4f9d41ba058083ffe9f","author":{"name":"Benjamin Chan","email":"9d02e91494759a45db8e9239adcc094cc8cc249d@codeaurora.org"},"message":"msm: mdss: adjust mdss_mdp_get_plane_sizes parameters init order\n\nParameter mdss_mdp_plane_sizes must be cleared to 0 before returning\nunder an error condition, otherwise caller function will use the\nuninitialized mdss_mdp_plane_sizes values and caused incorrect\noperation.\n\nBug: 71501679\nChange-Id: I856b17ce9e917cc450040463ec34b7309d34b9b5\nSigned-off-by: Benjamin Chan <bkchan@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/f2b84d261b9c6700bd39d4f9d41ba058083ffe9f"},{"sha":"ecb5b41926490583367a6394570fa4e129f92f1e","author":{"name":"Marissa Wall","email":"dfdd147e0d31ffa94f60174fe3bbdbabee0568c5@google.com"},"message":"UPSTREAM: loop: fix concurrent lo_open/lo_release\n\n范龙飞 reports that KASAN can report a use-after-free in __lock_acquire.\nThe reason is due to insufficient serialization in lo_release(), which\nwill continue to use the loop device even after it has decremented the\nlo_refcnt to zero.\n\nIn the meantime, another process can come in, open the loop device\nagain as it is being shut down. Confusion ensues.\n\n(cherry-picked from ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5)\n\nBug: 72867809\nChange-Id: Iada5ceba515f0137db8c95d0746e8ffc753037f3\nReported-by: 范龙飞 <long7573@126.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Jens Axboe <axboe@kernel.dk>\nSigned-off-by: Marissa Wall <marissaw@google.com>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/ecb5b41926490583367a6394570fa4e129f92f1e"},{"sha":"9fc2e89218ce8b28b672232157ee19f6a9d48c41","author":{"name":"Abhinav Kumar","email":"9bdc05cb562779fe30fe795b37f1771483a247be@codeaurora.org"},"message":"qcacld-2.0: Fix buffer overwrite due to ssid_len in WMA handlers\n\nIn multiple WMA event handler functions, ssid_len is used to copy\nssid from FW buffer to local buffer and ssid_len value is received\nfrom the FW. If the ssid_len value exceeds SIR_MAC_MAX_SSID_LENGTH\nthen a buffer overwrite would occur.\nAdd sanity check for ssid_len against SIR_MAC_MAX_SSID_LENGTH in\nmultiple WMA handler functions\n\nBug: 72956801\nChange-Id: I9e4b1f88c275093b4912496cdb936cf54a8880a2\nCRs-Fixed: 2162678\nSigned-off-by: Ecco Park <eccopark@google.com>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/9fc2e89218ce8b28b672232157ee19f6a9d48c41"},{"sha":"bebb88bed62576c9225bc24ff6e67c90b012c855","author":{"name":"Odelu Kukatla","email":"e2c42005a0d0f922bed9a30a6ef7d23ddae2c90a@codeaurora.org"},"message":"msm: msm_bus: Add mutex lock for floor vote data\n\nFloor vote data needs to be protected with mutex lock to\navoid double free of memory due to race condtion.\n\nBug: 72956941\nChange-Id: Ifaa01a14d273ccba6b9463aff3a41c0038b05f06\nSigned-off-by: Odelu Kukatla <okukatla@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/bebb88bed62576c9225bc24ff6e67c90b012c855"},{"sha":"16b0e9d6a1785604b2ff3f8f155372526e743ae2","author":{"name":"Tanya Dixit","email":"d2693509892c3a1c06c079367e0813fa6e5344c2@codeaurora.org"},"message":"drivers: qdsp6v2: Add mutex unlock to properly release lock\n\nAdd mutex unlock in function audio_effects_shared_ioctl\nat appropriate place to prevent use after free.\n\nCRs-Fixed: 2123291\nBug: 72957040\nChange-Id: Ie0d321dc8cc20a295d102a44faea7e5710834932\nSigned-off-by: Tanya Dixit <tdixit@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/16b0e9d6a1785604b2ff3f8f155372526e743ae2"},{"sha":"1ad8a9571a9d9d00c441f401c281153ff78699ae","author":{"name":"Padma, Santhosh Kumar","email":"be073606cf7d0bdfd418af015b10b8eea94653a3@codeaurora.org"},"message":"qcacld-2.0: Avoid buffer overflow\n\nqcacld-3.0 to qcacld-2.0 propagation\n\nAdd max check for probe request length against max length of probe\nrequest buffer to avoid buffer overflow.\n\nBug: 72957234\nChange-Id: Ie0fad7443b2c749c66bb9ad662625a16d3a840c3\nCRs-Fixed: 2155808\nSigned-off-by: Ahmed ElArabawy <arabawy@google.com>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/1ad8a9571a9d9d00c441f401c281153ff78699ae"},{"sha":"db76edfeb1e03b440ca42aa4a556a0cf0e13fcfa","author":{"name":"gaurank kathpalia","email":"61f605b1a2b304adce113718c4626f77d7c2eb9b@codeaurora.org"},"message":"qcacld-2.0: Fix Out-of-bound access in sapInterferenceRssiCount\n\nFix Out-of-bound access in sapInterferenceRssiCount, by checking\nthe limit of start address for channel info and end address for\nchannel info.\n\nBug: 72957337\nChange-Id: If21e09d0f11bd655a8e04139ccf55d3682734b17\nCRs-Fixed: 2128512\nSigned-off-by: Ahmed ElArabawy <arabawy@google.com>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/db76edfeb1e03b440ca42aa4a556a0cf0e13fcfa"},{"sha":"06d9166f6bd286ebd37023e8b1d892bb9a55630c","author":{"name":"Tiger Yu","email":"62f72082223e4c26deb23937228d00ac28370ed2@codeaurora.org"},"message":"qcacld-2.0: Fix potential buffer overflow for TX_COMPL_IND\n\nCheck for the validity of num_msdus when received the htt message of\nHTT_T2H_MSG_TYPE_TX_COMPL_IND or HTT_T2H_MSG_TYPE_TX_INSPECT_IND from\nfirmware to ensure the buffer overflow does not happen.\n\nBug: 72957505\nChange-Id: Ic6ce75f34c5e2705d174eda014350e6ef0391388\nCRs-Fixed: 2146869\nSigned-off-by: Ahmed ElArabawy <arabawy@google.com>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/06d9166f6bd286ebd37023e8b1d892bb9a55630c"},{"sha":"61f64829478a207c09d39cc7a48bf8445c8785c0","author":{"name":"Ashish Kumar Dhanotiya","email":"e19f4c11b69de5af0e626470c132505528efc4bf@codeaurora.org"},"message":"qcacld-2.0: Avoid possible stack overflow in hdd_ProcessGENIE API\n\nThere is no check for the return value of dot11fUnpackIeRSN API\nin hdd_ProcessGENIE API, which may cause stack overflow if\npmkid_count is returned as more than the PMKIDCache size.\n\nAdd a check for return value of dot11fUnpackIeRSN to avoid possible\nstack overflow.\n\nBug: 72957507\nChange-Id: I56424c706de121b18b8d3f2c4a35089ec0434452\nCRs-Fixed: 2149187\nSigned-off-by: Ecco Park <eccopark@google.com>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/61f64829478a207c09d39cc7a48bf8445c8785c0"},{"sha":"a5702eacc6fa10f972e855d49a980b68566e039a","author":{"name":"Tiger Yu","email":"62f72082223e4c26deb23937228d00ac28370ed2@codeaurora.org"},"message":"qcacld-2.0: Fix memory leak for txrx_fw_stats cmd\n\nThe txrx_fw_stats cmd will allocate a req object before sending the cmd\nto the firmware, this memory is only freed when get response from firmware.\nThe memory leak will appear if the firmware doesn't response in time before\nthe driver unloading.\n\nThis fix will add a pending queue to trace this req object in the pdev.\nwhen pdev is detaching, it will clean up this queue to avoid memory leak.\n\nBug: 72957257\nChange-Id: I35f6216d35befbab978bba161252b305488bd34c\nCRs-Fixed: 2113219\nSigned-off-by: Ecco Park <eccopark@google.com>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/a5702eacc6fa10f972e855d49a980b68566e039a"},{"sha":"15d5a0c91fe9d90ad690154dff404a5e0eedd441","author":{"name":"tfyu","email":"62f72082223e4c26deb23937228d00ac28370ed2@codeaurora.org"},"message":"qcacld-2.0: Dump the txrx stat req if the queue is not empty\n\nDump the txrx stat req if the queue is not empty when detatch the pdev.\n\nBug: 72957257\nChange-Id: Ic38e01668efd28baf55acb04f448e236cc224c79\nCRs-Fixed: 2113219\nSigned-off-by: Ecco Park <eccopark@google.com>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/15d5a0c91fe9d90ad690154dff404a5e0eedd441"},{"sha":"6da4cefa202518c2cf4fc5f1f49e3c5760531783","author":{"name":"Ashish Kumar Dhanotiya","email":"e19f4c11b69de5af0e626470c132505528efc4bf@codeaurora.org"},"message":"qcacld-2.0: Race condition while using pkt log buffer\n\nThere can be a race condition if two different threads use the\npkt log buffer at the same time. This issue can lead to Use-After-Free\nof the packet log buffer.\n\nTo address this issue, protect the pktlog buffer access using spinlock.\n\nBug: 35470735\nChange-Id: Ibf38e5dac6cb01d02ec2cf1bb5eeb691f8f10738\nCRs-Fixed: 2042676\nSigned-off-by: Ahmed ElArabawy <arabawy@google.com>","distinct":false,"url":"https://api.github.com/repos/HardcoreKernel/bullhead/commits/6da4cefa202518c2cf4fc5f1f49e3c5760531783"}]}
{"actor":{"display_login":"scafroglia93"}}