{"push_id":2737408305,"size":178,"distinct_size":178,"ref":"refs/heads/marlin-oreo-m4","head":"6899fd13f82baea69bf183f0db04a05a28d56bdf","before":"7a167a89ee29689ba46c71b2cef7756f8def3918","commits":[{"sha":"7ae7a9188870dee3047fe6c378e060c08f2bd6b9","author":{"name":"Harrison Lingren","email":"28b977fd7bba8e95b4d1168a84ae539e55c93cf0@rodete-desktop-imager.corp.google.com"},"message":"Merge branch 'android-msm-marlin-3.18-oc-mr1' into android-msm-marlin-3.18-oc-mr1-security-next","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/7ae7a9188870dee3047fe6c378e060c08f2bd6b9"},{"sha":"7bd28b66977b8ffadbc5a405900f5c8c18c617a7","author":{"name":"Eric Biggers","email":"6f6115196800bbe9712b3f04c7e40093bb382fc5@google.com"},"message":"ASN.1: fix out-of-bounds read when parsing indefinite length item\n\ncommit e0058f3a874ebb48b25be7ff79bc3b4e59929f90 upstream.\n\nIn asn1_ber_decoder(), indefinitely-sized ASN.1 items were being passed\nto the action functions before their lengths had been computed, using\nthe bogus length of 0x80 (ASN1_INDEFINITE_LENGTH).  This resulted in\nreading data past the end of the input buffer, when given a specially\ncrafted message.\n\nFix it by rearranging the code so that the indefinite length is resolved\nbefore the action is called.\n\nThis bug was originally found by fuzzing the X.509 parser in userspace\nusing libFuzzer from the LLVM project.\n\nKASAN report (cleaned up slightly):\n\n    BUG: KASAN: slab-out-of-bounds in memcpy ./include/linux/string.h:341 [inline]\n    BUG: KASAN: slab-out-of-bounds in x509_fabricate_name.constprop.1+0x1a4/0x940 crypto/asymmetric_keys/x509_cert_parser.c:366\n    Read of size 128 at addr ffff880035dd9eaf by task keyctl/195\n\n    CPU: 1 PID: 195 Comm: keyctl Not tainted 4.14.0-09238-g1d3b78bbc6e9 #26\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014\n    Call Trace:\n     __dump_stack lib/dump_stack.c:17 [inline]\n     dump_stack+0xd1/0x175 lib/dump_stack.c:53\n     print_address_description+0x78/0x260 mm/kasan/report.c:252\n     kasan_report_error mm/kasan/report.c:351 [inline]\n     kasan_report+0x23f/0x350 mm/kasan/report.c:409\n     memcpy+0x1f/0x50 mm/kasan/kasan.c:302\n     memcpy ./include/linux/string.h:341 [inline]\n     x509_fabricate_name.constprop.1+0x1a4/0x940 crypto/asymmetric_keys/x509_cert_parser.c:366\n     asn1_ber_decoder+0xb4a/0x1fd0 lib/asn1_decoder.c:447\n     x509_cert_parse+0x1c7/0x620 crypto/asymmetric_keys/x509_cert_parser.c:89\n     x509_key_preparse+0x61/0x750 crypto/asymmetric_keys/x509_public_key.c:174\n     asymmetric_key_preparse+0xa4/0x150 crypto/asymmetric_keys/asymmetric_type.c:388\n     key_create_or_update+0x4d4/0x10a0 security/keys/key.c:850\n     SYSC_add_key security/keys/keyctl.c:122 [inline]\n     SyS_add_key+0xe8/0x290 security/keys/keyctl.c:62\n     entry_SYSCALL_64_fastpath+0x1f/0x96\n\n    Allocated by task 195:\n     __do_kmalloc_node mm/slab.c:3675 [inline]\n     __kmalloc_node+0x47/0x60 mm/slab.c:3682\n     kvmalloc ./include/linux/mm.h:540 [inline]\n     SYSC_add_key security/keys/keyctl.c:104 [inline]\n     SyS_add_key+0x19e/0x290 security/keys/keyctl.c:62\n     entry_SYSCALL_64_fastpath+0x1f/0x96\n\nFixes: 42d5ec27f873 (\"X.509: Add an ASN.1 decoder\")\nReported-by: Alexander Potapenko <glider@google.com>\nCc: <stable@vger.kernel.org> # v3.7+\nBug: 73827422\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nChange-Id: Ie5738889d965b8e45cf193ee6d098bab964d9675","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/7bd28b66977b8ffadbc5a405900f5c8c18c617a7"},{"sha":"fe0ec339353abccdda1df7c7906005643b6789fa","author":{"name":"Mike Maloney","email":"11e0c74741bc2265cea35da5594829826913c970@google.com"},"message":"ipv6: fix udpv6 sendmsg crash caused by too small MTU\n\n[ Upstream commit 749439bfac6e1a2932c582e2699f91d329658196 ]\n\nThe logic in __ip6_append_data() assumes that the MTU is at least large\nenough for the headers.  A device's MTU may be adjusted after being\nadded while sendmsg() is processing data, resulting in\n__ip6_append_data() seeing any MTU.  For an mtu smaller than the size of\nthe fragmentation header, the math results in a negative 'maxfraglen',\nwhich causes problems when refragmenting any previous skb in the\nskb_write_queue, leaving it possibly malformed.\n\nInstead sendmsg returns EINVAL when the mtu is calculated to be less\nthan IPV6_MIN_MTU.\n\nFound by syzkaller:\nkernel BUG at ./include/linux/skbuff.h:2064!\ninvalid opcode: 0000 [#1] SMP KASAN\nDumping ftrace buffer:\n   (ftrace buffer empty)\nModules linked in:\nCPU: 1 PID: 14216 Comm: syz-executor5 Not tainted 4.13.0-rc4+ #2\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\ntask: ffff8801d0b68580 task.stack: ffff8801ac6b8000\nRIP: 0010:__skb_pull include/linux/skbuff.h:2064 [inline]\nRIP: 0010:__ip6_make_skb+0x18cf/0x1f70 net/ipv6/ip6_output.c:1617\nRSP: 0018:ffff8801ac6bf570 EFLAGS: 00010216\nRAX: 0000000000010000 RBX: 0000000000000028 RCX: ffffc90003cce000\nRDX: 00000000000001b8 RSI: ffffffff839df06f RDI: ffff8801d9478ca0\nRBP: ffff8801ac6bf780 R08: ffff8801cc3f1dbc R09: 0000000000000000\nR10: ffff8801ac6bf7a0 R11: 43cb4b7b1948a9e7 R12: ffff8801cc3f1dc8\nR13: ffff8801cc3f1d40 R14: 0000000000001036 R15: dffffc0000000000\nFS:  00007f43d740c700(0000) GS:ffff8801dc100000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f7834984000 CR3: 00000001d79b9000 CR4: 00000000001406e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n ip6_finish_skb include/net/ipv6.h:911 [inline]\n udp_v6_push_pending_frames+0x255/0x390 net/ipv6/udp.c:1093\n udpv6_sendmsg+0x280d/0x31a0 net/ipv6/udp.c:1363\n inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:762\n sock_sendmsg_nosec net/socket.c:633 [inline]\n sock_sendmsg+0xca/0x110 net/socket.c:643\n SYSC_sendto+0x352/0x5a0 net/socket.c:1750\n SyS_sendto+0x40/0x50 net/socket.c:1718\n entry_SYSCALL_64_fastpath+0x1f/0xbe\nRIP: 0033:0x4512e9\nRSP: 002b:00007f43d740bc08 EFLAGS: 00000216 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 00000000007180a8 RCX: 00000000004512e9\nRDX: 000000000000002e RSI: 0000000020d08000 RDI: 0000000000000005\nRBP: 0000000000000086 R08: 00000000209c1000 R09: 000000000000001c\nR10: 0000000000040800 R11: 0000000000000216 R12: 00000000004b9c69\nR13: 00000000ffffffff R14: 0000000000000005 R15: 00000000202c2000\nCode: 9e 01 fe e9 c5 e8 ff ff e8 7f 9e 01 fe e9 4a ea ff ff 48 89 f7 e8 52 9e 01 fe e9 aa eb ff ff e8 a8 b6 cf fd 0f 0b e8 a1 b6 cf fd <0f> 0b 49 8d 45 78 4d 8d 45 7c 48 89 85 78 fe ff ff 49 8d 85 ba\nRIP: __skb_pull include/linux/skbuff.h:2064 [inline] RSP: ffff8801ac6bf570\nRIP: __ip6_make_skb+0x18cf/0x1f70 net/ipv6/ip6_output.c:1617 RSP: ffff8801ac6bf570\n\nReported-by: syzbot <syzkaller@googlegroups.com>\nBug: 65023306\nSigned-off-by: Mike Maloney <maloney@google.com>\nReviewed-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nChange-Id: If7663cd538ca686c8a7874181b45bdb48630f538","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/fe0ec339353abccdda1df7c7906005643b6789fa"},{"sha":"45ee7d900c680fd859fee52fce61744ba57d3b0d","author":{"name":"Vaishnavi Kommaraju","email":"883dc6ee1d74aa716c5ef3854851243918466eeb@codeaurora.org"},"message":"ASoC: wcd_cpe_core: Add mutex lock for CPE session\n\nAdd mutex lock to ensure atomic access to core handle\nin CPE alloc and dealloc sessions.\n\nCRs-Fixed: 2169403\nBug: 62536960\nSigned-off-by: Vaishnavi Kommaraju <vkommara@codeaurora.org>\nChange-Id: Iaf95e462e6ec8bfa711013d2239140b51d897eff","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/45ee7d900c680fd859fee52fce61744ba57d3b0d"},{"sha":"4afaa191b6d1bcf82fbda3f777d03d3d6a778c6f","author":{"name":"Sean Callanan","email":"de7670bc15f53732973f792db533739a238082e0@google.com"},"message":"msm: ADSPRPC: use access_ok to validate pointers\n\nThe FASTRPC_IOCTL_INIT ioctl registers a pointer for later\naccess without checking that it is a user pointer.  This could\nallow arbitrary kernel memory access.\n\nThis patch verifies that the pointer is a user pointer.\n\nBug: 63165064\nChange-Id: I936f73a2c2029f9e7ca12cc8fc06d0698e6710c0\nSigned-off-by: Tharun Kumar Merugu <mtharu@codeaurora.org>\nSigned-off-by: Sean Callanan <spyffe@google.com>","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/4afaa191b6d1bcf82fbda3f777d03d3d6a778c6f"},{"sha":"d4bf16edebdcc6e2065033127cf1f9e3f181851c","author":{"name":"Hanumanth Reddy Pothula","email":"8196c9ad3789a46b33a754647c291c9db243b28c@codeaurora.org"},"message":"qcacld-2.0: Remove FW memory dump feature\n\nFW memory dump feature is no longer used. Hence remove FW memory\ndump feature code changes.\n\nChange-Id: Ida655f83630c369df746e7c0c9d61a8fee2932a2\nCRs-Fixed: 2120605\nBug: 65542521\nSigned-off-by: Srinivas Girigowda <sgirigow@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/d4bf16edebdcc6e2065033127cf1f9e3f181851c"},{"sha":"0aa2e60f2d2e566cb3bcc218e33bb86ed23a9945","author":{"name":"Eric Biggers","email":"6f6115196800bbe9712b3f04c7e40093bb382fc5@google.com"},"message":"KEYS: fix out-of-bounds read during ASN.1 parsing\n\ncommit 2eb9eabf1e868fda15808954fb29b0f105ed65f1 upstream.\n\nsyzkaller with KASAN reported an out-of-bounds read in\nasn1_ber_decoder().  It can be reproduced by the following command,\nassuming CONFIG_X509_CERTIFICATE_PARSER=y and CONFIG_KASAN=y:\n\n    keyctl add asymmetric desc $'\\x30\\x30' @s\n\nThe bug is that the length of an ASN.1 data value isn't validated in the\ncase where it is encoded using the short form, causing the decoder to\nread past the end of the input buffer.  Fix it by validating the length.\n\nThe bug report was:\n\n    BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x10cb/0x1730 lib/asn1_decoder.c:233\n    Read of size 1 at addr ffff88003cccfa02 by task syz-executor0/6818\n\n    CPU: 1 PID: 6818 Comm: syz-executor0 Not tainted 4.14.0-rc7-00008-g5f479447d983 #2\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n    Call Trace:\n     __dump_stack lib/dump_stack.c:16 [inline]\n     dump_stack+0xb3/0x10b lib/dump_stack.c:52\n     print_address_description+0x79/0x2a0 mm/kasan/report.c:252\n     kasan_report_error mm/kasan/report.c:351 [inline]\n     kasan_report+0x236/0x340 mm/kasan/report.c:409\n     __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:427\n     asn1_ber_decoder+0x10cb/0x1730 lib/asn1_decoder.c:233\n     x509_cert_parse+0x1db/0x650 crypto/asymmetric_keys/x509_cert_parser.c:89\n     x509_key_preparse+0x64/0x7a0 crypto/asymmetric_keys/x509_public_key.c:174\n     asymmetric_key_preparse+0xcb/0x1a0 crypto/asymmetric_keys/asymmetric_type.c:388\n     key_create_or_update+0x347/0xb20 security/keys/key.c:855\n     SYSC_add_key security/keys/keyctl.c:122 [inline]\n     SyS_add_key+0x1cd/0x340 security/keys/keyctl.c:62\n     entry_SYSCALL_64_fastpath+0x1f/0xbe\n    RIP: 0033:0x447c89\n    RSP: 002b:00007fca7a5d3bd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8\n    RAX: ffffffffffffffda RBX: 00007fca7a5d46cc RCX: 0000000000447c89\n    RDX: 0000000020006f4a RSI: 0000000020006000 RDI: 0000000020001ff5\n    RBP: 0000000000000046 R08: fffffffffffffffd R09: 0000000000000000\n    R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000\n    R13: 0000000000000000 R14: 00007fca7a5d49c0 R15: 00007fca7a5d4700\n\nFixes: 42d5ec27f873 (\"X.509: Add an ASN.1 decoder\")\nBug: 73827422\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: James Morris <james.l.morris@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nChange-Id: I49455e7006a338e15326c9c3e1a2607ebf09baf4","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/0aa2e60f2d2e566cb3bcc218e33bb86ed23a9945"},{"sha":"2aabc3282374eb5221392d56567c5e2efdc6496b","author":{"name":"Liam Mark","email":"34a322c05ccf7a69003b3e288dfc60055c6d0c33@codeaurora.org"},"message":"ion: ensure CMO target is valid\n\nCleanup ION cache maintenance code to properly validate the target of\nuserspace cache maintenance requests.\n\nBug: 72957321\nChange-Id: I55b8e3584c59634f95250bc7c0bce5d8d70e6a13\nSigned-off-by: Liam Mark <lmark@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/2aabc3282374eb5221392d56567c5e2efdc6496b"},{"sha":"6da4492f1f3d7d2c91b409206152347fc7c7432b","author":{"name":"Eric Biggers","email":"6f6115196800bbe9712b3f04c7e40093bb382fc5@google.com"},"message":"crypto: hmac - require that the underlying hash algorithm is unkeyed\n\ncommit <af3ff8045bbf3e32f1a448542e73abb4c8ceb6f1> upstream.\n\nBecause the HMAC template didn't check that its underlying hash\nalgorithm is unkeyed, trying to use \"hmac(hmac(sha3-512-generic))\"\nthrough AF_ALG or through KEYCTL_DH_COMPUTE resulted in the inner HMAC\nbeing used without having been keyed, resulting in sha3_update() being\ncalled without sha3_init(), causing a stack buffer overflow.\n\nThis is a very old bug, but it seems to have only started causing real\nproblems when SHA-3 support was added (requires CONFIG_CRYPTO_SHA3)\nbecause the innermost hash's state is ->import()ed from a zeroed buffer,\nand it just so happens that other hash algorithms are fine with that,\nbut SHA-3 is not.  However, there could be arch or hardware-dependent\nhash algorithms also affected; I couldn't test everything.\n\nFix the bug by introducing a function crypto_shash_alg_has_setkey()\nwhich tests whether a shash algorithm is keyed.  Then update the HMAC\ntemplate to require that its underlying hash algorithm is unkeyed.\n\nHere is a reproducer:\n\n    #include <linux/if_alg.h>\n    #include <sys/socket.h>\n\n    int main()\n    {\n        int algfd;\n        struct sockaddr_alg addr = {\n            .salg_type = \"hash\",\n            .salg_name = \"hmac(hmac(sha3-512-generic))\",\n        };\n        char key[4096] = { 0 };\n\n        algfd = socket(AF_ALG, SOCK_SEQPACKET, 0);\n        bind(algfd, (const struct sockaddr *)&addr, sizeof(addr));\n        setsockopt(algfd, SOL_ALG, ALG_SET_KEY, key, sizeof(key));\n    }\n\nHere was the KASAN report from syzbot:\n\n    BUG: KASAN: stack-out-of-bounds in memcpy include/linux/string.h:341  [inline]\n    BUG: KASAN: stack-out-of-bounds in sha3_update+0xdf/0x2e0  crypto/sha3_generic.c:161\n    Write of size 4096 at addr ffff8801cca07c40 by task syzkaller076574/3044\n\n    CPU: 1 PID: 3044 Comm: syzkaller076574 Not tainted 4.14.0-mm1+ #25\n    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  Google 01/01/2011\n    Call Trace:\n      __dump_stack lib/dump_stack.c:17 [inline]\n      dump_stack+0x194/0x257 lib/dump_stack.c:53\n      print_address_description+0x73/0x250 mm/kasan/report.c:252\n      kasan_report_error mm/kasan/report.c:351 [inline]\n      kasan_report+0x25b/0x340 mm/kasan/report.c:409\n      check_memory_region_inline mm/kasan/kasan.c:260 [inline]\n      check_memory_region+0x137/0x190 mm/kasan/kasan.c:267\n      memcpy+0x37/0x50 mm/kasan/kasan.c:303\n      memcpy include/linux/string.h:341 [inline]\n      sha3_update+0xdf/0x2e0 crypto/sha3_generic.c:161\n      crypto_shash_update+0xcb/0x220 crypto/shash.c:109\n      shash_finup_unaligned+0x2a/0x60 crypto/shash.c:151\n      crypto_shash_finup+0xc4/0x120 crypto/shash.c:165\n      hmac_finup+0x182/0x330 crypto/hmac.c:152\n      crypto_shash_finup+0xc4/0x120 crypto/shash.c:165\n      shash_digest_unaligned+0x9e/0xd0 crypto/shash.c:172\n      crypto_shash_digest+0xc4/0x120 crypto/shash.c:186\n      hmac_setkey+0x36a/0x690 crypto/hmac.c:66\n      crypto_shash_setkey+0xad/0x190 crypto/shash.c:64\n      shash_async_setkey+0x47/0x60 crypto/shash.c:207\n      crypto_ahash_setkey+0xaf/0x180 crypto/ahash.c:200\n      hash_setkey+0x40/0x90 crypto/algif_hash.c:446\n      alg_setkey crypto/af_alg.c:221 [inline]\n      alg_setsockopt+0x2a1/0x350 crypto/af_alg.c:254\n      SYSC_setsockopt net/socket.c:1851 [inline]\n      SyS_setsockopt+0x189/0x360 net/socket.c:1830\n      entry_SYSCALL_64_fastpath+0x1f/0x96\n\nReported-by: syzbot <syzkaller@googlegroups.com>\nBug: 71752561\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nChange-Id: Icfc16f18b0454ecc886cab0cdf9e93c018f2a44d","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/6da4492f1f3d7d2c91b409206152347fc7c7432b"},{"sha":"af06b5bb14e8f84a38802cac12c5ef1a5d8341d7","author":{"name":"Eric Biggers","email":"6f6115196800bbe9712b3f04c7e40093bb382fc5@google.com"},"message":"KEYS: add missing permission check for request_key() destination\n\ncommit 4dca6ea1d9432052afb06baf2e3ae78188a4410b upstream.\n\nWhen the request_key() syscall is not passed a destination keyring, it\nlinks the requested key (if constructed) into the \"default\" request-key\nkeyring.  This should require Write permission to the keyring.  However,\nthere is actually no permission check.\n\nThis can be abused to add keys to any keyring to which only Search\npermission is granted.  This is because Search permission allows joining\nthe keyring.  keyctl_set_reqkey_keyring(KEY_REQKEY_DEFL_SESSION_KEYRING)\nthen will set the default request-key keyring to the session keyring.\nThen, request_key() can be used to add keys to the keyring.\n\nBoth negatively and positively instantiated keys can be added using this\nmethod.  Adding negative keys is trivial.  Adding a positive key is a\nbit trickier.  It requires that either /sbin/request-key positively\ninstantiates the key, or that another thread adds the key to the process\nkeyring at just the right time, such that request_key() misses it\ninitially but then finds it in construct_alloc_key().\n\nFix this bug by checking for Write permission to the keyring in\nconstruct_get_dest_keyring() when the default keyring is being used.\n\nWe don't do the permission check for non-default keyrings because that\nwas already done by the earlier call to lookup_user_key().  Also,\nrequest_key_and_link() is currently passed a 'struct key *' rather than\na key_ref_t, so the \"possessed\" bit is unavailable.\n\nWe also don't do the permission check for the \"requestor keyring\", to\ncontinue to support the use case described by commit 8bbf4976b59f\n(\"KEYS: Alter use of key instantiation link-to-keyring argument\") where\n/sbin/request-key recursively calls request_key() to add keys to the\noriginal requestor's destination keyring.  (I don't know of any users\nwho actually do that, though...)\n\nFixes: 3e30148c3d52 (\"[PATCH] Keys: Make request-key create an authorisation key\")\nBug: 71751178\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nChange-Id: I22bf395912a0d4dd84f27d27138bd9d03dcce5ab","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/af06b5bb14e8f84a38802cac12c5ef1a5d8341d7"},{"sha":"a6fba7d93fcbc007d06e7f2d5d40000d3647f587","author":{"name":"Carter Cooper","email":"ff1e5ded47dd5c88716d0ac2f671fd3e0c0ebc6d@codeaurora.org"},"message":"msm: kgsl: Properly remove ref count on gpuobj_sync failure\n\nThe user can pass bad data into kgsl_ioctl_gpuobj_sync(). If\n_copy_from_user() fails do to bad data, undo any current\nreferences taken through this ioctl call.\n\nBug: 74237606\nChange-Id: I56195520b9dadba20ee419658fc2cbb282b8449c\nSigned-off-by: Carter Cooper <ccooper@codeaurora.org>\nSigned-off-by: samit vats <svats@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/a6fba7d93fcbc007d06e7f2d5d40000d3647f587"},{"sha":"9d65e3a777fa3438ce6624ec3871e8a88f5a5e11","author":{"name":"Mark Salyzyn","email":"4bb1064d1f46929ded0070376617aece30f0ee54@google.com"},"message":"ANDROID: Bluetooth: hidp: buffer overflow in hidp_process_report\n\nThe buffer length is unsigned at all layers, but gets cast to int and\nchecked in hidp_process_report and can lead to a buffer overflow.\nSwitch len parameter to unsigned int to resolve issue.\n\nSigned-off-by: Mark Salyzyn <salyzyn@google.com>\nFixes: 678af93e46ac10318b54f2f0c9abbdfe75c4e078 (\"HID: Bluetooth: hidp: make sure input buffers are big enough\")\nBug: 65853588\nChange-Id: I779ce783ae7c3bce8c5a66c0954ef31347e42cfc","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/9d65e3a777fa3438ce6624ec3871e8a88f5a5e11"},{"sha":"154e958a9c8caa0a3a776e9788202b4e5880ca6a","author":{"name":"Sreelakshmi Gownipalli","email":"ca39c2cc03944f28ff9ea61882d0995994b72dbb@codeaurora.org"},"message":"diag: Add conditional check for len in dci_process_ctrl_status()\n\nAdd correct conditional check for len in dci_process_ctrl_status() to\nprevent buffer overflow.\n\nBug: 70528036\nChange-Id: Id73ed1c8b104428eceef0544ce2858160cc08fd2\nSigned-off-by: Sreelakshmi Gownipalli <sgownipa@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/154e958a9c8caa0a3a776e9788202b4e5880ca6a"},{"sha":"a589cb7a32815ba7bbbc6e82727390f9d41327fa","author":{"name":"Andrew Chant","email":"a416ae3c2187a33b5cbc589c826e72eb7a23c996@google.com"},"message":"diag: dci: check signed values for negativity\n\nwhen comparing a signed value vs sizeof, make sure\nit's >= 0 so that when promoted to signed for comparison\nit won't lead to unexpected results.\n\nBug: 70528036\nChange-Id: I99a1220598e67e3ce5c99d425e84c79639121838\nSigned-off-by: Andrew Chant <achant@google.com>","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/a589cb7a32815ba7bbbc6e82727390f9d41327fa"},{"sha":"a68d2bd279f1dab0587fa6758a2161dbd674e16a","author":{"name":"c_mtharu","email":"012990c70e5a1c15d9a3a222f92d1c1f726a82e2@codeaurora.org"},"message":"msm: ADSPRPC: validate context pointer with magic number\n\nValidate context pointer using magic number instead of searching\nthrough context list. It removes the usage of spin lock in interrupt\nhandler for avoiding deadlock and reducing latency.\n\nBug: 74237782\nChange-Id: I2492a7984a8d6545618a9cfb7a2d239d03ddd5a2\nAcked-by: Viswanatham Paduchuri <vpaduchu@qti.qualcomm.com>\nSigned-off-by: Tharun Kumar Merugu <mtharu@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/a68d2bd279f1dab0587fa6758a2161dbd674e16a"},{"sha":"af97a14389b365c8576e0b32e03df7975dd4b70a","author":{"name":"Tharun Kumar Merugu","email":"012990c70e5a1c15d9a3a222f92d1c1f726a82e2@codeaurora.org"},"message":"msm: ADSPRPC: Use ID in response to get context pointer\n\nSend context ID in rpc header instead of context pointer.\nValidate context ID received in response and get context pointer.\n\nBug: 74237782\nChange-Id: I9cfd10d0c1b25c3085b8e15c7ca1c8ff214bf10d\nAcked-by: Viswanatham Paduchuri <vpaduchu@qti.qualcomm.com>\nSigned-off-by: Tharun Kumar Merugu <mtharu@codeaurora.org>\nSigned-off-by: Steve Pfetsch <spfetsch@google.com>","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/af97a14389b365c8576e0b32e03df7975dd4b70a"},{"sha":"f3caabdff7111ed41b5b2520f2ed76e2a3bd7038","author":{"name":"Himanshu Agarwal","email":"9262e84548070f5a2adb21c4f6264f905bad4a0d@qti.qualcomm.com"},"message":"qcacld-2.0: Move NBUF_UPDATE_TX_PKT_COUNT before freeing netbuf\n\nMove NBUF_UPDATE_TX_PKT_COUNT in ol_tx_completion_handler to make\nsure that netbuf is not accessed after it is freed.\n\nBug: 71638332\n\nChange-Id: Ifba9de788b11ce8cb323827d10f8005029609231\nCRs-fixed: 1040612\nSigned-off-by: Ahmed ElArabawy <arabawy@google.com>","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/f3caabdff7111ed41b5b2520f2ed76e2a3bd7038"},{"sha":"1b940319a5e4b138bdb28c5a8b1c57a9caa5a44e","author":{"name":"Sean Callanan","email":"de7670bc15f53732973f792db533739a238082e0@google.com"},"message":"mm-camera2:isp2: Handle use after free buffer\n\nIn the code, start_fetch can try to access the\nbuffer pointer variable after free, as the\nsame pointer can be freed at RELEASE_BUF call\nat the same time.\n\nCRs-Fixed: 2149998\nChange-Id: Ic83f22336504cf67afe12131f791eee25477f011\nSigned-off-by: Meera Gande <mgande@codeaurora.org>\nSigned-off-by: VijayaKumar T M <vtmuni@codeaurora.org>\n\nBug: 69065862\nSigned-off-by: Sean Callanan <spyffe@google.com>","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/1b940319a5e4b138bdb28c5a8b1c57a9caa5a44e"},{"sha":"ac75d0c216fdcfcdd5de95ecc212c2e22efd1c7c","author":{"name":"Alan Stern","email":"75ea6bb7bfc1186f92d26164de5f9268c9a45b59@rowland.harvard.edu"},"message":"USB: core: prevent malicious bNumInterfaces overflow\n\ncommit 48a4ff1c7bb5a32d2e396b03132d20d552c0eca7 upstream.\n\nA malicious USB device with crafted descriptors can cause the kernel\nto access unallocated memory by setting the bNumInterfaces value too\nhigh in a configuration descriptor.  Although the value is adjusted\nduring parsing, this adjustment is skipped in one of the error return\npaths.\n\nThis patch prevents the problem by setting bNumInterfaces to 0\ninitially.  The existing code already sets it to the proper value\nafter parsing is complete.\n\nBug: 71751622\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nChange-Id: I89bb5c8e48e7654aac05a7936f4ee92e1481ca65","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/ac75d0c216fdcfcdd5de95ecc212c2e22efd1c7c"},{"sha":"61980fa7957732e9c4381c1bbf03ec014f352ba2","author":{"name":"Tiger Yu","email":"62f72082223e4c26deb23937228d00ac28370ed2@codeaurora.org"},"message":"qcacld-2.0: Fix potential buffer overwrite in the htt_t2h_lp_msg_handler\n\nCheck for the validity of tx_desc_id when received the htt message of\nHTT_T2H_MSG_TYPE_MGMT_TX_COMPL_IND from firmware to ensure the buffer\noverwrite does not happen.\n\nBug: 74237532\n\nChange-Id: I0afc781b7fff303525352b817e7eb60b8b05e4d3\nCRs-Fixed: 2157917\nSigned-off-by: Ahmed ElArabawy <arabawy@google.com>","distinct":true,"url":"https://api.github.com/repos/shagbag913/aosp_kernel_marlin/commits/61980fa7957732e9c4381c1bbf03ec014f352ba2"}]}
{"actor":{"display_login":"shagbag913"}}