{"push_id":2394926801,"size":69,"distinct_size":69,"ref":"refs/heads/nougat-7.1.1-release-owens","head":"91468ddfc3cad43cb5030652abcc126a0f2e1af1","before":"15ed41d523681bd47a38ef662560d41f8270a067","commits":[{"sha":"16211eb3dfabce6bef47089608aad78412a4874d","author":{"name":"Benjamin Chan","email":"57574988578c5e43390d075245253f23de86c4da@codeaurora.org"},"message":"msm: mdss: Add lock to avoid release of active session in rotator\n\nAdd mutex lock to protect an active rotator session from being closed.\nWithout the lock, this can happen if a rotator closing IOCTL is\ncalled from a separate thread.\n\nMot-CRs-fixed: (CR)\nCVE-Fixed: CVE-2017-7370\nCRs-Fixed: 2006159\nChange-Id: I927a0c626bdae5ef149e12979ec4befdbac1b7f7\nSigned-off-by: Benjamin Chan <bkchan@codeaurora.org>\nReviewed-on: https://gerrit.mot.com/997388\nSME-Granted: SME Approvals Granted\nSLTApproved: Slta Waiver <sltawvr@motorola.com>\nTested-by: Jira Key <jirakey@motorola.com>\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nSubmit-Approved: Jira Key <jirakey@motorola.com>","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/16211eb3dfabce6bef47089608aad78412a4874d"},{"sha":"c8970ee1822a36f540c5a1c17272ce27dffc1bff","author":{"name":"Rajkumar Subbiah","email":"9b327231433955c4795117f11ea6771387df6c9b@codeaurora.org"},"message":"msm: mdss: Fix integer overflow in cursor validaton\n\nThe calculation of cursor image size has a potential\ninteger overflow issue. Modifing the validation logic\nto avoid overflow.\n\nMot-CRs-fixed: (CR)\nCVE-Fixed: CVE-2017-0579\nChange-Id: If21eff9623d71e11d116741de3a349a95dbc54bd\nSigned-off-by: Rajkumar Subbiah <rsubbia@codeaurora.org>\nReviewed-on: https://gerrit.mot.com/997389\nSME-Granted: SME Approvals Granted\nSLTApproved: Slta Waiver <sltawvr@motorola.com>\nTested-by: Jira Key <jirakey@motorola.com>\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nSubmit-Approved: Jira Key <jirakey@motorola.com>","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/c8970ee1822a36f540c5a1c17272ce27dffc1bff"},{"sha":"d991ab864cca231b759621c0ee8801b99a739bd4","author":{"name":"Ashwin Pathmudi","email":"9b7e9a0dd2c2c72f9b4278556fc37236d667d3a7@motorola.com"},"message":"input: touchscreen: validate bounds of intr_reg_num\n\nValidate the intr_reg_num value returned by touchscreen\nto ensure no out of bounds access can occur.\nPorted over from ANDROID-35472278\n\nMot-CRs-fixed: (CR)\nCVE-Fixed: CVE-2017-0650\nBug: 35472278\n\nChange-Id: I0ad8596773172056e54d417f43f31acc6c73295a\nSigned-off-by: Ashwin Pathmudi <jfxr63@motorola.com>\nReviewed-on: https://gerrit.mot.com/997390\nSLTApproved: Slta Waiver <sltawvr@motorola.com>\nSME-Granted: SME Approvals Granted\nTested-by: Jira Key <jirakey@motorola.com>\nReviewed-by: Konstantin Makariev <kmakariev@motorola.com>\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nSubmit-Approved: Jira Key <jirakey@motorola.com>","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/d991ab864cca231b759621c0ee8801b99a739bd4"},{"sha":"be8f70079a755754c732e7678acc75e8af9d9112","author":{"name":"Walter Yang","email":"40fe51b379e199d64ef1e40a9ce78510baf47edf@codeaurora.org"},"message":"ASoC: Add backend user count checking\n\nAdd backend user count checking to protect the index\nboundary.\n\nMot-CRs-fixed: (CR)\nCVE-fixed: CVE-2017-7369\nBug-Id: A-33751424\nChange-Id: Ic1b61d1f7130252cc54da0b16553858714988dbd\nCRs-Fixed: 2009216\nSigned-off-by: Walter Yang <yandongy@codeaurora.org>\n--\nReviewed-on: https://gerrit.mot.com/993008\nSME-Granted: SME Approvals Granted\nSLTApproved: Slta Waiver <sltawvr@motorola.com>\nTested-by: Jira Key <jirakey@motorola.com>\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nReviewed-by: Vrushali Prakash Bhosale <wkvq37@motorola.com>\nSubmit-Approved: Jira Key <jirakey@motorola.com>","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/be8f70079a755754c732e7678acc75e8af9d9112"},{"sha":"31af7c08a7dce9e8fbdb3ead3a4b378a35cef166","author":{"name":"Siena Richard","email":"d38b195d0a21dccff7df190f3906e3fea13874b3@codeaurora.org"},"message":"drivers: soc: add size check\n\nAdd size check to ensure the payload fits inside the declared payload\nsize to prevent loss of data when copying.\n\nMot-CRs-fixed: (CR)\nBug-Id: A-31796345\nCVE-fixed: CVE-2017-0451\nCRs-Fixed: 2009224\nSigned-off-by: Siena Richard <sienar@codeaurora.org>\nChange-Id: I4275c626605272941143b54a7b8861b25f8e750a\n---\nReviewed-on: https://gerrit.mot.com/993007\nSLTApproved: Slta Waiver <sltawvr@motorola.com>\nSME-Granted: SME Approvals Granted\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nTested-by: Jira Key <jirakey@motorola.com>\nReviewed-by: Vrushali Prakash Bhosale <wkvq37@motorola.com>\nSubmit-Approved: Jira Key <jirakey@motorola.com>","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/31af7c08a7dce9e8fbdb3ead3a4b378a35cef166"},{"sha":"857833126da39702edcbdd9f67e8af00372f1dcd","author":{"name":"Andrey Konovalov","email":"acba6f9b010367f452595b80d6e1782629aa36cc@google.com"},"message":"dccp: fix freeing skb too early for IPV6_RECVPKTINFO\n\nIn the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet\nis forcibly freed via __kfree_skb in dccp_rcv_state_process if\ndccp_v6_conn_request successfully returns.\n\nHowever, if IPV6_RECVPKTINFO is set on a socket, the address of the skb\nis saved to ireq->pktopts and the ref count for skb is incremented in\ndccp_v6_conn_request, so skb is still in use. Nevertheless, it gets freed\nin dccp_rcv_state_process.\n\nFix by calling consume_skb instead of doing goto discard and therefore\ncalling __kfree_skb.\n\nSimilar fixes for TCP:\n\nfb7e2399ec17f1004c0e0ccfd17439f8759ede01 [TCP]: skb is unexpectedly freed.\n0aea76d35c9651d55bbaf746e7914e5f9ae5a25d tcp: SYN packets are now\nsimply consumed\n\nMot-CRs-fixed:(CR)\nCVE-Fixed:CVE-2017-6074\n\nBug: 35784697\nUpstream commit: 5edabca9d4cff7f1f2b68f0bac55ef99d9798ba4\nSigned-off-by: Andrey Konovalov <andreyknvl@google.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n\n(cherry picked from commit 8e35329aa97336f0f07637646d930156bc42bfb2)\nSigned-off-by: Vineet Angadi V <vineetv@motorola.com>\n\nChange-Id: I9ce3501d7f4b6ef3581d6820440c0f808f770993\nReviewed-on: https://gerrit.mot.com/1009414\nSME-Granted: SME Approvals Granted\nSLTApproved: Slta Waiver\nTested-by: Jira Key\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nSubmit-Approved: Jira Key","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/857833126da39702edcbdd9f67e8af00372f1dcd"},{"sha":"a8457de0af12c6a82155faadd9f3d55c42e19298","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"ipv4: keep skb->dst around in presence of IP options\n\nAndrey Konovalov got crashes in __ip_options_echo() when a NULL skb->dst\nis accessed.\n\nipv4_pktinfo_prepare() should not drop the dst if (evil) IP options\nare present.\n\nWe could refine the test to the presence of ts_needtime or srr,\nbut IP options are not often used, so let's be conservative.\n\nThanks to syzkaller team for finding this bug.\n\nMot-CRs-fixed:(CR)\nCVE-Fixed:CVE-2017-5970\n\nChange-Id: I906e1fec822f256d20b5835ac578e14f582d2dc9\nFixes: d826eb14ecef (\"ipv4: PKTINFO doesnt need dst reference\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Vineet Angadi V <vineetv@motorola.com>\nReviewed-on: https://gerrit.mot.com/1010180\nSME-Granted: SME Approvals Granted\nSLTApproved: Slta Waiver\nTested-by: Jira Key\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nSubmit-Approved: Jira Key","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/a8457de0af12c6a82155faadd9f3d55c42e19298"},{"sha":"cd71f3f9c666ffcc94fb2e9130f77d8408e4b57c","author":{"name":"Nick Desaulniers","email":"b951273a67bf33267cd4dff69171cdef4e5efbe7@google.com"},"message":"Revert \"proc: smaps: Allow smaps access for CAP_SYS_RESOURCE\"\n\nThis reverts commit f0ce0eee6b71bc310153edb87e66e6b25e12fece.\n\nMot-CRs-fixed: (CR)\nCVE-Fixed: CVE-2017-0710\nBug: 34951864\nBug: 36468447\n\nChange-Id: I87bd92e096c6c28a53b9ecf302ae008f5e58eba1\nSigned-off-by: Nick Desaulniers <ndesaulniers@google.com>\nReviewed-on: https://gerrit.mot.com/1007792\nSLTApproved: Slta Waiver\nSME-Granted: SME Approvals Granted\nTested-by: Jira Key\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nSubmit-Approved: Jira Key","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/cd71f3f9c666ffcc94fb2e9130f77d8408e4b57c"},{"sha":"69c83c391057f131b89f7e8a76142d3da519340e","author":{"name":"Puja Gupta","email":"9c5fd77986c5287dde51caec5a64571356e49395@codeaurora.org"},"message":"soc: qcom: Avoid possible buffer overflow in service-locator\n\nFix possible buffer overflow by reading 'resp->total_domains' from the\nqmi response message since 'resp->total_domains' indicate total number\nof matching domains found by servreg.\n'resp->domain_list_len' indicates the domains that could be sent in one\nresponse which should not be greater than 'resp->total_domains'.\n\nMot-CRs-fixed: (CR)\nBug: 34359487\nCVE-fixed: CVE-2017-8259\nCRs-Fixed: 2009016\nChange-Id: I614561c5f9bc996689129bc098baaffc9b59c377\nSigned-off-by: Puja Gupta <pujag@codeaurora.org>\nReviewed-on: https://gerrit.mot.com/1009979\nSME-Granted: SME Approvals Granted\nSLTApproved: Slta Waiver\nTested-by: Jira Key\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nSubmit-Approved: Jira Key","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/69c83c391057f131b89f7e8a76142d3da519340e"},{"sha":"bf889012e5c01f044a16cfbd9f7f5638de40158a","author":{"name":"Ravi Kishore Tanuku","email":"951278bd0c5a54f6bb2366cc9e73359c7bdd57eb@codeaurora.org"},"message":"msm: camera: Add regulator enable and disable independent of CSID\n\nRegulator enable and disable of CSIPHY depends on the CSID module.\nMake the enable and disable of clk regulator independent of CSIPHY.\n\nCRs-Fixed: 1107702\nBug: 33299365\nCVE-fixed: CVE-2017-8264\nMot-CRs-fixed: (CR)\n\nChange-Id: Iabb5eb28d63b34a4c3201c53be17054a1907f4fe\nSigned-off-by: Ravi Kishore Tanuku <rktanuku@codeaurora.org>\nSigned-off-by: Nick Desaulniers <ndesaulniers@google.com>\nSigned-off-by: Srikanth A R <arsrikan@motorola.com>\nReviewed-on: https://gerrit.mot.com/1012322\nSME-Granted: SME Approvals Granted\nSLTApproved: Slta Waiver\nTested-by: Jira Key\nReviewed-by: Robert Kubicki <w17311@motorola.com>\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nSubmit-Approved: Jira Key","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/bf889012e5c01f044a16cfbd9f7f5638de40158a"},{"sha":"54eeb1b300b765d4d1cea6fc59f65fa61a2fa117","author":{"name":"Dennis Cagle","email":"1c958d084f7278f93cbdf16f75fd9d20fa6ac1af@codeaurora.org"},"message":"msm: rmnet_ipa: fix security issue\n\nFix the security issue where mux channel name might\nnot be null-terminated in ipa wan driver.\n\nMot-CRs-fixed: (CR)\nCVE-fixed: CVE-2017-8269\n\nBug: 33967002\nCRs-Fixed: 2013145\nChange-Id: I3ef440b62cf3861464fb60c1e7f65f2be5e39ed0\nAcked-by: Shihuan Liu <shihuanl@qti.qualcomm.com>\nSigned-off-by: Skylar Chang <chiaweic@codeaurora.org>\nSigned-off-by: Dennis Cagle <d-cagle@codeaurora.org>\nReviewed-on: https://gerrit.mot.com/1014285\nSLTApproved: Slta Waiver\nSME-Granted: SME Approvals Granted\nTested-by: Jira Key\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nSubmit-Approved: Jira Key","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/54eeb1b300b765d4d1cea6fc59f65fa61a2fa117"},{"sha":"4c980a9f90a64a5b344fded10c77caa378d036a2","author":{"name":"Sunil Khatri","email":"c2fa09c6a63ee27656efbed7bd5e770f84d009d0@codeaurora.org"},"message":"msm: kgsl: Fix kgsl memory allocation and free race condition\n\nWhen allocating userspace memory keep reference to memory\nallocation till it is completely initialized and info is send back\nto userspace\n\nMot-CRs-fixed: (CR)\nCVE-Fixed: CVE-2017-8262\n\nChange-Id: Id72c82bf98c094ecbd4722813c732a998dcbb188\nSigned-off-by: Tarun Karra <tkarra@codeaurora.org>\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>\nSigned-off-by: Ashwin Pathmudi <jfxr63@motorola.com>\nReviewed-on: https://gerrit.mot.com/1015496\nSLTApproved: Slta Waiver\nSME-Granted: SME Approvals Granted\nTested-by: Jira Key\nReviewed-by: Bang Nguyen <bangnguyen@motorola.com>\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nSubmit-Approved: Jira Key","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/4c980a9f90a64a5b344fded10c77caa378d036a2"},{"sha":"8721efca54ae7729a61b203fb4d44b6238197666","author":{"name":"Benjamin Chan","email":"57574988578c5e43390d075245253f23de86c4da@codeaurora.org"},"message":"msm: mdss: Add plane_count range check in mdss WFD\n\nFor any given output buffer to the MDSS WFD, it is necessary to check\nthe range of the plane_count against the MAX_PLANES definition, in order\nto avoid any out of bound access.\n\nMot-CRs-fixed: (CR)\nCVE-Fixed: CVE-2017-8272\n\nCRs-Fixed: 2028702\nChange-Id: I4f1497a3a2e4ca2d30fc268e68cfdacc0d8539ea\nSigned-off-by: Benjamin Chan <bkchan@codeaurora.org>\nSigned-off-by: Ashwin Pathmudi <jfxr63@motorola.com>\nReviewed-on: https://gerrit.mot.com/1015497\nSLTApproved: Slta Waiver\nSME-Granted: SME Approvals Granted\nTested-by: Jira Key\nReviewed-by: Bang Nguyen <bangnguyen@motorola.com>\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nSubmit-Approved: Jira Key","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/8721efca54ae7729a61b203fb4d44b6238197666"},{"sha":"8e3a1ce056403d0deea0994e2733b3c659a29768","author":{"name":"Benjamin Chan","email":"57574988578c5e43390d075245253f23de86c4da@codeaurora.org"},"message":"msm: mdss: Add plane_count limit check for mdss_rotator buffer\n\nFor each input and output buffer given to mdss rotator, it is necessary\nto check the range of the plane_count value against the MAX_PLANES\ndefinition, in order to avoid any plane array out of bound access.\n\nMot-CRs-fixed: (CR)\nCVE-Fixed: CVE-2017-8271\n\nCRs-Fixed: 2028681\nChange-Id: I117bf5daead17e5e97c62c6dc8e21d1fcc9d8e74\nSigned-off-by: Benjamin Chan <bkchan@codeaurora.org>\nSigned-off-by: Ashwin Pathmudi <jfxr63@motorola.com>\nReviewed-on: https://gerrit.mot.com/1015498\nSLTApproved: Slta Waiver\nSME-Granted: SME Approvals Granted\nTested-by: Jira Key\nReviewed-by: Bang Nguyen <bangnguyen@motorola.com>\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nSubmit-Approved: Jira Key","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/8e3a1ce056403d0deea0994e2733b3c659a29768"},{"sha":"7a50c1a44d0b2618bdf9728bb946598fc9f699f5","author":{"name":"Ingrid Gallardo","email":"f8768943cc1fe8d54da918ca5d2e69043d070211@codeaurora.org"},"message":"msm: mdss: fix race condition in mdp debugfs\n\nFix race condition in mdp debugfs properties\nduring the read and write of the panel and\nmdp registers. This race condition can cause\naccessing memory out bounderies.\n\nMot-CRs-fixed: (CR)\nCVE-Fixed: CVE-2017-8266\n\nChange-Id: I97a90a154237343d4aaf237c11f525bcc2c3a8e3\nSigned-off-by: Ingrid Gallardo <ingridg@codeaurora.org>\nSigned-off-by: Ashwin Pathmudi <jfxr63@motorola.com>\nReviewed-on: https://gerrit.mot.com/1015499\nSLTApproved: Slta Waiver\nSME-Granted: SME Approvals Granted\nTested-by: Jira Key\nReviewed-by: Bang Nguyen <bangnguyen@motorola.com>\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nSubmit-Approved: Jira Key","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/7a50c1a44d0b2618bdf9728bb946598fc9f699f5"},{"sha":"37729e0b488b2a5de5a329b0901d59589aa5f3ab","author":{"name":"Harsh Sahu","email":"062485454ca52b6187093d2ba1bac5da25a47a5e@codeaurora.org"},"message":"msm: mdss: fix race condition during mdp debugfs release\n\nFix race condition in the release of the mdp debugfs functions\npanel_debug_base_release and mdss_debug_base_release by adding\nthe lock for unpreempted freeing of the buffer so that multiple\nconcurrent processes cannot affect the release which can possibly\nlead to use-after-free operation on the buffer.\n\nMot-CRs-fixed: (CR)\nCVE-Fixed: CVE-2017-8266\n\nChange-Id: I9586081b65ae2eb0e7f6e30c606ee748ae9ef7e8\nSigned-off-by: Harsh Sahu <hsahu@codeaurora.org>\nSigned-off-by: Ashwin Pathmudi <jfxr63@motorola.com>\nReviewed-on: https://gerrit.mot.com/1015500\nSME-Granted: SME Approvals Granted\nSLTApproved: Slta Waiver\nTested-by: Jira Key\nReviewed-by: Bang Nguyen <bangnguyen@motorola.com>\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nSubmit-Approved: Jira Key","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/37729e0b488b2a5de5a329b0901d59589aa5f3ab"},{"sha":"7cc3d6f1168afc2c28fcde725d8312041bfa37cb","author":{"name":"Dennis Cagle","email":"1c958d084f7278f93cbdf16f75fd9d20fa6ac1af@codeaurora.org"},"message":"msm: camera2: cpp: Fix out-of-bounds frame or command buffer access\n\nWhen user application provides invalid (out of range) stripe size and\nstripe indices, while submitting  requests for the stripe based image\nprocessing by the CPP kernel driver, the driver could  perform out of\nbounds access of the internal buffers.\n\nThis fix ensures that stripe size and indices of frame/command buffer\nare properly validated during the configuration and before processing\nsuch requests through the CPP hardware block.\n\nBug: 34620535\nCRs-Fixed: 2002207\nCVE-fixed: CVE-2017-8268\nMot-CRs-fixed: (CR), (CR)\n\nChange-Id: Ib79e36fb507d8e75d8fc28afb990020a0e1bf845\nSigned-off-by: Ravi kumar Koyyana <rkoyyana@codeaurora.org>\nSigned-off-by: Dennis Cagle <d-cagle@codeaurora.org>\nSigned-off-by: Srikanth A R <arsrikan@motorola.com>\nReviewed-on: https://gerrit.mot.com/1011594\nSME-Granted: SME Approvals Granted\nSLTApproved: Slta Waiver\nTested-by: Jira Key\nReviewed-by: Robert Kubicki <w17311@motorola.com>\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nSubmit-Approved: Jira Key","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/7cc3d6f1168afc2c28fcde725d8312041bfa37cb"},{"sha":"3af5c7183fe4cd2cde5f1249cff712167e7c61b4","author":{"name":"Utkarsh Saxena","email":"a77f4916ff39fc133abd3bb49cf55a0c1b56ef54@codeaurora.org"},"message":"msm: ipa: Fix for missing int overflow check in the refcount library\n\nOverflow of reference counter can lead to memory leak.\n\nBefore incrementing the reference count, check with\nU32_MAX and return for error check.\n\nMot-CRs-fixed:(CR)\nCVE-fixed: CVE-2017-0746\n\nBug: 35467471\nCRs-Fixed: 2029392\nChange-Id: Ib96d36574ee086ec73c9836110cb2c98e8ae3d66\nAcked-by: Mohammed Javid <mjavid@qti.qualcomm.com>\nSigned-off-by: Utkarsh Saxena <usaxena@codeaurora.org>\nReviewed-on: https://gerrit.mot.com/1024900\nSME-Granted: SME Approvals Granted\nSLTApproved: Slta Waiver\nTested-by: Jira Key\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nSubmit-Approved: Jira Key","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/3af5c7183fe4cd2cde5f1249cff712167e7c61b4"},{"sha":"e499e8585afd36dcac13c542236aa2d8c041cd60","author":{"name":"Sunil Khatri","email":"c2fa09c6a63ee27656efbed7bd5e770f84d009d0@codeaurora.org"},"message":"msm: kgsl: Fix the race between context create and destroy\n\nHold the context lock before updating the context id in\nparam->drawctxt_id to avoid race condition between context\ncreation and context destroy.\n\nMot-CRs-fixed: (CR)\nCVE-Fixed: CVE-2017-9682\n\nChange-Id: Ic26d3e5b68078c02d15c38080b1a262ea4b1f7fe\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>\nSigned-off-by: Ashwin Pathmudi <jfxr63@motorola.com>\nReviewed-on: https://gerrit.mot.com/1025661\nSLTApproved: Slta Waiver\nSME-Granted: SME Approvals Granted\nTested-by: Jira Key\nReviewed-by: Bang Nguyen <bangnguyen@motorola.com>\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nSubmit-Approved: Jira Key","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/e499e8585afd36dcac13c542236aa2d8c041cd60"},{"sha":"5167b4f4b3e5d4cd739cf71741b2f03473c4d182","author":{"name":"Harsh Sahu","email":"062485454ca52b6187093d2ba1bac5da25a47a5e@codeaurora.org"},"message":"msm: mdss: fix memcpy source and dest memory buffer size mismatch\n\nCurrently memcpy is copying from a bigger memory size to a smaller\nmemory size. This change corrects this issue by performing the\nmemcopy restricted to the smaller of the src or dest memory buffer.\n\nMot-CRs-fixed: (CR)\nCVE-Fixed: CVE-2017-9678\n\nChange-Id: Ibbe5665083799a4262d3cfbb06f94f3e35e03748\nSigned-off-by: Harsh Sahu <hsahu@codeaurora.org>\nSigned-off-by: Ashwin Pathmudi <jfxr63@motorola.com>\nReviewed-on: https://gerrit.mot.com/1025662\nSME-Granted: SME Approvals Granted\nSLTApproved: Slta Waiver\nTested-by: Jira Key\nReviewed-by: Bang Nguyen <bangnguyen@motorola.com>\nReviewed-by: Igor Kovalenko <igork@motorola.com>\nSubmit-Approved: Jira Key","distinct":true,"url":"https://api.github.com/repos/john-tho/kernel-msm/commits/5167b4f4b3e5d4cd739cf71741b2f03473c4d182"}]}
{"actor":{"display_login":"john-tho"}}