{"push_id":2956535712,"size":9,"distinct_size":9,"ref":"refs/heads/android-pie","head":"9eb90b00af9885a85f83d2d35ca94e1aceb9289f","before":"a86f5bc8de4b91e810eb2a19286fe9392f41750c","commits":[{"sha":"962e81be0bf01e61ce618bfbef431da631aa5b21","author":{"name":"Tharun Kumar Merugu","email":"012990c70e5a1c15d9a3a222f92d1c1f726a82e2@codeaurora.org"},"message":"msm: ADSPRPC: Use msm_ion_do_cache_op to flush userspace buffers\n\nRemove the use of dmac_flush_range for userspace buffers and add\nmsm_ion_do_cache_op for flushing user space buffers.\n\nBug: 112277889\nChange-Id: Ice73eafac840bd1cabee0a2bfc8a641832a7d0c8\nAcked-by: Bharath Kumar <bkumar@qti.qualcomm.com>\nSigned-off-by: Tharun Kumar Merugu <mtharu@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/purez-kernel/kernel-google-marlin/commits/962e81be0bf01e61ce618bfbef431da631aa5b21"},{"sha":"703ca6bddbf3823a26b1cf93054748f62c9b2149","author":{"name":"John Dias","email":"0bf0aa9cb6b07050fd8ca7e9a5b8b18ec52aef5b@google.com"},"message":"Merge branch 'android-msm-marlin-3.18-pi' into android-msm-marlin-3.18-pi-security-next\n\nMerging before October security patches.\n\nBug: 112260671\nChange-Id: Id6935e9301aa82c1b0f5c3fbf9656d3f9eacc42a\nSigned-off-by: John Dias <joaodias@google.com>","distinct":true,"url":"https://api.github.com/repos/purez-kernel/kernel-google-marlin/commits/703ca6bddbf3823a26b1cf93054748f62c9b2149"},{"sha":"bc782cded23900c0d2d3818139bc3c39ee9df136","author":{"name":"Woody Lin","email":"a92fb446640ac22b30121049539b4559d2224a2c@google.com"},"message":"cpufreq_stats: Reset cpufreq_task_stats right after dup_task_struct\n\nThe `time_in_state' on current task (caller of fork) might be freed\nbecause of error handler `bad_fork_free' of copy_process:\n\n    p = dup_task_struct(current, node);\n    ...\n    ... /* Field `time_in_state' on newly created `p' was cloned from\n         * `current' */\n    ...\n    if /* some error condition */\n        goto bad_fork_free; ------> (0)\n    ...\n    retval = sched_fork(clone_flags, p);\n        /* `time_in_state' is only reset by sched_fork ->\n         * __sched_fork -> cpufreq_task_stats_init, but which is not\n         * reached in this scenario.  */\n    ...\nbad_fork_free:  <------------------ (0)\n    free_task(p);\n    --> cpufreq_task_stats_free(tsk);  /* p == tsk */\n        --> kfree(tsk->time_in_state); /* `time_in_state' of `current' is freed unexpectedly */\n\nLater, when current task ifself exits or next failure of copy_process\nhappens, the `time_in_state' is freed again. Thus \"KASAN: double-free or\ninvalid-free\" is detected.\n\n ==================================================================\n BUG: KASAN: double-free or invalid-free in           (null)\n\n CPU: 4 PID: 16252 Comm: syz-executor Tainted: G         C      4.4.116-gcff1ae5d4f72 #1\n Hardware name: Qualcomm Technologies, Inc. MSM8998 v2.1 (DT)\n Call trace:\n [<>] dump_backtrace+0x0/0x34c\n [<>] show_stack+0x1c/0x24\n [<>] dump_stack+0xb8/0xe8\n [<>] print_address_description+0x94/0x334\n [<>] kasan_report_double_free+0x74/0x8c\n [<>] kasan_slab_free+0x164/0x1c0\n [<>] kfree+0x8c/0x2b4\n [<>] process_notifier+0xb8/0xe4\n [<>] blocking_notifier_call_chain+0x9c/0xf4\n [<>] profile_task_exit+0x2c/0x34\n [<>] do_exit+0x3c/0x110c\n [<>] do_group_exit+0x7c/0x128\n [<>] get_signal+0x374/0x904\n [<>] do_signal+0x230/0x1408\n [<>] do_notify_resume+0x84/0x88\n [<>] work_pending+0x10/0x14\n\n Allocated by task 16248:\n [<>] save_stack_trace_tsk+0x0/0x204\n [<>] save_stack_trace+0x20/0x28\n [<>] kasan_kmalloc.part.5+0x50/0x124\n [<>] kasan_kmalloc+0xc4/0xe4\n [<>] __kmalloc+0x138/0x29c\n [<>] cpufreq_task_stats_alloc+0x70/0x140\n [<>] sched_fork+0x1b4/0x4e8\n [<>] copy_process.isra.66+0x7a4/0x276c\n [<>] _do_fork+0x98/0x5c8\n [<>] SyS_clone+0x40/0x4c\n [<>] el0_svc_naked+0x24/0x28\n\n Freed by task 16252:\n [<>] save_stack_trace_tsk+0x0/0x204\n [<>] save_stack_trace+0x20/0x28\n [<>] kasan_slab_free+0xb0/0x1c0\n [<>] kfree+0x8c/0x2b4\n [<>] cpufreq_task_stats_free+0x24/0x50\n [<>] free_task+0x28/0x18c\n [<>] copy_process.isra.66+0x800/0x276c\n [<>] _do_fork+0x98/0x5c8\n [<>] SyS_clone+0x40/0x4c\n [<>] el0_svc_naked+0x24/0x28\n\nTo fix this issue, add a `cpufreq_task_stats_init' before `goto\nbad_fork_free' to make sure that all cpufreq stats relative structure\nmembers are initialized before any chance the fields is being freed.\n\nVerify: Not reproducible w/ original fuzz testing.\n\nBug: 111081202\nChange-Id: I585dc28417fee740301e3ae1c1c974e84fdb19fe\nSigned-off-by: Woody Lin <woodylin@google.com>","distinct":true,"url":"https://api.github.com/repos/purez-kernel/kernel-google-marlin/commits/bc782cded23900c0d2d3818139bc3c39ee9df136"},{"sha":"753ee920f8dcd04ad16203f1afef3b8715c1019c","author":{"name":"Daniel Rosenberg","email":"b28fe47f344ea47a742972f6caa7ef1537d21708@google.com"},"message":"ANDROID: sdcardfs: Change current->fs under lock\n\nbug: 111641492\n\nChange-Id: I79e9894f94880048edaf0f7cfa2d180f65cbcf3b\nReported-by: Jann Horn <jannh@google.com>\nSigned-off-by: Daniel Rosenberg <drosen@google.com>","distinct":true,"url":"https://api.github.com/repos/purez-kernel/kernel-google-marlin/commits/753ee920f8dcd04ad16203f1afef3b8715c1019c"},{"sha":"43be8f8b6710bab5f559d9c33b90bd4a4360d543","author":{"name":"Daniel Rosenberg","email":"b28fe47f344ea47a742972f6caa7ef1537d21708@google.com"},"message":"ANDROID: sdcardfs: Don't use OVERRIDE_CRED macro\n\nThe macro hides some control flow, making it easier\nto run into bugs.\n\nbug: 111642636\n\nChange-Id: I37ec207c277d97c4e7f1e8381bc9ae743ad78435\nReported-by: Jann Horn <jannh@google.com>\nSigned-off-by: Daniel Rosenberg <drosen@google.com>","distinct":true,"url":"https://api.github.com/repos/purez-kernel/kernel-google-marlin/commits/43be8f8b6710bab5f559d9c33b90bd4a4360d543"},{"sha":"63ff89d8e0e62f053695319feed6ff861e5cbd4a","author":{"name":"John Dias","email":"0bf0aa9cb6b07050fd8ca7e9a5b8b18ec52aef5b@google.com"},"message":"Merge branch 'android-msm-marlin-3.18-pi-security-next' into android-msm-marlin-3.18-pi\n\nOctober 2018.1\n\nBug: 112260671\nChange-Id: I6b89feb0f78177848fa4908526c99da4a0980370\nSigned-off-by: John Dias <joaodias@google.com>","distinct":true,"url":"https://api.github.com/repos/purez-kernel/kernel-google-marlin/commits/63ff89d8e0e62f053695319feed6ff861e5cbd4a"},{"sha":"df62d3dc895630cb61ae602468fe1dab9c4f2d7c","author":{"name":"Badhri Jagan Sridharan","email":"b017a7d69662e516c16723ce24fd3155c8d80519@google.com"},"message":"usb: typec: fusb302: lazy acquire power supply objects\n\npower_supply_get_by_name explicitly returns NULL in some cases.\nHence, check for IS_ERR_OR_NULL while querying the status of the\npower_supply object. Also, lazy query for the power supply objects\ninstead of EPROBE_DEFER as there seems to be circular dependency\nwhich prevents the driver probe to never complete when one of the\npower supply is absent.\n\nBug: 112529920\nChange-Id: Ib55521570ccc8ff8a9c530c6b4ae4c314ad4b4cc\nSigned-off-by: Badhri Jagan Sridharan <Badhri@google.com>","distinct":true,"url":"https://api.github.com/repos/purez-kernel/kernel-google-marlin/commits/df62d3dc895630cb61ae602468fe1dab9c4f2d7c"},{"sha":"2513d2388ed10f8dbb80088426c6e402b2e9eb6b","author":{"name":"Jack Wu","email":"fb8a2e805e6309c9f6fd7dd4ae1433b0adc640cc@google.com"},"message":"charger: fix slower charging with NON-PD type-C charger\n\n1. When charger type is detected as NON-PD type-C but usb icl is\n   voted as 1500mA, it will cause wrong charging current.\n   That is fixed by voting correct current.\n2. NON-PD type-C charger with D+/D- open was detected as UNKNOWN charger.\n   Fix it.\n\nBug: 112529920\nChange-Id: I8818d632d64fd3ee82adb31043e68d0652c75003\nSigned-off-by: Jack Wu <wjack@google.com>","distinct":true,"url":"https://api.github.com/repos/purez-kernel/kernel-google-marlin/commits/2513d2388ed10f8dbb80088426c6e402b2e9eb6b"},{"sha":"9eb90b00af9885a85f83d2d35ca94e1aceb9289f","author":{"name":"Zaw Zaw","email":"cc6806aedecbe8ef57a650260a923c1fb500dc2f@outlook.com"},"message":"Merge android-9.0.0_r0.21 into android-pie\n\nAndroid 9.0.0 Release 0.21\n\nChanges in android-9.0.0_r21:\n     2513d23 charger: fix slower charging with NON-PD type-C charger\n     df62d3d usb: typec: fusb302: lazy acquire power supply objects\n     43be8f8 ANDROID: sdcardfs: Don't use OVERRIDE_CRED macro\n     753ee92 ANDROID: sdcardfs: Change current->fs under lock\n     bc782cd cpufreq_stats: Reset cpufreq_task_stats right after dup_task_struct\n\nConflicts:\n\tkernel/fork.c\n\nSigned-off-by: Zaw Zaw <mczawzaw12@outlook.com>","distinct":true,"url":"https://api.github.com/repos/purez-kernel/kernel-google-marlin/commits/9eb90b00af9885a85f83d2d35ca94e1aceb9289f"}]}
{"actor":{"display_login":"zawzaww"}}