{"push_id":2650309151,"size":168,"distinct_size":1,"ref":"refs/heads/oreo-fk-luis-powersave","head":"228a1e171b1dcb6571087e1b345b4e3f4908523b","before":"bbb84576aa5147ee871fc700beb0b27d24a209b1","commits":[{"sha":"55335ac3180920d14819370a8ec19770fab8fd55","author":{"name":"Vamsi Krishna Samavedam","email":"47b0e29304cd078485ecf21b4f20d61eb25fd047@codeaurora.org"},"message":"dwc3-msm: Introduce sysfs param to indicate usb compliance mode\n\nCurrently usb stack is teared down if no activity is detected for\n10 seconds when floating charger is connected. USB 3.1 compliance\nequipment usually reported as floating charger. Introduce sysfs\nparameter to indicate if usb compliance in progress and do not\ntear down the stack based on this parameter.\n\nChange-Id: I26013c281827f35eac7f21ed68b3880e541d82b9\nSigned-off-by: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>\nSigned-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/55335ac3180920d14819370a8ec19770fab8fd55"},{"sha":"1f070b0d9251b30df855a35e7b4cc69db7675c9b","author":{"name":"Anurag Chouhan","email":"90a8553e75e87fffbaadb9d19b99f1a5deaf89a1@codeaurora.org"},"message":"icnss: Avoid qmi exchange when fw is down\n\nCurrently wlan Host driver call exported API's which\ninvoke qmi exchanges irrespective of the firmware status\nwhich leads to QMI timeouts.\nTo address this issue avoid sending qmi request to\nfirmware when firmware is down.\n\nCRs-Fixed: 2175302\nChange-Id: Ie5e340cebf7ee7f6143472e7dca0dfd9600d1b7d\nSigned-off-by: Anurag Chouhan <achouhan@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/1f070b0d9251b30df855a35e7b4cc69db7675c9b"},{"sha":"b8d56658fdbab541782157125d1997d164e8fba5","author":{"name":"Camus Wong","email":"f5d1d19861627e9585a3e19af2df24b61ce01e3c@codeaurora.org"},"message":"DRM: SDE: Fix potential buffer overflow in SDE encoder\n\n_sde_encoder_misr_set function doesn't validate \"count\" argument.\nThis change add logic to check count against the MAX buffer size.\n\nChange-Id: I60d1784c73a182f47da93510f63e1fd34236cd45\nSigned-off-by: Camus Wong <camusw@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/b8d56658fdbab541782157125d1997d164e8fba5"},{"sha":"e74911261a19a70b8526f734d96b74f003a64cd9","author":{"name":"Abhinav Kumar","email":"9bdc05cb562779fe30fe795b37f1771483a247be@codeaurora.org"},"message":"qcacmn: Add new ini to set min delay btw scan and reason bit-mask\n\nAdd ini \"min_delay_btw_scans\" to set minimum duration allowed between\ntwo consecutive roam scans. Fw should not allow roam scan if duration\nbetween two consecutive roam scan is less than min_delay_btw_scan.\n\nAdd ini \"roam_trigger_reason_bitmask\" to set default value of\nbit-mask containing roam_trigger_reasons for which\nmin_delay_btw_scans constraints should be apply.\n\nPass value of min_delay_btw_scans and roam_trigger_reason_bitmask\nto fw.\n\nChange-Id: I2397467a13a720e763d1181d8cd50c571f861366\nCRs-Fixed: 2221785","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/e74911261a19a70b8526f734d96b74f003a64cd9"},{"sha":"6c42bd01ea979f9c3e59a19d8935781a653efc1c","author":{"name":"Hemant Kumar","email":"427b3e89cfa4833e90373054043f85c2b5772665@codeaurora.org"},"message":"usb: phy-msm-susb-qmp: power down phy upon disconnect notification\n\nUSB type-C compliance test 4.5.6(DRP Connect Try.SNK DRP) is failing\nbecause super speed communication(link layer) does not stop upon\nmoving from Attached.SRC to Unattached.SNK state. This happens because\nin Attached.SRC state hub driver performs re-tries to enumerate the\ndevice(exerciser) and upon failure resets the bus. As a result in the\nmiddle of re-tries when cc line gets disconnected, unloading XHCI stack\ntakes longer to finish and auto suspend kicks in afterwards to initiate\nmdwc runtime suspend which powers down ss phy. Hence power down ss phy as\nsoon as phy disconnect notification comes which happens before XHCI driver\nis unloaded.\n\nChange-Id: I83578fb09564f56df2746870c6e39ab86547448d\nSigned-off-by: Hemant Kumar <hemantk@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/6c42bd01ea979f9c3e59a19d8935781a653efc1c"},{"sha":"e58ad5ab88b0fb6f7204be7798fa590724cc25a2","author":{"name":"raghavendra ambadas","email":"0d1dae58f23e775314d087dff72f8e136928d2cc@codeaurora.org"},"message":"msm: mdss: Disable ECG feature for all chipsets\n\nDisbale ECG feature for all chipsets by default, for command\nmode panels when the FPS is less than 30, NOC errors are seen\nwhen some MDP registers are accessed after clocks are turned off\nfrom mdss driver.\n\nChange-Id: Ic90e995d1729411c0b784edab3893ae96b78320a\nSigned-off-by: Raghavendra Ambadas <rambad@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/e58ad5ab88b0fb6f7204be7798fa590724cc25a2"},{"sha":"382756bc52c2d7250887bc2b37de841ee775e4ea","author":{"name":"Dundi Raviteja","email":"2ba666d9162676066cc557b7be95ab722b8153af@codeaurora.org"},"message":"qcacld-3.0: Possble OOB access in hdd_set_limit_off_chan_for_tos()\n\nCurrently, in __wlan_hdd_cfg80211_set_limit_offchan_param() function after\nparsing the 'tos' value from incoming netlink buffer there is no check\nagainst the max value of tos. This tos value is passsed as an argument\nto hdd_set_limit_off_chan_for_tos() function where it is using as an array\nindex for 'limit_off_chan_tbl' variable which is limited to HDD_MAX_AC.\nThis may cause out of bound access.\n\nAdd check to ensure the parsed tos value is not greater than\nor equals to its max value.\n\nChange-Id: I661af1f9559d9bec627594d119423be97978ac2c\nCRs-Fixed: 2222803","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/382756bc52c2d7250887bc2b37de841ee775e4ea"},{"sha":"89e1ed8e874b6807befcbb4487efda9c66d014e3","author":{"name":"Pragaspathi Thilagaraj","email":"12c9935787ab9427327c81c79d00aa3a4cc21278@codeaurora.org"},"message":"qcacld-3.0: Fix integer truncation in convert_wsc_opaque\n\nIn the function convert_wsc_opaque, driver does copy of the\nnew parameters present in the additional IEs of the upstream\nassoc request frame. While copy of the IE length pOld->length to\ncurAddIELen, possible integer truncation could occur, as the\ncurAddIELen is of the type uint8_t whereas pOld->length is of\ntype uint16_t.\n\nChange the data type of curAddIELen to uint16_t. Make changes in\nconvert_p2p_opaque and convert_wfd_opaque as well.\n\nChange-Id: Ic26660fca4a02a265bfc9553b066c7ee42f1d1f4\nCRs-Fixed: 2231770","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/89e1ed8e874b6807befcbb4487efda9c66d014e3"},{"sha":"90440e88db493efb6a302ce4aee536f0a83f550e","author":{"name":"Himanshu Agarwal","email":"9262e84548070f5a2adb21c4f6264f905bad4a0d@codeaurora.org"},"message":"qcacld-3.0: Don't fill any WMA request if target is  not ready\n\nIf any WMA request is queued in wma hold req/vdev resp queue after fw\nhas crashed and sent the corresponding uevent to HOST, request will\ntimeout and if at the same time, SSR is also going on, it may lead to\nvarious issues and crashes.\n\nCheck whether target is ready or not before queuing any request\nin wma hold req/vdev resp queue.\n\nChange-Id: I358841566f858e115b3b04f12f4d8b70b75d1dfc\nCRs-Fixed: 2226497","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/90440e88db493efb6a302ce4aee536f0a83f550e"},{"sha":"e1480a756566a4bdeb9bf5f5d7a464fb5466ff89","author":{"name":"Kiran Gunda","email":"0262b99ca2d1401300f1220bd0206ad94ff780dc@codeaurora.org"},"message":"leds: qpnp-flash-v2: Fix HW_STROBE configuration\n\nAs per the hardware recommendation, configure the LED1 to\nHW_STROBE mode when LED2 or LED3 is configured in HW_STROBE\nmode. This enables hardware strobe option working for LED2/3\nchannels.\n\nCRs-Fixed: 2213325\nChange-Id: I1ceaa7477b8d0c18e03fbdea9d5347d0e75fc0f0\nSigned-off-by: Kiran Gunda <kgunda@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/e1480a756566a4bdeb9bf5f5d7a464fb5466ff89"},{"sha":"6ec7604a2e0fa9c8692212c46216777efd6f1925","author":{"name":"Sachin Bhayare","email":"b3a421eb3be2513778326c2c11b780145dbdf96b@codeaurora.org"},"message":"msm: Allocate fd with O_CLOEXEC flag\n\n(cherry-pick from 'commit 580ec70acac4 (\"fbdev: msm: Allocate fd\n with O_CLOEXEC flag\")') and made similar changes\nfor MDP3.\n\nWhen fd is requested during get_metadata call, create\nfd using O_CLOEXEC flag.\n\nChange-Id: Iaa55927ac04b019ea45fbdfe9c64b10d1f0e3ceb\nSigned-off-by: Nirmal Abraham <nabrah@codeaurora.org>\nSigned-off-by: Sachin Bhayare <sachin.bhayare@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/6ec7604a2e0fa9c8692212c46216777efd6f1925"},{"sha":"e9b770bbcebd10496c5bda6a210d17bc48b30c74","author":{"name":"Dmitry Torokhov","email":"6b8646d310837fed93a129ed3c979b90c7f2674f@gmail.com"},"message":"Input: gtco - fix potential out-of-bound access\n\nparse_hid_report_descriptor() has a while (i < length) loop, which\nonly guarantees that there's at least 1 byte in the buffer, but the\nloop body can read multiple bytes which causes out-of-bounds access.\n\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nReviewed-by: Andrey Konovalov <andreyknvl@google.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nChange-Id: I7b57556c100d28d8f10c03ea5480224e770fb64a\nGit-commit: a50829479f58416a013a4ccca791336af3c584c7\nGit-repo: https://android.googlesource.com/kernel/common\nSigned-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/e9b770bbcebd10496c5bda6a210d17bc48b30c74"},{"sha":"45700a6511435a635372280433a946fdd88b2302","author":{"name":"Linus Torvalds","email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org"},"message":"loop: fix concurrent lo_open/lo_release\n\n范龙飞 reports that KASAN can report a use-after-free in __lock_acquire.\nThe reason is due to insufficient serialization in lo_release(), which\nwill continue to use the loop device even after it has decremented the\nlo_refcnt to zero.\n\nIn the meantime, another process can come in, open the loop device\nagain as it is being shut down. Confusion ensues.\n\nReported-by: 范龙飞 <long7573@126.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Jens Axboe <axboe@kernel.dk>\nGit-commit: ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5\nGit-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\nChange-Id: I965ddcdc2a9d27fd56a54d2886b7c3861c21b05f\nSigned-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/45700a6511435a635372280433a946fdd88b2302"},{"sha":"2fb349bf70e3cee23d8f3add213d3d5940fa419e","author":{"name":"CNSS_WLAN Service","email":"e971b8da39cdffb9fdbb143eb86df67ffd94c57f@qualcomm.com"},"message":"Merge \"qcacld-3.0: Possble OOB access in hdd_set_limit_off_chan_for_tos()\" into wlan-cld3.driver.lnx.1.1.c9","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/2fb349bf70e3cee23d8f3add213d3d5940fa419e"},{"sha":"5a5b9847dc184199ab0084a11d11c1535963cf22","author":{"name":"Eric W. Biederman","email":"8a741aa8cbd77ebc4a56ddb528ce9fd15d42f034@xmission.com"},"message":"net: Fix double free and memory corruption in get_net_ns_by_id()\n\n(I can trivially verify that that idr_remove in cleanup_net happens\n after the network namespace count has dropped to zero --EWB)\n\nFunction get_net_ns_by_id() does not check for net::count\nafter it has found a peer in netns_ids idr.\n\nIt may dereference a peer, after its count has already been\nfinaly decremented. This leads to double free and memory\ncorruption:\n\nput_net(peer)                                   rtnl_lock()\natomic_dec_and_test(&peer->count) [count=0]     ...\n__put_net(peer)                                 get_net_ns_by_id(net, id)\n  spin_lock(&cleanup_list_lock)\n  list_add(&net->cleanup_list, &cleanup_list)\n  spin_unlock(&cleanup_list_lock)\nqueue_work()                                      peer = idr_find(&net->netns_ids, id)\n  |                                               get_net(peer) [count=1]\n  |                                               ...\n  |                                               (use after final put)\n  v                                               ...\n  cleanup_net()                                   ...\n    spin_lock(&cleanup_list_lock)                 ...\n    list_replace_init(&cleanup_list, ..)          ...\n    spin_unlock(&cleanup_list_lock)               ...\n    ...                                           ...\n    ...                                           put_net(peer)\n    ...                                             atomic_dec_and_test(&peer->count) [count=0]\n    ...                                               spin_lock(&cleanup_list_lock)\n    ...                                               list_add(&net->cleanup_list, &cleanup_list)\n    ...                                               spin_unlock(&cleanup_list_lock)\n    ...                                             queue_work()\n    ...                                           rtnl_unlock()\n    rtnl_lock()                                   ...\n    for_each_net(tmp) {                           ...\n      id = __peernet2id(tmp, peer)                ...\n      spin_lock_irq(&tmp->nsid_lock)              ...\n      idr_remove(&tmp->netns_ids, id)             ...\n      ...                                         ...\n      net_drop_ns()                               ...\n\tnet_free(peer)                            ...\n    }                                             ...\n  |\n  v\n  cleanup_net()\n    ...\n    (Second free of peer)\n\nAlso, put_net() on the right cpu may reorder with left's cpu\nlist_replace_init(&cleanup_list, ..), and then cleanup_list\nwill be corrupted.\n\nSince cleanup_net() is executed in worker thread, while\nput_net(peer) can happen everywhere, there should be\nenough time for concurrent get_net_ns_by_id() to pick\nthe peer up, and the race does not seem to be unlikely.\nThe patch fixes the problem in standard way.\n\n(Also, there is possible problem in peernet2id_alloc(), which requires\ncheck for net::count under nsid_lock and maybe_get_net(peer), but\nin current stable kernel it's used under rtnl_lock() and it has to be\nsafe. Openswitch begun to use peernet2id_alloc(), and possibly it should\nbe fixed too. While this is not in stable kernel yet, so I'll send\na separate message to netdev@ later).\n\nChange-Id: I68ff703f471e47672928d8d2b73b6141d452ff05\nCc: Nicolas Dichtel <nicolas.dichtel@6wind.com>\nSigned-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>\nFixes: 0c7aecd4bde4 \"netns: add rtnl cmd to add and get peer netns ids\"\nReviewed-by: Andrey Ryabinin <aryabinin@virtuozzo.com>\nReviewed-by: \"Eric W. Biederman\" <ebiederm@xmission.com>\nSigned-off-by: Eric W. Biederman <ebiederm@xmission.com>\nReviewed-by: Eric Dumazet <edumazet@google.com>\nAcked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nGit-commit: 21b5944350052d2583e82dd59b19a9ba94a007f0\nGit-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\nSigned-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/5a5b9847dc184199ab0084a11d11c1535963cf22"},{"sha":"7d9b814b8366737cca28ab3b0ef36437031b7e65","author":{"name":"Abhinav Kumar","email":"9bdc05cb562779fe30fe795b37f1771483a247be@codeaurora.org"},"message":"qcacld-3.0: Fix to pass appropriate buffer length to unpack WPA IE\n\nIn lim_set_rs_nie_wp_aiefrom_sme_start_bss_req_message, length passed\nto unpack WPA IE is length of WPA IE + 2 bytes extra\n(rsn_ie->rsnIEdata[1] + 2) - 4. So in case of only WPA IE is present\nin assoc request, the WPA IE parser will try to validate the buffer\nbeyond the WPA IE and might fail as the extra 2 bytes of buffer might\ncontains some garbage value.\n\nPass appropriate length to unpack WPA IE.\n\nChange-Id: Ifad6fabf701a82abd4234569d108b4172adf2bcb\nCRs-Fixed: 2217455","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/7d9b814b8366737cca28ab3b0ef36437031b7e65"},{"sha":"a28ed7ee2c9d72ec7c192ad9e0bf1f870bc357e3","author":{"name":"Sourav Mohapatra","email":"401a8fcba49b40960007c9f05f43c0a87dc3ac61@codeaurora.org"},"message":"qcacld-3.0: Allow country change to occur during driver load\n\nIn the current scenario, when the country_code parameter is passed\nwhile driver load, the country change is unsuccesful. This is due to\nthe check in cds_get_reg_domain_from_country_code that returns while\ndriver load is in progress.\n\nRemove the check for driver load as this command needs to be executed\nwhile the driver is in loading state only. Keep checks for only\nrecovering and driver unloading.\n\nChange-Id: I300e44be44df9b8496e83e9d135e5096e492c3e5\nCRs-Fixed: 2205621","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/a28ed7ee2c9d72ec7c192ad9e0bf1f870bc357e3"},{"sha":"148f78f2784c19d5b9caf8559fa9c5b979eead1f","author":{"name":"Abhinav Kumar","email":"9bdc05cb562779fe30fe795b37f1771483a247be@codeaurora.org"},"message":"qcacld-3.0: Add new ini to set delay Hand-off period\n\nAdd new ini item \"ho_delay_for_rx\" to set delay Hand-off\nperiod. For LFR 3.0 roaming scenario, once roam candidate\nis found, firmware waits for minimum this much duration\nto receive pending rx frames from current BSS before\nswitching to new channel for handoff to new AP\n\nChange-Id: Ided9a81e9402259f5df6b42926b3fa336b6bb4d0\nCRs-Fixed: 2221748","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/148f78f2784c19d5b9caf8559fa9c5b979eead1f"},{"sha":"e359db47f1e334886eaaf1d71a4754dd312be01c","author":{"name":"Yeshwanth Sriram Guntuka","email":"970755accd1ea3063de607bbc4dfbb141ee50b64@codeaurora.org"},"message":"qcacld-3.0: Possible buffer overflow in wma_stats_ext_event_handler\n\nCheck for stats ext info data len does not take TLV header\nsize into account which could lead to buffer overflow\nwhen copying data where TLV header size is taken into\naccount.\n\nFix is to subtract TLV header size and stats_ext_info\nsize from max allowed size when validating stats ext\ninfo data length.\n\nChange-Id: I34e35a0aab396af3d93a0f61e0ab6a2da09f22ab\nCRs-Fixed: 2227263","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/e359db47f1e334886eaaf1d71a4754dd312be01c"},{"sha":"2fc3e8a2ae8233690872d313fbfb4c74d0c61daa","author":{"name":"Vignesh Viswanathan","email":"2144e6197159821ddfaf7f09949f422f621ff36c@codeaurora.org"},"message":"qcacld-3.0: Add sanity check variable_data len in update_fils_data\n\nIn function update_fils_data, fils_indication->num_variable_data\nis the actual length of the data present in the array variable_data.\nWhile accessing variable_data array to copy cache identifier, HESSID\nand realm identifiers, the length of the array is not checked and\ncould lead to OOB access.\n\nAdd check to validate remaining data length in variable_data array\nbefore accessing it to copy various fields.\n\nChange-Id: Ifc1f5d55964bcd7fdcc2676ea9c2afede0fe6803\nCRs-Fixed: 2231767","distinct":false,"url":"https://api.github.com/repos/FraEgg/android_kernel_oneplus_msm8998_flash/commits/2fc3e8a2ae8233690872d313fbfb4c74d0c61daa"}]}
{"actor":{"display_login":"FraEgg"}}