{"push_id":2478811907,"size":21,"distinct_size":0,"ref":"refs/heads/cm-14.1","head":"f7b3563fc8dc8d406a82a22cc860025d24830184","before":"6d306a3ab3603508a18a59cbb2cc8fffca1702cf","commits":[{"sha":"da983ccb0e1114206b55a549d9ef0273374866e7","author":{"name":"Marissa Wall","email":"dfdd147e0d31ffa94f60174fe3bbdbabee0568c5@google.com"},"message":"BACKPORT: USB: core: harden cdc_parse_cdc_header\n\nAndrey Konovalov reported a possible out-of-bounds problem for the\ncdc_parse_cdc_header function.  He writes:\n\tIt looks like cdc_parse_cdc_header() doesn't validate buflen\n\tbefore accessing buffer[1], buffer[2] and so on. The only check\n\tpresent is while (buflen > 0).\n\nSo fix this issue up by properly validating the buffer length matches\nwhat the descriptor says it is.\n\n(cherry picked from commit 2e1c42391ff2556387b3cb6308b24f6f65619feb)\n\n(The original patch fixed the generic cdc_parser_cdc_header function.\nThat generic function did not exist in 3.10 but there are a couple\ncdc parsers that suffer from the same underlying problem.)\n\nBug: 69052594\nChange-Id: I75b16a1eaad8a06bd9ef1db66148f72e965a341f\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Marissa Wall <marissaw@google.com>","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/da983ccb0e1114206b55a549d9ef0273374866e7"},{"sha":"ae37f6e9f0cadfa0da68c2e26915053cc48779ac","author":{"name":"Vignesh Viswanathan","email":"2144e6197159821ddfaf7f09949f422f621ff36c@codeaurora.org"},"message":"qcacld-2.0: Fix buffer overrun in function ProcSetReqInternal\n\nIn function ProcSetReqInternal, valueLen is obtained from the\nmessage buffer pParam. This valueLen is used as argument to the\nfunction GetStrValue where the contents of the buffer pParam is\ncopied to pMac->cfg.gSBuffer for valueLen number of bytes. However\nthe array pMac->cfg.gSBuffer is a static array of size CFG_MAX_STR_LEN.\nIf the value of valueLen exceeds CFG_MAX_STR_LEN, a buffer overwrite\nwill occur in GetStrValue.\n\nAdd Sanity check to make sure valueLen does not exceed CFG_MAX_STR_LEN.\n\nBug: 72957177\nChange-Id: I9bf3a502d4b73c37e7b4ece963e7ce493274c893\nCRs-Fixed: 2143847","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/ae37f6e9f0cadfa0da68c2e26915053cc48779ac"},{"sha":"02b24eac87791a9cfb238b5ffa4a5087146343ae","author":{"name":"Aditya Bavanari","email":"db80788cf8b274adaa1dcabee05b99b19e154b04@codeaurora.org"},"message":"ASoC: apr: Add validity check to APR port\n\nAdd boundary checks for APR port received from ADSP.\n\nChange-Id: Ia0a3859b30536bd6aa6030cdbd44c783c9558068\nCRs-Fixed: 2143207\nBug: 72956842\nSigned-off-by: Aditya Bavanari <abavanar@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/02b24eac87791a9cfb238b5ffa4a5087146343ae"},{"sha":"2d21b6136ed6ccd26b667a02340d190cf7f5dbc0","author":{"name":"Eric Biggers","email":"6f6115196800bbe9712b3f04c7e40093bb382fc5@google.com"},"message":"UPSTREAM: KEYS: encrypted: fix buffer overread in valid_master_desc()\n\nWith the 'encrypted' key type it was possible for userspace to provide a\ndata blob ending with a master key description shorter than expected,\ne.g. 'keyctl add encrypted desc \"new x\" @s'.  When validating such a\nmaster key description, validate_master_desc() could read beyond the end\nof the buffer.  Fix this by using strncmp() instead of memcmp().  [Also\nclean up the code to deduplicate some logic.]\n\nCc: linux-stable <stable@vger.kernel.org> # 3.18.y\nCc: Mimi Zohar <zohar@linux.vnet.ibm.com>\nBug: 70526974\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: James Morris <james.l.morris@oracle.com>\nSigned-off-by: Jin Qian <jinqian@google.com>\nSigned-off-by: Steve Pfetsch <spfetsch@google.com>\n(cherry picked from commit 794b4bc292f5d31739d89c0202c54e7dc9bc3add)\n\nChange-Id: I1c7346912feb76f3d6dab6c83c108e5ff59ca78e","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/2d21b6136ed6ccd26b667a02340d190cf7f5dbc0"},{"sha":"374a0e08f2ebd75542cb0f870e22925b66b6a2ad","author":{"name":"Jonathan Solnit","email":"a9d53b9dba7f33613bd11979958e90a887b0ccb2@google.com"},"message":"BACKPORT: net: ipv4: fix for a race condition in raw_sendmsg\n\n[ Upstream commit 8f659a03a0ba9289b9aeb9b4470e6fb263d6f483 ]\n\ninet->hdrincl is racy, and could lead to uninitialized stack pointer\nusage, so its value should be read only once.\n\nBug: 71500434\nChange-Id: I10ae932691e17d8084e2cd42538dcf08f99761e9\nFixes: c008ba5bdc9f (\"ipv4: Avoid reading user iov twice after raw_probe_proto_opt\")\nSigned-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>\nReviewed-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Jonathan Solnit <jsolnit@google.com>","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/374a0e08f2ebd75542cb0f870e22925b66b6a2ad"},{"sha":"fe4f1ef438749bb32918862a1a0deaf7d0584b69","author":{"name":"Peng Xu","email":"886604e01ac4f8d1f4813dbb7bdd557dcbf82bbf@qti.qualcomm.com"},"message":"nl80211: Define policy for packet pattern attributes\n\nDefine a policy for packet pattern attributes in order to fix a\npotential read over the end of the buffer during nla_get_u32()\nof the NL80211_WOWLAN_PKTPAT_OFFSET attribute.\n\nNote that the data there can always be read due to SKB allocation\n(with alignment and struct skb_shared_info at the end), but the\ndata might be uninitialized. This could be used to leak some data\nfrom uninitialized vmalloc() memory, but most drivers don't allow\nan offset (so you'd just get -EINVAL if the data is non-zero) or\njust allow it with a fixed value - 100 or 128 bytes, so anything\nabove that would get -EINVAL. With brcmfmac the limit is 1500 so\n(at least) one byte could be obtained.\n\nCc: stable@kernel.org\nBug: 64403015\nSigned-off-by: Peng Xu <pxu@qti.qualcomm.com>\nSigned-off-by: Jouni Malinen <jouni@qca.qualcomm.com>\n[rewrite description based on SKB allocation knowledge]\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\n\nChange-Id: I6d8975ba163808481637a21fd6e57f917ec10ed4\nGit-commit: ad670233c9e1d5feb365d870e30083ef1b889177\nGit-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git\nCRs-fixed: 2116387\n[Backport: Fix conflicts]\nSigned-off-by: Vidyullatha Kanchanapally <vidyullatha@codeaurora.org>\nSigned-off-by: Peng Xu <pxu@codeaurora.org>\nSigned-off-by: Srinivas Dasari <dasaris@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/fe4f1ef438749bb32918862a1a0deaf7d0584b69"},{"sha":"e9a0d6ff4614b5f87a85e5220c170f2ef0770ac1","author":{"name":"Ravi Gummadidala","email":"ada8c1c5264329aa061fae385dcb53ffb1ecc11c@codeaurora.org"},"message":"msm: ipa: fix header table reset bug\n\nHeader table reset was also resetting the \"default\" header\nleading to failures in Header Insertion unit tests. This\ncommit fixes that bug.\n\nChange-Id: I8c412febb27f6077e250936015b3f5c68f3ce61e\nSigned-off-by: Ravi Gummadidala <rgummadi@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/e9a0d6ff4614b5f87a85e5220c170f2ef0770ac1"},{"sha":"94028c7429271a087168420199d3ef58cb201a28","author":{"name":"Ghanim Fodi","email":"7d29b39ba490ecdf77701b23f4a7cec4bc0c4d3d@codeaurora.org"},"message":"msm: ipa: Fix the handling of default IPA header\n\nDefault IPA header is added or deleted from the driver\ndirectly and not by user space application. This change\nprevents adding/deleting it from user application which\nmay cause inconsistencies in the driver. Also the change\nfixes the header reset function to skip on the correct\ndefault header.\n\nBug: 72957269\nChange-Id: Iea0984c86f89d8f8ef53b5e14bb6df42c0bd51e1\nCRs-fixed: 2151146\nSigned-off-by: Ghanim Fodi <gfodi@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/94028c7429271a087168420199d3ef58cb201a28"},{"sha":"5275834c664e371c08bcba514ad17e3406693d95","author":{"name":"Tiger Yu","email":"62f72082223e4c26deb23937228d00ac28370ed2@codeaurora.org"},"message":"qcacld-2.0: Fix potential buffer overflow in ol_rx_flush_handler\n\nCheck for the validity of tid when received the htt message of\nHTT_T2H_MSG_TYPE_RX_FLUSH & HTT_T2H_MSG_TYPE_RX_PN_IND from firmware\nto ensure the buffer overflow does not happen.\n\nAnd correct the sequence number type from signed int to unsigned.\n\nBug: 72957235\nChange-Id: I1d333acddfcfafcd23d8ba8da676384d28d0a471\nCRs-Fixed: 2149399","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/5275834c664e371c08bcba514ad17e3406693d95"},{"sha":"78430813eb9f072282152d9c45e7141381e4a26e","author":{"name":"Thierry Strudel","email":"c11fa6a468cd0603c031ecceca207a4a86f97358@google.com"},"message":"qcacld-2.0: remove log spam\n\nChange-Id: I9716bd776dda841d202872170f8db9afbadcc32d\nSigned-off-by: Thierry Strudel <tstrudel@google.com>","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/78430813eb9f072282152d9c45e7141381e4a26e"},{"sha":"0c7fe65dca8e21a053ebd3acd49c102a1e68c9c8","author":{"name":"Srinivas Girigowda","email":"d262bfc6295007ec2cc8b9f8b60248904c609ad1@codeaurora.org"},"message":"qcacld-2.0: Add proto tracing for ARP, NS and NA packets\n\n[cherry-pick only the logging change in wma_wow_wakeup_host_event]\n\nAdd proto tracing for ARP, ICMPv6 NS and ICMPv6 NA\npackets.\n\nChange-Id: I7735d6d6be1e5c7e0249ee99b30316cfbc69a3f9\nCRs-Fixed: 1056328\nBug: 30894488\nSigned-off-by: Srinivas Girigowda <sgirigow@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/0c7fe65dca8e21a053ebd3acd49c102a1e68c9c8"},{"sha":"0dc2ff8e8faf92ecdfec1e710cb443c506a9d6e3","author":{"name":"Srinivas Girigowda","email":"d262bfc6295007ec2cc8b9f8b60248904c609ad1@codeaurora.org"},"message":"qcacld-2.0: Add sanity check for vdev_id in wma_wow_wakeup_host_event\n\nCurrently wake_info->vdev_id, recevied from the FW, is directly used\nto refer to wma->interfaces without validating if the vdev_id is valid.\n\nAdd sanity check to make sure vdev_id is less than max_bssid before\nusing it.\n\nChange-Id: If7612be6c5b3ca4fc541b4168995f58e7f92f3e5\nCRs-Fixed: 2114363\nBug: 71501687\nSigned-off-by: Srinivas Girigowda <sgirigow@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/0dc2ff8e8faf92ecdfec1e710cb443c506a9d6e3"},{"sha":"e836be74dfbd0baf6366627e811d4d326165a7ae","author":{"name":"Abhinav Kumar","email":"9bdc05cb562779fe30fe795b37f1771483a247be@codeaurora.org"},"message":"qcacld-2.0: Fix Integer overflow in wma_tbttoffset_update_event_handler()\n\nCurrently, value of param_buf->num_tbttoffset_list is received\nfrom FW is used to allocate the memory for local buffer to store\ntbtt offset list If the value of param_buf->num_tbttoffset_list\nis very large then during memory allocation input argument can be\noverflowed.As a result of this integer overflow, a heap overwrite\ncan occur during memory copy.\n\nAdd sanity check to make sure param_buf->num_tbttoffset_list is\nnot exceed the maximum limit.\n\nBug: 71501686\nChange-Id: Ie543c49391468f4af4aaee50c6d5cf3397480f43\nCRs-Fixed: 2114336\nSigned-off-by: Ecco Park <eccopark@google.com>","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/e836be74dfbd0baf6366627e811d4d326165a7ae"},{"sha":"6c791dff59b107c6e26ff53d1b1878f45615650d","author":{"name":"Poddar, Siddarth","email":"0567d9da6014b5f5289da7cfef1dfbd5e58cd336@codeaurora.org"},"message":"qcacld-2.0: Fix potential buffer overflow in process_tx_info\n\nCheck for buffer overflow for pktlog messages in process_tx_info\nfunction before doing mem copy.\n\nBug: 72957136\nChange-Id: Ic8ee17fa03a987468405c9978aa06ee849fa5661\nCRs-Fixed: 2154331","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/6c791dff59b107c6e26ff53d1b1878f45615650d"},{"sha":"7b0243530e0f198eb5868c04a1bed5d581266ac5","author":{"name":"Tiger Yu","email":"62f72082223e4c26deb23937228d00ac28370ed2@codeaurora.org"},"message":"qcacld-2.0: Fix potential buffer overflow in htt_t2h_lp_msg_handler\n\nCheck for the validity of peer_id when received the htt message of\nHTT_T2H_MSG_TYPE_PEER_MAP or HTT_T2H_MSG_TYPE_PEER_UNMAP from firmware\nto ensure the buffer overflow does not happen.\n\nBug: 72956997\nChange-Id: I2c589e9f8a99ba18b7ee629b80732fbc5e2c1f44\nCRs-Fixed: 2147119","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/7b0243530e0f198eb5868c04a1bed5d581266ac5"},{"sha":"63227a2a5e3f8d6d5ab8f5bab841793676975836","author":{"name":"gaurank kathpalia","email":"61f605b1a2b304adce113718c4626f77d7c2eb9b@codeaurora.org"},"message":"qcacld-2.0: Fix buffer overwrite in wma_extscan_rsp_handler\n\nIn function \"wma_extscan_start_stop_event_handler\",\nvariable \"event\" is coming from the FW, whose content\nis copied to variable \"buf\".Variable \"vdev_id\" equals\nto \"event->vdev_id\". \"vdev_id\" is a uint8_t value,\nwith no limit check, so a buffer overwrite is possible.\n\nAdd sanity check for vdev-id  to avoid buffer overwrite\n\nBug: 71501691\n\nChange-Id: I59aee41e7560e25dfd6fafbc8042611dbcd5781e\nCRs-Fixed: 2115207\nSigned-off-by: Ahmed ElArabawy <arabawy@google.com>","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/63227a2a5e3f8d6d5ab8f5bab841793676975836"},{"sha":"5b7fd0fb7549c9c3d5f11a1ad9e91547fdefc494","author":{"name":"Bala Venkatesh","email":"a73d87798543bf43786d1828a756236e75e3f8fe@codeaurora.org"},"message":"qcacld-2.0: Check for valid vdev ID in SWBA event handler\n\nAfter deriving the vdev_id from the vdev map in\nwma_beacon_swba_handler check for the validity\nof the vdev_id\n\nBug: 71501695\nChange-Id: Ieaa8b9d863d5dfa0ced12565771fef3b07120015\nCRs-Fixed: 2115134\nSigned-off-by: Ecco Park <eccopark@google.com>","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/5b7fd0fb7549c9c3d5f11a1ad9e91547fdefc494"},{"sha":"c2edab68cfccfce44ce09ae552503c87dfb2241c","author":{"name":"Srinivas Girigowda","email":"d262bfc6295007ec2cc8b9f8b60248904c609ad1@codeaurora.org"},"message":"qcacld-2.0: Add sanity check for vdev id to prevent OOB access\n\nAdd sanity check for vdev id in wma_vdev_start_resp_handler() to prevent\nout of bound memory access.\n\nChange-Id: I2a496e3f5b546d20813e7fce208c037f4bf68e42\nCRs-Fixed: 2120424\nBug: 71501694\nSigned-off-by: Srinivas Girigowda <sgirigow@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/c2edab68cfccfce44ce09ae552503c87dfb2241c"},{"sha":"bf92a65880ed68ae726924ad0e8aca6168ee5760","author":{"name":"Skylar Chang","email":"8aceadea1e0c82daf6b8c0d881366d29d83d4981@codeaurora.org"},"message":"msm: ipa3: add lock for num_q6_rule\n\nThere is a race condition be observed\non global variable num_q6_rule used in\nipa wan-driver. The fix is to add lock\nto prevent different threads are accessing\nit at the same time.\n\nBug: 68992477\nChange-Id: I7b91b85ceaace0721785d1ac70f78727e2c121f1\nSigned-off-by: Skylar Chang <chiaweic@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/bf92a65880ed68ae726924ad0e8aca6168ee5760"},{"sha":"f38a28f6011507c5cb30d91419d7f94452f731dd","author":{"name":"Insun Song","email":"2775a652ae985849e81932d5eaa3cfb3a7e99a5a@broadcom.com"},"message":"net: wireless: bcmdhd: remove obsoleted wl_cfgvendor_priv_string_handler\n\ncompletely replaced to wl_cfgvendor_get_feature_set_matrix\nand it's not used anymore.\n\nSigned-off-by: Insun Song <insun.song@broadcom.com>\nBug: 71359108\nChange-Id: Iaf6f99842e2925202a800f96330a182f3481f114","distinct":false,"url":"https://api.github.com/repos/github-cygwin/android_kernel_samsung_apq8084/commits/f38a28f6011507c5cb30d91419d7f94452f731dd"}]}
{"actor":{"display_login":"github-cygwin"}}