)]}' { "log": [ { "commit": "cc4e799a6fc4288e61b72d245ff4cb787e2bdb4b", "tree": "670780d259c1677d5f670548a6da9cded8f301b4", "parents": [ "27159f6baa7294d9b17906c515d5f9c6f303112f" ], "author": { "name": "Stephen Boyd", "email": "sboyd@codeaurora.org", "time": "Tue Jun 03 20:25:27 2014 +0200" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sun Jan 22 20:07:36 2017 +0000" }, "message": "coccinelle: Check for missing NULL terminators in of_device_id tables\n\nFailure to terminate an of_device_id table can lead to confusing\nfailures depending on where the compiler places the array. Add a\ncheck to make sure these tables are terminated. Thanks to Mitchel\nHumpherys for coming up with the pattern initially.\n\nChange-Id: Id6a934ce69aaf60b49cb76b2793f9520aae25a7e\nCc: Mitchel Humpherys \u003cmitchelh@codeaurora.org\u003e\nCc: Gilles Muller \u003cGilles.Muller@lip6.fr\u003e\nCc: Nicolas Palix \u003cnicolas.palix@imag.fr\u003e\nCc: Rob Herring \u003crobh+dt@kernel.org\u003e\nCc: devicetree@vger.kernel.org\nSigned-off-by: Stephen Boyd \u003csboyd@codeaurora.org\u003e\nAcked-by: Grant Likely \u003cgrant.likely@linaro.org\u003e\nSigned-off-by: Julia Lawall \u003cjulia.lawall@lip6.fr\u003e\nSigned-off-by: Michal Marek \u003cmmarek@suse.cz\u003e\n" }, { "commit": "27159f6baa7294d9b17906c515d5f9c6f303112f", "tree": "107743d024d65b7480f69d031515c86f8085af78", "parents": [ "155c98a43910e6d14c95a8e575ccd7e59b31cfac" ], "author": { "name": "boscogh", "email": "pavel.malyutin@gmail.com", "time": "Sun Jan 22 12:28:13 2017 +0000" }, "committer": { "name": "Pavel Malyutin", "email": "pavel.malyutin@gmail.com", "time": "Sun Jan 22 18:14:30 2017 +0000" }, "message": "input: cy8c_cs: Null terminate i2c_device_id struct\n\nafter succeeding the compilation, driver fails to start, causing boot-loop,\nafter cy8c_cs_probe called second time with\nid-\u003ename \u003d \"akm8975\". This seems to happen because driver registered\nwith cy8c_cs_id which missed end tag\n\nChange-Id: Ica264e3661ae293907ddeb774244433013949668\n" }, { "commit": "155c98a43910e6d14c95a8e575ccd7e59b31cfac", "tree": "4d9323b10a973b3f274589fa4e7375789c983e46", "parents": [ "6567b95e2a11d697b4f71b87ba901075cf99eec7" ], "author": { "name": "Azam Sadiq Pasha Kapatrala Syed", "email": "akapatra@codeaurora.org", "time": "Thu Mar 10 15:01:06 2016 -0800" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Fri Jan 20 02:08:00 2017 -0600" }, "message": "msm: camera: Avoid exposing kernel addresses\n\nUsage of %p exposes the kernel addresses, an easy target to\nkernel write vulnerabilities. With this patch currently\n%pK prints only Zeros as address. If you need actual address\necho 0 \u003e /proc/sys/kernel/kptr_restrict\n\nCRs-Fixed: 987011\nChange-Id: I6c79f82376936fc646b723872a96a6694fe47cd9\nSigned-off-by: Azam Sadiq Pasha Kapatrala Syed \u003cakapatra@codeaurora.org\u003e\n" }, { "commit": "6567b95e2a11d697b4f71b87ba901075cf99eec7", "tree": "6bf22a0de8a797bf804342e5cfbde5c64fc695b8", "parents": [ "8b863f28296b9c61f4a552cbceeb540c044c673b" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri Dec 16 13:42:06 2016 -0500" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Mon Jan 16 14:34:57 2017 -0600" }, "message": "sg_write()/bsg_write() is not fit to be called under KERNEL_DS\n\nBoth damn things interpret userland pointers embedded into the payload;\nworse, they are actually traversing those. Leaving aside the bad\nAPI design, this is very much _not_ safe to call with KERNEL_DS.\nBail out early if that happens.\n\nChange-Id: I74658c269c42a4f2023e829a1c8e0ec0804cef9b\nCc: stable@vger.kernel.org\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "8b863f28296b9c61f4a552cbceeb540c044c673b", "tree": "1ff862cbc46695aee5976d534c01b6d80bff1782", "parents": [ "5c60b0872757dd78c8dc64a2948df89c549cc90d" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Mon Dec 28 20:47:08 2015 -0500" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Mon Jan 16 14:34:57 2017 -0600" }, "message": "arm: fix handling of F_OFD_... in oabi_fcntl64()\n\nChange-Id: I75054f88e8c2c10a61b100a20b00bfbf09ff7c4d\nCc: stable@vger.kernel.org # 3.15+\nReviewed-by: Jeff Layton \u003cjeff.layton@primarydata.com\u003e\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n" }, { "commit": "5c60b0872757dd78c8dc64a2948df89c549cc90d", "tree": "7a5facb470033f9afe43b50aadd405b10d878c1c", "parents": [ "364d19878eb0c82cee80f6e9d9d7c870109fe04c" ], "author": { "name": "Philip Pettersson", "email": "philip.pettersson@gmail.com", "time": "Wed Nov 30 14:55:36 2016 -0800" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Mon Jan 16 20:25:14 2017 +0000" }, "message": "packet: fix race condition in packet_set_ring\n\nWhen packet_set_ring creates a ring buffer it will initialize a\nstruct timer_list if the packet version is TPACKET_V3. This value\ncan then be raced by a different thread calling setsockopt to\nset the version to TPACKET_V1 before packet_set_ring has finished.\n\nThis leads to a use-after-free on a function pointer in the\nstruct timer_list when the socket is closed as the previously\ninitialized timer will not be deleted.\n\nThe bug is fixed by taking lock_sock(sk) in packet_setsockopt when\nchanging the packet version while also taking the lock at the start\nof packet_set_ring.\n\nChange-Id: Iec8b20f499134e1edd0f9214aa4dde477d1674e1\nFixes: f6fb8f100b80 (\"af-packet: TPACKET_V3 flexible buffer implementation.\")\nSigned-off-by: Philip Pettersson \u003cphilip.pettersson@gmail.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "364d19878eb0c82cee80f6e9d9d7c870109fe04c", "tree": "b32fd41c29b9acef47609903aef83bc4d3412173", "parents": [ "85d9ed93eaf5d02ad3f0c1e6346b251bcc327033" ], "author": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sat Jan 14 02:57:57 2017 -0600" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sat Jan 14 03:00:27 2017 -0600" }, "message": "msm: HTC: m7/t6: Regenerate defconfigs\n\nResolve a minor warning about reassignment of CONFIGFS_FS\n\nChange-Id: Iae3b6f4b5e20d264f16d96bf791c974e296faed1\n" }, { "commit": "85d9ed93eaf5d02ad3f0c1e6346b251bcc327033", "tree": "e4112a01ab72cf6aef7948317108ab249d2231c7", "parents": [ "737f1a092417a0f64986f62ad649ebd25538729b" ], "author": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sat Jan 14 02:50:44 2017 -0600" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sat Jan 14 03:00:27 2017 -0600" }, "message": "Makefile: update CROSS_COMPILE prefix\n\nResolves script errors when running \u0027make mrproper\u0027\n\nChange-Id: I59c72871c1a608503e7da644b20195a9e7b5dd16\n" }, { "commit": "737f1a092417a0f64986f62ad649ebd25538729b", "tree": "ea308aeaa6ab7cf3294ee4e1c4f4441bf73fc5dc", "parents": [ "c54e86f22a4cc959ccc965dd3fbb036b8f3b320f" ], "author": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sat Jan 07 16:27:49 2017 -0600" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sat Jan 07 16:29:18 2017 -0600" }, "message": "msm: HTC: s4: Enable RPFILTER\n\nChange-Id: I1a52c9242652169317c580aa1f0d765c8088f5ba\n" }, { "commit": "c54e86f22a4cc959ccc965dd3fbb036b8f3b320f", "tree": "69ef94d0e8d61fc0c0ec47f5b255d49f978f106c", "parents": [ "8b378f1ff4c2aed62f6e64b8d802ca9d1f097335" ], "author": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Thu Jan 05 21:02:38 2017 -0600" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sat Jan 07 16:29:15 2017 -0600" }, "message": "cm3629: Use dynamic allocation for large array\n\nAvoid compilation warning concerning frame size of array table_str[].\n\ndrivers/input/misc/cm3629.c: In function \u0027ps_workaround_table_show\u0027:\ndrivers/input/misc/cm3629.c:2245:2: error: implicit declaration of\nfunction \u0027scprintf\u0027 [-Werror\u003dimplicit-function-declaration]\n return scprintf(buf, \"%s\\n\", table_str);\n ^\ndrivers/input/misc/cm3629.c:2246:1: warning: the frame size of 1040\nbytes is larger than 1024 bytes [-Wframe-larger-than\u003d]\nerror, forbidden warning: cm3629.c:2246\n\nChange-Id: I3a4deb0547904f051fc81d0a06feab45205e2331\n" }, { "commit": "8b378f1ff4c2aed62f6e64b8d802ca9d1f097335", "tree": "2e2f181714819906f0f1b7bf7a444818336fa1bf", "parents": [ "16a39eddb18a2daf21142a8fd1fd0cfde76a9397" ], "author": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Thu Jan 05 19:17:33 2017 -0600" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Thu Jan 05 19:29:20 2017 -0600" }, "message": "sunrpc: Resolve uninitialized variable warnings\n\nChange-Id: Icb5134616d814da8b87ffdd199d62947da65b88b\n" }, { "commit": "16a39eddb18a2daf21142a8fd1fd0cfde76a9397", "tree": "5f858f20e445c8a45078ca0ec5f61c4e088e1deb", "parents": [ "e39192331424b6e0695038c1dd57f43efebe9355", "8d1988f838a95e836342b505398d38b223181f17" ], "author": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 30 09:42:57 2016 -0600" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 30 10:00:46 2016 -0600" }, "message": "Merge tag \u0027v3.4.113\u0027 into cm-14.1\n\nChange-Id: Ifa814958fd557299a5442731fc22fcb62139898b\n" }, { "commit": "e39192331424b6e0695038c1dd57f43efebe9355", "tree": "66163ddb33f34926121becac2e78257b827fc100", "parents": [ "4289934b842a6cebd900950b916615bc2b0867b7" ], "author": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Tue Dec 20 23:59:53 2016 +0300" }, "committer": { "name": "doc HD", "email": "doc.divxm@gmail.com", "time": "Wed Dec 21 00:00:04 2016 +0300" }, "message": "m7: Enable SDCARD_FS\n\nChange-Id: Id04820f10859e5498726701ea764ab73ad353dd6\n" }, { "commit": "4289934b842a6cebd900950b916615bc2b0867b7", "tree": "31c2b0e4e28168a156bb427316a23e0be92e79e6", "parents": [ "f505eaa17d839a8b39c7e6ab743784d6cf1db2b3" ], "author": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Thu Dec 08 08:55:15 2016 -0600" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Thu Dec 08 08:55:15 2016 -0600" }, "message": "msm: HTC: enable RPFILTER\n\nChange-Id: I8fc419e5007786ec257a3dafab6c5fab6247225c\n" }, { "commit": "f505eaa17d839a8b39c7e6ab743784d6cf1db2b3", "tree": "3a709e9a8f982d9f1e131212c7d18233612bacae", "parents": [ "95ab41b07a60bd9644832104d43294ee30f5015f" ], "author": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Sun Dec 04 12:32:34 2016 -0600" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Mon Dec 05 06:14:45 2016 -0800" }, "message": "msm: HTC: t6: Enable HTC Validity fingerprint\n\nChange-Id: Ic3cd6569ac04a5b9fe9724a8f1a977f5a837cef3\n" }, { "commit": "95ab41b07a60bd9644832104d43294ee30f5015f", "tree": "ef16510c03be5b0cca137a290042f820ed487bbe", "parents": [ "4c957e44fd84c61e42ef734403fc7b3a6bc78a4e" ], "author": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Sun Dec 04 12:53:51 2016 -0600" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Mon Dec 05 06:14:10 2016 -0800" }, "message": "msm: HTC: t6: Fix board fingerprint derp\n\nChange-Id: I372a806fb78095f8084b64bb2413e67ca659a199\n" }, { "commit": "4c957e44fd84c61e42ef734403fc7b3a6bc78a4e", "tree": "9f22dc70a4d6ebe4db73d000d8c872cf3e25d280", "parents": [ "b4650582fd2e352fca322735a0e91bb39e5b3796" ], "author": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Sun Dec 04 12:31:07 2016 -0600" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Mon Dec 05 06:12:44 2016 -0800" }, "message": "misc: fpr: Add source in Kconfig for Validity driver\n\nChange-Id: Id4c0c8cb9412566a7bc80c656b3cb46bdeee1676\n" }, { "commit": "b4650582fd2e352fca322735a0e91bb39e5b3796", "tree": "9ec3fe3bf709585f84d39863dc097d87765a29c3", "parents": [ "b9fb98fccd0091829ebd4518468a1e372701373d" ], "author": { "name": "Sunil Khatri", "email": "sunilkh@codeaurora.org", "time": "Mon Jun 13 15:49:37 2016 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 07:53:45 2016 -0800" }, "message": "msm: kgsl: Defer adding the mem entry to a process\n\nIf we add the mem entry pointer in the process idr and rb tree\ntoo early, other threads can do operations on the entry by\nguessing the ID or GPU address before the object gets returned\nby the creating operation.\n\nAllocate an ID for the object but don\u0027t assign the pointer until\nright before the creating function returns ensuring that another\noperation can\u0027t access it until it is ready.\n\nBug: 28026365\nCRs-Fixed: 1002974\nChange-Id: Ic0dedbadc0dd2125bd2a7bcc152972c0555e07f8\nSigned-off-by: Jordan Crouse \u003cjcrouse@codeaurora.org\u003e\nSigned-off-by: Sunil Khatri \u003csunilkh@codeaurora.org\u003e\nSigned-off-by: Santhosh Punugu \u003cspunug@codeaurora.org\u003e\n" }, { "commit": "b9fb98fccd0091829ebd4518468a1e372701373d", "tree": "3cafe5938d26122bd9731c7736523bf5564d7a2d", "parents": [ "82aa4dd0adc3214503db8bc952bb19de59819994" ], "author": { "name": "Rajesh Kemisetti", "email": "rajeshk@codeaurora.org", "time": "Tue Apr 19 16:40:31 2016 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:44:20 2016 -0600" }, "message": "msm: kgsl: Add missing checks for alloc size and sglen\n\nIn _kgsl_sharedmem_page_alloc():\n\n- Make len of type size_t to be in line with size.\n- Check for boundary limits of requested alloc size before honoring.\n- Make sure sglen is greater than zero before marking it as end\nof sg list.\n\nBug: 27475454\nChange-Id: I5389bcef3478f2ccf2be5f719049867496235f28\nSigned-off-by: Yuan Lin \u003cyualin@google.com\u003e\n" }, { "commit": "82aa4dd0adc3214503db8bc952bb19de59819994", "tree": "05746f1909db79daa66993eff4ef9c8bb73f51fb", "parents": [ "38d8fed7222e04d9b8a50cb58a2422ba71615a8d" ], "author": { "name": "SaidiReddy Yenuga", "email": "c_saidir@qti.qualcomm.com", "time": "Thu May 26 15:07:50 2016 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:06:15 2016 -0600" }, "message": "wlan: Remove the support for setwpaie ioctl\n\nThis ioctl gets call during the start of SAP/hostapd with wext\ninterface and which is obsolete, currently using nl80211 interface\nfor the same\n\nRemove the code related to setwpaie ioctl\n\nCRs-Fixed: 1000913\nChange-Id: I8b00db1753d8f72192e4cdb88bc7c638007180fe\n" }, { "commit": "38d8fed7222e04d9b8a50cb58a2422ba71615a8d", "tree": "fb733fe6f555e1b8d42338b88a7405921b4c4d83", "parents": [ "5f3f4aab975abd30fe0a31c5ef932e614e216aea" ], "author": { "name": "Kiran Kumar Lokere", "email": "klokere@codeaurora.org", "time": "Thu Nov 07 19:01:17 2013 -0800" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:06:09 2016 -0600" }, "message": "Fix the buffer overflow issue observed in static code analysis.\n\nFix the possible buffer overflow in IE parsing.\n\nChange-Id: I1a386ac09dbe30562fbd84739eb8d61c6a09b001\nCRs-Fixed: 553937, 553941\n" }, { "commit": "5f3f4aab975abd30fe0a31c5ef932e614e216aea", "tree": "bc83c1acbba2acbe9b9c2441ac78b50fd14fe4f4", "parents": [ "d5b224e46a0527dba4b311c289c5d37698be8231" ], "author": { "name": "Girish Gowli", "email": "c_ggowli@qti.qualcomm.com", "time": "Mon Jun 09 19:47:53 2014 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:06:01 2016 -0600" }, "message": "wlan: Deprecate all WAPI ioctls\n\nALL WAPI ioctls WLAN_PRIV_SET_WAPI_MODE, WLAN_PRIV_GET_WAPI_MODE\nWLAN_PRIV_SET_WAPI_ASSOC_INFO, WLAN_PRIV_SET_WAPI_KEY,\nWLAN_PRIV_SET_WAPI_BKID, WLAN_PRIV_GET_WAPI_BKID are not being\nused, hence removing the source code related to all these ioctls\n\nChange-Id: I204cd579b4e29df7e995f30cc0aa8612bc7965ee\nCRs-Fixed: 677410\n" }, { "commit": "d5b224e46a0527dba4b311c289c5d37698be8231", "tree": "14cafee7fd47ca7361b24b0b3e67fe9820420687", "parents": [ "69c6ac5812c00cc0517b8fb612aaf0cd5ae615f5" ], "author": { "name": "Mahesh A Saptasagar", "email": "c_msapta@qti.qualcomm.com", "time": "Tue Oct 27 15:13:46 2015 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:05:57 2016 -0600" }, "message": "wlan: Validate ioctls for valid input length\n\nReturn failure to applications if ioctl is invoked with arguments\nof improper length.\n\nChange-Id: I01589f37996510ee130485ef43e1f36811692e28\nCRs-Fixed: 930542\n" }, { "commit": "69c6ac5812c00cc0517b8fb612aaf0cd5ae615f5", "tree": "854b69909fc7807c107a80c53196d96648c4c3d2", "parents": [ "78cd0cd49979c29cd64bae41f84f6c48d1e9a87b" ], "author": { "name": "Arun Khandavalli", "email": "akhandav@qti.qualcomm.com", "time": "Mon Nov 09 10:28:18 2015 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:05:53 2016 -0600" }, "message": "wlan: validate essid length before processing scan req\n\nPresently we are not validating the length of the essid received\nand directly copying the buffer without size checking.\nPerform bound checking before processing the scan req.\n\nChange-Id: I786e4feb67bf039df3d217138a412da54f51787d\nCRs-fixed: 890228\n" }, { "commit": "78cd0cd49979c29cd64bae41f84f6c48d1e9a87b", "tree": "0280418cc97027f56fc74e590f5547c41c6d08f4", "parents": [ "626c6af397c2ecf95b405a10f48c4c4ab83eded3" ], "author": { "name": "Srinivas Girigowda", "email": "sgirigow@qca.qualcomm.com", "time": "Tue Aug 20 14:00:50 2013 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:05:48 2016 -0600" }, "message": "wlan: Remove support for deprecated api get/set countryrev\n\nCustomer has deprecated the run time configuration\nAPIs get/set countryrev.\n\nChange-Id: I1f071bce41375657635967fb05d961bf828600eb\nCRs-Fixed: 531806\n" }, { "commit": "626c6af397c2ecf95b405a10f48c4c4ab83eded3", "tree": "4fd2facacf1171bc6dcd68de1c4fbe1c351ecbf1", "parents": [ "d736a8ab0a1f1771066aed477d7f4d0dd26c5f6c" ], "author": { "name": "Agarwal Ashish", "email": "ashishka@qti.qualcomm.com", "time": "Tue Jul 22 00:11:55 2014 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:05:43 2016 -0600" }, "message": "wlan: EnableStrictRegulatoryForFCC should be False by default.\n\nCurrently at the time of driver loading EnableStrictRegulatoryForFCC\nis true. With the new rules of FCC, this param should be FALSE\nso that GO/SAP can work on UNII-1 band in FCC domain.\n\nCRs-Fixed: 697408\nChange-Id: I5f73a819f6af4a2682402c56d61488b5412ade84\n" }, { "commit": "d736a8ab0a1f1771066aed477d7f4d0dd26c5f6c", "tree": "540a2a2b7a80f4781712bb3eaa501ad811b3329d", "parents": [ "76c67e6eb5daf3a8cb6d7c3b088e2e6a5742e949" ], "author": { "name": "Sameer Thalappil", "email": "sameert@qca.qualcomm.com", "time": "Wed Sep 25 11:45:07 2013 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:05:39 2016 -0600" }, "message": "wlan: Synchronize country code HDD ioctl\n\nHDD device ioctl for the country code should only return once it\nupdates the wiphy data structure.\n\nChange-Id: I594b81786d5443444cdfafdb12de79e2080d869a\nCRs-Fixed: 530587\n" }, { "commit": "76c67e6eb5daf3a8cb6d7c3b088e2e6a5742e949", "tree": "22ac4fdcde8cef2014042362086ca53f4b6b47e7", "parents": [ "f74efe0da06a5729f7a1d68fa2a73efa0209c963" ], "author": { "name": "Madan Mohan Koyyalamudi", "email": "mkoyyala@qca.qualcomm.com", "time": "Tue Aug 06 22:45:43 2013 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:05:34 2016 -0600" }, "message": "wlan: Correcting timeout value for event driver_crda_req.\n\nThe driver is waiting on event \u0027driver_crda_req\u0027 for 3 seconds\ninstead of 300ms. The function is expecting the the time in\njiffies, so passing the time value in jiffies.\nAdding debug logs in case of timeout happens.\n\nCRs-Fixed: 524133\nChange-Id: Iad7a01bd2537d3bb15c73116c222f067378bafef\n" }, { "commit": "f74efe0da06a5729f7a1d68fa2a73efa0209c963", "tree": "aa699cb29bc4cd1e336c05cdd49ec7b1d3be7f49", "parents": [ "634d7990601f175c57b861449c26fe01b997d4d9" ], "author": { "name": "c_hpothu", "email": "c_hpothu@qti.qualcomm.com", "time": "Tue Oct 28 15:51:18 2014 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:05:29 2016 -0600" }, "message": "wlan: Resolve excessive logging issue.\n\nLowering the log levels to INFO/WARN from ERROR, as these logs\nare not real error logs.\n\nChange-Id: Ie476732fd7325a6fdb7164fbb31a10d84ea32c3b\nCRs-Fixed: 731433\n" }, { "commit": "634d7990601f175c57b861449c26fe01b997d4d9", "tree": "c53064b50fbf5d70401a21ad31d3086c9aff7a15", "parents": [ "b19555c7705ce2a1363cc39351ca6a23d4e90f9c" ], "author": { "name": "kalikinkar dhara", "email": "c_kaliki@qca.qualcomm.com", "time": "Tue Oct 08 16:41:33 2013 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:05:23 2016 -0600" }, "message": "WLAN: same p2p MAC address is observed from mutiple devices\n\nSetting the \"CFG_P2P_DEVICE_ADDRESS_ADMINISTRATED_DEFAULT\" to 1 so that it\nwill avoid have common mac address for multiple device.\n\nChange-Id: I149d59499abff671f69455da930564878e11a573\nCRs-fixed: 547504\n" }, { "commit": "b19555c7705ce2a1363cc39351ca6a23d4e90f9c", "tree": "13c3fbaf80ca4bdd05b5f5848bc9c77dcdfcfc71", "parents": [ "2b3d8ba9a12cd195d3729be51148055ba2d50851" ], "author": { "name": "Hanumantha Reddy Pothula", "email": "c_hpothu@qti.qualcomm.com", "time": "Tue Oct 27 21:41:43 2015 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:05:08 2016 -0600" }, "message": "wlan:Check priviledge permission before processing SET_CHAR_GET_NONE IOCTL\n\nKernel assumes all SET IOCTL commands are assigned with even\nnumbers. But in our WLAN driver, some SET IOCTLS are assigned with\nodd numbers. This leads kernel fail to check, for some SET IOCTLs,\nwhether user has the right permission to do SET operation.\nHence, in driver, before processing SET_CHAR_GET_NONE IOCTLs, making\nsure user task has right permission to process the command.\n\nChange-Id: I7b060bcdc84f7016e8d301e994437a535533a260\nCRs-Fixed: 930935\n" }, { "commit": "2b3d8ba9a12cd195d3729be51148055ba2d50851", "tree": "58dd5a6f0b8979c12b747e6010526595afdbb7e5", "parents": [ "ab019bb5868fb1a4b9eb7da6e58513b38b35d5f5" ], "author": { "name": "Hanumantha Reddy Pothula", "email": "c_hpothu@qti.qualcomm.com", "time": "Tue Oct 27 21:55:28 2015 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:05:03 2016 -0600" }, "message": "wlan:Check priviledge permission before processing SET_PACKET_FILTER IOCTL\n\nKernel assumes all SET IOCTL commands are assigned with even\nnumbers. But in our WLAN driver, some SET IOCTLS are assigned with\nodd numbers. This leads kernel fail to check, for some SET IOCTLs,\nwhether user has the right permission to do SET operation.\nHence, in driver, before processing SET_PACKET_FILTER IOCTL, making\nsure user task has right permission to process the command.\n\nChange-Id: Ib49c3223eacdc90dfe0d45af1aff7c74518990df\nCRs-Fixed: 930937\n" }, { "commit": "ab019bb5868fb1a4b9eb7da6e58513b38b35d5f5", "tree": "8096c2c15b2186e4fec4036ee8aa0f47a6b73b17", "parents": [ "19458957f3907fc4a5c7220b97c9a904b92216e6" ], "author": { "name": "Ratnam Rachuri", "email": "rrachu@codeaurora.org", "time": "Fri Oct 30 19:13:30 2015 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:04:59 2016 -0600" }, "message": "wlan:Check priviledge permission for SET_VAR_INTS_GETNONE IOCTL\n\nKernel assumes all SET IOCTL commands are assigned with even\nnumbers. But in our WLAN driver, some SET IOCTLS are assigned with\nodd numbers. This leads kernel fail to check, for some SET IOCTLs,\nwhether user has the right permission to do SET operation.\nHence, in driver, before processing SET_VAR_INTS_GETNONE, making\nsure user task has right permission to process the command.\n\nChange-Id: Icbdfe69c18c1ab3b75d63e046d5251307a794817\nCRs-Fixed: 930942\n" }, { "commit": "19458957f3907fc4a5c7220b97c9a904b92216e6", "tree": "8932a7e8821ca3ed609cfaf15637c29e33c1d9b6", "parents": [ "6330528e40ebe0be3367ddd4cc9a3cf6ba92cab8" ], "author": { "name": "Hanumantha Reddy Pothula", "email": "c_hpothu@qti.qualcomm.com", "time": "Tue Oct 27 22:55:07 2015 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:04:53 2016 -0600" }, "message": "wlan:Check priviledge permission before processing QCSAP_IOCTL_SETWPSIE\n\nKernel assumes all SET IOCTL commands are assigned with even\nnumbers. But in our WLAN driver, some SET IOCTLS are assigned with\nodd numbers. This leads kernel fail to check, for some SET IOCTLs,\nwhether user has the right permission to do SET operation.\nHence, in driver, before processing QCSAP_IOCTL_SETWPSIE IOCTL,\nmaking sure user task has right permission to process the command.\n\nChange-Id: Ie1c945afb0f109892beda66bab25647d70cc62d7\nCRs-Fixed: 930944\n" }, { "commit": "6330528e40ebe0be3367ddd4cc9a3cf6ba92cab8", "tree": "6f170439fbf336221f9c2a85b06d4c3a284b9772", "parents": [ "30273b3e6bb7ccaa87506d9c65a07b685e4a1c2b" ], "author": { "name": "Hanumantha Reddy Pothula", "email": "c_hpothu@qti.qualcomm.com", "time": "Tue Oct 27 21:58:39 2015 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:04:48 2016 -0600" }, "message": "wlan:Check priviledge permission before processing SET_BAND_CONFIG\n IOCTL\n\nKernel assumes all SET IOCTL commands are assigned with even\nnumbers. But in our WLAN driver, some SET IOCTLS are assigned with\nodd numbers. This leads kernel fail to check, for some SET IOCTLs,\nwhether user has the right permission to do SET operation.\nHence, in driver, before processing SET_BAND_CONFIG IOCTL, making\nsure user task has right permission to process the command.\n\nChange-Id: Ie8a36bfa07a7b21601364b27b3c4bc888a6a5b4e\nCRs-Fixed: 930952\n" }, { "commit": "30273b3e6bb7ccaa87506d9c65a07b685e4a1c2b", "tree": "2807e72655ab305bca82250f901473d1a7ba0d26", "parents": [ "6e63543e95d0bc75c60b60ff3ab355fcadcdb913" ], "author": { "name": "Hanumantha Reddy Pothula", "email": "c_hpothu@qti.qualcomm.com", "time": "Tue Oct 27 22:10:50 2015 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:04:43 2016 -0600" }, "message": "wlan:Check priviledge permission before processing SET_POWER_PARAMS\n IOCTL\n\nKernel assumes all SET IOCTL commands are assigned with even\nnumbers. But in our WLAN driver, some SET IOCTLS are assigned with\nodd numbers. This leads kernel fail to check, for some SET IOCTLs,\nwhether user has the right permission to do SET operation.\nHence, in driver, before processing SET_POWER_PARAMS IOCTL, making\nsure user task has right permission to process the command.\n\nChange-Id: Ie930c9723ecbd54ae0e6bf6506815301e0387932\nCRs-Fixed: 930953\n" }, { "commit": "6e63543e95d0bc75c60b60ff3ab355fcadcdb913", "tree": "8d8b1d51732fa5b217d723825bdb803ca0c66dc6", "parents": [ "8bb79f9c9b5b1c794bc4e816900e490df036083a" ], "author": { "name": "Hanumantha Reddy Pothula", "email": "c_hpothu@qti.qualcomm.com", "time": "Tue Oct 27 22:01:39 2015 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:04:38 2016 -0600" }, "message": "wlan:Check priviledge permission before processing CLEAR_MCBC_FILTER\n IOCTL\n\nKernel assumes all SET IOCTL commands are assigned with even\nnumbers. But in our WLAN driver, some SET IOCTLS are assigned with\nodd numbers. This leads kernel fail to check, for some SET IOCTLs,\nwhether user has the right permission to do SET operation.\nHence, in driver, before processing CLEAR_MCBC_FILTER IOCTL, making\nsure user task has right permission to process the command.\n\nChange-Id: I9b50fcc0eeb1c1eb3493eab573f4421b52f0ea9a\nCRs-Fixed: 930954\n" }, { "commit": "8bb79f9c9b5b1c794bc4e816900e490df036083a", "tree": "a6cb6a487f89d9e1f12659d61fa48343239c05b0", "parents": [ "88fb39d81b2c97db7a9337b4bd1432661dae0043" ], "author": { "name": "Hanumantha Reddy Pothula", "email": "c_hpothu@qti.qualcomm.com", "time": "Wed Oct 28 00:12:23 2015 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:04:30 2016 -0600" }, "message": "wlan:Check priviledge permission for SET_THREE_INT_GET_NONE\n\nKernel assumes all SET IOCTL commands are assigned with even\nnumbers. But in our WLAN driver, some SET IOCTLS are assigned with\nodd numbers. This leads kernel fail to check, for some SET IOCTLs,\nwhether user has the right permission to do SET operation.\nHence, in driver, before processing SET_THREE_INT_GET_NONE IOCTL,\nmaking sure user task has right permission to process the command.\n\nChange-Id: I3c695160d637ed87b04ccf3299985055a9791c4b\nCRs-Fixed: 930948\n" }, { "commit": "88fb39d81b2c97db7a9337b4bd1432661dae0043", "tree": "6f8a5ffd4241b7cd213e52a357ba97ef9fd9a164", "parents": [ "1ac4bfd1142589ce1b93785d67eb0fd8d115e9b9" ], "author": { "name": "Hanumantha Reddy Pothula", "email": "c_hpothu@qti.qualcomm.com", "time": "Tue Oct 27 20:48:17 2015 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:04:26 2016 -0600" }, "message": "wlan:Check priviledge permission before processing SET_OEM_DATA_REQ\n IOCTL\n\nKernel assumes all SET IOCTL commands are assigned with even\nnumbers. But in our WLAN driver, some SET IOCTLS are assigned with\nodd numbers. This leads kernel fail to check, for some SET IOCTLs,\nwhether user has the right permission to do SET operation.\nHence, in driver, before processing SET_OEM_DATA_REQ IOCTLs, making\nsure user task has right permission to process the command.\n\nChange-Id: Ida0133304b00627d01ef7f85f5b15ed9d404d443\nCRs-Fixed: 930549\n" }, { "commit": "1ac4bfd1142589ce1b93785d67eb0fd8d115e9b9", "tree": "e1a024720ad792f4daca65a7bddd995a7b04e736", "parents": [ "c20ee705ec5eb6867d6bb3ff2763bb5478b47d68" ], "author": { "name": "Hanumantha Reddy Pothula", "email": "c_hpothu@qti.qualcomm.com", "time": "Tue Oct 27 16:49:59 2015 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:04:21 2016 -0600" }, "message": "wlan: ensure permission for WLAN_FTM_PRIV_SET_CHAR_GET_NONE\n\nKernel assumes all SET IOCTL commands are assigned with even\nnumbers. But in our WLAN driver, some SET IOCTLS are assigned with\nodd numbers. This leads kernel fail to check, for some SET IOCTLs,\nwhether user has the right permission to do SET operation. Hence,\nin driver, before processing WLAN_FTM_PRIV_SET_CHAR_GET_NONE,\nmaking sure user task has right permission to process the command.\n\nChange-Id: Id7715da30961b418f3d067dd1a04c0e6098167a6\nCRs-Fixed: 930837\n" }, { "commit": "c20ee705ec5eb6867d6bb3ff2763bb5478b47d68", "tree": "08bdbea16a1489809c9cb7a792a74acba1b7952a", "parents": [ "8a67057d2ab07ab8133aac49c5d4491f2e0efee5" ], "author": { "name": "Mahesh A Saptasagar", "email": "c_msapta@qti.qualcomm.com", "time": "Wed Oct 28 13:08:42 2015 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:04:17 2016 -0600" }, "message": "wlan: Validate WPA and RSN IE for valid length\n\nReturn failure to applications if genie ioctl is invoked to configure\nWPS/WPA/RSN IEs with arguments of improper length.\n\nChange-Id: I2e034ef9f2537922be35d46ce266e6b99dab7bb6\nCRs-Fixed: 931451\n" }, { "commit": "8a67057d2ab07ab8133aac49c5d4491f2e0efee5", "tree": "d6b9c7ad300526b34cdd0cffe41f346cec19ada4", "parents": [ "88489932257c91f808692e6199d553ef37d12094" ], "author": { "name": "Ratheesh S P", "email": "rpappa@codeaurora.org", "time": "Sat Aug 15 14:08:20 2015 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Fri Dec 02 09:04:12 2016 -0600" }, "message": "prima: Logging level changes on wlan HOST\n\nAs there are a lot of prints dropped on the console in\nshort duration, it leads to interrupt disablement on\nthe cpu.\n\nSo reducing the logging level of log statement from\nERROR to INFO\n\nCRs-Fixed: 886644\nChange-Id: I3eefac49378a7bfbcc235b1dd3362e1213fa1f42\n" }, { "commit": "88489932257c91f808692e6199d553ef37d12094", "tree": "361016fecb4bc590d8bd85efb4480dda3763c0de", "parents": [ "26df648f391352874bfab2505089b5857e2d5ffe" ], "author": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 08:59:18 2016 -0600" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 10:28:24 2016 -0600" }, "message": "t6: enable sdcardFS\n\nChange-Id: I7cf7a51ea9dd364e9383ac6d04dc4bfce39e3888\n" }, { "commit": "26df648f391352874bfab2505089b5857e2d5ffe", "tree": "0de3f2989577c80515e21731456af0a0b754bb70", "parents": [ "31e1a87bd0f9ed0c091720f77a0edbba4e8a7601" ], "author": { "name": "Daniel Rosenberg", "email": "drosen@google.com", "time": "Wed Mar 23 12:09:25 2016 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 10:28:18 2016 -0600" }, "message": "inotify: Fix erroneous update of bit count\n\nPatch \"vfs: add d_canonical_path for stacked filesystem support\"\nerroneously updated the ALL_INOTIFY_BITS count. This changes it back\n\nChange-Id: Idb04edc736da276159d30f04c40cff9d6b1e070f\n" }, { "commit": "31e1a87bd0f9ed0c091720f77a0edbba4e8a7601", "tree": "c72a75385cd0e0b65a41be1e1d0f44effc102cef", "parents": [ "1fe59765f55e5f987b761e60be2277c6d21af417" ], "author": { "name": "alvin_liang", "email": "alvin_liang@htc.com", "time": "Mon Sep 19 16:59:12 2016 +0800" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 10:28:07 2016 -0600" }, "message": "sdcardfs: fix external storage exporting incorrect uid\n\nSymptom: App cannot write into per-app folder\nRoot Cause: sdcardfs exports incorrect uid\nSolution: fix uid\nProject: All\nNote:\nTest done by RD: passed\n\nChange-Id: Iff64f6f40ba4c679f07f4426d3db6e6d0db7e3ca\n" }, { "commit": "1fe59765f55e5f987b761e60be2277c6d21af417", "tree": "07e1bec075a2234d0971e79ff7b6cc446c281cfe", "parents": [ "df6d5fd2a3e9dabffab716fcd3fbc4d9ba447614" ], "author": { "name": "fluxi", "email": "linflux@arcor.de", "time": "Fri Oct 21 22:57:35 2016 +0200" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 10:28:00 2016 -0600" }, "message": "sdcardfs: Flag files as non-mappable\n\nImplement Samsung\u0027s FMODE_NONMAPPABLE flag from\nsdcardfs version 2.1.4 as we hit a BUG on ext4:\n\n[ 49.655037]@0 Kernel BUG at ffffffc0001deeec [verbose debug info unavailable]\n[ 49.655045]@0 Internal error: Oops - BUG: 0 [#1] PREEMPT SMP\n[ 49.655052]@0 Modules linked in:\n[ 49.655061]@0 CPU: 0 PID: 283 Comm: kworker/u8:7 Tainted: G W 3.18.20-perf-g3be2054-00086-ga8307fb #1\n[ 49.655070]@0 Hardware name: Qualcomm Technologies, Inc. MSM 8996 v3 + PMI8996 MTP (DT)\n[ 49.655077]@0 Workqueue: writeback bdi_writeback_workfn (flush-8:0)\n[ 49.655096]@0 task: ffffffc174ba8b00 ti: ffffffc174bb4000 task.ti: ffffffc174bb4000\n[ 49.655108]@0 PC is at mpage_prepare_extent_to_map+0x198/0x218\n[ 49.655116]@0 LR is at mpage_prepare_extent_to_map+0x110/0x218\n[ 49.655121]@0 pc : [\u003cffffffc0001deeec\u003e] lr : [\u003cffffffc0001dee64\u003e] pstate: 60000145\n[ 49.655126]@0 sp : ffffffc174bb7800\n[ 49.655130]@0 x29: ffffffc174bb7800 x28: ffffffc174bb7880\n[ 49.655140]@0 x27: 000000000000000d x26: ffffffc1245505e8\n[ 49.655149]@0 x25: 0000000000000000 x24: 0000000000003400\n[ 49.655160]@0 x23: ffffffffffffffff x22: 0000000000000000\n[ 49.655172]@0 x21: ffffffc174bb7888 x20: ffffffc174bb79e0\n[ 49.655182]@0 x19: ffffffbdc4ee7b80 x18: 0000007f92872000\n[ 49.655191]@0 x17: 0000007f959b6424 x16: ffffffc00016d1ac\n[ 49.655201]@0 x15: 0000007f9285d158 x14: ffffffc1734796e8\n[ 49.655210]@0 x13: ffffffbdc1ffa4c0 x12: ffffffbdc4ee7b80\n[ 49.655220]@0 x11: 0000000000000100 x10: 0000000000000000\n[ 49.655229]@0 x9 : 0000000000000000 x8 : ffffffc0b444e210\n[ 49.655237]@0 x7 : 0000000000000000 x6 : ffffffc0b444e1e0\n[ 49.655246]@0 x5 : 0000000000000000 x4 : 0000000000000001\n[ 49.655254]@0 x3 : 0000000000000000 x2 : 400000000002003d\n[ 49.655263]@0 x1 : ffffffbdc4ee7b80 x0 : 400000000002003d\n[ 49.655271]@0\n[ 49.656502]@0 Process kworker/u8:7 (pid: 283, stack limit \u003d 0xffffffc174bb4058)\n[ 49.656509]@0 Call trace:\n[ 49.656514]@0 [\u003cffffffc0001deeec\u003e] mpage_prepare_extent_to_map+0x198/0x218\n[ 49.656526]@0 [\u003cffffffc0001e28d0\u003e] ext4_writepages+0x270/0xa58\n[ 49.656533]@0 [\u003cffffffc00012982c\u003e] do_writepages+0x24/0x40\n[ 49.656541]@0 [\u003cffffffc000180160\u003e] __writeback_single_inode+0x40/0x114\n[ 49.656549]@0 [\u003cffffffc000180e50\u003e] writeback_sb_inodes+0x1dc/0x34c\n[ 49.656555]@0 [\u003cffffffc00018103c\u003e] __writeback_inodes_wb+0x7c/0xc4\n[ 49.656560]@0 [\u003cffffffc000181224\u003e] wb_writeback+0x110/0x1a8\n[ 49.656565]@0 [\u003cffffffc000181344\u003e] wb_check_old_data_flush+0x88/0x98\n[ 49.656571]@0 [\u003cffffffc00018156c\u003e] bdi_writeback_workfn+0xf4/0x1fc\n[ 49.656576]@0 [\u003cffffffc0000b14f8\u003e] process_one_work+0x1e0/0x300\n[ 49.656585]@0 [\u003cffffffc0000b1e14\u003e] worker_thread+0x318/0x438\n[ 49.656590]@0 [\u003cffffffc0000b5da0\u003e] kthread+0xe0/0xec\n[ 49.656598]@0 Code: f9400260 f9400a63 1ad92063 37580040 (e7f001f2)\n[ 49.656604]@0 ---[ end trace cbed09f772fd630d ]---\n\nChange-Id: I931da7cb3841db1f130dba298a7d256b6f02d1bc\n" }, { "commit": "df6d5fd2a3e9dabffab716fcd3fbc4d9ba447614", "tree": "41adc34b871694ffb42a8eb34fd30325dd0ca007", "parents": [ "af4d4f0d82e0fff46d175799329f4385acb29805" ], "author": { "name": "Daniel Rosenberg", "email": "drosen@google.com", "time": "Sun Aug 21 21:04:12 2016 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 10:27:50 2016 -0600" }, "message": "sdcardfs: Remove stale dentries when reusing an inode.\n\nWhen an inode is moved in one view of sdcardfs, others\ndo not know about it until the information is requested,\nand even then, the old dentry is not invalidated until\nit is used. If the inode moves back, it may successfully\nrevalidate with stale permissions. Since we do not allow\nhard links, we can avoid this by removing alias\u0027s when\nwe reuse an inode.\n\nChange-Id: I3c00c496b436af4d3309a77a596dec8fd5906cdd\nSigned-off-by: Daniel Rosenberg \u003cdrosen@google.com\u003e\n" }, { "commit": "af4d4f0d82e0fff46d175799329f4385acb29805", "tree": "903c394106954ec49e790265693f74c925422d1a", "parents": [ "8de71c0d614d36dba513a27c5a9e0a38a2055bf7" ], "author": { "name": "Daniel Rosenberg", "email": "drosen@google.com", "time": "Mon Mar 28 13:38:46 2016 -0800" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 10:27:40 2016 -0600" }, "message": "sdcardfs: Fix issue with d_child move\n\n\"move d_rcu from overlapping d_child to overlapping d_alias\"\nmoved the location of d_child in struct dentry. This fixes\na container_of that relied on that in sdcardfs\n\nChange-Id: I3c81909a2f26eb191a3222fdac6127d8a318c251\n" }, { "commit": "8de71c0d614d36dba513a27c5a9e0a38a2055bf7", "tree": "037ab3da04a30b17e1d2176c3bef30677f2d2618", "parents": [ "0f7f508cf942dfdf1b63a3096c082debd1ea28c1" ], "author": { "name": "Daniel Rosenberg", "email": "drosen@google.com", "time": "Wed May 18 16:57:10 2016 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 10:27:34 2016 -0600" }, "message": "sdcardfs: Added top to sdcardfs_inode_info\n\nAdding packages to the package list and moving files\ntakes a large amount of locks, and is currently a\nheavy operation. This adds a \u0027top\u0027 field to the\ninode_info, which points to the inode for the top\nmost directory whose owner you would like to match.\n\nOn permission checks and get_attr, we look up the\nowner based on the information at top. When we change\na package mapping, we need only modify the information\nin the corresponding top inode_info\u0027s. When renaming,\nwe must ensure top is set correctly in all children.\nThis happens when an app specific folder gets moved\noutside of the folder for that app.\n\nChange-Id: Ib749c60b568e9a45a46f8ceed985c1338246ec6c\nSigned-off-by: Daniel Rosenberg \u003cdrosen@google.com\u003e\n" }, { "commit": "0f7f508cf942dfdf1b63a3096c082debd1ea28c1", "tree": "ab99b67cd8ca03fa9f6d807da964407ac81cc3b7", "parents": [ "64bb32fb2eebe195138cb5076b24e0e45ebdab38" ], "author": { "name": "Daniel Rosenberg", "email": "drosen@google.com", "time": "Tue May 10 13:42:43 2016 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 10:27:19 2016 -0600" }, "message": "sdcardfs: Fix locking\n\nIterating over d_subdirs requires taking d_lock. Switched\nhashmap guard over to a spinlock to use within the loop.\nSeveral places were taking unneeded locks.\n\nChange-Id: I9fdcab279009005bf28536247d11e13babab0b93\nSigned-off-by: Daniel Rosenberg \u003cdrosen@google.com\u003e\n" }, { "commit": "64bb32fb2eebe195138cb5076b24e0e45ebdab38", "tree": "9de5029eeefa50794e616dd4bde361e852792c3e", "parents": [ "440440d9e5d2c9abfc80b11dfe7eba533b06cef9" ], "author": { "name": "Daniel Rosenberg", "email": "drosen@google.com", "time": "Wed Apr 27 15:31:29 2016 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 10:27:12 2016 -0600" }, "message": "sdcardfs: Check for other cases on path lookup\n\nThis fixes a bug where the first lookup of a\nfile or folder created under a different view\nwould not be case insensitive. It will now\nsearch through for a case insensitive match\nif the initial lookup fails.\n\nBug:28024488\nChange-Id: I4ff9ce297b9f2f9864b47540e740fd491c545229\nSigned-off-by: Daniel Rosenberg \u003cdrosen@google.com\u003e\n" }, { "commit": "440440d9e5d2c9abfc80b11dfe7eba533b06cef9", "tree": "2e0b8fa058645bba7ac8750fae8c6866d3511eb9", "parents": [ "785d1554e47a3d540bbbd5eb0ac850d7a7fe32d5" ], "author": { "name": "Daniel Rosenberg", "email": "drosen@google.com", "time": "Wed Apr 13 16:38:34 2016 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 10:27:04 2016 -0600" }, "message": "sdcardfs: override umask on mkdir and create\n\nThe mode on files created on the lower fs should\nnot be affected by the umask of the calling\ntask\u0027s fs_struct. Instead, we create a copy\nand modify it as needed. This also lets us avoid\nthe string shenanigans around .nomedia files.\n\nBug: 27992761\nChange-Id: Ia3a6e56c24c6e19b3b01c1827e46403bb71c2f4c\nSigned-off-by: Daniel Rosenberg \u003cdrosen@google.com\u003e\n" }, { "commit": "785d1554e47a3d540bbbd5eb0ac850d7a7fe32d5", "tree": "074482d0f368bafd204a23327081f604c4f25552", "parents": [ "f181b5a2caf345938fa20080ce4d5d7a9bc89d7f" ], "author": { "name": "Julia Lawall", "email": "julia.lawall@lip6.fr", "time": "Wed Jun 01 10:28:49 2016 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 10:26:57 2016 -0600" }, "message": "ANDROID: sdcardfs: fix itnull.cocci warnings\n\nList_for_each_entry has the property that the first argument is always\nbound to a real list element, never NULL, so testing dentry is not needed.\n\nGenerated by: scripts/coccinelle/iterators/itnull.cocci\n\nChange-Id: I51033a2649eb39451862b35b6358fe5cfe25c5f5\nCc: Daniel Rosenberg \u003cdrosen@google.com\u003e\nSigned-off-by: Julia Lawall \u003cjulia.lawall@lip6.fr\u003e\nSigned-off-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nSigned-off-by: Guenter Roeck \u003cgroeck@chromium.org\u003e\n" }, { "commit": "f181b5a2caf345938fa20080ce4d5d7a9bc89d7f", "tree": "f80728185324e8223e93ce262712d45730c3d40e", "parents": [ "03d1eccc55e86bf063bac2b8a44b11bb6148d9ee" ], "author": { "name": "Daniel Rosenberg", "email": "drosen@google.com", "time": "Fri Jul 08 14:15:14 2016 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 10:26:52 2016 -0600" }, "message": "sdcardfs: Truncate packages_gid.list on overflow\n\npackages_gid.list was improperly returning the wrong\ncount. Use scnprintf instead, and inform the user that\nthe list was truncated if it is.\n\nBug: 30013843\nChange-Id: Ida2b2ef7cd86dd87300bfb4c2cdb6bfe2ee1650d\nSigned-off-by: Daniel Rosenberg \u003cdrosen@google.com\u003e\n" }, { "commit": "03d1eccc55e86bf063bac2b8a44b11bb6148d9ee", "tree": "4fca3bf4f16465155706fd33641d1a411fb63eae", "parents": [ "09a3900b6e6d6e180d1fb437837958ce41b1bd36" ], "author": { "name": "Daniel Rosenberg", "email": "drosen@google.com", "time": "Fri Apr 22 00:00:48 2016 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 10:25:34 2016 -0600" }, "message": "fuse: Add support for d_canonical_path\n\nAllows FUSE to report to inotify that it is acting\nas a layered filesystem. The userspace component\nreturns a string representing the location of the\nunderlying file. If the string cannot be resolved\ninto a path, the top level path is returned instead.\n\nbug: 23904372\nChange-Id: Iabdca0bbedfbff59e9c820c58636a68ef9683d9f\nSigned-off-by: Daniel Rosenberg \u003cdrosen@google.com\u003e\n" }, { "commit": "09a3900b6e6d6e180d1fb437837958ce41b1bd36", "tree": "772937252491c482ecaac30e91f8835e366269cf", "parents": [ "44d71eba7954a24e2ab72b7334337bfb76ab94d7" ], "author": { "name": "Daniel Rosenberg", "email": "drosen@google.com", "time": "Fri Apr 22 00:00:14 2016 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 10:25:27 2016 -0600" }, "message": "vfs: change d_canonical_path to take two paths\n\nbug: 23904372\nChange-Id: I4a686d64b6de37decf60019be1718e1d820193e6\nSigned-off-by: Daniel Rosenberg \u003cdrosen@google.com\u003e\n" }, { "commit": "44d71eba7954a24e2ab72b7334337bfb76ab94d7", "tree": "2adf23ccac1ebf748d021cdcf4a1fccd23dedba7", "parents": [ "00f3a5fc3108e366f48730299199390d87225bf7" ], "author": { "name": "Daniel Rosenberg", "email": "drosen@google.com", "time": "Thu Feb 11 16:44:15 2016 -0800" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 10:24:55 2016 -0600" }, "message": "vfs: add d_canonical_path for stacked filesystem support\n\nInotify does not currently know when a filesystem\nis acting as a wrapper around another fs. This means\nthat inotify watchers will miss any modifications to\nthe base file, as well as any made in a separate\nstacked fs that points to the same file.\nd_canonical_path solves this problem by allowing the fs\nto map a dentry to a path in the lower fs. Inotify\ncan use it to find the appropriate place to watch to\nbe informed of all changes to a file.\n\nChange-Id: I09563baffad1711a045e45c1bd0bd8713c2cc0b6\nSigned-off-by: Daniel Rosenberg \u003cdrosen@google.com\u003e\n" }, { "commit": "00f3a5fc3108e366f48730299199390d87225bf7", "tree": "50c6e36492de01132bc6898426f3230b15196c64", "parents": [ "192a24b40944e4ae1a49766600c1b7d278e31ead" ], "author": { "name": "Daniel Rosenberg", "email": "drosen@google.com", "time": "Mon Mar 28 16:00:34 2016 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 10:24:49 2016 -0600" }, "message": "sdcardfs: remove unneeded __init and __exit\n\nChange-Id: I2a2d45d52f891332174c3000e8681c5167c1564f\n" }, { "commit": "192a24b40944e4ae1a49766600c1b7d278e31ead", "tree": "23bc91bdb8ebb784fb7f0d452ce3a40bbe835b52", "parents": [ "d8554b108e421210750e7ef5ebab53f6de03fceb" ], "author": { "name": "Daniel Rosenberg", "email": "drosen@google.com", "time": "Mon Mar 28 15:00:20 2016 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 10:24:39 2016 -0600" }, "message": "sdcardfs: Remove unused code\n\nChange-Id: Ie97cba27ce44818ac56cfe40954f164ad44eccf6\n" }, { "commit": "d8554b108e421210750e7ef5ebab53f6de03fceb", "tree": "9cc591f4cc420ffb139f016acd0f0d8db94257a7", "parents": [ "dd096bc7335a7857ee053712f64f9938d0bbdb2b" ], "author": { "name": "Daniel Rosenberg", "email": "drosen@google.com", "time": "Thu Feb 11 16:53:36 2016 -0800" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 10:24:24 2016 -0600" }, "message": "sdcardfs: Add support for d_canonicalize\n\nChange-Id: I5d6f0e71b8ca99aec4b0894412f1dfd1cfe12add\nSigned-off-by: Daniel Rosenberg \u003cdrosen@google.com\u003e\n" }, { "commit": "dd096bc7335a7857ee053712f64f9938d0bbdb2b", "tree": "bf94ae26c7b53a89d7e4186edcb4811693de60af", "parents": [ "4fadefba283e97cf087890f95ae6370f8d2a06ea" ], "author": { "name": "Daniel Rosenberg", "email": "drosen@google.com", "time": "Wed Feb 03 21:08:21 2016 -0800" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 08:32:50 2016 -0600" }, "message": "sdcardfs: Bring up to date with Android M permissions:\n\nIn M, the workings of sdcardfs were changed significantly.\nThis brings sdcardfs into line with the changes.\n\nChange-Id: I10e91a84a884c838feef7aa26c0a2b21f02e052e\n" }, { "commit": "4fadefba283e97cf087890f95ae6370f8d2a06ea", "tree": "43db045ca558187c7d226fbae5589e875ed28987", "parents": [ "d925de26bf5db02593e9c9e555f32376c6ca0dc1" ], "author": { "name": "Daniel Campello", "email": "campello@google.com", "time": "Wed Jun 24 15:14:54 2015 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 08:32:44 2016 -0600" }, "message": "sdcardfs: Changed type-cast in packagelist management\n\nChange-Id: Ic8842de2d7274b7a5438938d2febf5d8da867148\n" }, { "commit": "d925de26bf5db02593e9c9e555f32376c6ca0dc1", "tree": "5f5bb413957b6c1287496c195b1f5d8c09a5e934", "parents": [ "b7fb16f31a39e25c73635c09997966c508ba6db0" ], "author": { "name": "fluxi", "email": "linflux@arcor.de", "time": "Fri Jul 29 18:52:13 2016 +0200" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 08:32:34 2016 -0600" }, "message": "sdcardfs: Port to 3.4\n\nAnalog port to 3.10 by Daniel Campello \u003ccampello@google.com\u003e.\n\nChange-Id: I0b05890cdd4332c5cfc2ffdf66a3f3a7890cce35\n" }, { "commit": "b7fb16f31a39e25c73635c09997966c508ba6db0", "tree": "fe9e38f476e2c34e9766dec4d6173f8efa924697", "parents": [ "1d930b2b94f95685b6520fb5dca522ed41c1be6f" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Fri Jun 15 03:01:42 2012 +0400" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 08:32:27 2016 -0600" }, "message": "get rid of kern_path_parent()\n\nall callers want the same thing, actually - a kinda-sorta analog of\nkern_path_create(). I.e. they want parent vfsmount/dentry (with\n-\u003ei_mutex held, to make sure the child dentry is still their child)\n+ the child dentry.\n\nSigned-off-by Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n\nChange-Id: I58cc7b0a087646516db9af69962447d27fb3ee8b\n" }, { "commit": "1d930b2b94f95685b6520fb5dca522ed41c1be6f", "tree": "6f8281b575ee677a2190d2a18e114a3013ae55e3", "parents": [ "885fd32ea5abab0e338f2068d09ee80f659999c4" ], "author": { "name": "Daniel Campello", "email": "campello@google.com", "time": "Mon Jul 20 16:23:50 2015 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 30 08:32:23 2016 -0600" }, "message": "Included sdcardfs source code for kernel 3.0\n\nOnly included the source code as is for kernel 3.0. Following patches\ntake care of porting this file system to version 3.10.\n\nChange-Id: I09e76db77cd98a059053ba5b6fd88572a4b75b5b\nSigned-off-by: Daniel Campello \u003ccampello@google.com\u003e\n" }, { "commit": "885fd32ea5abab0e338f2068d09ee80f659999c4", "tree": "4742569da9c4afb3e8cb4f3b14942cc72420756c", "parents": [ "c97fe2418e51a47b1966fbdd60beb9d84f703bc0" ], "author": { "name": "Lorenzo Colitti", "email": "lorenzo@google.com", "time": "Wed Dec 16 12:30:03 2015 +0900" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 09:30:01 2016 -0600" }, "message": "net: diag: Add the ability to destroy a socket.\n\nThis patch adds a SOCK_DESTROY operation, a destroy function\npointer to sock_diag_handler, and a diag_destroy function\npointer. It does not include any implementation code.\n\n[Backport of net-next 64be0aed59ad519d6f2160868734f7e278290ac1]\n\nChange-Id: I1d998e1c5f836b2f5638c0f79244c372c8d2d9d9\nSigned-off-by: Lorenzo Colitti \u003clorenzo@google.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c97fe2418e51a47b1966fbdd60beb9d84f703bc0", "tree": "0a846a146fbacd8906efc9c2c1f786d62bec7ccb", "parents": [ "7156334b7baca9408eb48f5306676c4d262189f9" ], "author": { "name": "Lorenzo Colitti", "email": "lorenzo@google.com", "time": "Thu Feb 04 00:52:15 2016 +0900" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 09:29:57 2016 -0600" }, "message": "selinux: nlmsgtab: add SOCK_DESTROY to the netlink mapping tables\n\nWithout this, using SOCK_DESTROY in enforcing mode results in:\n\n SELinux: unrecognized netlink message type\u003d21 for sclass\u003d32\n\nChange-Id: I7862bb0fc83573567243ffa9549a2c7405b5986c\n" }, { "commit": "7156334b7baca9408eb48f5306676c4d262189f9", "tree": "273a06224a4bc58ae871f69ca9e8d06ea6a3a08d", "parents": [ "094e2328c4f91d16008bfbced519a54166071a92" ], "author": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Mon Nov 23 16:07:41 2015 -0500" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 09:29:51 2016 -0600" }, "message": "UPSTREAM: selinux: fix bug in conditional rules handling\n\n(cherry picked from commit commit f3bef67992e8698897b584616535803887c4a73e)\n\ncommit fa1aa143ac4a (\"selinux: extended permissions for ioctls\")\nintroduced a bug into the handling of conditional rules, skipping the\nprocessing entirely when the caller does not provide an extended\npermissions (xperms) structure. Access checks from userspace using\n/sys/fs/selinux/access do not include such a structure since that\ninterface does not presently expose extended permission information.\nAs a result, conditional rules were being ignored entirely on userspace\naccess requests, producing denials when access was allowed by\nconditional rules in the policy. Fix the bug by only skipping\ncomputation of extended permissions in this situation, not the entire\nconditional rules processing.\n\nChange-Id: I6f81765f6cdb9ce72f93c290d7987d93688651a0\nReported-by: Laurent Bigonville \u003cbigon@debian.org\u003e\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\n[PM: fixed long lines in patch description]\nCc: stable@vger.kernel.org # 4.3\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\n" }, { "commit": "094e2328c4f91d16008bfbced519a54166071a92", "tree": "3e1c4cbf2ff3014384e3691f2e9619eac9f1c8b2", "parents": [ "d81c0562be6de1daf743aab55e908a10933d91d8" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Thu Oct 22 09:30:40 2015 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 09:29:42 2016 -0600" }, "message": "selinux: Android kernel compatibility with M userspace\n\nNOT intended for new Android devices - this commit is unnecessary\nfor a target device that does not have a previous M variant.\n\nDO NOT upstream. Android only.\n\nMotivation:\n\nThis commit mitigates a mismatch between selinux kernel and\nselinux userspace. The selinux ioctl white-listing binary policy\nformat that was accepted into Android M differs slightly from what\nwas later accepted into the upstream kernel. This leaves Android\nmaster branch kernels incompatible with Android M releases. This\npatch restores backwards compatibility. This is important because:\n\n1. kernels may be updated on a different cycle than the rest of the\n OS e.g. security patching.\n2. Android M bringup may still be ongoing for some devices. The\n same kernel should work for both M and master.\n\nBackwards compatibility is achieved by checking for an Android M\npolicy characteristic during initial policy read and converting to\nupstream policy format. The inverse conversion is done for policy\nwrite as required for CTS testing.\n\nBug: 22846070\nChange-Id: I2f1ee2eee402f37cf3c9df9f9e03c1b9ddec1929\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n" }, { "commit": "d81c0562be6de1daf743aab55e908a10933d91d8", "tree": "76dc86cf268d68583f6d47acd60148c49120dc20", "parents": [ "e05c4ff48e4957ab652baec4f71c1c25aea43354" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Fri Jul 10 17:19:56 2015 -0400" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 09:29:34 2016 -0600" }, "message": "selinux: extended permissions for ioctls\n\n(cherry picked from commit fa1aa143ac4a682c7f5fd52a3cf05f5a6fe44a0a)\n\nAdd extended permissions logic to selinux. Extended permissions\nprovides additional permissions in 256 bit increments. Extend the\ngeneric ioctl permission check to use the extended permissions for\nper-command filtering. Source/target/class sets including the ioctl\npermission may additionally include a set of commands. Example:\n\nallowxperm \u003csource\u003e \u003ctarget\u003e:\u003cclass\u003e ioctl unpriv_app_socket_cmds\nauditallowxperm \u003csource\u003e \u003ctarget\u003e:\u003cclass\u003e ioctl priv_gpu_cmds\n\nWhere unpriv_app_socket_cmds and priv_gpu_cmds are macros\nrepresenting commonly granted sets of ioctl commands.\n\nWhen ioctl commands are omitted only the permissions are checked.\nThis feature is intended to provide finer granularity for the ioctl\npermission that may be too imprecise. For example, the same driver\nmay use ioctls to provide important and benign functionality such as\ndriver version or socket type as well as dangerous capabilities such\nas debugging features, read/write/execute to physical memory or\naccess to sensitive data. Per-command filtering provides a mechanism\nto reduce the attack surface of the kernel, and limit applications\nto the subset of commands required.\n\nThe format of the policy binary has been modified to include ioctl\ncommands, and the policy version number has been incremented to\nPOLICYDB_VERSION_XPERMS_IOCTL\u003d30 to account for the format\nchange.\n\nThe extended permissions logic is deliberately generic to allow\ncomponents to be reused e.g. netlink filters\n\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\nAcked-by: Nick Kralevich \u003cnnk@google.com\u003e\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\nBug: 22846070\nChange-Id: I299dc776d2f98d593ecc051707110c92a085350f\n" }, { "commit": "e05c4ff48e4957ab652baec4f71c1c25aea43354", "tree": "b85958d51d16f4e0adee5c7e0c9a9dbd7abf2aa4", "parents": [ "5c3bc39810588c40b8cce9cb30d8f520f88a6fde" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Thu Feb 26 13:54:17 2015 -0800" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 09:29:29 2016 -0600" }, "message": "selinux: remove unnecessary pointer reassignment\n\n(cherry pick from commit 83d4a806ae46397f606de7376b831524bd3a21e5)\n\nCommit f01e1af445fa (\"selinux: don\u0027t pass in NULL avd to avc_has_perm_noaudit\")\nmade this pointer reassignment unnecessary. Avd should continue to reference\nthe stack-based copy.\n\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\nAcked-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\n[PM: tweaked subject line]\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\nBug: 22846070\nChange-Id: Ie33688d163870705272607309a27fb7c8f870748\n" }, { "commit": "5c3bc39810588c40b8cce9cb30d8f520f88a6fde", "tree": "4c283be9b9d38878dd36e58bbc46bda3d453d7d2", "parents": [ "009677b8d16082a62a107c7ad281488af2c92bfd" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jul 29 18:36:41 2015 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 09:29:24 2016 -0600" }, "message": "Revert \"SELinux: per-command whitelisting of ioctls\"\n\nThis reverts commit bc84b4adb1469e3d05ad76c304a4c545feaf1f88.\n\nBug: 22846070\nChange-Id: Ib4cb130b2225ea2e22556ff852313e0de7dddcab\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n" }, { "commit": "009677b8d16082a62a107c7ad281488af2c92bfd", "tree": "1bca3b0d84942e89f20e1d725a5d2d90bd16890e", "parents": [ "7ef868d65cd83362a0e0072c244622fc15b647e3" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jul 29 18:35:33 2015 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 09:29:19 2016 -0600" }, "message": "Revert \"SELinux: use deletion-safe iterator to free list\"\n\nThis reverts commit c9a8571249fa3a55a0490bd571eaf0cea097fab0.\n\nBug: 22846070\nChange-Id: I85e2b6322f98bd584ed523b0bd0291375dbc35dc\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n" }, { "commit": "7ef868d65cd83362a0e0072c244622fc15b647e3", "tree": "db7ee36fa57c2f5b5dd060a26150ec84dd7eb621", "parents": [ "8a3c3991b1d80ba40ee0515c4a7747285655d266" ], "author": { "name": "Jeff Vander Stoep", "email": "jeffv@google.com", "time": "Wed Jul 29 18:33:33 2015 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 09:29:13 2016 -0600" }, "message": "Revert \"SELinux: ss: Fix policy write for ioctl operations\"\n\nThis reverts commit c06168226f5eaaaad93af5b2811f213b01382363.\n\nBug: 22846070\nChange-Id: I665c1f2350e10ce890e7c4be1a06e666929d5d7a\nSigned-off-by: Jeff Vander Stoep \u003cjeffv@google.com\u003e\n" }, { "commit": "8a3c3991b1d80ba40ee0515c4a7747285655d266", "tree": "8d306e9e1f41a522faa7d086d2812002f4ded105", "parents": [ "1b5a72a5fad603eb143f800a31ff8966966dd176" ], "author": { "name": "Liam Mark", "email": "lmark@codeaurora.org", "time": "Wed Oct 12 14:22:56 2016 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 07:09:17 2016 -0800" }, "message": "ion: disable system contig heap\n\nA malicious application can take advantage of the ION contig heap to\ncreate a specific memory chunk size to exercise a rowhammer attack on the\nphysical hardware.\nSo remove support for the ION contig heap.\n\nChange-Id: I9cb454cebb74df291479cecc3533d2c684363f77\nSigned-off-by: Liam Mark \u003clmark@codeaurora.org\u003e\nSigned-off-by: Prakash Gupta \u003cguptap@codeaurora.org\u003e\n(cherry picked from commit 914202e385c592688877d6edb30fba9701d97862)\n" }, { "commit": "1b5a72a5fad603eb143f800a31ff8966966dd176", "tree": "cea6e78da5811e3bca1a884192000b92e04694e9", "parents": [ "b7741100c4b25dea0763b33a8a155e4b59b0d59e" ], "author": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Thu Nov 10 23:39:12 2016 -0600" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 07:01:59 2016 -0800" }, "message": "ASoC: msm: Increase verbosity of VOIP sample rate errors\n\nChange-Id: I8f584bcfc4aa3d76c3ce066dde15eda7949abfef\n(cherry picked from commit 7c4151938260cf0a0638d2847775924d9bed482c)\n" }, { "commit": "b7741100c4b25dea0763b33a8a155e4b59b0d59e", "tree": "36c6180af30b8460e127dc41da737849ca0b222c", "parents": [ "dd529d4132a04da673eac2f4f5668c4771488aed" ], "author": { "name": "Prashanth Reddy", "email": "pgreddy@codeaurora.org", "time": "Fri Jan 11 12:04:44 2013 -0800" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 07:01:49 2016 -0800" }, "message": "ASoC: msm: Return signed error code\n\nComparision of unsigned value against 0 will always evaluate\nto false. Fix function to return signed error codes.\n\nChange-Id: I9c2d7fff27e639677ae98bff696ce1fa5c7bc296\nSigned-off-by: Prashanth Reddy \u003cpgreddy@codeaurora.org\u003e\n(cherry picked from commit 101462eb974224853430c4207d082abc56872a47)\n" }, { "commit": "dd529d4132a04da673eac2f4f5668c4771488aed", "tree": "082592a2966e68a5cc0689ef35c0bd30e42dc6f3", "parents": [ "5ac5e5146e0d135a1fee551a2d42d057aaaef501" ], "author": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Thu Nov 10 18:39:35 2016 -0600" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 07:01:34 2016 -0800" }, "message": "Revert \"ASoC: msm: Reduce maximum number of VOIP periods\"\n\nThe new audio HAL is requesting [periods_min, periods_max] \u003d [10, 10]\nfor VOIP calls, resulting in a pcm error since only 2 periods are\ncurrently supported. Remove the limitation.\n\nThis reverts commit ed31f5db8c654783007e0b287ddb34b1101be345.\n\nChange-Id: I4866137a2da4e3c3567da2c6bbc448f240d8c772\n(cherry picked from commit acb5c2913beba2256e92991787c9ada4b6f20778)\n" }, { "commit": "5ac5e5146e0d135a1fee551a2d42d057aaaef501", "tree": "8edf869f236721befbe4ffea10cc32db966f276a", "parents": [ "6e064c2c4046b0a977cedc3946ba654de04f6f21" ], "author": { "name": "Narsinga Rao Chella", "email": "nrchella@codeaurora.org", "time": "Tue Jan 21 22:30:02 2014 +0000" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 07:01:19 2016 -0800" }, "message": "BACKPORT: ASoC: msm: Add support to change bit rate during VoIP call\n\nAdd support to change the bit rate for AMR NB and AMR WB\nvocoders while in VoIP call. This change is needed as part of\nsupporting VoWLAN feature.\n\nChange-Id: Ic486dd7f48aca2c640b2364d00712741b50df4c8\nSigned-off-by: Narsinga Rao Chella \u003cnrchella@codeaurora.org\u003e\n(cherry picked from commit 5ddf87020d862405ae441672614c89c0e7c84ad1)\n" }, { "commit": "6e064c2c4046b0a977cedc3946ba654de04f6f21", "tree": "2efc4c3a07b802193984f62a07ed82422a082787", "parents": [ "7aea166d3854b96a565c2259fe6c27f15757d43b" ], "author": { "name": "Narsinga Rao Chella", "email": "nrchella@codeaurora.org", "time": "Mon Nov 04 22:13:05 2013 +0000" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 07:01:10 2016 -0800" }, "message": "BACKPORT: ASoC: msm: qdsp6v2: Add support for non-pcm VoIP formats\n\nThis change is needed to support non-pcm vocoder formats\nfor VoIP call.\n\nChange-Id: If69d52450816a0f438de1fa17d6382b1e0fb9247\nSigned-off-by: Narsinga Rao Chella \u003cnrchella@codeaurora.org\u003e\n(cherry picked from commit 913570883027338b4cbcf2e87936c5e3f1547d86)\n" }, { "commit": "7aea166d3854b96a565c2259fe6c27f15757d43b", "tree": "60416391e8bbf755da3af2aea30dca50452289a5", "parents": [ "e58f6ead18591db271d3b51fc2965d2f25101fe2" ], "author": { "name": "Narsinga Rao Chella", "email": "nrchella@codeaurora.org", "time": "Thu Sep 19 01:47:42 2013 +0000" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 07:00:58 2016 -0800" }, "message": "BACKPORT: ASoC: msm: qdsp6v2: Add support to configure min and max rates\n\nAdd support to configure min and max frame rates for EVRC/EVRCB/\nEVRCWB/EVRCNW codecs. This change is needed to support variable\nlength frames for VoIP calls.\n\nChange-Id: Id17dd645b17b1b8c1dc21afcf20dbc7e2c9c0d30\nSigned-off-by: Narsinga Rao Chella \u003cnrchella@codeaurora.org\u003e\n(cherry picked from commit db2f73bc4f412517d2cfb7c396b5ac22665b8bfc)\n" }, { "commit": "e58f6ead18591db271d3b51fc2965d2f25101fe2", "tree": "085d95eaa414e004ac0db593d7d21201178d960d", "parents": [ "df5fe476138c14a373208c27bb5f81d37005c2e9" ], "author": { "name": "Benjamin Tissoires", "email": "benjamin.tissoires@redhat.com", "time": "Tue Jan 19 12:34:58 2016 +0100" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 07:00:44 2016 -0800" }, "message": "HID: core: prevent out-of-bound readings\n\nPlugging a Logitech DJ receiver with KASAN activated raises a bunch of\nout-of-bound readings.\n\nThe fields are allocated up to MAX_USAGE, meaning that potentially, we do\nnot have enough fields to fit the incoming values.\nAdd checks and silence KASAN.\n\nChange-Id: I11d44957b450a3eda258c05f9e833c71a079e83c\nSigned-off-by: Benjamin Tissoires \u003cbenjamin.tissoires@redhat.com\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.cz\u003e\n(cherry picked from commit 299ea3b5f6c588dc85e6d618c85261e02675fc58)\n" }, { "commit": "df5fe476138c14a373208c27bb5f81d37005c2e9", "tree": "75455a01efec323cc4d7ad2f07ea4e8632a684e8", "parents": [ "beba3adfc26bc57dd06aee8d7907c71b2158f8e2" ], "author": { "name": "Peter Hurley", "email": "peter@hurleysoftware.com", "time": "Fri Nov 27 14:30:21 2015 -0500" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 07:00:35 2016 -0800" }, "message": "BACKPORT: tty: Prevent ldisc drivers from re-using stale tty fields\n\n(cherry picked from commit dd42bf1197144ede075a9d4793123f7689e164bc)\n\nLine discipline drivers may mistakenly misuse ldisc-related fields\nwhen initializing. For example, a failure to initialize tty-\u003ereceive_room\nin the N_GIGASET_M101 line discipline was recently found and fixed [1].\nNow, the N_X25 line discipline has been discovered accessing the previous\nline discipline\u0027s already-freed private data [2].\n\nHarden the ldisc interface against misuse by initializing revelant\ntty fields before instancing the new line discipline.\n\n[1]\n commit fd98e9419d8d622a4de91f76b306af6aa627aa9c\n Author: Tilman Schmidt \u003ctilman@imap.cc\u003e\n Date: Tue Jul 14 00:37:13 2015 +0200\n\n isdn/gigaset: reset tty-\u003ereceive_room when attaching ser_gigaset\n\n[2] Report from Sasha Levin \u003csasha.levin@oracle.com\u003e\n [ 634.336761] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n [ 634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0\n [ 634.339558] Read of size 4 by task syzkaller_execu/8981\n [ 634.340359] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n [ 634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected\n ...\n [ 634.405018] Call Trace:\n [ 634.405277] dump_stack (lib/dump_stack.c:52)\n [ 634.405775] print_trailer (mm/slub.c:655)\n [ 634.406361] object_err (mm/slub.c:662)\n [ 634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)\n [ 634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)\n [ 634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))\n [ 634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)\n [ 634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)\n [ 634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)\n [ 634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)\n [ 634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)\n [ 634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)\n\nCc: Tilman Schmidt \u003ctilman@imap.cc\u003e\nCc: Sasha Levin \u003csasha.levin@oracle.com\u003e\nSigned-off-by: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nChange-Id: Ibed6feadfb9706d478f93feec3b240aecfc64af3\nBug: 30951112\n(cherry picked from commit e8bbc1a417788f014541ba130cc3aacd5094e478)\n" }, { "commit": "beba3adfc26bc57dd06aee8d7907c71b2158f8e2", "tree": "cb0dc4d3af7f50a8394773dbc5b57ef106b24297", "parents": [ "5e6df0a0b4f47a3bd4bbb48855bf7703ad8a9562" ], "author": { "name": "AnilKumar Chimata", "email": "anilc@codeaurora.org", "time": "Wed Aug 31 14:08:16 2016 +0530" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 07:00:21 2016 -0800" }, "message": "qcedev: Validate Source and Destination addresses\n\nSource and Destination addresses passed by user space apps/clients\nare validated independent of type of operation to mitigate kernel\naddress space exploitation.\n\nChange-Id: If831275cdcc96cb0bf829fc62056e408accbfcca\nSigned-off-by: AnilKumar Chimata \u003canilc@codeaurora.org\u003e\n(cherry picked from commit 22e2854c99f88372d68d77622c83636727e53253)\n(cherry picked from commit f2ef9e20135cbec155cb9a593ec2bbef30e296ec)\n" }, { "commit": "5e6df0a0b4f47a3bd4bbb48855bf7703ad8a9562", "tree": "8287accf0bf1a40569003be32cb511caa52a68e7", "parents": [ "e0fc5972861039583f9db0f168a1e7490336d450" ], "author": { "name": "Paul Moore", "email": "paul@paul-moore.com", "time": "Tue Sep 13 12:41:08 2016 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 07:00:11 2016 -0800" }, "message": "BACKPORT: audit: fix a double fetch in audit_log_single_execve_arg()\n\n(cherry picked from commit 43761473c254b45883a64441dd0bc85a42f3645c)\n\nThere is a double fetch problem in audit_log_single_execve_arg()\nwhere we first check the execve(2) argumnets for any \"bad\" characters\nwhich would require hex encoding and then re-fetch the arguments for\nlogging in the audit record[1]. Of course this leaves a window of\nopportunity for an unsavory application to munge with the data.\n\nThis patch reworks things by only fetching the argument data once[2]\ninto a buffer where it is scanned and logged into the audit\nrecords(s). In addition to fixing the double fetch, this patch\nimproves on the original code in a few other ways: better handling\nof large arguments which require encoding, stricter record length\nchecking, and some performance improvements (completely unverified,\nbut we got rid of some strlen() calls, that\u0027s got to be a good\nthing).\n\nAs part of the development of this patch, I\u0027ve also created a basic\nregression test for the audit-testsuite, the test can be tracked on\nGitHub at the following link:\n\n * https://github.com/linux-audit/audit-testsuite/issues/25\n\n[1] If you pay careful attention, there is actually a triple fetch\nproblem due to a strnlen_user() call at the top of the function.\n\n[2] This is a tiny white lie, we do make a call to strnlen_user()\nprior to fetching the argument data. I don\u0027t like it, but due to the\nway the audit record is structured we really have no choice unless we\ncopy the entire argument at once (which would require a rather\nwasteful allocation). The good news is that with this patch the\nkernel no longer relies on this strnlen_user() value for anything\nbeyond recording it in the log, we also update it with a trustworthy\nvalue whenever possible.\n\nReported-by: Pengfei Wang \u003cwpengfeinudt@gmail.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Paul Moore \u003cpaul@paul-moore.com\u003e\nChange-Id: I10e979e94605e3cf8d461e3e521f8f9837228aa5\nBug: 30956807\n(cherry picked from commit a4c1000b10a5143d761b28f16e8cec68ff44b7f0)\n" }, { "commit": "e0fc5972861039583f9db0f168a1e7490336d450", "tree": "2acac2a72e830119bbec44a50d2b38920e12c70c", "parents": [ "eb5d2d7a8b736b4c3bbff30be8ceacd033574d06" ], "author": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Tue Dec 15 13:49:05 2015 +0100" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 07:00:01 2016 -0800" }, "message": "perf: Fix race in swevent hash\n\nThere\u0027s a race on CPU unplug where we free the swevent hash array\nwhile it can still have events on. This will result in a\nuse-after-free which is BAD.\n\nSimply do not free the hash array on unplug. This leaves the thing\naround and no use-after-free takes place.\n\nWhen the last swevent dies, we do a for_each_possible_cpu() iteration\nanyway to clean these up, at which time we\u0027ll free it, so no leakage\nwill occur.\n\nChange-Id: I751faf3215bbdaa6b6358f3a752bdd24126cfa0b\nReported-by: Sasha Levin \u003csasha.levin@oracle.com\u003e\nTested-by: Sasha Levin \u003csasha.levin@oracle.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nCc: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Stephane Eranian \u003ceranian@google.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Vince Weaver \u003cvincent.weaver@maine.edu\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n(cherry picked from commit 230cfdd3e6e7ca8fd848d37e254589b282ea7f63)\n(cherry picked from commit bc813beb1d3d6e4fe93fd79207f4c0d0e239a86b)\n" }, { "commit": "eb5d2d7a8b736b4c3bbff30be8ceacd033574d06", "tree": "7f584a3f9588c7677795bfcc40f718fb6498ec24", "parents": [ "03599747ef44ad65eff24f21837c8bcbc0448bf1" ], "author": { "name": "Vladis Dronov", "email": "vdronov@redhat.com", "time": "Thu Mar 31 12:05:43 2016 -0400" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 06:59:37 2016 -0800" }, "message": "ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call\n\ncreate_fixed_stream_quirk(), snd_usb_parse_audio_interface() and\ncreate_uaxx_quirk() functions allocate the audioformat object by themselves\nand free it upon error before returning. However, once the object is linked\nto a stream, it\u0027s freed again in snd_usb_audio_pcm_free(), thus it\u0027ll be\ndouble-freed, eventually resulting in a memory corruption.\n\nThis patch fixes these failures in the error paths by unlinking the audioformat\nobject before freeing it.\n\nBased on a patch by Takashi Iwai \u003ctiwai@suse.de\u003e\n\n[Note for stable backports:\n this patch requires the commit 902eb7fd1e4a (\u0027ALSA: usb-audio: Minor\n code cleanup in create_fixed_stream_quirk()\u0027)]\n\nChange-Id: I129dc4f3b0ae4cb6f790c16d24dd768c9ee06822\nBugzilla: https://bugzilla.redhat.com/show_bug.cgi?id\u003d1283358\nReported-by: Ralf Spenneberg \u003cralf@spenneberg.net\u003e\nCc: \u003cstable@vger.kernel.org\u003e # see the note above\nSigned-off-by: Vladis Dronov \u003cvdronov@redhat.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n(cherry picked from commit f404554edd2b847f291527f7ae2ca286be618b1d)\n" }, { "commit": "03599747ef44ad65eff24f21837c8bcbc0448bf1", "tree": "9f842b8d3b83900933407bcde7c3c40d18c7df32", "parents": [ "dd741a44330bc17ad3160537f370f91f79e93291" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Tue Mar 15 12:14:49 2016 +0100" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 06:59:03 2016 -0800" }, "message": "ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()\n\nJust a minor code cleanup: unify the error paths.\n\nChange-Id: I31346b08ed1024819c58eff797c63bb42c283512\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n(cherry picked from commit 052aca02e247f85b0709832c7bf275da6db78ed5)\n" }, { "commit": "dd741a44330bc17ad3160537f370f91f79e93291", "tree": "06a8dafbdeaf42825bc061465fc663025917e18f", "parents": [ "f5217c8358e4c840fe4b0153d4b0887a8765ce81" ], "author": { "name": "Calvin Owens", "email": "calvinowens@fb.com", "time": "Fri Oct 30 16:57:00 2015 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 06:58:51 2016 -0800" }, "message": "sg: Fix double-free when drives detach during SG_IO\n\nIn sg_common_write(), we free the block request and return -ENODEV if\nthe device is detached in the middle of the SG_IO ioctl().\n\nUnfortunately, sg_finish_rem_req() also tries to free srp-\u003erq, so we\nend up freeing rq-\u003ecmd in the already free rq object, and then free\nthe object itself out from under the current user.\n\nThis ends up corrupting random memory via the list_head on the rq\nobject. The most common crash trace I saw is this:\n\n ------------[ cut here ]------------\n kernel BUG at block/blk-core.c:1420!\n Call Trace:\n [\u003cffffffff81281eab\u003e] blk_put_request+0x5b/0x80\n [\u003cffffffffa0069e5b\u003e] sg_finish_rem_req+0x6b/0x120 [sg]\n [\u003cffffffffa006bcb9\u003e] sg_common_write.isra.14+0x459/0x5a0 [sg]\n [\u003cffffffff8125b328\u003e] ? selinux_file_alloc_security+0x48/0x70\n [\u003cffffffffa006bf95\u003e] sg_new_write.isra.17+0x195/0x2d0 [sg]\n [\u003cffffffffa006cef4\u003e] sg_ioctl+0x644/0xdb0 [sg]\n [\u003cffffffff81170f80\u003e] do_vfs_ioctl+0x90/0x520\n [\u003cffffffff81258967\u003e] ? file_has_perm+0x97/0xb0\n [\u003cffffffff811714a1\u003e] SyS_ioctl+0x91/0xb0\n [\u003cffffffff81602afb\u003e] tracesys+0xdd/0xe2\n RIP [\u003cffffffff81281e04\u003e] __blk_put_request+0x154/0x1a0\n\nThe solution is straightforward: just set srp-\u003erq to NULL in the\nfailure branch so that sg_finish_rem_req() doesn\u0027t attempt to re-free\nit.\n\nAdditionally, since sg_rq_end_io() will never be called on the object\nwhen this happens, we need to free memory backing -\u003ecmd if it isn\u0027t\nembedded in the object itself.\n\nKASAN was extremely helpful in finding the root cause of this bug.\n\nChange-Id: I8c2389a4e2e1b5f753a47f8af60502a761b891b5\nSigned-off-by: Calvin Owens \u003ccalvinowens@fb.com\u003e\nAcked-by: Douglas Gilbert \u003cdgilbert@interlog.com\u003e\nSigned-off-by: Martin K. Petersen \u003cmartin.petersen@oracle.com\u003e\n(cherry picked from commit 9533658b7cd20b3991ecb7952e17fa9c70e0184c)\n" }, { "commit": "f5217c8358e4c840fe4b0153d4b0887a8765ce81", "tree": "eaf320607683e0be78c1331bb630b770177502f7", "parents": [ "9b942302a65f2d981c418dc5077b6b8ffe23f2f7" ], "author": { "name": "Omar Sandoval", "email": "osandov@fb.com", "time": "Fri Jul 01 00:39:35 2016 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 06:58:37 2016 -0800" }, "message": "block: fix use-after-free in sys_ioprio_get()\n\nget_task_ioprio() accesses the task-\u003eio_context without holding the task\nlock and thus can race with exit_io_context(), leading to a\nuse-after-free. The reproducer below hits this within a few seconds on\nmy 4-core QEMU VM:\n\nint main(int argc, char **argv)\n{\n\tpid_t pid, child;\n\tlong nproc, i;\n\n\t/* ioprio_set(IOPRIO_WHO_PROCESS, 0, IOPRIO_PRIO_VALUE(IOPRIO_CLASS_IDLE, 0)); */\n\tsyscall(SYS_ioprio_set, 1, 0, 0x6000);\n\n\tnproc \u003d sysconf(_SC_NPROCESSORS_ONLN);\n\n\tfor (i \u003d 0; i \u003c nproc; i++) {\n\t\tpid \u003d fork();\n\t\tassert(pid !\u003d -1);\n\t\tif (pid \u003d\u003d 0) {\n\t\t\tfor (;;) {\n\t\t\t\tpid \u003d fork();\n\t\t\t\tassert(pid !\u003d -1);\n\t\t\t\tif (pid \u003d\u003d 0) {\n\t\t\t\t\t_exit(0);\n\t\t\t\t} else {\n\t\t\t\t\tchild \u003d wait(NULL);\n\t\t\t\t\tassert(child \u003d\u003d pid);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tpid \u003d fork();\n\t\tassert(pid !\u003d -1);\n\t\tif (pid \u003d\u003d 0) {\n\t\t\tfor (;;) {\n\t\t\t\t/* ioprio_get(IOPRIO_WHO_PGRP, 0); */\n\t\t\t\tsyscall(SYS_ioprio_get, 2, 0);\n\t\t\t}\n\t\t}\n\t}\n\n\tfor (;;) {\n\t\t/* ioprio_get(IOPRIO_WHO_PGRP, 0); */\n\t\tsyscall(SYS_ioprio_get, 2, 0);\n\t}\n\n\treturn 0;\n}\n\nThis gets us KASAN dumps like this:\n\n[ 35.526914] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 35.530009] BUG: KASAN: out-of-bounds in get_task_ioprio+0x7b/0x90 at addr ffff880066f34e6c\n[ 35.530009] Read of size 2 by task ioprio-gpf/363\n[ 35.530009] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 35.530009] BUG blkdev_ioc (Not tainted): kasan: bad access detected\n[ 35.530009] -----------------------------------------------------------------------------\n\n[ 35.530009] Disabling lock debugging due to kernel taint\n[ 35.530009] INFO: Allocated in create_task_io_context+0x2b/0x370 age\u003d0 cpu\u003d0 pid\u003d360\n[ 35.530009] \t___slab_alloc+0x55d/0x5a0\n[ 35.530009] \t__slab_alloc.isra.20+0x2b/0x40\n[ 35.530009] \tkmem_cache_alloc_node+0x84/0x200\n[ 35.530009] \tcreate_task_io_context+0x2b/0x370\n[ 35.530009] \tget_task_io_context+0x92/0xb0\n[ 35.530009] \tcopy_process.part.8+0x5029/0x5660\n[ 35.530009] \t_do_fork+0x155/0x7e0\n[ 35.530009] \tSyS_clone+0x19/0x20\n[ 35.530009] \tdo_syscall_64+0x195/0x3a0\n[ 35.530009] \treturn_from_SYSCALL_64+0x0/0x6a\n[ 35.530009] INFO: Freed in put_io_context+0xe7/0x120 age\u003d0 cpu\u003d0 pid\u003d1060\n[ 35.530009] \t__slab_free+0x27b/0x3d0\n[ 35.530009] \tkmem_cache_free+0x1fb/0x220\n[ 35.530009] \tput_io_context+0xe7/0x120\n[ 35.530009] \tput_io_context_active+0x238/0x380\n[ 35.530009] \texit_io_context+0x66/0x80\n[ 35.530009] \tdo_exit+0x158e/0x2b90\n[ 35.530009] \tdo_group_exit+0xe5/0x2b0\n[ 35.530009] \tSyS_exit_group+0x1d/0x20\n[ 35.530009] \tentry_SYSCALL_64_fastpath+0x1a/0xa4\n[ 35.530009] INFO: Slab 0xffffea00019bcd00 objects\u003d20 used\u003d4 fp\u003d0xffff880066f34ff0 flags\u003d0x1fffe0000004080\n[ 35.530009] INFO: Object 0xffff880066f34e58 @offset\u003d3672 fp\u003d0x0000000000000001\n[ 35.530009] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nFix it by grabbing the task lock while we poke at the io_context.\n\nChange-Id: I4261aaf076fab943a80a45b0a77e023aa4ecbbd8\nCc: stable@vger.kernel.org\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: Omar Sandoval \u003cosandov@fb.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@fb.com\u003e\n(cherry picked from commit 9614b2784fcb54a79586ffae7a9db9b1b156a686)\n" }, { "commit": "9b942302a65f2d981c418dc5077b6b8ffe23f2f7", "tree": "f1b54f863af4148bba694b30ed31000f03c5d570", "parents": [ "023d31ed5b333a7b462f0791e2825198c3f1465d" ], "author": { "name": "Vegard Nossum", "email": "vegard.nossum@oracle.com", "time": "Fri Jul 29 10:40:31 2016 +0200" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 06:58:24 2016 -0800" }, "message": "block: fix use-after-free in seq file\n\nI got a KASAN report of use-after-free:\n\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n BUG: KASAN: use-after-free in klist_iter_exit+0x61/0x70 at addr ffff8800b6581508\n Read of size 8 by task trinity-c1/315\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n BUG kmalloc-32 (Not tainted): kasan: bad access detected\n -----------------------------------------------------------------------------\n\n Disabling lock debugging due to kernel taint\n INFO: Allocated in disk_seqf_start+0x66/0x110 age\u003d144 cpu\u003d1 pid\u003d315\n ___slab_alloc+0x4f1/0x520\n __slab_alloc.isra.58+0x56/0x80\n kmem_cache_alloc_trace+0x260/0x2a0\n disk_seqf_start+0x66/0x110\n traverse+0x176/0x860\n seq_read+0x7e3/0x11a0\n proc_reg_read+0xbc/0x180\n do_loop_readv_writev+0x134/0x210\n do_readv_writev+0x565/0x660\n vfs_readv+0x67/0xa0\n do_preadv+0x126/0x170\n SyS_preadv+0xc/0x10\n do_syscall_64+0x1a1/0x460\n return_from_SYSCALL_64+0x0/0x6a\n INFO: Freed in disk_seqf_stop+0x42/0x50 age\u003d160 cpu\u003d1 pid\u003d315\n __slab_free+0x17a/0x2c0\n kfree+0x20a/0x220\n disk_seqf_stop+0x42/0x50\n traverse+0x3b5/0x860\n seq_read+0x7e3/0x11a0\n proc_reg_read+0xbc/0x180\n do_loop_readv_writev+0x134/0x210\n do_readv_writev+0x565/0x660\n vfs_readv+0x67/0xa0\n do_preadv+0x126/0x170\n SyS_preadv+0xc/0x10\n do_syscall_64+0x1a1/0x460\n return_from_SYSCALL_64+0x0/0x6a\n\n CPU: 1 PID: 315 Comm: trinity-c1 Tainted: G B 4.7.0+ #62\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014\n ffffea0002d96000 ffff880119b9f918 ffffffff81d6ce81 ffff88011a804480\n ffff8800b6581500 ffff880119b9f948 ffffffff8146c7bd ffff88011a804480\n ffffea0002d96000 ffff8800b6581500 fffffffffffffff4 ffff880119b9f970\n Call Trace:\n [\u003cffffffff81d6ce81\u003e] dump_stack+0x65/0x84\n [\u003cffffffff8146c7bd\u003e] print_trailer+0x10d/0x1a0\n [\u003cffffffff814704ff\u003e] object_err+0x2f/0x40\n [\u003cffffffff814754d1\u003e] kasan_report_error+0x221/0x520\n [\u003cffffffff8147590e\u003e] __asan_report_load8_noabort+0x3e/0x40\n [\u003cffffffff83888161\u003e] klist_iter_exit+0x61/0x70\n [\u003cffffffff82404389\u003e] class_dev_iter_exit+0x9/0x10\n [\u003cffffffff81d2e8ea\u003e] disk_seqf_stop+0x3a/0x50\n [\u003cffffffff8151f812\u003e] seq_read+0x4b2/0x11a0\n [\u003cffffffff815f8fdc\u003e] proc_reg_read+0xbc/0x180\n [\u003cffffffff814b24e4\u003e] do_loop_readv_writev+0x134/0x210\n [\u003cffffffff814b4c45\u003e] do_readv_writev+0x565/0x660\n [\u003cffffffff814b8a17\u003e] vfs_readv+0x67/0xa0\n [\u003cffffffff814b8de6\u003e] do_preadv+0x126/0x170\n [\u003cffffffff814b92ec\u003e] SyS_preadv+0xc/0x10\n\nThis problem can occur in the following situation:\n\nopen()\n - pread()\n - .seq_start()\n - iter \u003d kmalloc() // succeeds\n - seqf-\u003eprivate \u003d iter\n - .seq_stop()\n - kfree(seqf-\u003eprivate)\n - pread()\n - .seq_start()\n - iter \u003d kmalloc() // fails\n - .seq_stop()\n - class_dev_iter_exit(seqf-\u003eprivate) // boom! old pointer\n\nAs the comment in disk_seqf_stop() says, stop is called even if start\nfailed, so we need to reinitialise the private pointer to NULL when seq\niteration stops.\n\nAn alternative would be to set the private pointer to NULL when the\nkmalloc() in disk_seqf_start() fails.\n\nChange-Id: I41ee55505a213f99a92ce630885e6c31b4b60232\nCc: stable@vger.kernel.org\nSigned-off-by: Vegard Nossum \u003cvegard.nossum@oracle.com\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Jens Axboe \u003caxboe@fb.com\u003e\n(cherry picked from commit 56d38f3098d4aefa6cb79349555b36dffd1bf1ca)\n" }, { "commit": "023d31ed5b333a7b462f0791e2825198c3f1465d", "tree": "da0fd977fc55743362ef65b2acc996f2183582b4", "parents": [ "b62986e7bd31fbad9e01c5f6199a01413e9b164f" ], "author": { "name": "Jin Qian", "email": "jinqian@google.com", "time": "Mon Jul 20 11:33:07 2015 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 06:58:11 2016 -0800" }, "message": "proc: fix build broken by proc inode per namespace patch\n\nChange-Id: I119e4f31584b4a7ab9d6825499947d59c1293f1b\n(cherry picked from commit 50de7bce629b302e9f09659c0e7df968208c7cc5)\n" }, { "commit": "b62986e7bd31fbad9e01c5f6199a01413e9b164f", "tree": "94ae99a2a24d048956cf302861f4be1092ca9048", "parents": [ "315a9ded11f15ab0e43e30683e2b62453e695d6e" ], "author": { "name": "Daniel Rosenberg", "email": "drosen@google.com", "time": "Tue Jul 21 15:17:26 2015 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 06:52:53 2016 -0800" }, "message": "Fix incorrect conflict resolution in \"vfs: Add setns support for the mount namespace\"\n\nChange-Id: Ib974a066d15036c75f13ff7845cffc5b1f66ac75\n(cherry picked from commit 831730dbc5ebebe0f7d921dafd8aa5e4ed1b4192)\n" }, { "commit": "315a9ded11f15ab0e43e30683e2b62453e695d6e", "tree": "9fe4ebecf54a061ea8e01aebda02f61899e9561a", "parents": [ "851c34bdf9e5002c0be2a9ac3332742f7328b87f" ], "author": { "name": "Naveen Kaje", "email": "nkaje@codeaurora.org", "time": "Tue Jul 29 12:54:15 2014 -0600" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Mon Oct 31 12:16:52 2016 -0700" }, "message": "BACKPORT: fs: Add TTY PM IOCTLs to compat table\n\nAugment the compat ioctl table with entries for\nPM control of TTY devices. These compat entries\nwere not present since other TTY/serial core drivers\nwere not using them.\n\nBackport from kernel msm-3.18\n\nChange-Id: I96a0e54c001d780a2a427380655f1fbb0091aef7\nSigned-off-by: Naveen Kaje \u003cnkaje@codeaurora.org\u003e\n" }, { "commit": "8d1988f838a95e836342b505398d38b223181f17", "tree": "25efd590db98728cf4a4a2bcb0018222ed3781ae", "parents": [ "887cbce4a7f533aef33da6747aaf63b54a814cc1" ], "author": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Wed Oct 26 23:15:47 2016 +0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Wed Oct 26 23:15:47 2016 +0800" }, "message": "Linux 3.4.113\n" }, { "commit": "887cbce4a7f533aef33da6747aaf63b54a814cc1", "tree": "de2f03e2193ec4211f48c0bc4637611bc844e0bd", "parents": [ "1c8544a93151329be95f702f6f4029f860b77ee7" ], "author": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Mon Mar 14 09:56:35 2016 -0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Wed Oct 26 23:15:47 2016 +0800" }, "message": "net: Fix use after free in the recvmmsg exit path\n\ncommit 34b88a68f26a75e4fded796f1a49c40f82234b7d upstream.\n\nThe syzkaller fuzzer hit the following use-after-free:\n\n Call Trace:\n [\u003cffffffff8175ea0e\u003e] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:295\n [\u003cffffffff851cc31a\u003e] __sys_recvmmsg+0x6fa/0x7f0 net/socket.c:2261\n [\u003c inline \u003e] SYSC_recvmmsg net/socket.c:2281\n [\u003cffffffff851cc57f\u003e] SyS_recvmmsg+0x16f/0x180 net/socket.c:2270\n [\u003cffffffff86332bb6\u003e] entry_SYSCALL_64_fastpath+0x16/0x7a\n arch/x86/entry/entry_64.S:185\n\nAnd, as Dmitry rightly assessed, that is because we can drop the\nreference and then touch it when the underlying recvmsg calls return\nsome packets and then hit an error, which will make recvmmsg to set\nsock-\u003esk-\u003esk_err, oops, fix it.\n\nReported-and-Tested-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nCc: Alexander Potapenko \u003cglider@google.com\u003e\nCc: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Kostya Serebryany \u003ckcc@google.com\u003e\nCc: Sasha Levin \u003csasha.levin@oracle.com\u003e\nFixes: a2e2725541fa (\"net: Introduce recvmmsg socket syscall\")\nhttp://lkml.kernel.org/r/20160122211644.GC2470@redhat.com\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "1c8544a93151329be95f702f6f4029f860b77ee7", "tree": "1a1cd34ba915faa832ac83d0086e0cc9f1b1be45", "parents": [ "86eecef7f9d182c759c687020a504235c6bef903" ], "author": { "name": "Michal Hocko", "email": "mhocko@suse.com", "time": "Sun Oct 16 11:55:00 2016 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Wed Oct 26 23:15:46 2016 +0800" }, "message": "mm, gup: close FOLL MAP_PRIVATE race\n\ncommit 19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619 upstream.\n\nfaultin_page drops FOLL_WRITE after the page fault handler did the CoW\nand then we retry follow_page_mask to get our CoWed page. This is racy,\nhowever because the page might have been unmapped by that time and so\nwe would have to do a page fault again, this time without CoW. This\nwould cause the page cache corruption for FOLL_FORCE on MAP_PRIVATE\nread only mappings with obvious consequences.\n\nThis is an ancient bug that was actually already fixed once by Linus\neleven years ago in commit 4ceb5db9757a (\"Fix get_user_pages() race\nfor write access\") but that was then undone due to problems on s390\nby commit f33ea7f404e5 (\"fix get_user_pages bug\") because s390 didn\u0027t\nhave proper dirty pte tracking until abf09bed3cce (\"s390/mm: implement\nsoftware dirty bits\"). This wasn\u0027t a problem at the time as pointed out\nby Hugh Dickins because madvise relied on mmap_sem for write up until\n0a27a14a6292 (\"mm: madvise avoid exclusive mmap_sem\") but since then we\ncan race with madvise which can unmap the fresh COWed page or with KSM\nand corrupt the content of the shared page.\n\nThis patch is based on the Linus\u0027 approach to not clear FOLL_WRITE after\nthe CoW page fault (aka VM_FAULT_WRITE) but instead introduces FOLL_COW\nto note this fact. The flag is then rechecked during follow_pfn_pte to\nenforce the page fault again if we do not see the CoWed page. Linus was\nsuggesting to check pte_dirty again as s390 is OK now. But that would\nmake backporting to some old kernels harder. So instead let\u0027s just make\nsure that vm_normal_page sees a pure anonymous page.\n\nThis would guarantee we are seeing a real CoW page. Introduce\ncan_follow_write_pte which checks both pte_write and falls back to\nPageAnon on forced write faults which passed CoW already. Thanks to Hugh\nto point out that a special care has to be taken for KSM pages because\nour COWed page might have been merged with a KSM one and keep its\nPageAnon flag.\n\nFixes: 0a27a14a6292 (\"mm: madvise avoid exclusive mmap_sem\")\nReported-by: Phil \"not Paul\" Oester \u003ckernel@linuxace.com\u003e\nDisclosed-by: Andy Lutomirski \u003cluto@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Michal Hocko \u003cmhocko@suse.com\u003e\n[bwh: Backported to 3.2:\n - Adjust filename, context, indentation\n - The \u0027no_page\u0027 exit path in follow_page() is different, so open-code the\n cleanup\n - Delete a now-unused label]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "86eecef7f9d182c759c687020a504235c6bef903", "tree": "6ab7aaee44fd4f25fe4b9126084ab720f3eac960", "parents": [ "17fd6bbdac823dac8ecc7a33a7fa42238d9da5ed" ], "author": { "name": "Nikolay Aleksandrov", "email": "nikolay@cumulusnetworks.com", "time": "Tue Nov 17 15:49:06 2015 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Wed Oct 26 23:15:46 2016 +0800" }, "message": "net/core: revert \"net: fix __netdev_update_features return..\" and add comment\n\ncommit 17b85d29e82cc3c874a497a8bc5764d6a2b043e2 upstream.\n\nThis reverts commit 00ee59271777 (\"net: fix __netdev_update_features return\non ndo_set_features failure\")\nand adds a comment explaining why it\u0027s okay to return a value other than\n0 upon error. Some drivers might actually change flags and return an\nerror so it\u0027s better to fire a spurious notification rather than miss\nthese.\n\nCC: Michał Mirosław \u003cmirq-linux@rere.qmqm.pl\u003e\nSigned-off-by: Nikolay Aleksandrov \u003cnikolay@cumulusnetworks.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "17fd6bbdac823dac8ecc7a33a7fa42238d9da5ed", "tree": "2c3d374348ccb83e9899ca6fc8c9232932cdc2b0", "parents": [ "344288395a42ce1959a452e4f3a8543f1c012efe" ], "author": { "name": "Paul Bolle", "email": "pebolle@tiscali.nl", "time": "Thu Feb 18 21:29:08 2016 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Wed Oct 26 23:15:46 2016 +0800" }, "message": "ser_gigaset: use container_of() instead of detour\n\ncommit 8d2c3ab4445640957d136caa3629857d63544a2a upstream.\n\nThe purpose of gigaset_device_release() is to kfree() the struct\nser_cardstate that contains our struct device. This is done via a bit of\na detour. First we make our struct device\u0027s driver_data point to the\ncontainer of our struct ser_cardstate (which is a struct cardstate). In\ngigaset_device_release() we then retrieve that driver_data again. And\nafter that we finally kfree() the struct ser_cardstate that was saved in\nthe struct cardstate.\n\nAll of this can be achieved much easier by using container_of() to get\nfrom our struct device to its container, struct ser_cardstate. Do so.\n\nNote that at the time the detour was implemented commit b8b2c7d845d5\n(\"base/platform: assert that dev_pm_domain callbacks are called\nunconditionally\") had just entered the tree. That commit disconnected\nour platform_device and our platform_driver. These were reconnected\nagain in v4.5-rc2 through commit 25cad69f21f5 (\"base/platform: Fix\nplatform drivers with no probe callback\"). And one of the consequences\nof that fix was that it broke the detour via driver_data. That\u0027s because\nit made __device_release_driver() stop being a NOP for our struct device\nand actually do stuff again. One of the things it now does, is setting\nour driver_data to NULL. That, in turn, makes it impossible for\ngigaset_device_release() to get to our struct cardstate. Which has the\nnet effect of leaking a struct ser_cardstate at every call of this\ndriver\u0027s tty close() operation. So using container_of() has the\nadditional benefit of actually working.\n\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nTested-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: Paul Bolle \u003cpebolle@tiscali.nl\u003e\nAcked-by: Tilman Schmidt \u003ctilman@imap.cc\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "344288395a42ce1959a452e4f3a8543f1c012efe", "tree": "b06c0bf7d0b88c486815af703594686e7fbb6eaa", "parents": [ "658ba629ae9263312ea373c5f9faac0b2dabf070" ], "author": { "name": "Tilman Schmidt", "email": "tilman@imap.cc", "time": "Tue Dec 15 18:11:31 2015 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Wed Oct 26 23:15:46 2016 +0800" }, "message": "ser_gigaset: remove unnecessary kfree() calls from release method\n\ncommit 8aeb3c3d655e22d3aa5ba49f313157bd27354bb4 upstream.\n\ndevice-\u003eplatform_data and platform_device-\u003eresource are never used\nand remain NULL through their entire life. Drops the kfree() calls\nfor them from the device release method.\n\nSigned-off-by: Tilman Schmidt \u003ctilman@imap.cc\u003e\nSigned-off-by: Paul Bolle \u003cpebolle@tiscali.nl\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" } ], "next": "658ba629ae9263312ea373c5f9faac0b2dabf070" }