{"push_id":790693197,"size":1000,"distinct_size":5384,"ref":"refs/heads/123","head":"56cb5203dc4181fd24d75d82f7e2756c01505822","before":"e85f60b67d506c05b944010313ff348eff657d68","commits":[{"sha":"b99d845bbd969d4de8e3c707f76f0260d3f2be2c","author":{"email":"72416dde44ea762d19e3a7a555e3b59ce98f8eea@chromium.org","name":"Will Drewry"},"message":"CHROMIUM: ARM: arch/arm: allow a scno of -1 to not cause a SIGILL\n\nOn tracehook-friendly platforms, a system call number of -1 falls\nthrough without running much code or taking much action.\n\nARM is different.  This adds a lightweight check to arm_syscall()\nto make sure that ARM behaves the same way.\n\nSigned-off-by: Will Drewry <wad@chromium.org>\nTEST=building on tegra2 now. Will live test with seccomp testsuite. It was through SIGILL.\nBUG=chromium-os:27878\n\nChange-Id: Ie3896b54e9bfa21c22e0df456a47ad03c8d0aa3f\nReviewed-on: https://gerrit.chromium.org/gerrit/21251\nReviewed-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Will Drewry <wad@chromium.org>\nTested-by: Will Drewry <wad@chromium.org>\nSigned-off-by: Sasha Levitskiy <sanek@google.com>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/b99d845bbd969d4de8e3c707f76f0260d3f2be2c"},{"sha":"2e48e52e5678c48cf6e4736ae99e1db9b7fa400a","author":{"email":"72416dde44ea762d19e3a7a555e3b59ce98f8eea@chromium.org","name":"Will Drewry"},"message":"CHROMIUM: seccomp: set -ENOSYS if there is no tracer\n\n[Will attempt to add to -next, but this may need to wait\n until there is a motivating usecase, like ARM, since x86\n does the right thing already.]\n\nOn some arches, -ENOSYS is not set as the default system call\nreturn value.  This means that a skipped or invalid system call\ndoes not yield this response.  That behavior is not inline with\nthe stated ABI of seccomp filter.  To that end, we ensure we set\nthat value here to avoid arch idiosyncrasies.\n\nSigned-off-by: Will Drewry <wad@chromium.org>\nTEST=tegra2_kaen; boot, strace works, seccomp testsuite  trace tests pass\nBUG=chromium-os:27878\n\nChange-Id: I03a5e633d2fbb5d3d3cc33c067b2887068364c17\nReviewed-on: https://gerrit.chromium.org/gerrit/21337\nReviewed-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Will Drewry <wad@chromium.org>\nTested-by: Will Drewry <wad@chromium.org>\nSigned-off-by: Sasha Levitskiy <sanek@google.com>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/2e48e52e5678c48cf6e4736ae99e1db9b7fa400a"},{"sha":"4e93e06d100541d56a7cce42fcf01d0784b7a00f","author":{"email":"72416dde44ea762d19e3a7a555e3b59ce98f8eea@chromium.org","name":"Will Drewry"},"message":"CHROMIUM: ARM: r1->r0 for get/set arguments\n\nARM reuses r0 as the first argument. This fixes the mistaken\nassumption in the original patchset.  These will be merged\ninto one change when sent upstream.\n\nSigned-off-by: Will Drewry <wad@chromium.org>\nTEST=emerge tegra2_kaen; run seccomp testsuite\nBUG=chromium-os:27878\n\nChange-Id: Iaaa09995d35f78ee8cef7b600d526e71f3b2fcec\nReviewed-on: https://gerrit.chromium.org/gerrit/21342\nReviewed-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Will Drewry <wad@chromium.org>\nTested-by: Will Drewry <wad@chromium.org>\nSigned-off-by: Sasha Levitskiy <sanek@google.com>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/4e93e06d100541d56a7cce42fcf01d0784b7a00f"},{"sha":"5255fd28cee5a5c67789256e11fbd0a9a6f96efc","author":{"email":"50cb10d2be062154b17ab4d66a4eab34f1cf1c84@chromium.org","name":"Kees Cook"},"message":"MAINTAINERS: create seccomp entry\n\nAdd myself as seccomp maintainer.\n\nSuggested-by: James Morris <jmorris@namei.org>\nSigned-off-by: Kees Cook <keescook@chromium.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/5255fd28cee5a5c67789256e11fbd0a9a6f96efc"},{"sha":"1cf256f1c50b4542ac7dc7aebe4517ec936ef25a","author":{"email":"50cb10d2be062154b17ab4d66a4eab34f1cf1c84@chromium.org","name":"Kees Cook"},"message":"seccomp: create internal mode-setting function\n\nIn preparation for having other callers of the seccomp mode setting\nlogic, split the prctl entry point away from the core logic that performs\nseccomp mode setting.\n\nSigned-off-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Oleg Nesterov <oleg@redhat.com>\nReviewed-by: Andy Lutomirski <luto@amacapital.net>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/1cf256f1c50b4542ac7dc7aebe4517ec936ef25a"},{"sha":"bd8e1cab7658ed0559e1e9dd40915e5a81fc0d12","author":{"email":"50cb10d2be062154b17ab4d66a4eab34f1cf1c84@chromium.org","name":"Kees Cook"},"message":"seccomp: extract check/assign mode helpers\n\nTo support splitting mode 1 from mode 2, extract the mode checking and\nassignment logic into common functions.\n\nSigned-off-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Oleg Nesterov <oleg@redhat.com>\nReviewed-by: Andy Lutomirski <luto@amacapital.net>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/bd8e1cab7658ed0559e1e9dd40915e5a81fc0d12"},{"sha":"4adf2cd4e3a59cb4c1ac5ff6a4797a5dbeb46371","author":{"email":"50cb10d2be062154b17ab4d66a4eab34f1cf1c84@chromium.org","name":"Kees Cook"},"message":"seccomp: split mode setting routines\n\nSeparates the two mode setting paths to make things more readable with\nfewer #ifdefs within function bodies.\n\nSigned-off-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Oleg Nesterov <oleg@redhat.com>\nReviewed-by: Andy Lutomirski <luto@amacapital.net>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/4adf2cd4e3a59cb4c1ac5ff6a4797a5dbeb46371"},{"sha":"64d484eaea29d59a43d59f8511e7d3d8c2ec8ec8","author":{"email":"50cb10d2be062154b17ab4d66a4eab34f1cf1c84@chromium.org","name":"Kees Cook"},"message":"seccomp: add \"seccomp\" syscall\n\nThis adds the new \"seccomp\" syscall with both an \"operation\" and \"flags\"\nparameter for future expansion. The third argument is a pointer value,\nused with the SECCOMP_SET_MODE_FILTER operation. Currently, flags must\nbe 0. This is functionally equivalent to prctl(PR_SET_SECCOMP, ...).\n\nIn addition to the TSYNC flag later in this patch series, there is a\nnon-zero chance that this syscall could be used for configuring a fixed\nargument area for seccomp-tracer-aware processes to pass syscall arguments\nin the future. Hence, the use of \"seccomp\" not simply \"seccomp_add_filter\"\nfor this syscall. Additionally, this syscall uses operation, flags,\nand user pointer for arguments because strictly passing arguments via\na user pointer would mean seccomp itself would be unable to trivially\nfilter the seccomp syscall itself.\n\nSigned-off-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Oleg Nesterov <oleg@redhat.com>\nReviewed-by: Andy Lutomirski <luto@amacapital.net>\n\nConflicts:\n\tarch/x86/syscalls/syscall_32.tbl\n\tarch/x86/syscalls/syscall_64.tbl\n\tinclude/linux/syscalls.h\n\tinclude/uapi/asm-generic/unistd.h\n\tinclude/uapi/linux/seccomp.h\n\tkernel/seccomp.c\n\tkernel/sys_ni.c","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/64d484eaea29d59a43d59f8511e7d3d8c2ec8ec8"},{"sha":"13b77e10e9fd12add31b1f97052ae013b6ae695a","author":{"email":"50cb10d2be062154b17ab4d66a4eab34f1cf1c84@chromium.org","name":"Kees Cook"},"message":"ARM: add seccomp syscall\n\nWires up the new seccomp syscall.\n\nSigned-off-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Oleg Nesterov <oleg@redhat.com>\n\nConflicts:\n\tarch/arm/include/uapi/asm/unistd.h\n\tarch/arm/kernel/calls.S","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/13b77e10e9fd12add31b1f97052ae013b6ae695a"},{"sha":"db8ca0a128cb7a0eb1f21d529ec7d5fdd393a89d","author":{"email":"50cb10d2be062154b17ab4d66a4eab34f1cf1c84@chromium.org","name":"Kees Cook"},"message":"sched: move no_new_privs into new atomic flags\n\nSince seccomp transitions between threads requires updates to the\nno_new_privs flag to be atomic, the flag must be part of an atomic flag\nset. This moves the nnp flag into a separate task field, and introduces\naccessors.\n\nSigned-off-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Oleg Nesterov <oleg@redhat.com>\nReviewed-by: Andy Lutomirski <luto@amacapital.net>\n\nConflicts:\n\tfs/exec.c\n\tinclude/linux/sched.h\n\tkernel/sys.c","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/db8ca0a128cb7a0eb1f21d529ec7d5fdd393a89d"},{"sha":"850c3661fa68215fa7529ddf252765ef364a2c48","author":{"email":"50cb10d2be062154b17ab4d66a4eab34f1cf1c84@chromium.org","name":"Kees Cook"},"message":"seccomp: split filter prep from check and apply\n\nIn preparation for adding seccomp locking, move filter creation away\nfrom where it is checked and applied. This will allow for locking where\nno memory allocation is happening. The validation, filter attachment,\nand seccomp mode setting can all happen under the future locks.\n\nFor extreme defensiveness, I've added a BUG_ON check for the calculated\nsize of the buffer allocation in case BPF_MAXINSN ever changes, which\nshouldn't ever happen. The compiler should actually optimize out this\ncheck since the test above it makes it impossible.\n\nSigned-off-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Oleg Nesterov <oleg@redhat.com>\nReviewed-by: Andy Lutomirski <luto@amacapital.net>\n\nConflicts:\n\tkernel/seccomp.c","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/850c3661fa68215fa7529ddf252765ef364a2c48"},{"sha":"4cad9be1133e2c63c734dc00ad38c995022ddc5e","author":{"email":"50cb10d2be062154b17ab4d66a4eab34f1cf1c84@chromium.org","name":"Kees Cook"},"message":"seccomp: introduce writer locking\n\nNormally, task_struct.seccomp.filter is only ever read or modified by\nthe task that owns it (current). This property aids in fast access\nduring system call filtering as read access is lockless.\n\nUpdating the pointer from another task, however, opens up race\nconditions. To allow cross-thread filter pointer updates, writes to the\nseccomp fields are now protected by the sighand spinlock (which is shared\nby all threads in the thread group). Read access remains lockless because\npointer updates themselves are atomic.  However, writes (or cloning)\noften entail additional checking (like maximum instruction counts)\nwhich require locking to perform safely.\n\nIn the case of cloning threads, the child is invisible to the system\nuntil it enters the task list. To make sure a child can't be cloned from\na thread and left in a prior state, seccomp duplication is additionally\nmoved under the sighand lock. Then parent and child are certain have\nthe same seccomp state when they exit the lock.\n\nBased on patches by Will Drewry and David Drysdale.\n\nSigned-off-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Oleg Nesterov <oleg@redhat.com>\nReviewed-by: Andy Lutomirski <luto@amacapital.net>\n\nConflicts:\n\tkernel/fork.c","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/4cad9be1133e2c63c734dc00ad38c995022ddc5e"},{"sha":"a4c269c7113897ee4a5e10180c047480d7b40210","author":{"email":"50cb10d2be062154b17ab4d66a4eab34f1cf1c84@chromium.org","name":"Kees Cook"},"message":"seccomp: allow mode setting across threads\n\nThis changes the mode setting helper to allow threads to change the\nseccomp mode from another thread. We must maintain barriers to keep\nTIF_SECCOMP synchronized with the rest of the seccomp state.\n\nSigned-off-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Oleg Nesterov <oleg@redhat.com>\nReviewed-by: Andy Lutomirski <luto@amacapital.net>\n\nConflicts:\n\tkernel/seccomp.c","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/a4c269c7113897ee4a5e10180c047480d7b40210"},{"sha":"420297354c789dbf6fe7334f13ac49507d72af26","author":{"email":"20b70f0af00562e63758b9ee42012ecc96c58590@redhat.com","name":"Oleg Nesterov"},"message":"introduce for_each_thread() to replace the buggy while_each_thread()\n\nwhile_each_thread() and next_thread() should die, almost every lockless\nusage is wrong.\n\n1. Unless g == current, the lockless while_each_thread() is not safe.\n\n   while_each_thread(g, t) can loop forever if g exits, next_thread()\n   can't reach the unhashed thread in this case. Note that this can\n   happen even if g is the group leader, it can exec.\n\n2. Even if while_each_thread() itself was correct, people often use\n   it wrongly.\n\n   It was never safe to just take rcu_read_lock() and loop unless\n   you verify that pid_alive(g) == T, even the first next_thread()\n   can point to the already freed/reused memory.\n\nThis patch adds signal_struct->thread_head and task->thread_node to\ncreate the normal rcu-safe list with the stable head.  The new\nfor_each_thread(g, t) helper is always safe under rcu_read_lock() as\nlong as this task_struct can't go away.\n\nNote: of course it is ugly to have both task_struct->thread_node and the\nold task_struct->thread_group, we will kill it later, after we change\nthe users of while_each_thread() to use for_each_thread().\n\nPerhaps we can kill it even before we convert all users, we can\nreimplement next_thread(t) using the new thread_head/thread_node.  But\nwe can't do this right now because this will lead to subtle behavioural\nchanges.  For example, do/while_each_thread() always sees at least one\ntask, while for_each_thread() can do nothing if the whole thread group\nhas died.  Or thread_group_empty(), currently its semantics is not clear\nunless thread_group_leader(p) and we need to audit the callers before we\ncan change it.\n\nSo this patch adds the new interface which has to coexist with the old\none for some time, hopefully the next changes will be more or less\nstraightforward and the old one will go away soon.\n\nSigned-off-by: Oleg Nesterov <oleg@redhat.com>\nReviewed-by: Sergey Dyasly <dserrg@gmail.com>\nTested-by: Sergey Dyasly <dserrg@gmail.com>\nReviewed-by: Sameer Nanda <snanda@chromium.org>\nAcked-by: David Rientjes <rientjes@google.com>\nCc: \"Eric W. Biederman\" <ebiederm@xmission.com>\nCc: Frederic Weisbecker <fweisbec@gmail.com>\nCc: Mandeep Singh Baines <msb@chromium.org>\nCc: \"Ma, Xindong\" <xindong.ma@intel.com>\nCc: Michal Hocko <mhocko@suse.cz>\nCc: \"Tu, Xiaobing\" <xiaobing.tu@intel.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n\nConflicts:\n\tkernel/fork.c","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/420297354c789dbf6fe7334f13ac49507d72af26"},{"sha":"f1a342246b1ae4c63e3e76db1a78be0fedddd508","author":{"email":"50cb10d2be062154b17ab4d66a4eab34f1cf1c84@chromium.org","name":"Kees Cook"},"message":"seccomp: implement SECCOMP_FILTER_FLAG_TSYNC\n\nApplying restrictive seccomp filter programs to large or diverse\ncodebases often requires handling threads which may be started early in\nthe process lifetime (e.g., by code that is linked in). While it is\npossible to apply permissive programs prior to process start up, it is\ndifficult to further restrict the kernel ABI to those threads after that\npoint.\n\nThis change adds a new seccomp syscall flag to SECCOMP_SET_MODE_FILTER for\nsynchronizing thread group seccomp filters at filter installation time.\n\nWhen calling seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC,\nfilter) an attempt will be made to synchronize all threads in current's\nthreadgroup to its new seccomp filter program. This is possible iff all\nthreads are using a filter that is an ancestor to the filter current is\nattempting to synchronize to. NULL filters (where the task is running as\nSECCOMP_MODE_NONE) are also treated as ancestors allowing threads to be\ntransitioned into SECCOMP_MODE_FILTER. If prctrl(PR_SET_NO_NEW_PRIVS,\n...) has been set on the calling thread, no_new_privs will be set for\nall synchronized threads too. On success, 0 is returned. On failure,\nthe pid of one of the failing threads will be returned and no filters\nwill have been applied.\n\nThe race conditions against another thread are:\n- requesting TSYNC (already handled by sighand lock)\n- performing a clone (already handled by sighand lock)\n- changing its filter (already handled by sighand lock)\n- calling exec (handled by cred_guard_mutex)\nThe clone case is assisted by the fact that new threads will have their\nseccomp state duplicated from their parent before appearing on the tasklist.\n\nHolding cred_guard_mutex means that seccomp filters cannot be assigned\nwhile in the middle of another thread's exec (potentially bypassing\nno_new_privs or similar). The call to de_thread() may kill threads waiting\nfor the mutex.\n\nChanges across threads to the filter pointer includes a barrier.\n\nBased on patches by Will Drewry.\n\nSuggested-by: Julien Tinnes <jln@chromium.org>\nSigned-off-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Oleg Nesterov <oleg@redhat.com>\nReviewed-by: Andy Lutomirski <luto@amacapital.net>\n\nConflicts:\n\tinclude/linux/seccomp.h\n\tinclude/uapi/linux/seccomp.h","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/f1a342246b1ae4c63e3e76db1a78be0fedddd508"},{"sha":"a94cffc650faadb79683835b2e00e7c183693926","author":{"email":"f55ad94e336f3a28322d0a25d280221ea9daf7a3@google.com","name":"Robert Sesek"},"message":"seccomp: Use atomic operations that are present in kernel 3.4.\n\nSigned-off-by: Robert Sesek <rsesek@google.com>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/a94cffc650faadb79683835b2e00e7c183693926"},{"sha":"22148dccc5770019794dd2f3b01ab8299e06dc21","author":{"email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost","name":"Linux Build Service Account"},"message":"Merge \"msm_fb: display: turn off lcdc timing generator when splash is done\"","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/22148dccc5770019794dd2f3b01ab8299e06dc21"},{"sha":"bca4e5f9040b56186ba5d939c95f6e327fb27179","author":{"email":"15979f761f0435734e355242d9be8e8ee9ca4311@codeaurora.org","name":"Vinu Deokaran"},"message":"msm: board-8064: fix for gpio conflict\n\nFix for gpio conflict between adv7481 and home button. On mobis\nplatform gpio27 maps to adv7481 reset pin, but on es2 platform,\ngpio27 maps to home button. This fix will enable both platforms\ngpio to work without conflict.\n\nChange-Id: If435cc7e513c543f2674f549630f0a79f6170542\nSigned-off-by: Vinu Deokaran <vinud@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/bca4e5f9040b56186ba5d939c95f6e327fb27179"},{"sha":"6a440f3cb8b2772c301c0d5a9d5f1d7a611cbf4e","author":{"email":"5ee695045ff23377b540344f819c3ec194b2e2c6@codeaurora.org","name":"Huaibin Yang"},"message":"msm_fb: display: fix pipe solid fill initialization issue\n\nCurrently solid fill mode is not properly initialized. Only the base\npipe allocated for the interface is supposed to be initialized before\ninterface timing generator is turned on. However, the solidfill_init\nfunction initializes all pipes and this could cause underruns on the\npipes already being used.\n\nChange-Id: I6be589c188a2dc285b5dc4a942840c603af6d1be\nSigned-off-by: Huaibin Yang <huaibiny@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/6a440f3cb8b2772c301c0d5a9d5f1d7a611cbf4e"},{"sha":"89770e553be6a683661a2ed19f9d25f1e65a1255","author":{"email":"2c46c2d89e7a7f03dd0177671c94cc505fb41574@codeaurora.org","name":"Linto Paul"},"message":"defconfig: msm: make BT kernel loadable module\n\nMake BT driver a kernel loadable module in order to\nreduce kernel boot time.\n\nChange-Id: I36b4d9ccc00a3540c9585307397d883627613632\nSigned-off-by: Linto Paul <lpaul@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Mrcl1450/android_kernel_sony_msm8x60/commits/89770e553be6a683661a2ed19f9d25f1e65a1255"}]}