{"push_id":757310898,"size":28,"distinct_size":28,"ref":"refs/heads/optimus_stock","head":"681d45c2bc219cca41ff09fbaa8adc7a18f6d9b9","before":"6c6c262956279fc0e7f0962caf929d767ddcb0fc","commits":[{"sha":"d91b16caccfdc01dcc5204f7af5305d2bca34c47","author":{"email":"00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de","name":"Thomas Gleixner"},"message":"futex: Validate atomic acquisition in futex_lock_pi_atomic()\n\nWe need to protect the atomic acquisition in the kernel against rogue\nuser space which sets the user space futex to 0, so the kernel side\nacquisition succeeds while there is existing state in the kernel\nassociated to the real owner.\n\nVerify whether the futex has waiters associated with kernel state. If\nit has, return -EINVAL. The state is corrupted already, so no point in\ncleaning it up. Subsequent calls will fail as well. Not our problem.\n\n[ tglx: Use futex_top_waiter() and explain why we do not need to try\n  \trestoring the already corrupted user space state. ]\n\nSigned-off-by: Darren Hart <dvhart@linux.intel.com>\nCc: Kees Cook <keescook@chromium.org>\nCc: Will Drewry <wad@chromium.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nGit-commit: 550c7910f0e2fd4f130fec2f17541f3614fdfaf9\nGit-repo: https://android.googlesource.com/kernel/common.git\nSigned-off-by: Ian Maund <imaund@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/d91b16caccfdc01dcc5204f7af5305d2bca34c47"},{"sha":"fdcb4dbb1561052d690ba31f9c780ae911bacec7","author":{"email":"00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de","name":"Thomas Gleixner"},"message":"futex: Always cleanup owner tid in unlock_pi\n\nIf the owner died bit is set at futex_unlock_pi, we currently do not\ncleanup the user space futex. So the owner TID of the current owner\n(the unlocker) persists. That's observable inconsistant state,\nespecially when the ownership of the pi state got transferred.\n\nClean it up unconditionally.\n\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: Kees Cook <keescook@chromium.org>\nCc: Will Drewry <wad@chromium.org>\nCc: Darren Hart <dvhart@linux.intel.com>\nCc: stable@vger.kernel.org\nGit-commit: a2ec8e3dcdc6c93f574a0e22039b791cc5e14fa6\nGit-repo: https://android.googlesource.com/kernel/common.git\nSigned-off-by: Ian Maund <imaund@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/fdcb4dbb1561052d690ba31f9c780ae911bacec7"},{"sha":"1ff85a21d790866d137acc366af96e6124fe96d8","author":{"email":"00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de","name":"Thomas Gleixner"},"message":"futex: Make lookup_pi_state more robust\n\nThe current implementation of lookup_pi_state has ambigous handling of\nthe TID value 0 in the user space futex. We can get into the kernel\neven if the TID value is 0, because either there is a stale waiters\nbit or the owner died bit is set or we are called from the requeue_pi\npath or from user space just for fun.\n\nThe current code avoids an explicit sanity check for pid = 0 in case\nthat kernel internal state (waiters) are found for the user space\naddress. This can lead to state leakage and worse under some\ncircumstances.\n\nHandle the cases explicit:\n\n     Waiter | pi_state | pi->owner | uTID      | uODIED | ?\n\n[1]  NULL   | ---      | ---       | 0         | 0/1    | Valid\n[2]  NULL   | ---      | ---       | >0        | 0/1    | Valid\n\n[3]  Found  | NULL     | --        | Any       | 0/1    | Invalid\n\n[4]  Found  | Found    | NULL      | 0         | 1      | Valid\n[5]  Found  | Found    | NULL      | >0        | 1      | Invalid\n\n[6]  Found  | Found    | task      | 0         | 1      | Valid\n\n[7]  Found  | Found    | NULL      | Any       | 0      | Invalid\n\n[8]  Found  | Found    | task      | ==taskTID | 0/1    | Valid\n[9]  Found  | Found    | task      | 0         | 0      | Invalid\n[10] Found  | Found    | task      | !=taskTID | 0/1    | Invalid\n\n[1]  Indicates that the kernel can acquire the futex atomically. We\n     came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.\n\n[2]  Valid, if TID does not belong to a kernel thread. If no matching\n     thread is found then it indicates that the owner TID has died.\n\n[3]  Invalid. The waiter is queued on a non PI futex\n\n[4]  Valid state after exit_robust_list(), which sets the user space\n     value to FUTEX_WAITERS | FUTEX_OWNER_DIED.\n\n[5]  The user space value got manipulated between exit_robust_list()\n     and exit_pi_state_list()\n\n[6]  Valid state after exit_pi_state_list() which sets the new owner in\n     the pi_state but cannot access the user space value.\n\n[7]  pi_state->owner can only be NULL when the OWNER_DIED bit is set.\n\n[8]  Owner and user space value match\n\n[9]  There is no transient state which sets the user space TID to 0\n     except exit_robust_list(), but this is indicated by the\n     FUTEX_OWNER_DIED bit. See [4]\n\n[10] There is no transient state which leaves owner and user space\n     TID out of sync.\n\nBackport to 3.13\n  conflicts: kernel/futex.c\n\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: John Johansen <john.johansen@canonical.com>\nCc: Kees Cook <keescook@chromium.org>\nCc: Will Drewry <wad@chromium.org>\nCc: Darren Hart <dvhart@linux.intel.com>\nCc: stable@vger.kernel.org\nGit-commit: b50939f89dae691f8da9e0fd22e0eae0db1c0ae4\nGit-repo: https://android.googlesource.com/kernel/common.git\nSigned-off-by: Ian Maund <imaund@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/1ff85a21d790866d137acc366af96e6124fe96d8"},{"sha":"77bbf527646b3f1a734e8c382d4165bc4203c6b5","author":{"email":"331be22c6b63ca3e0a03d408c2d906b1b02cd5f2@stressinduktion.org","name":"Hannes Frederic Sowa"},"message":"ipv4: try to cache dst_entries which would cause a redirect\n\nNot caching dst_entries which cause redirects could be exploited by hosts\non the same subnet, causing a severe DoS attack. This effect aggravated\nsince commit f88649721268999 (\"ipv4: fix dst race in sk_dst_get()\").\n\nLookups causing redirects will be allocated with DST_NOCACHE set which\nwill force dst_release to free them via RCU.  Unfortunately waiting for\nRCU grace period just takes too long, we can end up with >1M dst_entries\nwaiting to be released and the system will run OOM. rcuos threads cannot\ncatch up under high softirq load.\n\nAttaching the flag to emit a redirect later on to the specific skb allows\nus to cache those dst_entries thus reducing the pressure on allocation\nand deallocation.\n\nThis issue was discovered by Marcelo Leitner.\n\nCc: Julian Anastasov <ja@ssi.bg>\nSigned-off-by: Marcelo Leitner <mleitner@redhat.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: Julian Anastasov <ja@ssi.bg>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n\nConflicts:\n\tinclude/net/ip.h\n\tnet/ipv4/route.c\n\nChange-Id: I53e4b500a4db2f5fece937a42a3bd810b2640c44","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/77bbf527646b3f1a734e8c382d4165bc4203c6b5"},{"sha":"7c5dd1950aea51f4c335eb006b4c4eb2f8da3936","author":{"email":"cef439e78636cdab99cd2923826c5065a0743e5b@strlen.de","name":"Florian Westphal"},"message":"netfilter: conntrack: disable generic tracking for known protocols\n\nGiven following iptables ruleset:\n\n-P FORWARD DROP\n-A FORWARD -m sctp --dport 9 -j ACCEPT\n-A FORWARD -p tcp --dport 80 -j ACCEPT\n-A FORWARD -p tcp -m conntrack -m state ESTABLISHED,RELATED -j ACCEPT\n\nOne would assume that this allows SCTP on port 9 and TCP on port 80.\nUnfortunately, if the SCTP conntrack module is not loaded, this allows\n*all* SCTP communication, to pass though, i.e. -p sctp -j ACCEPT,\nwhich we think is a security issue.\n\nThis is because on the first SCTP packet on port 9, we create a dummy\n\"generic l4\" conntrack entry without any port information (since\nconntrack doesn't know how to extract this information).\n\nAll subsequent packets that are unknown will then be in established\nstate since they will fallback to proto_generic and will match the\n'generic' entry.\n\nOur originally proposed version [1] completely disabled generic protocol\ntracking, but Jozsef suggests to not track protocols for which a more\nsuitable helper is available, hence we now mitigate the issue for in\ntree known ct protocol helpers only, so that at least NAT and direction\ninformation will still be preserved for others.\n\n [1] http://www.spinics.net/lists/netfilter-devel/msg33430.html\n\nJoint work with Daniel Borkmann.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nAcked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\n\nChange-Id: I9bac2de7bc1eb406c1df53510dedaba6440a9f07","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/7c5dd1950aea51f4c335eb006b4c4eb2f8da3936"},{"sha":"c089e76ca2eb14bdfd01b6b0c1cd14bf92002a88","author":{"email":"8c1011c9d06fc72acd93645d683782ab9543044d@google.com","name":"Michael Halcrow"},"message":"eCryptfs: Remove buggy and unnecessary write in file name decode routine\n\nDmitry Chernenkov used KASAN to discover that eCryptfs writes past the\nend of the allocated buffer during encrypted filename decoding. This\nfix corrects the issue by getting rid of the unnecessary 0 write when\nthe current bit offset is 2.\n\nSigned-off-by: Michael Halcrow <mhalcrow@google.com>\nReported-by: Dmitry Chernenkov <dmitryc@google.com>\nSuggested-by: Kees Cook <keescook@chromium.org>\nCc: stable@vger.kernel.org # v2.6.29+: 51ca58d eCryptfs: Filename Encryption: Encoding and encryption functions\nSigned-off-by: Tyler Hicks <tyhicks@canonical.com>","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/c089e76ca2eb14bdfd01b6b0c1cd14bf92002a88"},{"sha":"ecff4d75222215813093eb3210ee2d1a677a7c7c","author":{"email":"9ff04a02a69f376b2b9aeec27187017cbf3cf5f9@redhat.com","name":"Daniel Borkmann"},"message":"netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages\n\nSome occurences in the netfilter tree use skb_header_pointer() in\nthe following way ...\n\n  struct dccp_hdr _dh, *dh;\n  ...\n  skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);\n\n... where dh itself is a pointer that is being passed as the copy\nbuffer. Instead, we need to use &_dh as the forth argument so that\nwe're copying the data into an actual buffer that sits on the stack.\n\nCurrently, we probably could overwrite memory on the stack (e.g.\nwith a possibly mal-formed DCCP packet), but unintentionally, as\nwe only want the buffer to be placed into _dh variable.\n\nFixes: 2bc780499aa3 (\"[NETFILTER]: nf_conntrack: add DCCP protocol support\")\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/ecff4d75222215813093eb3210ee2d1a677a7c7c"},{"sha":"1e5fcde6dc64c18213b7222da9802dca2ea2f78d","author":{"email":"bc6501c174fe21162c67cfc51ecb38b9a4d035f0@gmail.com","name":"Ethan Chen"},"message":"fs: Remove dummy f2fs symlinks\n\nChange-Id: I1575a03e4cbd9fe1d559e1aab52e0a9e6ee6439f","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/1e5fcde6dc64c18213b7222da9802dca2ea2f78d"},{"sha":"9c5ca421c441a9a42e8f3d144394249bb049d23c","author":{"email":"bc6501c174fe21162c67cfc51ecb38b9a4d035f0@gmail.com","name":"Ethan Chen"},"message":"Merge Motorola motorola-kernel f2fs driver\n\n* Motorola package version: MMI-LXB22.46-28\n\nChange-Id: I265ebd52acc58fec937bb84bc5ba8b4d8ca16415","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/9c5ca421c441a9a42e8f3d144394249bb049d23c"},{"sha":"ceabca16606924bbac297ceae719d39a39ac870f","author":{"email":"acf100fecd02cef2faf6699a6d67014a4da84dd4@gmail.com","name":"attack11"},"message":"Add Prima Drivers","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/ceabca16606924bbac297ceae719d39a39ac870f"},{"sha":"33ee07a578a99938ce5ebc9b69b1f7bc789ea24b","author":{"email":"acf100fecd02cef2faf6699a6d67014a4da84dd4@gmail.com","name":"attack11"},"message":"Make Wlan.ko","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/33ee07a578a99938ce5ebc9b69b1f7bc789ea24b"},{"sha":"67892fc1ea93c2b544a33155c14e731d5f74bc55","author":{"email":"77d2ac97f60e5d5b905585669b1154dbc647411c@gmail.com","name":"dhacker29"},"message":"drivers/usb/gadget/Kconfig:881:warning: defaults for choice values\n\nnot supported\n\nChange-Id: I597f88f7001dfbdb8a61bdee263e626b327a5d36","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/67892fc1ea93c2b544a33155c14e731d5f74bc55"},{"sha":"e3074c02248c72a12583c88c9962c601c856ce9a","author":{"email":"d688953a19dcb476c5fb90e6abba87f77b09be65@gmail.com","name":"Pranav Vashi"},"message":"msm: use of swp{b} is deprecated for ARMv6+\n\nChange-Id: Iaced6f678edfad1c65041fb2b0574a467924ecc2\nSigned-off-by: Pranav Vashi <neobuddy89@gmail.com>","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/e3074c02248c72a12583c88c9962c601c856ce9a"},{"sha":"b29b5f746e47f821af3302d6a28fe46c157a191f","author":{"email":"168fbe9b48536378ad61dccedb637b5a226976e8@linux.org.tw","name":"Chih-Wei Huang"},"message":"cpufreq: interactive: fix compiling warnings\n\nThe gcc warns like:\n\n  cpufreq_interactive.c:745:6: warning: operation on 'ret' may be\nundefined [-Wsequence-point]\n\nIt was introduced by commit cf0fad49d17cb8273ce555dd5b7afab67d7923bf.\n\nSince sprintf(...) just return 1 (one character) in this case, ret\nshould not changed.\nJust discarding the result of sprintf(...) leads to the result that\nthe committer of cf0fad49d17cb8273ce555dd5b7afab67d7923bf wants.\n\nChange-Id: Ifed1cef6d6a31c3ed23dad03a567b3b9eddf3a57\nSigned-off-by: Chih-Wei Huang <cwhuang@android-x86.org>\nSigned-off-by: Dave Daynard <nardholio@gmail.com>","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/b29b5f746e47f821af3302d6a28fe46c157a191f"},{"sha":"b4169ccd027915edaec67e9a3698cff82d148bea","author":{"email":"383ef5577c6e1178b93f59ec8d0936f76d2a98c4@codeaurora.org","name":"Kumar Gala"},"message":"msm: smd: fix in-tree compilation\n\nIn-tree compilation for arch/arm/mach-msm/smd_init_dt.c was hitting this\nerror:\n\narch/arm/mach-msm/smd_init_dt.c:24:25: fatal error: smd_private.h: No such\nfile or directory\n #include <smd_private.h>\n\nThis was due to using <> instead of \"\" style include.\n\nChange-Id: I462d259410377244cd551db910df9e15521544ed\nSigned-off-by: Kumar Gala <galak@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/b4169ccd027915edaec67e9a3698cff82d148bea"},{"sha":"5b5ae64a6038f423a17f9d8f36f11b5d9711e953","author":{"email":"383ef5577c6e1178b93f59ec8d0936f76d2a98c4@codeaurora.org","name":"Kumar Gala"},"message":"ASoC: msm: fix in-tree compilation for RTAC\n\nIn-tree compilation for sound/soc/msm/qdsp6v2/rtac.c was hitting this\nerror:\n\nsound/soc/msm/qdsp6v2/rtac.c:27:21: fatal error: q6voice.h: No such file\nor directory\n #include <q6voice.h>\n\nThis was due to using <> instead of \"\" style include.\n\nChange-Id: Ie96cc91bd29e44c55b9fb0cbc36e25786d6f8823\nSigned-off-by: Kumar Gala <galak@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/5b5ae64a6038f423a17f9d8f36f11b5d9711e953"},{"sha":"769bd30f6bf743d4bd45a435fb3347695d4efc10","author":{"email":"383ef5577c6e1178b93f59ec8d0936f76d2a98c4@codeaurora.org","name":"Kumar Gala"},"message":"msm: Fix compiling kernel in place\n\nA number of files incorrectly used system include notation <> for header\nfiles that are local.  Fix thoses cases to now be #include \"FILE.h\" instead\nof #include <FILE.h>\n\nChange-Id: I1467268b10b33b6fd29bc36b2312378a0b1dde32\nSigned-off-by: Kumar Gala <galak@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/769bd30f6bf743d4bd45a435fb3347695d4efc10"},{"sha":"94c1e27eefc29a6b47ed2104596677e6a666faea","author":{"email":"acf100fecd02cef2faf6699a6d67014a4da84dd4@gmail.com","name":"attack11"},"message":"Clean Up Defconfig","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/94c1e27eefc29a6b47ed2104596677e6a666faea"},{"sha":"1b6134c5ec27f5685626c1d1c67bd68b891d12bd","author":{"email":"acf100fecd02cef2faf6699a6d67014a4da84dd4@gmail.com","name":"attack11"},"message":"Update defconfig","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/1b6134c5ec27f5685626c1d1c67bd68b891d12bd"},{"sha":"35294252f7af18ac3924dc1703e8017379c7ca1d","author":{"email":"c2dd1a32bb3e48cab508ee8058d27d4c1e5f29ec@gmail.com","name":"Varun Chitre"},"message":"return_address.c: Fix warning - TODO: return_address should use unwind tables","distinct":true,"url":"https://api.github.com/repos/desaishivam26/kernel-msm/commits/35294252f7af18ac3924dc1703e8017379c7ca1d"}]}