{"push_id":659108033,"size":10,"distinct_size":10,"ref":"refs/heads/lollipop-caf","head":"a0331449c1b55eba6c8666e195cb967899f98a67","before":"da4f6b5444aa8aa82994df87cee2d683a136bfc4","commits":[{"sha":"c0c3472618d7b5e8c2c7f8d933c0a85ff8904f35","author":{"email":"711c73f64afdce07b7e38039a96d2224209e9a6c@chris-wilson.co.uk","name":"Chris Wilson"},"message":"drm: Prevent overwriting from userspace underallocating core ioctl structs\n\ncommit b062672e305ce071f21eb9e18b102c2a430e0999 upstream.\n\nApply the protections from\n\ncommit 1b2f1489633888d4a06028315dc19d65768a1c05\nAuthor: Dave Airlie <airlied@redhat.com>\nDate:   Sat Aug 14 20:20:34 2010 +1000\n\n    drm: block userspace under allocating buffer and having drivers overwrite it (v2)\n\nto the core ioctl structs as well, for we found one instance where there\nis a 32-/64-bit size mismatch and were guilty of writing beyond the end\nof the user's buffer.\n\nSigned-off-by: Chris Wilson <chris@chris-wilson.co.uk>\nCc: Dave Airlie <airlied@redhat.com>\nReviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>\nCc: dri-devel@lists.freedesktop.org\nSigned-off-by: Dave Airlie <airlied@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/c0c3472618d7b5e8c2c7f8d933c0a85ff8904f35"},{"sha":"1f4e21ca6cbf45c6f70468a833b8d03ca33449e6","author":{"email":"08dc22c6156113f2deff178e35e3ed9b24d6af9e@amd.com","name":"Alex Deucher"},"message":"drm/radeon/atom: workaround vbios bug in transmitter table on rs780\n\ncommit c23632d4e57c0dd20bf50eca08fa0eb8ad3ff680 upstream.\n\nSome rs780 asics seem to be affected as well.\n\nSee:\nhttp://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=91f3a6aaf280294b07c05dfe606e6c27b7ba3c72\n\nFixes:\nhttps://bugzilla.kernel.org/show_bug.cgi?id=60791\n\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/1f4e21ca6cbf45c6f70468a833b8d03ca33449e6"},{"sha":"476147c2fa168a534c3e7432f2f3bb8046fdf327","author":{"email":"4645f7897fd33786a2ee1264d590b3c400559d85@linuxfoundation.org","name":"Greg Kroah-Hartman"},"message":"Linux 3.4.69","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/476147c2fa168a534c3e7432f2f3bb8046fdf327"},{"sha":"3905c0330f26eb40ffb71f76947e308df75655cd","author":{"email":"a5240e9e4c4d742e3a4232ca749f78defd45d722@citrix.com","name":"Wei Liu"},"message":"xen-netback: use jiffies_64 value to calculate credit timeout\n\n[ Upstream commit 059dfa6a93b779516321e5112db9d7621b1367ba ]\n\ntime_after_eq() only works if the delta is < MAX_ULONG/2.\n\nFor a 32bit Dom0, if netfront sends packets at a very low rate, the time\nbetween subsequent calls to tx_credit_exceeded() may exceed MAX_ULONG/2\nand the test for timer_after_eq() will be incorrect. Credit will not be\nreplenished and the guest may become unable to send packets (e.g., if\nprior to the long gap, all credit was exhausted).\n\nUse jiffies_64 variant to mitigate this problem for 32bit Dom0.\n\nSuggested-by: Jan Beulich <jbeulich@suse.com>\nSigned-off-by: Wei Liu <wei.liu2@citrix.com>\nReviewed-by: David Vrabel <david.vrabel@citrix.com>\nCc: Ian Campbell <ian.campbell@citrix.com>\nCc: Jason Luan <jianhai.luan@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/3905c0330f26eb40ffb71f76947e308df75655cd"},{"sha":"5a0a378c3a970cd8c4c99822ab25b81e776d13df","author":{"email":"d1996eefd6f63075256880b1bd8999364b16b5fc@intel.com","name":"Nikhil P Rao"},"message":"PCI: fix truncation of resource size to 32 bits\n\ncommit d6776e6d5c2f8db0252f447b09736075e1bbe387 upstream.\n\n_pci_assign_resource() took an int \"size\" argument, which meant that\nsizes larger than 4GB were truncated.  Change type to resource_size_t.\n\n[bhelgaas: changelog]\nSigned-off-by: Nikhil P Rao <nikhil.rao@intel.com>\nSigned-off-by: Bjorn Helgaas <bhelgaas@google.com>\nCc: Jiri Slaby <jslaby@suse.cz>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/5a0a378c3a970cd8c4c99822ab25b81e776d13df"},{"sha":"ad723d6238a910a3527b470f5361bbb1536bec3e","author":{"email":"c8668a574bb9f9643dce4ce802c681af47750654@zte.com.cn","name":"Rui li"},"message":"USB: add new zte 3g-dongle's pid to option.c\n\ncommit 0636fc507a976cdc40f21bdbcce6f0b98ff1dfe9 upstream.\n\nSigned-off-by: Rui li <li.rui27@zte.com.cn>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/ad723d6238a910a3527b470f5361bbb1536bec3e"},{"sha":"42b5c5d3019fb683e38de5f3e77ba732f67f60a1","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ALSA: hda - Move one-time init codes from generic_hdmi_init()\n\ncommit 8b8d654b55648561287bd8baca0f75f964a17038 upstream.\n\nThe codes to initialize work struct or create a proc interface should\nbe called only once and never although it's called many times through\nthe init callback.  Move that stuff into patch_generic_hdmi() so that\nit's called only once.\n\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nBugLink: https://bugs.launchpad.net/bugs/1212160\nSigned-off-by: David Henningsson <david.henningsson@canonical.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/42b5c5d3019fb683e38de5f3e77ba732f67f60a1"},{"sha":"8e7367a48efa3023557a6c845bb0412ed7842881","author":{"email":"3a4d625ce225e891399f98db96a382ac4a84080b@trash.net","name":"Patrick McHardy"},"message":"netfilter: nf_ct_sip: don't drop packets with offsets pointing outside the packet\n\ncommit 3a7b21eaf4fb3c971bdb47a98f570550ddfe4471 upstream.\n\nSome Cisco phones create huge messages that are spread over multiple packets.\nAfter calculating the offset of the SIP body, it is validated to be within\nthe packet and the packet is dropped otherwise. This breaks operation of\nthese phones. Since connection tracking is supposed to be passive, just let\nthose packets pass unmodified and untracked.\n\nSigned-off-by: Patrick McHardy <kaber@trash.net>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nCc: William Roberts <bill.c.roberts@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/8e7367a48efa3023557a6c845bb0412ed7842881"},{"sha":"2cdc1d0d1950a0f5deca9f577b34fe39fda0cd61","author":{"email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org","name":"Steven Rostedt"},"message":"tracing: Fix potential out-of-bounds in trace_get_user()\n\ncommit 057db8488b53d5e4faa0cedb2f39d4ae75dfbdbb upstream.\n\nAndrey reported the following report:\n\nERROR: AddressSanitizer: heap-buffer-overflow on address ffff8800359c99f3\nffff8800359c99f3 is located 0 bytes to the right of 243-byte region [ffff8800359c9900, ffff8800359c99f3)\nAccessed by thread T13003:\n  #0 ffffffff810dd2da (asan_report_error+0x32a/0x440)\n  #1 ffffffff810dc6b0 (asan_check_region+0x30/0x40)\n  #2 ffffffff810dd4d3 (__tsan_write1+0x13/0x20)\n  #3 ffffffff811cd19e (ftrace_regex_release+0x1be/0x260)\n  #4 ffffffff812a1065 (__fput+0x155/0x360)\n  #5 ffffffff812a12de (____fput+0x1e/0x30)\n  #6 ffffffff8111708d (task_work_run+0x10d/0x140)\n  #7 ffffffff810ea043 (do_exit+0x433/0x11f0)\n  #8 ffffffff810eaee4 (do_group_exit+0x84/0x130)\n  #9 ffffffff810eafb1 (SyS_exit_group+0x21/0x30)\n  #10 ffffffff81928782 (system_call_fastpath+0x16/0x1b)\n\nAllocated by thread T5167:\n  #0 ffffffff810dc778 (asan_slab_alloc+0x48/0xc0)\n  #1 ffffffff8128337c (__kmalloc+0xbc/0x500)\n  #2 ffffffff811d9d54 (trace_parser_get_init+0x34/0x90)\n  #3 ffffffff811cd7b3 (ftrace_regex_open+0x83/0x2e0)\n  #4 ffffffff811cda7d (ftrace_filter_open+0x2d/0x40)\n  #5 ffffffff8129b4ff (do_dentry_open+0x32f/0x430)\n  #6 ffffffff8129b668 (finish_open+0x68/0xa0)\n  #7 ffffffff812b66ac (do_last+0xb8c/0x1710)\n  #8 ffffffff812b7350 (path_openat+0x120/0xb50)\n  #9 ffffffff812b8884 (do_filp_open+0x54/0xb0)\n  #10 ffffffff8129d36c (do_sys_open+0x1ac/0x2c0)\n  #11 ffffffff8129d4b7 (SyS_open+0x37/0x50)\n  #12 ffffffff81928782 (system_call_fastpath+0x16/0x1b)\n\nShadow bytes around the buggy address:\n  ffff8800359c9700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  ffff8800359c9780: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa\n  ffff8800359c9800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  ffff8800359c9880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  ffff8800359c9900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=>ffff8800359c9980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[03]fb\n  ffff8800359c9a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  ffff8800359c9a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  ffff8800359c9b00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\n  ffff8800359c9b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  ffff8800359c9c00: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07\n  Heap redzone:          fa\n  Heap kmalloc redzone:  fb\n  Freed heap region:     fd\n  Shadow gap:            fe\n\nThe out-of-bounds access happens on 'parser->buffer[parser->idx] = 0;'\n\nAlthough the crash happened in ftrace_regex_open() the real bug\noccurred in trace_get_user() where there's an incrementation to\nparser->idx without a check against the size. The way it is triggered\nis if userspace sends in 128 characters (EVENT_BUF_SIZE + 1), the loop\nthat reads the last character stores it and then breaks out because\nthere is no more characters. Then the last character is read to determine\nwhat to do next, and the index is incremented without checking size.\n\nThen the caller of trace_get_user() usually nulls out the last character\nwith a zero, but since the index is equal to the size, it writes a nul\ncharacter after the allocated space, which can corrupt memory.\n\nLuckily, only root user has write access to this file.\n\nLink: http://lkml.kernel.org/r/20131009222323.04fd1a0d@gandalf.local.home\n\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: Steven Rostedt <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/2cdc1d0d1950a0f5deca9f577b34fe39fda0cd61"},{"sha":"a0331449c1b55eba6c8666e195cb967899f98a67","author":{"email":"feca23b3ae4a60fef538f28252c4665e4a95e740@parrot.com","name":"Ivan Djelic"},"message":"ARM: 7668/1: fix memset-related crashes caused by recent GCC (4.7.2) optimizations\n\ncommit 455bd4c430b0c0a361f38e8658a0d6cb469942b5 upstream.\n\nRecent GCC versions (e.g. GCC-4.7.2) perform optimizations based on\nassumptions about the implementation of memset and similar functions.\nThe current ARM optimized memset code does not return the value of\nits first argument, as is usually expected from standard implementations.\n\nFor instance in the following function:\n\nvoid debug_mutex_lock_common(struct mutex *lock, struct mutex_waiter *waiter)\n{\n\tmemset(waiter, MUTEX_DEBUG_INIT, sizeof(*waiter));\n\twaiter->magic = waiter;\n\tINIT_LIST_HEAD(&waiter->list);\n}\n\ncompiled as:\n\n800554d0 <debug_mutex_lock_common>:\n800554d0:       e92d4008        push    {r3, lr}\n800554d4:       e1a00001        mov     r0, r1\n800554d8:       e3a02010        mov     r2, #16 ; 0x10\n800554dc:       e3a01011        mov     r1, #17 ; 0x11\n800554e0:       eb04426e        bl      80165ea0 <memset>\n800554e4:       e1a03000        mov     r3, r0\n800554e8:       e583000c        str     r0, [r3, #12]\n800554ec:       e5830000        str     r0, [r3]\n800554f0:       e5830004        str     r0, [r3, #4]\n800554f4:       e8bd8008        pop     {r3, pc}\n\nGCC assumes memset returns the value of pointer 'waiter' in register r0; causing\nregister/memory corruptions.\n\nThis patch fixes the return value of the assembly version of memset.\nIt adds a 'mov' instruction and merges an additional load+store into\nexisting load/store instructions.\nFor ease of review, here is a breakdown of the patch into 4 simple steps:\n\nStep 1\n======\nPerform the following substitutions:\nip -> r8, then\nr0 -> ip,\nand insert 'mov ip, r0' as the first statement of the function.\nAt this point, we have a memset() implementation returning the proper result,\nbut corrupting r8 on some paths (the ones that were using ip).\n\nStep 2\n======\nMake sure r8 is saved and restored when (! CALGN(1)+0) == 1:\n\nsave r8:\n-       str     lr, [sp, #-4]!\n+       stmfd   sp!, {r8, lr}\n\nand restore r8 on both exit paths:\n-       ldmeqfd sp!, {pc}               @ Now <64 bytes to go.\n+       ldmeqfd sp!, {r8, pc}           @ Now <64 bytes to go.\n(...)\n        tst     r2, #16\n        stmneia ip!, {r1, r3, r8, lr}\n-       ldr     lr, [sp], #4\n+       ldmfd   sp!, {r8, lr}\n\nStep 3\n======\nMake sure r8 is saved and restored when (! CALGN(1)+0) == 0:\n\nsave r8:\n-       stmfd   sp!, {r4-r7, lr}\n+       stmfd   sp!, {r4-r8, lr}\n\nand restore r8 on both exit paths:\n        bgt     3b\n-       ldmeqfd sp!, {r4-r7, pc}\n+       ldmeqfd sp!, {r4-r8, pc}\n(...)\n        tst     r2, #16\n        stmneia ip!, {r4-r7}\n-       ldmfd   sp!, {r4-r7, lr}\n+       ldmfd   sp!, {r4-r8, lr}\n\nStep 4\n======\nRewrite register list \"r4-r7, r8\" as \"r4-r8\".\n\nSigned-off-by: Ivan Djelic <ivan.djelic@parrot.com>\nReviewed-by: Nicolas Pitre <nico@linaro.org>\nSigned-off-by: Dirk Behme <dirk.behme@gmail.com>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>\nCc: Eric Bénard <eric@eukrea.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nConflicts:\n\tarch/arm/lib/memset.S","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/a0331449c1b55eba6c8666e195cb967899f98a67"}]}