{"push_id":549297999,"size":36,"distinct_size":4,"ref":"refs/heads/lolipop","head":"1def215cd096ae33268b30f6d8b27bcfcc494038","before":"c1550c51e6aebabe383aea0c654c7e0b916192b9","commits":[{"sha":"ad4eb6ea8f19edabbd114a1b4a2b0002d9418c17","author":{"email":"fec53db8c4887e6e95defbb5052bc6438029c1e6@codeaurora.org","name":"Jordan Crouse"},"message":"msm: kgsl: Force the ME off before reading the microcode\n\nOn A3XX reading the microcode while the CP is running is dangerous\nbeyond words.  By setting the offset address for the read, we are\nessentially changing the instruction pointer for the ME while it\nis running causing opcode errors, gpu faults and/or system errors.\n\nWe do not want to stop the CP at the beginning of the snapshot\nprocess beacuse doing so changes the RBBM status and the state of\nthe CP registers which may damage the debug effort.  But by the\ntime we get to the microcode read we no longer care about the state\nof the registers so we can freely halt the ME just before starting\nthe read.\n\nConflicts:\n\tdrivers/gpu/msm/adreno_a3xx_snapshot.c\n\nChange-Id: Ic0dedbad85d7ec26915f054dd597e226e8101a29\nSigned-off-by: Jordan Crouse <jcrouse@codeaurora.org>\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/ad4eb6ea8f19edabbd114a1b4a2b0002d9418c17"},{"sha":"8880d5bb53b74a4549c295dfbfe8fd10e8474cfb","author":{"email":"203686835f49d1750fcbb70065cda5c503139a61@android.com","name":"Arve Hjønnevåg"},"message":"Staging: android: binder: More offset validation.\n\nMake sure offsets don't point to overlapping flat_binder_object\nstructs.\n\nConflicts:\n\tdrivers/staging/android/binder.c\n\nChange-Id: I425ab0c46fbe2b00ed679c5becf9e8140395eb40\nSigned-off-by: Arve Hjønnevåg <arve@android.com>\nGit-commit: 457c3cd05958b8397211ae1f6dd3c3d325f4c0ea\nGit-repo: https://android.googlesource.com/kernel/common/\nSigned-off-by: Neeti Desai <neetid@codeaurora.org>\nSigned-off-by: Ajay Dudani <adudani@codeaurora.org>\nSigned-off-by: Nirmal Abraham <nabrah@codeaurora.org>\nSigned-off-by: Prados Das <prados@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/8880d5bb53b74a4549c295dfbfe8fd10e8474cfb"},{"sha":"b31e7264d1a89699ee2eef53c1c0fa31fd41384b","author":{"email":"af9cbceb8388e2170881d17f5ca88833c5c37ed6@codeaurora.org","name":"Shubhraprakash Das"},"message":"msm: kgsl: Increase the timeout value for fault detection\n\nIncrement the timeout value for detecting faults from 50ms to\n200ms. The fault detection mechanism is a backup to hardware\nfault detection. 50ms is small since it has been observed that\nthis mechanism triggers false positives with 50ms.\n\nCRs-Fixed: 672164\nChange-Id: I8f382051e06bdc47f152309a2868092e1980604e\nSigned-off-by: Shubhraprakash Das <sadas@codeaurora.org>\nSigned-off-by: Tarun Karra <tkarra@codeaurora.org>\nSigned-off-by: Sunil Khatri <sunilkh@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/b31e7264d1a89699ee2eef53c1c0fa31fd41384b"},{"sha":"ecab17be93f5c130f7ea19e860dce7472d297b0d","author":{"email":"00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de","name":"Thomas Gleixner"},"message":"futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)\n\nIf uaddr == uaddr2, then we have broken the rule of only requeueing from\na non-pi futex to a pi futex with this call.  If we attempt this, then\ndangling pointers may be left for rt_waiter resulting in an exploitable\ncondition.\n\nThis change brings futex_requeue() in line with futex_wait_requeue_pi()\nwhich performs the same check as per commit 6f7b0a2a5c0f (\"futex: Forbid\nuaddr == uaddr2 in futex_wait_requeue_pi()\")\n\n[ tglx: Compare the resulting keys as well, as uaddrs might be\n  \tdifferent depending on the mapping ]\n\nFixes CVE-2014-3153.\n\nReported-by: Pinkie Pie\nSigned-off-by: Will Drewry <wad@chromium.org>\nSigned-off-by: Kees Cook <keescook@chromium.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nReviewed-by: Darren Hart <dvhart@linux.intel.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nChange-Id: I9ee5c8a87cc43c7b1e1dc2796949e7c20c74ddf4\nGit-commit: e9c243a5a6de0be8e584c604d353412584b592f8\nGit-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\nSigned-off-by: Divya Sharma <c_shard@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/ecab17be93f5c130f7ea19e860dce7472d297b0d"},{"sha":"d21fa7b2c97dd355366abe7f648b80bad8672e60","author":{"email":"432784a429e5c6bfee995afc7cd6d79e756339fb@intel.com","name":"Wang, Xiaoming"},"message":"net: ipv4: current group_info should be put after using.\n\nPlug a group_info refcount leak in ping_init.\ngroup_info is only needed during initialization and\nthe code failed to release the reference on exit.\nWhile here move grabbing the reference to a place\nwhere it is actually needed.\n\nChange-Id: I38d476f49e7ae300bc1168bc4b2c1b67274a51ca\nSigned-off-by: Chuansheng Liu <chuansheng.liu@intel.com>\nSigned-off-by: Zhang Dongxing <dongxing.zhang@intel.com>\nSigned-off-by: xiaoming wang <xiaoming.wang@intel.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nGit-commit:b04c46190219a4f845e46a459e3102137b7f6cac\nGit-repo: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git\nSigned-off-by: Divya Sharma <c_shard@codeaurora.org>\n[rsiddoji@codeaurora.org: resolve trivial merge conflicts]\nSigned-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/d21fa7b2c97dd355366abe7f648b80bad8672e60"},{"sha":"a6e4893b0fae844bc5ff286eae5740fa9fbe7bf0","author":{"email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost","name":"Linux Build Service Account"},"message":"Merge \"msm: kgsl: Force the ME off before reading the microcode\"","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/a6e4893b0fae844bc5ff286eae5740fa9fbe7bf0"},{"sha":"287ea41b9e0be394f5d7d0eba9869fc4365fec44","author":{"email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost","name":"Linux Build Service Account"},"message":"Merge \"msm: kgsl: Increase the timeout value for fault detection\"","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/287ea41b9e0be394f5d7d0eba9869fc4365fec44"},{"sha":"110c783372c3f35bac04ee3b629322b125be2b66","author":{"email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost","name":"Linux Build Service Account"},"message":"Merge \"Merge \"msm: kgsl: Increase the timeout value for fault detection\"\"","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/110c783372c3f35bac04ee3b629322b125be2b66"},{"sha":"407ebcc000bec3a9aa26f65707ae314b15e8e23e","author":{"email":"2e473c16998297376fa93aaaf19bfd6462656788@codeaurora.org","name":"Gaurav Gagrani"},"message":"msm: kgsl: Don't hold the refernce to the process private in kgsl create context\n\nThere is a possible race condition for dev_priv where the kgsl_release\nis called, while adreno_ft_detect has reference for the same context.\nThis change will avoid to use dev_priv in context destroy, which is\nalready freed in kgsl_release.\n\nCRs-Fixed: 688521\nChange-Id: I0411873b605c4e264057eaa3f79c6439004c427c\nSigned-off-by: Gaurav Gagrani <ggagrani@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/407ebcc000bec3a9aa26f65707ae314b15e8e23e"},{"sha":"8a8b01263b950d6c777275123f7f8e0c3344644a","author":{"email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost","name":"Linux Build Service Account"},"message":"Merge \"msm: kgsl: Don't hold the refernce to the process private in kgsl create context\"","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/8a8b01263b950d6c777275123f7f8e0c3344644a"},{"sha":"75b38de5e10c02adc31562a6ef3606598fde40bc","author":{"email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost","name":"Linux Build Service Account"},"message":"Merge \"Merge \"msm: kgsl: Don't hold the refernce to the process private in kgsl create context\"\"","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/75b38de5e10c02adc31562a6ef3606598fde40bc"},{"sha":"f49114d75a2ce4b7143f8b555491290447c66519","author":{"email":"f20d708e3113324fd359f30f88ce125131becc93@codeaurora.org","name":"Ashok Raj Deenadayalan"},"message":"msm: camera: Propogate vpe subdev init error\n\nPropogate vpe subdev init error so that we dont end up\nin NULL pointer dereference.\n\nCRs-Fixed: 637459\nChange-Id: I4582a8a673576c525ad3b59a3c6a8e983a1d0941\nSigned-off-by: Ashok Raj Deenadayalan <adeena@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/f49114d75a2ce4b7143f8b555491290447c66519"},{"sha":"6a3aa61a68d662cce468af1ed326fddf54109ad1","author":{"email":"4b8373d016f277527198385ba72fda0feb5da015@hurleysoftware.com","name":"Peter Hurley"},"message":"n_tty: Fix n_tty_write crash when echoing in raw mode\n\nThe tty atomic_write_lock does not provide an exclusion guarantee for\nthe tty driver if the termios settings are LECHO & !OPOST. And since\nit is unexpected and not allowed to call TTY buffer helpers like\ntty_insert_flip_string concurrently, this may lead to crashes when\nconcurrect writers call pty_write. In that case the following two\nwriters:\n* the ECHOing from a workqueue and\n* pty_write from the process\nrace and can overflow the corresponding TTY buffer like follows.\n\nIf we look into tty_insert_flip_string_fixed_flag, there is:\n  int space = __tty_buffer_request_room(port, goal, flags);\n  struct tty_buffer *tb = port->buf.tail;\n  ...\n  memcpy(char_buf_ptr(tb, tb->used), chars, space);\n  ...\n  tb->used += space;\n\nso the race of the two can result in something like this:\n          A                             B\n   __tty_buffer_request_room\n                                  __tty_buffer_request_room\n   memcpy(buf(tb->used), ...)\n   tb->used += space;\n                                 memcpy(buf(tb->used), ...) ->BOOM\n\nB's memcpy is past the tty_buffer due to the previous A's tb->used\nincrement.\n\nSince the N_TTY line discipline input processing can output\nconcurrently with a tty write, obtain the N_TTY ldisc output_lock to\nserialize echo output with normal tty writes. This ensures the tty\nbuffer helper tty_insert_flip_string is not called concurrently and\neverything is fine.\n\nNote that this is nicely reproducible by an ordinary user using\nforkpty and some setup around that (raw termios + ECHO). And it is\npresent in kernels at least after commit\nd945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to\nuse the normal buffering logic) in 2.6.31-rc3.\n\njs: add more info to the commit log\njs: switch to bool\njs: lock unconditionally\njs: lock only the tty->ops->write call\n\nSigned-off-by: Peter Hurley <peter@hurleysoftware.com>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nChange-Id: I9e235db6ec2bb950f26bd8a23f6145dab5dc0a15\nGit-commit: 4291086b1f081b869c6d79e5b7441633dc3ace00\nGit-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\nSigned-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>\n[rsiddoji@codeaurora.org: resolve trivial merge conflicts]\nSigned-off-by: Ravi Kumar S <rsiddoji@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/6a3aa61a68d662cce468af1ed326fddf54109ad1"},{"sha":"07c8228730c901dfb7ab93b42ada3a9efefe851a","author":{"email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost","name":"Linux Build Service Account"},"message":"Merge \"n_tty: Fix n_tty_write crash when echoing in raw mode\"","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/07c8228730c901dfb7ab93b42ada3a9efefe851a"},{"sha":"7eb7890163fd90ec8c2abace8bd9ffc61ce573c4","author":{"email":"1dc9a55fbcba59128627e933e7c9fd67d2a78e24@codeaurora.org","name":"Subash Abhinov Kasiviswanathan"},"message":"msm_bam_rmnet: Fix potential memory corruption\n\nUsage of legacy string manipulation function sprintf could lead to\nmemory corruption as the number of bytes to be written to the\ndestination is not bounded. Replace sprintf with snprintf where the\nnumber of bytes to be written is explicitly specified.\n\nCRs-fixed: 672202\nChange-Id: Iab7516ad0e2540eb619fe96e26a3516c7adf86cc\nSigned-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/7eb7890163fd90ec8c2abace8bd9ffc61ce573c4"},{"sha":"3d3a2a0cead41d2ccc478681b28bcc613dcb3f83","author":{"email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost","name":"Linux Build Service Account"},"message":"Merge \"Merge \"n_tty: Fix n_tty_write crash when echoing in raw mode\"\"","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/3d3a2a0cead41d2ccc478681b28bcc613dcb3f83"},{"sha":"9ef9dc3030e71d359e3477aa1ed7bb70d9718669","author":{"email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost","name":"Linux Build Service Account"},"message":"Merge \"msm_bam_rmnet: Fix potential memory corruption\"","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/9ef9dc3030e71d359e3477aa1ed7bb70d9718669"},{"sha":"6c06ef3f5e50cf64f2af8203c9de1bbdc0dc2aa0","author":{"email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost","name":"Linux Build Service Account"},"message":"Merge \"Merge \"msm_bam_rmnet: Fix potential memory corruption\"\"","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/6c06ef3f5e50cf64f2af8203c9de1bbdc0dc2aa0"},{"sha":"4086854692fb065567bbee22c10236c3ee5a3c0d","author":{"email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost","name":"Linux Build Service Account"},"message":"Merge \"Staging: android: binder: More offset validation.\"","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/4086854692fb065567bbee22c10236c3ee5a3c0d"},{"sha":"7aa13db11db9551be619f9e07b5b4d642857458e","author":{"email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost","name":"Linux Build Service Account"},"message":"Merge \"Merge \"Staging: android: binder: More offset validation.\"\"","distinct":false,"url":"https://api.github.com/repos/nikhil18/android_kernel_sony_apq8064/commits/7aa13db11db9551be619f9e07b5b4d642857458e"}]}