GitHub PushEvent at 2014-06-09 14:55:57
Repository: android_kernel_htc_msm8974
Actor: CPA-Poke
Payload: {"shas":[["ad4c6208f95389fc8f9b22221a520b0d6ac7068f","00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de","futex: Prevent attaching to kernel threads\n\nWe happily allow userspace to declare a random kernel thread to be the\nowner of a user space PI futex.\n\nFound while analysing the fallout of Dave Jones syscall fuzzer.\n\nWe also should validate the thread group for private futexes and find\nsome fast way to validate whether the \"alleged\" owner has RW access on\nthe file which backs the SHM, but that's a separate issue.\n\nChange-Id: Id43144232efa7c3ae7c630cffa69f55ff83d8fd9\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: Dave Jones <davej@redhat.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Darren Hart <darren@dvhart.com>\nCc: Davidlohr Bueso <davidlohr@hp.com>\nCc: Steven Rostedt <rostedt@goodmis.org>\nCc: Clark Williams <williams@redhat.com>\nCc: Paul McKenney <paulmck@linux.vnet.ibm.com>\nCc: Lai Jiangshan <laijs@cn.fujitsu.com>\nCc: Roland McGrath <roland@hack.frob.com>\nCc: Carlos ODonell <carlos@redhat.com>\nCc: Jakub Jelinek <jakub@redhat.com>\nCc: Michael Kerrisk <mtk.manpages@gmail.com>\nCc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>\nLink: http://lkml.kernel.org/r/20140512201701.194824402@linutronix.de\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: stable@vger.kernel.org","Thomas Gleixner",true],["998b83faf601abcc1dddbf2ec70095da35186a8b","00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de","futex: Add another early deadlock detection check\n\nDave Jones trinity syscall fuzzer exposed an issue in the deadlock\ndetection code of rtmutex:\n  http://lkml.kernel.org/r/20140429151655.GA14277@redhat.com\n\nThat underlying issue has been fixed with a patch to the rtmutex code,\nbut the futex code must not call into rtmutex in that case because\n    - it can detect that issue early\n    - it avoids a different and more complex fixup for backing out\n\nIf the user space variable got manipulated to 0x80000000 which means\nno lock holder, but the waiters bit set and an active pi_state in the\nkernel is found we can figure out the recursive locking issue by\nlooking at the pi_state owner. If that is the current task, then we\ncan safely return -EDEADLK.\n\nThe check should have been added in commit 59fa62451 (futex: Handle\nfutex_pi OWNER_DIED take over correctly) already, but I did not see\nthe above issue caused by user space manipulation back then.\n\nChange-Id: I038ce8d61ee0d427574939b048035877149a2981\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: Dave Jones <davej@redhat.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Darren Hart <darren@dvhart.com>\nCc: Davidlohr Bueso <davidlohr@hp.com>\nCc: Steven Rostedt <rostedt@goodmis.org>\nCc: Clark Williams <williams@redhat.com>\nCc: Paul McKenney <paulmck@linux.vnet.ibm.com>\nCc: Lai Jiangshan <laijs@cn.fujitsu.com>\nCc: Roland McGrath <roland@hack.frob.com>\nCc: Carlos ODonell <carlos@redhat.com>\nCc: Jakub Jelinek <jakub@redhat.com>\nCc: Michael Kerrisk <mtk.manpages@gmail.com>\nCc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>\nLink: http://lkml.kernel.org/r/20140512201701.097349971@linutronix.de\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: stable@vger.kernel.org","Thomas Gleixner",true],["4745a0699d8228dc7138fd11a90a69154bc98241","00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de","futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)\n\nIf uaddr == uaddr2, then we have broken the rule of only requeueing\nfrom a non-pi futex to a pi futex with this call. If we attempt this,\nthen dangling pointers may be left for rt_waiter resulting in an\nexploitable condition.\n\nThis change brings futex_requeue() into line with\nfutex_wait_requeue_pi() which performs the same check as per commit\n6f7b0a2a5 (futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi())\n\n[ tglx: Compare the resulting keys as well, as uaddrs might be\n  \tdifferent depending on the mapping ]\n\nFixes CVE-2014-3153.\n\nChange-Id: I6bfa0943ee54d6331e6faa7779d621f9cf19fe52\nReported-by: Pinkie Pie\nSigned-off-by: Will Drewry <wad@chromium.org>\nSigned-off-by: Kees Cook <keescook@chromium.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>","Thomas Gleixner",true],["745c6830a63363b1bd98a8e6a5b2580f23bb7194","00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de","futex: Validate atomic acquisition in futex_lock_pi_atomic()\n\nWe need to protect the atomic acquisition in the kernel against rogue\nuser space which sets the user space futex to 0, so the kernel side\nacquisition succeeds while there is existing state in the kernel\nassociated to the real owner.\n\nVerify whether the futex has waiters associated with kernel state. If\nit has, return -EINVAL. The state is corrupted already, so no point in\ncleaning it up. Subsequent calls will fail as well. Not our problem.\n\n[ tglx: Use futex_top_waiter() and explain why we do not need to try\n  \trestoring the already corrupted user space state. ]\n\nChange-Id: Ifca31cf91f32a408171a01b8db1e49c14411a776\nSigned-off-by: Darren Hart <dvhart@linux.intel.com>\nCc: Kees Cook <keescook@chromium.org>\nCc: Will Drewry <wad@chromium.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>","Thomas Gleixner",true],["b42bbc9921af99340b5d1b728f22e73211c9454e","00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de","futex: Always cleanup owner tid in unlock_pi\n\nIf the owner died bit is set at futex_unlock_pi, we currently do not\ncleanup the user space futex. So the owner TID of the current owner\n(the unlocker) persists. That's observable inconsistant state,\nespecially when the ownership of the pi state got transferred.\n\nClean it up unconditionally.\n\nChange-Id: I8708a8c38c82ac4565634421fce8f916a6da873b\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: Kees Cook <keescook@chromium.org>\nCc: Will Drewry <wad@chromium.org>\nCc: Darren Hart <dvhart@linux.intel.com>\nCc: stable@vger.kernel.org","Thomas Gleixner",true],["22e483b858c676afd460754903810c764c1059b2","00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de","futex: Make lookup_pi_state more robust\n\nThe current implementation of lookup_pi_state has ambigous handling of\nthe TID value 0 in the user space futex. We can get into the kernel\neven if the TID value is 0, because either there is a stale waiters\nbit or the owner died bit is set or we are called from the requeue_pi\npath or from user space just for fun.\n\nThe current code avoids an explicit sanity check for pid = 0 in case\nthat kernel internal state (waiters) are found for the user space\naddress. This can lead to state leakage and worse under some\ncircumstances.\n\nHandle the cases explicit:\n\n     Waiter | pi_state | pi->owner | uTID      | uODIED | ?\n\n[1]  NULL   | ---      | ---       | 0         | 0/1    | Valid\n[2]  NULL   | ---      | ---       | >0        | 0/1    | Valid\n\n[3]  Found  | NULL     | --        | Any       | 0/1    | Invalid\n\n[4]  Found  | Found    | NULL      | 0         | 1      | Valid\n[5]  Found  | Found    | NULL      | >0        | 1      | Invalid\n\n[6]  Found  | Found    | task      | 0         | 1      | Valid\n\n[7]  Found  | Found    | NULL      | Any       | 0      | Invalid\n\n[8]  Found  | Found    | task      | ==taskTID | 0/1    | Valid\n[9]  Found  | Found    | task      | 0         | 0      | Invalid\n[10] Found  | Found    | task      | !=taskTID | 0/1    | Invalid\n\n[1]  Indicates that the kernel can acquire the futex atomically. We\n     came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.\n\n[2]  Valid, if TID does not belong to a kernel thread. If no matching\n     thread is found then it indicates that the owner TID has died.\n\n[3]  Invalid. The waiter is queued on a non PI futex\n\n[4]  Valid state after exit_robust_list(), which sets the user space\n     value to FUTEX_WAITERS | FUTEX_OWNER_DIED.\n\n[5]  The user space value got manipulated between exit_robust_list()\n     and exit_pi_state_list()\n\n[6]  Valid state after exit_pi_state_list() which sets the new owner in\n     the pi_state but cannot access the user space value.\n\n[7]  pi_state->owner can only be NULL when the OWNER_DIED bit is set.\n\n[8]  Owner and user space value match\n\n[9]  There is no transient state which sets the user space TID to 0\n     except exit_robust_list(), but this is indicated by the\n     FUTEX_OWNER_DIED bit. See [4]\n\n[10] There is no transient state which leaves owner and user space\n     TID out of sync.\n\nBackport to 3.13\n  conflicts: kernel/futex.c\n\nChange-Id: Ibec82fe154f4ed702332d2d259ec88317b6fede1\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: John Johansen <john.johansen@canonical.com>\nCc: Kees Cook <keescook@chromium.org>\nCc: Will Drewry <wad@chromium.org>\nCc: Darren Hart <dvhart@linux.intel.com>\nCc: stable@vger.kernel.org","Thomas Gleixner",true],["726ba1cacf8b8bd701265624e8da6c36055bdd52","f2753a2bdde7e1ef62e493a03072d1c5db7b53e0@qca.qualcomm.com","wlan: Revert back changes setting the gLimRspReqd for stats requests\n\nThe link speed is showing as 0 in the display as the function\nlimProcessNormalHddMsg(pMac, limMsg, false) is being\ncalled with fRspReqd as false for eWNI_SME_STA_STAT_REQ.\n\nChanges are made to revert back freeing the request when fRspReqd\nis false in functions __limProcessSmeGetStatisticsRequest,\n__limProcessSmeGetRoamRssiRequest and __limProcessSmeStatsRequest.\n\nChange-Id: Ia9b33dd2484976c54f58b3cac1a8a34c36242f8f\nCRs-Fixed: 541869","Madan Mohan Koyyalamudi",true],["f7f8bcb97e54aaeb868f73eb7efb4a0a2fbccd2f","272d690af0ea32d87561c4cdb8ad85d432c099a5@codeaurora.org","ASoC: msm: Reset the stream open flag after CMD_CLOSE is sent to DSP\n\nIn case of gapless playback, driver does not wait for EOS. CMD_CLOSE\nfor stream one or two can be called from compress driver free before\nEOS ACK for stream one is received. This can result in CMD_CLOSE to\nbe sent for already closed stream. Reset the stream open flag after\nCMD_CLOSE is sent to DSP to prevent multiple CMD_CLOSE on same\nstream.\n\nChange-Id: Ic186ae37a760a2996ebd7b9b5dc5d5846621ab66\nSigned-off-by: Krishnankutty Kolathappilly <kkolat@codeaurora.org>","Krishnankutty Kolathappilly",true],["aae63d0e5eedd4b470461e60fe1c955d31f80fc6","1d684bb414a022d8a1bfc880b0df61ab60e1fc49@codeaurora.org","ASoC: msm: Add PCM support in compress driver\n\nPCM playback support is added to compress driver so that application\ncan use the single audio hardware device to play both compressed\nand PCM audio.\n\nChange-Id: Ie7719be8d7435088a7e4cfb5b817d4557e25e4c5\nSigned-off-by: Dhananjay Kumar <dhakumar@codeaurora.org>\n\nConflicts:\n\tsound/soc/msm/qdsp6v2/msm-compress-q6-v2.c","Dhananjay Kumar",true],["06f661139884d1a766bbcc24006b24b76bb0ad89","a6aa4b4fcb52deb1d756e7b1cea5d95872888fd9@codeaurora.org","ASoC: msm: Add check for NULL pointer and buffer overflow\n\nChanges to add check for NULL pointer before they\nget dereferenced and check for buffer overflows\nto ensure out of bound indexes of arrays are not\naccessed.\n\nCRs-fixed: 628847 628850\nChange-Id: I3fcebe07a7f9e7ff480857480fa0df2ada017c69\nSigned-off-by: Aravind Kumar <akumark@codeaurora.org>","Aravind Kumar",true],["9e48ec0bfb148bffa7adfa6f8424e2a3277ab975","a824964325a9086a42798c0883d664d3858a2226@codeaurora.org","ASoC: msm: Send endpoint parameters for DDP decoder\n\nDDP decoder requires end point parameters to be configured or\nupdated based on the input clip configuration or as updated by\nthe user through set parameter. Add support for the same\n\nChange-Id: I1d331b4be27d67e1da5b3a03cfaff161e5fd1550\nSigned-off-by: Subhash Chandra Bose Naripeddy <snariped@codeaurora.org>","Subhash Chandra Bose Naripeddy",true],["70c245c983213a0e81c0827cf3b8d83fba7d29c6","fabc8c84c888ec05ed5fb694924c4ec949ea7bac@codeaurora.org","ASoC: msm: ensure check before accessing session private data.\n\nThe compressed session needs to be active to set volume to dsp.\nEnsure the check to see valid session exist before accessing\nprivate data, else results in kernel panic.\n\nThe Memory allocation for driver data also needs to be freed\nfor failure in session open.\n\nCRs-Fixed: 638817\nChange-Id: Ifdce543aa55df420960e9eeff0564f18d9410060\nSigned-off-by: Asish Bhattacharya <asishb@codeaurora.org>","Asish Bhattacharya",true],["b4decc8cb07c56725e20bfaa775db3a89426a408","a2c46ce543403d5c4722267bf69f2706779b7349@codeaurora.org","ASoC: compr: Disable soft-pause for compress playback\n\nSoft-pause (i.e pause ack after a timeout) adversely affects\naudio/video sync during pause/resume use cases leading to some\nframe drops. Disable this feature for compress playback.\n\nChange-Id: I3ce444dadf1e4b94c1e8d6f017a1c639b082285f\nSigned-off-by: Haynes Mathew George <hgeorge@codeaurora.org>\nCRs-Fixed: 636328","Haynes Mathew George",true],["89edd32ebb51c7fae5dc0498565ae3668ce8dc1f","a2c46ce543403d5c4722267bf69f2706779b7349@codeaurora.org","msm: compr: Use irq{save/restore} version of spinlock\n\ncompress driver event handler uses spin_lock/unlock APIs.\nIt should be sufficient to use the irq{save/restore} versions.\n\nChange-Id: I8f32c6896396a09faa1baf741bd182d8ceb4301a\nSigned-off-by: Haynes Mathew George <hgeorge@codeaurora.org>","Haynes Mathew George",true],["6f690e567609aede616e990e86f50e5c778b2e74","7f5bb03cf507c861269be561971108be8f37d832@chemlab.org","asoc: msm: Resync with upstream\n\n * Remove HTC's weird flush/drain handling, it's incompatible with\n   our userspace.\n * Resync with upstream, keep HTC-specific features.\n\nChange-Id: I1e0491a1b1b17801af21bc0b485aa2f6a831b68e","Steve Kondik",true],["60f9661a115d5d5b77ef2691a207b9171193cc0b","7f5bb03cf507c861269be561971108be8f37d832@chemlab.org","Copy audio_effects.h to userspace\n\nChange-Id: Idce1c1e51b80ae58cfd663376a41cb37a0649f5b","Steve Kondik",true]],"size":16,"ref":"refs/heads/kitkat","head":"60f9661a115d5d5b77ef2691a207b9171193cc0b"}