From 7d4865a56f2e5fc63c3f945bb52665d235c1bb24 Mon Sep 17 00:00:00 2001 From: Thierry Strudel Date: Wed, 6 Dec 2017 16:10:59 -0800 Subject: angler: update kernel prebuilt d7193540482d ANDROID: sound: rawmidi: Hold lock around realloc bfa67ef470ed rtac: add size check when reading cal data kvaddr buffer a6661da56dc6 ANDROID: qtaguid: Fix the UAF probelm with tag_ref_tree 4d87c6ebc4e8 msm: camera: Return -NOTTY on invalid ioctl command. d9bbbff01114 BACKPORT: ALSA: seq: Fix use-after-free at creating a port d2579ab4c107 msm: ipa: Fix to use after free issue da5730bcf5c6 FROMLIST: input: synaptics_dsx: remove unused synaptics touch screen driver files 5071f5a022f3 iovec: make sure the caller actually wants anything in memcpy_fromiovecend 1f537533b003 Merge branch 'android-msm-angler-3.10' into android-msm-angler-3.10-security-next 5a720136d4aa Merge branch 'android-msm-angler-3.10-oc' into android-msm-angler-3.10 78384f0f797e clocksource: arch_timer: make virtual counter access configurable 0ceec3c93a57 arm64: issue isb when trapping CNTVCT_EL0 access b789fddc92f3 BACKPORT: arm64: Add CNTFRQ_EL0 trap handler ce1c246ac2e7 BACKPORT: arm64: Add CNTVCT_EL0 trap handler 3914a61956b4 UPSTREAM: crypto: algif_skcipher - Load TX SG list after waiting 4d4884ceab60 arm64/configs: angler: remove unused configs for Bluetooth 04d52620b0c3 msm: ADSPRPC: validate user buffers after copying from user a2887cdcac5c input: synaptics: restrict sysfs node write permissions 569a56200c1a BACKPORT: Sanitize 'move_pages()' permission checks 040986cea60f staging: android: ashmem: fix a race condition in ASHMEM_SET_SIZE ioctl 28d13c64ee87 ASoC: wcd9xxx: restrict debugfs permission 17c719aad109 soc: qcom: glink_pkt: fix spinlock patch 7e2aa5f94717 soc: qcom: glink_pkt: Use spinlock to protect Rx data packet list 982ff1617f5f Merge branch 'android-msm-angler-3.10' into android-msm-angler-3.10-security-next 4b55f6552068 Merge branch 'android-msm-angler-3.10' into android-msm-angler-3.10-security-next 7392b108c064 Merge branch 'android-msm-angler-3.10' into android-msm-angler-3.10-security-next 8937d7f62a98 Merge branch 'android-msm-angler-3.10' into android-msm-angler-3.10-security-next 2eeb37d04369 Merge android-msm-angler-3.10 into android-msm-angler-3.10-security-next e7863dfe7bf5 Merge android-msm-angler-3.10 into android-msm-angler-3.10-security-next f90d1634fb0a UPSTREAM: char: Drop bogus dependency of DEVPORT on !M68K 2a445d6eaf86 FROMLIST: msm: qdsp6v2: set pointer to NULL after free 86f48f86e9b8 Merge branch msm-huawei/android-msm-angler-3.10 into android-msm-angler-3.10-security-next 6578e5863f36 net: wireless: bcmdhd: fix for IOVAR GET failed 0e89b7b1b8b2 xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window Linux version 3.10.73-gd7193540482 (android- build@wpra2.hot.corp.google.com) (gcc version 4.9.x-google 20140827 (prerelease) (GCC) ) #1 SMP PREEMPT Wed Dec 6 22:19:12 UTC 2017 Bug: 36000515 Bug: 36279469 Bug: 36565222 Bug: 36604779 Bug: 37158466 Bug: 37210310 Bug: 37275839 Bug: 38177011 Bug: 62464339 Bug: 62800865 Bug: 63174519 Bug: 63527053 Bug: 64315347 Bug: 64386293 Bug: 65172622 Bug: 65468230 Bug: 65853158 Bug: 66954097 Bug: 67713083 Bug: 67713091 Bug: 67713103 Bug: 67900971 Bug: 68266545 Bug: 68992478 Bug: 68992479 Bug: 68996174 Bug: 70285905 Change-Id: I6a15bed942212d342533b95542a9dde9a8ddaec3 Source-Branch: android-msm-angler-3.10 Signed-off-by: Thierry Strudel (cherry picked from commit cdee9caac54b16217cd70cd2be78085bcdafa992) --- Image.gz-dtb | Bin 11135939 -> 11134528 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/Image.gz-dtb b/Image.gz-dtb index c50b2bf..e8083c6 100644 Binary files a/Image.gz-dtb and b/Image.gz-dtb differ -- cgit v1.2.3 From 0661087b52b7f86d0aea4098af4d8391ae0a8267 Mon Sep 17 00:00:00 2001 From: Wei Wang Date: Tue, 16 Jan 2018 10:22:05 -0800 Subject: Merge angler kernel into oc-m3-release angler: update kernel prebuilt 9142a68b Merge branch 'android-msm-angler-3.10-security-next' into android-msm-angler-3.10 1a3a7631 msm:ipa: Fix to incorrect structure access 04bd7c00 msm: sensor: flash: add conditional check for ioctl 0bdec1f3 ASoC: msm: qdsp6v2: Set freed pointers to NULL b74dcd1c UPSTREAM: packet: fix tp_reserve race in packet_set_ring 492e4ed4 diag: Add protection while de-initializing clients 25c948ed UPSTREAM: USB: serial: console: fix use-after-free after failed setup 5a9a76f1 UPSTREAM: ALSA: usb-audio: Kill stray URB at exiting b20cb75b UPSTREAM: ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor 7b8e29ae UPSTREAM: USB: fix out-of-bounds in usb_set_configuration 403b1758 UPSTREAM: HID: usbhid: fix out-of-bounds bug 6f694601 UPSTREAM: USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor() 1310cdd9 UPSTREAM: packet: hold bind lock when rebinding to fanout hook 8d58bb26 BACKPORT: packet: in packet_do_bind, test fanout with bind_lock held d07ca335 power: qcom: msm-core: Add mutex lock for ioctl 2c32d7ab FROMLIST: power: Fix user ptr in EA_LEAKAGE ioctl 3559400b diag: Add mutex protection while reading dci debug statistics 41cf64bd ANDROID: sdcardfs: Add default_normal option 6f661860 ANDROID: sdcardfs: notify lower file of opens d7193540 ANDROID: sound: rawmidi: Hold lock around realloc bfa67ef4 rtac: add size check when reading cal data kvaddr buffer a6661da5 ANDROID: qtaguid: Fix the UAF probelm with tag_ref_tree 4d87c6eb msm: camera: Return -NOTTY on invalid ioctl command. d9bbbff0 BACKPORT: ALSA: seq: Fix use-after-free at creating a port d2579ab4 msm: ipa: Fix to use after free issue da5730bc FROMLIST: input: synaptics_dsx: remove unused synaptics touch screen driver files 5071f5a0 iovec: make sure the caller actually wants anything in memcpy_fromiovecend 1f537533 Merge branch 'android-msm-angler-3.10' into android-msm-angler-3.10-security-next 5a720136 Merge branch 'android-msm-angler-3.10-oc' into android-msm-angler-3.10 78384f0f clocksource: arch_timer: make virtual counter access configurable 0ceec3c9 arm64: issue isb when trapping CNTVCT_EL0 access b789fddc BACKPORT: arm64: Add CNTFRQ_EL0 trap handler ce1c246a BACKPORT: arm64: Add CNTVCT_EL0 trap handler 3914a619 UPSTREAM: crypto: algif_skcipher - Load TX SG list after waiting 4d4884ce arm64/configs: angler: remove unused configs for Bluetooth 04d52620 msm: ADSPRPC: validate user buffers after copying from user a2887cdc input: synaptics: restrict sysfs node write permissions 569a5620 BACKPORT: Sanitize 'move_pages()' permission checks 040986ce staging: android: ashmem: fix a race condition in ASHMEM_SET_SIZE ioctl 28d13c64 ASoC: wcd9xxx: restrict debugfs permission 17c719aa soc: qcom: glink_pkt: fix spinlock patch 7e2aa5f9 soc: qcom: glink_pkt: Use spinlock to protect Rx data packet list 982ff161 Merge branch 'android-msm-angler-3.10' into android-msm-angler-3.10-security-next 4b55f655 Merge branch 'android-msm-angler-3.10' into android-msm-angler-3.10-security-next 7392b108 Merge branch 'android-msm-angler-3.10' into android-msm-angler-3.10-security-next 8937d7f6 Merge branch 'android-msm-angler-3.10' into android-msm-angler-3.10-security-next 2eeb37d0 Merge android-msm-angler-3.10 into android-msm-angler-3.10-security-next e7863dfe Merge android-msm-angler-3.10 into android-msm-angler-3.10-security-next f90d1634 UPSTREAM: char: Drop bogus dependency of DEVPORT on !M68K 2a445d6e FROMLIST: msm: qdsp6v2: set pointer to NULL after free 86f48f86 Merge branch msm-huawei/android-msm-angler-3.10 into android-msm-angler-3.10-security-next 6578e586 net: wireless: bcmdhd: fix for IOVAR GET failed 0e89b7b1 xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window Linux version 3.10.73-g9142a68b659 (android- build@wprh4.hot.corp.google.com) (gcc version 4.9.x-google 20140827 (prerelease) (GCC) ) #1 SMP PREEMPT Fri Jan 12 23:03:37 UTC 2018 Bug: 36000515 Bug: 36279469 Bug: 36565222 Bug: 36604779 Bug: 37158466 Bug: 37210310 Bug: 37275839 Bug: 38177011 Bug: 62464339 Bug: 62800865 Bug: 63174519 Bug: 63527053 Bug: 63851638 Bug: 64315347 Bug: 64386293 Bug: 64672411 Bug: 64836865 Bug: 65172622 Bug: 65468230 Bug: 65853158 Bug: 66954097 Bug: 67713083 Bug: 67713091 Bug: 67713103 Bug: 67900971 Bug: 68266545 Bug: 68664502 Bug: 68806121 Bug: 68870904 Bug: 68992478 Bug: 68992479 Bug: 68996174 Bug: 69050921 Bug: 69051382 Bug: 69051731 Bug: 69052055 Bug: 69052348 Bug: 69052675 Bug: 69160446 Bug: 70235107 Bug: 70237702 Bug: 70237704 Bug: 70706497 Change-Id: Ic069a0b2da53b999cb99152803b40e04b4cb379c Source-Branch: android-msm-angler-3.10 Signed-off-by: Wei Wang (cherry picked from commit 6d498382e0adbb95e725635d29c4744d6dfa4605) --- Image.gz-dtb | Bin 11134528 -> 11135104 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/Image.gz-dtb b/Image.gz-dtb index e8083c6..3846a37 100644 Binary files a/Image.gz-dtb and b/Image.gz-dtb differ -- cgit v1.2.3