{"push_id":1058956542,"size":1000,"distinct_size":41908,"ref":"refs/heads/master","head":"962216d448c64866fa2daf4b8389d255f4e58bba","before":"418886a3c185aef7a01782207aea5ac373542d24","commits":[{"sha":"f00fa2417b3e1252b1a761f88731af03afff4407","author":{"email":"c689bc33a4e7e6587463ef41c0d13ed5f5424039@gmail.com","name":"Nicolai Stange"},"message":"lib/mpi: mpi_read_buffer(): optimize skipping of leading zero limbs\n\nCurrently, if the number of leading zeros is greater than fits into a\ncomplete limb, mpi_read_buffer() skips them by iterating over them\nlimb-wise.\n\nInstead of skipping the high order zero limbs within the loop as shown\nabove, adjust the copying loop's bounds.\n\nSigned-off-by: Nicolai Stange <nicstange@gmail.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/f00fa2417b3e1252b1a761f88731af03afff4407"},{"sha":"90f864e20029600a8dc33e27b1192af4636100d4","author":{"email":"c689bc33a4e7e6587463ef41c0d13ed5f5424039@gmail.com","name":"Nicolai Stange"},"message":"lib/mpi: mpi_read_buffer(): replace open coded endian conversion\n\nCurrently, the endian conversion from CPU order to BE is open coded in\nmpi_read_buffer().\n\nReplace this by the centrally provided cpu_to_be*() macros.\nCopy from the temporary storage on stack to the destination buffer\nby means of memcpy().\n\nSigned-off-by: Nicolai Stange <nicstange@gmail.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/90f864e20029600a8dc33e27b1192af4636100d4"},{"sha":"462696fd0fd2aae2fd38d22d19b2d08a55606014","author":{"email":"c689bc33a4e7e6587463ef41c0d13ed5f5424039@gmail.com","name":"Nicolai Stange"},"message":"lib/mpi: mpi_read_buffer(): fix buffer overflow\n\nCurrently, mpi_read_buffer() writes full limbs to the output buffer\nand moves memory around to purge leading zero limbs afterwards.\n\nHowever, with\n\n  commit 9cbe21d8f89d (\"lib/mpi: only require buffers as big as needed for\n                        the integer\")\n\nthe caller is only required to provide a buffer large enough to hold the\nresult without the leading zeros.\n\nThis might result in a buffer overflow for small MP numbers with leading\nzeros.\n\nFix this by coping the result to its final destination within the output\nbuffer and not copying the leading zeros at all.\n\nFixes: 9cbe21d8f89d (\"lib/mpi: only require buffers as big as needed for\n                      the integer\")\nSigned-off-by: Nicolai Stange <nicstange@gmail.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/462696fd0fd2aae2fd38d22d19b2d08a55606014"},{"sha":"b698538951a45dd853d9e40f51e143fdd46a60c6","author":{"email":"c689bc33a4e7e6587463ef41c0d13ed5f5424039@gmail.com","name":"Nicolai Stange"},"message":"lib/mpi: mpi_read_raw_from_sgl(): replace len argument by nbytes\n\nCurrently, the nbytes local variable is calculated from the len argument\nas follows:\n\n  ... mpi_read_raw_from_sgl(..., unsigned int len)\n  {\n    unsigned nbytes;\n    ...\n    if (!ents)\n      nbytes = 0;\n    else\n      nbytes = len - lzeros;\n    ...\n  }\n\nGiven that nbytes is derived from len in a trivial way and that the len\nargument is shadowed by a local len variable in several loops, this is just\nconfusing.\n\nRename the len argument to nbytes and get rid of the nbytes local variable.\nDo the nbytes calculation in place.\n\nSigned-off-by: Nicolai Stange <nicstange@gmail.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/b698538951a45dd853d9e40f51e143fdd46a60c6"},{"sha":"ab1e912ec1021e7532148398a01eb1283437fe62","author":{"email":"c689bc33a4e7e6587463ef41c0d13ed5f5424039@gmail.com","name":"Nicolai Stange"},"message":"lib/mpi: mpi_read_raw_from_sgl(): don't include leading zero SGEs in nbytes\n\nAt the very beginning of mpi_read_raw_from_sgl(), the leading zeros of\nthe input scatterlist are counted:\n\n  lzeros = 0;\n  for_each_sg(sgl, sg, ents, i) {\n    ...\n    if (/* sg contains nonzero bytes */)\n      break;\n\n    /* sg contains nothing but zeros here */\n    ents--;\n    lzeros = 0;\n  }\n\nLater on, the total number of trailing nonzero bytes is calculated by\nsubtracting the number of leading zero bytes from the total number of input\nbytes:\n\n  nbytes -= lzeros;\n\nHowever, since lzeros gets reset to zero for each completely zero leading\nsg in the loop above, it doesn't include those.\n\nBesides wasting resources by allocating a too large output buffer,\nthis mistake propagates into the calculation of x, the number of\nleading zeros within the most significant output limb:\n\n  x = BYTES_PER_MPI_LIMB - nbytes % BYTES_PER_MPI_LIMB;\n\nWhat's more, the low order bytes of the output, equal in number to the\nextra bytes in nbytes, are left uninitialized.\n\nFix this by adjusting nbytes for each completely zero leading scatterlist\nentry.\n\nFixes: 2d4d1eea540b (\"lib/mpi: Add mpi sgl helpers\")\nSigned-off-by: Nicolai Stange <nicstange@gmail.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/ab1e912ec1021e7532148398a01eb1283437fe62"},{"sha":"60e1b74c224e9eda14e5b479413c5d990373c2cb","author":{"email":"c689bc33a4e7e6587463ef41c0d13ed5f5424039@gmail.com","name":"Nicolai Stange"},"message":"lib/mpi: mpi_read_raw_from_sgl(): purge redundant clearing of nbits\n\nIn mpi_read_raw_from_sgl(), unsigned nbits is calculated as follows:\n\n  nbits = nbytes * 8;\n\nand redundantly cleared later on if nbytes == 0:\n\n  if (nbytes > 0)\n    ...\n  else\n    nbits = 0;\n\nPurge this redundant clearing for the sake of clarity.\n\nSigned-off-by: Nicolai Stange <nicstange@gmail.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/60e1b74c224e9eda14e5b479413c5d990373c2cb"},{"sha":"64c09b0b59b92ad231dd526f57f24139b728044b","author":{"email":"c689bc33a4e7e6587463ef41c0d13ed5f5424039@gmail.com","name":"Nicolai Stange"},"message":"lib/mpi: mpi_read_raw_from_sgl(): fix nbits calculation\n\nThe number of bits, nbits, is calculated in mpi_read_raw_from_sgl() as\nfollows:\n\n  nbits = nbytes * 8;\n\nAfterwards, the number of leading zero bits of the first byte get\nsubtracted:\n\n  nbits -= count_leading_zeros(*(u8 *)(sg_virt(sgl) + lzeros));\n\nHowever, count_leading_zeros() takes an unsigned long and thus,\nthe u8 gets promoted to an unsigned long.\n\nThus, the above doesn't subtract the number of leading zeros in the most\nsignificant nonzero input byte from nbits, but the number of leading\nzeros of the most significant nonzero input byte promoted to unsigned long,\ni.e. BITS_PER_LONG - 8 too many.\n\nFix this by subtracting\n\n  count_leading_zeros(...) - (BITS_PER_LONG - 8)\n\nfrom nbits only.\n\nFixes: 2d4d1eea540b (\"lib/mpi: Add mpi sgl helpers\")\nSigned-off-by: Nicolai Stange <nicstange@gmail.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/64c09b0b59b92ad231dd526f57f24139b728044b"},{"sha":"85d541a3d14ab7a4e08c280740d9a7e097b04835","author":{"email":"c689bc33a4e7e6587463ef41c0d13ed5f5424039@gmail.com","name":"Nicolai Stange"},"message":"lib/mpi: mpi_read_raw_from_sgl(): sanitize meaning of indices\n\nWithin the byte reading loop in mpi_read_raw_sgl(), there are two\nhousekeeping indices used, z and x.\n\nAt all times, the index z represents the number of output bytes covered\nby the input SGEs for which processing has completed so far. This includes\nany leading zero bytes within the most significant limb.\n\nThe index x changes its meaning after the first outer loop's iteration\nthough: while processing the first input SGE, it represents\n\n  \"number of leading zero bytes in most significant output limb\" +\n   \"current position within current SGE\"\n\nFor the remaining SGEs OTOH, x corresponds just to\n\n  \"current position within current SGE\"\n\nAfter all, it is only the sum of z and x that has any meaning for the\noutput buffer and thus, the\n\n  \"number of leading zero bytes in most significant output limb\"\n\npart can be moved away from x into z from the beginning, opening up the\nopportunity for cleaner code.\n\nBefore the outer loop iterating over the SGEs, don't initialize z with\nzero, but with the number of leading zero bytes in the most significant\noutput limb. For the inner loop iterating over a single SGE's bytes,\nget rid of the buf_shift offset to x' bounds and let x run from zero to\nsg->length - 1.\n\nSigned-off-by: Nicolai Stange <nicstange@gmail.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/85d541a3d14ab7a4e08c280740d9a7e097b04835"},{"sha":"0bb5c9ead62f4e1eaf226744076e0b4e8348f68f","author":{"email":"c689bc33a4e7e6587463ef41c0d13ed5f5424039@gmail.com","name":"Nicolai Stange"},"message":"lib/mpi: mpi_read_raw_from_sgl(): fix out-of-bounds buffer access\n\nWithin the copying loop in mpi_read_raw_from_sgl(), the last input SGE's\nbyte count gets artificially extended as follows:\n\n  if (sg_is_last(sg) && (len % BYTES_PER_MPI_LIMB))\n    len += BYTES_PER_MPI_LIMB - (len % BYTES_PER_MPI_LIMB);\n\nWithin the following byte copying loop, this causes reads beyond that\nSGE's allocated buffer:\n\n  BUG: KASAN: slab-out-of-bounds in mpi_read_raw_from_sgl+0x331/0x650\n                                     at addr ffff8801e168d4d8\n  Read of size 1 by task systemd-udevd/721\n  [...]\n  Call Trace:\n   [<ffffffff818c4d35>] dump_stack+0xbc/0x117\n   [<ffffffff818c4c79>] ? _atomic_dec_and_lock+0x169/0x169\n   [<ffffffff814af5d1>] ? print_section+0x61/0xb0\n   [<ffffffff814b1109>] print_trailer+0x179/0x2c0\n   [<ffffffff814bc524>] object_err+0x34/0x40\n   [<ffffffff814bfdc7>] kasan_report_error+0x307/0x8c0\n   [<ffffffff814bf315>] ? kasan_unpoison_shadow+0x35/0x50\n   [<ffffffff814bf38e>] ? kasan_kmalloc+0x5e/0x70\n   [<ffffffff814c0ad1>] kasan_report+0x71/0xa0\n   [<ffffffff81938171>] ? mpi_read_raw_from_sgl+0x331/0x650\n   [<ffffffff814bf1a6>] __asan_load1+0x46/0x50\n   [<ffffffff81938171>] mpi_read_raw_from_sgl+0x331/0x650\n   [<ffffffff817f41b6>] rsa_verify+0x106/0x260\n   [<ffffffff817f40b0>] ? rsa_set_pub_key+0xf0/0xf0\n   [<ffffffff818edc79>] ? sg_init_table+0x29/0x50\n   [<ffffffff817f4d22>] ? pkcs1pad_sg_set_buf+0xb2/0x2e0\n   [<ffffffff817f5b74>] pkcs1pad_verify+0x1f4/0x2b0\n   [<ffffffff81831057>] public_key_verify_signature+0x3a7/0x5e0\n   [<ffffffff81830cb0>] ? public_key_describe+0x80/0x80\n   [<ffffffff817830f0>] ? keyring_search_aux+0x150/0x150\n   [<ffffffff818334a4>] ? x509_request_asymmetric_key+0x114/0x370\n   [<ffffffff814b83f0>] ? kfree+0x220/0x370\n   [<ffffffff818312c2>] public_key_verify_signature_2+0x32/0x50\n   [<ffffffff81830b5c>] verify_signature+0x7c/0xb0\n   [<ffffffff81835d0c>] pkcs7_validate_trust+0x42c/0x5f0\n   [<ffffffff813c391a>] system_verify_data+0xca/0x170\n   [<ffffffff813c3850>] ? top_trace_array+0x9b/0x9b\n   [<ffffffff81510b29>] ? __vfs_read+0x279/0x3d0\n   [<ffffffff8129372f>] mod_verify_sig+0x1ff/0x290\n  [...]\n\nThe exact purpose of the len extension isn't clear to me, but due to\nits form, I suspect that it's a leftover somehow accounting for leading\nzero bytes within the most significant output limb.\n\nNote however that without that len adjustement, the total number of bytes\never processed by the inner loop equals nbytes and thus, the last output\nlimb gets written at this point. Thus the net effect of the len adjustement\ncited above is just to keep the inner loop running for some more\niterations, namely < BYTES_PER_MPI_LIMB ones, reading some extra bytes from\nbeyond the last SGE's buffer and discarding them afterwards.\n\nFix this issue by purging the extension of len beyond the last input SGE's\nbuffer length.\n\nFixes: 2d4d1eea540b (\"lib/mpi: Add mpi sgl helpers\")\nSigned-off-by: Nicolai Stange <nicstange@gmail.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/0bb5c9ead62f4e1eaf226744076e0b4e8348f68f"},{"sha":"082ebe92ca7f09845f0550e85837a878d6cedb34","author":{"email":"ac7da5bc34fbda078ba4af5ef710d2a59a2316f5@intel.com","name":"Tadeusz Struk"},"message":"crypto: qat - make sure const_tab is 1024 bytes aligned\n\nFW requires the const_tab to be 1024 bytes aligned.\n\nSigned-off-by: Tadeusz Struk <tadeusz.struk@intel.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/082ebe92ca7f09845f0550e85837a878d6cedb34"},{"sha":"0c4935b31df0e5ffa6da0f8a2fdfc690d1118ba7","author":{"email":"8517222e0016b924aa485756bff8401c0efbb054@intel.com","name":"Ahsan Atta"},"message":"crypto: qat - Remove redundant nrbg rings\n\nRemove redundant nrbg rings.\n\nSigned-off-by: Ahsan Atta <ahsan.atta@intel.com>\nSigned-off-by: Tadeusz Struk <tadeusz.struk@intel.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/0c4935b31df0e5ffa6da0f8a2fdfc690d1118ba7"},{"sha":"aa8b6dd4b06bab62ec7f8972f9e66782dbc23d60","author":{"email":"3ac157f5e8f9c0192e23b6cba432581e37a1d616@nxp.com","name":"Tudor Ambarus"},"message":"crypto: qat - avoid memory corruption or undefined behaviour\n\nmemcopying to a (null pointer + offset) will result\nin memory corruption or undefined behaviour.\n\nSigned-off-by: Tudor Ambarus <tudor-dan.ambarus@nxp.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/aa8b6dd4b06bab62ec7f8972f9e66782dbc23d60"},{"sha":"738f98233b94db55607f97a76f9699efc4217276","author":{"email":"3ac157f5e8f9c0192e23b6cba432581e37a1d616@nxp.com","name":"Tudor Ambarus"},"message":"crypto: qat - fix address leaking of RSA public exponent\n\nSigned-off-by: Tudor Ambarus <tudor-dan.ambarus@nxp.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/738f98233b94db55607f97a76f9699efc4217276"},{"sha":"bdb6cf9f6fe6d9af905ea34b7c4bb78ea601329e","author":{"email":"4df73f6d53a690d105cd8130f057950f3b2f7aac@gmail.com","name":"Corentin LABBE"},"message":"crypto: sun4i-ss - Replace spinlock_bh by spin_lock_irq{save|restore}\n\nThe current sun4i-ss driver could generate data corruption when ciphering/deciphering.\nIt occurs randomly on end of handled data.\nNo root cause have been found and the only way to remove it is to replace\nall spin_lock_bh by their irq counterparts.\n\nFixes: 6298e948215f (\"crypto: sunxi-ss - Add Allwinner Security System crypto accelerator\")\nSigned-off-by: LABBE Corentin <clabbe.montjoie@gmail.com>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/bdb6cf9f6fe6d9af905ea34b7c4bb78ea601329e"},{"sha":"4218ebe8cab421c72f134cca1374e0985303f34a","author":{"email":"cc02df512ad79bcd2ad3264230580f113da4eba6@chronox.de","name":"Stephan Mueller"},"message":"crypto: drbg - set HMAC key only when altered\n\nThe HMAC implementation allows setting the HMAC key independently from\nthe hashing operation. Therefore, the key only needs to be set when a\nnew key is generated.\n\nThis patch increases the speed of the HMAC DRBG by at least 35% depending\non the use case.\n\nThe patch is fully CAVS tested.\n\nSigned-off-by: Stephan Mueller <smueller@chronox.de>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/4218ebe8cab421c72f134cca1374e0985303f34a"},{"sha":"cb00bca42f8b819498b2647f24b6148d65ec9aa4","author":{"email":"ac7da5bc34fbda078ba4af5ef710d2a59a2316f5@intel.com","name":"Tadeusz Struk"},"message":"crypto: qat - explicitly stop all VFs first\n\nWhen stopping devices it is not enought to loop backwards.\nWe need to explicitly stop all VFs first.\n\nSigned-off-by: Tadeusz Struk <tadeusz.struk@intel.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/cb00bca42f8b819498b2647f24b6148d65ec9aa4"},{"sha":"f1420ceef3011547323733e3bb4fcb4aca3fe840","author":{"email":"ac7da5bc34fbda078ba4af5ef710d2a59a2316f5@intel.com","name":"Tadeusz Struk"},"message":"crypto: qat - changed adf_dev_stop to void\n\nIt returns always zero anyway.\n\nSigned-off-by: Tadeusz Struk <tadeusz.struk@intel.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/f1420ceef3011547323733e3bb4fcb4aca3fe840"},{"sha":"043809d8d25eac8307c8c7b74bca7266070cb007","author":{"email":"1a8531307367602b8284517edb33d53d54e5ce8e@samsung.com","name":"Krzysztof Kozlowski"},"message":"hwrng: exynos - Fix misspelled Samsung address\n\nCorrect smasung.com into samsung.com.\n\nSigned-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/043809d8d25eac8307c8c7b74bca7266070cb007"},{"sha":"07b48ac4bbe527e68cfc555f2b2b206908437141","author":{"email":"4f9c5a5cfa819e47d69719a414c02aa6016a9f54@arm.com","name":"Robin Murphy"},"message":"iommu/dma: Restore scatterlist offsets correctly\n\nWith the change to stashing just the IOVA-page-aligned remainder of the\nCPU-page offset rather than the whole thing, the failure path in\n__invalidate_sg() also needs tweaking to account for that in the case of\ndiffering page sizes where the two offsets may not be equivalent.\nSimilarly in __finalise_sg(), lest the architecture-specific wrappers\nlater get the wrong address for cache maintenance on sync or unmap.\n\nFixes: 164afb1d85b8 (\"iommu/dma: Use correct offset in map_sg\")\nReported-by: Magnus Damm <damm+renesas@opensource.se>\nSigned-off-by: Robin Murphy <robin.murphy@arm.com>\nCc: stable@ver.kernel.org # v4.4+\nSigned-off-by: Joerg Roedel <jroedel@suse.de>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/07b48ac4bbe527e68cfc555f2b2b206908437141"},{"sha":"35b67291b4a85d37ec31f9d9ea3c5d3258ee0da6","author":{"email":"cbbc2a491dd609dc667a5c30620606c73351583d@nvidia.com","name":"Jon Hunter"},"message":"soc/tegra: pmc: Add missing structure members to kernel-doc\n\nSome members of the tegra_pmc structure are missing from the kernel-doc\ncomment for this structure. Add the missing members.\n\nSigned-off-by: Jon Hunter <jonathanh@nvidia.com>\nSigned-off-by: Thierry Reding <treding@nvidia.com>","distinct":true,"url":"https://api.github.com/repos/unusual-thoughts/linux-xps13/commits/35b67291b4a85d37ec31f9d9ea3c5d3258ee0da6"}]}