{"push_id":1423777813,"size":42,"distinct_size":42,"ref":"refs/heads/master","head":"a0d60e62ea5c88a9823410e9d0929a513e29dea2","before":"3ad0e83cf86bcaeb6ca3c37060a3ce866b25fb42","commits":[{"sha":"6a84fb4b4e439a8ef0ce19ec7e7661ad76f655c9","author":{"name":"Dan Williams","email":"11d4d1e92ac6a0e1ab4aaa72a56a5c1cae6b74af@intel.com"},"message":"device-dax: check devm_nsio_enable() return value\n\nIf the dax_pmem driver is passed a resource that is already busy the\ndriver probe attempt should fail with a message like the following:\n\n  dax_pmem dax0.1: could not reserve region [mem 0x100000000-0x11fffffff]\n\nHowever, if we do not catch the error we crash for the obvious reason of\naccessing memory that is not mapped.\n\n BUG: unable to handle kernel paging request at ffffc90020001000\n IP: [<ffffffff81496712>] __memcpy+0x12/0x20\n [..]\n Call Trace:\n  [<ffffffff815c4960>] ? nsio_rw_bytes+0x60/0x180\n  [<ffffffff815c6045>] nd_pfn_validate+0x75/0x320\n  [<ffffffff815c63a9>] nvdimm_setup_pfn+0xb9/0x5d0\n  [<ffffffff815c48ef>] ? devm_nsio_enable+0xff/0x110\n  [<ffffffff815cb699>] dax_pmem_probe+0x59/0x260\n\nCc: <stable@vger.kernel.org>\nFixes: ab68f2622136 (\"/dev/dax, pmem: direct access to persistent memory\")\nReported-by: Dave Hansen <dave.hansen@linux.intel.com>\nSigned-off-by: Dan Williams <dan.j.williams@intel.com>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/6a84fb4b4e439a8ef0ce19ec7e7661ad76f655c9"},{"sha":"4cb19355ea19995941ccaad115dbfac6b75215ca","author":{"name":"Dan Williams","email":"11d4d1e92ac6a0e1ab4aaa72a56a5c1cae6b74af@intel.com"},"message":"device-dax: fail all private mapping attempts\n\nThe device-dax implementation originally tried to be tricky and allow\nprivate read-only mappings, but in the process allowed writable\nMAP_PRIVATE + MAP_NORESERVE mappings.  For simplicity and predictability\njust fail all private mapping attempts since device-dax memory is\nstatically allocated and will never support overcommit.\n\nCc: <stable@vger.kernel.org>\nCc: Dave Hansen <dave.hansen@linux.intel.com>\nFixes: dee410792419 (\"/dev/dax, core: file operations and dax-mmap\")\nReported-by: Pawel Lebioda <pawel.lebioda@intel.com>\nSigned-off-by: Dan Williams <dan.j.williams@intel.com>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/4cb19355ea19995941ccaad115dbfac6b75215ca"},{"sha":"7a43906f5cbfb74712af168988455e350707e310","author":{"name":"Benjamin Herrenschmidt","email":"58942ee662d0fe5d44043b40ceefc845bad5a84d@kernel.crashing.org"},"message":"powerpc: Set missing wakeup bit in LPCR on POWER9\n\nThere is a new bit, LPCR_PECE_HVEE (Hypervisor Virtualization Exit\nEnable), which controls wakeup from STOP states on Hypervisor\nVirtualization Interrupts (which happen to also be all external\ninterrupts in host or bare metal mode).\n\nIt needs to be set or we will miss wakeups.\n\nFixes: 9baaef0a22c8 (\"powerpc/irq: Add support for HV virtualization interrupts\")\nCc: stable@vger.kernel.org # v4.8+\nSigned-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>\n[mpe: Rename it to HVEE to match the name in the ISA]\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/7a43906f5cbfb74712af168988455e350707e310"},{"sha":"9e5f68842276672a05737c23e407250f776cbf35","author":{"name":"Nicholas Piggin","email":"f05c04607627fe5da053d74c5f6ef1dc9d849ab6@gmail.com"},"message":"powerpc: Fix missing CRCs, add more asm-prototypes.h declarations\n\nAfter patch 4efca4ed0 (\"kbuild: modversions for EXPORT_SYMBOL() for asm\"),\nasm exports can get modversions CRCs generated if they have C definitions\nin asm-prototypes.h. This patch adds missing definitions for 32 and 64 bit\nallmodconfig builds.\n\nFixes: 9445aa1a3062 (\"ppc: move exports to definitions\")\nSigned-off-by: Nicholas Piggin <npiggin@gmail.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/9e5f68842276672a05737c23e407250f776cbf35"},{"sha":"c9b8af1330198ae241cd545e1f040019010d44d9","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"flow_dissect: call init_default_flow_dissectors() earlier\n\nAndre Noll reported panics after my recent fix (commit 34fad54c2537\n\"net: __skb_flow_dissect() must cap its return value\")\n\nAfter some more headaches, Alexander root caused the problem to\ninit_default_flow_dissectors() being called too late, in case\na network driver like IGB is not a module and receives DHCP message\nvery early.\n\nFix is to call init_default_flow_dissectors() much earlier,\nas it is a core infrastructure and does not depend on another\nkernel service.\n\nFixes: 06635a35d13d4 (\"flow_dissect: use programable dissector in skb_flow_dissect and friends\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Andre Noll <maan@tuebingen.mpg.de>\nDiagnosed-by: Alexander Duyck <alexander.h.duyck@intel.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/c9b8af1330198ae241cd545e1f040019010d44d9"},{"sha":"39385cb5f3274735b03ed1f8e7ff517b02a0beed","author":{"name":"Johan Hedberg","email":"96898026c3f4a50ee66f26e7291d450d5b98554a@intel.com"},"message":"Bluetooth: Fix using the correct source address type\n\nThe hci_get_route() API is used to look up local HCI devices, however\nso far it has been incapable of dealing with anything else than the\npublic address of HCI devices. This completely breaks with LE-only HCI\ndevices that do not come with a public address, but use a static\nrandom address instead.\n\nThis patch exteds the hci_get_route() API with a src_type parameter\nthat's used for comparing with the right address of each HCI device.\n\nSigned-off-by: Johan Hedberg <johan.hedberg@intel.com>\nSigned-off-by: Marcel Holtmann <marcel@holtmann.org>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/39385cb5f3274735b03ed1f8e7ff517b02a0beed"},{"sha":"5499a6b22e5508b921c447757685b0a5e40a07ed","author":{"name":"Oliver Hartkopp","email":"4a7aeae382a9ad981c684b504c17442f359c4ede@hartkopp.net"},"message":"can: bcm: fix support for CAN FD frames\n\nSince commit 6f3b911d5f29b98 (\"can: bcm: add support for CAN FD frames\") the\nCAN broadcast manager supports CAN and CAN FD data frames.\n\nAs these data frames are embedded in struct can[fd]_frames which have a\ndifferent length the access to the provided array of CAN frames became\ndependend of op->cfsiz. By using a struct canfd_frame pointer for the array of\nCAN frames the new offset calculation based on op->cfsiz was accidently applied\nto CAN FD frame element lengths.\n\nThis fix makes the pointer to the arrays of the different CAN frame types a\nvoid pointer so that the offset calculation in bytes accesses the correct CAN\nframe elements.\n\nReference: http://marc.info/?l=linux-netdev&m=147980658909653\n\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: Oliver Hartkopp <socketcan@hartkopp.net>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nCc: linux-stable <stable@vger.kernel.org>\nSigned-off-by: Marc Kleine-Budde <mkl@pengutronix.de>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/5499a6b22e5508b921c447757685b0a5e40a07ed"},{"sha":"ffa54a238c69184414a8f3dc35a18aed875290e7","author":{"name":"Kirill Esipov","email":"3531996cb6dcf8bd17b761dc4c3958fabc7e86e6@gmail.com"},"message":"net: phy: micrel: fix KSZ8041FTL supported value\n\nFix setting of SUPPORTED_FIBRE bit as it was not present in features\nof KSZ8041.\n\nSigned-off-by: Kirill Esipov <yesipov@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/ffa54a238c69184414a8f3dc35a18aed875290e7"},{"sha":"c3891fa2543cbab26093f5e425b8a50cd6837f16","author":{"name":"Gao Feng","email":"a965c44740368ac055fd57e1ddf8942162e92a66@ikuai8.com"},"message":"driver: macvlan: Check if need rollback multicast setting in macvlan_open\n\nWhen dev_set_promiscuity failed in macvlan_open, it always invokes\ndev_set_allmulti without checking if necessary.\nNow check the IFF_ALLMULTI flag firstly before rollback the multicast\nsetting in the error handler.\n\nSigned-off-by: Gao Feng <fgao@ikuai8.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/c3891fa2543cbab26093f5e425b8a50cd6837f16"},{"sha":"920c1cd36642ac21a7b2fdc47ab44b9634d570f9","author":{"name":"Randy Dunlap","email":"7b1545df92ec18ff8c05a6b1165712e69bce8bfd@infradead.org"},"message":"netdevice.h: fix kernel-doc warning\n\nFix kernel-doc warning in <linux/netdevice.h> (missing ':'):\n\n..//include/linux/netdevice.h:1904: warning: No description found for parameter 'prio_tc_map[TC_BITMASK + 1]'\n\nSigned-off-by: Randy Dunlap <rdunlap@infradead.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/920c1cd36642ac21a7b2fdc47ab44b9634d570f9"},{"sha":"57aac71b3e9ed890cf2219dd980c36f859b43d6a","author":{"name":"Christophe Jaillet","email":"37dad06b5adae86647eb31988fda7e3e669b78d5@wanadoo.fr"},"message":"bnxt_en: Fix a VXLAN vs GENEVE issue\n\nKnowing that:\n  #define TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_VXLAN        (0x1UL << 0)\n  #define TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_GENEVE       (0x5UL << 0)\nand that 'bnxt_hwrm_tunnel_dst_port_alloc()' is only called with one of\nthese 2 constants, the TUNNEL_DST_PORT_ALLOC_REQ_TUNNEL_TYPE_GENEVE can not\ntrigger.\n\nReplace the bit test that overlap by an equality test, just as in\n'bnxt_hwrm_tunnel_dst_port_free()' above.\n\nSigned-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>\nAcked-by: Michael Chan <michael.chan@broadcom.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/57aac71b3e9ed890cf2219dd980c36f859b43d6a"},{"sha":"93af205656bed3d8d3f4b85b2a3749c7ed7d996a","author":{"name":"Zhang Shengju","email":"81dbfb17f3a802b8999d25d07872acb1e3c55600@cmss.chinamobile.com"},"message":"rtnetlink: fix the wrong minimal dump size getting from rtnl_calcit()\n\nFor RT netlink, calcit() function should return the minimal size for\nnetlink dump message. This will make sure that dump message for every\nnetwork device can be stored.\n\nCurrently, rtnl_calcit() function doesn't account the size of header of\nnetlink message, this patch will fix it.\n\nSigned-off-by: Zhang Shengju <zhangshengju@cmss.chinamobile.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/93af205656bed3d8d3f4b85b2a3749c7ed7d996a"},{"sha":"a4cd0271ead09439fa03ce38fa79654dd1e5484b","author":{"name":"WANG Cong","email":"3f5d79d28d6d48052800caba9df0b30e06fefe41@gmail.com"},"message":"net: revert \"net: l2tp: Treat NET_XMIT_CN as success in l2tp_eth_dev_xmit\"\n\nThis reverts commit 7c6ae610a1f0, because l2tp_xmit_skb() never\nreturns NET_XMIT_CN, it ignores the return value of l2tp_xmit_core().\n\nCc: Gao Feng <gfree.wind@gmail.com>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/a4cd0271ead09439fa03ce38fa79654dd1e5484b"},{"sha":"b6e01232e25629907df9db19f25da7d4e8f5b589","author":{"name":"Tariq Toukan","email":"499b9e3879a4336b0d365a303f367380df3b4ae9@mellanox.com"},"message":"net/mlx4_en: Free netdev resources under state lock\n\nMake sure mlx4_en_free_resources is called under the netdev state lock.\nThis is needed since RCU dereference of XDP prog should be protected.\n\nFixes: 326fe02d1ed6 (\"net/mlx4_en: protect ring->xdp_prog with rcu_read_lock\")\nSigned-off-by: Tariq Toukan <tariqt@mellanox.com>\nReported-by: Sagi Grimberg <sagi@grimberg.me>\nCC: Brenden Blanco <bblanco@plumgrid.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/b6e01232e25629907df9db19f25da7d4e8f5b589"},{"sha":"a1ff57416af9a7971a801d553cd53edd8afb28d6","author":{"name":"Oliver O'Halloran","email":"96d3d26266c5508c3d645286fc3296b12cf811c5@gmail.com"},"message":"powerpc/boot: Fix the early OPAL console wrappers\n\nWhen configured with CONFIG_PPC_EARLY_DEBUG_OPAL=y the kernel expects\nthe OPAL entry and base addresses to be passed in r8 and r9\nrespectively. Currently the wrapper does not attempt to restore these\nvalues before entering the decompressed kernel which causes the kernel\nto branch into whatever happens to be in r9 when doing a write to the\nOPAL console in early boot.\n\nThis patch adds a platform_ops hook that can be used to branch into the\nnew kernel. The OPAL console driver patches this at runtime so that if\nthe console is used it will be restored just prior to entering the\nkernel.\n\nFixes: 656ad58ef19e (\"powerpc/boot: Add OPAL console to epapr wrappers\")\nCc: stable@vger.kernel.org # v4.8+\nSigned-off-by: Oliver O'Halloran <oohall@gmail.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/a1ff57416af9a7971a801d553cd53edd8afb28d6"},{"sha":"764d3be6e415b40056834bfd29b994dc3f837606","author":{"name":"Paolo Abeni","email":"760d0d6fcadb77e1b4c1d3c7879788c2b4ed8bbe@redhat.com"},"message":"ipv6: bump genid when the IFA_F_TENTATIVE flag is clear\n\nWhen an ipv6 address has the tentative flag set, it can't be\nused as source for egress traffic, while the associated route,\nif any, can be looked up and even stored into some dst_cache.\n\nIn the latter scenario, the source ipv6 address selected and\nstored in the cache is most probably wrong (e.g. with\nlink-local scope) and the entity using the dst_cache will\nexperience lack of ipv6 connectivity until said cache is\ncleared or invalidated.\n\nOverall this may cause lack of connectivity over most IPv6 tunnels\n(comprising geneve and vxlan), if the first egress packet reaches\nthe tunnel before the DaD is completed for the used ipv6\naddress.\n\nThis patch bumps a new genid after that the IFA_F_TENTATIVE flag\nis cleared, so that dst_cache will be invalidated on\nnext lookup and ipv6 connectivity restored.\n\nFixes: 0c1d70af924b (\"net: use dst_cache for vxlan device\")\nFixes: 468dfffcd762 (\"geneve: add dst caching support\")\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: Paolo Abeni <pabeni@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/764d3be6e415b40056834bfd29b994dc3f837606"},{"sha":"444fdad88f35de9fd1c130b2c4e4550671758fd2","author":{"name":"Radim Krčmář","email":"468295613cb0a835b9dff6e08fea8a1219c56a14@redhat.com"},"message":"KVM: x86: fix out-of-bounds access in lapic\n\nCluster xAPIC delivery incorrectly assumed that dest_id <= 0xff.\nWith enabled KVM_X2APIC_API_USE_32BIT_IDS in KVM_CAP_X2APIC_API, a\nuserspace can send an interrupt with dest_id that results in\nout-of-bounds access.\n\nFound by syzkaller:\n\n  BUG: KASAN: slab-out-of-bounds in kvm_irq_delivery_to_apic_fast+0x11fa/0x1210 at addr ffff88003d9ca750\n  Read of size 8 by task syz-executor/22923\n  CPU: 0 PID: 22923 Comm: syz-executor Not tainted 4.9.0-rc4+ #49\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n   [...]\n  Call Trace:\n   [...] __dump_stack lib/dump_stack.c:15\n   [...] dump_stack+0xb3/0x118 lib/dump_stack.c:51\n   [...] kasan_object_err+0x1c/0x70 mm/kasan/report.c:156\n   [...] print_address_description mm/kasan/report.c:194\n   [...] kasan_report_error mm/kasan/report.c:283\n   [...] kasan_report+0x231/0x500 mm/kasan/report.c:303\n   [...] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:329\n   [...] kvm_irq_delivery_to_apic_fast+0x11fa/0x1210 arch/x86/kvm/lapic.c:824\n   [...] kvm_irq_delivery_to_apic+0x132/0x9a0 arch/x86/kvm/irq_comm.c:72\n   [...] kvm_set_msi+0x111/0x160 arch/x86/kvm/irq_comm.c:157\n   [...] kvm_send_userspace_msi+0x201/0x280 arch/x86/kvm/../../../virt/kvm/irqchip.c:74\n   [...] kvm_vm_ioctl+0xba5/0x1670 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3015\n   [...] vfs_ioctl fs/ioctl.c:43\n   [...] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679\n   [...] SYSC_ioctl fs/ioctl.c:694\n   [...] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685\n   [...] entry_SYSCALL_64_fastpath+0x1f/0xc2\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nCc: stable@vger.kernel.org\nFixes: e45115b62f9a (\"KVM: x86: use physical LAPIC array for logical x2APIC\")\nReviewed-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Radim Krčmář <rkrcmar@redhat.com>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/444fdad88f35de9fd1c130b2c4e4550671758fd2"},{"sha":"2117d5398c81554fbf803f5fd1dc55eb78216c0c","author":{"name":"Radim Krčmář","email":"468295613cb0a835b9dff6e08fea8a1219c56a14@redhat.com"},"message":"KVM: x86: drop error recovery in em_jmp_far and em_ret_far\n\nem_jmp_far and em_ret_far assumed that setting IP can only fail in 64\nbit mode, but syzkaller proved otherwise (and SDM agrees).\nCode segment was restored upon failure, but it was left uninitialized\noutside of long mode, which could lead to a leak of host kernel stack.\nWe could have fixed that by always saving and restoring the CS, but we\ntake a simpler approach and just break any guest that manages to fail\nas the error recovery is error-prone and modern CPUs don't need emulator\nfor this.\n\nFound by syzkaller:\n\n  WARNING: CPU: 2 PID: 3668 at arch/x86/kvm/emulate.c:2217 em_ret_far+0x428/0x480\n  Kernel panic - not syncing: panic_on_warn set ...\n\n  CPU: 2 PID: 3668 Comm: syz-executor Not tainted 4.9.0-rc4+ #49\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n   [...]\n  Call Trace:\n   [...] __dump_stack lib/dump_stack.c:15\n   [...] dump_stack+0xb3/0x118 lib/dump_stack.c:51\n   [...] panic+0x1b7/0x3a3 kernel/panic.c:179\n   [...] __warn+0x1c4/0x1e0 kernel/panic.c:542\n   [...] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585\n   [...] em_ret_far+0x428/0x480 arch/x86/kvm/emulate.c:2217\n   [...] em_ret_far_imm+0x17/0x70 arch/x86/kvm/emulate.c:2227\n   [...] x86_emulate_insn+0x87a/0x3730 arch/x86/kvm/emulate.c:5294\n   [...] x86_emulate_instruction+0x520/0x1ba0 arch/x86/kvm/x86.c:5545\n   [...] emulate_instruction arch/x86/include/asm/kvm_host.h:1116\n   [...] complete_emulated_io arch/x86/kvm/x86.c:6870\n   [...] complete_emulated_mmio+0x4e9/0x710 arch/x86/kvm/x86.c:6934\n   [...] kvm_arch_vcpu_ioctl_run+0x3b7a/0x5a90 arch/x86/kvm/x86.c:6978\n   [...] kvm_vcpu_ioctl+0x61e/0xdd0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2557\n   [...] vfs_ioctl fs/ioctl.c:43\n   [...] do_vfs_ioctl+0x18c/0x1040 fs/ioctl.c:679\n   [...] SYSC_ioctl fs/ioctl.c:694\n   [...] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685\n   [...] entry_SYSCALL_64_fastpath+0x1f/0xc2\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nCc: stable@vger.kernel.org\nFixes: d1442d85cc30 (\"KVM: x86: Handle errors when RIP is set during far jumps\")\nSigned-off-by: Radim Krčmář <rkrcmar@redhat.com>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/2117d5398c81554fbf803f5fd1dc55eb78216c0c"},{"sha":"81cdb259fb6d8c1c4ecfeea389ff5a73c07f5755","author":{"name":"Radim Krčmář","email":"468295613cb0a835b9dff6e08fea8a1219c56a14@redhat.com"},"message":"KVM: x86: fix out-of-bounds accesses of rtc_eoi map\n\nKVM was using arrays of size KVM_MAX_VCPUS with vcpu_id, but ID can be\nbigger that the maximal number of VCPUs, resulting in out-of-bounds\naccess.\n\nFound by syzkaller:\n\n  BUG: KASAN: slab-out-of-bounds in __apic_accept_irq+0xb33/0xb50 at addr [...]\n  Write of size 1 by task a.out/27101\n  CPU: 1 PID: 27101 Comm: a.out Not tainted 4.9.0-rc5+ #49\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n   [...]\n  Call Trace:\n   [...] __apic_accept_irq+0xb33/0xb50 arch/x86/kvm/lapic.c:905\n   [...] kvm_apic_set_irq+0x10e/0x180 arch/x86/kvm/lapic.c:495\n   [...] kvm_irq_delivery_to_apic+0x732/0xc10 arch/x86/kvm/irq_comm.c:86\n   [...] ioapic_service+0x41d/0x760 arch/x86/kvm/ioapic.c:360\n   [...] ioapic_set_irq+0x275/0x6c0 arch/x86/kvm/ioapic.c:222\n   [...] kvm_ioapic_inject_all arch/x86/kvm/ioapic.c:235\n   [...] kvm_set_ioapic+0x223/0x310 arch/x86/kvm/ioapic.c:670\n   [...] kvm_vm_ioctl_set_irqchip arch/x86/kvm/x86.c:3668\n   [...] kvm_arch_vm_ioctl+0x1a08/0x23c0 arch/x86/kvm/x86.c:3999\n   [...] kvm_vm_ioctl+0x1fa/0x1a70 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3099\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nCc: stable@vger.kernel.org\nFixes: af1bae5497b9 (\"KVM: x86: bump KVM_MAX_VCPU_ID to 1023\")\nReviewed-by: Paolo Bonzini <pbonzini@redhat.com>\nReviewed-by: David Hildenbrand <david@redhat.com>\nSigned-off-by: Radim Krčmář <rkrcmar@redhat.com>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/81cdb259fb6d8c1c4ecfeea389ff5a73c07f5755"},{"sha":"df492896e6dfb44fd1154f5402428d8e52705081","author":{"name":"Radim Krčmář","email":"468295613cb0a835b9dff6e08fea8a1219c56a14@redhat.com"},"message":"KVM: x86: check for pic and ioapic presence before use\n\nSplit irqchip allows pic and ioapic routes to be used without them being\ncreated, which results in NULL access.  Check for NULL and avoid it.\n(The setup is too racy for a nicer solutions.)\n\nFound by syzkaller:\n\n  general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN\n  Dumping ftrace buffer:\n     (ftrace buffer empty)\n  Modules linked in:\n  CPU: 3 PID: 11923 Comm: kworker/3:2 Not tainted 4.9.0-rc5+ #27\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n  Workqueue: events irqfd_inject\n  task: ffff88006a06c7c0 task.stack: ffff880068638000\n  RIP: 0010:[...]  [...] __lock_acquire+0xb35/0x3380 kernel/locking/lockdep.c:3221\n  RSP: 0000:ffff88006863ea20  EFLAGS: 00010006\n  RAX: dffffc0000000000 RBX: dffffc0000000000 RCX: 0000000000000000\n  RDX: 0000000000000039 RSI: 0000000000000000 RDI: 1ffff1000d0c7d9e\n  RBP: ffff88006863ef58 R08: 0000000000000001 R09: 0000000000000000\n  R10: 00000000000001c8 R11: 0000000000000000 R12: ffff88006a06c7c0\n  R13: 0000000000000001 R14: ffffffff8baab1a0 R15: 0000000000000001\n  FS:  0000000000000000(0000) GS:ffff88006d100000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00000000004abdd0 CR3: 000000003e2f2000 CR4: 00000000000026e0\n  Stack:\n   ffffffff894d0098 1ffff1000d0c7d56 ffff88006863ecd0 dffffc0000000000\n   ffff88006a06c7c0 0000000000000000 ffff88006863ecf8 0000000000000082\n   0000000000000000 ffffffff815dd7c1 ffffffff00000000 ffffffff00000000\n  Call Trace:\n   [...] lock_acquire+0x2a2/0x790 kernel/locking/lockdep.c:3746\n   [...] __raw_spin_lock include/linux/spinlock_api_smp.h:144\n   [...] _raw_spin_lock+0x38/0x50 kernel/locking/spinlock.c:151\n   [...] spin_lock include/linux/spinlock.h:302\n   [...] kvm_ioapic_set_irq+0x4c/0x100 arch/x86/kvm/ioapic.c:379\n   [...] kvm_set_ioapic_irq+0x8f/0xc0 arch/x86/kvm/irq_comm.c:52\n   [...] kvm_set_irq+0x239/0x640 arch/x86/kvm/../../../virt/kvm/irqchip.c:101\n   [...] irqfd_inject+0xb4/0x150 arch/x86/kvm/../../../virt/kvm/eventfd.c:60\n   [...] process_one_work+0xb40/0x1ba0 kernel/workqueue.c:2096\n   [...] worker_thread+0x214/0x18a0 kernel/workqueue.c:2230\n   [...] kthread+0x328/0x3e0 kernel/kthread.c:209\n   [...] ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:433\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nCc: stable@vger.kernel.org\nFixes: 49df6397edfc (\"KVM: x86: Split the APIC from the rest of IRQCHIP.\")\nSigned-off-by: Radim Krčmář <rkrcmar@redhat.com>","distinct":true,"url":"https://api.github.com/repos/kraj/linux/commits/df492896e6dfb44fd1154f5402428d8e52705081"}]}
{"actor":{"display_login":"kraj"}}