{"push_id":953326669,"size":11,"distinct_size":11,"ref":"refs/heads/n5lstable","head":"f1e71f532afe880019737aa89c6ecf3308b82c55","before":"aced8b7eb8365cad5cac0be1f3d99a03acbc5f57","commits":[{"sha":"f0597afe105b456d9f1eaa63cdeb5100bc3cf5ef","author":{"email":"0f114804888b88d50037b04b42e57b858d851b87@gmail.com","name":"WANG Cong"},"message":"pptp: verify sockaddr_len in pptp_bind() and pptp_connect()\n\nReported-by: Dmitry Vyukov <dvyukov@gmail.com>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/hohoxu/n5kernel/commits/f0597afe105b456d9f1eaa63cdeb5100bc3cf5ef"},{"sha":"19694bbd82a8a368e79bff2b028f092a539db91a","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"ipv6: update skb->csum when CE mark is propagated\n\nWhen a tunnel decapsulates the outer header, it has to comply\nwith RFC 6080 and eventually propagate CE mark into inner header.\n\nIt turns out IP6_ECN_set_ce() does not correctly update skb->csum\nfor CHECKSUM_COMPLETE packets, triggering infamous \"hw csum failure\"\nmessages and stack traces.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nAcked-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: HouHongxun <houhongxun@gmail.com>\n\nConflicts:\n\tinclude/net/inet_ecn.h\n\tnet/ipv6/xfrm6_mode_tunnel.c","distinct":true,"url":"https://api.github.com/repos/hohoxu/n5kernel/commits/19694bbd82a8a368e79bff2b028f092a539db91a"},{"sha":"3e2aae681f557781b01997f8c2006566af8789a9","author":{"email":"c9abf7248a519119ccb31f4fd3c3a4e0b6ebd20b@oracle.com","name":"Vegard Nossum"},"message":"kconfig: return 'false' instead of 'no' in bool function\n\nmenu_is_visible() is a bool function and should use boolean return\nvalues. \"no\" is a tristate value which happens to also have a value\nof 0, but we should nevertheless use the right symbol for it.\n\nThis is a very minor cleanup with no semantic change.\n\nFixes: 86e187ff9 (\"kconfig: add an option to determine a menu's visibility\")\nCc: Arnaud Lacombe <lacombar@gmail.com>\nCc: Mauro Carvalho Chehab <mchehab@redhat.com>\nSigned-off-by: Vegard Nossum <vegard.nossum@oracle.com>\nSigned-off-by: Michal Marek <mmarek@suse.com>","distinct":true,"url":"https://api.github.com/repos/hohoxu/n5kernel/commits/3e2aae681f557781b01997f8c2006566af8789a9"},{"sha":"002f52708701ebf7dea43ff68c5e52b88e1b0477","author":{"email":"9cd9d802d23c0ed5e224beabf4ae4a5c478746ef@linaro.org","name":"Linus Walleij"},"message":"mmc: mmci: fix an ages old detection error\n\ncommit 4956e10903fd (\"ARM: 6244/1: mmci: add variant data and default\nMCICLOCK support\") added variant data for ARM, U300 and Ux500 variants.\nThe Nomadik NHK8815/8820 variant was erroneously labeled as a U300\nvariant, and when the proper Nomadik variant was later introduced in\ncommit 34fd421349ff (\"ARM: 7378/1: mmci: add support for the Nomadik MMCI\nvariant\") this was not fixes. Let's say this fixes the latter commit as\nthere was no proper Nomadik support until then.\n\nCc: stable@vger.kernel.org\nFixes: 34fd421349ff (\"ARM: 7378/1: mmci: add support for the Nomadik...\")\nSigned-off-by: Linus Walleij <linus.walleij@linaro.org>\nSigned-off-by: Ulf Hansson <ulf.hansson@linaro.org>","distinct":true,"url":"https://api.github.com/repos/hohoxu/n5kernel/commits/002f52708701ebf7dea43ff68c5e52b88e1b0477"},{"sha":"320c0096bc2dcd655492187cf7eaa5bc54b80fb7","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ALSA: hrtimer: Fix stall by hrtimer_cancel()\n\nhrtimer_cancel() waits for the completion from the callback, thus it\nmust not be called inside the callback itself.  This was already a\nproblem in the past with ALSA hrtimer driver, and the early commit\n[fcfdebe70759: ALSA: hrtimer - Fix lock-up] tried to address it.\n\nHowever, the previous fix is still insufficient: it may still cause a\nlockup when the ALSA timer instance reprograms itself in its callback.\nThen it invokes the start function even in snd_timer_interrupt() that\nis called in hrtimer callback itself, results in a CPU stall.  This is\nno hypothetical problem but actually triggered by syzkaller fuzzer.\n\nThis patch tries to fix the issue again.  Now we call\nhrtimer_try_to_cancel() at both start and stop functions so that it\nwon't fall into a deadlock, yet giving some chance to cancel the queue\nif the functions have been called outside the callback.  The proper\nhrtimer_cancel() is called in anyway at closing, so this should be\nenough.\n\nReported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/hohoxu/n5kernel/commits/320c0096bc2dcd655492187cf7eaa5bc54b80fb7"},{"sha":"c4d18bb9337b01a4594d5d2a2d87512308e3a0db","author":{"email":"f3daba1cdc403799935674d3cd4b0e5bd1804232@chromium.org","name":"Nicolas Boichat"},"message":"ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode\n\nThis reverts one hunk of\ncommit ef44a1ec6eee (\"ALSA: sound/core: use memdup_user()\"), which\nreplaced a number of kmalloc followed by memcpy with memdup calls.\n\nIn this case, we are copying from a struct snd_pcm_hw_params32 to\na struct snd_pcm_hw_params, but the latter is 4 bytes longer than\nthe 32-bit version, so we need to separate kmalloc and copy calls.\n\nThis actually leads to an out-of-bounds memory access later on\nin sound/soc/soc-pcm.c:soc_pcm_hw_params() (detected using KASan).\n\nFixes: ef44a1ec6eee ('ALSA: sound/core: use memdup_user()')\nSigned-off-by: Nicolas Boichat <drinkcat@chromium.org>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/hohoxu/n5kernel/commits/c4d18bb9337b01a4594d5d2a2d87512308e3a0db"},{"sha":"9e9edc3ad506c06f82c6d7cb0d64483b3e3c0dc3","author":{"email":"f3daba1cdc403799935674d3cd4b0e5bd1804232@chromium.org","name":"Nicolas Boichat"},"message":"ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode\n\nThis reverts one hunk of\ncommit ef44a1ec6eee (\"ALSA: sound/core: use memdup_user()\"), which\nreplaced a number of kmalloc followed by memcpy with memdup calls.\n\nIn this case, we are copying from a struct snd_seq_port_info32 to a\nstruct snd_seq_port_info, but the latter is 4 bytes longer than the\n32-bit version, so we need to separate kmalloc and copy calls.\n\nFixes: ef44a1ec6eee ('ALSA: sound/core: use memdup_user()')\nSigned-off-by: Nicolas Boichat <drinkcat@chromium.org>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/hohoxu/n5kernel/commits/9e9edc3ad506c06f82c6d7cb0d64483b3e3c0dc3"},{"sha":"2be81f67272bdc4ccd84fa100e29fb45b8ea1f33","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0\n\nWhen a TLV ioctl with numid zero is handled, the driver may spew a\nkernel warning with a stack trace at each call.  The check was\nintended obviously only for a kernel driver, but not for a user\ninteraction.  Let's fix it.\n\nThis was spotted by syzkaller fuzzer.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/hohoxu/n5kernel/commits/2be81f67272bdc4ccd84fa100e29fb45b8ea1f33"},{"sha":"e5d3465758a83ae0de91d67d07eb7c4dac3f8cbf","author":{"email":"ef65de1c7be0aa837fe7b25ba9a7739905af6a55@gondor.apana.org.au","name":"Herbert Xu"},"message":"crypto: algif_skcipher - Load TX SG list after waiting\n\nWe need to load the TX SG list in sendmsg(2) after waiting for\nincoming data, not before.\n\nCc: stable@vger.kernel.org\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: HouHongxun <houhongxun@gmail.com>\n\nConflicts:\n\tcrypto/algif_skcipher.c","distinct":true,"url":"https://api.github.com/repos/hohoxu/n5kernel/commits/e5d3465758a83ae0de91d67d07eb7c4dac3f8cbf"},{"sha":"e7c87161afd776161031e9ac362248b3672d63aa","author":{"email":"d6e1285e1c84d3d5885c2124fdacc780e9fc0a94@tycho.nsa.gov","name":"Stephen Smalley"},"message":"selinux: fix bug in conditional rules handling\n\ncommit fa1aa143ac4a (\"selinux: extended permissions for ioctls\")\nintroduced a bug into the handling of conditional rules, skipping the\nprocessing entirely when the caller does not provide an extended\npermissions (xperms) structure.  Access checks from userspace using\n/sys/fs/selinux/access do not include such a structure since that\ninterface does not presently expose extended permission information.\nAs a result, conditional rules were being ignored entirely on userspace\naccess requests, producing denials when access was allowed by\nconditional rules in the policy.  Fix the bug by only skipping\ncomputation of extended permissions in this situation, not the entire\nconditional rules processing.\n\nReported-by: Laurent Bigonville <bigon@debian.org>\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>\n[PM: fixed long lines in patch description]\nCc: stable@vger.kernel.org # 4.3\nSigned-off-by: Paul Moore <pmoore@redhat.com>","distinct":true,"url":"https://api.github.com/repos/hohoxu/n5kernel/commits/e7c87161afd776161031e9ac362248b3672d63aa"},{"sha":"f1e71f532afe880019737aa89c6ecf3308b82c55","author":{"email":"3fddac958924aef220f202ca567388ddab3f14a8@infradead.org","name":"Peter Zijlstra"},"message":"perf: Fix race in swevent hash\n\nThere's a race on CPU unplug where we free the swevent hash array\nwhile it can still have events on. This will result in a\nuse-after-free which is BAD.\n\nSimply do not free the hash array on unplug. This leaves the thing\naround and no use-after-free takes place.\n\nWhen the last swevent dies, we do a for_each_possible_cpu() iteration\nanyway to clean these up, at which time we'll free it, so no leakage\nwill occur.\n\nReported-by: Sasha Levin <sasha.levin@oracle.com>\nTested-by: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Arnaldo Carvalho de Melo <acme@redhat.com>\nCc: Frederic Weisbecker <fweisbec@gmail.com>\nCc: Jiri Olsa <jolsa@redhat.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Stephane Eranian <eranian@google.com>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Vince Weaver <vincent.weaver@maine.edu>\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/hohoxu/n5kernel/commits/f1e71f532afe880019737aa89c6ecf3308b82c55"}]}