{"push_id":1398849150,"size":24,"distinct_size":24,"ref":"refs/heads/cm-13.0","head":"0e5d5fc5fd29db3966f1370e46425236825e1dd0","before":"3be8cca38ee58e09b22e0ed217ec0081707a3640","commits":[{"sha":"cd3cad2eabc7a8508ef4032eb1c5ec8411dce5f1","author":{"name":"Biswajit Paul","email":"7ee5649c8de55a61a3bbcbc7dcde16c04b2f65da@codeaurora.org"},"message":"input: synaptics: allocate heap memory for temp buf\n\nrmidev file operations structure include write() and\nread() which accepts data from user space. Temp\nbuffers are allocated through variable length arrays\nwhich can pose security problems. So allocate memory\non heap instead of stack to avoid this.\n\nBug: 28799389\nCRs-Fixed: 1032459\nChange-Id: I44443f91d435715dd0097ef8e8dfc48e291f93fc\nSigned-off-by: Mohan Pallaka <mpallaka@codeaurora.org>\nSigned-off-by: Biswajit Paul <biswajitpaul@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/cd3cad2eabc7a8508ef4032eb1c5ec8411dce5f1"},{"sha":"146dc676724b7bef0a0a7e64a1bb2f6972da1028","author":{"name":"Marek Szyprowski","email":"4d0ab7dac85d754388f4be3549f400e336faa58a@samsung.com"},"message":"arm64: dma-mapping: always clear allocated buffers\n\n[ Upstream commit 6829e274a623187c24f7cfc0e3d35f25d087fcc5 ]\n\nBuffers allocated by dma_alloc_coherent() are always zeroed on Alpha,\nARM (32bit), MIPS, PowerPC, x86/x86_64 and probably other architectures.\nIt turned out that some drivers rely on this 'feature'. Allocated buffer\nmight be also exposed to userspace with dma_mmap() call, so clearing it\nis desired from security point of view to avoid exposing random memory\nto userspace. This patch unifies dma_alloc_coherent() behavior on ARM64\narchitecture with other implementations by unconditionally zeroing\nallocated buffer.\n\nBug: 29795245\nCRs-Fixed: 1041735\nChange-Id: I74bf024e0f603ca8c0b05430dc2ee154d579cfb2\nCc: <stable@vger.kernel.org> # v3.14+\nSigned-off-by: Marek Szyprowski <m.szyprowski@samsung.com>\nSigned-off-by: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>\nGit-commit: a142e9641dcbead2c8845c949ad518acac96ed28\nGit-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\n[lmark@codeaurora.org: resolve merge conflicts]\nSigned-off-by: Liam Mark <lmark@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/146dc676724b7bef0a0a7e64a1bb2f6972da1028"},{"sha":"a0b6ec49e137c57390adfaa4eb74c95473b3aa53","author":{"name":"Mohit Aggarwal","email":"e312531ff0a491048a1f78294d19bb12f0137756@codeaurora.org"},"message":"diag: Fix possible underflow/overflow issues\n\nAdd check in order to fix possible integer underflow\nduring HDLC encoding which may lead to buffer\noverflow. Also added check for packet length to\navoid buffer overflow.\n\nBug: 28767796\nChange-Id: Ifbac719a7db73aab121cb00c2090edf1bf1094bb\nSigned-off-by: Yuan Lin <yualin@google.com>","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/a0b6ec49e137c57390adfaa4eb74c95473b3aa53"},{"sha":"69c402e390dddcd3da5a89d18e04b2a3ab93ddae","author":{"name":"Arve Hjønnevåg","email":"252c00e8bf89f12b2f75a1e0ab87a5ad019cda88@android.com"},"message":"ANDROID: binder: Add strong ref checks\n\nPrevent using a binder_ref with only weak references where a strong\nreference is required.\n\nBUG: 30445380\nChange-Id: I66c15b066808f28bd27bfe50fd0e03ff45a09fca\nSigned-off-by: Arve Hjønnevåg <arve@android.com>","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/69c402e390dddcd3da5a89d18e04b2a3ab93ddae"},{"sha":"60a8d44587c538ede5f7310793f9210709a99d1c","author":{"name":"Davidlohr Bueso","email":"00d5de41cc3d2418d03f53cfbcaf9aeba891dad2@hp.com"},"message":"lib/int_sqrt.c: optimize square root algorithm\n\nOptimize the current version of the shift-and-subtract (hardware)\nalgorithm, described by John von Newmann[1] and Guy L Steele.\n\nIterating 1,000,000 times, perf shows for the current version:\n\n Performance counter stats for './sqrt-curr' (10 runs):\n\n         27.170996 task-clock                #    0.979 CPUs utilized            ( +-  3.19% )\n                 3 context-switches          #    0.103 K/sec                    ( +-  4.76% )\n                 0 cpu-migrations            #    0.004 K/sec                    ( +-100.00% )\n               104 page-faults               #    0.004 M/sec                    ( +-  0.16% )\n        64,921,199 cycles                    #    2.389 GHz                      ( +-  0.03% )\n        28,967,789 stalled-cycles-frontend   #   44.62% frontend cycles idle     ( +-  0.18% )\n   <not supported> stalled-cycles-backend\n       104,502,623 instructions              #    1.61  insns per cycle\n                                             #    0.28  stalled cycles per insn  ( +-  0.00% )\n        34,088,368 branches                  # 1254.587 M/sec                    ( +-  0.00% )\n             4,901 branch-misses             #    0.01% of all branches          ( +-  1.32% )\n\n       0.027763015 seconds time elapsed                                          ( +-  3.22% )\n\nAnd for the new version:\n\nPerformance counter stats for './sqrt-new' (10 runs):\n\n          0.496869 task-clock                #    0.519 CPUs utilized            ( +-  2.38% )\n                 0 context-switches          #    0.000 K/sec\n                 0 cpu-migrations            #    0.403 K/sec                    ( +-100.00% )\n               104 page-faults               #    0.209 M/sec                    ( +-  0.15% )\n           590,760 cycles                    #    1.189 GHz                      ( +-  2.35% )\n           395,053 stalled-cycles-frontend   #   66.87% frontend cycles idle     ( +-  3.67% )\n   <not supported> stalled-cycles-backend\n           398,963 instructions              #    0.68  insns per cycle\n                                             #    0.99  stalled cycles per insn  ( +-  0.39% )\n            70,228 branches                  #  141.341 M/sec                    ( +-  0.36% )\n             3,364 branch-misses             #    4.79% of all branches          ( +-  5.45% )\n\n       0.000957440 seconds time elapsed                                          ( +-  2.42% )\n\nFurthermore, this saves space in instruction text:\n\n   text    data     bss     dec     hex filename\n    111       0       0     111      6f lib/int_sqrt-baseline.o\n     89       0       0      89      59 lib/int_sqrt.o\n\n[1] http://en.wikipedia.org/wiki/First_Draft_of_a_Report_on_the_EDVAC\n\nChange-Id: I36d524f03d759e81a5a985f44561b3e4283676a5\nSigned-off-by: Davidlohr Bueso <davidlohr.bueso@hp.com>\nReviewed-by: Jonathan Gonzalez <jgonzlez@linets.cl>\nTested-by: Jonathan Gonzalez <jgonzlez@linets.cl>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Paul Keith <javelinanddart@gmail.com>","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/60a8d44587c538ede5f7310793f9210709a99d1c"},{"sha":"a39344ab8294653037d518665d8520f494ebc299","author":{"name":"Biswajit Paul","email":"7ee5649c8de55a61a3bbcbc7dcde16c04b2f65da@codeaurora.org"},"message":"input: synaptics: Apply temp buffers for additional drivers\n\nCommit I44443f91d435715dd0097ef8e8dfc48e291f93fc missed an instance in\nour g2/synaptics touchscreen driver in which the commit applied. Apply\nit here as well as we build this section of the driver as well.\n\nChange-Id: I8b9494568b123edc69b8d5a3b4a854779082a2c7","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/a39344ab8294653037d518665d8520f494ebc299"},{"sha":"303434dee963d41443c5f04829c0570c23a50fa4","author":{"name":"Min Chong","email":"80b2cbf0ce2195028a61ea55fdb7b840626629d5@google.com"},"message":"input: synaptics: allocate heap memory for buffer\n\nAllocate buffer memory on the heap instead of the stack\nto avoid a potential stack overflow in the write function.\n\nBug: 30537088\nChange-Id: Ibe54ac391ade69e4c0c87bf5332c8bcae730e94c\nSigned-off-by: Ivan Lozano <ivanlozano@google.com>","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/303434dee963d41443c5f04829c0570c23a50fa4"},{"sha":"f8d6ac331625ef650f1eac0251413ab5201e9ea2","author":{"name":"Rainer Weikusat","email":"83eef5bb46142d818cc9ec09a206a7f5abed4070@mobileactivedefense.com"},"message":"UPSTREAM: unix: avoid use-after-free in ep_remove_wait_queue\n\n(cherry picked from commit 7d267278a9ece963d77eefec61630223fce08c6c)\n\nRainer Weikusat <rweikusat@mobileactivedefense.com> writes:\nAn AF_UNIX datagram socket being the client in an n:1 association with\nsome server socket is only allowed to send messages to the server if the\nreceive queue of this socket contains at most sk_max_ack_backlog\ndatagrams. This implies that prospective writers might be forced to go\nto sleep despite none of the message presently enqueued on the server\nreceive queue were sent by them. In order to ensure that these will be\nwoken up once space becomes again available, the present unix_dgram_poll\nroutine does a second sock_poll_wait call with the peer_wait wait queue\nof the server socket as queue argument (unix_dgram_recvmsg does a wake\nup on this queue after a datagram was received). This is inherently\nproblematic because the server socket is only guaranteed to remain alive\nfor as long as the client still holds a reference to it. In case the\nconnection is dissolved via connect or by the dead peer detection logic\nin unix_dgram_sendmsg, the server socket may be freed despite \"the\npolling mechanism\" (in particular, epoll) still has a pointer to the\ncorresponding peer_wait queue. There's no way to forcibly deregister a\nwait queue with epoll.\n\nBased on an idea by Jason Baron, the patch below changes the code such\nthat a wait_queue_t belonging to the client socket is enqueued on the\npeer_wait queue of the server whenever the peer receive queue full\ncondition is detected by either a sendmsg or a poll. A wake up on the\npeer queue is then relayed to the ordinary wait queue of the client\nsocket via wake function. The connection to the peer wait queue is again\ndissolved if either a wake up is about to be relayed or the client\nsocket reconnects or a dead peer is detected or the client socket is\nitself closed. This enables removing the second sock_poll_wait from\nunix_dgram_poll, thus avoiding the use-after-free, while still ensuring\nthat no blocked writer sleeps forever.\n\nSigned-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com>\nFixes: ec0d215f9420 (\"af_unix: fix 'poll for write'/connected DGRAM sockets\")\nReviewed-by: Jason Baron <jbaron@akamai.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nChange-Id: Ia374ee061195088f8c777940baa75cedbe897f4e\nBug: 29119002","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/f8d6ac331625ef650f1eac0251413ab5201e9ea2"},{"sha":"6b8e2e3277e703764ef023a313998fff0e2f0f62","author":{"name":"Rainer Weikusat","email":"83eef5bb46142d818cc9ec09a206a7f5abed4070@mobileactivedefense.com"},"message":"UPSTREAM: af_unix: Guard against other == sk in unix_dgram_sendmsg\n\n(cherry picked from commit a5527dda344fff0514b7989ef7a755729769daa1)\n\nThe unix_dgram_sendmsg routine use the following test\n\nif (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {\n\nto determine if sk and other are in an n:1 association (either\nestablished via connect or by using sendto to send messages to an\nunrelated socket identified by address). This isn't correct as the\nspecified address could have been bound to the sending socket itself or\nbecause this socket could have been connected to itself by the time of\nthe unix_peer_get but disconnected before the unix_state_lock(other). In\nboth cases, the if-block would be entered despite other == sk which\nmight either block the sender unintentionally or lead to trying to unlock\nthe same spin lock twice for a non-blocking send. Add a other != sk\ncheck to guard against this.\n\nFixes: 7d267278a9ec (\"unix: avoid use-after-free in ep_remove_wait_queue\")\nReported-By: Philipp Hahn <pmhahn@pmhahn.de>\nSigned-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com>\nTested-by: Philipp Hahn <pmhahn@pmhahn.de>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n\nFixes: Change-Id: Ia374ee061195088f8c777940baa75cedbe897f4e\n       (\"UPSTREAM: unix: avoid use-after-free in ep_remove_wait_queue\")\nChange-Id: I4ebef6a390df3487903b166b837e34c653e01cb2\nSigned-off-by: Amit Pundir <amit.pundir@linaro.org>","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/6b8e2e3277e703764ef023a313998fff0e2f0f62"},{"sha":"53e0149cb0e095061ba781669af2ba828e42a59f","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"af_unix: speedup /proc/net/unix\n\n/proc/net/unix has quadratic behavior, and can hold unix_table_lock for\na while if high number of unix sockets are alive. (90 ms for 200k\nsockets...)\n\nWe already have a hash table, so its quite easy to use it.\n\nProblem is unbound sockets are still hashed in a single hash slot\n(unix_socket_table[UNIX_HASH_TABLE])\n\nThis patch also spreads unbound sockets to 256 hash slots, to speedup\nboth /proc/net/unix and unix_diag.\n\nTime to read /proc/net/unix with 200k unix sockets :\n(time dd if=/proc/net/unix of=/dev/null bs=4k)\n\nbefore : 520 secs\nafter : 2 secs\n\nChange-Id: Idf8ee4b6fe9c066483f4e1376714fa2b4ff573e6\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Steven Whitehouse <swhiteho@redhat.com>\nCc: Pavel Emelyanov <xemul@parallels.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nGit-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git\nGit-commit: 7123aaa3a1416529ce461e98108e6b343b294643","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/53e0149cb0e095061ba781669af2ba828e42a59f"},{"sha":"91851d68006132c60fe0d05972892ea4fac704e4","author":{"name":"Tim Murray","email":"1236fbd8e0651a86c12ed0f0b75aaeb5e5852ea8@google.com"},"message":"lowmemorykiller: Account for unevictable pages\n\nlowmemorykiller was not taking into account unevictable pages when\ndeciding what level to kill. If significant amounts of memory were\npinned, this caused lowmemorykiller to effectively stop at a much higher\nlevel than it should.\n\nBUG 31255977\n\nChange-Id: I763ecbfef8c56d65bb8f6147ae810692bd81b6e2","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/91851d68006132c60fe0d05972892ea4fac704e4"},{"sha":"c02f2d62272bb21059855f089e7d094a0acb0a6c","author":{"name":"Peter Zijlstra","email":"4d3106856cce90e8f40acc5180f60ddda3a23b6e@infradead.org"},"message":"perf: Fix race in swevent hash\n\nThere's a race on CPU unplug where we free the swevent hash array\nwhile it can still have events on. This will result in a\nuse-after-free which is BAD.\n\nSimply do not free the hash array on unplug. This leaves the thing\naround and no use-after-free takes place.\n\nWhen the last swevent dies, we do a for_each_possible_cpu() iteration\nanyway to clean these up, at which time we'll free it, so no leakage\nwill occur.\n\nChange-Id: I53d94088d4d2cd0cb20009972c7c34b468d49535\nReported-by: Sasha Levin <sasha.levin@oracle.com>\nTested-by: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Arnaldo Carvalho de Melo <acme@redhat.com>\nCc: Frederic Weisbecker <fweisbec@gmail.com>\nCc: Jiri Olsa <jolsa@redhat.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Stephane Eranian <eranian@google.com>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Vince Weaver <vincent.weaver@maine.edu>\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/c02f2d62272bb21059855f089e7d094a0acb0a6c"},{"sha":"afa3341d3c045039b73876e165bf6d751a7f31fa","author":{"name":"Calvin Owens","email":"114f95235b01701def87f33797e11d10e01315ab@fb.com"},"message":"sg: Fix double-free when drives detach during SG_IO\n\nIn sg_common_write(), we free the block request and return -ENODEV if\nthe device is detached in the middle of the SG_IO ioctl().\n\nUnfortunately, sg_finish_rem_req() also tries to free srp->rq, so we\nend up freeing rq->cmd in the already free rq object, and then free\nthe object itself out from under the current user.\n\nThis ends up corrupting random memory via the list_head on the rq\nobject. The most common crash trace I saw is this:\n\n  ------------[ cut here ]------------\n  kernel BUG at block/blk-core.c:1420!\n  Call Trace:\n  [<ffffffff81281eab>] blk_put_request+0x5b/0x80\n  [<ffffffffa0069e5b>] sg_finish_rem_req+0x6b/0x120 [sg]\n  [<ffffffffa006bcb9>] sg_common_write.isra.14+0x459/0x5a0 [sg]\n  [<ffffffff8125b328>] ? selinux_file_alloc_security+0x48/0x70\n  [<ffffffffa006bf95>] sg_new_write.isra.17+0x195/0x2d0 [sg]\n  [<ffffffffa006cef4>] sg_ioctl+0x644/0xdb0 [sg]\n  [<ffffffff81170f80>] do_vfs_ioctl+0x90/0x520\n  [<ffffffff81258967>] ? file_has_perm+0x97/0xb0\n  [<ffffffff811714a1>] SyS_ioctl+0x91/0xb0\n  [<ffffffff81602afb>] tracesys+0xdd/0xe2\n    RIP [<ffffffff81281e04>] __blk_put_request+0x154/0x1a0\n\nThe solution is straightforward: just set srp->rq to NULL in the\nfailure branch so that sg_finish_rem_req() doesn't attempt to re-free\nit.\n\nAdditionally, since sg_rq_end_io() will never be called on the object\nwhen this happens, we need to free memory backing ->cmd if it isn't\nembedded in the object itself.\n\nKASAN was extremely helpful in finding the root cause of this bug.\n\nChange-Id: Iabfddfe352e91c9c93ae8f5adf19320db092c5c4\nSigned-off-by: Calvin Owens <calvinowens@fb.com>\nAcked-by: Douglas Gilbert <dgilbert@interlog.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/afa3341d3c045039b73876e165bf6d751a7f31fa"},{"sha":"e0023b527b55cdebe110ef14ff1fc14be621d6d4","author":{"name":"Omar Sandoval","email":"39102d44aa5274bc7139838962c296ef0b609c1e@fb.com"},"message":"block: fix use-after-free in sys_ioprio_get()\n\nget_task_ioprio() accesses the task->io_context without holding the task\nlock and thus can race with exit_io_context(), leading to a\nuse-after-free. The reproducer below hits this within a few seconds on\nmy 4-core QEMU VM:\n\nint main(int argc, char **argv)\n{\n\tpid_t pid, child;\n\tlong nproc, i;\n\n\t/* ioprio_set(IOPRIO_WHO_PROCESS, 0, IOPRIO_PRIO_VALUE(IOPRIO_CLASS_IDLE, 0)); */\n\tsyscall(SYS_ioprio_set, 1, 0, 0x6000);\n\n\tnproc = sysconf(_SC_NPROCESSORS_ONLN);\n\n\tfor (i = 0; i < nproc; i++) {\n\t\tpid = fork();\n\t\tassert(pid != -1);\n\t\tif (pid == 0) {\n\t\t\tfor (;;) {\n\t\t\t\tpid = fork();\n\t\t\t\tassert(pid != -1);\n\t\t\t\tif (pid == 0) {\n\t\t\t\t\t_exit(0);\n\t\t\t\t} else {\n\t\t\t\t\tchild = wait(NULL);\n\t\t\t\t\tassert(child == pid);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tpid = fork();\n\t\tassert(pid != -1);\n\t\tif (pid == 0) {\n\t\t\tfor (;;) {\n\t\t\t\t/* ioprio_get(IOPRIO_WHO_PGRP, 0); */\n\t\t\t\tsyscall(SYS_ioprio_get, 2, 0);\n\t\t\t}\n\t\t}\n\t}\n\n\tfor (;;) {\n\t\t/* ioprio_get(IOPRIO_WHO_PGRP, 0); */\n\t\tsyscall(SYS_ioprio_get, 2, 0);\n\t}\n\n\treturn 0;\n}\n\nThis gets us KASAN dumps like this:\n\n[   35.526914] ==================================================================\n[   35.530009] BUG: KASAN: out-of-bounds in get_task_ioprio+0x7b/0x90 at addr ffff880066f34e6c\n[   35.530009] Read of size 2 by task ioprio-gpf/363\n[   35.530009] =============================================================================\n[   35.530009] BUG blkdev_ioc (Not tainted): kasan: bad access detected\n[   35.530009] -----------------------------------------------------------------------------\n\n[   35.530009] Disabling lock debugging due to kernel taint\n[   35.530009] INFO: Allocated in create_task_io_context+0x2b/0x370 age=0 cpu=0 pid=360\n[   35.530009] \t___slab_alloc+0x55d/0x5a0\n[   35.530009] \t__slab_alloc.isra.20+0x2b/0x40\n[   35.530009] \tkmem_cache_alloc_node+0x84/0x200\n[   35.530009] \tcreate_task_io_context+0x2b/0x370\n[   35.530009] \tget_task_io_context+0x92/0xb0\n[   35.530009] \tcopy_process.part.8+0x5029/0x5660\n[   35.530009] \t_do_fork+0x155/0x7e0\n[   35.530009] \tSyS_clone+0x19/0x20\n[   35.530009] \tdo_syscall_64+0x195/0x3a0\n[   35.530009] \treturn_from_SYSCALL_64+0x0/0x6a\n[   35.530009] INFO: Freed in put_io_context+0xe7/0x120 age=0 cpu=0 pid=1060\n[   35.530009] \t__slab_free+0x27b/0x3d0\n[   35.530009] \tkmem_cache_free+0x1fb/0x220\n[   35.530009] \tput_io_context+0xe7/0x120\n[   35.530009] \tput_io_context_active+0x238/0x380\n[   35.530009] \texit_io_context+0x66/0x80\n[   35.530009] \tdo_exit+0x158e/0x2b90\n[   35.530009] \tdo_group_exit+0xe5/0x2b0\n[   35.530009] \tSyS_exit_group+0x1d/0x20\n[   35.530009] \tentry_SYSCALL_64_fastpath+0x1a/0xa4\n[   35.530009] INFO: Slab 0xffffea00019bcd00 objects=20 used=4 fp=0xffff880066f34ff0 flags=0x1fffe0000004080\n[   35.530009] INFO: Object 0xffff880066f34e58 @offset=3672 fp=0x0000000000000001\n[   35.530009] ==================================================================\n\nFix it by grabbing the task lock while we poke at the io_context.\n\nChange-Id: I0de17c057242410b1d5276c11c4bc923a463193a\nCc: stable@vger.kernel.org\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Omar Sandoval <osandov@fb.com>\nSigned-off-by: Jens Axboe <axboe@fb.com>","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/e0023b527b55cdebe110ef14ff1fc14be621d6d4"},{"sha":"16188b77d6bbef029b3474200a5adffbdc9aca3d","author":{"name":"Vegard Nossum","email":"9c44e0ed746b5c309b0bf31e4bae8fb5eb72beb1@oracle.com"},"message":"block: fix use-after-free in seq file\n\nI got a KASAN report of use-after-free:\n\n    ==================================================================\n    BUG: KASAN: use-after-free in klist_iter_exit+0x61/0x70 at addr ffff8800b6581508\n    Read of size 8 by task trinity-c1/315\n    =============================================================================\n    BUG kmalloc-32 (Not tainted): kasan: bad access detected\n    -----------------------------------------------------------------------------\n\n    Disabling lock debugging due to kernel taint\n    INFO: Allocated in disk_seqf_start+0x66/0x110 age=144 cpu=1 pid=315\n            ___slab_alloc+0x4f1/0x520\n            __slab_alloc.isra.58+0x56/0x80\n            kmem_cache_alloc_trace+0x260/0x2a0\n            disk_seqf_start+0x66/0x110\n            traverse+0x176/0x860\n            seq_read+0x7e3/0x11a0\n            proc_reg_read+0xbc/0x180\n            do_loop_readv_writev+0x134/0x210\n            do_readv_writev+0x565/0x660\n            vfs_readv+0x67/0xa0\n            do_preadv+0x126/0x170\n            SyS_preadv+0xc/0x10\n            do_syscall_64+0x1a1/0x460\n            return_from_SYSCALL_64+0x0/0x6a\n    INFO: Freed in disk_seqf_stop+0x42/0x50 age=160 cpu=1 pid=315\n            __slab_free+0x17a/0x2c0\n            kfree+0x20a/0x220\n            disk_seqf_stop+0x42/0x50\n            traverse+0x3b5/0x860\n            seq_read+0x7e3/0x11a0\n            proc_reg_read+0xbc/0x180\n            do_loop_readv_writev+0x134/0x210\n            do_readv_writev+0x565/0x660\n            vfs_readv+0x67/0xa0\n            do_preadv+0x126/0x170\n            SyS_preadv+0xc/0x10\n            do_syscall_64+0x1a1/0x460\n            return_from_SYSCALL_64+0x0/0x6a\n\n    CPU: 1 PID: 315 Comm: trinity-c1 Tainted: G    B           4.7.0+ #62\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014\n     ffffea0002d96000 ffff880119b9f918 ffffffff81d6ce81 ffff88011a804480\n     ffff8800b6581500 ffff880119b9f948 ffffffff8146c7bd ffff88011a804480\n     ffffea0002d96000 ffff8800b6581500 fffffffffffffff4 ffff880119b9f970\n    Call Trace:\n     [<ffffffff81d6ce81>] dump_stack+0x65/0x84\n     [<ffffffff8146c7bd>] print_trailer+0x10d/0x1a0\n     [<ffffffff814704ff>] object_err+0x2f/0x40\n     [<ffffffff814754d1>] kasan_report_error+0x221/0x520\n     [<ffffffff8147590e>] __asan_report_load8_noabort+0x3e/0x40\n     [<ffffffff83888161>] klist_iter_exit+0x61/0x70\n     [<ffffffff82404389>] class_dev_iter_exit+0x9/0x10\n     [<ffffffff81d2e8ea>] disk_seqf_stop+0x3a/0x50\n     [<ffffffff8151f812>] seq_read+0x4b2/0x11a0\n     [<ffffffff815f8fdc>] proc_reg_read+0xbc/0x180\n     [<ffffffff814b24e4>] do_loop_readv_writev+0x134/0x210\n     [<ffffffff814b4c45>] do_readv_writev+0x565/0x660\n     [<ffffffff814b8a17>] vfs_readv+0x67/0xa0\n     [<ffffffff814b8de6>] do_preadv+0x126/0x170\n     [<ffffffff814b92ec>] SyS_preadv+0xc/0x10\n\nThis problem can occur in the following situation:\n\nopen()\n - pread()\n    - .seq_start()\n       - iter = kmalloc() // succeeds\n       - seqf->private = iter\n    - .seq_stop()\n       - kfree(seqf->private)\n - pread()\n    - .seq_start()\n       - iter = kmalloc() // fails\n    - .seq_stop()\n       - class_dev_iter_exit(seqf->private) // boom! old pointer\n\nAs the comment in disk_seqf_stop() says, stop is called even if start\nfailed, so we need to reinitialise the private pointer to NULL when seq\niteration stops.\n\nAn alternative would be to set the private pointer to NULL when the\nkmalloc() in disk_seqf_start() fails.\n\nChange-Id: I523b1631c2fc183ceca00a06182e6909b5e14328\nCc: stable@vger.kernel.org\nSigned-off-by: Vegard Nossum <vegard.nossum@oracle.com>\nAcked-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Jens Axboe <axboe@fb.com>","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/16188b77d6bbef029b3474200a5adffbdc9aca3d"},{"sha":"b98f4a19a4a76d20cd73c188bbeab4a64e795d31","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()\n\nJust a minor code cleanup: unify the error paths.\n\nChange-Id: I31346b08ed1024819c58eff797c63bb42c283512\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/b98f4a19a4a76d20cd73c188bbeab4a64e795d31"},{"sha":"76f92e2b8e89b357175f49f6337537aae9ded84c","author":{"name":"Zhen Kong","email":"b999fb1d59364862997bac94d5b793be36d63b01@codeaurora.org"},"message":"msm: crypto: Fix integer over flow check in qcrypto driver\n\nInteger overflow check is invalid when ULONG_MAX is used,\nas ULONG_MAX has typeof 'unsigned long', while req->assoclen,\nreq->crytlen, and qreq.ivsize are 'unsigned int'. Make change\nto use UINT_MAX instead of ULONG_MAX.\n\nCRs-fixed: 1050970\nChange-Id: I3782ea7ed2eaacdcad15b34e047a4699bf4f9e4f\nSigned-off-by: Zhen Kong <zkong@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/76f92e2b8e89b357175f49f6337537aae9ded84c"},{"sha":"12562026784379a502f2cf70841e41d52bd05ebe","author":{"name":"Peter Hurley","email":"6214814a67b9688a08e8c6dc7fa5dee076dddc8d@hurleysoftware.com"},"message":"BACKPORT: tty: Prevent ldisc drivers from re-using stale tty fields\n\n(cherry picked from commit dd42bf1197144ede075a9d4793123f7689e164bc)\n\nLine discipline drivers may mistakenly misuse ldisc-related fields\nwhen initializing. For example, a failure to initialize tty->receive_room\nin the N_GIGASET_M101 line discipline was recently found and fixed [1].\nNow, the N_X25 line discipline has been discovered accessing the previous\nline discipline's already-freed private data [2].\n\nHarden the ldisc interface against misuse by initializing revelant\ntty fields before instancing the new line discipline.\n\n[1]\n    commit fd98e9419d8d622a4de91f76b306af6aa627aa9c\n    Author: Tilman Schmidt <tilman@imap.cc>\n    Date:   Tue Jul 14 00:37:13 2015 +0200\n\n    isdn/gigaset: reset tty->receive_room when attaching ser_gigaset\n\n[2] Report from Sasha Levin <sasha.levin@oracle.com>\n    [  634.336761] ==================================================================\n    [  634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0\n    [  634.339558] Read of size 4 by task syzkaller_execu/8981\n    [  634.340359] =============================================================================\n    [  634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected\n    ...\n    [  634.405018] Call Trace:\n    [  634.405277] dump_stack (lib/dump_stack.c:52)\n    [  634.405775] print_trailer (mm/slub.c:655)\n    [  634.406361] object_err (mm/slub.c:662)\n    [  634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)\n    [  634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)\n    [  634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))\n    [  634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)\n    [  634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)\n    [  634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)\n    [  634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)\n    [  634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)\n    [  634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)\n\nCc: Tilman Schmidt <tilman@imap.cc>\nCc: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: Peter Hurley <peter@hurleysoftware.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nChange-Id: Ibed6feadfb9706d478f93feec3b240aecfc64af3\nBug: 30951112","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/12562026784379a502f2cf70841e41d52bd05ebe"},{"sha":"fcd1bc1861096bd082625d7ea9d62339ce5c5070","author":{"name":"Paul Moore","email":"54f65660711c038b3360dd7288dc12347ae58ba3@paul-moore.com"},"message":"BACKPORT: audit: fix a double fetch in audit_log_single_execve_arg()\n\n(cherry picked from commit 43761473c254b45883a64441dd0bc85a42f3645c)\n\nThere is a double fetch problem in audit_log_single_execve_arg()\nwhere we first check the execve(2) argumnets for any \"bad\" characters\nwhich would require hex encoding and then re-fetch the arguments for\nlogging in the audit record[1].  Of course this leaves a window of\nopportunity for an unsavory application to munge with the data.\n\nThis patch reworks things by only fetching the argument data once[2]\ninto a buffer where it is scanned and logged into the audit\nrecords(s).  In addition to fixing the double fetch, this patch\nimproves on the original code in a few other ways: better handling\nof large arguments which require encoding, stricter record length\nchecking, and some performance improvements (completely unverified,\nbut we got rid of some strlen() calls, that's got to be a good\nthing).\n\nAs part of the development of this patch, I've also created a basic\nregression test for the audit-testsuite, the test can be tracked on\nGitHub at the following link:\n\n * https://github.com/linux-audit/audit-testsuite/issues/25\n\n[1] If you pay careful attention, there is actually a triple fetch\nproblem due to a strnlen_user() call at the top of the function.\n\n[2] This is a tiny white lie, we do make a call to strnlen_user()\nprior to fetching the argument data.  I don't like it, but due to the\nway the audit record is structured we really have no choice unless we\ncopy the entire argument at once (which would require a rather\nwasteful allocation).  The good news is that with this patch the\nkernel no longer relies on this strnlen_user() value for anything\nbeyond recording it in the log, we also update it with a trustworthy\nvalue whenever possible.\n\nReported-by: Pengfei Wang <wpengfeinudt@gmail.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Paul Moore <paul@paul-moore.com>\nChange-Id: I10e979e94605e3cf8d461e3e521f8f9837228aa5\nBug: 30956807","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/fcd1bc1861096bd082625d7ea9d62339ce5c5070"},{"sha":"131e968d6cbba62dbfa52ccc27f3b14b8577d660","author":{"name":"Vladis Dronov","email":"41435c47c64e54f8ec26bbc1be6d7972ea4d40bd@redhat.com"},"message":"ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call\n\ncreate_fixed_stream_quirk(), snd_usb_parse_audio_interface() and\ncreate_uaxx_quirk() functions allocate the audioformat object by themselves\nand free it upon error before returning. However, once the object is linked\nto a stream, it's freed again in snd_usb_audio_pcm_free(), thus it'll be\ndouble-freed, eventually resulting in a memory corruption.\n\nThis patch fixes these failures in the error paths by unlinking the audioformat\nobject before freeing it.\n\nBased on a patch by Takashi Iwai <tiwai@suse.de>\n\n[Note for stable backports:\n this patch requires the commit 902eb7fd1e4a ('ALSA: usb-audio: Minor\n code cleanup in create_fixed_stream_quirk()')]\n\nChange-Id: I99e972c65cfe43dfa87f9ac28dd203ac416518fc\nBugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283358\nReported-by: Ralf Spenneberg <ralf@spenneberg.net>\nCc: <stable@vger.kernel.org> # see the note above\nSigned-off-by: Vladis Dronov <vdronov@redhat.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/blastagator/LGG2_Kernel/commits/131e968d6cbba62dbfa52ccc27f3b14b8577d660"}]}
{"actor":{"display_login":"blastagator"}}