{"push_id":3171178048,"size":33,"distinct_size":33,"ref":"refs/heads/9.0","head":"68f1548567ec474b1df037c28ae1dfd915f51f88","before":"3dc7d42de13c2d32eca7089e1ecdf5b04cc19f29","commits":[{"sha":"7689ac7e329e65c988a861cea3cd1e666d100b8c","author":{"name":"Takashi Iwai","email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de"},"message":"ACPI: APEI / ERST: Fix missing error handling in erst_reader()\n\ncommit bb82e0b4a7e96494f0c1004ce50cec3d7b5fb3d1 upstream.\n\nThe commit f6f828513290 (\"pstore: pass allocated memory region back to\ncaller\") changed the check of the return value from erst_read() in\nerst_reader() in the following way:\n\n        if (len == -ENOENT)\n                goto skip;\n-       else if (len < 0) {\n-               rc = -1;\n+       else if (len < sizeof(*rcd)) {\n+               rc = -EIO;\n                goto out;\n\nThis introduced another bug: since the comparison with sizeof() is\ncast to unsigned, a negative len value doesn't hit any longer.\nAs a result, when an error is returned from erst_read(), the code\nfalls through, and it may eventually lead to some weird thing like\nmemory corruption.\n\nThis patch adds the negative error value check more explicitly for\naddressing the issue.\n\nFixes: f6f828513290 (pstore: pass allocated memory region back to caller)\nTested-by: Jerry Tang <jtang@suse.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nAcked-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Borislav Petkov <bp@suse.de>\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/7689ac7e329e65c988a861cea3cd1e666d100b8c"},{"sha":"08f98db754ae2550abde97e7e13054dfa33c699b","author":{"name":"Sebastian Andrzej Siewior","email":"265264fed90bdf8e813a354375ec16f47ebdb1c5@linutronix.de"},"message":"crypto: mcryptd - protect the per-CPU queue with a lock\n\ncommit 9abffc6f2efe46c3564c04312e52e07622d40e51 upstream.\n\nmcryptd_enqueue_request() grabs the per-CPU queue struct and protects\naccess to it with disabled preemption. Then it schedules a worker on the\nsame CPU. The worker in mcryptd_queue_worker() guards access to the same\nper-CPU variable with disabled preemption.\n\nIf we take CPU-hotplug into account then it is possible that between\nqueue_work_on() and the actual invocation of the worker the CPU goes\ndown and the worker will be scheduled on _another_ CPU. And here the\npreempt_disable() protection does not work anymore. The easiest thing is\nto add a spin_lock() to guard access to the list.\n\nAnother detail: mcryptd_queue_worker() is not processing more than\nMCRYPTD_BATCH invocation in a row. If there are still items left, then\nit will invoke queue_work() to proceed with more later. *I* would\nsuggest to simply drop that check because it does not use a system\nworkqueue and the workqueue is already marked as \"CPU_INTENSIVE\". And if\npreemption is required then the scheduler should do it.\nHowever if queue_work() is used then the work item is marked as CPU\nunbound. That means it will try to run on the local CPU but it may run\non another CPU as well. Especially with CONFIG_DEBUG_WQ_FORCE_RR_CPU=y.\nAgain, the preempt_disable() won't work here but lock which was\nintroduced will help.\nIn order to keep work-item on the local CPU (and avoid RR) I changed it\nto queue_work_on().\n\nSigned-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/08f98db754ae2550abde97e7e13054dfa33c699b"},{"sha":"aa3d6e39a61757da1d720454368d2e774e42ba34","author":{"name":"Johan Hovold","email":"759412786bc533369b22377bf83fb9056c5b25b2@kernel.org"},"message":"mfd: twl4030-audio: Fix sibling-node lookup\n\ncommit 0a423772de2f3d7b00899987884f62f63ae00dcb upstream.\n\nA helper purported to look up a child node based on its name was using\nthe wrong of-helper and ended up prematurely freeing the parent of-node\nwhile leaking any matching node.\n\nTo make things worse, any matching node would not even necessarily be a\nchild node as the whole device tree was searched depth-first starting at\nthe parent.\n\nFixes: 019a7e6b7b31 (\"mfd: twl4030-audio: Add DT support\")\nSigned-off-by: Johan Hovold <johan@kernel.org>\nAcked-by: Peter Ujfalusi <peter.ujfalusi@ti.com>\nSigned-off-by: Lee Jones <lee.jones@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/aa3d6e39a61757da1d720454368d2e774e42ba34"},{"sha":"1cf41e0fd008126ba4d2ca5a91af72baf870037c","author":{"name":"Johan Hovold","email":"759412786bc533369b22377bf83fb9056c5b25b2@kernel.org"},"message":"mfd: twl6040: Fix child-node lookup\n\ncommit 85e9b13cbb130a3209f21bd7933933399c389ffe upstream.\n\nFix child-node lookup during probe, which ended up searching the whole\ndevice tree depth-first starting at the parent rather than just matching\non its children.\n\nTo make things worse, the parent node was prematurely freed, while the\nchild node was leaked.\n\nNote that the CONFIG_OF compile guard can be removed as\nof_get_child_by_name() provides a !CONFIG_OF implementation which always\nfails.\n\nFixes: 37e13cecaa14 (\"mfd: Add support for Device Tree to twl6040\")\nFixes: ca2cad6ae38e (\"mfd: Fix twl6040 build failure\")\nSigned-off-by: Johan Hovold <johan@kernel.org>\nAcked-by: Peter Ujfalusi <peter.ujfalusi@ti.com>\nSigned-off-by: Lee Jones <lee.jones@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/1cf41e0fd008126ba4d2ca5a91af72baf870037c"},{"sha":"4cbf9b2898b6dc7cc2ba961f721322224c25381c","author":{"name":"Takashi Iwai","email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de"},"message":"ALSA: rawmidi: Avoid racy info ioctl via ctl device\n\ncommit c1cfd9025cc394fd137a01159d74335c5ac978ce upstream.\n\nThe rawmidi also allows to obtaining the information via ioctl of ctl\nAPI.  It means that user can issue an ioctl to the rawmidi device even\nwhen it's being removed as long as the control device is present.\nAlthough the code has some protection via the global register_mutex,\nits range is limited to the search of the corresponding rawmidi\nobject, and the mutex is already unlocked at accessing the rawmidi\nobject.  This may lead to a use-after-free.\n\nFor avoiding it, this patch widens the application of register_mutex\nto the whole snd_rawmidi_info_select() function.  We have another\nmutex per rawmidi object, but this operation isn't very hot path, so\nit shouldn't matter from the performance POV.\n\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/4cbf9b2898b6dc7cc2ba961f721322224c25381c"},{"sha":"7dd18cfbe49535bbb0ae8b100fe342b1ac22ebc9","author":{"name":"Takashi Iwai","email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de"},"message":"ALSA: usb-audio: Fix the missing ctl name suffix at parsing SU\n\ncommit 5a15f289ee87eaf33f13f08a4909ec99d837ec5f upstream.\n\nThe commit 89b89d121ffc (\"ALSA: usb-audio: Add check return value for\nusb_string()\") added the check of the return value from\nsnd_usb_copy_string_desc(), which is correct per se, but it introduced\na regression.  In the original code, either the \"Clock Source\",\n\"Playback Source\" or \"Capture Source\" suffix is added after the\nterminal string, while the commit changed it to add the suffix only\nwhen get_term_name() is failing.  It ended up with an incorrect ctl\nname like \"PCM\" instead of \"PCM Capture Source\".\n\nAlso, even the original code has a similar bug: when the ctl name is\ngenerated from snd_usb_copy_string_desc() for the given iSelector, it\nalso doesn't put the suffix.\n\nThis patch addresses these issues: the suffix is added always when no\nstatic mapping is found.  Also the patch tries to put more comments\nand cleans up the if/else block for better readability in order to\navoid the same pitfall again.\n\nFixes: 89b89d121ffc (\"ALSA: usb-audio: Add check return value for usb_string()\")\nReported-and-tested-by: Mauro Santos <registo.mailling@gmail.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/7dd18cfbe49535bbb0ae8b100fe342b1ac22ebc9"},{"sha":"ce8d9398646d3f5ceb42ba72315f8ea97cabc262","author":{"name":"Rafael J. Wysocki","email":"27ffc44a8ec6a212fba98cfc3246c6ce8ab131e0@intel.com"},"message":"PCI / PM: Force devices to D0 in pci_pm_thaw_noirq()\n\ncommit 5839ee7389e893a31e4e3c9cf17b50d14103c902 upstream.\n\nIt is incorrect to call pci_restore_state() for devices in low-power\nstates (D1-D3), as that involves the restoration of MSI setup which\nrequires MMIO to be operational and that is only the case in D0.\n\nHowever, pci_pm_thaw_noirq() may do that if the driver's \"freeze\"\ncallbacks put the device into a low-power state, so fix it by making\nit force devices into D0 via pci_set_power_state() instead of trying\nto \"update\" their power state which is pointless.\n\nFixes: e60514bd4485 (PCI/PM: Restore the status of PCI devices across hibernation)\nReported-by: Thomas Gleixner <tglx@linutronix.de>\nReported-by: Maarten Lankhorst <dev@mblankhorst.nl>\nTested-by: Thomas Gleixner <tglx@linutronix.de>\nTested-by: Maarten Lankhorst <dev@mblankhorst.nl>\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>\nAcked-by: Bjorn Helgaas <bhelgaas@google.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/ce8d9398646d3f5ceb42ba72315f8ea97cabc262"},{"sha":"a3653b092ac8e6cef537305ff696a3b8958012ed","author":{"name":"Helge Deller","email":"5b1e7895819cf7d6bc77091b09bbfd6d330a4e74@gmx.de"},"message":"parisc: Hide Diva-built-in serial aux and graphics card\n\ncommit bcf3f1752a622f1372d3252d0fea8855d89812e7 upstream.\n\nDiva GSP card has built-in serial AUX port and ATI graphic card which simply\ndon't work and which both don't have external connectors.  User Guides even\nmention that those devices shouldn't be used.\nSo, prevent that Linux drivers try to enable those devices.\n\nSigned-off-by: Helge Deller <deller@gmx.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/a3653b092ac8e6cef537305ff696a3b8958012ed"},{"sha":"0bd92121a8887dd2571b584709b1becf0eb8064c","author":{"name":"Wanpeng Li","email":"bdcdf23be75b976d8e1ad9f82e6b264941889f50@hotmail.com"},"message":"KVM: X86: Fix load RFLAGS w/o the fixed bit\n\ncommit d73235d17ba63b53dc0e1051dbc10a1f1be91b71 upstream.\n\n *** Guest State ***\n CR0: actual=0x0000000000000030, shadow=0x0000000060000010, gh_mask=fffffffffffffff7\n CR4: actual=0x0000000000002050, shadow=0x0000000000000000, gh_mask=ffffffffffffe871\n CR3 = 0x00000000fffbc000\n RSP = 0x0000000000000000  RIP = 0x0000000000000000\n RFLAGS=0x00000000         DR7 = 0x0000000000000400\n        ^^^^^^^^^^\n\nThe failed vmentry is triggered by the following testcase when ept=Y:\n\n    #include <unistd.h>\n    #include <sys/syscall.h>\n    #include <string.h>\n    #include <stdint.h>\n    #include <linux/kvm.h>\n    #include <fcntl.h>\n    #include <sys/ioctl.h>\n\n    long r[5];\n    int main()\n    {\n    \tr[2] = open(\"/dev/kvm\", O_RDONLY);\n    \tr[3] = ioctl(r[2], KVM_CREATE_VM, 0);\n    \tr[4] = ioctl(r[3], KVM_CREATE_VCPU, 7);\n    \tstruct kvm_regs regs = {\n    \t\t.rflags = 0,\n    \t};\n    \tioctl(r[4], KVM_SET_REGS, &regs);\n    \tioctl(r[4], KVM_RUN, 0);\n    }\n\nX86 RFLAGS bit 1 is fixed set, userspace can simply clearing bit 1\nof RFLAGS with KVM_SET_REGS ioctl which results in vmentry fails.\nThis patch fixes it by oring X86_EFLAGS_FIXED during ioctl.\n\nSuggested-by: Jim Mattson <jmattson@google.com>\nReviewed-by: David Hildenbrand <david@redhat.com>\nReviewed-by: Quan Xu <quan.xu0@gmail.com>\nCc: Paolo Bonzini <pbonzini@redhat.com>\nCc: Radim Krčmář <rkrcmar@redhat.com>\nCc: Jim Mattson <jmattson@google.com>\nSigned-off-by: Wanpeng Li <wanpeng.li@hotmail.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/0bd92121a8887dd2571b584709b1becf0eb8064c"},{"sha":"18868d3562a39b923c3cfcf4cc428a8a69c521e5","author":{"name":"Ravi Bangoria","email":"c3c2a342b6d0b20c2fffcb500dabb9f78ad28a56@linux.vnet.ibm.com"},"message":"powerpc/perf: Dereference BHRB entries safely\n\ncommit f41d84dddc66b164ac16acf3f584c276146f1c48 upstream.\n\nIt's theoretically possible that branch instructions recorded in\nBHRB (Branch History Rolling Buffer) entries have already been\nunmapped before they are processed by the kernel. Hence, trying to\ndereference such memory location will result in a crash. eg:\n\n    Unable to handle kernel paging request for data at address 0xd000000019c41764\n    Faulting instruction address: 0xc000000000084a14\n    NIP [c000000000084a14] branch_target+0x4/0x70\n    LR [c0000000000eb828] record_and_restart+0x568/0x5c0\n    Call Trace:\n    [c0000000000eb3b4] record_and_restart+0xf4/0x5c0 (unreliable)\n    [c0000000000ec378] perf_event_interrupt+0x298/0x460\n    [c000000000027964] performance_monitor_exception+0x54/0x70\n    [c000000000009ba4] performance_monitor_common+0x114/0x120\n\nFix it by deferefencing the addresses safely.\n\nFixes: 691231846ceb (\"powerpc/perf: Fix setting of \"to\" addresses for BHRB\")\nSuggested-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>\nSigned-off-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>\nReviewed-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>\n[mpe: Use probe_kernel_read() which is clearer, tweak change log]\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/18868d3562a39b923c3cfcf4cc428a8a69c521e5"},{"sha":"2dcb71928fc6452eb4401a88b3f44dd8e0d8e1c7","author":{"name":"Yelena Krivosheev","email":"86cbf28d3aac395d915d79cf038bd25eb785cbf1@marvell.com"},"message":"net: mvneta: clear interface link status on port disable\n\ncommit 4423c18e466afdfb02a36ee8b9f901d144b3c607 upstream.\n\nWhen port connect to PHY in polling mode (with poll interval 1 sec),\nport and phy link status must be synchronize in order don't loss link\nchange event.\n\n[gregory.clement@free-electrons.com: add fixes tag]\nFixes: c5aff18204da (\"net: mvneta: driver for Marvell Armada 370/XP network unit\")\nSigned-off-by: Yelena Krivosheev <yelena@marvell.com>\nTested-by: Dmitri Epshtein <dima@marvell.com>\nSigned-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/2dcb71928fc6452eb4401a88b3f44dd8e0d8e1c7"},{"sha":"0ccc892efe8bf77c0e1c82fb0fd705b520c6bf4c","author":{"name":"Steven Rostedt (VMware)","email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org"},"message":"tracing: Remove extra zeroing out of the ring buffer page\n\ncommit 6b7e633fe9c24682df550e5311f47fb524701586 upstream.\n\nThe ring_buffer_read_page() takes care of zeroing out any extra data in the\npage that it returns. There's no need to zero it out again from the\nconsumer. It was removed from one consumer of this function, but\nread_buffers_splice_read() did not remove it, and worse, it contained a\nnasty bug because of it.\n\nFixes: 2711ca237a084 (\"ring-buffer: Move zeroing out excess in page to ring buffer code\")\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/0ccc892efe8bf77c0e1c82fb0fd705b520c6bf4c"},{"sha":"05ba73ec63ef76225e364bd762a2396d1f2068f6","author":{"name":"Steven Rostedt (VMware)","email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org"},"message":"tracing: Fix possible double free on failure of allocating trace buffer\n\ncommit 4397f04575c44e1440ec2e49b6302785c95fd2f8 upstream.\n\nJing Xia and Chunyan Zhang reported that on failing to allocate part of the\ntracing buffer, memory is freed, but the pointers that point to them are not\ninitialized back to NULL, and later paths may try to free the freed memory\nagain. Jing and Chunyan fixed one of the locations that does this, but\nmissed a spot.\n\nLink: http://lkml.kernel.org/r/20171226071253.8968-1-chunyan.zhang@spreadtrum.com\n\nFixes: 737223fbca3b1 (\"tracing: Consolidate buffer allocation code\")\nReported-by: Jing Xia <jing.xia@spreadtrum.com>\nReported-by: Chunyan Zhang <chunyan.zhang@spreadtrum.com>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/05ba73ec63ef76225e364bd762a2396d1f2068f6"},{"sha":"c87a8ff9147401c7a9cd8b1e8c530991ce2a9689","author":{"name":"Jing Xia","email":"f4bba3231364d206eb321a8c35431c333b0758ba@spreadtrum.com"},"message":"tracing: Fix crash when it fails to alloc ring buffer\n\ncommit 24f2aaf952ee0b59f31c3a18b8b36c9e3d3c2cf5 upstream.\n\nDouble free of the ring buffer happens when it fails to alloc new\nring buffer instance for max_buffer if TRACER_MAX_TRACE is configured.\nThe root cause is that the pointer is not set to NULL after the buffer\nis freed in allocate_trace_buffers(), and the freeing of the ring\nbuffer is invoked again later if the pointer is not equal to Null,\nas:\n\ninstance_mkdir()\n    |-allocate_trace_buffers()\n        |-allocate_trace_buffer(tr, &tr->trace_buffer...)\n\t|-allocate_trace_buffer(tr, &tr->max_buffer...)\n\n          // allocate fail(-ENOMEM),first free\n          // and the buffer pointer is not set to null\n        |-ring_buffer_free(tr->trace_buffer.buffer)\n\n       // out_free_tr\n    |-free_trace_buffers()\n        |-free_trace_buffer(&tr->trace_buffer);\n\n\t      //if trace_buffer is not null, free again\n\t    |-ring_buffer_free(buf->buffer)\n                |-rb_free_cpu_buffer(buffer->buffers[cpu])\n                    // ring_buffer_per_cpu is null, and\n                    // crash in ring_buffer_per_cpu->pages\n\nLink: http://lkml.kernel.org/r/20171226071253.8968-1-chunyan.zhang@spreadtrum.com\n\nFixes: 737223fbca3b1 (\"tracing: Consolidate buffer allocation code\")\nSigned-off-by: Jing Xia <jing.xia@spreadtrum.com>\nSigned-off-by: Chunyan Zhang <chunyan.zhang@spreadtrum.com>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/c87a8ff9147401c7a9cd8b1e8c530991ce2a9689"},{"sha":"1e2c0f65d5f5237ea8206f6c04982ebd8661afd7","author":{"name":"Steven Rostedt (VMware)","email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org"},"message":"ring-buffer: Mask out the info bits when returning buffer page length\n\ncommit 45d8b80c2ac5d21cd1e2954431fb676bc2b1e099 upstream.\n\nTwo info bits were added to the \"commit\" part of the ring buffer data page\nwhen returned to be consumed. This was to inform the user space readers that\nevents have been missed, and that the count may be stored at the end of the\npage.\n\nWhat wasn't handled, was the splice code that actually called a function to\nreturn the length of the data in order to zero out the rest of the page\nbefore sending it up to user space. These data bits were returned with the\nlength making the value negative, and that negative value was not checked.\nIt was compared to PAGE_SIZE, and only used if the size was less than\nPAGE_SIZE. Luckily PAGE_SIZE is unsigned long which made the compare an\nunsigned compare, meaning the negative size value did not end up causing a\nlarge portion of memory to be randomly zeroed out.\n\nFixes: 66a8cb95ed040 (\"ring-buffer: Add place holder recording of dropped events\")\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/1e2c0f65d5f5237ea8206f6c04982ebd8661afd7"},{"sha":"96a77a37b354a0e0e91ce7101e19f7e01115f95b","author":{"name":"Johan Hovold","email":"759412786bc533369b22377bf83fb9056c5b25b2@kernel.org"},"message":"ASoC: twl4030: fix child-node lookup\n\ncommit 15f8c5f2415bfac73f33a14bcd83422bcbfb5298 upstream.\n\nFix child-node lookup during probe, which ended up searching the whole\ndevice tree depth-first starting at the parent rather than just matching\non its children.\n\nTo make things worse, the parent codec node was also prematurely freed,\nwhile the child node was leaked.\n\nFixes: 2d6d649a2e0f (\"ASoC: twl4030: Support for DT booted kernel\")\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/96a77a37b354a0e0e91ce7101e19f7e01115f95b"},{"sha":"8ecf0c70fd847e26e0b8df9245e824aa85d2b701","author":{"name":"Linus Torvalds","email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org"},"message":"kbuild: add '-fno-stack-check' to kernel build options\n\ncommit 3ce120b16cc548472f80cf8644f90eda958cf1b6 upstream.\n\nIt appears that hardened gentoo enables \"-fstack-check\" by default for\ngcc.\n\nThat doesn't work _at_all_ for the kernel, because the kernel stack\ndoesn't act like a user stack at all: it's much smaller, and it doesn't\nauto-expand on use.  So the extra \"probe one page below the stack\" code\ngenerated by -fstack-check just breaks the kernel in horrible ways,\ncausing infinite double faults etc.\n\n[ I have to say, that the particular code gcc generates looks very\n  stupid even for user space where it works, but that's a separate\n  issue.  ]\n\nReported-and-tested-by: Alexander Tsoy <alexander@tsoy.me>\nReported-and-tested-by: Toralf Förster <toralf.foerster@gmx.de>\nCc: Dave Hansen <dave.hansen@intel.com>\nCc: Jiri Kosina <jikos@kernel.org>\nCc: Andy Lutomirski <luto@amacapital.net>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/8ecf0c70fd847e26e0b8df9245e824aa85d2b701"},{"sha":"1ada9110a30b80c5fa1020918e2d059e391066a5","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"ipv4: igmp: guard against silly MTU values\n\n\n[ Upstream commit b5476022bbada3764609368f03329ca287528dc8 ]\n\nIPv4 stack reacts to changes to small MTU, by disabling itself under\nRTNL.\n\nBut there is a window where threads not using RTNL can see a wrong\ndevice mtu. This can lead to surprises, in igmp code where it is\nassumed the mtu is suitable.\n\nFix this by reading device mtu once and checking IPv4 minimal MTU.\n\nThis patch adds missing IPV4_MIN_MTU define, to not abuse\nETH_MIN_MTU anymore.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/1ada9110a30b80c5fa1020918e2d059e391066a5"},{"sha":"570f98fa08eb509e8fdfbe1fede367ea2e9e0aec","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"ipv6: mcast: better catch silly mtu values\n\n\n[ Upstream commit b9b312a7a451e9c098921856e7cfbc201120e1a7 ]\n\nsyzkaller reported crashes in IPv6 stack [1]\n\nXin Long found that lo MTU was set to silly values.\n\nIPv6 stack reacts to changes to small MTU, by disabling itself under\nRTNL.\n\nBut there is a window where threads not using RTNL can see a wrong\ndevice mtu. This can lead to surprises, in mld code where it is assumed\nthe mtu is suitable.\n\nFix this by reading device mtu once and checking IPv6 minimal MTU.\n\n[1]\n skbuff: skb_over_panic: text:0000000010b86b8d len:196 put:20\n head:000000003b477e60 data:000000000e85441e tail:0xd4 end:0xc0 dev:lo\n ------------[ cut here ]------------\n kernel BUG at net/core/skbuff.c:104!\n invalid opcode: 0000 [#1] SMP KASAN\n Dumping ftrace buffer:\n    (ftrace buffer empty)\n Modules linked in:\n CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.15.0-rc2-mm1+ #39\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS\n Google 01/01/2011\n RIP: 0010:skb_panic+0x15c/0x1f0 net/core/skbuff.c:100\n RSP: 0018:ffff8801db307508 EFLAGS: 00010286\n RAX: 0000000000000082 RBX: ffff8801c517e840 RCX: 0000000000000000\n RDX: 0000000000000082 RSI: 1ffff1003b660e61 RDI: ffffed003b660e95\n RBP: ffff8801db307570 R08: 1ffff1003b660e23 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff85bd4020\n R13: ffffffff84754ed2 R14: 0000000000000014 R15: ffff8801c4e26540\n FS:  0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000463610 CR3: 00000001c6698000 CR4: 00000000001406e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n  <IRQ>\n  skb_over_panic net/core/skbuff.c:109 [inline]\n  skb_put+0x181/0x1c0 net/core/skbuff.c:1694\n  add_grhead.isra.24+0x42/0x3b0 net/ipv6/mcast.c:1695\n  add_grec+0xa55/0x1060 net/ipv6/mcast.c:1817\n  mld_send_cr net/ipv6/mcast.c:1903 [inline]\n  mld_ifc_timer_expire+0x4d2/0x770 net/ipv6/mcast.c:2448\n  call_timer_fn+0x23b/0x840 kernel/time/timer.c:1320\n  expire_timers kernel/time/timer.c:1357 [inline]\n  __run_timers+0x7e1/0xb60 kernel/time/timer.c:1660\n  run_timer_softirq+0x4c/0xb0 kernel/time/timer.c:1686\n  __do_softirq+0x29d/0xbb2 kernel/softirq.c:285\n  invoke_softirq kernel/softirq.c:365 [inline]\n  irq_exit+0x1d3/0x210 kernel/softirq.c:405\n  exiting_irq arch/x86/include/asm/apic.h:540 [inline]\n  smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052\n  apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:920\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nTested-by: Xin Long <lucien.xin@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/570f98fa08eb509e8fdfbe1fede367ea2e9e0aec"},{"sha":"4d704ed48fa20a91335e0e26f7471cb8bb09a643","author":{"name":"Kevin Cernekee","email":"3105dbb3dd63fbb4f6371cfb04adc6726f76c56b@chromium.org"},"message":"net: igmp: Use correct source address on IGMPv3 reports\n\n\n[ Upstream commit a46182b00290839fa3fa159d54fd3237bd8669f0 ]\n\nClosing a multicast socket after the final IPv4 address is deleted\nfrom an interface can generate a membership report that uses the\nsource IP from a different interface.  The following test script, run\nfrom an isolated netns, reproduces the issue:\n\n    #!/bin/bash\n\n    ip link add dummy0 type dummy\n    ip link add dummy1 type dummy\n    ip link set dummy0 up\n    ip link set dummy1 up\n    ip addr add 10.1.1.1/24 dev dummy0\n    ip addr add 192.168.99.99/24 dev dummy1\n\n    tcpdump -U -i dummy0 &\n    socat EXEC:\"sleep 2\" \\\n        UDP4-DATAGRAM:239.101.1.68:8889,ip-add-membership=239.0.1.68:10.1.1.1 &\n\n    sleep 1\n    ip addr del 10.1.1.1/24 dev dummy0\n    sleep 5\n    kill %tcpdump\n\nRFC 3376 specifies that the report must be sent with a valid IP source\naddress from the destination subnet, or from address 0.0.0.0.  Add an\nextra check to make sure this is the case.\n\nSigned-off-by: Kevin Cernekee <cernekee@chromium.org>\nReviewed-by: Andrew Lunn <andrew@lunn.ch>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Huawei-Dev/android_kernel_huawei_bach/commits/4d704ed48fa20a91335e0e26f7471cb8bb09a643"}]}
{"actor":{"display_login":"Huawei-Dev"}}