{"push_id":3119176681,"size":61,"distinct_size":61,"ref":"refs/heads/lineage-16.0-4.9","head":"a32de00e16e4cfecb817f89fe16a059312919ba9","before":"ce736d99dfea70ae3dadbd5bed431b0fdc4e8020","commits":[{"sha":"d29b73e6f4419c45709078090c4bfe401a9b7753","author":{"name":"Todd Kjos","email":"8be399b0cc2f31b2ed16702a88343f61fd6797ee@android.com"},"message":"UPSTREAM: binder: fix race that allows malicious free of live buffer\n\ncommit 7bada55ab50697861eee6bb7d60b41e68a961a9c upstream\n\nMalicious code can attempt to free buffers using the BC_FREE_BUFFER\nioctl to binder. There are protections against a user freeing a buffer\nwhile in use by the kernel, however there was a window where\nBC_FREE_BUFFER could be used to free a recently allocated buffer that\nwas not completely initialized. This resulted in a use-after-free\ndetected by KASAN with a malicious test program.\n\nThis window is closed by setting the buffer's allow_user_free attribute\nto 0 when the buffer is allocated or when the user has previously freed\nit instead of waiting for the caller to set it. The problem was that\nwhen the struct buffer was recycled, allow_user_free was stale and set\nto 1 allowing a free to go through.\n\nBug: 116855682\nChange-Id: I0b38089f6fdb1adbf7e1102747e4119c9a05b191\nSigned-off-by: Todd Kjos <tkjos@google.com>\nAcked-by: Arve Hjønnevåg <arve@android.com>\nCc: stable <stable@vger.kernel.org> # 4.14\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/d29b73e6f4419c45709078090c4bfe401a9b7753"},{"sha":"b48c29b1ddffa7f743a9da9404553deaf5882e14","author":{"name":"Hugh Dickins","email":"d3abdf3e2800e6cb849f11b81e6eb50b34d96431@google.com"},"message":"mm/huge_memory: rename freeze_page() to unmap_page()\n\ncommit 906f9cdfc2a0800f13683f9e4ebdfd08c12ee81b upstream.\n\nThe term \"freeze\" is used in several ways in the kernel, and in mm it\nhas the particular meaning of forcing page refcount temporarily to 0.\nfreeze_page() is just too confusing a name for a function that unmaps a\npage: rename it unmap_page(), and rename unfreeze_page() remap_page().\n\nWent to change the mention of freeze_page() added later in mm/rmap.c,\nbut found it to be incorrect: ordinary page reclaim reaches there too;\nbut the substance of the comment still seems correct, so edit it down.\n\nLink: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261514080.2275@eggly.anvils\nFixes: e9b61f19858a5 (\"thp: reintroduce split_huge_page()\")\nSigned-off-by: Hugh Dickins <hughd@google.com>\nAcked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>\nCc: Jerome Glisse <jglisse@redhat.com>\nCc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>\nCc: Matthew Wilcox <willy@infradead.org>\nCc: <stable@vger.kernel.org>\t[4.8+]\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/b48c29b1ddffa7f743a9da9404553deaf5882e14"},{"sha":"fb732e62bf37d34160ff69d46e2ab89e2e98a70a","author":{"name":"Konstantin Khlebnikov","email":"3b96b99f19643d33e1bfa1caa535c041c3608549@yandex-team.ru"},"message":"mm/huge_memory.c: reorder operations in __split_huge_page_tail()\n\ncommit 605ca5ede7643a01f4c4a15913f9714ac297f8a6 upstream.\n\nTHP split makes non-atomic change of tail page flags.  This is almost ok\nbecause tail pages are locked and isolated but this breaks recent\nchanges in page locking: non-atomic operation could clear bit\nPG_waiters.\n\nAs a result concurrent sequence get_page_unless_zero() -> lock_page()\nmight block forever.  Especially if this page was truncated later.\n\nFix is trivial: clone flags before unfreezing page reference counter.\n\nThis race exists since commit 62906027091f (\"mm: add PageWaiters\nindicating tasks are waiting for a page bit\") while unsave unfreeze\nitself was added in commit 8df651c7059e (\"thp: cleanup\nsplit_huge_page()\").\n\nclear_compound_head() also must be called before unfreezing page\nreference because after successful get_page_unless_zero() might follow\nput_page() which needs correct compound_head().\n\nAnd replace page_ref_inc()/page_ref_add() with page_ref_unfreeze() which\nis made especially for that and has semantic of smp_store_release().\n\nLink: http://lkml.kernel.org/r/151844393341.210639.13162088407980624477.stgit@buzz\nSigned-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>\nAcked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>\nCc: Michal Hocko <mhocko@suse.com>\nCc: Nicholas Piggin <npiggin@gmail.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/fb732e62bf37d34160ff69d46e2ab89e2e98a70a"},{"sha":"ffdad597ccfc6ccb8b6f1b6c2c77c3e79e90fb36","author":{"name":"Hugh Dickins","email":"d3abdf3e2800e6cb849f11b81e6eb50b34d96431@google.com"},"message":"mm/huge_memory: splitting set mapping+index before unfreeze\n\ncommit 173d9d9fd3ddae84c110fea8aedf1f26af6be9ec upstream.\n\nHuge tmpfs stress testing has occasionally hit shmem_undo_range()'s\nVM_BUG_ON_PAGE(page_to_pgoff(page) != index, page).\n\nMove the setting of mapping and index up before the page_ref_unfreeze()\nin __split_huge_page_tail() to fix this: so that a page cache lookup\ncannot get a reference while the tail's mapping and index are unstable.\n\nIn fact, might as well move them up before the smp_wmb(): I don't see an\nactual need for that, but if I'm missing something, this way round is\nsafer than the other, and no less efficient.\n\nYou might argue that VM_BUG_ON_PAGE(page_to_pgoff(page) != index, page) is\nmisplaced, and should be left until after the trylock_page(); but left as\nis has not crashed since, and gives more stringent assurance.\n\nLink: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261516380.2275@eggly.anvils\nFixes: e9b61f19858a5 (\"thp: reintroduce split_huge_page()\")\nRequires: 605ca5ede764 (\"mm/huge_memory.c: reorder operations in __split_huge_page_tail()\")\nSigned-off-by: Hugh Dickins <hughd@google.com>\nAcked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>\nCc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>\nCc: Jerome Glisse <jglisse@redhat.com>\nCc: Matthew Wilcox <willy@infradead.org>\nCc: <stable@vger.kernel.org>\t[4.8+]\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/ffdad597ccfc6ccb8b6f1b6c2c77c3e79e90fb36"},{"sha":"b59b24fed59d322718a3f0fcaacf492335e9c9ca","author":{"name":"Hugh Dickins","email":"d3abdf3e2800e6cb849f11b81e6eb50b34d96431@google.com"},"message":"mm/huge_memory: fix lockdep complaint on 32-bit i_size_read()\n\ncommit 006d3ff27e884f80bd7d306b041afc415f63598f upstream.\n\nHuge tmpfs testing, on 32-bit kernel with lockdep enabled, showed that\n__split_huge_page() was using i_size_read() while holding the irq-safe\nlru_lock and page tree lock, but the 32-bit i_size_read() uses an\nirq-unsafe seqlock which should not be nested inside them.\n\nInstead, read the i_size earlier in split_huge_page_to_list(), and pass\nthe end offset down to __split_huge_page(): all while holding head page\nlock, which is enough to prevent truncation of that extent before the\npage tree lock has been taken.\n\nLink: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261520070.2275@eggly.anvils\nFixes: baa355fd33142 (\"thp: file pages support for split_huge_page()\")\nSigned-off-by: Hugh Dickins <hughd@google.com>\nAcked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>\nCc: Jerome Glisse <jglisse@redhat.com>\nCc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>\nCc: Matthew Wilcox <willy@infradead.org>\nCc: <stable@vger.kernel.org>\t[4.8+]\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/b59b24fed59d322718a3f0fcaacf492335e9c9ca"},{"sha":"10e458e6eb59e533e499269258b6069392bec627","author":{"name":"Hugh Dickins","email":"d3abdf3e2800e6cb849f11b81e6eb50b34d96431@google.com"},"message":"mm/khugepaged: collapse_shmem() stop if punched or truncated\n\ncommit 701270fa193aadf00bdcf607738f64997275d4c7 upstream.\n\nHuge tmpfs testing showed that although collapse_shmem() recognizes a\nconcurrently truncated or hole-punched page correctly, its handling of\nholes was liable to refill an emptied extent.  Add check to stop that.\n\nLink: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261522040.2275@eggly.anvils\nFixes: f3f0e1d2150b2 (\"khugepaged: add support of collapse for tmpfs/shmem pages\")\nSigned-off-by: Hugh Dickins <hughd@google.com>\nReviewed-by: Matthew Wilcox <willy@infradead.org>\nCc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>\nCc: Jerome Glisse <jglisse@redhat.com>\nCc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>\nCc: <stable@vger.kernel.org>\t[4.8+]\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/10e458e6eb59e533e499269258b6069392bec627"},{"sha":"cae7ed256d772766dd2fe3ad9a08ec77f24b9503","author":{"name":"Mike Rapoport","email":"6432ce95675be77d61ce23efe20f472ee21e9f31@linux.vnet.ibm.com"},"message":"shmem: shmem_charge: verify max_block is not exceeded before inode update\n\ncommit b1cc94ab2f2ba31fcb2c59df0b9cf03f6d720553 upstream.\n\nPatch series \"userfaultfd: enable zeropage support for shmem\".\n\nThese patches enable support for UFFDIO_ZEROPAGE for shared memory.\n\nThe first two patches are not strictly related to userfaultfd, they are\njust minor refactoring to reduce amount of code duplication.\n\nThis patch (of 7):\n\nCurrently we update inode and shmem_inode_info before verifying that\nused_blocks will not exceed max_blocks.  In case it will, we undo the\nupdate.  Let's switch the order and move the verification of the blocks\ncount before the inode and shmem_inode_info update.\n\nLink: http://lkml.kernel.org/r/1497939652-16528-2-git-send-email-rppt@linux.vnet.ibm.com\nSigned-off-by: Mike Rapoport <rppt@linux.vnet.ibm.com>\nCc: Andrea Arcangeli <aarcange@redhat.com>\nCc: Hugh Dickins <hughd@google.com>\nCc: \"Kirill A. Shutemov\" <kirill.shutemov@linux.intel.com>\nCc: Hillf Danton <hillf.zj@alibaba-inc.com>\nCc: Pavel Emelyanov <xemul@virtuozzo.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/cae7ed256d772766dd2fe3ad9a08ec77f24b9503"},{"sha":"9815b0fcec677a484514b28124d31df64c71a901","author":{"name":"Mike Rapoport","email":"6432ce95675be77d61ce23efe20f472ee21e9f31@linux.vnet.ibm.com"},"message":"shmem: introduce shmem_inode_acct_block\n\ncommit 0f0796945614b7523987f7eea32407421af4b1ee upstream.\n\nThe shmem_acct_block and the update of used_blocks are following one\nanother in all the places they are used.  Combine these two into a\nhelper function.\n\nLink: http://lkml.kernel.org/r/1497939652-16528-3-git-send-email-rppt@linux.vnet.ibm.com\nSigned-off-by: Mike Rapoport <rppt@linux.vnet.ibm.com>\nCc: \"Kirill A. Shutemov\" <kirill.shutemov@linux.intel.com>\nCc: Andrea Arcangeli <aarcange@redhat.com>\nCc: Hillf Danton <hillf.zj@alibaba-inc.com>\nCc: Hugh Dickins <hughd@google.com>\nCc: Pavel Emelyanov <xemul@virtuozzo.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/9815b0fcec677a484514b28124d31df64c71a901"},{"sha":"0dba3e54920bc876aaf88060358d96093b5e7c83","author":{"name":"Hugh Dickins","email":"d3abdf3e2800e6cb849f11b81e6eb50b34d96431@google.com"},"message":"mm/khugepaged: fix crashes due to misaccounted holes\n\ncommit aaa52e340073b7f4593b3c4ddafcafa70cf838b5 upstream.\n\nHuge tmpfs testing on a shortish file mapped into a pmd-rounded extent\nhit shmem_evict_inode()'s WARN_ON(inode->i_blocks) followed by\nclear_inode()'s BUG_ON(inode->i_data.nrpages) when the file was later\nclosed and unlinked.\n\nkhugepaged's collapse_shmem() was forgetting to update mapping->nrpages\non the rollback path, after it had added but then needs to undo some\nholes.\n\nThere is indeed an irritating asymmetry between shmem_charge(), whose\ncallers want it to increment nrpages after successfully accounting\nblocks, and shmem_uncharge(), when __delete_from_page_cache() already\ndecremented nrpages itself: oh well, just add a comment on that to them\nboth.\n\nAnd shmem_recalc_inode() is supposed to be called when the accounting is\nexpected to be in balance (so it can deduce from imbalance that reclaim\ndiscarded some pages): so change shmem_charge() to update nrpages\nearlier (though it's rare for the difference to matter at all).\n\nLink: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261523450.2275@eggly.anvils\nFixes: 800d8c63b2e98 (\"shmem: add huge pages support\")\nFixes: f3f0e1d2150b2 (\"khugepaged: add support of collapse for tmpfs/shmem pages\")\nSigned-off-by: Hugh Dickins <hughd@google.com>\nAcked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>\nCc: Jerome Glisse <jglisse@redhat.com>\nCc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>\nCc: Matthew Wilcox <willy@infradead.org>\nCc: <stable@vger.kernel.org>\t[4.8+]\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/0dba3e54920bc876aaf88060358d96093b5e7c83"},{"sha":"5c0ecc2ba54201881c54a51ead083bba85176a76","author":{"name":"Hugh Dickins","email":"d3abdf3e2800e6cb849f11b81e6eb50b34d96431@google.com"},"message":"mm/khugepaged: collapse_shmem() remember to clear holes\n\ncommit 2af8ff291848cc4b1cce24b6c943394eb2c761e8 upstream.\n\nHuge tmpfs testing reminds us that there is no __GFP_ZERO in the gfp\nflags khugepaged uses to allocate a huge page - in all common cases it\nwould just be a waste of effort - so collapse_shmem() must remember to\nclear out any holes that it instantiates.\n\nThe obvious place to do so, where they are put into the page cache tree,\nis not a good choice: because interrupts are disabled there.  Leave it\nuntil further down, once success is assured, where the other pages are\ncopied (before setting PageUptodate).\n\nLink: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261525080.2275@eggly.anvils\nFixes: f3f0e1d2150b2 (\"khugepaged: add support of collapse for tmpfs/shmem pages\")\nSigned-off-by: Hugh Dickins <hughd@google.com>\nAcked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>\nCc: Jerome Glisse <jglisse@redhat.com>\nCc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>\nCc: Matthew Wilcox <willy@infradead.org>\nCc: <stable@vger.kernel.org>\t[4.8+]\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/5c0ecc2ba54201881c54a51ead083bba85176a76"},{"sha":"c2ca73b7ab3d5e0edc69e9a0a9e464407cabaec1","author":{"name":"Hugh Dickins","email":"d3abdf3e2800e6cb849f11b81e6eb50b34d96431@google.com"},"message":"mm/khugepaged: minor reorderings in collapse_shmem()\n\ncommit 042a30824871fa3149b0127009074b75cc25863c upstream.\n\nSeveral cleanups in collapse_shmem(): most of which probably do not\nreally matter, beyond doing things in a more familiar and reassuring\norder.  Simplify the failure gotos in the main loop, and on success\nupdate stats while interrupts still disabled from the last iteration.\n\nLink: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261526400.2275@eggly.anvils\nFixes: f3f0e1d2150b2 (\"khugepaged: add support of collapse for tmpfs/shmem pages\")\nSigned-off-by: Hugh Dickins <hughd@google.com>\nAcked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>\nCc: Jerome Glisse <jglisse@redhat.com>\nCc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>\nCc: Matthew Wilcox <willy@infradead.org>\nCc: <stable@vger.kernel.org>\t[4.8+]\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/c2ca73b7ab3d5e0edc69e9a0a9e464407cabaec1"},{"sha":"8dcbb5f21567c3a85a7e4ec781d0e49ea174397d","author":{"name":"Hugh Dickins","email":"d3abdf3e2800e6cb849f11b81e6eb50b34d96431@google.com"},"message":"mm/khugepaged: collapse_shmem() without freezing new_page\n\ncommit 87c460a0bded56195b5eb497d44709777ef7b415 upstream.\n\nkhugepaged's collapse_shmem() does almost all of its work, to assemble\nthe huge new_page from 512 scattered old pages, with the new_page's\nrefcount frozen to 0 (and refcounts of all old pages so far also frozen\nto 0).  Including shmem_getpage() to read in any which were out on swap,\nmemory reclaim if necessary to allocate their intermediate pages, and\ncopying over all the data from old to new.\n\nImagine the frozen refcount as a spinlock held, but without any lock\ndebugging to highlight the abuse: it's not good, and under serious load\nheads into lockups - speculative getters of the page are not expecting\nto spin while khugepaged is rescheduled.\n\nOne can get a little further under load by hacking around elsewhere; but\nfortunately, freezing the new_page turns out to have been entirely\nunnecessary, with no hacks needed elsewhere.\n\nThe huge new_page lock is already held throughout, and guards all its\nsubpages as they are brought one by one into the page cache tree; and\nanything reading the data in that page, without the lock, before it has\nbeen marked PageUptodate, would already be in the wrong.  So simply\neliminate the freezing of the new_page.\n\nEach of the old pages remains frozen with refcount 0 after it has been\nreplaced by a new_page subpage in the page cache tree, until they are\nall unfrozen on success or failure: just as before.  They could be\nunfrozen sooner, but cause no problem once no longer visible to\nfind_get_entry(), filemap_map_pages() and other speculative lookups.\n\nLink: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261527570.2275@eggly.anvils\nFixes: f3f0e1d2150b2 (\"khugepaged: add support of collapse for tmpfs/shmem pages\")\nSigned-off-by: Hugh Dickins <hughd@google.com>\nAcked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>\nCc: Jerome Glisse <jglisse@redhat.com>\nCc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>\nCc: Matthew Wilcox <willy@infradead.org>\nCc: <stable@vger.kernel.org>\t[4.8+]\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/8dcbb5f21567c3a85a7e4ec781d0e49ea174397d"},{"sha":"dc62803e271decb287929d44789fe9170eec5ba7","author":{"name":"Hugh Dickins","email":"d3abdf3e2800e6cb849f11b81e6eb50b34d96431@google.com"},"message":"mm/khugepaged: collapse_shmem() do not crash on Compound\n\ncommit 06a5e1268a5fb9c2b346a3da6b97e85f2eba0f07 upstream.\n\ncollapse_shmem()'s VM_BUG_ON_PAGE(PageTransCompound) was unsafe: before\nit holds page lock of the first page, racing truncation then extension\nmight conceivably have inserted a hugepage there already.  Fail with the\nSCAN_PAGE_COMPOUND result, instead of crashing (CONFIG_DEBUG_VM=y) or\notherwise mishandling the unexpected hugepage - though later we might\ncode up a more constructive way of handling it, with SCAN_SUCCESS.\n\nLink: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261529310.2275@eggly.anvils\nFixes: f3f0e1d2150b2 (\"khugepaged: add support of collapse for tmpfs/shmem pages\")\nSigned-off-by: Hugh Dickins <hughd@google.com>\nCc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>\nCc: Jerome Glisse <jglisse@redhat.com>\nCc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>\nCc: Matthew Wilcox <willy@infradead.org>\nCc: <stable@vger.kernel.org>\t[4.8+]\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/dc62803e271decb287929d44789fe9170eec5ba7"},{"sha":"6fc74d9f9b412b295f9ad01af7a7e62a662aa5bd","author":{"name":"Matthias Schwarzott","email":"0a9348b32be3e40b872e5f0ce1a66182f8efca86@gentoo.org"},"message":"media: em28xx: Fix use-after-free when disconnecting\n\n[ Upstream commit 910b0797fa9e8af09c44a3fa36cb310ba7a7218d ]\n\nFix bug by moving the i2c_unregister_device calls after deregistration\nof dvb frontend.\n\nThe new style i2c drivers already destroys the frontend object at\ni2c_unregister_device time.\nWhen the dvb frontend is unregistered afterwards it leads to this oops:\n\n  [ 6058.866459] BUG: unable to handle kernel NULL pointer dereference at 00000000000001f8\n  [ 6058.866578] IP: dvb_frontend_stop+0x30/0xd0 [dvb_core]\n  [ 6058.866644] PGD 0\n  [ 6058.866646] P4D 0\n\n  [ 6058.866726] Oops: 0000 [#1] SMP\n  [ 6058.866768] Modules linked in: rc_pinnacle_pctv_hd(O) em28xx_rc(O) si2157(O) si2168(O) em28xx_dvb(O) em28xx(O) si2165(O) a8293(O) tda10071(O) tea5767(O) tuner(O) cx23885(O) tda18271(O) videobuf2_dvb(O) videobuf2_dma_sg(O) m88ds3103(O) tveeprom(O) cx2341x(O) v4l2_common(O) dvb_core(O) rc_core(O) videobuf2_memops(O) videobuf2_v4l2(O) videobuf2_core(O) videodev(O) media(O) bluetooth ecdh_generic ums_realtek uas rtl8192cu rtl_usb rtl8192c_common rtlwifi usb_storage snd_hda_codec_realtek snd_hda_codec_hdmi snd_hda_codec_generic i2c_mux snd_hda_intel snd_hda_codec snd_hwdep x86_pkg_temp_thermal snd_hda_core kvm_intel kvm irqbypass [last unloaded: videobuf2_memops]\n  [ 6058.867497] CPU: 2 PID: 7349 Comm: kworker/2:0 Tainted: G        W  O    4.13.9-gentoo #1\n  [ 6058.867595] Hardware name: MEDION E2050 2391/H81H3-EM2, BIOS H81EM2W08.308 08/25/2014\n  [ 6058.867692] Workqueue: usb_hub_wq hub_event\n  [ 6058.867746] task: ffff88011a15e040 task.stack: ffffc90003074000\n  [ 6058.867825] RIP: 0010:dvb_frontend_stop+0x30/0xd0 [dvb_core]\n  [ 6058.867896] RSP: 0018:ffffc90003077b58 EFLAGS: 00010293\n  [ 6058.867964] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000010040001f\n  [ 6058.868056] RDX: ffff88011a15e040 RSI: ffffea000464e400 RDI: ffff88001cbe3028\n  [ 6058.868150] RBP: ffffc90003077b68 R08: ffff880119390380 R09: 000000010040001f\n  [ 6058.868241] R10: ffffc90003077b18 R11: 000000000001e200 R12: ffff88001cbe3028\n  [ 6058.868330] R13: ffff88001cbe68d0 R14: ffff8800cf734000 R15: ffff8800cf734098\n  [ 6058.868419] FS:  0000000000000000(0000) GS:ffff88011fb00000(0000) knlGS:0000000000000000\n  [ 6058.868511] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [ 6058.868578] CR2: 00000000000001f8 CR3: 00000001113c5000 CR4: 00000000001406e0\n  [ 6058.868662] Call Trace:\n  [ 6058.868705]  dvb_unregister_frontend+0x2a/0x80 [dvb_core]\n  [ 6058.868774]  em28xx_dvb_fini+0x132/0x220 [em28xx_dvb]\n  [ 6058.868840]  em28xx_close_extension+0x34/0x90 [em28xx]\n  [ 6058.868902]  em28xx_usb_disconnect+0x4e/0x70 [em28xx]\n  [ 6058.868968]  usb_unbind_interface+0x6d/0x260\n  [ 6058.869025]  device_release_driver_internal+0x150/0x210\n  [ 6058.869094]  device_release_driver+0xd/0x10\n  [ 6058.869150]  bus_remove_device+0xe4/0x160\n  [ 6058.869204]  device_del+0x1ce/0x2f0\n  [ 6058.869253]  usb_disable_device+0x99/0x270\n  [ 6058.869306]  usb_disconnect+0x8d/0x260\n  [ 6058.869359]  hub_event+0x93d/0x1520\n  [ 6058.869408]  ? dequeue_task_fair+0xae5/0xd20\n  [ 6058.869467]  process_one_work+0x1d9/0x3e0\n  [ 6058.869522]  worker_thread+0x43/0x3e0\n  [ 6058.869576]  kthread+0x104/0x140\n  [ 6058.869602]  ? trace_event_raw_event_workqueue_work+0x80/0x80\n  [ 6058.869640]  ? kthread_create_on_node+0x40/0x40\n  [ 6058.869673]  ret_from_fork+0x22/0x30\n  [ 6058.869698] Code: 54 49 89 fc 53 48 8b 9f 18 03 00 00 0f 1f 44 00 00 41 83 bc 24 04 05 00 00 02 74 0c 41 c7 84 24 04 05 00 00 01 00 00 00 0f ae f0 <48> 8b bb f8 01 00 00 48 85 ff 74 5c e8 df 40 f0 e0 48 8b 93 f8\n  [ 6058.869850] RIP: dvb_frontend_stop+0x30/0xd0 [dvb_core] RSP: ffffc90003077b58\n  [ 6058.869894] CR2: 00000000000001f8\n  [ 6058.875880] ---[ end trace 717eecf7193b3fc6 ]---\n\nSigned-off-by: Matthias Schwarzott <zzam@gentoo.org>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/6fc74d9f9b412b295f9ad01af7a7e62a662aa5bd"},{"sha":"ad0ee4f58533dec7c49269864055f30d4dd2bdd7","author":{"name":"Sasha Levin","email":"ea64c107742a9398dbac3034fbc8d4b5fefb6d69@kernel.org"},"message":"Revert \"wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout()\"\n\nThis reverts commit afeeecc764436f31d4447575bb9007732333818c which was\nupstream commit 4ec7cece87b3ed21ffcd407c62fb2f151a366bc1.\n\nFrom Dietmar May's report on the stable mailing list\n(https://www.spinics.net/lists/stable/msg272201.html):\n\n> I've run into some problems which appear due to (a) recent patch(es) on\n> the wlcore wifi driver.\n>\n> 4.4.160 - commit 3fdd34643ffc378b5924941fad40352c04610294\n> 4.9.131 - commit afeeecc764436f31d4447575bb9007732333818c\n>\n> Earlier versions (4.9.130 and 4.4.159 - tested back to 4.4.49) do not\n> exhibit this problem. It is still present in 4.9.141.\n>\n> master as of 4.20.0-rc4 does not exhibit this problem.\n>\n> Basically, during client association when in AP mode (running hostapd),\n> handshake may or may not complete following a noticeable delay. If\n> successful, then the driver fails consistently in warn_slowpath_null\n> during disassociation. If unsuccessful, the wifi client attempts multiple\n> times, sometimes failing repeatedly. I've had clients unable to connect\n> for 3-5 minutes during testing, with the syslog filled with dozens of\n> backtraces. syslog details are below.\n>\n> I'm working on an embedded device with a TI 3352 ARM processor and a\n> murata wl1271 module in sdio mode. We're running a fully patched ubuntu\n> 18.04 ARM build, with a kernel built from kernel.org's stable/linux repo <https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.9.y&id=afeeecc764436f31d4447575bb9007732333818c>.\n> Relevant parts of the kernel config are included below.\n>\n> The commit message states:\n>\n> > /I've only seen this few times with the runtime PM patches enabled so\n> > this one is probably not needed before that. This seems to work\n> > currently based on the current PM implementation timer. Let's apply\n> > this separately though in case others are hitting this issue./\n> We're not doing anything explicit with power management. The device is an\n> IoT edge gateway with battery backup, normally running on wall power. The\n> battery is currently used solely to shut down the system cleanly to avoid\n> filesystem corruption.\n>\n> The device tree is configured to keep power in suspend; but the device\n> should never suspend, so in our case, there is no need to call\n> wl1271_ps_elp_wakeup() or wl1271_ps_elp_sleep(), as occurs in the patch.\n\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/ad0ee4f58533dec7c49269864055f30d4dd2bdd7"},{"sha":"d39ebd199a639df704f50db315e93aa45d9ca33c","author":{"name":"Petr Machata","email":"ceaa1af87bc9dd6639db1af18771f7956cf74a5c@mellanox.com"},"message":"net: skb_scrub_packet(): Scrub offload_fwd_mark\n\n[ Upstream commit b5dd186d10ba59e6b5ba60e42b3b083df56df6f3 ]\n\nWhen a packet is trapped and the corresponding SKB marked as\nalready-forwarded, it retains this marking even after it is forwarded\nacross veth links into another bridge. There, since it ingresses the\nbridge over veth, which doesn't have offload_fwd_mark, it triggers a\nwarning in nbp_switchdev_frame_mark().\n\nThen nbp_switchdev_allowed_egress() decides not to allow egress from\nthis bridge through another veth, because the SKB is already marked, and\nthe mark (of 0) of course matches. Thus the packet is incorrectly\nblocked.\n\nSolve by resetting offload_fwd_mark() in skb_scrub_packet(). That\nfunction is called from tunnels and also from veth, and thus catches the\ncases where traffic is forwarded between bridges and transformed in a\nway that invalidates the marking.\n\nFixes: 6bc506b4fb06 (\"bridge: switchdev: Add forward mark support for stacked devices\")\nFixes: abf4bb6b63d0 (\"skbuff: Add the offload_mr_fwd_mark field\")\nSigned-off-by: Petr Machata <petrm@mellanox.com>\nSuggested-by: Ido Schimmel <idosch@mellanox.com>\nAcked-by: Jiri Pirko <jiri@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/d39ebd199a639df704f50db315e93aa45d9ca33c"},{"sha":"13a3d8908e54f99a98af3c41f733aab9e93a0c56","author":{"name":"Pan Bian","email":"10d7ad8858c5990f87a888a439b19a315f02cd42@163.com"},"message":"rapidio/rionet: do not free skb before reading its length\n\n[ Upstream commit cfc435198f53a6fa1f656d98466b24967ff457d0 ]\n\nskb is freed via dev_kfree_skb_any, however, skb->len is read then. This\nmay result in a use-after-free bug.\n\nFixes: e6161d64263 (\"rapidio/rionet: rework driver initialization and removal\")\nSigned-off-by: Pan Bian <bianpan2016@163.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/13a3d8908e54f99a98af3c41f733aab9e93a0c56"},{"sha":"1d3891c724da45955fddc99652387a35926bb5fb","author":{"name":"Julian Wiedmann","email":"a70165cc435925071a1d5d2715fcc7eb04666fa4@linux.ibm.com"},"message":"s390/qeth: fix length check in SNMP processing\n\n[ Upstream commit 9a764c1e59684c0358e16ccaafd870629f2cfe67 ]\n\nThe response for a SNMP request can consist of multiple parts, which\nthe cmd callback stages into a kernel buffer until all parts have been\nreceived. If the callback detects that the staging buffer provides\ninsufficient space, it bails out with error.\nThis processing is buggy for the first part of the response - while it\ninitially checks for a length of 'data_len', it later copies an\nadditional amount of 'offsetof(struct qeth_snmp_cmd, data)' bytes.\n\nFix the calculation of 'data_len' for the first part of the response.\nThis also nicely cleans up the memcpy code.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Julian Wiedmann <jwi@linux.ibm.com>\nReviewed-by: Ursula Braun <ubraun@linux.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/1d3891c724da45955fddc99652387a35926bb5fb"},{"sha":"ff67a7d34bc5015b50856ae458d3e7c89d2acda0","author":{"name":"Bernd Eckstein","email":"1539af50aaa48977031b909c40b884a721e0ec38@gmail.com"},"message":"usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2\n\n[ Upstream commit 45611c61dd503454b2edae00aabe1e429ec49ebe ]\n\nThe bug is not easily reproducable, as it may occur very infrequently\n(we had machines with 20minutes heavy downloading before it occurred)\nHowever, on a virual machine (VMWare on Windows 10 host) it occurred\npretty frequently (1-2 seconds after a speedtest was started)\n\ndev->tx_skb mab be freed via dev_kfree_skb_irq on a callback\nbefore it is set.\n\nThis causes the following problems:\n- double free of the skb or potential memory leak\n- in dmesg: 'recvmsg bug' and 'recvmsg bug 2' and eventually\n  general protection fault\n\nExample dmesg output:\n[  134.841986] ------------[ cut here ]------------\n[  134.841987] recvmsg bug: copied 9C24A555 seq 9C24B557 rcvnxt 9C25A6B3 fl 0\n[  134.841993] WARNING: CPU: 7 PID: 2629 at /build/linux-hwe-On9fm7/linux-hwe-4.15.0/net/ipv4/tcp.c:1865 tcp_recvmsg+0x44d/0xab0\n[  134.841994] Modules linked in: ipheth(OE) kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd glue_helper cryptd vmw_balloon intel_rapl_perf joydev input_leds serio_raw vmw_vsock_vmci_transport vsock shpchp i2c_piix4 mac_hid binfmt_misc vmw_vmci parport_pc ppdev lp parport autofs4 vmw_pvscsi vmxnet3 hid_generic usbhid hid vmwgfx ttm drm_kms_helper syscopyarea sysfillrect mptspi mptscsih sysimgblt ahci psmouse fb_sys_fops pata_acpi mptbase libahci e1000 drm scsi_transport_spi\n[  134.842046] CPU: 7 PID: 2629 Comm: python Tainted: G        W  OE    4.15.0-34-generic #37~16.04.1-Ubuntu\n[  134.842046] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/19/2017\n[  134.842048] RIP: 0010:tcp_recvmsg+0x44d/0xab0\n[  134.842048] RSP: 0018:ffffa6630422bcc8 EFLAGS: 00010286\n[  134.842049] RAX: 0000000000000000 RBX: ffff997616f4f200 RCX: 0000000000000006\n[  134.842049] RDX: 0000000000000007 RSI: 0000000000000082 RDI: ffff9976257d6490\n[  134.842050] RBP: ffffa6630422bd98 R08: 0000000000000001 R09: 000000000004bba4\n[  134.842050] R10: 0000000001e00c6f R11: 000000000004bba4 R12: ffff99760dee3000\n[  134.842051] R13: 0000000000000000 R14: ffff99760dee3514 R15: 0000000000000000\n[  134.842051] FS:  00007fe332347700(0000) GS:ffff9976257c0000(0000) knlGS:0000000000000000\n[  134.842052] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  134.842053] CR2: 0000000001e41000 CR3: 000000020e9b4006 CR4: 00000000003606e0\n[  134.842055] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  134.842055] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  134.842057] Call Trace:\n[  134.842060]  ? aa_sk_perm+0x53/0x1a0\n[  134.842064]  inet_recvmsg+0x51/0xc0\n[  134.842066]  sock_recvmsg+0x43/0x50\n[  134.842070]  SYSC_recvfrom+0xe4/0x160\n[  134.842072]  ? __schedule+0x3de/0x8b0\n[  134.842075]  ? ktime_get_ts64+0x4c/0xf0\n[  134.842079]  SyS_recvfrom+0xe/0x10\n[  134.842082]  do_syscall_64+0x73/0x130\n[  134.842086]  entry_SYSCALL_64_after_hwframe+0x3d/0xa2\n[  134.842086] RIP: 0033:0x7fe331f5a81d\n[  134.842088] RSP: 002b:00007ffe8da98398 EFLAGS: 00000246 ORIG_RAX: 000000000000002d\n[  134.842090] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00007fe331f5a81d\n[  134.842094] RDX: 00000000000003fb RSI: 0000000001e00874 RDI: 0000000000000003\n[  134.842095] RBP: 00007fe32f642c70 R08: 0000000000000000 R09: 0000000000000000\n[  134.842097] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe332347698\n[  134.842099] R13: 0000000001b7e0a0 R14: 0000000001e00874 R15: 0000000000000000\n[  134.842103] Code: 24 fd ff ff e9 cc fe ff ff 48 89 d8 41 8b 8c 24 10 05 00 00 44 8b 45 80 48 c7 c7 08 bd 59 8b 48 89 85 68 ff ff ff e8 b3 c4 7d ff <0f> 0b 48 8b 85 68 ff ff ff e9 e9 fe ff ff 41 8b 8c 24 10 05 00\n[  134.842126] ---[ end trace b7138fc08c83147f ]---\n[  134.842144] general protection fault: 0000 [#1] SMP PTI\n[  134.842145] Modules linked in: ipheth(OE) kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd glue_helper cryptd vmw_balloon intel_rapl_perf joydev input_leds serio_raw vmw_vsock_vmci_transport vsock shpchp i2c_piix4 mac_hid binfmt_misc vmw_vmci parport_pc ppdev lp parport autofs4 vmw_pvscsi vmxnet3 hid_generic usbhid hid vmwgfx ttm drm_kms_helper syscopyarea sysfillrect mptspi mptscsih sysimgblt ahci psmouse fb_sys_fops pata_acpi mptbase libahci e1000 drm scsi_transport_spi\n[  134.842161] CPU: 7 PID: 2629 Comm: python Tainted: G        W  OE    4.15.0-34-generic #37~16.04.1-Ubuntu\n[  134.842162] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/19/2017\n[  134.842164] RIP: 0010:tcp_close+0x2c6/0x440\n[  134.842165] RSP: 0018:ffffa6630422bde8 EFLAGS: 00010202\n[  134.842167] RAX: 0000000000000000 RBX: ffff99760dee3000 RCX: 0000000180400034\n[  134.842168] RDX: 5c4afd407207a6c4 RSI: ffffe868495bd300 RDI: ffff997616f4f200\n[  134.842169] RBP: ffffa6630422be08 R08: 0000000016f4d401 R09: 0000000180400034\n[  134.842169] R10: ffffa6630422bd98 R11: 0000000000000000 R12: 000000000000600c\n[  134.842170] R13: 0000000000000000 R14: ffff99760dee30c8 R15: ffff9975bd44fe00\n[  134.842171] FS:  00007fe332347700(0000) GS:ffff9976257c0000(0000) knlGS:0000000000000000\n[  134.842173] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  134.842174] CR2: 0000000001e41000 CR3: 000000020e9b4006 CR4: 00000000003606e0\n[  134.842177] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  134.842178] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  134.842179] Call Trace:\n[  134.842181]  inet_release+0x42/0x70\n[  134.842183]  __sock_release+0x42/0xb0\n[  134.842184]  sock_close+0x15/0x20\n[  134.842187]  __fput+0xea/0x220\n[  134.842189]  ____fput+0xe/0x10\n[  134.842191]  task_work_run+0x8a/0xb0\n[  134.842193]  exit_to_usermode_loop+0xc4/0xd0\n[  134.842195]  do_syscall_64+0xf4/0x130\n[  134.842197]  entry_SYSCALL_64_after_hwframe+0x3d/0xa2\n[  134.842197] RIP: 0033:0x7fe331f5a560\n[  134.842198] RSP: 002b:00007ffe8da982e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003\n[  134.842200] RAX: 0000000000000000 RBX: 00007fe32f642c70 RCX: 00007fe331f5a560\n[  134.842201] RDX: 00000000008f5320 RSI: 0000000001cd4b50 RDI: 0000000000000003\n[  134.842202] RBP: 00007fe32f6500f8 R08: 000000000000003c R09: 00000000009343c0\n[  134.842203] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe32f6500d0\n[  134.842204] R13: 00000000008f5320 R14: 00000000008f5320 R15: 0000000001cd4770\n[  134.842205] Code: c8 00 00 00 45 31 e4 49 39 fe 75 4d eb 50 83 ab d8 00 00 00 01 48 8b 17 48 8b 47 08 48 c7 07 00 00 00 00 48 c7 47 08 00 00 00 00 <48> 89 42 08 48 89 10 0f b6 57 34 8b 47 2c 2b 47 28 83 e2 01 80\n[  134.842226] RIP: tcp_close+0x2c6/0x440 RSP: ffffa6630422bde8\n[  134.842227] ---[ end trace b7138fc08c831480 ]---\n\nThe proposed patch eliminates a potential racing condition.\nBefore, usb_submit_urb was called and _after_ that, the skb was attached\n(dev->tx_skb). So, on a callback it was possible, however unlikely that the\nskb was freed before it was set. That way (because dev->tx_skb was not set\nto NULL after it was freed), it could happen that a skb from a earlier\ntransmission was freed a second time (and the skb we should have freed did\nnot get freed at all)\n\nNow we free the skb directly in ipheth_tx(). It is not passed to the\ncallback anymore, eliminating the posibility of a double free of the same\nskb. Depending on the retval of usb_submit_urb() we use dev_kfree_skb_any()\nrespectively dev_consume_skb_any() to free the skb.\n\nSigned-off-by: Oliver Zweigle <Oliver.Zweigle@faro.com>\nSigned-off-by: Bernd Eckstein <3ernd.Eckstein@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/ff67a7d34bc5015b50856ae458d3e7c89d2acda0"},{"sha":"aa716434a05907a6302e008a24d8dcdd6e7d47bf","author":{"name":"Junaid Shahid","email":"aaf94ebe6313df785f223e22a08d9ac3811b753e@google.com"},"message":"kvm: mmu: Fix race in emulated page table writes\n\ncommit 0e0fee5c539b61fdd098332e0e2cc375d9073706 upstream.\n\nWhen a guest page table is updated via an emulated write,\nkvm_mmu_pte_write() is called to update the shadow PTE using the just\nwritten guest PTE value. But if two emulated guest PTE writes happened\nconcurrently, it is possible that the guest PTE and the shadow PTE end\nup being out of sync. Emulated writes do not mark the shadow page as\nunsync-ed, so this inconsistency will not be resolved even by a guest TLB\nflush (unless the page was marked as unsync-ed at some other point).\n\nThis is fixed by re-reading the current value of the guest PTE after the\nMMU lock has been acquired instead of just using the value that was\nwritten prior to calling kvm_mmu_pte_write().\n\nSigned-off-by: Junaid Shahid <junaids@google.com>\nReviewed-by: Wanpeng Li <wanpengli@tencent.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/joeyhuab/villain_kernel_xiaomi_msm8953/commits/aa716434a05907a6302e008a24d8dcdd6e7d47bf"}]}
{"actor":{"display_login":"joeyhuab"}}