{"push_id":2406756011,"size":140,"distinct_size":140,"ref":"refs/heads/caf/aosp-common/upstream-linux-4.14.y","head":"9b1fb9cc922dbf27959287ad75009bb388d115fe","before":"96427a5164f3eff6ee6eb924dbb53adb6eaa082d","commits":[{"sha":"31c4bc6e01e5219283c81fcfa61eb242d87965c7","author":{"name":"Masahiro Yamada","email":"642490827508ea1a46cbcea45eb79617d0758c10@socionext.com"},"message":"kbuild: move \"_all\" target out of $(KBUILD_SRC) conditional\n\ncommit ba634eceb535d95e87ef09caae7814b3687c6036 upstream.\n\nThe first \"_all\" occurrence around line 120 is only visible when\nKBUILD_SRC is unset.\n\nIf O=... is specified, the working directory is relocated, then the\nonly second occurrence around line 193 is visible, that is not set\nto PHONY.\n\nMove the first one to an always visible place.  This clarifies \"_all\"\nis our default target and it is always set to PHONY.\n\nSigned-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>\nReviewed-by: Douglas Anderson <dianders@chromium.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/31c4bc6e01e5219283c81fcfa61eb242d87965c7"},{"sha":"9a07f4a6befc34d8f91e5fa0069d063283705f3a","author":{"name":"Jerry Hoemann","email":"6ec4b37fa85f90d3fa61f3d86a0b7cb652b07f8d@hpe.com"},"message":"watchdog: hpwdt: SMBIOS check\n\ncommit c42cbe41727a138905a28f8e0b00c147be77ee93 upstream.\n\nThis corrects:\ncommit cce78da76601 (\"watchdog: hpwdt: Add check for UEFI bits\")\n\nThe test on HPE SMBIOS extension type 219 record \"Misc Features\"\nbits for UEFI support is incorrect.  The definition of the Misc Features\nbits in the HPE SMBIOS OEM Extensions specification (and related\nfirmware) was changed to use a different pair of bits to\nrepresent UEFI supported.  Howerver, a corresponding change\nto Linux was missed.\n\nCurrent code/platform work because the iCRU test is working.\nBut purpose of cce78da766 is to ensure correct functionality\non future systems where iCRU isn't supported.\n\nSigned-off-by: Jerry Hoemann <jerry.hoemann@hpe.com>\nReviewed-by: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Wim Van Sebroeck <wim@iguana.be>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/9a07f4a6befc34d8f91e5fa0069d063283705f3a"},{"sha":"d40d7b332592d9e15c57afb7c00a37f5e1cb1df6","author":{"name":"Jerry Hoemann","email":"6ec4b37fa85f90d3fa61f3d86a0b7cb652b07f8d@hpe.com"},"message":"watchdog: hpwdt: Check source of NMI\n\ncommit 838534e50e2e5c1e644e30ab6cb28da88eb31368 upstream.\n\nDo not claim the NMI (i.e. return NMI_DONE) if the source of\nthe NMI isn't the iLO watchdog or debug.\n\nSigned-off-by: Jerry Hoemann <jerry.hoemann@hpe.com>\nReviewed-by: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Wim Van Sebroeck <wim@iguana.be>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/d40d7b332592d9e15c57afb7c00a37f5e1cb1df6"},{"sha":"41da51dbc3721cae1b9796a422610366e9ff851c","author":{"name":"Arnd Bergmann","email":"72a0f6d3b182607e6d5c44b93e1abb7b23ee18f3@arndb.de"},"message":"watchdog: hpwdt: fix unused variable warning\n\ncommit aeebc6ba88ba3758ad95467ff6191fabf2074c13 upstream.\n\nThe new hpwdt_my_nmi() function is used conditionally, which produces\na harmless warning in some configurations:\n\ndrivers/watchdog/hpwdt.c:478:12: error: 'hpwdt_my_nmi' defined but not used [-Werror=unused-function]\n\nThis moves it inside of the #ifdef that protects its caller, to silence\nthe warning.\n\nFixes: 621174a92851 (\"watchdog: hpwdt: Check source of NMI\")\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nReviewed-by: Jerry Hoemann <jerry.hoemann@hpe.com>\nReviewed-by: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Wim Van Sebroeck <wim@iguana.be>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/41da51dbc3721cae1b9796a422610366e9ff851c"},{"sha":"77fbdd1e2a0c316481313caa4246b87a95aa0f31","author":{"name":"Jerry Hoemann","email":"6ec4b37fa85f90d3fa61f3d86a0b7cb652b07f8d@hpe.com"},"message":"watchdog: hpwdt: Remove legacy NMI sourcing.\n\ncommit 2b3d89b402b085b08498e896c65267a145bed486 upstream.\n\nGen8 and prior Proliant systems supported the \"CRU\" interface\nto firmware.  This interfaces allows linux to \"call back\" into firmware\nto source the cause of an NMI.  This feature isn't fully utilized\nas the actual source of the NMI isn't printed, the driver only\nindicates that the source couldn't be determined when the call\nfails.\n\nWith the advent of Gen9, iCRU replaces the CRU. The call back\nfeature is no longer available in firmware.  To be compatible and\nnot attempt to call back into firmware on system not supporting CRU,\nthe SMBIOS table is consulted to determine if it is safe to\nmake the call back or not.\n\nThis results in about half of the driver code being devoted\nto either making CRU calls or determing if it is safe to make\nCRU calls.  As noted, the driver isn't really using the results of\nthe CRU calls.\n\nFurthermore, as a consequence of the Spectre security issue, the\nBIOS/EFI calls are being wrapped into Spectre-disabling section.\nRemoving the call back in hpwdt_pretimeout assists in this effort.\n\nAs the CRU sourcing of the NMI isn't required for handling the\nNMI and there are security concerns with making the call back, remove\nthe legacy (pre Gen9) NMI sourcing and the DMI code to determine if\nthe system had the CRU interface.\n\nSigned-off-by: Jerry Hoemann <jerry.hoemann@hpe.com>\nAcked-by: Ingo Molnar <mingo@kernel.org>\nReviewed-by: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Wim Van Sebroeck <wim@iguana.be>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/77fbdd1e2a0c316481313caa4246b87a95aa0f31"},{"sha":"c116baf79f0ecedd94be496be622ab6b65a243e7","author":{"name":"Arnd Bergmann","email":"72a0f6d3b182607e6d5c44b93e1abb7b23ee18f3@arndb.de"},"message":"ARM: omap2: hide omap3_save_secure_ram on non-OMAP3 builds\n\ncommit 863204cfdae98626a92535ac928ad79f4d6b74ff upstream.\n\nIn configurations without CONFIG_OMAP3 but with secure RAM support,\nwe now run into a link failure:\n\narch/arm/mach-omap2/omap-secure.o: In function `omap3_save_secure_ram':\nomap-secure.c:(.text+0x130): undefined reference to `save_secure_ram_context'\n\nThe omap3_save_secure_ram() function is only called from the OMAP34xx\npower management code, so we can simply hide that function in the\nappropriate #ifdef.\n\nFixes: d09220a887f7 (\"ARM: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context\")\nAcked-by: Tony Lindgren <tony@atomide.com>\nTested-by: Dan Murphy <dmurphy@ti.com>\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/c116baf79f0ecedd94be496be622ab6b65a243e7"},{"sha":"314b54aae2ad9dc347be82112edfc9a612d2894c","author":{"name":"Chintan Patel","email":"5f3c37a4665ad5ba1881e8e51cd780dedc6c1259@intel.com"},"message":"ASoC: Intel: Skylake: Fix jack name format substitution\n\ncommit d1c4cb447a7efcb5608a33cdfed8ab4234378b0a upstream.\n\nJack name is not getting formatted correctly hence resulting\nin invalid name for HDMI/DP input devices.\n\nThis was recently exposed due changes brought by MST:\ncommit 3a13347f05fd (\"ASoC: Intel: kbl: Add jack port initialize\nin kbl machine drivers\")\n\nSigned-off-by: Chintan Patel <chintan.m.patel@intel.com>\nAcked-By: Vinod Koul <vinod.koul@intel.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nCc: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/314b54aae2ad9dc347be82112edfc9a612d2894c"},{"sha":"310f286ded5f1f7fd72dcb1cff936c0a02d5a4d2","author":{"name":"Vinod Koul","email":"1a280c20d4fd551b7d6d0e7722938abf8882c615@intel.com"},"message":"ASoC: Intel: kbl: fix jack name\n\ncommit cedb6415f9ece6d3368aa0ac8a433caff799792a upstream.\n\nCommit d1c4cb447a7e (\"ASoC: Intel: Skylake: Fix jack name format\nsubstitution\") added Jack name but erroneously added a space as well,\nso remove the space in Jack name.\n\nFixes: d1c4cb447a7e (\"ASoC: Intel: Skylake: Fix jack name format substitution\")\nSigned-off-by: Vinod Koul <vinod.koul@intel.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nCc: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/310f286ded5f1f7fd72dcb1cff936c0a02d5a4d2"},{"sha":"638c2e4eff89aae86593e80ac2be01eee195fccb","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: add back stackpointer size checks\n\ncommit 57ebd808a97d7c5b1e1afb937c2db22beba3c1f8 upstream.\n\nThe rationale for removing the check is only correct for rulesets\ngenerated by ip(6)tables.\n\nIn iptables, a jump can only occur to a user-defined chain, i.e.\nbecause we size the stack based on number of user-defined chains we\ncannot exceed stack size.\n\nHowever, the underlying binary format has no such restriction,\nand the validation step only ensures that the jump target is a\nvalid rule start point.\n\nIOW, its possible to build a rule blob that has no user-defined\nchains but does contain a jump.\n\nIf this happens, no jump stack gets allocated and crash occurs\nbecause no jumpstack was allocated.\n\nFixes: 7814b6ec6d0d6 (\"netfilter: xtables: don't save/restore jumpstack offset\")\nReported-by: syzbot+e783f671527912cd9403@syzkaller.appspotmail.com\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/638c2e4eff89aae86593e80ac2be01eee195fccb"},{"sha":"4514a597aa4376a024927ecde3570dacac742e70","author":{"name":"Cong Wang","email":"3f5d79d28d6d48052800caba9df0b30e06fefe41@gmail.com"},"message":"netfilter: ipt_CLUSTERIP: fix a race condition of proc file creation\n\ncommit b3e456fce9f51d6276e576d00271e2813c1b8b67 upstream.\n\nThere is a race condition between clusterip_config_entry_put()\nand clusterip_config_init(), after we release the spinlock in\nclusterip_config_entry_put(), a new proc file with a same IP could\nbe created immediately since it is already removed from the configs\nlist, therefore it triggers this warning:\n\n------------[ cut here ]------------\nproc_dir_entry 'ipt_CLUSTERIP/172.20.0.170' already registered\nWARNING: CPU: 1 PID: 4152 at fs/proc/generic.c:330 proc_register+0x2a4/0x370 fs/proc/generic.c:329\nKernel panic - not syncing: panic_on_warn set ...\n\nAs a quick fix, just move the proc_remove() inside the spinlock.\n\nReported-by: <syzbot+03218bcdba6aa76441a3@syzkaller.appspotmail.com>\nFixes: 6c5d5cfbe3c5 (\"netfilter: ipt_CLUSTERIP: check duplicate config when initializing\")\nTested-by: Paolo Abeni <pabeni@redhat.com>\nCc: Xin Long <lucien.xin@gmail.com>\nCc: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nReviewed-by: Xin Long <lucien.xin@gmail.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/4514a597aa4376a024927ecde3570dacac742e70"},{"sha":"2a7ebc07a1531a6dbe00434d3c69402c615dbd74","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"netfilter: xt_hashlimit: fix lock imbalance\n\ncommit de526f401284e1638d4c97cb5a4c292ac3f37655 upstream.\n\nsyszkaller found that rcu was not held in hashlimit_mt_common()\n\nWe only need to enable BH at this point.\n\nFixes: bea74641e378 (\"netfilter: xt_hashlimit: add rate match mode\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzkaller <syzkaller@googlegroups.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/2a7ebc07a1531a6dbe00434d3c69402c615dbd74"},{"sha":"ab737b02b2fdb02640bac85432ad7a4ebbba2e14","author":{"name":"Paolo Abeni","email":"760d0d6fcadb77e1b4c1d3c7879788c2b4ed8bbe@redhat.com"},"message":"netfilter: x_tables: fix missing timer initialization in xt_LED\n\ncommit 10414014bc085aac9f787a5890b33b5605fbcfc4 upstream.\n\nsyzbot reported that xt_LED may try to use the ledinternal->timer\nwithout previously initializing it:\n\n------------[ cut here ]------------\nkernel BUG at kernel/time/timer.c:958!\ninvalid opcode: 0000 [#1] SMP KASAN\nDumping ftrace buffer:\n    (ftrace buffer empty)\nModules linked in:\nCPU: 1 PID: 1826 Comm: kworker/1:2 Not tainted 4.15.0+ #306\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS\nGoogle 01/01/2011\nWorkqueue: ipv6_addrconf addrconf_dad_work\nRIP: 0010:__mod_timer kernel/time/timer.c:958 [inline]\nRIP: 0010:mod_timer+0x7d6/0x13c0 kernel/time/timer.c:1102\nRSP: 0018:ffff8801d24fe9f8 EFLAGS: 00010293\nRAX: ffff8801d25246c0 RBX: ffff8801aec6cb50 RCX: ffffffff816052c6\nRDX: 0000000000000000 RSI: 00000000fffbd14b RDI: ffff8801aec6cb68\nRBP: ffff8801d24fec98 R08: 0000000000000000 R09: 1ffff1003a49fd6c\nR10: ffff8801d24feb28 R11: 0000000000000005 R12: dffffc0000000000\nR13: ffff8801d24fec70 R14: 00000000fffbd14b R15: ffff8801af608f90\nFS:  0000000000000000(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000206d6fd0 CR3: 0000000006a22001 CR4: 00000000001606e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n  led_tg+0x1db/0x2e0 net/netfilter/xt_LED.c:75\n  ip6t_do_table+0xc2a/0x1a30 net/ipv6/netfilter/ip6_tables.c:365\n  ip6table_raw_hook+0x65/0x80 net/ipv6/netfilter/ip6table_raw.c:42\n  nf_hook_entry_hookfn include/linux/netfilter.h:120 [inline]\n  nf_hook_slow+0xba/0x1a0 net/netfilter/core.c:483\n  nf_hook.constprop.27+0x3f6/0x830 include/linux/netfilter.h:243\n  NF_HOOK include/linux/netfilter.h:286 [inline]\n  ndisc_send_skb+0xa51/0x1370 net/ipv6/ndisc.c:491\n  ndisc_send_ns+0x38a/0x870 net/ipv6/ndisc.c:633\n  addrconf_dad_work+0xb9e/0x1320 net/ipv6/addrconf.c:4008\n  process_one_work+0xbbf/0x1af0 kernel/workqueue.c:2113\n  worker_thread+0x223/0x1990 kernel/workqueue.c:2247\n  kthread+0x33c/0x400 kernel/kthread.c:238\n  ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:429\nCode: 85 2a 0b 00 00 4d 8b 3c 24 4d 85 ff 75 9f 4c 8b bd 60 fd ff ff e8 bb\n57 10 00 65 ff 0d 94 9a a1 7e e9 d9 fc ff ff e8 aa 57 10 00 <0f> 0b e8 a3\n57 10 00 e9 14 fb ff ff e8 99 57 10 00 4c 89 bd 70\nRIP: __mod_timer kernel/time/timer.c:958 [inline] RSP: ffff8801d24fe9f8\nRIP: mod_timer+0x7d6/0x13c0 kernel/time/timer.c:1102 RSP: ffff8801d24fe9f8\n---[ end trace f661ab06f5dd8b3d ]---\n\nThe ledinternal struct can be shared between several different\nxt_LED targets, but the related timer is currently initialized only\nif the first target requires it. Fix it by unconditionally\ninitializing the timer struct.\n\nv1 -> v2: call del_timer_sync() unconditionally, too.\n\nFixes: 268cb38e1802 (\"netfilter: x_tables: add LED trigger target\")\nReported-by: syzbot+10c98dc5725c6c8fc7fb@syzkaller.appspotmail.com\nSigned-off-by: Paolo Abeni <pabeni@redhat.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/ab737b02b2fdb02640bac85432ad7a4ebbba2e14"},{"sha":"53f94e6110aa47cfac198030ddb9585b9cd8bd3f","author":{"name":"Paolo Abeni","email":"760d0d6fcadb77e1b4c1d3c7879788c2b4ed8bbe@redhat.com"},"message":"netfilter: nat: cope with negative port range\n\ncommit db57ccf0f2f4624b4c4758379f8165277504fbd7 upstream.\n\nsyzbot reported a division by 0 bug in the netfilter nat code:\n\ndivide error: 0000 [#1] SMP KASAN\nDumping ftrace buffer:\n    (ftrace buffer empty)\nModules linked in:\nCPU: 1 PID: 4168 Comm: syzkaller034710 Not tainted 4.16.0-rc1+ #309\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS\nGoogle 01/01/2011\nRIP: 0010:nf_nat_l4proto_unique_tuple+0x291/0x530\nnet/netfilter/nf_nat_proto_common.c:88\nRSP: 0018:ffff8801b2466778 EFLAGS: 00010246\nRAX: 000000000000f153 RBX: ffff8801b2466dd8 RCX: ffff8801b2466c7c\nRDX: 0000000000000000 RSI: ffff8801b2466c58 RDI: ffff8801db5293ac\nRBP: ffff8801b24667d8 R08: ffff8801b8ba6dc0 R09: ffffffff88af5900\nR10: ffff8801b24666f0 R11: 0000000000000000 R12: 000000002990f153\nR13: 0000000000000001 R14: 0000000000000000 R15: ffff8801b2466c7c\nFS:  00000000017e3880(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000208fdfe4 CR3: 00000001b5340002 CR4: 00000000001606e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n  dccp_unique_tuple+0x40/0x50 net/netfilter/nf_nat_proto_dccp.c:30\n  get_unique_tuple+0xc28/0x1c10 net/netfilter/nf_nat_core.c:362\n  nf_nat_setup_info+0x1c2/0xe00 net/netfilter/nf_nat_core.c:406\n  nf_nat_redirect_ipv6+0x306/0x730 net/netfilter/nf_nat_redirect.c:124\n  redirect_tg6+0x7f/0xb0 net/netfilter/xt_REDIRECT.c:34\n  ip6t_do_table+0xc2a/0x1a30 net/ipv6/netfilter/ip6_tables.c:365\n  ip6table_nat_do_chain+0x65/0x80 net/ipv6/netfilter/ip6table_nat.c:41\n  nf_nat_ipv6_fn+0x594/0xa80 net/ipv6/netfilter/nf_nat_l3proto_ipv6.c:302\n  nf_nat_ipv6_local_fn+0x33/0x5d0\nnet/ipv6/netfilter/nf_nat_l3proto_ipv6.c:407\n  ip6table_nat_local_fn+0x2c/0x40 net/ipv6/netfilter/ip6table_nat.c:69\n  nf_hook_entry_hookfn include/linux/netfilter.h:120 [inline]\n  nf_hook_slow+0xba/0x1a0 net/netfilter/core.c:483\n  nf_hook include/linux/netfilter.h:243 [inline]\n  NF_HOOK include/linux/netfilter.h:286 [inline]\n  ip6_xmit+0x10ec/0x2260 net/ipv6/ip6_output.c:277\n  inet6_csk_xmit+0x2fc/0x580 net/ipv6/inet6_connection_sock.c:139\n  dccp_transmit_skb+0x9ac/0x10f0 net/dccp/output.c:142\n  dccp_connect+0x369/0x670 net/dccp/output.c:564\n  dccp_v6_connect+0xe17/0x1bf0 net/dccp/ipv6.c:946\n  __inet_stream_connect+0x2d4/0xf00 net/ipv4/af_inet.c:620\n  inet_stream_connect+0x58/0xa0 net/ipv4/af_inet.c:684\n  SYSC_connect+0x213/0x4a0 net/socket.c:1639\n  SyS_connect+0x24/0x30 net/socket.c:1620\n  do_syscall_64+0x282/0x940 arch/x86/entry/common.c:287\n  entry_SYSCALL_64_after_hwframe+0x26/0x9b\nRIP: 0033:0x441c69\nRSP: 002b:00007ffe50cc0be8 EFLAGS: 00000217 ORIG_RAX: 000000000000002a\nRAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000441c69\nRDX: 000000000000001c RSI: 00000000208fdfe4 RDI: 0000000000000003\nRBP: 00000000006cc018 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000538 R11: 0000000000000217 R12: 0000000000403590\nR13: 0000000000403620 R14: 0000000000000000 R15: 0000000000000000\nCode: 48 89 f0 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 46 02 00 00 48 8b\n45 c8 44 0f b7 20 e8 88 97 04 fd 31 d2 41 0f b7 c4 4c 89 f9 <41> f7 f6 48\nc1 e9 03 48 b8 00 00 00 00 00 fc ff df 0f b6 0c 01\nRIP: nf_nat_l4proto_unique_tuple+0x291/0x530\nnet/netfilter/nf_nat_proto_common.c:88 RSP: ffff8801b2466778\n\nThe problem is that currently we don't have any check on the\nconfigured port range. A port range == -1 triggers the bug, while\nother negative values may require a very long time to complete the\nfollowing loop.\n\nThis commit addresses the issue swapping the two ends on negative\nranges. The check is performed in nf_nat_l4proto_unique_tuple() since\nthe nft nat loads the port values from nft registers at runtime.\n\nv1 -> v2: use the correct 'Fixes' tag\nv2 -> v3: update commit message, drop unneeded READ_ONCE()\n\nFixes: 5b1158e909ec (\"[NETFILTER]: Add NAT support for nf_conntrack\")\nReported-by: syzbot+8012e198bd037f4871e5@syzkaller.appspotmail.com\nSigned-off-by: Paolo Abeni <pabeni@redhat.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/53f94e6110aa47cfac198030ddb9585b9cd8bd3f"},{"sha":"c89e04e5c06e682d95a18f1d286636183fd585fc","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"netfilter: IDLETIMER: be syzkaller friendly\n\ncommit cfc2c740533368b96e2be5e0a4e8c3cace7d9814 upstream.\n\nWe had one report from syzkaller [1]\n\nFirst issue is that INIT_WORK() should be done before mod_timer()\nor we risk timer being fired too soon, even with a 1 second timer.\n\nSecond issue is that we need to reject too big info->timeout\nto avoid overflows in msecs_to_jiffies(info->timeout * 1000), or\nrisk looping, if result after overflow is 0.\n\n[1]\nWARNING: CPU: 1 PID: 5129 at kernel/workqueue.c:1444 __queue_work+0xdf4/0x1230 kernel/workqueue.c:1444\nKernel panic - not syncing: panic_on_warn set ...\n\nCPU: 1 PID: 5129 Comm: syzkaller159866 Not tainted 4.16.0-rc1+ #230\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n <IRQ>\n __dump_stack lib/dump_stack.c:17 [inline]\n dump_stack+0x194/0x257 lib/dump_stack.c:53\n panic+0x1e4/0x41c kernel/panic.c:183\n __warn+0x1dc/0x200 kernel/panic.c:547\n report_bug+0x211/0x2d0 lib/bug.c:184\n fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178\n fixup_bug arch/x86/kernel/traps.c:247 [inline]\n do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296\n do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315\n invalid_op+0x22/0x40 arch/x86/entry/entry_64.S:988\nRIP: 0010:__queue_work+0xdf4/0x1230 kernel/workqueue.c:1444\nRSP: 0018:ffff8801db507538 EFLAGS: 00010006\nRAX: ffff8801aeb46080 RBX: ffff8801db530200 RCX: ffffffff81481404\nRDX: 0000000000000100 RSI: ffffffff86b42640 RDI: 0000000000000082\nRBP: ffff8801db507758 R08: 1ffff1003b6a0de5 R09: 000000000000000c\nR10: ffff8801db5073f0 R11: 0000000000000020 R12: 1ffff1003b6a0eb6\nR13: ffff8801b1067ae0 R14: 00000000000001f8 R15: dffffc0000000000\n queue_work_on+0x16a/0x1c0 kernel/workqueue.c:1488\n queue_work include/linux/workqueue.h:488 [inline]\n schedule_work include/linux/workqueue.h:546 [inline]\n idletimer_tg_expired+0x44/0x60 net/netfilter/xt_IDLETIMER.c:116\n call_timer_fn+0x228/0x820 kernel/time/timer.c:1326\n expire_timers kernel/time/timer.c:1363 [inline]\n __run_timers+0x7ee/0xb70 kernel/time/timer.c:1666\n run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692\n __do_softirq+0x2d7/0xb85 kernel/softirq.c:285\n invoke_softirq kernel/softirq.c:365 [inline]\n irq_exit+0x1cc/0x200 kernel/softirq.c:405\n exiting_irq arch/x86/include/asm/apic.h:541 [inline]\n smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052\n apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:829\n </IRQ>\nRIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:777 [inline]\nRIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]\nRIP: 0010:_raw_spin_unlock_irqrestore+0x5e/0xba kernel/locking/spinlock.c:184\nRSP: 0018:ffff8801c20173c8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff12\nRAX: dffffc0000000000 RBX: 0000000000000282 RCX: 0000000000000006\nRDX: 1ffffffff0d592cd RSI: 1ffff10035d68d23 RDI: 0000000000000282\nRBP: ffff8801c20173d8 R08: 1ffff10038402e47 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8820e5c8\nR13: ffff8801b1067ad8 R14: ffff8801aea7c268 R15: ffff8801aea7c278\n __debug_object_init+0x235/0x1040 lib/debugobjects.c:378\n debug_object_init+0x17/0x20 lib/debugobjects.c:391\n __init_work+0x2b/0x60 kernel/workqueue.c:506\n idletimer_tg_create net/netfilter/xt_IDLETIMER.c:152 [inline]\n idletimer_tg_checkentry+0x691/0xb00 net/netfilter/xt_IDLETIMER.c:213\n xt_check_target+0x22c/0x7d0 net/netfilter/x_tables.c:850\n check_target net/ipv6/netfilter/ip6_tables.c:533 [inline]\n find_check_entry.isra.7+0x935/0xcf0 net/ipv6/netfilter/ip6_tables.c:575\n translate_table+0xf52/0x1690 net/ipv6/netfilter/ip6_tables.c:744\n do_replace net/ipv6/netfilter/ip6_tables.c:1160 [inline]\n do_ip6t_set_ctl+0x370/0x5f0 net/ipv6/netfilter/ip6_tables.c:1686\n nf_sockopt net/netfilter/nf_sockopt.c:106 [inline]\n nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115\n ipv6_setsockopt+0x10b/0x130 net/ipv6/ipv6_sockglue.c:927\n udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1422\n sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2976\n SYSC_setsockopt net/socket.c:1850 [inline]\n SyS_setsockopt+0x189/0x360 net/socket.c:1829\n do_syscall_64+0x282/0x940 arch/x86/entry/common.c:287\n\nFixes: 0902b469bd25 (\"netfilter: xtables: idletimer target implementation\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzkaller <syzkaller@googlegroups.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/c89e04e5c06e682d95a18f1d286636183fd585fc"},{"sha":"eaa06bfba8eabd44ce952758046492eebc973bbe","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets\n\ncommit b71812168571fa55e44cdd0254471331b9c4c4c6 upstream.\n\nWe need to make sure the offsets are not out of range of the\ntotal size.\nAlso check that they are in ascending order.\n\nThe WARN_ON triggered by syzkaller (it sets panic_on_warn) is\nchanged to also bail out, no point in continuing parsing.\n\nBriefly tested with simple ruleset of\n-A INPUT --limit 1/s' --log\nplus jump to custom chains using 32bit ebtables binary.\n\nReported-by: <syzbot+845a53d13171abf8bf29@syzkaller.appspotmail.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/eaa06bfba8eabd44ce952758046492eebc973bbe"},{"sha":"2d7e07003950dadd2f918effff584b0c98501189","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: bridge: ebt_among: add missing match size checks\n\ncommit c4585a2823edf4d1326da44d1524ecbfda26bb37 upstream.\n\nebt_among is special, it has a dynamic match size and is exempt\nfrom the central size checks.\n\nTherefore it must check that the size of the match structure\nprovided from userspace is sane by making sure em->match_size\nis at least the minimum size of the expected structure.\n\nThe module has such a check, but its only done after accessing\na structure that might be out of bounds.\n\ntested with: ebtables -A INPUT ... \\\n--among-dst fe:fe:fe:fe:fe:fe\n--among-dst fe:fe:fe:fe:fe:fe --among-src fe:fe:fe:fe:ff:f,fe:fe:fe:fe:fe:fb,fe:fe:fe:fe:fc:fd,fe:fe:fe:fe:fe:fd,fe:fe:fe:fe:fe:fe\n--among-src fe:fe:fe:fe:ff:f,fe:fe:fe:fe:fe:fa,fe:fe:fe:fe:fe:fd,fe:fe:fe:fe:fe:fe,fe:fe:fe:fe:fe:fe\n\nReported-by: <syzbot+fe0b19af568972814355@syzkaller.appspotmail.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/2d7e07003950dadd2f918effff584b0c98501189"},{"sha":"39f154faecc23e42190a41e6225060c39092d1f8","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt\n\ncommit b078556aecd791b0e5cb3a59f4c3a14273b52121 upstream.\n\nl4proto->manip_pkt() can cause reallocation of skb head so pointer\nto the ipv6 header must be reloaded.\n\nReported-and-tested-by: <syzbot+10005f4292fc9cc89de7@syzkaller.appspotmail.com>\nFixes: 58a317f1061c89 (\"netfilter: ipv6: add IPv6 NAT support\")\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/39f154faecc23e42190a41e6225060c39092d1f8"},{"sha":"9131a1b3d9c8fc22c3c2f5115f06c7c4332860a4","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"netfilter: use skb_to_full_sk in ip6_route_me_harder\n\ncommit 7d98386d55a5afaa65de77e1e9197edeb8a42079 upstream.\n\nFor some reason, Florian forgot to apply to ip6_route_me_harder\nthe fix that went in commit 29e09229d9f2 (\"netfilter: use\nskb_to_full_sk in ip_route_me_harder\")\n\nFixes: ca6fb0651883 (\"tcp: attach SYNACK messages to request sockets instead of listener\") \nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/9131a1b3d9c8fc22c3c2f5115f06c7c4332860a4"},{"sha":"f1bb2393fcd005b13857a002d25d9a4ebc6a2398","author":{"name":"Azhar Shaikh","email":"5062ba4cf947dfea1faa5ad336a072ca19eb9da2@intel.com"},"message":"tpm_tis: Move ilb_base_addr to tpm_tis_data\n\ncommit c382babccba2c82fe57f9e647f290fb7bf4d130d upstream.\n\nMove static variable ilb_base_addr to tpm_tis_data.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Azhar Shaikh <azhar.shaikh@intel.com>\nReviewed-by: Jarkko Sakkinen  <jarkko.sakkinen@linux.intel.com>\nTested-by: Jarkko Sakkinen  <jarkko.sakkinen@linux.intel.com>\nSigned-off-by: Jarkko Sakkinen  <jarkko.sakkinen@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/f1bb2393fcd005b13857a002d25d9a4ebc6a2398"},{"sha":"7cea3381216a304e12dc21fb050e51bf62ed7a11","author":{"name":"Azhar Shaikh","email":"5062ba4cf947dfea1faa5ad336a072ca19eb9da2@intel.com"},"message":"tpm: Keep CLKRUN enabled throughout the duration of transmit_cmd()\n\ncommit b3e958ce4c585bf666de249dc794971ebc62d2d3 upstream.\n\nCommit 5e572cab92f0bb5 (\"tpm: Enable CLKRUN protocol for Braswell\nsystems\") disabled CLKRUN protocol during TPM transactions and re-enabled\nonce the transaction is completed. But there were still some corner cases\nobserved where, reading of TPM header failed for savestate command\nwhile going to suspend, which resulted in suspend failure.\nTo fix this issue keep the CLKRUN protocol disabled for the entire\nduration of a single TPM command and not disabling and re-enabling\nagain for every TPM transaction. For the other TPM accesses outside\nTPM command flow, add a higher level of disabling and re-enabling\nthe CLKRUN protocol, instead of doing for every TPM transaction.\n\nFixes: 5e572cab92f0bb5 (\"tpm: Enable CLKRUN protocol for Braswell systems\")\nSigned-off-by: Azhar Shaikh <azhar.shaikh@intel.com>\nReviewed-by: Jarkko Sakkinen  <jarkko.sakkinen@linux.intel.com>\nTested-by: Jarkko Sakkinen  <jarkko.sakkinen@linux.intel.com>\nSigned-off-by: Jarkko Sakkinen  <jarkko.sakkinen@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/7cea3381216a304e12dc21fb050e51bf62ed7a11"}]}
{"actor":{"display_login":"Jackeagle"}}