{"push_id":2858956645,"size":52,"distinct_size":52,"ref":"refs/heads/lineage-15.1","head":"1ea519a02c7bb6422529398bc65778a6b588ae14","before":"54d66907a88061000d5955727ecee7333dd10f21","commits":[{"sha":"96dd9d81d2b459997893f502c4151460bd19c38f","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"af_key: do not use GFP_KERNEL in atomic contexts\n\n\n[ Upstream commit 36f41f8fc6d8aa9f8c9072d66ff7cf9055f5e69b ]\n\npfkey_broadcast() might be called from non process contexts,\nwe can not use GFP_KERNEL in these cases [1].\n\nThis patch partially reverts commit ba51b6be38c1 (\"net: Fix RCU splat in\naf_key\"), only keeping the GFP_ATOMIC forcing under rcu_read_lock()\nsection.\n\n[1] : syzkaller reported :\n\nin_atomic(): 1, irqs_disabled(): 0, pid: 2932, name: syzkaller183439\n3 locks held by syzkaller183439/2932:\n #0:  (&net->xfrm.xfrm_cfg_mutex){+.+.+.}, at: [<ffffffff83b43888>] pfkey_sendmsg+0x4c8/0x9f0 net/key/af_key.c:3649\n #1:  (&pfk->dump_lock){+.+.+.}, at: [<ffffffff83b467f6>] pfkey_do_dump+0x76/0x3f0 net/key/af_key.c:293\n #2:  (&(&net->xfrm.xfrm_policy_lock)->rlock){+...+.}, at: [<ffffffff83957632>] spin_lock_bh include/linux/spinlock.h:304 [inline]\n #2:  (&(&net->xfrm.xfrm_policy_lock)->rlock){+...+.}, at: [<ffffffff83957632>] xfrm_policy_walk+0x192/0xa30 net/xfrm/xfrm_policy.c:1028\nCPU: 0 PID: 2932 Comm: syzkaller183439 Not tainted 4.13.0-rc4+ #24\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:16 [inline]\n dump_stack+0x194/0x257 lib/dump_stack.c:52\n ___might_sleep+0x2b2/0x470 kernel/sched/core.c:5994\n __might_sleep+0x95/0x190 kernel/sched/core.c:5947\n slab_pre_alloc_hook mm/slab.h:416 [inline]\n slab_alloc mm/slab.c:3383 [inline]\n kmem_cache_alloc+0x24b/0x6e0 mm/slab.c:3559\n skb_clone+0x1a0/0x400 net/core/skbuff.c:1037\n pfkey_broadcast_one+0x4b2/0x6f0 net/key/af_key.c:207\n pfkey_broadcast+0x4ba/0x770 net/key/af_key.c:281\n dump_sp+0x3d6/0x500 net/key/af_key.c:2685\n xfrm_policy_walk+0x2f1/0xa30 net/xfrm/xfrm_policy.c:1042\n pfkey_dump_sp+0x42/0x50 net/key/af_key.c:2695\n pfkey_do_dump+0xaa/0x3f0 net/key/af_key.c:299\n pfkey_spddump+0x1a0/0x210 net/key/af_key.c:2722\n pfkey_process+0x606/0x710 net/key/af_key.c:2814\n pfkey_sendmsg+0x4d6/0x9f0 net/key/af_key.c:3650\nsock_sendmsg_nosec net/socket.c:633 [inline]\n sock_sendmsg+0xca/0x110 net/socket.c:643\n ___sys_sendmsg+0x755/0x890 net/socket.c:2035\n __sys_sendmsg+0xe5/0x210 net/socket.c:2069\n SYSC_sendmsg net/socket.c:2080 [inline]\n SyS_sendmsg+0x2d/0x50 net/socket.c:2076\n entry_SYSCALL_64_fastpath+0x1f/0xbe\nRIP: 0033:0x445d79\nRSP: 002b:00007f32447c1dc8 EFLAGS: 00000202 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000445d79\nRDX: 0000000000000000 RSI: 000000002023dfc8 RDI: 0000000000000008\nRBP: 0000000000000086 R08: 00007f32447c2700 R09: 00007f32447c2700\nR10: 00007f32447c2700 R11: 0000000000000202 R12: 0000000000000000\nR13: 00007ffe33edec4f R14: 00007f32447c29c0 R15: 0000000000000000\n\nFixes: ba51b6be38c1 (\"net: Fix RCU splat in af_key\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nCc: David Ahern <dsa@cumulusnetworks.com>\nAcked-by: David Ahern <dsahern@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/96dd9d81d2b459997893f502c4151460bd19c38f"},{"sha":"836bcafaf2b9120ca45ce229a093d3a7c6559be0","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"dccp: purge write queue in dccp_destroy_sock()\n\n\n[ Upstream commit 7749d4ff88d31b0be17c8683143135adaaadc6a7 ]\n\nsyzkaller reported that DCCP could have a non empty\nwrite queue at dismantle time.\n\nWARNING: CPU: 1 PID: 2953 at net/core/stream.c:199 sk_stream_kill_queues+0x3ce/0x520 net/core/stream.c:199\nKernel panic - not syncing: panic_on_warn set ...\n\nCPU: 1 PID: 2953 Comm: syz-executor0 Not tainted 4.13.0-rc4+ #2\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:16 [inline]\n dump_stack+0x194/0x257 lib/dump_stack.c:52\n panic+0x1e4/0x417 kernel/panic.c:180\n __warn+0x1c4/0x1d9 kernel/panic.c:541\n report_bug+0x211/0x2d0 lib/bug.c:183\n fixup_bug+0x40/0x90 arch/x86/kernel/traps.c:190\n do_trap_no_signal arch/x86/kernel/traps.c:224 [inline]\n do_trap+0x260/0x390 arch/x86/kernel/traps.c:273\n do_error_trap+0x120/0x390 arch/x86/kernel/traps.c:310\n do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:323\n invalid_op+0x1e/0x30 arch/x86/entry/entry_64.S:846\nRIP: 0010:sk_stream_kill_queues+0x3ce/0x520 net/core/stream.c:199\nRSP: 0018:ffff8801d182f108 EFLAGS: 00010297\nRAX: ffff8801d1144140 RBX: ffff8801d13cb280 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffffffff85137b00 RDI: ffff8801d13cb280\nRBP: ffff8801d182f148 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff8801d13cb4d0\nR13: ffff8801d13cb3b8 R14: ffff8801d13cb300 R15: ffff8801d13cb3b8\n inet_csk_destroy_sock+0x175/0x3f0 net/ipv4/inet_connection_sock.c:835\n dccp_close+0x84d/0xc10 net/dccp/proto.c:1067\n inet_release+0xed/0x1c0 net/ipv4/af_inet.c:425\n sock_release+0x8d/0x1e0 net/socket.c:597\n sock_close+0x16/0x20 net/socket.c:1126\n __fput+0x327/0x7e0 fs/file_table.c:210\n ____fput+0x15/0x20 fs/file_table.c:246\n task_work_run+0x18a/0x260 kernel/task_work.c:116\n exit_task_work include/linux/task_work.h:21 [inline]\n do_exit+0xa32/0x1b10 kernel/exit.c:865\n do_group_exit+0x149/0x400 kernel/exit.c:969\n get_signal+0x7e8/0x17e0 kernel/signal.c:2330\n do_signal+0x94/0x1ee0 arch/x86/kernel/signal.c:808\n exit_to_usermode_loop+0x21c/0x2d0 arch/x86/entry/common.c:157\n prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]\n syscall_return_slowpath+0x3a7/0x450 arch/x86/entry/common.c:263\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/836bcafaf2b9120ca45ce229a093d3a7c6559be0"},{"sha":"f804089b0031da82dd797ae8330b13bc4837115a","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"dccp: defer ccid_hc_tx_delete() at dismantle time\n\n\n[ Upstream commit 120e9dabaf551c6dc03d3a10a1f026376cb1811c ]\n\nsyszkaller team reported another problem in DCCP [1]\n\nProblem here is that the structure holding RTO timer\n(ccid2_hc_tx_rto_expire() handler) is freed too soon.\n\nWe can not use del_timer_sync() to cancel the timer\nsince this timer wants to grab socket lock (that would risk a dead lock)\n\nSolution is to defer the freeing of memory when all references to\nthe socket were released. Socket timers do own a reference, so this\nshould fix the issue.\n\n[1]\n\n==================================================================\nBUG: KASAN: use-after-free in ccid2_hc_tx_rto_expire+0x51c/0x5c0 net/dccp/ccids/ccid2.c:144\nRead of size 4 at addr ffff8801d2660540 by task kworker/u4:7/3365\n\nCPU: 1 PID: 3365 Comm: kworker/u4:7 Not tainted 4.13.0-rc4+ #3\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nWorkqueue: events_unbound call_usermodehelper_exec_work\nCall Trace:\n <IRQ>\n __dump_stack lib/dump_stack.c:16 [inline]\n dump_stack+0x194/0x257 lib/dump_stack.c:52\n print_address_description+0x73/0x250 mm/kasan/report.c:252\n kasan_report_error mm/kasan/report.c:351 [inline]\n kasan_report+0x24e/0x340 mm/kasan/report.c:409\n __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429\n ccid2_hc_tx_rto_expire+0x51c/0x5c0 net/dccp/ccids/ccid2.c:144\n call_timer_fn+0x233/0x830 kernel/time/timer.c:1268\n expire_timers kernel/time/timer.c:1307 [inline]\n __run_timers+0x7fd/0xb90 kernel/time/timer.c:1601\n run_timer_softirq+0x21/0x80 kernel/time/timer.c:1614\n __do_softirq+0x2f5/0xba3 kernel/softirq.c:284\n invoke_softirq kernel/softirq.c:364 [inline]\n irq_exit+0x1cc/0x200 kernel/softirq.c:405\n exiting_irq arch/x86/include/asm/apic.h:638 [inline]\n smp_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:1044\n apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:702\nRIP: 0010:arch_local_irq_enable arch/x86/include/asm/paravirt.h:824 [inline]\nRIP: 0010:__raw_write_unlock_irq include/linux/rwlock_api_smp.h:267 [inline]\nRIP: 0010:_raw_write_unlock_irq+0x56/0x70 kernel/locking/spinlock.c:343\nRSP: 0018:ffff8801cd50eaa8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10\nRAX: dffffc0000000000 RBX: ffffffff85a090c0 RCX: 0000000000000006\nRDX: 1ffffffff0b595f3 RSI: 1ffff1003962f989 RDI: ffffffff85acaf98\nRBP: ffff8801cd50eab0 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff8801cc96ea60\nR13: dffffc0000000000 R14: ffff8801cc96e4c0 R15: ffff8801cc96e4c0\n </IRQ>\n release_task+0xe9e/0x1a40 kernel/exit.c:220\n wait_task_zombie kernel/exit.c:1162 [inline]\n wait_consider_task+0x29b8/0x33c0 kernel/exit.c:1389\n do_wait_thread kernel/exit.c:1452 [inline]\n do_wait+0x441/0xa90 kernel/exit.c:1523\n kernel_wait4+0x1f5/0x370 kernel/exit.c:1665\n SYSC_wait4+0x134/0x140 kernel/exit.c:1677\n SyS_wait4+0x2c/0x40 kernel/exit.c:1673\n call_usermodehelper_exec_sync kernel/kmod.c:286 [inline]\n call_usermodehelper_exec_work+0x1a0/0x2c0 kernel/kmod.c:323\n process_one_work+0xbf3/0x1bc0 kernel/workqueue.c:2097\n worker_thread+0x223/0x1860 kernel/workqueue.c:2231\n kthread+0x35e/0x430 kernel/kthread.c:231\n ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:425\n\nAllocated by task 21267:\n save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59\n save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n set_track mm/kasan/kasan.c:459 [inline]\n kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551\n kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489\n kmem_cache_alloc+0x127/0x750 mm/slab.c:3561\n ccid_new+0x20e/0x390 net/dccp/ccid.c:151\n dccp_hdlr_ccid+0x27/0x140 net/dccp/feat.c:44\n __dccp_feat_activate+0x142/0x2a0 net/dccp/feat.c:344\n dccp_feat_activate_values+0x34e/0xa90 net/dccp/feat.c:1538\n dccp_rcv_request_sent_state_process net/dccp/input.c:472 [inline]\n dccp_rcv_state_process+0xed1/0x1620 net/dccp/input.c:677\n dccp_v4_do_rcv+0xeb/0x160 net/dccp/ipv4.c:679\n sk_backlog_rcv include/net/sock.h:911 [inline]\n __release_sock+0x124/0x360 net/core/sock.c:2269\n release_sock+0xa4/0x2a0 net/core/sock.c:2784\n inet_wait_for_connect net/ipv4/af_inet.c:557 [inline]\n __inet_stream_connect+0x671/0xf00 net/ipv4/af_inet.c:643\n inet_stream_connect+0x58/0xa0 net/ipv4/af_inet.c:682\n SYSC_connect+0x204/0x470 net/socket.c:1642\n SyS_connect+0x24/0x30 net/socket.c:1623\n entry_SYSCALL_64_fastpath+0x1f/0xbe\n\nFreed by task 3049:\n save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59\n save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n set_track mm/kasan/kasan.c:459 [inline]\n kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524\n __cache_free mm/slab.c:3503 [inline]\n kmem_cache_free+0x77/0x280 mm/slab.c:3763\n ccid_hc_tx_delete+0xc5/0x100 net/dccp/ccid.c:190\n dccp_destroy_sock+0x1d1/0x2b0 net/dccp/proto.c:225\n inet_csk_destroy_sock+0x166/0x3f0 net/ipv4/inet_connection_sock.c:833\n dccp_done+0xb7/0xd0 net/dccp/proto.c:145\n dccp_time_wait+0x13d/0x300 net/dccp/minisocks.c:72\n dccp_rcv_reset+0x1d1/0x5b0 net/dccp/input.c:160\n dccp_rcv_state_process+0x8fc/0x1620 net/dccp/input.c:663\n dccp_v4_do_rcv+0xeb/0x160 net/dccp/ipv4.c:679\n sk_backlog_rcv include/net/sock.h:911 [inline]\n __sk_receive_skb+0x33e/0xc00 net/core/sock.c:521\n dccp_v4_rcv+0xef1/0x1c00 net/dccp/ipv4.c:871\n ip_local_deliver_finish+0x2e2/0xba0 net/ipv4/ip_input.c:216\n NF_HOOK include/linux/netfilter.h:248 [inline]\n ip_local_deliver+0x1ce/0x6d0 net/ipv4/ip_input.c:257\n dst_input include/net/dst.h:477 [inline]\n ip_rcv_finish+0x8db/0x19c0 net/ipv4/ip_input.c:397\n NF_HOOK include/linux/netfilter.h:248 [inline]\n ip_rcv+0xc3f/0x17d0 net/ipv4/ip_input.c:488\n __netif_receive_skb_core+0x19af/0x33d0 net/core/dev.c:4417\n __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4455\n process_backlog+0x203/0x740 net/core/dev.c:5130\n napi_poll net/core/dev.c:5527 [inline]\n net_rx_action+0x792/0x1910 net/core/dev.c:5593\n __do_softirq+0x2f5/0xba3 kernel/softirq.c:284\n\nThe buggy address belongs to the object at ffff8801d2660100\n which belongs to the cache ccid2_hc_tx_sock of size 1240\nThe buggy address is located 1088 bytes inside of\n 1240-byte region [ffff8801d2660100, ffff8801d26605d8)\nThe buggy address belongs to the page:\npage:ffffea0007499800 count:1 mapcount:0 mapping:ffff8801d2660100 index:0x0 compound_mapcount: 0\nflags: 0x200000000008100(slab|head)\nraw: 0200000000008100 ffff8801d2660100 0000000000000000 0000000100000005\nraw: ffffea00075271a0 ffffea0007538820 ffff8801d3aef9c0 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff8801d2660400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff8801d2660480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n>ffff8801d2660500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                                           ^\n ffff8801d2660580: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc\n ffff8801d2660600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n==================================================================\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nCc: Gerrit Renker <gerrit@erg.abdn.ac.uk>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/f804089b0031da82dd797ae8330b13bc4837115a"},{"sha":"ecfd1f0afc97f49711acc7f47898936859a86a13","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"ipv4: fix NULL dereference in free_fib_info_rcu()\n\n\n[ Upstream commit 187e5b3ac84d3421d2de3aca949b2791fbcad554 ]\n\nIf fi->fib_metrics could not be allocated in fib_create_info()\nwe attempt to dereference a NULL pointer in free_fib_info_rcu() :\n\n    m = fi->fib_metrics;\n    if (m != &dst_default_metrics && atomic_dec_and_test(&m->refcnt))\n            kfree(m);\n\nBefore my recent patch, we used to call kfree(NULL) and nothing wrong\nhappened.\n\nInstead of using RCU to defer freeing while we are under memory stress,\nit seems better to take immediate action.\n\nThis was reported by syzkaller team.\n\nFixes: 3fb07daff8e9 (\"ipv4: add reference counting to metrics\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/ecfd1f0afc97f49711acc7f47898936859a86a13"},{"sha":"42cb35ee675d27e28bd8222b72449720a68cc51f","author":{"name":"Konstantin Khlebnikov","email":"3b96b99f19643d33e1bfa1caa535c041c3608549@yandex-team.ru"},"message":"net_sched/sfq: update hierarchical backlog when drop packet\n\n\n[ Upstream commit 325d5dc3f7e7c2840b65e4a2988c082c2c0025c5 ]\n\nWhen sfq_enqueue() drops head packet or packet from another queue it\nhave to update backlog at upper qdiscs too.\n\nFixes: 2ccccf5fb43f (\"net_sched: update hierarchical backlog too\")\nSigned-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/42cb35ee675d27e28bd8222b72449720a68cc51f"},{"sha":"7a6d8037e029e5ab0fe51e4a0abc80d2ce773f7d","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"ipv4: better IP_MAX_MTU enforcement\n\n\n[ Upstream commit c780a049f9bf442314335372c9abc4548bfe3e44 ]\n\nWhile working on yet another syzkaller report, I found\nthat our IP_MAX_MTU enforcements were not properly done.\n\ngcc seems to reload dev->mtu for min(dev->mtu, IP_MAX_MTU), and\nfinal result can be bigger than IP_MAX_MTU :/\n\nThis is a problem because device mtu can be changed on other cpus or\nthreads.\n\nWhile this patch does not fix the issue I am working on, it is\nprobably worth addressing it.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/7a6d8037e029e5ab0fe51e4a0abc80d2ce773f7d"},{"sha":"9b6a45a54021fe2fc0b64b62add394a2abbc4060","author":{"name":"Alexander Potapenko","email":"3640347d2aca22f57be504cddeccc130f1a3ca7e@google.com"},"message":"sctp: fully initialize the IPv6 address in sctp_v6_to_addr()\n\n\n[ Upstream commit 15339e441ec46fbc3bf3486bb1ae4845b0f1bb8d ]\n\nKMSAN reported use of uninitialized sctp_addr->v4.sin_addr.s_addr and\nsctp_addr->v6.sin6_scope_id in sctp_v6_cmp_addr() (see below).\nMake sure all fields of an IPv6 address are initialized, which\nguarantees that the IPv4 fields are also initialized.\n\n==================================================================\n BUG: KMSAN: use of uninitialized memory in sctp_v6_cmp_addr+0x8d4/0x9f0\n net/sctp/ipv6.c:517\n CPU: 2 PID: 31056 Comm: syz-executor1 Not tainted 4.11.0-rc5+ #2944\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs\n 01/01/2011\n Call Trace:\n  dump_stack+0x172/0x1c0 lib/dump_stack.c:42\n  is_logbuf_locked mm/kmsan/kmsan.c:59 [inline]\n  kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:938\n  native_save_fl arch/x86/include/asm/irqflags.h:18 [inline]\n  arch_local_save_flags arch/x86/include/asm/irqflags.h:72 [inline]\n  arch_local_irq_save arch/x86/include/asm/irqflags.h:113 [inline]\n  __msan_warning_32+0x61/0xb0 mm/kmsan/kmsan_instr.c:467\n  sctp_v6_cmp_addr+0x8d4/0x9f0 net/sctp/ipv6.c:517\n  sctp_v6_get_dst+0x8c7/0x1630 net/sctp/ipv6.c:290\n  sctp_transport_route+0x101/0x570 net/sctp/transport.c:292\n  sctp_assoc_add_peer+0x66d/0x16f0 net/sctp/associola.c:651\n  sctp_sendmsg+0x35a5/0x4f90 net/sctp/socket.c:1871\n  inet_sendmsg+0x498/0x670 net/ipv4/af_inet.c:762\n  sock_sendmsg_nosec net/socket.c:633 [inline]\n  sock_sendmsg net/socket.c:643 [inline]\n  SYSC_sendto+0x608/0x710 net/socket.c:1696\n  SyS_sendto+0x8a/0xb0 net/socket.c:1664\n  entry_SYSCALL_64_fastpath+0x13/0x94\n RIP: 0033:0x44b479\n RSP: 002b:00007f6213f21c08 EFLAGS: 00000286 ORIG_RAX: 000000000000002c\n RAX: ffffffffffffffda RBX: 0000000020000000 RCX: 000000000044b479\n RDX: 0000000000000041 RSI: 0000000020edd000 RDI: 0000000000000006\n RBP: 00000000007080a8 R08: 0000000020b85fe4 R09: 000000000000001c\n R10: 0000000000040005 R11: 0000000000000286 R12: 00000000ffffffff\n R13: 0000000000003760 R14: 00000000006e5820 R15: 0000000000ff8000\n origin description: ----dst_saddr@sctp_v6_get_dst\n local variable created at:\n  sk_fullsock include/net/sock.h:2321 [inline]\n  inet6_sk include/linux/ipv6.h:309 [inline]\n  sctp_v6_get_dst+0x91/0x1630 net/sctp/ipv6.c:241\n  sctp_transport_route+0x101/0x570 net/sctp/transport.c:292\n==================================================================\n BUG: KMSAN: use of uninitialized memory in sctp_v6_cmp_addr+0x8d4/0x9f0\n net/sctp/ipv6.c:517\n CPU: 2 PID: 31056 Comm: syz-executor1 Not tainted 4.11.0-rc5+ #2944\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs\n 01/01/2011\n Call Trace:\n  dump_stack+0x172/0x1c0 lib/dump_stack.c:42\n  is_logbuf_locked mm/kmsan/kmsan.c:59 [inline]\n  kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:938\n  native_save_fl arch/x86/include/asm/irqflags.h:18 [inline]\n  arch_local_save_flags arch/x86/include/asm/irqflags.h:72 [inline]\n  arch_local_irq_save arch/x86/include/asm/irqflags.h:113 [inline]\n  __msan_warning_32+0x61/0xb0 mm/kmsan/kmsan_instr.c:467\n  sctp_v6_cmp_addr+0x8d4/0x9f0 net/sctp/ipv6.c:517\n  sctp_v6_get_dst+0x8c7/0x1630 net/sctp/ipv6.c:290\n  sctp_transport_route+0x101/0x570 net/sctp/transport.c:292\n  sctp_assoc_add_peer+0x66d/0x16f0 net/sctp/associola.c:651\n  sctp_sendmsg+0x35a5/0x4f90 net/sctp/socket.c:1871\n  inet_sendmsg+0x498/0x670 net/ipv4/af_inet.c:762\n  sock_sendmsg_nosec net/socket.c:633 [inline]\n  sock_sendmsg net/socket.c:643 [inline]\n  SYSC_sendto+0x608/0x710 net/socket.c:1696\n  SyS_sendto+0x8a/0xb0 net/socket.c:1664\n  entry_SYSCALL_64_fastpath+0x13/0x94\n RIP: 0033:0x44b479\n RSP: 002b:00007f6213f21c08 EFLAGS: 00000286 ORIG_RAX: 000000000000002c\n RAX: ffffffffffffffda RBX: 0000000020000000 RCX: 000000000044b479\n RDX: 0000000000000041 RSI: 0000000020edd000 RDI: 0000000000000006\n RBP: 00000000007080a8 R08: 0000000020b85fe4 R09: 000000000000001c\n R10: 0000000000040005 R11: 0000000000000286 R12: 00000000ffffffff\n R13: 0000000000003760 R14: 00000000006e5820 R15: 0000000000ff8000\n origin description: ----dst_saddr@sctp_v6_get_dst\n local variable created at:\n  sk_fullsock include/net/sock.h:2321 [inline]\n  inet6_sk include/linux/ipv6.h:309 [inline]\n  sctp_v6_get_dst+0x91/0x1630 net/sctp/ipv6.c:241\n  sctp_transport_route+0x101/0x570 net/sctp/transport.c:292\n==================================================================\n\nSigned-off-by: Alexander Potapenko <glider@google.com>\nReviewed-by: Xin Long <lucien.xin@gmail.com>\nAcked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/9b6a45a54021fe2fc0b64b62add394a2abbc4060"},{"sha":"6afa305cf62a2270f1f83c2162a7245ef2c0c84c","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"tipc: fix use-after-free\n\n\n[ Upstream commit 5bfd37b4de5c98e86b12bd13be5aa46c7484a125 ]\n\nsyszkaller reported use-after-free in tipc [1]\n\nWhen msg->rep skb is freed, set the pointer to NULL,\nso that caller does not free it again.\n\n[1]\n\n==================================================================\nBUG: KASAN: use-after-free in skb_push+0xd4/0xe0 net/core/skbuff.c:1466\nRead of size 8 at addr ffff8801c6e71e90 by task syz-executor5/4115\n\nCPU: 1 PID: 4115 Comm: syz-executor5 Not tainted 4.13.0-rc4+ #32\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:16 [inline]\n dump_stack+0x194/0x257 lib/dump_stack.c:52\n print_address_description+0x73/0x250 mm/kasan/report.c:252\n kasan_report_error mm/kasan/report.c:351 [inline]\n kasan_report+0x24e/0x340 mm/kasan/report.c:409\n __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430\n skb_push+0xd4/0xe0 net/core/skbuff.c:1466\n tipc_nl_compat_recv+0x833/0x18f0 net/tipc/netlink_compat.c:1209\n genl_family_rcv_msg+0x7b7/0xfb0 net/netlink/genetlink.c:598\n genl_rcv_msg+0xb2/0x140 net/netlink/genetlink.c:623\n netlink_rcv_skb+0x216/0x440 net/netlink/af_netlink.c:2397\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:634\n netlink_unicast_kernel net/netlink/af_netlink.c:1265 [inline]\n netlink_unicast+0x4e8/0x6f0 net/netlink/af_netlink.c:1291\n netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1854\n sock_sendmsg_nosec net/socket.c:633 [inline]\n sock_sendmsg+0xca/0x110 net/socket.c:643\n sock_write_iter+0x31a/0x5d0 net/socket.c:898\n call_write_iter include/linux/fs.h:1743 [inline]\n new_sync_write fs/read_write.c:457 [inline]\n __vfs_write+0x684/0x970 fs/read_write.c:470\n vfs_write+0x189/0x510 fs/read_write.c:518\n SYSC_write fs/read_write.c:565 [inline]\n SyS_write+0xef/0x220 fs/read_write.c:557\n entry_SYSCALL_64_fastpath+0x1f/0xbe\nRIP: 0033:0x4512e9\nRSP: 002b:00007f3bc8184c08 EFLAGS: 00000216 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 0000000000718000 RCX: 00000000004512e9\nRDX: 0000000000000020 RSI: 0000000020fdb000 RDI: 0000000000000006\nRBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000216 R12: 00000000004b5e76\nR13: 00007f3bc8184b48 R14: 00000000004b5e86 R15: 0000000000000000\n\nAllocated by task 4115:\n save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59\n save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n set_track mm/kasan/kasan.c:459 [inline]\n kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551\n kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489\n kmem_cache_alloc_node+0x13d/0x750 mm/slab.c:3651\n __alloc_skb+0xf1/0x740 net/core/skbuff.c:219\n alloc_skb include/linux/skbuff.h:903 [inline]\n tipc_tlv_alloc+0x26/0xb0 net/tipc/netlink_compat.c:148\n tipc_nl_compat_dumpit+0xf2/0x3c0 net/tipc/netlink_compat.c:248\n tipc_nl_compat_handle net/tipc/netlink_compat.c:1130 [inline]\n tipc_nl_compat_recv+0x756/0x18f0 net/tipc/netlink_compat.c:1199\n genl_family_rcv_msg+0x7b7/0xfb0 net/netlink/genetlink.c:598\n genl_rcv_msg+0xb2/0x140 net/netlink/genetlink.c:623\n netlink_rcv_skb+0x216/0x440 net/netlink/af_netlink.c:2397\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:634\n netlink_unicast_kernel net/netlink/af_netlink.c:1265 [inline]\n netlink_unicast+0x4e8/0x6f0 net/netlink/af_netlink.c:1291\n netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1854\n sock_sendmsg_nosec net/socket.c:633 [inline]\n sock_sendmsg+0xca/0x110 net/socket.c:643\n sock_write_iter+0x31a/0x5d0 net/socket.c:898\n call_write_iter include/linux/fs.h:1743 [inline]\n new_sync_write fs/read_write.c:457 [inline]\n __vfs_write+0x684/0x970 fs/read_write.c:470\n vfs_write+0x189/0x510 fs/read_write.c:518\n SYSC_write fs/read_write.c:565 [inline]\n SyS_write+0xef/0x220 fs/read_write.c:557\n entry_SYSCALL_64_fastpath+0x1f/0xbe\n\nFreed by task 4115:\n save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59\n save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n set_track mm/kasan/kasan.c:459 [inline]\n kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524\n __cache_free mm/slab.c:3503 [inline]\n kmem_cache_free+0x77/0x280 mm/slab.c:3763\n kfree_skbmem+0x1a1/0x1d0 net/core/skbuff.c:622\n __kfree_skb net/core/skbuff.c:682 [inline]\n kfree_skb+0x165/0x4c0 net/core/skbuff.c:699\n tipc_nl_compat_dumpit+0x36a/0x3c0 net/tipc/netlink_compat.c:260\n tipc_nl_compat_handle net/tipc/netlink_compat.c:1130 [inline]\n tipc_nl_compat_recv+0x756/0x18f0 net/tipc/netlink_compat.c:1199\n genl_family_rcv_msg+0x7b7/0xfb0 net/netlink/genetlink.c:598\n genl_rcv_msg+0xb2/0x140 net/netlink/genetlink.c:623\n netlink_rcv_skb+0x216/0x440 net/netlink/af_netlink.c:2397\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:634\n netlink_unicast_kernel net/netlink/af_netlink.c:1265 [inline]\n netlink_unicast+0x4e8/0x6f0 net/netlink/af_netlink.c:1291\n netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1854\n sock_sendmsg_nosec net/socket.c:633 [inline]\n sock_sendmsg+0xca/0x110 net/socket.c:643\n sock_write_iter+0x31a/0x5d0 net/socket.c:898\n call_write_iter include/linux/fs.h:1743 [inline]\n new_sync_write fs/read_write.c:457 [inline]\n __vfs_write+0x684/0x970 fs/read_write.c:470\n vfs_write+0x189/0x510 fs/read_write.c:518\n SYSC_write fs/read_write.c:565 [inline]\n SyS_write+0xef/0x220 fs/read_write.c:557\n entry_SYSCALL_64_fastpath+0x1f/0xbe\n\nThe buggy address belongs to the object at ffff8801c6e71dc0\n which belongs to the cache skbuff_head_cache of size 224\nThe buggy address is located 208 bytes inside of\n 224-byte region [ffff8801c6e71dc0, ffff8801c6e71ea0)\nThe buggy address belongs to the page:\npage:ffffea00071b9c40 count:1 mapcount:0 mapping:ffff8801c6e71000 index:0x0\nflags: 0x200000000000100(slab)\nraw: 0200000000000100 ffff8801c6e71000 0000000000000000 000000010000000c\nraw: ffffea0007224a20 ffff8801d98caf48 ffff8801d9e79040 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff8801c6e71d80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb\n ffff8801c6e71e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n>ffff8801c6e71e80: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc\n                         ^\n ffff8801c6e71f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff8801c6e71f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n==================================================================\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Dmitry Vyukov  <dvyukov@google.com>\nCc: Jon Maloy <jon.maloy@ericsson.com>\nCc: Ying Xue <ying.xue@windriver.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/6afa305cf62a2270f1f83c2162a7245ef2c0c84c"},{"sha":"ee88175b78083c43e3942f3727671da000b54b51","author":{"name":"Wei Wang","email":"d1a14547fbd57d80de0d744a7697de0d1b6e7be3@google.com"},"message":"ipv6: reset fn->rr_ptr when replacing route\n\n\n[ Upstream commit 383143f31d7d3525a1dbff733d52fff917f82f15 ]\n\nsyzcaller reported the following use-after-free issue in rt6_select():\nBUG: KASAN: use-after-free in rt6_select net/ipv6/route.c:755 [inline] at addr ffff8800bc6994e8\nBUG: KASAN: use-after-free in ip6_pol_route.isra.46+0x1429/0x1470 net/ipv6/route.c:1084 at addr ffff8800bc6994e8\nRead of size 4 by task syz-executor1/439628\nCPU: 0 PID: 439628 Comm: syz-executor1 Not tainted 4.3.5+ #8\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n 0000000000000000 ffff88018fe435b0 ffffffff81ca384d ffff8801d3588c00\n ffff8800bc699380 ffff8800bc699500 dffffc0000000000 ffff8801d40a47c0\n ffff88018fe435d8 ffffffff81735751 ffff88018fe43660 ffff8800bc699380\nCall Trace:\n [<ffffffff81ca384d>] __dump_stack lib/dump_stack.c:15 [inline]\n [<ffffffff81ca384d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51\nsctp: [Deprecated]: syz-executor0 (pid 439615) Use of struct sctp_assoc_value in delayed_ack socket option.\nUse struct sctp_sack_info instead\n [<ffffffff81735751>] kasan_object_err+0x21/0x70 mm/kasan/report.c:158\n [<ffffffff817359c4>] print_address_description mm/kasan/report.c:196 [inline]\n [<ffffffff817359c4>] kasan_report_error+0x1b4/0x4a0 mm/kasan/report.c:285\n [<ffffffff81735d93>] kasan_report mm/kasan/report.c:305 [inline]\n [<ffffffff81735d93>] __asan_report_load4_noabort+0x43/0x50 mm/kasan/report.c:325\n [<ffffffff82a28e39>] rt6_select net/ipv6/route.c:755 [inline]\n [<ffffffff82a28e39>] ip6_pol_route.isra.46+0x1429/0x1470 net/ipv6/route.c:1084\n [<ffffffff82a28fb1>] ip6_pol_route_output+0x81/0xb0 net/ipv6/route.c:1203\n [<ffffffff82ab0a50>] fib6_rule_action+0x1f0/0x680 net/ipv6/fib6_rules.c:95\n [<ffffffff8265cbb6>] fib_rules_lookup+0x2a6/0x7a0 net/core/fib_rules.c:223\n [<ffffffff82ab1430>] fib6_rule_lookup+0xd0/0x250 net/ipv6/fib6_rules.c:41\n [<ffffffff82a22006>] ip6_route_output+0x1d6/0x2c0 net/ipv6/route.c:1224\n [<ffffffff829e83d2>] ip6_dst_lookup_tail+0x4d2/0x890 net/ipv6/ip6_output.c:943\n [<ffffffff829e889a>] ip6_dst_lookup_flow+0x9a/0x250 net/ipv6/ip6_output.c:1079\n [<ffffffff82a9f7d8>] ip6_datagram_dst_update+0x538/0xd40 net/ipv6/datagram.c:91\n [<ffffffff82aa0978>] __ip6_datagram_connect net/ipv6/datagram.c:251 [inline]\n [<ffffffff82aa0978>] ip6_datagram_connect+0x518/0xe50 net/ipv6/datagram.c:272\n [<ffffffff82aa1313>] ip6_datagram_connect_v6_only+0x63/0x90 net/ipv6/datagram.c:284\n [<ffffffff8292f790>] inet_dgram_connect+0x170/0x1f0 net/ipv4/af_inet.c:564\n [<ffffffff82565547>] SYSC_connect+0x1a7/0x2f0 net/socket.c:1582\n [<ffffffff8256a649>] SyS_connect+0x29/0x30 net/socket.c:1563\n [<ffffffff82c72032>] entry_SYSCALL_64_fastpath+0x12/0x17\nObject at ffff8800bc699380, in cache ip6_dst_cache size: 384\n\nThe root cause of it is that in fib6_add_rt2node(), when it replaces an\nexisting route with the new one, it does not update fn->rr_ptr.\nThis commit resets fn->rr_ptr to NULL when it points to a route which is\nreplaced in fib6_add_rt2node().\n\nFixes: 27596472473a (\"ipv6: fix ECMP route replacement\")\nSigned-off-by: Wei Wang <weiwan@google.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/ee88175b78083c43e3942f3727671da000b54b51"},{"sha":"a2e82e1f2312b1f64dfa2d62e644074b76b41f3d","author":{"name":"Wei Wang","email":"d1a14547fbd57d80de0d744a7697de0d1b6e7be3@google.com"},"message":"ipv6: repair fib6 tree in failure case\n\n\n[ Upstream commit 348a4002729ccab8b888b38cbc099efa2f2a2036 ]\n\nIn fib6_add(), it is possible that fib6_add_1() picks an intermediate\nnode and sets the node's fn->leaf to NULL in order to add this new\nroute. However, if fib6_add_rt2node() fails to add the new\nroute for some reason, fn->leaf will be left as NULL and could\npotentially cause crash when fn->leaf is accessed in fib6_locate().\nThis patch makes sure fib6_repair_tree() is called to properly repair\nfn->leaf in the above failure case.\n\nHere is the syzkaller reported general protection fault in fib6_locate:\nkasan: CONFIG_KASAN_INLINE enabled\nkasan: GPF could be caused by NULL-ptr deref or user memory access\ngeneral protection fault: 0000 [#1] SMP KASAN\nModules linked in:\nCPU: 0 PID: 40937 Comm: syz-executor3 Not tainted\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\ntask: ffff8801d7d64100 ti: ffff8801d01a0000 task.ti: ffff8801d01a0000\nRIP: 0010:[<ffffffff82a3e0e1>]  [<ffffffff82a3e0e1>] __ipv6_prefix_equal64_half include/net/ipv6.h:475 [inline]\nRIP: 0010:[<ffffffff82a3e0e1>]  [<ffffffff82a3e0e1>] ipv6_prefix_equal include/net/ipv6.h:492 [inline]\nRIP: 0010:[<ffffffff82a3e0e1>]  [<ffffffff82a3e0e1>] fib6_locate_1 net/ipv6/ip6_fib.c:1210 [inline]\nRIP: 0010:[<ffffffff82a3e0e1>]  [<ffffffff82a3e0e1>] fib6_locate+0x281/0x3c0 net/ipv6/ip6_fib.c:1233\nRSP: 0018:ffff8801d01a36a8  EFLAGS: 00010202\nRAX: 0000000000000020 RBX: ffff8801bc790e00 RCX: ffffc90002983000\nRDX: 0000000000001219 RSI: ffff8801d01a37a0 RDI: 0000000000000100\nRBP: ffff8801d01a36f0 R08: 00000000000000ff R09: 0000000000000000\nR10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000001\nR13: dffffc0000000000 R14: ffff8801d01a37a0 R15: 0000000000000000\nFS:  00007f6afd68c700(0000) GS:ffff8801db400000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000004c6340 CR3: 00000000ba41f000 CR4: 00000000001426f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nStack:\n ffff8801d01a37a8 ffff8801d01a3780 ffffed003a0346f5 0000000c82a23ea0\n ffff8800b7bd7700 ffff8801d01a3780 ffff8800b6a1c940 ffffffff82a23ea0\n ffff8801d01a3920 ffff8801d01a3748 ffffffff82a223d6 ffff8801d7d64988\nCall Trace:\n [<ffffffff82a223d6>] ip6_route_del+0x106/0x570 net/ipv6/route.c:2109\n [<ffffffff82a23f9d>] inet6_rtm_delroute+0xfd/0x100 net/ipv6/route.c:3075\n [<ffffffff82621359>] rtnetlink_rcv_msg+0x549/0x7a0 net/core/rtnetlink.c:3450\n [<ffffffff8274c1d1>] netlink_rcv_skb+0x141/0x370 net/netlink/af_netlink.c:2281\n [<ffffffff82613ddf>] rtnetlink_rcv+0x2f/0x40 net/core/rtnetlink.c:3456\n [<ffffffff8274ad38>] netlink_unicast_kernel net/netlink/af_netlink.c:1206 [inline]\n [<ffffffff8274ad38>] netlink_unicast+0x518/0x750 net/netlink/af_netlink.c:1232\n [<ffffffff8274b83e>] netlink_sendmsg+0x8ce/0xc30 net/netlink/af_netlink.c:1778\n [<ffffffff82564aff>] sock_sendmsg_nosec net/socket.c:609 [inline]\n [<ffffffff82564aff>] sock_sendmsg+0xcf/0x110 net/socket.c:619\n [<ffffffff82564d62>] sock_write_iter+0x222/0x3a0 net/socket.c:834\n [<ffffffff8178523d>] new_sync_write+0x1dd/0x2b0 fs/read_write.c:478\n [<ffffffff817853f4>] __vfs_write+0xe4/0x110 fs/read_write.c:491\n [<ffffffff81786c38>] vfs_write+0x178/0x4b0 fs/read_write.c:538\n [<ffffffff817892a9>] SYSC_write fs/read_write.c:585 [inline]\n [<ffffffff817892a9>] SyS_write+0xd9/0x1b0 fs/read_write.c:577\n [<ffffffff82c71e32>] entry_SYSCALL_64_fastpath+0x12/0x17\n\nNote: there is no \"Fixes\" tag as this seems to be a bug introduced\nvery early.\n\nSigned-off-by: Wei Wang <weiwan@google.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/a2e82e1f2312b1f64dfa2d62e644074b76b41f3d"},{"sha":"59f36459dc45ecd43b0fc7ca2599529032e1f5ca","author":{"name":"Neal Cardwell","email":"58d301c70203188c35d379474c26c9cc0636a189@google.com"},"message":"tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP\n\n\n[ Upstream commit cdbeb633ca71a02b7b63bfeb94994bf4e1a0b894 ]\n\nIn some situations tcp_send_loss_probe() can realize that it's unable\nto send a loss probe (TLP), and falls back to calling tcp_rearm_rto()\nto schedule an RTO timer. In such cases, sometimes tcp_rearm_rto()\nrealizes that the RTO was eligible to fire immediately or at some\npoint in the past (delta_us <= 0). Previously in such cases\ntcp_rearm_rto() was scheduling such \"overdue\" RTOs to happen at now +\nicsk_rto, which caused needless delays of hundreds of milliseconds\n(and non-linear behavior that made reproducible testing\ndifficult). This commit changes the logic to schedule \"overdue\" RTOs\nASAP, rather than at now + icsk_rto.\n\nFixes: 6ba8a3b19e76 (\"tcp: Tail loss probe (TLP)\")\nSuggested-by: Yuchung Cheng <ycheng@google.com>\nSigned-off-by: Neal Cardwell <ncardwell@google.com>\nSigned-off-by: Yuchung Cheng <ycheng@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/59f36459dc45ecd43b0fc7ca2599529032e1f5ca"},{"sha":"09e535ff92e0dec8daef4918bc412a9c32c9e242","author":{"name":"Colin Ian King","email":"d100aa70785e45ee8deab668147d941941915c21@canonical.com"},"message":"irda: do not leak initialized list.dev to userspace\n\n\n[ Upstream commit b024d949a3c24255a7ef1a470420eb478949aa4c ]\n\nlist.dev has not been initialized and so the copy_to_user is copying\ndata from the stack back to user space which is a potential\ninformation leak. Fix this ensuring all of list is initialized to\nzero.\n\nDetected by CoverityScan, CID#1357894 (\"Uninitialized scalar variable\")\n\nSigned-off-by: Colin Ian King <colin.king@canonical.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/09e535ff92e0dec8daef4918bc412a9c32c9e242"},{"sha":"e0c5d993793887bd01b450994f85b2cd169c2faa","author":{"name":"Xin Long","email":"ed9bd6f22d2a1e0b1507d3ddc300dc248265d19a@gmail.com"},"message":"net: sched: fix NULL pointer dereference when action calls some targets\n\n\n[ Upstream commit 4f8a881acc9d1adaf1e552349a0b1df28933a04c ]\n\nAs we know in some target's checkentry it may dereference par.entryinfo\nto check entry stuff inside. But when sched action calls xt_check_target,\npar.entryinfo is set with NULL. It would cause kernel panic when calling\nsome targets.\n\nIt can be reproduce with:\n  # tc qd add dev eth1 ingress handle ffff:\n  # tc filter add dev eth1 parent ffff: u32 match u32 0 0 action xt \\\n    -j ECN --ecn-tcp-remove\n\nIt could also crash kernel when using target CLUSTERIP or TPROXY.\n\nBy now there's no proper value for par.entryinfo in ipt_init_target,\nbut it can not be set with NULL. This patch is to void all these\npanics by setting it with an ipt_entry obj with all members = 0.\n\nNote that this issue has been there since the very beginning.\n\nSigned-off-by: Xin Long <lucien.xin@gmail.com>\nAcked-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/e0c5d993793887bd01b450994f85b2cd169c2faa"},{"sha":"2683e7c1304620620ade0a950263ba439439c6da","author":{"name":"Konstantin Khlebnikov","email":"3b96b99f19643d33e1bfa1caa535c041c3608549@yandex-team.ru"},"message":"net_sched: fix order of queue length updates in qdisc_replace()\n\n\n[ Upstream commit 68a66d149a8c78ec6720f268597302883e48e9fa ]\n\nThis important to call qdisc_tree_reduce_backlog() after changing queue\nlength. Parent qdisc should deactivate class in ->qlen_notify() called from\nqdisc_tree_reduce_backlog() but this happens only if qdisc->q.qlen in zero.\n\nMissed class deactivations leads to crashes/warnings at picking packets\nfrom empty qdisc and corrupting state at reactivating this class in future.\n\nSigned-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>\nFixes: 86a7996cc8a0 (\"net_sched: introduce qdisc_replace() helper\")\nAcked-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/2683e7c1304620620ade0a950263ba439439c6da"},{"sha":"8f1f3c3b06a2d70d8f149e1a3e126505e73a3906","author":{"name":"Tomas Winkler","email":"002a8af089113a6510dbc00453be711ac350fd80@intel.com"},"message":"mei: me: add broxton pci device ids\n\ncommit dd16f6cdeb4e02a728863d3cf99aaab352f0d761 upstream.\n\nAdd device ids for Broxton SoC based devices.\n\nSigned-off-by: Tomas Winkler <tomas.winkler@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/8f1f3c3b06a2d70d8f149e1a3e126505e73a3906"},{"sha":"48213f3d3f950f10d47590954a38d7a33ef9e4b2","author":{"name":"Tomas Winkler","email":"002a8af089113a6510dbc00453be711ac350fd80@intel.com"},"message":"mei: me: add lewisburg device ids\n\ncommit 9ff2007bea1f1bfc53ac0bc7ccf8200bb275fd52 upstream.\n\nAdd MEI Lewisburg PCH IDs for Purley based workstations.\n\nSigned-off-by: Alexander Usyskin <alexander.usyskin@intel.com>\nSigned-off-by: Tomas Winkler <tomas.winkler@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/48213f3d3f950f10d47590954a38d7a33ef9e4b2"},{"sha":"91697232cbb3ab553e7931d0869d966a3a2bee8a","author":{"name":"Aaron Ma","email":"6d75ab49fa4401d16749457e532362eb5fdb78e3@canonical.com"},"message":"Input: trackpoint - add new trackpoint firmware ID\n\ncommit ec667683c532c93fb41e100e5d61a518971060e2 upstream.\n\nSynaptics add new TP firmware ID: 0x2 and 0x3, for now both lower 2 bits\nare indicated as TP. Change the constant to bitwise values.\n\nThis makes trackpoint to be recognized on Lenovo Carbon X1 Gen5 instead\nof it being identified as \"PS/2 Generic Mouse\".\n\nSigned-off-by: Aaron Ma <aaron.ma@canonical.com>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/91697232cbb3ab553e7931d0869d966a3a2bee8a"},{"sha":"72bd3caed5152a956a4d24c15d6129d4507a13e5","author":{"name":"KT Liao","email":"8cbe3708fba0ad3ba0de70fc8acb4885a3f33fba@emc.com.tw"},"message":"Input: elan_i2c - add ELAN0602 ACPI ID to support Lenovo Yoga310\n\ncommit 1d2226e45040ed4aee95b633cbd64702bf7fc2a1 upstream.\n\nAdd ELAN0602 to the list of known ACPI IDs to enable support for ELAN\ntouchpads found in Lenovo Yoga310.\n\nSigned-off-by: KT Liao <kt.liao@emc.com.tw>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/72bd3caed5152a956a4d24c15d6129d4507a13e5"},{"sha":"f288f8d01b1de76ef17b7c28ff905b722b129b57","author":{"name":"Takashi Iwai","email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de"},"message":"ALSA: core: Fix unexpected error at replacing user TLV\n\ncommit 88c54cdf61f508ebcf8da2d819f5dfc03e954d1d upstream.\n\nWhen user tries to replace the user-defined control TLV, the kernel\nchecks the change of its content via memcmp().  The problem is that\nthe kernel passes the return value from memcmp() as is.  memcmp()\ngives a non-zero negative value depending on the comparison result,\nand this shall be recognized as an error code.\n\nThe patch covers that corner-case, return 1 properly for the changed\nTLV.\n\nFixes: 8aa9b586e420 (\"[ALSA] Control API - more robust TLV implementation\")\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/f288f8d01b1de76ef17b7c28ff905b722b129b57"},{"sha":"8d92fbd043552c78d426a6a62c5eae13e4c36019","author":{"name":"Takashi Iwai","email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de"},"message":"ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978)\n\ncommit bbba6f9d3da357bbabc6fda81e99ff5584500e76 upstream.\n\nLenovo G50-70 (17aa:3978) with Conexant codec chip requires the\nsimilar workaround for the inverted stereo dmic like other Lenovo\nmodels.\n\nBugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1020657\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/dndrmwn/android_kernel_xiaomi_msm8998/commits/8d92fbd043552c78d426a6a62c5eae13e4c36019"}]}
{"actor":{"display_login":"dndrmwn"}}