{"push_id":2308313412,"size":23,"distinct_size":0,"ref":"refs/heads/standard/tiny/intel","head":"54261bbd80db809bb3ff831370a8e27f968f0941","before":"9e52366a5d278c4b0108b8bf3bf68743cd86413f","commits":[{"sha":"d381bcb57a3fb092f54ac5af4c0c53149a0dd2f2","author":{"name":"Zhenbo Gao","email":"0f29fc8b330e311450cabe83f2778e28cc996ad2@windriver.com"},"message":"i2c: i801: correct the value of SBREG_SMBCTRL for DNV platform\n\nThe hardware watchdog doesn't work well for Denverton platform.\n\nThe value of SBREG_SMBCTRL should be set to 0xcf000c according\nto the document C3000_EDS_Rev2_0_review.pdf provided by Intel.\n(Section no: 59.6.2 General Control (GC), Page no:2772)\n\nThe hardware watchdog can work well with this modification.\n\nSigned-off-by: Zhenbo Gao <zhenbo.gao@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/d381bcb57a3fb092f54ac5af4c0c53149a0dd2f2"},{"sha":"c72b3d3af44f98a8fc9dc100135967ac2ccbcc27","author":{"name":"David Howells","email":"358fdf7bce8223edb2a0d846104bf62a286894d5@redhat.com"},"message":"assoc_array: Fix a buggy node-splitting case\n\ncommit ea6789980fdaa610d7eb63602c746bf6ec70cd2b upstream\n\nThis fixes CVE-2017-12193.\n\nFix a case in the assoc_array implementation in which a new leaf is\nadded that needs to go into a node that happens to be full, where the\nexisting leaves in that node cluster together at that level to the\nexclusion of new leaf.\n\nWhat needs to happen is that the existing leaves get moved out to a new\nnode, N1, at level + 1 and the existing node needs replacing with one,\nN0, that has pointers to the new leaf and to N1.\n\nThe code that tries to do this gets this wrong in two ways:\n\n (1) The pointer that should've pointed from N0 to N1 is set to point\n     recursively to N0 instead.\n\n (2) The backpointer from N0 needs to be set correctly in the case N0 is\n     either the root node or reached through a shortcut.\n\nFix this by removing this path and using the split_node path instead,\nwhich achieves the same end, but in a more general way (thanks to Eric\nBiggers for spotting the redundancy).\n\nThe problem manifests itself as:\n\n  BUG: unable to handle kernel NULL pointer dereference at 0000000000000010\n  IP: assoc_array_apply_edit+0x59/0xe5\n\nFixes: 3cb989501c26 (\"Add a generic associative array implementation.\")\nReported-and-tested-by: WU Fan <u3536072@connect.hku.hk>\nSigned-off-by: David Howells <dhowells@redhat.com>\nCc: stable@vger.kernel.org [v3.13-rc1+]\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Liu Haitao <haitao.liu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/c72b3d3af44f98a8fc9dc100135967ac2ccbcc27"},{"sha":"5f49005f1695c31fef529d270790d29186fc4e76","author":{"name":"Eric Biggers","email":"0106d512ed1cb672be29d4b167a07ead51709fba@google.com"},"message":"fork: fix incorrect fput of ->exe_file causing use-after-free\n\ncommit 2b7e8665b4ff51c034c55df3cff76518d1a9ee3a upstream\n\nCommit 7c051267931a (\"mm, fork: make dup_mmap wait for mmap_sem for\nwrite killable\") made it possible to kill a forking task while it is\nwaiting to acquire its ->mmap_sem for write, in dup_mmap().\n\nHowever, it was overlooked that this introduced an new error path before\na reference is taken on the mm_struct's ->exe_file.  Since the\n->exe_file of the new mm_struct was already set to the old ->exe_file by\nthe memcpy() in dup_mm(), it was possible for the mmput() in the error\npath of dup_mm() to drop a reference to ->exe_file which was never\ntaken.\n\nThis caused the struct file to later be freed prematurely.\n\nFix it by updating mm_init() to NULL out the ->exe_file, in the same\nplace it clears other things like the list of mmaps.\n\nThis bug was found by syzkaller.  It can be reproduced using the\nfollowing C program:\n\n    #define _GNU_SOURCE\n    #include <pthread.h>\n    #include <stdlib.h>\n    #include <sys/mman.h>\n    #include <sys/syscall.h>\n    #include <sys/wait.h>\n    #include <unistd.h>\n\n    static void *mmap_thread(void *_arg)\n    {\n        for (;;) {\n            mmap(NULL, 0x1000000, PROT_READ,\n                 MAP_POPULATE|MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);\n        }\n    }\n\n    static void *fork_thread(void *_arg)\n    {\n        usleep(rand() % 10000);\n        fork();\n    }\n\n    int main(void)\n    {\n        fork();\n        fork();\n        fork();\n        for (;;) {\n            if (fork() == 0) {\n                pthread_t t;\n\n                pthread_create(&t, NULL, mmap_thread, NULL);\n                pthread_create(&t, NULL, fork_thread, NULL);\n                usleep(rand() % 10000);\n                syscall(__NR_exit_group, 0);\n            }\n            wait(NULL);\n        }\n    }\n\nNo special kernel config options are needed.  It usually causes a NULL\npointer dereference in __remove_shared_vm_struct() during exit, or in\ndup_mmap() (which is usually inlined into copy_process()) during fork.\nBoth are due to a vm_area_struct's ->vm_file being used after it's\nalready been freed.\n\nGoogle Bug Id: 64772007\n\nLink: http://lkml.kernel.org/r/20170823211408.31198-1-ebiggers3@gmail.com\nFixes: 7c051267931a (\"mm, fork: make dup_mmap wait for mmap_sem for write killable\")\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nTested-by: Mark Rutland <mark.rutland@arm.com>\nAcked-by: Michal Hocko <mhocko@suse.com>\nCc: Dmitry Vyukov <dvyukov@google.com>\nCc: Ingo Molnar <mingo@kernel.org>\nCc: Konstantin Khlebnikov <koct9i@gmail.com>\nCc: Oleg Nesterov <oleg@redhat.com>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Vlastimil Babka <vbabka@suse.cz>\nCc: <stable@vger.kernel.org>\t[v4.7+]\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Jibin Xu <jibin.xu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/5f49005f1695c31fef529d270790d29186fc4e76"},{"sha":"58252e843dd3bcbbd52ec3a3e4d8502b64226262","author":{"name":"Eric Biggers","email":"0106d512ed1cb672be29d4b167a07ead51709fba@google.com"},"message":"x86/mm: Fix use-after-free of ldt_struct\n\ncommit ccd5b3235180eef3cfec337df1c8554ab151b5cc upstream\n\nThe following commit:\n\n  39a0526fb3f7 (\"x86/mm: Factor out LDT init from context init\")\n\nrenamed init_new_context() to init_new_context_ldt() and added a new\ninit_new_context() which calls init_new_context_ldt().  However, the\nerror code of init_new_context_ldt() was ignored.  Consequently, if a\nmemory allocation in alloc_ldt_struct() failed during a fork(), the\n->context.ldt of the new task remained the same as that of the old task\n(due to the memcpy() in dup_mm()).  ldt_struct's are not intended to be\nshared, so a use-after-free occurred after one task exited.\n\nFix the bug by making init_new_context() pass through the error code of\ninit_new_context_ldt().\n\nThis bug was found by syzkaller, which encountered the following splat:\n\n    BUG: KASAN: use-after-free in free_ldt_struct.part.2+0x10a/0x150 arch/x86/kernel/ldt.c:116\n    Read of size 4 at addr ffff88006d2cb7c8 by task kworker/u9:0/3710\n\n    CPU: 1 PID: 3710 Comm: kworker/u9:0 Not tainted 4.13.0-rc4-next-20170811 #2\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n    Call Trace:\n     __dump_stack lib/dump_stack.c:16 [inline]\n     dump_stack+0x194/0x257 lib/dump_stack.c:52\n     print_address_description+0x73/0x250 mm/kasan/report.c:252\n     kasan_report_error mm/kasan/report.c:351 [inline]\n     kasan_report+0x24e/0x340 mm/kasan/report.c:409\n     __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429\n     free_ldt_struct.part.2+0x10a/0x150 arch/x86/kernel/ldt.c:116\n     free_ldt_struct arch/x86/kernel/ldt.c:173 [inline]\n     destroy_context_ldt+0x60/0x80 arch/x86/kernel/ldt.c:171\n     destroy_context arch/x86/include/asm/mmu_context.h:157 [inline]\n     __mmdrop+0xe9/0x530 kernel/fork.c:889\n     mmdrop include/linux/sched/mm.h:42 [inline]\n     exec_mmap fs/exec.c:1061 [inline]\n     flush_old_exec+0x173c/0x1ff0 fs/exec.c:1291\n     load_elf_binary+0x81f/0x4ba0 fs/binfmt_elf.c:855\n     search_binary_handler+0x142/0x6b0 fs/exec.c:1652\n     exec_binprm fs/exec.c:1694 [inline]\n     do_execveat_common.isra.33+0x1746/0x22e0 fs/exec.c:1816\n     do_execve+0x31/0x40 fs/exec.c:1860\n     call_usermodehelper_exec_async+0x457/0x8f0 kernel/umh.c:100\n     ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431\n\n    Allocated by task 3700:\n     save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59\n     save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n     set_track mm/kasan/kasan.c:459 [inline]\n     kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551\n     kmem_cache_alloc_trace+0x136/0x750 mm/slab.c:3627\n     kmalloc include/linux/slab.h:493 [inline]\n     alloc_ldt_struct+0x52/0x140 arch/x86/kernel/ldt.c:67\n     write_ldt+0x7b7/0xab0 arch/x86/kernel/ldt.c:277\n     sys_modify_ldt+0x1ef/0x240 arch/x86/kernel/ldt.c:307\n     entry_SYSCALL_64_fastpath+0x1f/0xbe\n\n    Freed by task 3700:\n     save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59\n     save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n     set_track mm/kasan/kasan.c:459 [inline]\n     kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524\n     __cache_free mm/slab.c:3503 [inline]\n     kfree+0xca/0x250 mm/slab.c:3820\n     free_ldt_struct.part.2+0xdd/0x150 arch/x86/kernel/ldt.c:121\n     free_ldt_struct arch/x86/kernel/ldt.c:173 [inline]\n     destroy_context_ldt+0x60/0x80 arch/x86/kernel/ldt.c:171\n     destroy_context arch/x86/include/asm/mmu_context.h:157 [inline]\n     __mmdrop+0xe9/0x530 kernel/fork.c:889\n     mmdrop include/linux/sched/mm.h:42 [inline]\n     __mmput kernel/fork.c:916 [inline]\n     mmput+0x541/0x6e0 kernel/fork.c:927\n     copy_process.part.36+0x22e1/0x4af0 kernel/fork.c:1931\n     copy_process kernel/fork.c:1546 [inline]\n     _do_fork+0x1ef/0xfb0 kernel/fork.c:2025\n     SYSC_clone kernel/fork.c:2135 [inline]\n     SyS_clone+0x37/0x50 kernel/fork.c:2129\n     do_syscall_64+0x26c/0x8c0 arch/x86/entry/common.c:287\n     return_from_SYSCALL_64+0x0/0x7a\n\nHere is a C reproducer:\n\n    #include <asm/ldt.h>\n    #include <pthread.h>\n    #include <signal.h>\n    #include <stdlib.h>\n    #include <sys/syscall.h>\n    #include <sys/wait.h>\n    #include <unistd.h>\n\n    static void *fork_thread(void *_arg)\n    {\n        fork();\n    }\n\n    int main(void)\n    {\n        struct user_desc desc = { .entry_number = 8191 };\n\n        syscall(__NR_modify_ldt, 1, &desc, sizeof(desc));\n\n        for (;;) {\n            if (fork() == 0) {\n                pthread_t t;\n\n                srand(getpid());\n                pthread_create(&t, NULL, fork_thread, NULL);\n                usleep(rand() % 10000);\n                syscall(__NR_exit_group, 0);\n            }\n            wait(NULL);\n        }\n    }\n\nNote: the reproducer takes advantage of the fact that alloc_ldt_struct()\nmay use vmalloc() to allocate a large ->entries array, and after\ncommit:\n\n  5d17a73a2ebe (\"vmalloc: back off when the current task is killed\")\n\nit is possible for userspace to fail a task's vmalloc() by\nsending a fatal signal, e.g. via exit_group().  It would be more\ndifficult to reproduce this bug on kernels without that commit.\n\nThis bug only affected kernels with CONFIG_MODIFY_LDT_SYSCALL=y.\n\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nAcked-by: Dave Hansen <dave.hansen@linux.intel.com>\nCc: <stable@vger.kernel.org> [v4.6+]\nCc: Andrew Morton <akpm@linux-foundation.org>\nCc: Andy Lutomirski <luto@amacapital.net>\nCc: Borislav Petkov <bp@alien8.de>\nCc: Brian Gerst <brgerst@gmail.com>\nCc: Christoph Hellwig <hch@lst.de>\nCc: Denys Vlasenko <dvlasenk@redhat.com>\nCc: Dmitry Vyukov <dvyukov@google.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Michal Hocko <mhocko@suse.com>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Rik van Riel <riel@redhat.com>\nCc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: linux-mm@kvack.org\nFixes: 39a0526fb3f7 (\"x86/mm: Factor out LDT init from context init\")\nLink: http://lkml.kernel.org/r/20170824175029.76040-1-ebiggers3@gmail.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Liu Haitao <haitao.liu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/58252e843dd3bcbbd52ec3a3e4d8502b64226262"},{"sha":"46dddc5e8a76172d8c075da1e35baefe9f216b0a","author":{"name":"Herbert Xu","email":"b06c1e85ee1d40a691f7eaf317640579555a220e@gondor.apana.org.au"},"message":"ipsec: Fix aborted xfrm policy dump crash\n\ncommit 1137b5e2529a8f5ca8ee709288ecba3e68044df2 upstream\n\nAn independent security researcher, Mohamed Ghannam, has reported\nthis vulnerability to Beyond Security's SecuriTeam Secure Disclosure\nprogram.\n\nThe xfrm_dump_policy_done function expects xfrm_dump_policy to\nhave been called at least once or it will crash.  This can be\ntriggered if a dump fails because the target socket's receive\nbuffer is full.\n\nThis patch fixes it by using the cb->start mechanism to ensure that\nthe initialisation is always done regardless of the buffer situation.\n\nFixes: 12a169e7d8f4 (\"ipsec: Put dumpers on the dump list\")\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: Jibin Xu <jibin.xu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/46dddc5e8a76172d8c075da1e35baefe9f216b0a"},{"sha":"78466101b183ea7feb176018a5cc4273d09dce6f","author":{"name":"Andrew Honig","email":"c692ba18eb9ed9f429f2deaa8a1df193e9fbce8a@google.com"},"message":"KVM: VMX: remove I/O port 0x80 bypass on Intel hosts\n\ncommit d59d51f088014f25c2562de59b9abff4f42a7468 upstream\n\nThis fixes CVE-2017-1000407.\n\nKVM allows guests to directly access I/O port 0x80 on Intel hosts.  If\nthe guest floods this port with writes it generates exceptions and\ninstability in the host kernel, leading to a crash.  With this change\nguest writes to port 0x80 on Intel will behave the same as they\ncurrently behave on AMD systems.\n\nPrevent the flooding by removing the code that sets port 0x80 as a\npassthrough port.  This is essentially the same as upstream patch\n99f85a28a78e96d28907fe036e1671a218fee597, except that patch was\nfor AMD chipsets and this patch is for Intel.\n\nSigned-off-by: Andrew Honig <ahonig@google.com>\nSigned-off-by: Jim Mattson <jmattson@google.com>\nFixes: fdef3ad1b386 (\"KVM: VMX: Enable io bitmaps to avoid IO port 0x80 VMEXITs\")\nCc: <stable@vger.kernel.org>\nSigned-off-by: Radim Krčmář <rkrcmar@redhat.com>\n[op: adjusted context for kernel versions 4.1, 4.8]\nSigned-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/78466101b183ea7feb176018a5cc4273d09dce6f"},{"sha":"0f8ed9b1a5a366734e3c9b3e6ab27b8648d5ae74","author":{"name":"Haiqing Bai","email":"3d4861e8da7f80675633b5a7666463502bb60ee3@windriver.com"},"message":"net: ipv4: fix for a race condition in raw_sendmsg\n\ncommit 8f659a03a0ba9289b9aeb9b4470e6fb263d6f483 upstream\n\ninet->hdrincl is racy, and could lead to uninitialized stack pointer\nusage, so its value should be read only once.\n\nFixes: c008ba5bdc9f (\"ipv4: Avoid reading user iov twice after raw_probe_proto_opt\")\nSigned-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>\nReviewed-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Haiqing Bai <Haiqing.Bai@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/0f8ed9b1a5a366734e3c9b3e6ab27b8648d5ae74"},{"sha":"b2d18e1846a0e6dfdf4e8d3bba3329d8a98b38cd","author":{"name":"David Howells","email":"358fdf7bce8223edb2a0d846104bf62a286894d5@redhat.com"},"message":"KEYS: don't let add_key() update an uninstantiated key\n\ncommit 60ff5b2f547af3828aebafd54daded44cfb0807a upstream\n\nCurrently, when passed a key that already exists, add_key() will call the\nkey's ->update() method if such exists.  But this is heavily broken in the\ncase where the key is uninstantiated because it doesn't call\n__key_instantiate_and_link().  Consequently, it doesn't do most of the\nthings that are supposed to happen when the key is instantiated, such as\nsetting the instantiation state, clearing KEY_FLAG_USER_CONSTRUCT and\nawakening tasks waiting on it, and incrementing key->user->nikeys.\n\nIt also never takes key_construction_mutex, which means that\n->instantiate() can run concurrently with ->update() on the same key.  In\nthe case of the \"user\" and \"logon\" key types this causes a memory leak, at\nbest.  Maybe even worse, the ->update() methods of the \"encrypted\" and\n\"trusted\" key types actually just dereference a NULL pointer when passed an\nuninstantiated key.\n\nChange key_create_or_update() to wait interruptibly for the key to finish\nconstruction before continuing.\n\nThis patch only affects *uninstantiated* keys.  For now we still allow a\nnegatively instantiated key to be updated (thereby positively\ninstantiating it), although that's broken too (the next patch fixes it)\nand I'm not sure that anyone actually uses that functionality either.\n\nHere is a simple reproducer for the bug using the \"encrypted\" key type\n(requires CONFIG_ENCRYPTED_KEYS=y), though as noted above the bug\npertained to more than just the \"encrypted\" key type:\n\n    #include <stdlib.h>\n    #include <unistd.h>\n    #include <keyutils.h>\n\n    int main(void)\n    {\n        int ringid = keyctl_join_session_keyring(NULL);\n\n        if (fork()) {\n            for (;;) {\n                const char payload[] = \"update user:foo 32\";\n\n                usleep(rand() % 10000);\n                add_key(\"encrypted\", \"desc\", payload, sizeof(payload), ringid);\n                keyctl_clear(ringid);\n            }\n        } else {\n            for (;;)\n                request_key(\"encrypted\", \"desc\", \"callout_info\", ringid);\n        }\n    }\n\nIt causes:\n\n    BUG: unable to handle kernel NULL pointer dereference at 0000000000000018\n    IP: encrypted_update+0xb0/0x170\n    PGD 7a178067 P4D 7a178067 PUD 77269067 PMD 0\n    PREEMPT SMP\n    CPU: 0 PID: 340 Comm: reproduce Tainted: G      D         4.14.0-rc1-00025-g428490e38b2e #796\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n    task: ffff8a467a39a340 task.stack: ffffb15c40770000\n    RIP: 0010:encrypted_update+0xb0/0x170\n    RSP: 0018:ffffb15c40773de8 EFLAGS: 00010246\n    RAX: 0000000000000000 RBX: ffff8a467a275b00 RCX: 0000000000000000\n    RDX: 0000000000000005 RSI: ffff8a467a275b14 RDI: ffffffffb742f303\n    RBP: ffffb15c40773e20 R08: 0000000000000000 R09: ffff8a467a275b17\n    R10: 0000000000000020 R11: 0000000000000000 R12: 0000000000000000\n    R13: 0000000000000000 R14: ffff8a4677057180 R15: ffff8a467a275b0f\n    FS:  00007f5d7fb08700(0000) GS:ffff8a467f200000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    CR2: 0000000000000018 CR3: 0000000077262005 CR4: 00000000001606f0\n    Call Trace:\n     key_create_or_update+0x2bc/0x460\n     SyS_add_key+0x10c/0x1d0\n     entry_SYSCALL_64_fastpath+0x1f/0xbe\n    RIP: 0033:0x7f5d7f211259\n    RSP: 002b:00007ffed03904c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8\n    RAX: ffffffffffffffda RBX: 000000003b2a7955 RCX: 00007f5d7f211259\n    RDX: 00000000004009e4 RSI: 00000000004009ff RDI: 0000000000400a04\n    RBP: 0000000068db8bad R08: 000000003b2a7955 R09: 0000000000000004\n    R10: 000000000000001a R11: 0000000000000246 R12: 0000000000400868\n    R13: 00007ffed03905d0 R14: 0000000000000000 R15: 0000000000000000\n    Code: 77 28 e8 64 34 1f 00 45 31 c0 31 c9 48 8d 55 c8 48 89 df 48 8d 75 d0 e8 ff f9 ff ff 85 c0 41 89 c4 0f 88 84 00 00 00 4c 8b 7d c8 <49> 8b 75 18 4c 89 ff e8 24 f8 ff ff 85 c0 41 89 c4 78 6d 49 8b\n    RIP: encrypted_update+0xb0/0x170 RSP: ffffb15c40773de8\n    CR2: 0000000000000018\n\nCc: <stable@vger.kernel.org> # v2.6.12+\nReported-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\ncc: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Qi Hou <qi.hou@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/b2d18e1846a0e6dfdf4e8d3bba3329d8a98b38cd"},{"sha":"3972a055cdf1ad26b59c93843af8744356722a90","author":{"name":"lwang1","email":"def3e05ca5992ee0316444c5b97de48c5ef11c61@windriver.com"},"message":"usb: usbtest: fix NULL pointer dereference\n\ncommit 7c80f9e4a588f1925b07134bb2e3689335f6c6d8 upstream\n\nIf the usbtest driver encounters a device with an IN bulk endpoint but\nno OUT bulk endpoint, it will try to dereference a NULL pointer\n(out->desc.bEndpointAddress).  The problem can be solved by adding a\nmissing test.\n\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>\nSigned-off-by: lwang1 <li.wang@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/3972a055cdf1ad26b59c93843af8744356722a90"},{"sha":"63578302b00afcd6ccc02ff2fad84517b6e69f2d","author":{"name":"Alan Stern","email":"5c4cbde65af01ad64f5b2177d0cd78ab5b01e5a1@rowland.harvard.edu"},"message":"USB: core: prevent malicious bNumInterfaces overflow\n\ncommit 48a4ff1c7bb5a32d2e396b03132d20d552c0eca7 upstream\n\nA malicious USB device with crafted descriptors can cause the kernel\nto access unallocated memory by setting the bNumInterfaces value too\nhigh in a configuration descriptor.  Although the value is adjusted\nduring parsing, this adjustment is skipped in one of the error return\npaths.\n\nThis patch prevents the problem by setting bNumInterfaces to 0\ninitially.  The existing code already sets it to the proper value\nafter parsing is complete.\n\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nCC: <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/63578302b00afcd6ccc02ff2fad84517b6e69f2d"},{"sha":"8c4a162b639a41c446bf7d0e4aee3b69162b5db0","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor\n\ncommit bfc81a8bc18e3c4ba0cbaa7666ff76be2f998991 upstream\n\nWhen a USB-audio device receives a maliciously adjusted or corrupted\nbuffer descriptor, the USB-audio driver may access an out-of-bounce\nvalue at its parser.  This was detected by syzkaller, something like:\n\n  BUG: KASAN: slab-out-of-bounds in usb_audio_probe+0x27b2/0x2ab0\n  Read of size 1 at addr ffff88006b83a9e8 by task kworker/0:1/24\n  CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.14.0-rc1-42251-gebb2c2437d80 #224\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n  Workqueue: usb_hub_wq hub_event\n  Call Trace:\n   __dump_stack lib/dump_stack.c:16\n   dump_stack+0x292/0x395 lib/dump_stack.c:52\n   print_address_description+0x78/0x280 mm/kasan/report.c:252\n   kasan_report_error mm/kasan/report.c:351\n   kasan_report+0x22f/0x340 mm/kasan/report.c:409\n   __asan_report_load1_noabort+0x19/0x20 mm/kasan/report.c:427\n   snd_usb_create_streams sound/usb/card.c:248\n   usb_audio_probe+0x27b2/0x2ab0 sound/usb/card.c:605\n   usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361\n   really_probe drivers/base/dd.c:413\n   driver_probe_device+0x610/0xa00 drivers/base/dd.c:557\n   __device_attach_driver+0x230/0x290 drivers/base/dd.c:653\n   bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463\n   __device_attach+0x26e/0x3d0 drivers/base/dd.c:710\n   device_initial_probe+0x1f/0x30 drivers/base/dd.c:757\n   bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523\n   device_add+0xd0b/0x1660 drivers/base/core.c:1835\n   usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932\n   generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174\n   usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266\n   really_probe drivers/base/dd.c:413\n   driver_probe_device+0x610/0xa00 drivers/base/dd.c:557\n   __device_attach_driver+0x230/0x290 drivers/base/dd.c:653\n   bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463\n   __device_attach+0x26e/0x3d0 drivers/base/dd.c:710\n   device_initial_probe+0x1f/0x30 drivers/base/dd.c:757\n   bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523\n   device_add+0xd0b/0x1660 drivers/base/core.c:1835\n   usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457\n   hub_port_connect drivers/usb/core/hub.c:4903\n   hub_port_connect_change drivers/usb/core/hub.c:5009\n   port_event drivers/usb/core/hub.c:5115\n   hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195\n   process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119\n   worker_thread+0x221/0x1850 kernel/workqueue.c:2253\n   kthread+0x3a1/0x470 kernel/kthread.c:231\n   ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431\n\nThis patch adds the checks of out-of-bounce accesses at appropriate\nplaces and bails out when it goes out of the given buffer.\n\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Qi Hou <qi.hou@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/8c4a162b639a41c446bf7d0e4aee3b69162b5db0"},{"sha":"ef1937d8db903776054afe9ed16ea89f1ffcf0e9","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: usb-audio: Kill stray URB at exiting\n\ncommit 124751d5e63c823092060074bd0abaae61aaa9c4 upstream\n\nUSB-audio driver may leave a stray URB for the mixer interrupt when it\nexits by some error during probe.  This leads to a use-after-free\nerror as spotted by syzkaller like:\n  ==================================================================\n  BUG: KASAN: use-after-free in snd_usb_mixer_interrupt+0x604/0x6f0\n  Call Trace:\n   <IRQ>\n   __dump_stack lib/dump_stack.c:16\n   dump_stack+0x292/0x395 lib/dump_stack.c:52\n   print_address_description+0x78/0x280 mm/kasan/report.c:252\n   kasan_report_error mm/kasan/report.c:351\n   kasan_report+0x23d/0x350 mm/kasan/report.c:409\n   __asan_report_load8_noabort+0x19/0x20 mm/kasan/report.c:430\n   snd_usb_mixer_interrupt+0x604/0x6f0 sound/usb/mixer.c:2490\n   __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779\n   ....\n\n  Allocated by task 1484:\n   save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59\n   save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n   set_track mm/kasan/kasan.c:459\n   kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551\n   kmem_cache_alloc_trace+0x11e/0x2d0 mm/slub.c:2772\n   kmalloc ./include/linux/slab.h:493\n   kzalloc ./include/linux/slab.h:666\n   snd_usb_create_mixer+0x145/0x1010 sound/usb/mixer.c:2540\n   create_standard_mixer_quirk+0x58/0x80 sound/usb/quirks.c:516\n   snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560\n   create_composite_quirk+0x1c4/0x3e0 sound/usb/quirks.c:59\n   snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560\n   usb_audio_probe+0x1040/0x2c10 sound/usb/card.c:618\n   ....\n\n  Freed by task 1484:\n   save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59\n   save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n   set_track mm/kasan/kasan.c:459\n   kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:524\n   slab_free_hook mm/slub.c:1390\n   slab_free_freelist_hook mm/slub.c:1412\n   slab_free mm/slub.c:2988\n   kfree+0xf6/0x2f0 mm/slub.c:3919\n   snd_usb_mixer_free+0x11a/0x160 sound/usb/mixer.c:2244\n   snd_usb_mixer_dev_free+0x36/0x50 sound/usb/mixer.c:2250\n   __snd_device_free+0x1ff/0x380 sound/core/device.c:91\n   snd_device_free_all+0x8f/0xe0 sound/core/device.c:244\n   snd_card_do_free sound/core/init.c:461\n   release_card_device+0x47/0x170 sound/core/init.c:181\n   device_release+0x13f/0x210 drivers/base/core.c:814\n   ....\n\nActually such a URB is killed properly at disconnection when the\ndevice gets probed successfully, and what we need is to apply it for\nthe error-path, too.\n\nIn this patch, we apply snd_usb_mixer_disconnect() at releasing.\nAlso introduce a new flag, disconnected, to struct usb_mixer_interface\nfor not performing the disconnection procedure twice.\n\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Qi Hou <qi.hou@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/ef1937d8db903776054afe9ed16ea89f1ffcf0e9"},{"sha":"9e21e1bc8fd3aea784f8416fb763277ed4261d41","author":{"name":"Mohamed Ghannam","email":"5eb3f933fdfc6698c763351d205c026ea603aa21@gmail.com"},"message":"dccp: CVE-2017-8824: use-after-free in DCCP code\n\ncommit 69c64866ce072dea1d1e59a0d61e0f66c0dffb76 upstream\n\nWhenever the sock object is in DCCP_CLOSED state,\ndccp_disconnect() must free dccps_hc_tx_ccid and\ndccps_hc_rx_ccid and set to NULL.\n\nSigned-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>\nReviewed-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jibin Xu <jibin.xu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/9e21e1bc8fd3aea784f8416fb763277ed4261d41"},{"sha":"13d28c06ed9f077ed00af55ddbf4dfef28059dc1","author":{"name":"Johan Hovold","email":"c5aaa0c362db47011b825595d6a432662259e2f1@kernel.org"},"message":"cx231xx-cards: fix NULL-deref on missing association descriptor\n\ncommit 6c3b047fa2d2286d5e438bcb470c7b1a49f415f6 upstream\n\nMake sure to check that we actually have an Interface Association\nDescriptor before dereferencing it during probe to avoid dereferencing a\nNULL-pointer.\n\nFixes: e0d3bafd0258 (\"V4L/DVB (10954): Add cx231xx USB driver\")\n\nCc: stable <stable@vger.kernel.org>     # 2.6.30\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: Hans Verkuil <hans.verkuil@cisco.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>\nSigned-off-by: Wenlin Kang <wenlin.kang@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/13d28c06ed9f077ed00af55ddbf4dfef28059dc1"},{"sha":"c6b048b2757e37bd99915c86f102911a05a7665b","author":{"name":"Kevin Cernekee","email":"3219fdf39e3ba5f552e432c31cc96159991751aa@chromium.org"},"message":"netfilter: nfnetlink_cthelper: Add missing permission checks\n\ncommit \t4b380c42f7d00a395feede754f0bc2292eebe6e5 upstream\n\nThe capability check in nfnetlink_rcv() verifies that the caller\nhas CAP_NET_ADMIN in the namespace that \"owns\" the netlink socket.\nHowever, nfnl_cthelper_list is shared by all net namespaces on the\nsystem.  An unprivileged user can create user and net namespaces\nin which he holds CAP_NET_ADMIN to bypass the netlink_net_capable()\ncheck:\n\n    $ nfct helper list\n    nfct v1.4.4: netlink error: Operation not permitted\n    $ vpnns -- nfct helper list\n    {\n            .name = ftp,\n            .queuenum = 0,\n            .l3protonum = 2,\n            .l4protonum = 6,\n            .priv_data_len = 24,\n            .status = enabled,\n    };\n\nAdd capable() checks in nfnetlink_cthelper, as this is cleaner than\ntrying to generalize the solution.\n\nSigned-off-by: Kevin Cernekee <cernekee@chromium.org>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Liu Haitao <haitao.liu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/c6b048b2757e37bd99915c86f102911a05a7665b"},{"sha":"4ce81f801906e5e860eb715fe8ee037c393d1638","author":{"name":"Kevin Cernekee","email":"3219fdf39e3ba5f552e432c31cc96159991751aa@chromium.org"},"message":"netlink: Add netns check on taps\n\ncommit \t93c647643b48f0131f02e45da3bd367d80443291 upstream\n\nCurrently, a nlmon link inside a child namespace can observe systemwide\nnetlink activity.  Filter the traffic so that nlmon can only sniff\nnetlink messages from its own netns.\n\nTest case:\n\n    vpnns -- bash -c \"ip link add nlmon0 type nlmon; \\\n                      ip link set nlmon0 up; \\\n                      tcpdump -i nlmon0 -q -w /tmp/nlmon.pcap -U\" &\n    sudo ip xfrm state add src 10.1.1.1 dst 10.1.1.2 proto esp \\\n        spi 0x1 mode transport \\\n        auth sha1 0x6162633132330000000000000000000000000000 \\\n        enc aes 0x00000000000000000000000000000000\n    grep --binary abc123 /tmp/nlmon.pcap\n\nSigned-off-by: Kevin Cernekee <cernekee@chromium.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Liu Haitao <haitao.liu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/4ce81f801906e5e860eb715fe8ee037c393d1638"},{"sha":"5b8d8452c224b8f69e0291f2ea4ead3bc6d8fa58","author":{"name":"Eric Biggers","email":"0106d512ed1cb672be29d4b167a07ead51709fba@google.com"},"message":"crypto: hmac - require that the underlying hash algorithm is unkeyed\n\ncommit af3ff8045bbf3e32f1a448542e73abb4c8ceb6f1 upstream\n\nBecause the HMAC template didn't check that its underlying hash\nalgorithm is unkeyed, trying to use \"hmac(hmac(sha3-512-generic))\"\nthrough AF_ALG or through KEYCTL_DH_COMPUTE resulted in the inner HMAC\nbeing used without having been keyed, resulting in sha3_update() being\ncalled without sha3_init(), causing a stack buffer overflow.\n\nThis is a very old bug, but it seems to have only started causing real\nproblems when SHA-3 support was added (requires CONFIG_CRYPTO_SHA3)\nbecause the innermost hash's state is ->import()ed from a zeroed buffer,\nand it just so happens that other hash algorithms are fine with that,\nbut SHA-3 is not.  However, there could be arch or hardware-dependent\nhash algorithms also affected; I couldn't test everything.\n\nFix the bug by introducing a function crypto_shash_alg_has_setkey()\nwhich tests whether a shash algorithm is keyed.  Then update the HMAC\ntemplate to require that its underlying hash algorithm is unkeyed.\n\nHere is a reproducer:\n\n    #include <linux/if_alg.h>\n    #include <sys/socket.h>\n\n    int main()\n    {\n        int algfd;\n        struct sockaddr_alg addr = {\n            .salg_type = \"hash\",\n            .salg_name = \"hmac(hmac(sha3-512-generic))\",\n        };\n        char key[4096] = { 0 };\n\n        algfd = socket(AF_ALG, SOCK_SEQPACKET, 0);\n        bind(algfd, (const struct sockaddr *)&addr, sizeof(addr));\n        setsockopt(algfd, SOL_ALG, ALG_SET_KEY, key, sizeof(key));\n    }\n\nHere was the KASAN report from syzbot:\n\n    BUG: KASAN: stack-out-of-bounds in memcpy include/linux/string.h:341  [inline]\n    BUG: KASAN: stack-out-of-bounds in sha3_update+0xdf/0x2e0  crypto/sha3_generic.c:161\n    Write of size 4096 at addr ffff8801cca07c40 by task syzkaller076574/3044\n\n    CPU: 1 PID: 3044 Comm: syzkaller076574 Not tainted 4.14.0-mm1+ #25\n    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  Google 01/01/2011\n    Call Trace:\n      __dump_stack lib/dump_stack.c:17 [inline]\n      dump_stack+0x194/0x257 lib/dump_stack.c:53\n      print_address_description+0x73/0x250 mm/kasan/report.c:252\n      kasan_report_error mm/kasan/report.c:351 [inline]\n      kasan_report+0x25b/0x340 mm/kasan/report.c:409\n      check_memory_region_inline mm/kasan/kasan.c:260 [inline]\n      check_memory_region+0x137/0x190 mm/kasan/kasan.c:267\n      memcpy+0x37/0x50 mm/kasan/kasan.c:303\n      memcpy include/linux/string.h:341 [inline]\n      sha3_update+0xdf/0x2e0 crypto/sha3_generic.c:161\n      crypto_shash_update+0xcb/0x220 crypto/shash.c:109\n      shash_finup_unaligned+0x2a/0x60 crypto/shash.c:151\n      crypto_shash_finup+0xc4/0x120 crypto/shash.c:165\n      hmac_finup+0x182/0x330 crypto/hmac.c:152\n      crypto_shash_finup+0xc4/0x120 crypto/shash.c:165\n      shash_digest_unaligned+0x9e/0xd0 crypto/shash.c:172\n      crypto_shash_digest+0xc4/0x120 crypto/shash.c:186\n      hmac_setkey+0x36a/0x690 crypto/hmac.c:66\n      crypto_shash_setkey+0xad/0x190 crypto/shash.c:64\n      shash_async_setkey+0x47/0x60 crypto/shash.c:207\n      crypto_ahash_setkey+0xaf/0x180 crypto/ahash.c:200\n      hash_setkey+0x40/0x90 crypto/algif_hash.c:446\n      alg_setkey crypto/af_alg.c:221 [inline]\n      alg_setsockopt+0x2a1/0x350 crypto/af_alg.c:254\n      SYSC_setsockopt net/socket.c:1851 [inline]\n      SyS_setsockopt+0x189/0x360 net/socket.c:1830\n      entry_SYSCALL_64_fastpath+0x1f/0x96\n\nReported-by: syzbot <syzkaller@googlegroups.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Catalin Enache <catalin.enache@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/5b8d8452c224b8f69e0291f2ea4ead3bc6d8fa58"},{"sha":"2211dc8007a0f2d43cd94c4ce5730dc5bb6935f4","author":{"name":"Eric Biggers","email":"0106d512ed1cb672be29d4b167a07ead51709fba@google.com"},"message":"crypto: salsa20 - fix blkcipher_walk API usage\n\ncommit ecaaab5649781c5a0effdaf298a925063020500e upstream\n\nWhen asked to encrypt or decrypt 0 bytes, both the generic and x86\nimplementations of Salsa20 crash in blkcipher_walk_done(), either when\ndoing 'kfree(walk->buffer)' or 'free_page((unsigned long)walk->page)',\nbecause walk->buffer and walk->page have not been initialized.\n\nThe bug is that Salsa20 is calling blkcipher_walk_done() even when\nnothing is in 'walk.nbytes'.  But blkcipher_walk_done() is only meant to\nbe called when a nonzero number of bytes have been provided.\n\nThe broken code is part of an optimization that tries to make only one\ncall to salsa20_encrypt_bytes() to process inputs that are not evenly\ndivisible by 64 bytes.  To fix the bug, just remove this \"optimization\"\nand use the blkcipher_walk API the same way all the other users do.\n\nReproducer:\n\n    #include <linux/if_alg.h>\n    #include <sys/socket.h>\n    #include <unistd.h>\n\n    int main()\n    {\n            int algfd, reqfd;\n            struct sockaddr_alg addr = {\n                    .salg_type = \"skcipher\",\n                    .salg_name = \"salsa20\",\n            };\n            char key[16] = { 0 };\n\n            algfd = socket(AF_ALG, SOCK_SEQPACKET, 0);\n            bind(algfd, (void *)&addr, sizeof(addr));\n            reqfd = accept(algfd, 0, 0);\n            setsockopt(algfd, SOL_ALG, ALG_SET_KEY, key, sizeof(key));\n            read(reqfd, key, sizeof(key));\n    }\n\nReported-by: syzbot <syzkaller@googlegroups.com>\nFixes: eb6f13eb9f81 (\"[CRYPTO] salsa20_generic: Fix multi-page processing\")\nCc: <stable@vger.kernel.org> # v2.6.25+\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/2211dc8007a0f2d43cd94c4ce5730dc5bb6935f4"},{"sha":"cfba732d3b844d01ec5824bda93d79023cd17c0a","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"tcp: allow drivers to tweak TSQ logic\n\ncommit \t3a9b76fd0db9f0d426533f96a68a62a58753a51e upstream\n\nI had many reports that TSQ logic breaks wifi aggregation.\n\nCurrent logic is to allow up to 1 ms of bytes to be queued into qdisc\nand drivers queues.\n\nBut Wifi aggregation needs a bigger budget to allow bigger rates to\nbe discovered by various TCP Congestion Controls algorithms.\n\nThis patch adds an extra socket field, allowing wifi drivers to select\nanother log scale to derive TCP Small Queue credit from current pacing\nrate.\n\nInitial value is 10, meaning that this patch does not change current\nbehavior.\n\nWe expect wifi drivers to set this field to smaller values (tests have\nbeen done with values from 6 to 9)\n\nThey would have to use following template :\n\nif (skb->sk && skb->sk->sk_pacing_shift != MY_PACING_SHIFT)\n     skb->sk->sk_pacing_shift = MY_PACING_SHIFT;\n\nRef: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1670041\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Johannes Berg <johannes.berg@intel.com>\nCc: Toke Høiland-Jørgensen <toke@toke.dk>\nCc: Kir Kolyshkin <kir@openvz.org>\nAcked-by: Neal Cardwell <ncardwell@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Liu Haitao <haitao.liu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/cfba732d3b844d01ec5824bda93d79023cd17c0a"},{"sha":"4efe7580961b6e82a56d8511321fbaaa8df10956","author":{"name":"Kevin Cernekee","email":"3219fdf39e3ba5f552e432c31cc96159991751aa@chromium.org"},"message":"netfilter: xt_osf: Add missing permission checks\n\ncommit \t916a27901de01446bcf57ecca4783f6cff493309  upstream\n\nThe capability check in nfnetlink_rcv() verifies that the caller\nhas CAP_NET_ADMIN in the namespace that \"owns\" the netlink socket.\nHowever, xt_osf_fingers is shared by all net namespaces on the\nsystem.  An unprivileged user can create user and net namespaces\nin which he holds CAP_NET_ADMIN to bypass the netlink_net_capable()\ncheck:\n\n    vpnns -- nfnl_osf -f /tmp/pf.os\n\n    vpnns -- nfnl_osf -f /tmp/pf.os -d\n\nThese non-root operations successfully modify the systemwide OS\nfingerprint list.  Add new capable() checks so that they can't.\n\nSigned-off-by: Kevin Cernekee <cernekee@chromium.org>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Liu Haitao <haitao.liu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/4efe7580961b6e82a56d8511321fbaaa8df10956"}]}
{"actor":{"display_login":"mseaster-wr"}}