{"push_id":2771596406,"size":248,"distinct_size":2,"ref":"refs/heads/aosp-common/android-4.14","head":"6f2e09c90a6dcca9a90de517b40f54da5f10e5d3","before":"1981ee0dc8fb42892bdee077d895421bf1d93a99","commits":[{"sha":"03002d0374dd37a1969c6c3aa5e16ffe9844af24","author":{"name":"Sami Tolvanen","email":"13b5b7039a021b8cc9f1fde674d009cb5243a69d@google.com"},"message":"ANDROID: ftrace: fix function type mismatches\n\nThis change fixes indirect call mismatches with function and function\ngraph tracing, which trip Control-Flow Integrity (CFI) checking.\n\nBug: 79510107\nBug: 67506682\nChange-Id: I5de08c113fb970ffefedce93c58e0161f22c7ca2\nSigned-off-by: Sami Tolvanen <samitolvanen@google.com>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/03002d0374dd37a1969c6c3aa5e16ffe9844af24"},{"sha":"2d5fc7ffa84bfa0d778c30b96072295ad36a1030","author":{"name":"Kees Cook","email":"50cb10d2be062154b17ab4d66a4eab34f1cf1c84@chromium.org"},"message":"fork: unconditionally clear stack on fork\n\ncommit e01e80634ecdde1dd113ac43b3adad21b47f3957 upstream.\n\nOne of the classes of kernel stack content leaks[1] is exposing the\ncontents of prior heap or stack contents when a new process stack is\nallocated.  Normally, those stacks are not zeroed, and the old contents\nremain in place.  In the face of stack content exposure flaws, those\ncontents can leak to userspace.\n\nFixing this will make the kernel no longer vulnerable to these flaws, as\nthe stack will be wiped each time a stack is assigned to a new process.\nThere's not a meaningful change in runtime performance; it almost looks\nlike it provides a benefit.\n\nPerforming back-to-back kernel builds before:\n\tRun times: 157.86 157.09 158.90 160.94 160.80\n\tMean: 159.12\n\tStd Dev: 1.54\n\nand after:\n\tRun times: 159.31 157.34 156.71 158.15 160.81\n\tMean: 158.46\n\tStd Dev: 1.46\n\nInstead of making this a build or runtime config, Andy Lutomirski\nrecommended this just be enabled by default.\n\n[1] A noisy search for many kinds of stack content leaks can be seen here:\nhttps://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=linux+kernel+stack+leak\n\nI did some more with perf and cycle counts on running 100,000 execs of\n/bin/true.\n\nbefore:\nCycles: 218858861551 218853036130 214727610969 227656844122 224980542841\nMean:  221015379122.60\nStd Dev: 4662486552.47\n\nafter:\nCycles: 213868945060 213119275204 211820169456 224426673259 225489986348\nMean:  217745009865.40\nStd Dev: 5935559279.99\n\nIt continues to look like it's faster, though the deviation is rather\nwide, but I'm not sure what I could do that would be less noisy.  I'm\nopen to ideas!\n\nLink: http://lkml.kernel.org/r/20180221021659.GA37073@beast\nSigned-off-by: Kees Cook <keescook@chromium.org>\nAcked-by: Michal Hocko <mhocko@suse.com>\nReviewed-by: Andrew Morton <akpm@linux-foundation.org>\nCc: Andy Lutomirski <luto@kernel.org>\nCc: Laura Abbott <labbott@redhat.com>\nCc: Rasmus Villemoes <rasmus.villemoes@prevas.dk>\nCc: Mel Gorman <mgorman@techsingularity.net>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/2d5fc7ffa84bfa0d778c30b96072295ad36a1030"},{"sha":"c0b86d269bf097fd100e275574ae50f1aec248ad","author":{"name":"Lixin Wang","email":"5397f945f4d693ce1eede2fa133b14aa70173058@nokia-sbell.com"},"message":"i2c: core: decrease reference count of device node in i2c_unregister_device\n\ncommit e0638fa400eaccf9fa8060f67140264c4e276552 upstream.\n\nReference count of device node was increased in of_i2c_register_device,\nbut without decreasing it in i2c_unregister_device. Then the added\ndevice node will never be released. Fix this by adding the of_node_put.\n\nSigned-off-by: Lixin Wang <alan.1.wang@nokia-sbell.com>\nTested-by: Wolfram Sang <wsa@the-dreams.de>\nSigned-off-by: Wolfram Sang <wsa@the-dreams.de>\nCc: stable@kernel.org\nSigned-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/c0b86d269bf097fd100e275574ae50f1aec248ad"},{"sha":"3af618717e710a4b4d635eaef87645bc0e99c71a","author":{"name":"Bart Van Assche","email":"28563a2d387a4f8f033bf7abbf80937064dfbe0c@wdc.com"},"message":"RDMA/core: Avoid that ib_drain_qp() triggers an out-of-bounds stack access\n\ncommit a1ae7d0345edd593d6725d3218434d903a0af95d upstream.\n\nThis patch fixes the following KASAN complaint:\n\n==================================================================\nBUG: KASAN: stack-out-of-bounds in rxe_post_send+0x77d/0x9b0 [rdma_rxe]\nRead of size 8 at addr ffff880061aef860 by task 01/1080\n\nCPU: 2 PID: 1080 Comm: 01 Not tainted 4.16.0-rc3-dbg+ #2\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014\nCall Trace:\ndump_stack+0x85/0xc7\nprint_address_description+0x65/0x270\nkasan_report+0x231/0x350\nrxe_post_send+0x77d/0x9b0 [rdma_rxe]\n__ib_drain_sq+0x1ad/0x250 [ib_core]\nib_drain_qp+0x9/0x30 [ib_core]\nsrp_destroy_qp+0x51/0x70 [ib_srp]\nsrp_free_ch_ib+0xfc/0x380 [ib_srp]\nsrp_create_target+0x1071/0x19e0 [ib_srp]\nkernfs_fop_write+0x180/0x210\n__vfs_write+0xb1/0x2e0\nvfs_write+0xf6/0x250\nSyS_write+0x99/0x110\ndo_syscall_64+0xee/0x2b0\nentry_SYSCALL_64_after_hwframe+0x42/0xb7\n\nThe buggy address belongs to the page:\npage:ffffea000186bbc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0\nflags: 0x4000000000000000()\nraw: 4000000000000000 0000000000000000 0000000000000000 00000000ffffffff\nraw: 0000000000000000 ffffea000186bbe0 0000000000000000 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\nffff880061aef700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\nffff880061aef780: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00\n>ffff880061aef800: f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 f2 f2 f2 f2\n                                                      ^\nffff880061aef880: f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 f2 f2\nffff880061aef900: f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 00\n==================================================================\n\nFixes: 765d67748bcf (\"IB: new common API for draining queues\")\nSigned-off-by: Bart Van Assche <bart.vanassche@wdc.com>\nCc: Steve Wise <swise@opengridcomputing.com>\nCc: Sagi Grimberg <sagi@grimberg.me>\nCc: stable@vger.kernel.org\nSigned-off-by: Jason Gunthorpe <jgg@mellanox.com>\nSigned-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/3af618717e710a4b4d635eaef87645bc0e99c71a"},{"sha":"d02c9c8bfef147c790985db5a348a91ab0deec66","author":{"name":"Andrew Morton","email":"5c1e68b099950c134891f0b6e179498a8ebe9cf9@linux-foundation.org"},"message":"drivers/infiniband/core/verbs.c: fix build with gcc-4.4.4\n\ncommit 6ee687735e745eafae9e6b93d1ea70bc52e7ad07 upstream.\n\ngcc-4.4.4 has issues with initialization of anonymous unions.\n\ndrivers/infiniband/core/verbs.c: In function '__ib_drain_sq':\ndrivers/infiniband/core/verbs.c:2204: error: unknown field 'wr_cqe' specified in initializer\ndrivers/infiniband/core/verbs.c:2204: warning: initialization makes integer from pointer without a cast\n\nWork around this.\n\nFixes: a1ae7d0345edd5 (\"RDMA/core: Avoid that ib_drain_qp() triggers an out-of-bounds stack access\")\nCc: Bart Van Assche <bart.vanassche@wdc.com>\nCc: Steve Wise <swise@opengridcomputing.com>\nCc: Sagi Grimberg <sagi@grimberg.me>\nCc: Jason Gunthorpe <jgg@mellanox.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Doug Ledford <dledford@redhat.com>\nSigned-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/d02c9c8bfef147c790985db5a348a91ab0deec66"},{"sha":"1e8bb2e9c9df0d0e491e5022ce80a2b96b757ac3","author":{"name":"Bart Van Assche","email":"28563a2d387a4f8f033bf7abbf80937064dfbe0c@wdc.com"},"message":"IB/srpt: Fix an out-of-bounds stack access in srpt_zerolength_write()\n\ncommit 2a78cb4db487372152bed2055c038f9634d595e8 upstream.\n\nAvoid triggering an out-of-bounds stack access by changing the type\nof 'wr' from ib_send_wr into ib_rdma_wr.\n\nThis patch fixes the following KASAN bug report:\n\nBUG: KASAN: stack-out-of-bounds in rxe_post_send+0x7a9/0x9a0 [rdma_rxe]\nRead of size 8 at addr ffff880068197a48 by task kworker/2:1/44\n\nWorkqueue: ib_cm cm_work_handler [ib_cm]\nCall Trace:\n dump_stack+0x8e/0xcd\n print_address_description+0x6f/0x280\n kasan_report+0x25a/0x380\n __asan_load8+0x54/0x90\n rxe_post_send+0x7a9/0x9a0 [rdma_rxe]\n srpt_zerolength_write+0xf0/0x180 [ib_srpt]\n srpt_cm_rtu_recv+0x68/0x110 [ib_srpt]\n srpt_rdma_cm_handler+0xbb/0x15b [ib_srpt]\n cma_ib_handler+0x1aa/0x4a0 [rdma_cm]\n cm_process_work+0x30/0x100 [ib_cm]\n cm_work_handler+0xa86/0x351b [ib_cm]\n process_one_work+0x475/0x9f0\n worker_thread+0x69/0x690\n kthread+0x1ad/0x1d0\n ret_from_fork+0x3a/0x50\n\nFixes: aaf45bd83eba (\"IB/srpt: Detect session shutdown reliably\")\nSigned-off-by: Bart Van Assche <bart.vanassche@wdc.com>\nCc: Christoph Hellwig <hch@lst.de>\nCc: stable@vger.kernel.org\nSigned-off-by: Jason Gunthorpe <jgg@mellanox.com>\nSigned-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/1e8bb2e9c9df0d0e491e5022ce80a2b96b757ac3"},{"sha":"e581f7c590cca70b7338f43b73f4cfa081077c00","author":{"name":"Andrew Morton","email":"5c1e68b099950c134891f0b6e179498a8ebe9cf9@linux-foundation.org"},"message":"drivers/infiniband/ulp/srpt/ib_srpt.c: fix build with gcc-4.4.4\n\ncommit 06892cc190550807d332c95a0114c7e175584012 upstream.\n\ngcc-4.4.4 has issues with initialization of anonymous unions:\n\ndrivers/infiniband/ulp/srpt/ib_srpt.c: In function 'srpt_zerolength_write':\ndrivers/infiniband/ulp/srpt/ib_srpt.c:854: error: unknown field 'wr_cqe' specified in initializer\ndrivers/infiniband/ulp/srpt/ib_srpt.c:854: warning: initialization makes integer from pointer without a cast\n\nWork aound this.\n\nFixes: 2a78cb4db487 (\"IB/srpt: Fix an out-of-bounds stack access in srpt_zerolength_write()\")\nCc: Bart Van Assche <bart.vanassche@wdc.com>\nCc: Christoph Hellwig <hch@lst.de>\nCc: Jason Gunthorpe <jgg@mellanox.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Doug Ledford <dledford@redhat.com>\nSigned-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/e581f7c590cca70b7338f43b73f4cfa081077c00"},{"sha":"c09032b71fc6fa7d8a010b3a58ee4ca2ae9e1a09","author":{"name":"Marek Szyprowski","email":"2a0259761cc3e88db42be5300c1579a67c77e65e@samsung.com"},"message":"spi: spi-s3c64xx: Fix system resume support\n\ncommit e935dba111621bd6a0c5d48e6511a4d9885103b4 upstream.\n\nSince Linux v4.10 release (commit 1d9174fbc55e \"PM / Runtime: Defer\nresuming of the device in pm_runtime_force_resume()\"),\npm_runtime_force_resume() function doesn't runtime resume device if it was\nnot runtime active before system suspend. Thus, driver should not do any\nregister access after pm_runtime_force_resume() without checking the\nruntime status of the device. To fix this issue, simply move\ns3c64xx_spi_hwinit() call to s3c64xx_spi_runtime_resume() to ensure that\nhardware is always properly initialized. This fixes Synchronous external\nabort issue on system suspend/resume cycle on newer Exynos SoCs.\n\nSigned-off-by: Marek Szyprowski <m.szyprowski@samsung.com>\nReviewed-by: Krzysztof Kozlowski <krzk@kernel.org>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/c09032b71fc6fa7d8a010b3a58ee4ca2ae9e1a09"},{"sha":"b4667635de2e60b1ffb059f03d3d2977258849f0","author":{"name":"Donald Shanty III","email":"877571fd6e38c5a1556fe09ae84afca790c5339c@protonmail.com"},"message":"Input: elan_i2c - add ACPI ID for lenovo ideapad 330\n\ncommit 938f45008d8bc391593c97508bc798cc95a52b9b upstream.\n\nThis allows Elan driver to bind to the touchpad found in Lenovo Ideapad 330\nseries laptops.\n\nSigned-off-by: Donald Shanty III <dshanty@protonmail.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/b4667635de2e60b1ffb059f03d3d2977258849f0"},{"sha":"e0e385e2126e0b73af8f54301b818499d2b3e6db","author":{"name":"Chen-Yu Tsai","email":"11e8bbde1bc9e0af703df23be02afe58864a4a18@csie.org"},"message":"Input: i8042 - add Lenovo LaVie Z to the i8042 reset list\n\ncommit 384cf4285b34e08917e3e66603382f2b0c4f6e1b upstream.\n\nThe Lenovo LaVie Z laptop requires i8042 to be reset in order to\nconsistently detect its Elantech touchpad. The nomux and kbdreset\nquirks are not sufficient.\n\nIt's possible the other LaVie Z models from NEC require this as well.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Chen-Yu Tsai <wens@csie.org>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/e0e385e2126e0b73af8f54301b818499d2b3e6db"},{"sha":"ca6427facd967cbb7067422c1f3ab085874bb037","author":{"name":"KT Liao","email":"8cbe3708fba0ad3ba0de70fc8acb4885a3f33fba@emc.com.tw"},"message":"Input: elan_i2c - add another ACPI ID for Lenovo Ideapad 330-15AST\n\ncommit 6f88a6439da5d94de334a341503bc2c7f4a7ea7f upstream.\n\nAdd ELAN0622 to ACPI mapping table to support Elan touchpad found in\nIdeapad 330-15AST.\n\nSigned-off-by: KT Liao <kt.liao@emc.com.tw>\nReported-by: Anant Shende <anantshende@gmail.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/ca6427facd967cbb7067422c1f3ab085874bb037"},{"sha":"8eead4f5dea9fdf01ac254171e3cc141181b825b","author":{"name":"Shakeel Butt","email":"a2d885899f287490a04175b0385f00f972813402@google.com"},"message":"kvm, mm: account shadow page tables to kmemcg\n\ncommit d97e5e6160c0e0a23963ec198c7cb1c69e6bf9e8 upstream.\n\nThe size of kvm's shadow page tables corresponds to the size of the\nguest virtual machines on the system.  Large VMs can spend a significant\namount of memory as shadow page tables which can not be left as system\nmemory overhead.  So, account shadow page tables to the kmemcg.\n\n[shakeelb@google.com: replace (GFP_KERNEL|__GFP_ACCOUNT) with GFP_KERNEL_ACCOUNT]\n  Link: http://lkml.kernel.org/r/20180629140224.205849-1-shakeelb@google.com\nLink: http://lkml.kernel.org/r/20180627181349.149778-1-shakeelb@google.com\nSigned-off-by: Shakeel Butt <shakeelb@google.com>\nCc: Michal Hocko <mhocko@kernel.org>\nCc: Johannes Weiner <hannes@cmpxchg.org>\nCc: Vladimir Davydov <vdavydov.dev@gmail.com>\nCc: Paolo Bonzini <pbonzini@redhat.com>\nCc: Greg Thelen <gthelen@google.com>\nCc: Radim Krčmář <rkrcmar@redhat.com>\nCc: Peter Feiner <pfeiner@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/8eead4f5dea9fdf01ac254171e3cc141181b825b"},{"sha":"a2f85c02810f91af6f2b7dd5de6a0ffb4c835b67","author":{"name":"Tejun Heo","email":"546b05909706652891a87f7bfe385ae147f61f91@kernel.org"},"message":"delayacct: fix crash in delayacct_blkio_end() after delayacct init failure\n\ncommit b512719f771a82180211c9a315b8a7f628832b3d upstream.\n\nWhile forking, if delayacct init fails due to memory shortage, it\ncontinues expecting all delayacct users to check task->delays pointer\nagainst NULL before dereferencing it, which all of them used to do.\n\nCommit c96f5471ce7d (\"delayacct: Account blkio completion on the correct\ntask\"), while updating delayacct_blkio_end() to take the target task\ninstead of always using %current, made the function test NULL on\n%current->delays and then continue to operated on @p->delays.  If\n%current succeeded init while @p didn't, it leads to the following\ncrash.\n\n BUG: unable to handle kernel NULL pointer dereference at 0000000000000004\n IP: __delayacct_blkio_end+0xc/0x40\n PGD 8000001fd07e1067 P4D 8000001fd07e1067 PUD 1fcffbb067 PMD 0\n Oops: 0000 [#1] SMP PTI\n CPU: 4 PID: 25774 Comm: QIOThread0 Not tainted 4.16.0-9_fbk1_rc2_1180_g6b593215b4d7 #9\n RIP: 0010:__delayacct_blkio_end+0xc/0x40\n Call Trace:\n  try_to_wake_up+0x2c0/0x600\n  autoremove_wake_function+0xe/0x30\n  __wake_up_common+0x74/0x120\n  wake_up_page_bit+0x9c/0xe0\n  mpage_end_io+0x27/0x70\n  blk_update_request+0x78/0x2c0\n  scsi_end_request+0x2c/0x1e0\n  scsi_io_completion+0x20b/0x5f0\n  blk_mq_complete_request+0xa2/0x100\n  ata_scsi_qc_complete+0x79/0x400\n  ata_qc_complete_multiple+0x86/0xd0\n  ahci_handle_port_interrupt+0xc9/0x5c0\n  ahci_handle_port_intr+0x54/0xb0\n  ahci_single_level_irq_intr+0x3b/0x60\n  __handle_irq_event_percpu+0x43/0x190\n  handle_irq_event_percpu+0x20/0x50\n  handle_irq_event+0x2a/0x50\n  handle_edge_irq+0x80/0x1c0\n  handle_irq+0xaf/0x120\n  do_IRQ+0x41/0xc0\n  common_interrupt+0xf/0xf\n\nFix it by updating delayacct_blkio_end() check @p->delays instead.\n\nLink: http://lkml.kernel.org/r/20180724175542.GP1934745@devbig577.frc2.facebook.com\nFixes: c96f5471ce7d (\"delayacct: Account blkio completion on the correct task\")\nSigned-off-by: Tejun Heo <tj@kernel.org>\nReported-by: Dave Jones <dsj@fb.com>\nDebugged-by: Dave Jones <dsj@fb.com>\nReviewed-by: Andrew Morton <akpm@linux-foundation.org>\nCc: Josh Snyder <joshs@netflix.com>\nCc: <stable@vger.kernel.org>\t[4.15+]\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/a2f85c02810f91af6f2b7dd5de6a0ffb4c835b67"},{"sha":"9158a7debe5351688515de22fd18a5a8b006f458","author":{"name":"Steven Rostedt (VMware)","email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org"},"message":"tracing: Fix double free of event_trigger_data\n\ncommit 1863c387259b629e4ebfb255495f67cd06aa229b upstream.\n\nRunning the following:\n\n # cd /sys/kernel/debug/tracing\n # echo 500000 > buffer_size_kb\n[ Or some other number that takes up most of memory ]\n # echo snapshot > events/sched/sched_switch/trigger\n\nTriggers the following bug:\n\n ------------[ cut here ]------------\n kernel BUG at mm/slub.c:296!\n invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI\n CPU: 6 PID: 6878 Comm: bash Not tainted 4.18.0-rc6-test+ #1066\n Hardware name: Hewlett-Packard HP Compaq Pro 6300 SFF/339A, BIOS K01 v03.03 07/14/2016\n RIP: 0010:kfree+0x16c/0x180\n Code: 05 41 0f b6 72 51 5b 5d 41 5c 4c 89 d7 e9 ac b3 f8 ff 48 89 d9 48 89 da 41 b8 01 00 00 00 5b 5d 41 5c 4c 89 d6 e9 f4 f3 ff ff <0f> 0b 0f 0b 48 8b 3d d9 d8 f9 00 e9 c1 fe ff ff 0f 1f 40 00 0f 1f\n RSP: 0018:ffffb654436d3d88 EFLAGS: 00010246\n RAX: ffff91a9d50f3d80 RBX: ffff91a9d50f3d80 RCX: ffff91a9d50f3d80\n RDX: 00000000000006a4 RSI: ffff91a9de5a60e0 RDI: ffff91a9d9803500\n RBP: ffffffff8d267c80 R08: 00000000000260e0 R09: ffffffff8c1a56be\n R10: fffff0d404543cc0 R11: 0000000000000389 R12: ffffffff8c1a56be\n R13: ffff91a9d9930e18 R14: ffff91a98c0c2890 R15: ffffffff8d267d00\n FS:  00007f363ea64700(0000) GS:ffff91a9de580000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 000055c1cacc8e10 CR3: 00000000d9b46003 CR4: 00000000001606e0\n Call Trace:\n  event_trigger_callback+0xee/0x1d0\n  event_trigger_write+0xfc/0x1a0\n  __vfs_write+0x33/0x190\n  ? handle_mm_fault+0x115/0x230\n  ? _cond_resched+0x16/0x40\n  vfs_write+0xb0/0x190\n  ksys_write+0x52/0xc0\n  do_syscall_64+0x5a/0x160\n  entry_SYSCALL_64_after_hwframe+0x49/0xbe\n RIP: 0033:0x7f363e16ab50\n Code: 73 01 c3 48 8b 0d 38 83 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 79 db 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 1e e3 01 00 48 89 04 24\n RSP: 002b:00007fff9a4c6378 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f363e16ab50\n RDX: 0000000000000009 RSI: 000055c1cacc8e10 RDI: 0000000000000001\n RBP: 000055c1cacc8e10 R08: 00007f363e435740 R09: 00007f363ea64700\n R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000009\n R13: 0000000000000001 R14: 00007f363e4345e0 R15: 00007f363e4303c0\n Modules linked in: ip6table_filter ip6_tables snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_seq snd_seq_device i915 snd_pcm snd_timer i2c_i801 snd soundcore i2c_algo_bit drm_kms_helper\n86_pkg_temp_thermal video kvm_intel kvm irqbypass wmi e1000e\n ---[ end trace d301afa879ddfa25 ]---\n\nThe cause is because the register_snapshot_trigger() call failed to\nallocate the snapshot buffer, and then called unregister_trigger()\nwhich freed the data that was passed to it. Then on return to the\nfunction that called register_snapshot_trigger(), as it sees it\nfailed to register, it frees the trigger_data again and causes\na double free.\n\nBy calling event_trigger_init() on the trigger_data (which only ups\nthe reference counter for it), and then event_trigger_free() afterward,\nthe trigger_data would not get freed by the registering trigger function\nas it would only up and lower the ref count for it. If the register\ntrigger function fails, then the event_trigger_free() called after it\nwill free the trigger data normally.\n\nLink: http://lkml.kernel.org/r/20180724191331.738eb819@gandalf.local.home\n\nCc: stable@vger.kerne.org\nFixes: 93e31ffbf417 (\"tracing: Add 'snapshot' event trigger command\")\nReported-by: Masami Hiramatsu <mhiramat@kernel.org>\nReviewed-by: Masami Hiramatsu <mhiramat@kernel.org>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/9158a7debe5351688515de22fd18a5a8b006f458"},{"sha":"10419b0c16d41e7fa3848e83e6bf7521aa9407ef","author":{"name":"Steven Rostedt (VMware)","email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org"},"message":"tracing: Fix possible double free in event_enable_trigger_func()\n\ncommit 15cc78644d0075e76d59476a4467e7143860f660 upstream.\n\nThere was a case that triggered a double free in event_trigger_callback()\ndue to the called reg() function freeing the trigger_data and then it\ngetting freed again by the error return by the caller. The solution there\nwas to up the trigger_data ref count.\n\nCode inspection found that event_enable_trigger_func() has the same issue,\nbut is not as easy to trigger (requires harder to trigger failures). It\nneeds to be solved slightly different as it needs more to clean up when the\nreg() function fails.\n\nLink: http://lkml.kernel.org/r/20180725124008.7008e586@gandalf.local.home\n\nCc: stable@vger.kernel.org\nFixes: 7862ad1846e99 (\"tracing: Add 'enable_event' and 'disable_event' event trigger commands\")\nReivewed-by: Masami Hiramatsu <mhiramat@kernel.org>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/10419b0c16d41e7fa3848e83e6bf7521aa9407ef"},{"sha":"f957456878eb3b5fd8c41412686a76d2cce6c504","author":{"name":"Snild Dolkow","email":"35d9cb31f6646600b9569c86dc506985112ac81c@sony.com"},"message":"kthread, tracing: Don't expose half-written comm when creating kthreads\n\ncommit 3e536e222f2930534c252c1cc7ae799c725c5ff9 upstream.\n\nThere is a window for racing when printing directly to task->comm,\nallowing other threads to see a non-terminated string. The vsnprintf\nfunction fills the buffer, counts the truncated chars, then finally\nwrites the \\0 at the end.\n\n\tcreator                     other\n\tvsnprintf:\n\t  fill (not terminated)\n\t  count the rest            trace_sched_waking(p):\n\t  ...                         memcpy(comm, p->comm, TASK_COMM_LEN)\n\t  write \\0\n\nThe consequences depend on how 'other' uses the string. In our case,\nit was copied into the tracing system's saved cmdlines, a buffer of\nadjacent TASK_COMM_LEN-byte buffers (note the 'n' where 0 should be):\n\n\tcrash-arm64> x/1024s savedcmd->saved_cmdlines | grep 'evenk'\n\t0xffffffd5b3818640:     \"irq/497-pwr_evenkworker/u16:12\"\n\n...and a strcpy out of there would cause stack corruption:\n\n\t[224761.522292] Kernel panic - not syncing: stack-protector:\n\t    Kernel stack is corrupted in: ffffff9bf9783c78\n\n\tcrash-arm64> kbt | grep 'comm\\|trace_print_context'\n\t#6  0xffffff9bf9783c78 in trace_print_context+0x18c(+396)\n\t      comm (char [16]) =  \"irq/497-pwr_even\"\n\n\tcrash-arm64> rd 0xffffffd4d0e17d14 8\n\tffffffd4d0e17d14:  2f71726900000000 5f7277702d373934   ....irq/497-pwr_\n\tffffffd4d0e17d24:  726f776b6e657665 3a3631752f72656b   evenkworker/u16:\n\tffffffd4d0e17d34:  f9780248ff003231 cede60e0ffffff9b   12..H.x......`..\n\tffffffd4d0e17d44:  cede60c8ffffffd4 00000fffffffffd4   .....`..........\n\nThe workaround in e09e28671 (use strlcpy in __trace_find_cmdline) was\nlikely needed because of this same bug.\n\nSolved by vsnprintf:ing to a local buffer, then using set_task_comm().\nThis way, there won't be a window where comm is not terminated.\n\nLink: http://lkml.kernel.org/r/20180726071539.188015-1-snild@sony.com\n\nCc: stable@vger.kernel.org\nFixes: bc0c38d139ec7 (\"ftrace: latency tracer infrastructure\")\nReviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Snild Dolkow <snild@sony.com>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/f957456878eb3b5fd8c41412686a76d2cce6c504"},{"sha":"86428ec165ee9c25618794b442827ab78b3da087","author":{"name":"Artem Savkov","email":"d63d291a587345cfb191d99b4bf48847a127ac18@redhat.com"},"message":"tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure\n\ncommit 57ea2a34adf40f3a6e88409aafcf803b8945619a upstream.\n\nIf enable_trace_kprobe fails to enable the probe in enable_k(ret)probe\nit returns an error, but does not unset the tp flags it set previously.\nThis results in a probe being considered enabled and failures like being\nunable to remove the probe through kprobe_events file since probes_open()\nexpects every probe to be disabled.\n\nLink: http://lkml.kernel.org/r/20180725102826.8300-1-asavkov@redhat.com\nLink: http://lkml.kernel.org/r/20180725142038.4765-1-asavkov@redhat.com\n\nCc: Ingo Molnar <mingo@redhat.com>\nCc: stable@vger.kernel.org\nFixes: 41a7dd420c57 (\"tracing/kprobes: Support ftrace_event_file base multibuffer\")\nAcked-by: Masami Hiramatsu <mhiramat@kernel.org>\nReviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>\nSigned-off-by: Artem Savkov <asavkov@redhat.com>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/86428ec165ee9c25618794b442827ab78b3da087"},{"sha":"4681e8820f99aea022801ed94a279d61746b9523","author":{"name":"Steven Rostedt (VMware)","email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org"},"message":"tracing: Quiet gcc warning about maybe unused link variable\n\ncommit 2519c1bbe38d7acacc9aacba303ca6f97482ed53 upstream.\n\nCommit 57ea2a34adf4 (\"tracing/kprobes: Fix trace_probe flags on\nenable_trace_kprobe() failure\") added an if statement that depends on another\nif statement that gcc doesn't see will initialize the \"link\" variable and\ngives the warning:\n\n \"warning: 'link' may be used uninitialized in this function\"\n\nIt is really a false positive, but to quiet the warning, and also to make\nsure that it never actually is used uninitialized, initialize the \"link\"\nvariable to NULL and add an if (!WARN_ON_ONCE(!link)) where the compiler\nthinks it could be used uninitialized.\n\nCc: stable@vger.kernel.org\nFixes: 57ea2a34adf4 (\"tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure\")\nReported-by: kbuild test robot <lkp@intel.com>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/4681e8820f99aea022801ed94a279d61746b9523"},{"sha":"c1550e0141351e38af1dc781b18e7d2c5ebd42b4","author":{"name":"Johannes Weiner","email":"331be22c6b63ca3e0a03d408c2d906b1b02cd5f2@cmpxchg.org"},"message":"arm64: fix vmemmap BUILD_BUG_ON() triggering on !vmemmap setups\n\ncommit 7b0eb6b41a08fa1fa0d04b1c53becd62b5fbfaee upstream.\n\nArnd reports the following arm64 randconfig build error with the PSI\npatches that add another page flag:\n\n  /git/arm-soc/arch/arm64/mm/init.c: In function 'mem_init':\n  /git/arm-soc/include/linux/compiler.h:357:38: error: call to\n  '__compiletime_assert_618' declared with attribute error: BUILD_BUG_ON\n  failed: sizeof(struct page) > (1 << STRUCT_PAGE_MAX_SHIFT)\n\nThe additional page flag causes other information stored in\npage->flags to get bumped into their own struct page member:\n\n  #if SECTIONS_WIDTH+ZONES_WIDTH+NODES_SHIFT+LAST_CPUPID_SHIFT <=\n  BITS_PER_LONG - NR_PAGEFLAGS\n  #define LAST_CPUPID_WIDTH LAST_CPUPID_SHIFT\n  #else\n  #define LAST_CPUPID_WIDTH 0\n  #endif\n\n  #if defined(CONFIG_NUMA_BALANCING) && LAST_CPUPID_WIDTH == 0\n  #define LAST_CPUPID_NOT_IN_PAGE_FLAGS\n  #endif\n\nwhich in turn causes the struct page size to exceed the size set in\nSTRUCT_PAGE_MAX_SHIFT. This value is an an estimate used to size the\nVMEMMAP page array according to address space and struct page size.\n\nHowever, the check is performed - and triggers here - on a !VMEMMAP\nconfig, which consumes an additional 22 page bits for the sparse\nsection id. When VMEMMAP is enabled, those bits are returned, cpupid\ndoesn't need its own member, and the page passes the VMEMMAP check.\n\nRestrict that check to the situation it was meant to check: that we\nare sizing the VMEMMAP page array correctly.\n\nSays Arnd:\n\n    Further experiments show that the build error already existed before,\n    but was only triggered with larger values of CONFIG_NR_CPU and/or\n    CONFIG_NODES_SHIFT that might be used in actual configurations but\n    not in randconfig builds.\n\n    With longer CPU and node masks, I could recreate the problem with\n    kernels as old as linux-4.7 when arm64 NUMA support got added.\n\nReported-by: Arnd Bergmann <arnd@arndb.de>\nTested-by: Arnd Bergmann <arnd@arndb.de>\nCc: stable@vger.kernel.org\nFixes: 1a2db300348b (\"arm64, numa: Add NUMA support for arm64 platforms.\")\nFixes: 3e1907d5bf5a (\"arm64: mm: move vmemmap region right below the linear region\")\nSigned-off-by: Johannes Weiner <hannes@cmpxchg.org>\nSigned-off-by: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/c1550e0141351e38af1dc781b18e7d2c5ebd42b4"},{"sha":"73990abb1a04a526c011780e1c06b9c80d613e1a","author":{"name":"Petr Machata","email":"ceaa1af87bc9dd6639db1af18771f7956cf74a5c@mellanox.com"},"message":"mlxsw: spectrum_switchdev: Fix port_vlan refcounting\n\n[ Upstream commit 9e25826ffc942e985b8595b2f1cf2065d3880514 ]\n\nSwitchdev notifications for addition of SWITCHDEV_OBJ_ID_PORT_VLAN are\ndistributed not only on clean addition, but also when flags on an\nexisting VLAN are changed. mlxsw_sp_bridge_port_vlan_add() calls\nmlxsw_sp_port_vlan_get() to get at the port_vlan in question, which\nimplicitly references the object. This then leads to discrepancies in\nreference counting when the VLAN is removed. spectrum.c warns about the\nproblem when the module is removed:\n\n[13578.493090] WARNING: CPU: 0 PID: 2454 at drivers/net/ethernet/mellanox/mlxsw/spectrum.c:2973 mlxsw_sp_port_remove+0xfd/0x110 [mlxsw_spectrum]\n[...]\n[13578.627106] Call Trace:\n[13578.629617]  mlxsw_sp_fini+0x2a/0xe0 [mlxsw_spectrum]\n[13578.634748]  mlxsw_core_bus_device_unregister+0x3e/0x130 [mlxsw_core]\n[13578.641290]  mlxsw_pci_remove+0x13/0x40 [mlxsw_pci]\n[13578.646238]  pci_device_remove+0x31/0xb0\n[13578.650244]  device_release_driver_internal+0x14f/0x220\n[13578.655562]  driver_detach+0x32/0x70\n[13578.659183]  bus_remove_driver+0x47/0xa0\n[13578.663134]  pci_unregister_driver+0x1e/0x80\n[13578.667486]  mlxsw_sp_module_exit+0xc/0x3fa [mlxsw_spectrum]\n[13578.673207]  __x64_sys_delete_module+0x13b/0x1e0\n[13578.677888]  ? exit_to_usermode_loop+0x78/0x80\n[13578.682374]  do_syscall_64+0x39/0xe0\n[13578.685976]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nFix by putting the port_vlan when mlxsw_sp_port_vlan_bridge_join()\ndetermines it's a flag-only change.\n\nFixes: b3529af6bb0d (\"spectrum: Reference count VLAN entries\")\nSigned-off-by: Petr Machata <petrm@mellanox.com>\nAcked-by: Jiri Pirko <jiri@mellanox.com>\nSigned-off-by: Ido Schimmel <idosch@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/73990abb1a04a526c011780e1c06b9c80d613e1a"}]}
{"actor":{"display_login":"Jackeagle"}}