{"push_id":2612545985,"size":10,"distinct_size":0,"ref":"refs/heads/aosp/android-4.4-n-release","head":"8bbef324ee334e6a330a645b879856a354860525","before":"43c5b606bb03ab4bec9212bf2fe9f3fa0a3f8b21","commits":[{"sha":"65be20f6dccec14f349777fc294ef8f8b590ce83","author":{"name":"Eric Biggers","email":"6f6115196800bbe9712b3f04c7e40093bb382fc5@google.com"},"message":"ASN.1: fix out-of-bounds read when parsing indefinite length item\n\ncommit e0058f3a874ebb48b25be7ff79bc3b4e59929f90 upstream.\n\nIn asn1_ber_decoder(), indefinitely-sized ASN.1 items were being passed\nto the action functions before their lengths had been computed, using\nthe bogus length of 0x80 (ASN1_INDEFINITE_LENGTH).  This resulted in\nreading data past the end of the input buffer, when given a specially\ncrafted message.\n\nFix it by rearranging the code so that the indefinite length is resolved\nbefore the action is called.\n\nThis bug was originally found by fuzzing the X.509 parser in userspace\nusing libFuzzer from the LLVM project.\n\nKASAN report (cleaned up slightly):\n\n    BUG: KASAN: slab-out-of-bounds in memcpy ./include/linux/string.h:341 [inline]\n    BUG: KASAN: slab-out-of-bounds in x509_fabricate_name.constprop.1+0x1a4/0x940 crypto/asymmetric_keys/x509_cert_parser.c:366\n    Read of size 128 at addr ffff880035dd9eaf by task keyctl/195\n\n    CPU: 1 PID: 195 Comm: keyctl Not tainted 4.14.0-09238-g1d3b78bbc6e9 #26\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014\n    Call Trace:\n     __dump_stack lib/dump_stack.c:17 [inline]\n     dump_stack+0xd1/0x175 lib/dump_stack.c:53\n     print_address_description+0x78/0x260 mm/kasan/report.c:252\n     kasan_report_error mm/kasan/report.c:351 [inline]\n     kasan_report+0x23f/0x350 mm/kasan/report.c:409\n     memcpy+0x1f/0x50 mm/kasan/kasan.c:302\n     memcpy ./include/linux/string.h:341 [inline]\n     x509_fabricate_name.constprop.1+0x1a4/0x940 crypto/asymmetric_keys/x509_cert_parser.c:366\n     asn1_ber_decoder+0xb4a/0x1fd0 lib/asn1_decoder.c:447\n     x509_cert_parse+0x1c7/0x620 crypto/asymmetric_keys/x509_cert_parser.c:89\n     x509_key_preparse+0x61/0x750 crypto/asymmetric_keys/x509_public_key.c:174\n     asymmetric_key_preparse+0xa4/0x150 crypto/asymmetric_keys/asymmetric_type.c:388\n     key_create_or_update+0x4d4/0x10a0 security/keys/key.c:850\n     SYSC_add_key security/keys/keyctl.c:122 [inline]\n     SyS_add_key+0xe8/0x290 security/keys/keyctl.c:62\n     entry_SYSCALL_64_fastpath+0x1f/0x96\n\n    Allocated by task 195:\n     __do_kmalloc_node mm/slab.c:3675 [inline]\n     __kmalloc_node+0x47/0x60 mm/slab.c:3682\n     kvmalloc ./include/linux/mm.h:540 [inline]\n     SYSC_add_key security/keys/keyctl.c:104 [inline]\n     SyS_add_key+0x19e/0x290 security/keys/keyctl.c:62\n     entry_SYSCALL_64_fastpath+0x1f/0x96\n\nFixes: 42d5ec27f873 (\"X.509: Add an ASN.1 decoder\")\nReported-by: Alexander Potapenko <glider@google.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/65be20f6dccec14f349777fc294ef8f8b590ce83"},{"sha":"c9fa5fe3bddd4b6e24661a236440414d655d3ac4","author":{"name":"Eric Biggers","email":"6f6115196800bbe9712b3f04c7e40093bb382fc5@google.com"},"message":"KEYS: fix out-of-bounds read during ASN.1 parsing\n\ncommit 2eb9eabf1e868fda15808954fb29b0f105ed65f1 upstream.\n\nsyzkaller with KASAN reported an out-of-bounds read in\nasn1_ber_decoder().  It can be reproduced by the following command,\nassuming CONFIG_X509_CERTIFICATE_PARSER=y and CONFIG_KASAN=y:\n\n    keyctl add asymmetric desc $'\\x30\\x30' @s\n\nThe bug is that the length of an ASN.1 data value isn't validated in the\ncase where it is encoded using the short form, causing the decoder to\nread past the end of the input buffer.  Fix it by validating the length.\n\nThe bug report was:\n\n    BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x10cb/0x1730 lib/asn1_decoder.c:233\n    Read of size 1 at addr ffff88003cccfa02 by task syz-executor0/6818\n\n    CPU: 1 PID: 6818 Comm: syz-executor0 Not tainted 4.14.0-rc7-00008-g5f479447d983 #2\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n    Call Trace:\n     __dump_stack lib/dump_stack.c:16 [inline]\n     dump_stack+0xb3/0x10b lib/dump_stack.c:52\n     print_address_description+0x79/0x2a0 mm/kasan/report.c:252\n     kasan_report_error mm/kasan/report.c:351 [inline]\n     kasan_report+0x236/0x340 mm/kasan/report.c:409\n     __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:427\n     asn1_ber_decoder+0x10cb/0x1730 lib/asn1_decoder.c:233\n     x509_cert_parse+0x1db/0x650 crypto/asymmetric_keys/x509_cert_parser.c:89\n     x509_key_preparse+0x64/0x7a0 crypto/asymmetric_keys/x509_public_key.c:174\n     asymmetric_key_preparse+0xcb/0x1a0 crypto/asymmetric_keys/asymmetric_type.c:388\n     key_create_or_update+0x347/0xb20 security/keys/key.c:855\n     SYSC_add_key security/keys/keyctl.c:122 [inline]\n     SyS_add_key+0x1cd/0x340 security/keys/keyctl.c:62\n     entry_SYSCALL_64_fastpath+0x1f/0xbe\n    RIP: 0033:0x447c89\n    RSP: 002b:00007fca7a5d3bd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8\n    RAX: ffffffffffffffda RBX: 00007fca7a5d46cc RCX: 0000000000447c89\n    RDX: 0000000020006f4a RSI: 0000000020006000 RDI: 0000000020001ff5\n    RBP: 0000000000000046 R08: fffffffffffffffd R09: 0000000000000000\n    R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000\n    R13: 0000000000000000 R14: 00007fca7a5d49c0 R15: 00007fca7a5d4700\n\nFixes: 42d5ec27f873 (\"X.509: Add an ASN.1 decoder\")\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: James Morris <james.l.morris@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/c9fa5fe3bddd4b6e24661a236440414d655d3ac4"},{"sha":"ffa81d2e8b718f8aeb332b91d6fcf5ea4db34e27","author":{"name":"Mark Rutland","email":"1db9dd262beaa64f35756dd39531d9747b7778bb@arm.com"},"message":"BACKPORT: arm64: split thread_info from task stack\n\nThis patch moves arm64's struct thread_info from the task stack into\ntask_struct. This protects thread_info from corruption in the case of\nstack overflows, and makes its address harder to determine if stack\naddresses are leaked, making a number of attacks more difficult. Precise\ndetection and handling of overflow is left for subsequent patches.\n\nLargely, this involves changing code to store the task_struct in sp_el0,\nand acquire the thread_info from the task struct. Core code now\nimplements current_thread_info(), and as noted in <linux/sched.h> this\nrelies on offsetof(task_struct, thread_info) == 0, enforced by core\ncode.\n\nThis change means that the 'tsk' register used in entry.S now points to\na task_struct, rather than a thread_info as it used to. To make this\nclear, the TI_* field offsets are renamed to TSK_TI_*, with asm-offsets\nappropriately updated to account for the structural change.\n\nUserspace clobbers sp_el0, and we can no longer restore this from the\nstack. Instead, the current task is cached in a per-cpu variable that we\ncan safely access from early assembly as interrupts are disabled (and we\nare thus not preemptible).\n\nBoth secondary entry and idle are updated to stash the sp and task\npointer separately.\n\nSigned-off-by: Mark Rutland <mark.rutland@arm.com>\nTested-by: Laura Abbott <labbott@redhat.com>\nCc: AKASHI Takahiro <takahiro.akashi@linaro.org>\nCc: Andy Lutomirski <luto@kernel.org>\nCc: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nCc: James Morse <james.morse@arm.com>\nCc: Kees Cook <keescook@chromium.org>\nCc: Suzuki K Poulose <suzuki.poulose@arm.com>\nCc: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Catalin Marinas <catalin.marinas@arm.com>\n\nThis is a modification of Mark Rutland's original patch. Guards to check\nif CONFIG_THREAD_INFO_IN_TASK is used has been inserted. get_current()\nfor when CONFIG_THREAD_INFO_IN_TASK is not used has been added to\narch/arm64/include/asm/current.h.\n\nBug: 38331309\nChange-Id: Ic5eae344a7c2baea0864f6ae16be1e9c60c0a74a\n(cherry picked from commit c02433dd6de32f042cf3ffe476746b1115b8c096)\nSigned-off-by: Zubin Mithra <zsm@google.com>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/ffa81d2e8b718f8aeb332b91d6fcf5ea4db34e27"},{"sha":"6b77502b9b8531bc690b952825fe20fdb145d007","author":{"name":"Geert Uytterhoeven","email":"a1ff81395f7e6bf5b509fe9aab06bf3419493e1d@glider.be"},"message":"ARM: amba: Don't read past the end of sysfs \"driver_override\" buffer\n\ncommit d2ffed5185df9d8d9ccd150e4340e3b6f96a8381 upstream.\n\nWhen printing the driver_override parameter when it is 4095 and 4094\nbytes long, the printing code would access invalid memory because we\nneed count + 1 bytes for printing.\n\nCfr. commits 4efe874aace57dba (\"PCI: Don't read past the end of sysfs\n\"driver_override\" buffer\") and bf563b01c2895a4b (\"driver core: platform:\nDon't read past the end of \"driver_override\" buffer\").\n\nFixes: 3cf385713460eb2b (\"ARM: 8256/1: driver coamba: add device binding path 'driver_override'\")\nSigned-off-by: Geert Uytterhoeven <geert+renesas@glider.be>\nReviewed-by: Todd Kjos <tkjos@google.com>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/6b77502b9b8531bc690b952825fe20fdb145d007"},{"sha":"6e2b89c450276330f89e1a874e346665b3bdef86","author":{"name":"Alexander Potapenko","email":"3640347d2aca22f57be504cddeccc130f1a3ca7e@google.com"},"message":"ipv4, ipv6: ensure raw socket message is big enough to hold an IP header\n\n[ Upstream commit 86f4c90a1c5c1493f07f2d12c1079f5bf01936f2 ]\n\nraw_send_hdrinc() and rawv6_send_hdrinc() expect that the buffer copied\nfrom the userspace contains the IPv4/IPv6 header, so if too few bytes are\ncopied, parts of the header may remain uninitialized.\n\nThis bug has been detected with KMSAN.\n\nFor the record, the KMSAN report:\n\n==================================================================\nBUG: KMSAN: use of unitialized memory in nf_ct_frag6_gather+0xf5a/0x44a0\ninter: 0\nCPU: 0 PID: 1036 Comm: probe Not tainted 4.11.0-rc5+ #2455\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:16\n dump_stack+0x143/0x1b0 lib/dump_stack.c:52\n kmsan_report+0x16b/0x1e0 mm/kmsan/kmsan.c:1078\n __kmsan_warning_32+0x5c/0xa0 mm/kmsan/kmsan_instr.c:510\n nf_ct_frag6_gather+0xf5a/0x44a0 net/ipv6/netfilter/nf_conntrack_reasm.c:577\n ipv6_defrag+0x1d9/0x280 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:68\n nf_hook_entry_hookfn ./include/linux/netfilter.h:102\n nf_hook_slow+0x13f/0x3c0 net/netfilter/core.c:310\n nf_hook ./include/linux/netfilter.h:212\n NF_HOOK ./include/linux/netfilter.h:255\n rawv6_send_hdrinc net/ipv6/raw.c:673\n rawv6_sendmsg+0x2fcb/0x41a0 net/ipv6/raw.c:919\n inet_sendmsg+0x3f8/0x6d0 net/ipv4/af_inet.c:762\n sock_sendmsg_nosec net/socket.c:633\n sock_sendmsg net/socket.c:643\n SYSC_sendto+0x6a5/0x7c0 net/socket.c:1696\n SyS_sendto+0xbc/0xe0 net/socket.c:1664\n do_syscall_64+0x72/0xa0 arch/x86/entry/common.c:285\n entry_SYSCALL64_slow_path+0x25/0x25 arch/x86/entry/entry_64.S:246\nRIP: 0033:0x436e03\nRSP: 002b:00007ffce48baf38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 00000000004002b0 RCX: 0000000000436e03\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003\nRBP: 00007ffce48baf90 R08: 00007ffce48baf50 R09: 000000000000001c\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000401790 R14: 0000000000401820 R15: 0000000000000000\norigin: 00000000d9400053\n save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59\n kmsan_save_stack_with_flags mm/kmsan/kmsan.c:362\n kmsan_internal_poison_shadow+0xb1/0x1a0 mm/kmsan/kmsan.c:257\n kmsan_poison_shadow+0x6d/0xc0 mm/kmsan/kmsan.c:270\n slab_alloc_node mm/slub.c:2735\n __kmalloc_node_track_caller+0x1f4/0x390 mm/slub.c:4341\n __kmalloc_reserve net/core/skbuff.c:138\n __alloc_skb+0x2cd/0x740 net/core/skbuff.c:231\n alloc_skb ./include/linux/skbuff.h:933\n alloc_skb_with_frags+0x209/0xbc0 net/core/skbuff.c:4678\n sock_alloc_send_pskb+0x9ff/0xe00 net/core/sock.c:1903\n sock_alloc_send_skb+0xe4/0x100 net/core/sock.c:1920\n rawv6_send_hdrinc net/ipv6/raw.c:638\n rawv6_sendmsg+0x2918/0x41a0 net/ipv6/raw.c:919\n inet_sendmsg+0x3f8/0x6d0 net/ipv4/af_inet.c:762\n sock_sendmsg_nosec net/socket.c:633\n sock_sendmsg net/socket.c:643\n SYSC_sendto+0x6a5/0x7c0 net/socket.c:1696\n SyS_sendto+0xbc/0xe0 net/socket.c:1664\n do_syscall_64+0x72/0xa0 arch/x86/entry/common.c:285\n return_from_SYSCALL_64+0x0/0x6a arch/x86/entry/entry_64.S:246\n==================================================================\n\n, triggered by the following syscalls:\n  socket(PF_INET6, SOCK_RAW, IPPROTO_RAW) = 3\n  sendto(3, NULL, 0, 0, {sa_family=AF_INET6, sin6_port=htons(0), inet_pton(AF_INET6, \"ff00::\", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = -1 EPERM\n\nA similar report is triggered in net/ipv4/raw.c if we use a PF_INET socket\ninstead of a PF_INET6 one.\n\nSigned-off-by: Alexander Potapenko <glider@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/6e2b89c450276330f89e1a874e346665b3bdef86"},{"sha":"7a830f73da16f409d30a2013af8e8b32c84d9a57","author":{"name":"Mike Maloney","email":"11e0c74741bc2265cea35da5594829826913c970@google.com"},"message":"ipv6: fix udpv6 sendmsg crash caused by too small MTU\n\n\n[ Upstream commit 749439bfac6e1a2932c582e2699f91d329658196 ]\n\nThe logic in __ip6_append_data() assumes that the MTU is at least large\nenough for the headers.  A device's MTU may be adjusted after being\nadded while sendmsg() is processing data, resulting in\n__ip6_append_data() seeing any MTU.  For an mtu smaller than the size of\nthe fragmentation header, the math results in a negative 'maxfraglen',\nwhich causes problems when refragmenting any previous skb in the\nskb_write_queue, leaving it possibly malformed.\n\nInstead sendmsg returns EINVAL when the mtu is calculated to be less\nthan IPV6_MIN_MTU.\n\nFound by syzkaller:\nkernel BUG at ./include/linux/skbuff.h:2064!\ninvalid opcode: 0000 [#1] SMP KASAN\nDumping ftrace buffer:\n   (ftrace buffer empty)\nModules linked in:\nCPU: 1 PID: 14216 Comm: syz-executor5 Not tainted 4.13.0-rc4+ #2\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\ntask: ffff8801d0b68580 task.stack: ffff8801ac6b8000\nRIP: 0010:__skb_pull include/linux/skbuff.h:2064 [inline]\nRIP: 0010:__ip6_make_skb+0x18cf/0x1f70 net/ipv6/ip6_output.c:1617\nRSP: 0018:ffff8801ac6bf570 EFLAGS: 00010216\nRAX: 0000000000010000 RBX: 0000000000000028 RCX: ffffc90003cce000\nRDX: 00000000000001b8 RSI: ffffffff839df06f RDI: ffff8801d9478ca0\nRBP: ffff8801ac6bf780 R08: ffff8801cc3f1dbc R09: 0000000000000000\nR10: ffff8801ac6bf7a0 R11: 43cb4b7b1948a9e7 R12: ffff8801cc3f1dc8\nR13: ffff8801cc3f1d40 R14: 0000000000001036 R15: dffffc0000000000\nFS:  00007f43d740c700(0000) GS:ffff8801dc100000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f7834984000 CR3: 00000001d79b9000 CR4: 00000000001406e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n ip6_finish_skb include/net/ipv6.h:911 [inline]\n udp_v6_push_pending_frames+0x255/0x390 net/ipv6/udp.c:1093\n udpv6_sendmsg+0x280d/0x31a0 net/ipv6/udp.c:1363\n inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:762\n sock_sendmsg_nosec net/socket.c:633 [inline]\n sock_sendmsg+0xca/0x110 net/socket.c:643\n SYSC_sendto+0x352/0x5a0 net/socket.c:1750\n SyS_sendto+0x40/0x50 net/socket.c:1718\n entry_SYSCALL_64_fastpath+0x1f/0xbe\nRIP: 0033:0x4512e9\nRSP: 002b:00007f43d740bc08 EFLAGS: 00000216 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 00000000007180a8 RCX: 00000000004512e9\nRDX: 000000000000002e RSI: 0000000020d08000 RDI: 0000000000000005\nRBP: 0000000000000086 R08: 00000000209c1000 R09: 000000000000001c\nR10: 0000000000040800 R11: 0000000000000216 R12: 00000000004b9c69\nR13: 00000000ffffffff R14: 0000000000000005 R15: 00000000202c2000\nCode: 9e 01 fe e9 c5 e8 ff ff e8 7f 9e 01 fe e9 4a ea ff ff 48 89 f7 e8 52 9e 01 fe e9 aa eb ff ff e8 a8 b6 cf fd 0f 0b e8 a1 b6 cf fd <0f> 0b 49 8d 45 78 4d 8d 45 7c 48 89 85 78 fe ff ff 49 8d 85 ba\nRIP: __skb_pull include/linux/skbuff.h:2064 [inline] RSP: ffff8801ac6bf570\nRIP: __ip6_make_skb+0x18cf/0x1f70 net/ipv6/ip6_output.c:1617 RSP: ffff8801ac6bf570\n\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: Mike Maloney <maloney@google.com>\nReviewed-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/7a830f73da16f409d30a2013af8e8b32c84d9a57"},{"sha":"2cbcf43478231a1856d12efa2ff42d009b36c631","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"ipv6: ip6_make_skb() needs to clear cork.base.dst\n\n\n[ Upstream commit 95ef498d977bf44ac094778fd448b98af158a3e6 ]\n\nIn my last patch, I missed fact that cork.base.dst was not initialized\nin ip6_make_skb() :\n\nIf ip6_setup_cork() returns an error, we might attempt a dst_release()\non some random pointer.\n\nFixes: 862c03ee1deb (\"ipv6: fix possible mem leaks in ipv6_make_skb()\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/2cbcf43478231a1856d12efa2ff42d009b36c631"},{"sha":"c8579e811e2769d256fefdbdb9c91a1be1a8ead4","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"ipv6: fix possible mem leaks in ipv6_make_skb()\n\n\n[ Upstream commit 862c03ee1deb7e19e0f9931682e0294ecd1fcaf9 ]\n\nip6_setup_cork() might return an error, while memory allocations have\nbeen done and must be rolled back.\n\nFixes: 6422398c2ab0 (\"ipv6: introduce ipv6_make_skb\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Vlad Yasevich <vyasevich@gmail.com>\nReported-by: Mike Maloney <maloney@google.com>\nAcked-by:  Mike Maloney <maloney@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/c8579e811e2769d256fefdbdb9c91a1be1a8ead4"},{"sha":"7e4e3c3ae23f0f252eae79bb0866ff2a0e10c0ba","author":{"name":"Hou Tao","email":"81fb726ec5ca1d0cf3291fefbf0bcf1e05e096da@huawei.com"},"message":"blkcg: fix double free of new_blkg in blkcg_init_queue\n\ncommit 9b54d816e00425c3a517514e0d677bb3cec49258 upstream.\n\nIf blkg_create fails, new_blkg passed as an argument will\nbe freed by blkg_create, so there is no need to free it again.\n\nSigned-off-by: Hou Tao <houtao1@huawei.com>\nSigned-off-by: Jens Axboe <axboe@fb.com>\nCc: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/7e4e3c3ae23f0f252eae79bb0866ff2a0e10c0ba"},{"sha":"8bbef324ee334e6a330a645b879856a354860525","author":{"name":"Todd Kjos","email":"8be399b0cc2f31b2ed16702a88343f61fd6797ee@google.com"},"message":"Revert \"BACKPORT: arm64: split thread_info from task stack\"\n\nThis reverts commit ffa81d2e8b718f8aeb332b91d6fcf5ea4db34e27.","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/8bbef324ee334e6a330a645b879856a354860525"}]}
{"actor":{"display_login":"Jackeagle"}}