{"push_id":2997588150,"size":138,"distinct_size":3,"ref":"refs/heads/oreo-mr1-stock","head":"6228af652ef2ac81c61b4bdbe0abe7e2b4e3d3a4","before":"417f4b00fa7e8af4ece38fc6019e82d418400a54","commits":[{"sha":"0b55774efd87593116228b6e120e2335727de161","author":{"name":"Krishna Manikandan","email":"493fff274643f41a2b3fe3195a065f232f89f3ff@codeaurora.org"},"message":"msm: mdss: Use TPG to handle null commit\n\nAdd support to use TPG to send configurable constant color to\npanel during the null commit to ensure that no fetch\nis happening during the secure to non-secure transition and\nvice-versa.\n\nChange-Id: I8cc1a283e88fa9be91da38019c7d532d5180dfb5\nSigned-off-by: Krishna Manikandan <mkrishn@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/0b55774efd87593116228b6e120e2335727de161"},{"sha":"98b7b46a6e13796c248fd3cbf382c3652b0c6949","author":{"name":"Sriharsha Allenki","email":"87f9e90e139799351d7b7eafea3d30c76fd535a2@codeaurora.org"},"message":"usb: dwc3: Prevent runtime_suspend after wakeup event\n\nCurrently the core is being suspended even after the\nwakeup event because the autosuspend delay is elapsed\nafter the wakeup event is received but before the sm_work\nis executed.\nPrevent the runtime_suspend being called by marking last_busy\nwhen the wakeup interrupt is received. Also bail out\nfrom the dwc3_msm_suspend if a wakeup interrupt is\nreceived.\n\nChange-Id: I229338adbf3a6719e7e818d1da83eda9f03034b7\nSigned-off-by: Sriharsha Allenki <sallenki@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/98b7b46a6e13796c248fd3cbf382c3652b0c6949"},{"sha":"a220a762521327f971341bef02108f7402957c66","author":{"name":"Al Viro","email":"de609eb4d5d70b1d38ec6642adbfc33a2781f63c@zeniv.linux.org.uk"},"message":"lock_parent() needs to recheck if dentry got __dentry_kill'ed under it\n\ncommit 3b821409632ab778d46e807516b457dfa72736ed upstream.\n\nIn case when dentry passed to lock_parent() is protected from freeing only\nby the fact that it's on a shrink list and trylock of parent fails, we\ncould get hit by __dentry_kill() (and subsequent dentry_kill(parent))\nbetween unlocking dentry and locking presumed parent.  We need to recheck\nthat dentry is alive once we lock both it and parent *and* postpone\nrcu_read_unlock() until after that point.  Otherwise we could return\na pointer to struct dentry that already is rcu-scheduled for freeing, with\n->d_lock held on it; caller's subsequent attempt to unlock it can end\nup with memory corruption.\n\nChange-Id: I909cf83e8b856711317d5192e480cc417349ace4\nCc: stable@vger.kernel.org # 3.12+, counting backports\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nGit-Repo: https://android.googlesource.com/kernel/common/\nGit-Commit: e4353660cf59d49f2c75789081e97c9da21631ec\nSigned-off-by: Sahitya Tummala <stummala@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/a220a762521327f971341bef02108f7402957c66"},{"sha":"f7b38d2362b587cf9675c2bf121d6554ddca51e2","author":{"name":"Linux Build Service Account","email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost"},"message":"Merge \"usb: dwc3: Prevent runtime_suspend after wakeup event\"","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/f7b38d2362b587cf9675c2bf121d6554ddca51e2"},{"sha":"0a4a646bcbb62c54a307419da74131be936421ce","author":{"name":"Linux Build Service Account","email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost"},"message":"Merge \"msm: mdss: Use TPG to handle null commit\"","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/0a4a646bcbb62c54a307419da74131be936421ce"},{"sha":"87bdbdb9196dea7d3c76d6e8ece1c5969f25681f","author":{"name":"Manoj Prabhu B","email":"51b61d6315ea064116d73791151f1cd7671c0f3a@codeaurora.org"},"message":"diag: Modify md_info and diag client map synchronization\n\nExtend the scope of protection to md_info till queueing\nthe write to sdcard. Patch adds protection to diag client map\nsynchronizing access by various clients.\n\nCRs-Fixed: 2282558\nChange-Id: If076af2d09180a282a9077b4ebcda0184e9f67b5\nSigned-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/87bdbdb9196dea7d3c76d6e8ece1c5969f25681f"},{"sha":"8a22a653e4730973bf26cd4415c74c8c7bb7224f","author":{"name":"Linux Build Service Account","email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost"},"message":"Merge \"lock_parent() needs to recheck if dentry got __dentry_kill'ed under it\"","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/8a22a653e4730973bf26cd4415c74c8c7bb7224f"},{"sha":"994d6e738708548e56fcbf3afc1bba796d9bca0f","author":{"name":"Linux Build Service Account","email":"d3c7bae90ce2477533ec852edf38b65198016249@localhost"},"message":"Merge 8a22a653e4730973bf26cd4415c74c8c7bb7224f on remote branch\n\nChange-Id: I12efb5e7ef67df36bfa771eeac99164b220ef4bc","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/994d6e738708548e56fcbf3afc1bba796d9bca0f"},{"sha":"b1b1ba1d6672ec3491bf5263f41dcffb0506835d","author":{"name":"Soumya Managoli","email":"186e7356f934358edb5f6b05018df524a47f0599@codeaurora.org"},"message":"asoc : msm: Fix zero size pointer issue\n\nAPPS crashes randomly due to invalid memory allocation\nin q6asm_audio_client_buf_free_contiguous.\nAdded check to return error if memory allocation size is 0.\n\nChange-Id: I40f49aa147d513b29b56224a5ee77ccbb2dcc110\nCRs-Fixed: 2285272\nSigned-off-by: Soumya Managoli <smanag@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/b1b1ba1d6672ec3491bf5263f41dcffb0506835d"},{"sha":"b3667b7a8e1dbc4d3413f147fa8ef0e0fafdbc12","author":{"name":"Sébastien Szymanski","email":"df6bdf20a159eda54db82d97e15e3f2b8626ef27@armadeus.com"},"message":"ASoC: cs4265: fix MMTLR Data switch control\n\ncommit 90a3b7f8aba3011badacd6d8121e03aa24ac79d1 upstream.\n\nThe MMTLR bit is in the CS4265_SPDIF_CTL2 register at address 0x12 bit 0\nand not at address 0x0 bit 1. Fix this.\n\nSigned-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/b3667b7a8e1dbc4d3413f147fa8ef0e0fafdbc12"},{"sha":"7ddd41b2558b213469ad911f03a929d5de02244f","author":{"name":"Takashi Sakamoto","email":"d5ec7d0cd8074757a1f5eb708bc105c3065a65ea@sakamocchi.jp"},"message":"ALSA: bebob: use address returned by kmalloc() instead of kernel stack for streaming DMA mapping\n\ncommit 493626f2d87a74e6dbea1686499ed6e7e600484e upstream.\n\nWhen executing 'fw_run_transaction()' with 'TCODE_WRITE_BLOCK_REQUEST',\nan address of 'payload' argument is used for streaming DMA mapping by\n'firewire_ohci' module if 'size' argument is larger than 8 byte.\nAlthough in this case the address should not be on kernel stack, current\nimplementation of ALSA bebob driver uses data in kernel stack for a cue\nto boot M-Audio devices. This often brings unexpected result, especially\nfor a case of CONFIG_VMAP_STACK=y.\n\nThis commit fixes the bug.\n\nReference: https://bugzilla.kernel.org/show_bug.cgi?id=201021\nReference: https://forum.manjaro.org/t/firewire-m-audio-410-driver-wont-load-firmware/51165\nFixes: a2b2a7798fb6('ALSA: bebob: Send a cue to load firmware for M-Audio Firewire series')\nCc: <stable@vger.kernel.org> # v3.16+\nSigned-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/7ddd41b2558b213469ad911f03a929d5de02244f"},{"sha":"b27adc00ceb6426c8e2e6a23a327acde678c28eb","author":{"name":"Willy Tarreau","email":"aff024fe4ab0fece4091de044c58c9ae4233383a@1wt.eu"},"message":"ALSA: emu10k1: fix possible info leak to userspace on SNDRV_EMU10K1_IOCTL_INFO\n\ncommit 49434c6c575d2008c0abbc93e615019f39e01252 upstream.\n\nsnd_emu10k1_fx8010_ioctl(SNDRV_EMU10K1_IOCTL_INFO) allocates\nmemory using kmalloc() and partially fills it by calling\nsnd_emu10k1_fx8010_info() before returning the resulting\nstructure to userspace, leaving uninitialized holes. Let's\njust use kzalloc() here.\n\nBugLink: http://blog.infosectcbr.com.au/2018/09/linux-kernel-infoleaks.html\nSigned-off-by: Willy Tarreau <w@1wt.eu>\nCc: Jann Horn <jannh@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/b27adc00ceb6426c8e2e6a23a327acde678c28eb"},{"sha":"05bc6cb652c2703d47d8ce91548eb024db17a40f","author":{"name":"Vaibhav Nagarnaik","email":"1fa667586c90bce718fd3c486c1144f98789d483@google.com"},"message":"ring-buffer: Allow for rescheduling when removing pages\n\ncommit 83f365554e47997ec68dc4eca3f5dce525cd15c3 upstream.\n\nWhen reducing ring buffer size, pages are removed by scheduling a work\nitem on each CPU for the corresponding CPU ring buffer. After the pages\nare removed from ring buffer linked list, the pages are free()d in a\ntight loop. The loop does not give up CPU until all pages are removed.\nIn a worst case behavior, when lot of pages are to be freed, it can\ncause system stall.\n\nAfter the pages are removed from the list, the free() can happen while\nthe work is rescheduled. Call cond_resched() in the loop to prevent the\nsystem hangup.\n\nLink: http://lkml.kernel.org/r/20180907223129.71994-1-vnagarnaik@google.com\n\nCc: stable@vger.kernel.org\nFixes: 83f40318dab00 (\"ring-buffer: Make removal of ring buffer pages atomic\")\nReported-by: Jason Behmer <jbehmer@google.com>\nSigned-off-by: Vaibhav Nagarnaik <vnagarnaik@google.com>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/05bc6cb652c2703d47d8ce91548eb024db17a40f"},{"sha":"b4570618fa02bcd9eec7d249c22f16ed503f8ec6","author":{"name":"Joel Fernandes (Google)","email":"4816dabf8db1bc6cac35b3a24cab2ff844b5b0c7@joelfernandes.org"},"message":"mm: shmem.c: Correctly annotate new inodes for lockdep\n\ncommit b45d71fb89ab8adfe727b9d0ee188ed58582a647 upstream.\n\nDirectories and inodes don't necessarily need to be in the same lockdep\nclass.  For ex, hugetlbfs splits them out too to prevent false positives\nin lockdep.  Annotate correctly after new inode creation.  If its a\ndirectory inode, it will be put into a different class.\n\nThis should fix a lockdep splat reported by syzbot:\n\n> ======================================================\n> WARNING: possible circular locking dependency detected\n> 4.18.0-rc8-next-20180810+ #36 Not tainted\n> ------------------------------------------------------\n> syz-executor900/4483 is trying to acquire lock:\n> 00000000d2bfc8fe (&sb->s_type->i_mutex_key#9){++++}, at: inode_lock\n> include/linux/fs.h:765 [inline]\n> 00000000d2bfc8fe (&sb->s_type->i_mutex_key#9){++++}, at:\n> shmem_fallocate+0x18b/0x12e0 mm/shmem.c:2602\n>\n> but task is already holding lock:\n> 0000000025208078 (ashmem_mutex){+.+.}, at: ashmem_shrink_scan+0xb4/0x630\n> drivers/staging/android/ashmem.c:448\n>\n> which lock already depends on the new lock.\n>\n> -> #2 (ashmem_mutex){+.+.}:\n>        __mutex_lock_common kernel/locking/mutex.c:925 [inline]\n>        __mutex_lock+0x171/0x1700 kernel/locking/mutex.c:1073\n>        mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1088\n>        ashmem_mmap+0x55/0x520 drivers/staging/android/ashmem.c:361\n>        call_mmap include/linux/fs.h:1844 [inline]\n>        mmap_region+0xf27/0x1c50 mm/mmap.c:1762\n>        do_mmap+0xa10/0x1220 mm/mmap.c:1535\n>        do_mmap_pgoff include/linux/mm.h:2298 [inline]\n>        vm_mmap_pgoff+0x213/0x2c0 mm/util.c:357\n>        ksys_mmap_pgoff+0x4da/0x660 mm/mmap.c:1585\n>        __do_sys_mmap arch/x86/kernel/sys_x86_64.c:100 [inline]\n>        __se_sys_mmap arch/x86/kernel/sys_x86_64.c:91 [inline]\n>        __x64_sys_mmap+0xe9/0x1b0 arch/x86/kernel/sys_x86_64.c:91\n>        do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290\n>        entry_SYSCALL_64_after_hwframe+0x49/0xbe\n>\n> -> #1 (&mm->mmap_sem){++++}:\n>        __might_fault+0x155/0x1e0 mm/memory.c:4568\n>        _copy_to_user+0x30/0x110 lib/usercopy.c:25\n>        copy_to_user include/linux/uaccess.h:155 [inline]\n>        filldir+0x1ea/0x3a0 fs/readdir.c:196\n>        dir_emit_dot include/linux/fs.h:3464 [inline]\n>        dir_emit_dots include/linux/fs.h:3475 [inline]\n>        dcache_readdir+0x13a/0x620 fs/libfs.c:193\n>        iterate_dir+0x48b/0x5d0 fs/readdir.c:51\n>        __do_sys_getdents fs/readdir.c:231 [inline]\n>        __se_sys_getdents fs/readdir.c:212 [inline]\n>        __x64_sys_getdents+0x29f/0x510 fs/readdir.c:212\n>        do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290\n>        entry_SYSCALL_64_after_hwframe+0x49/0xbe\n>\n> -> #0 (&sb->s_type->i_mutex_key#9){++++}:\n>        lock_acquire+0x1e4/0x540 kernel/locking/lockdep.c:3924\n>        down_write+0x8f/0x130 kernel/locking/rwsem.c:70\n>        inode_lock include/linux/fs.h:765 [inline]\n>        shmem_fallocate+0x18b/0x12e0 mm/shmem.c:2602\n>        ashmem_shrink_scan+0x236/0x630 drivers/staging/android/ashmem.c:455\n>        ashmem_ioctl+0x3ae/0x13a0 drivers/staging/android/ashmem.c:797\n>        vfs_ioctl fs/ioctl.c:46 [inline]\n>        file_ioctl fs/ioctl.c:501 [inline]\n>        do_vfs_ioctl+0x1de/0x1720 fs/ioctl.c:685\n>        ksys_ioctl+0xa9/0xd0 fs/ioctl.c:702\n>        __do_sys_ioctl fs/ioctl.c:709 [inline]\n>        __se_sys_ioctl fs/ioctl.c:707 [inline]\n>        __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:707\n>        do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290\n>        entry_SYSCALL_64_after_hwframe+0x49/0xbe\n>\n> other info that might help us debug this:\n>\n> Chain exists of:\n>   &sb->s_type->i_mutex_key#9 --> &mm->mmap_sem --> ashmem_mutex\n>\n>  Possible unsafe locking scenario:\n>\n>        CPU0                    CPU1\n>        ----                    ----\n>   lock(ashmem_mutex);\n>                                lock(&mm->mmap_sem);\n>                                lock(ashmem_mutex);\n>   lock(&sb->s_type->i_mutex_key#9);\n>\n>  *** DEADLOCK ***\n>\n> 1 lock held by syz-executor900/4483:\n>  #0: 0000000025208078 (ashmem_mutex){+.+.}, at:\n> ashmem_shrink_scan+0xb4/0x630 drivers/staging/android/ashmem.c:448\n\nLink: http://lkml.kernel.org/r/20180821231835.166639-1-joel@joelfernandes.org\nSigned-off-by: Joel Fernandes (Google) <joel@joelfernandes.org>\nReported-by: syzbot <syzkaller@googlegroups.com>\nReviewed-by: NeilBrown <neilb@suse.com>\nSuggested-by: NeilBrown <neilb@suse.com>\nCc: Matthew Wilcox <willy@infradead.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Hugh Dickins <hughd@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/b4570618fa02bcd9eec7d249c22f16ed503f8ec6"},{"sha":"0aced03a0e2527b92241b3cc4994458759d021c0","author":{"name":"Toke Høiland-Jørgensen","email":"c739cf9ea9032889618db8b95a03da66fcc9867e@toke.dk"},"message":"gso_segment: Reset skb->mac_len after modifying network header\n\n[ Upstream commit c56cae23c6b167acc68043c683c4573b80cbcc2c ]\n\nWhen splitting a GSO segment that consists of encapsulated packets, the\nskb->mac_len of the segments can end up being set wrong, causing packet\ndrops in particular when using act_mirred and ifb interfaces in\ncombination with a qdisc that splits GSO packets.\n\nThis happens because at the time skb_segment() is called, network_header\nwill point to the inner header, throwing off the calculation in\nskb_reset_mac_len(). The network_header is subsequently adjust by the\nouter IP gso_segment handlers, but they don't set the mac_len.\n\nFix this by adding skb_reset_mac_len() calls to both the IPv4 and IPv6\ngso_segment handlers, after they modify the network_header.\n\nMany thanks to Eric Dumazet for his help in identifying the cause of\nthe bug.\n\nAcked-by: Dave Taht <dave.taht@gmail.com>\nReviewed-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: Toke Høiland-Jørgensen <toke@toke.dk>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/0aced03a0e2527b92241b3cc4994458759d021c0"},{"sha":"2ababd51858f71ef174a1bb2fe045f0b23f04c1c","author":{"name":"Willy Tarreau","email":"aff024fe4ab0fece4091de044c58c9ae4233383a@1wt.eu"},"message":"net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT\n\n[ Upstream commit 9824dfae5741275473a23a7ed5756c7b6efacc9d ]\n\nFields ->dev and ->next of struct ipddp_route may be copied to\nuserspace on the SIOCFINDIPDDPRT ioctl. This is only accessible\nto CAP_NET_ADMIN though. Let's manually copy the relevant fields\ninstead of using memcpy().\n\nBugLink: http://blog.infosectcbr.com.au/2018/09/linux-kernel-infoleaks.html\nCc: Jann Horn <jannh@google.com>\nSigned-off-by: Willy Tarreau <w@1wt.eu>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/2ababd51858f71ef174a1bb2fe045f0b23f04c1c"},{"sha":"a9b7eba12438c4b5219f56d920ed269e10dbb906","author":{"name":"Colin Ian King","email":"d100aa70785e45ee8deab668147d941941915c21@canonical.com"},"message":"net: hp100: fix always-true check for link up state\n\n[ Upstream commit a7f38002fb69b44f8fc622ecb838665d0b8666af ]\n\nThe operation ~(p100_inb(VG_LAN_CFG_1) & HP100_LINK_UP) returns a value\nthat is always non-zero and hence the wait for the link to drop always\nterminates prematurely.  Fix this by using a logical not operator instead\nof a bitwise complement.  This issue has been in the driver since\npre-2.6.12-rc2.\n\nDetected by CoverityScan, CID#114157 (\"Logical vs. bitwise operator\")\n\nSigned-off-by: Colin Ian King <colin.king@canonical.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/a9b7eba12438c4b5219f56d920ed269e10dbb906"},{"sha":"3f0d9d15b163049af09ac66cd2a25d103307cd06","author":{"name":"Vasily Khoruzhick","email":"8d423c6462c386eeb08996628b7802c179650542@arista.com"},"message":"neighbour: confirm neigh entries when ARP packet is received\n\n[ Upstream commit f0e0d04413fcce9bc76388839099aee93cd0d33b ]\n\nUpdate 'confirmed' timestamp when ARP packet is received. It shouldn't\naffect locktime logic and anyway entry can be confirmed by any higher-layer\nprotocol. Thus it makes sense to confirm it when ARP packet is received.\n\nFixes: 77d7123342dc (\"neighbour: update neigh timestamps iff update is effective\")\nSigned-off-by: Vasily Khoruzhick <vasilykh@arista.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/3f0d9d15b163049af09ac66cd2a25d103307cd06"},{"sha":"2e421bf4b9632dfd0a39edfa6d362f3de4461065","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"ipv6: fix possible use-after-free in ip6_xmit()\n\n[ Upstream commit bbd6528d28c1b8e80832b3b018ec402b6f5c3215 ]\n\nIn the unlikely case ip6_xmit() has to call skb_realloc_headroom(),\nwe need to call skb_set_owner_w() before consuming original skb,\notherwise we risk a use-after-free.\n\nBring IPv6 in line with what we do in IPv4 to fix this.\n\nFixes: 1da177e4c3f41 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/2e421bf4b9632dfd0a39edfa6d362f3de4461065"},{"sha":"d31152ba0f282348c9ffbd8436b7a3622064aea6","author":{"name":"Vincent Pelletier","email":"79ed65387ffcd88b36f0a80b55bba4063084e90e@gmail.com"},"message":"scsi: target: iscsi: Use hex2bin instead of a re-implementation\n\ncommit 1816494330a83f2a064499d8ed2797045641f92c upstream.\n\nThis change has the following effects, in order of descreasing importance:\n\n1) Prevent a stack buffer overflow\n\n2) Do not append an unnecessary NULL to an anyway binary buffer, which\n   is writing one byte past client_digest when caller is:\n   chap_string_to_hex(client_digest, chap_r, strlen(chap_r));\n\nThe latter was found by KASAN (see below) when input value hes expected size\n(32 hex chars), and further analysis revealed a stack buffer overflow can\nhappen when network-received value is longer, allowing an unauthenticated\nremote attacker to smash up to 17 bytes after destination buffer (16 bytes\nattacker-controlled and one null).  As switching to hex2bin requires\nspecifying destination buffer length, and does not internally append any null,\nit solves both issues.\n\nThis addresses CVE-2018-14633.\n\nBeyond this:\n\n- Validate received value length and check hex2bin accepted the input, to log\n  this rejection reason instead of just failing authentication.\n\n- Only log received CHAP_R and CHAP_C values once they passed sanity checks.\n\n==================================================================\nBUG: KASAN: stack-out-of-bounds in chap_string_to_hex+0x32/0x60 [iscsi_target_mod]\nWrite of size 1 at addr ffff8801090ef7c8 by task kworker/0:0/1021\n\nCPU: 0 PID: 1021 Comm: kworker/0:0 Tainted: G           O      4.17.8kasan.sess.connops+ #2\nHardware name: To be filled by O.E.M. To be filled by O.E.M./Aptio CRB, BIOS 5.6.5 05/19/2014\nWorkqueue: events iscsi_target_do_login_rx [iscsi_target_mod]\nCall Trace:\n dump_stack+0x71/0xac\n print_address_description+0x65/0x22e\n ? chap_string_to_hex+0x32/0x60 [iscsi_target_mod]\n kasan_report.cold.6+0x241/0x2fd\n chap_string_to_hex+0x32/0x60 [iscsi_target_mod]\n chap_server_compute_md5.isra.2+0x2cb/0x860 [iscsi_target_mod]\n ? chap_binaryhex_to_asciihex.constprop.5+0x50/0x50 [iscsi_target_mod]\n ? ftrace_caller_op_ptr+0xe/0xe\n ? __orc_find+0x6f/0xc0\n ? unwind_next_frame+0x231/0x850\n ? kthread+0x1a0/0x1c0\n ? ret_from_fork+0x35/0x40\n ? ret_from_fork+0x35/0x40\n ? iscsi_target_do_login_rx+0x3bc/0x4c0 [iscsi_target_mod]\n ? deref_stack_reg+0xd0/0xd0\n ? iscsi_target_do_login_rx+0x3bc/0x4c0 [iscsi_target_mod]\n ? is_module_text_address+0xa/0x11\n ? kernel_text_address+0x4c/0x110\n ? __save_stack_trace+0x82/0x100\n ? ret_from_fork+0x35/0x40\n ? save_stack+0x8c/0xb0\n ? 0xffffffffc1660000\n ? iscsi_target_do_login+0x155/0x8d0 [iscsi_target_mod]\n ? iscsi_target_do_login_rx+0x3bc/0x4c0 [iscsi_target_mod]\n ? process_one_work+0x35c/0x640\n ? worker_thread+0x66/0x5d0\n ? kthread+0x1a0/0x1c0\n ? ret_from_fork+0x35/0x40\n ? iscsi_update_param_value+0x80/0x80 [iscsi_target_mod]\n ? iscsit_release_cmd+0x170/0x170 [iscsi_target_mod]\n chap_main_loop+0x172/0x570 [iscsi_target_mod]\n ? chap_server_compute_md5.isra.2+0x860/0x860 [iscsi_target_mod]\n ? rx_data+0xd6/0x120 [iscsi_target_mod]\n ? iscsit_print_session_params+0xd0/0xd0 [iscsi_target_mod]\n ? cyc2ns_read_begin.part.2+0x90/0x90\n ? _raw_spin_lock_irqsave+0x25/0x50\n ? memcmp+0x45/0x70\n iscsi_target_do_login+0x875/0x8d0 [iscsi_target_mod]\n ? iscsi_target_check_first_request.isra.5+0x1a0/0x1a0 [iscsi_target_mod]\n ? del_timer+0xe0/0xe0\n ? memset+0x1f/0x40\n ? flush_sigqueue+0x29/0xd0\n iscsi_target_do_login_rx+0x3bc/0x4c0 [iscsi_target_mod]\n ? iscsi_target_nego_release+0x80/0x80 [iscsi_target_mod]\n ? iscsi_target_restore_sock_callbacks+0x130/0x130 [iscsi_target_mod]\n process_one_work+0x35c/0x640\n worker_thread+0x66/0x5d0\n ? flush_rcu_work+0x40/0x40\n kthread+0x1a0/0x1c0\n ? kthread_bind+0x30/0x30\n ret_from_fork+0x35/0x40\n\nThe buggy address belongs to the page:\npage:ffffea0004243bc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0\nflags: 0x17fffc000000000()\nraw: 017fffc000000000 0000000000000000 0000000000000000 00000000ffffffff\nraw: ffffea0004243c20 ffffea0004243ba0 0000000000000000 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff8801090ef680: f2 f2 f2 f2 f2 f2 f2 01 f2 f2 f2 f2 f2 f2 f2 00\n ffff8801090ef700: f2 f2 f2 f2 f2 f2 f2 00 02 f2 f2 f2 f2 f2 f2 00\n>ffff8801090ef780: 00 f2 f2 f2 f2 f2 f2 00 00 f2 f2 f2 f2 f2 f2 00\n                                              ^\n ffff8801090ef800: 00 f2 f2 f2 f2 f2 f2 00 00 00 00 02 f2 f2 f2 f2\n ffff8801090ef880: f2 f2 f2 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00\n==================================================================\n\nSigned-off-by: Vincent Pelletier <plr.vincent@gmail.com>\nReviewed-by: Mike Christie <mchristi@redhat.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/franciscofranco/tissot/commits/d31152ba0f282348c9ffbd8436b7a3622064aea6"}]}
{"actor":{"display_login":"franciscofranco"}}