{"push_id":2474412046,"size":152,"distinct_size":152,"ref":"refs/heads/lineage-15.1-v3.18.101","head":"4460f9a9d6579829e9cfee5b65958150e63521f5","before":"3250aa27ada2b788c1764e056624a5272f8bb003","commits":[{"sha":"7ea1e4fdf35d529c80e9f6f837459d92e8716b0e","author":{"name":"Paolo Abeni","email":"6e4ffc2e3438feb7acb34f6b67e6ae17e700099c@redhat.com"},"message":"netfilter: drop outermost socket lock in getsockopt()\n\ncommit 01ea306f2ac2baff98d472da719193e738759d93 upstream.\n\nThe Syzbot reported a possible deadlock in the netfilter area caused by\nrtnl lock, xt lock and socket lock being acquired with a different order\non different code paths, leading to the following backtrace:\nReviewed-by: Xin Long <lucien.xin@gmail.com>\n\n======================================================\nWARNING: possible circular locking dependency detected\n4.15.0+ #301 Not tainted\n------------------------------------------------------\nsyzkaller233489/4179 is trying to acquire lock:\n  (rtnl_mutex){+.+.}, at: [<0000000048e996fd>] rtnl_lock+0x17/0x20\nnet/core/rtnetlink.c:74\n\nbut task is already holding lock:\n  (&xt[i].mutex){+.+.}, at: [<00000000328553a2>]\nxt_find_table_lock+0x3e/0x3e0 net/netfilter/x_tables.c:1041\n\nwhich lock already depends on the new lock.\n===\n\nSince commit 3f34cfae1230 (\"netfilter: on sockopt() acquire sock lock\nonly in the required scope\"), we already acquire the socket lock in\nthe innermost scope, where needed. In such commit I forgot to remove\nthe outer-most socket lock from the getsockopt() path, this commit\naddresses the issues dropping it now.\n\nv1 -> v2: fix bad subj, added relavant 'fixes' tag\n\nFixes: 22265a5c3c10 (\"netfilter: xt_TEE: resolve oif using netdevice notifiers\")\nFixes: 202f59afd441 (\"netfilter: ipt_CLUSTERIP: do not hold dev\")\nFixes: 3f34cfae1230 (\"netfilter: on sockopt() acquire sock lock only in the required scope\")\nReported-by: syzbot+ddde1c7b7ff7442d7f2d@syzkaller.appspotmail.com\nSuggested-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Paolo Abeni <pabeni@redhat.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nTested-by: Krzysztof Piotr Oledzki <ole@ans.pl>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/7ea1e4fdf35d529c80e9f6f837459d92e8716b0e"},{"sha":"c1bbb174ff0d45a88c2fcf80500cb35c2d926333","author":{"name":"Johan Hovold","email":"759412786bc533369b22377bf83fb9056c5b25b2@kernel.org"},"message":"PCI: keystone: Fix interrupt-controller-node lookup\n\ncommit eac56aa3bc8af3d9b9850345d0f2da9d83529134 upstream.\n\nFix child-node lookup during initialisation which was using the wrong\nOF-helper and ended up searching the whole device tree depth-first\nstarting at the parent rather than just matching on its children.\n\nTo make things worse, the parent pci node could end up being prematurely\nfreed as of_find_node_by_name() drops a reference to its first argument.\nAny matching child interrupt-controller node was also leaked.\n\nFixes: 0c4ffcfe1fbc (\"PCI: keystone: Add TI Keystone PCIe driver\")\nCc: stable <stable@vger.kernel.org>     # 3.18\nAcked-by: Murali Karicheri <m-karicheri2@ti.com>\nSigned-off-by: Johan Hovold <johan@kernel.org>\n[lorenzo.pieralisi@arm.com: updated commit subject]\nSigned-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>\n[johan: backport to 4.4]\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/c1bbb174ff0d45a88c2fcf80500cb35c2d926333"},{"sha":"b0bbe0abe8ca3ba5f29682dafe3f2251db8ecf40","author":{"name":"Tyrel Datwyler","email":"f4a317f2a73d762775eb462a22d913f1ae21c433@linux.vnet.ibm.com"},"message":"scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info\n\ncommit c39813652700f3df552b6557530f1e5f782dbe2f upstream.\n\nThe fcp_rsp_info structure as defined in the FC spec has an initial 3\nbytes reserved field. The ibmvfc driver mistakenly defined this field as\n4 bytes resulting in the rsp_code field being defined in what should be\nthe start of the second reserved field and thus always being reported as\nzero by the driver.\n\nIdeally, we should wire ibmvfc up with libfc for the sake of code\ndeduplication, and ease of maintaining standardized structures in a\nsingle place. However, for now simply fixup the definition in ibmvfc for\nbackporting to distros on older kernels. Wiring up with libfc will be\ndone in a followup patch.\n\nCc: <stable@vger.kernel.org>\nReported-by: Hannes Reinecke <hare@suse.de>\nSigned-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/b0bbe0abe8ca3ba5f29682dafe3f2251db8ecf40"},{"sha":"48e0fd5f149d8be9932511ddf7b659913c159612","author":{"name":"Arnd Bergmann","email":"f2c659f01951776204a6c5b902787d9019fbeebd@arndb.de"},"message":"cfg80211: fix cfg80211_beacon_dup\n\ncommit bee92d06157fc39d5d7836a061c7d41289a55797 upstream.\n\ngcc-8 warns about some obviously incorrect code:\n\nnet/mac80211/cfg.c: In function 'cfg80211_beacon_dup':\nnet/mac80211/cfg.c:2896:3: error: 'memcpy' source argument is the same as destination [-Werror=restrict]\n\nFrom the context, I conclude that we want to copy from beacon into\nnew_beacon, as we do in the rest of the function.\n\nCc: stable@vger.kernel.org\nFixes: 73da7d5bab79 (\"mac80211: add channel switch command and beacon callbacks\")\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/48e0fd5f149d8be9932511ddf7b659913c159612"},{"sha":"907e5a6898679ad11dc06e52526895a35bad9cea","author":{"name":"Stefan Windfeldt-Prytz","email":"67b581ab909c695af7ae395a7273ae5c2a41c152@axis.com"},"message":"iio: buffer: check if a buffer has been set up when poll is called\n\ncommit 4cd140bda6494543f1c1b0ccceceaa44b676eef6 upstream.\n\nIf no iio buffer has been set up and poll is called return 0.\nWithout this check there will be a null pointer dereference when\ncalling poll on a iio driver without an iio buffer.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Stefan Windfeldt-Prytz <stefan.windfeldt@axis.com>\nSigned-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/907e5a6898679ad11dc06e52526895a35bad9cea"},{"sha":"4131eb6c7e8ce9bacb7b1b4c3ebf1d7a7c8e055d","author":{"name":"Lars-Peter Clausen","email":"3318dc5ce3e4fb7c28a0b841b6801c884e1d0896@metafoo.de"},"message":"iio: adis_lib: Initialize trigger before requesting interrupt\n\ncommit f027e0b3a774e10302207e91d304bbf99e3a8b36 upstream.\n\nThe adis_probe_trigger() creates a new IIO trigger and requests an\ninterrupt associated with the trigger. The interrupt uses the generic\niio_trigger_generic_data_rdy_poll() function as its interrupt handler.\n\nCurrently the driver initializes some fields of the trigger structure after\nthe interrupt has been requested. But an interrupt can fire as soon as it\nhas been requested. This opens up a race condition.\n\niio_trigger_generic_data_rdy_poll() will access the trigger data structure\nand dereference the ops field. If the ops field is not yet initialized this\nwill result in a NULL pointer deref.\n\nIt is not expected that the device generates an interrupt at this point, so\ntypically this issue did not surface unless e.g. due to a hardware\nmisconfiguration (wrong interrupt number, wrong polarity, etc.).\n\nBut some newer devices from the ADIS family start to generate periodic\ninterrupts in their power-on reset configuration and unfortunately the\ninterrupt can not be masked in the device.  This makes the race condition\nmuch more visible and the following crash has been observed occasionally\nwhen booting a system using the ADIS16460.\n\n\tUnable to handle kernel NULL pointer dereference at virtual address 00000008\n\tpgd = c0004000\n\t[00000008] *pgd=00000000\n\tInternal error: Oops: 5 [#1] PREEMPT SMP ARM\n\tModules linked in:\n\tCPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.9.0-04126-gf9739f0-dirty #257\n\tHardware name: Xilinx Zynq Platform\n\ttask: ef04f640 task.stack: ef050000\n\tPC is at iio_trigger_notify_done+0x30/0x68\n\tLR is at iio_trigger_generic_data_rdy_poll+0x18/0x20\n\tpc : [<c042d868>]    lr : [<c042d924>]    psr: 60000193\n\tsp : ef051bb8  ip : 00000000  fp : ef106400\n\tr10: c081d80a  r9 : ef3bfa00  r8 : 00000087\n\tr7 : ef051bec  r6 : 00000000  r5 : ef3bfa00  r4 : ee92ab00\n\tr3 : 00000000  r2 : 00000000  r1 : 00000000  r0 : ee97e400\n\tFlags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment none\n\tControl: 18c5387d  Table: 0000404a  DAC: 00000051\n\tProcess swapper/0 (pid: 1, stack limit = 0xef050210)\n\t[<c042d868>] (iio_trigger_notify_done) from [<c0065b10>] (__handle_irq_event_percpu+0x88/0x118)\n\t[<c0065b10>] (__handle_irq_event_percpu) from [<c0065bbc>] (handle_irq_event_percpu+0x1c/0x58)\n\t[<c0065bbc>] (handle_irq_event_percpu) from [<c0065c30>] (handle_irq_event+0x38/0x5c)\n\t[<c0065c30>] (handle_irq_event) from [<c0068e28>] (handle_level_irq+0xa4/0x130)\n\t[<c0068e28>] (handle_level_irq) from [<c0064e74>] (generic_handle_irq+0x24/0x34)\n\t[<c0064e74>] (generic_handle_irq) from [<c021ab7c>] (zynq_gpio_irqhandler+0xb8/0x13c)\n\t[<c021ab7c>] (zynq_gpio_irqhandler) from [<c0064e74>] (generic_handle_irq+0x24/0x34)\n\t[<c0064e74>] (generic_handle_irq) from [<c0065370>] (__handle_domain_irq+0x5c/0xb4)\n\t[<c0065370>] (__handle_domain_irq) from [<c000940c>] (gic_handle_irq+0x48/0x8c)\n\t[<c000940c>] (gic_handle_irq) from [<c0013e8c>] (__irq_svc+0x6c/0xa8)\n\nTo fix this make sure that the trigger is fully initialized before\nrequesting the interrupt.\n\nFixes: ccd2b52f4ac6 (\"staging:iio: Add common ADIS library\")\nReported-by: Robin Getz <Robin.Getz@analog.com>\nSigned-off-by: Lars-Peter Clausen <lars@metafoo.de>\nCc: <Stable@vger.kernel.org>\nSigned-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/4131eb6c7e8ce9bacb7b1b4c3ebf1d7a7c8e055d"},{"sha":"110f277f9be1b64418a45f322c7ed8122f357b8c","author":{"name":"Arnd Bergmann","email":"f2c659f01951776204a6c5b902787d9019fbeebd@arndb.de"},"message":"x86/oprofile: Fix bogus GCC-8 warning in nmi_setup()\n\ncommit 85c615eb52222bc5fab6c7190d146bc59fac289e upstream.\n\nGCC-8 shows a warning for the x86 oprofile code that copies per-CPU\ndata from CPU 0 to all other CPUs, which when building a non-SMP\nkernel turns into a memcpy() with identical source and destination\npointers:\n\n arch/x86/oprofile/nmi_int.c: In function 'mux_clone':\n arch/x86/oprofile/nmi_int.c:285:2: error: 'memcpy' source argument is the same as destination [-Werror=restrict]\n   memcpy(per_cpu(cpu_msrs, cpu).multiplex,\n   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n          per_cpu(cpu_msrs, 0).multiplex,\n          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n          sizeof(struct op_msr) * model->num_virt_counters);\n          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n arch/x86/oprofile/nmi_int.c: In function 'nmi_setup':\n arch/x86/oprofile/nmi_int.c:466:3: error: 'memcpy' source argument is the same as destination [-Werror=restrict]\n arch/x86/oprofile/nmi_int.c:470:3: error: 'memcpy' source argument is the same as destination [-Werror=restrict]\n\nI have analyzed a number of such warnings now: some are valid and the\nGCC warning is welcome. Others turned out to be false-positives, and\nGCC was changed to not warn about those any more. This is a corner case\nthat is a false-positive but the GCC developers feel it's better to keep\nwarning about it.\n\nIn this case, it seems best to work around it by telling GCC\na little more clearly that this code path is never hit with\nan IS_ENABLED() configuration check.\n\nCc:stable as we also want old kernels to build cleanly with GCC-8.\n\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nCc: Jessica Yu <jeyu@kernel.org>\nCc: Kees Cook <keescook@chromium.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Martin Sebor <msebor@gcc.gnu.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Robert Richter <rric@kernel.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: oprofile-list@lists.sf.net\nCc: stable@vger.kernel.org\nLink: http://lkml.kernel.org/r/20180220205826.2008875-1-arnd@arndb.de\nLink: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84095\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/110f277f9be1b64418a45f322c7ed8122f357b8c"},{"sha":"b3256e340936c977c85461f4f39829e64b417c24","author":{"name":"Shanker Donthineni","email":"7bcd1014cf0c3a0a680a90476c2a511353058a3f@codeaurora.org"},"message":"irqchip/gic-v3: Use wmb() instead of smb_wmb() in gic_raise_softirq()\n\ncommit 21ec30c0ef5234fb1039cc7c7737d885bf875a9e upstream.\n\nA DMB instruction can be used to ensure the relative order of only\nmemory accesses before and after the barrier. Since writes to system\nregisters are not memory operations, barrier DMB is not sufficient\nfor observability of memory accesses that occur before ICC_SGI1R_EL1\nwrites.\n\nA DSB instruction ensures that no instructions that appear in program\norder after the DSB instruction, can execute until the DSB instruction\nhas completed.\n\nCc: stable@vger.kernel.org\nAcked-by: Will Deacon <will.deacon@arm.com>,\nSigned-off-by: Shanker Donthineni <shankerd@codeaurora.org>\nSigned-off-by: Marc Zyngier <marc.zyngier@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/b3256e340936c977c85461f4f39829e64b417c24"},{"sha":"c76839074f66aa8ec675f74a2e7f072b6d0d1c1e","author":{"name":"Michael Weiser","email":"deeaf5c4ee2bb6716919c8d2d0f4c1bd9c4557aa@gmx.de"},"message":"arm64: Disable unhandled signal log messages by default\n\ncommit 5ee39a71fd89ab7240c5339d04161c44a8e03269 upstream.\n\naarch64 unhandled signal kernel messages are very verbose, suggesting\nthem to be more of a debugging aid:\n\nsigsegv[33]: unhandled level 2 translation fault (11) at 0x00000000, esr\n0x92000046, in sigsegv[400000+71000]\nCPU: 1 PID: 33 Comm: sigsegv Tainted: G        W        4.15.0-rc3+ #3\nHardware name: linux,dummy-virt (DT)\npstate: 60000000 (nZCv daif -PAN -UAO)\npc : 0x4003f4\nlr : 0x4006bc\nsp : 0000fffffe94a060\nx29: 0000fffffe94a070 x28: 0000000000000000\nx27: 0000000000000000 x26: 0000000000000000\nx25: 0000000000000000 x24: 00000000004001b0\nx23: 0000000000486ac8 x22: 00000000004001c8\nx21: 0000000000000000 x20: 0000000000400be8\nx19: 0000000000400b30 x18: 0000000000484728\nx17: 000000000865ffc8 x16: 000000000000270f\nx15: 00000000000000b0 x14: 0000000000000002\nx13: 0000000000000001 x12: 0000000000000000\nx11: 0000000000000000 x10: 0008000020008008\nx9 : 000000000000000f x8 : ffffffffffffffff\nx7 : 0004000000000000 x6 : ffffffffffffffff\nx5 : 0000000000000000 x4 : 0000000000000000\nx3 : 00000000004003e4 x2 : 0000fffffe94a1e8\nx1 : 000000000000000a x0 : 0000000000000000\n\nDisable them by default, so they can be enabled using\n/proc/sys/debug/exception-trace.\n\nCc: <stable@vger.kernel.org>\nSigned-off-by: Michael Weiser <michael.weiser@gmx.de>\nSigned-off-by: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/c76839074f66aa8ec675f74a2e7f072b6d0d1c1e"},{"sha":"d54aaba351a2feff76248ab80bd84137bdcad9b5","author":{"name":"Thinh Nguyen","email":"8e436f42a8d87f445466a3edb7bd598ad284eedd@synopsys.com"},"message":"usb: dwc3: gadget: Set maxpacket size for ep0 IN\n\ncommit 6180026341e852a250e1f97ebdcf71684a3c81b9 upstream.\n\nThere are 2 control endpoint structures for DWC3. However, the driver\nonly updates the OUT direction control endpoint structure during\nConnectDone event. DWC3 driver needs to update the endpoint max packet\nsize for control IN endpoint as well. If the max packet size is not\nproperly set, then the driver will incorrectly calculate the data\ntransfer size and fail to send ZLP for HS/FS 3-stage control read\ntransfer.\n\nThe fix is simply to update the max packet size for the ep0 IN direction\nduring ConnectDone event.\n\nCc: stable@vger.kernel.org\nFixes: 72246da40f37 (\"usb: Introduce DesignWare USB3 DRD Driver\")\nSigned-off-by: Thinh Nguyen <thinhn@synopsys.com>\nSigned-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/d54aaba351a2feff76248ab80bd84137bdcad9b5"},{"sha":"89ea4a7b53afd6a550047b18310154ef71ee609e","author":{"name":"Jack Pham","email":"cbd79eb9617449d4bb49d0087b0eb70c6cf062b0@codeaurora.org"},"message":"usb: gadget: f_fs: Process all descriptors during bind\n\ncommit 6cf439e0d37463e42784271179c8a308fd7493c6 upstream.\n\nDuring _ffs_func_bind(), the received descriptors are evaluated\nto prepare for binding with the gadget in order to allocate\nendpoints and optionally set up OS descriptors. However, the\nhigh- and super-speed descriptors are only parsed based on\nwhether the gadget_is_dualspeed() and gadget_is_superspeed()\ncalls are true, respectively.\n\nThis is a problem in case a userspace program always provides\nall of the {full,high,super,OS} descriptors when configuring a\nfunction. Then, for example if a gadget device is not capable\nof SuperSpeed, the call to ffs_do_descs() for the SS descriptors\nis skipped, resulting in an incorrect offset calculation for\nthe vla_ptr when moving on to the OS descriptors that follow.\nThis causes ffs_do_os_descs() to fail as it is now looking at\nthe SS descriptors' offset within the raw_descs buffer instead.\n\n_ffs_func_bind() should evaluate the descriptors unconditionally,\nso remove the checks for gadget speed.\n\nFixes: f0175ab51993 (\"usb: gadget: f_fs: OS descriptors support\")\nCc: stable@vger.kernel.org\nCo-Developed-by: Mayank Rana <mrana@codeaurora.org>\nSigned-off-by: Mayank Rana <mrana@codeaurora.org>\nSigned-off-by: Jack Pham <jackp@codeaurora.org>\nSigned-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/89ea4a7b53afd6a550047b18310154ef71ee609e"},{"sha":"c913c0513c3099b7ecee69020b23de87d0c3c769","author":{"name":"Eric Biggers","email":"6f6115196800bbe9712b3f04c7e40093bb382fc5@google.com"},"message":"ASN.1: fix out-of-bounds read when parsing indefinite length item\n\ncommit e0058f3a874ebb48b25be7ff79bc3b4e59929f90 upstream.\n\nIn asn1_ber_decoder(), indefinitely-sized ASN.1 items were being passed\nto the action functions before their lengths had been computed, using\nthe bogus length of 0x80 (ASN1_INDEFINITE_LENGTH).  This resulted in\nreading data past the end of the input buffer, when given a specially\ncrafted message.\n\nFix it by rearranging the code so that the indefinite length is resolved\nbefore the action is called.\n\nThis bug was originally found by fuzzing the X.509 parser in userspace\nusing libFuzzer from the LLVM project.\n\nKASAN report (cleaned up slightly):\n\n    BUG: KASAN: slab-out-of-bounds in memcpy ./include/linux/string.h:341 [inline]\n    BUG: KASAN: slab-out-of-bounds in x509_fabricate_name.constprop.1+0x1a4/0x940 crypto/asymmetric_keys/x509_cert_parser.c:366\n    Read of size 128 at addr ffff880035dd9eaf by task keyctl/195\n\n    CPU: 1 PID: 195 Comm: keyctl Not tainted 4.14.0-09238-g1d3b78bbc6e9 #26\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014\n    Call Trace:\n     __dump_stack lib/dump_stack.c:17 [inline]\n     dump_stack+0xd1/0x175 lib/dump_stack.c:53\n     print_address_description+0x78/0x260 mm/kasan/report.c:252\n     kasan_report_error mm/kasan/report.c:351 [inline]\n     kasan_report+0x23f/0x350 mm/kasan/report.c:409\n     memcpy+0x1f/0x50 mm/kasan/kasan.c:302\n     memcpy ./include/linux/string.h:341 [inline]\n     x509_fabricate_name.constprop.1+0x1a4/0x940 crypto/asymmetric_keys/x509_cert_parser.c:366\n     asn1_ber_decoder+0xb4a/0x1fd0 lib/asn1_decoder.c:447\n     x509_cert_parse+0x1c7/0x620 crypto/asymmetric_keys/x509_cert_parser.c:89\n     x509_key_preparse+0x61/0x750 crypto/asymmetric_keys/x509_public_key.c:174\n     asymmetric_key_preparse+0xa4/0x150 crypto/asymmetric_keys/asymmetric_type.c:388\n     key_create_or_update+0x4d4/0x10a0 security/keys/key.c:850\n     SYSC_add_key security/keys/keyctl.c:122 [inline]\n     SyS_add_key+0xe8/0x290 security/keys/keyctl.c:62\n     entry_SYSCALL_64_fastpath+0x1f/0x96\n\n    Allocated by task 195:\n     __do_kmalloc_node mm/slab.c:3675 [inline]\n     __kmalloc_node+0x47/0x60 mm/slab.c:3682\n     kvmalloc ./include/linux/mm.h:540 [inline]\n     SYSC_add_key security/keys/keyctl.c:104 [inline]\n     SyS_add_key+0x19e/0x290 security/keys/keyctl.c:62\n     entry_SYSCALL_64_fastpath+0x1f/0x96\n\nFixes: 42d5ec27f873 (\"X.509: Add an ASN.1 decoder\")\nReported-by: Alexander Potapenko <glider@google.com>\nCc: <stable@vger.kernel.org> # v3.7+\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/c913c0513c3099b7ecee69020b23de87d0c3c769"},{"sha":"6f8814f83fb0c7fe2418ed0e3fcc5af5296d3fd7","author":{"name":"Greg Kroah-Hartman","email":"4645f7897fd33786a2ee1264d590b3c400559d85@linuxfoundation.org"},"message":"Linux 3.18.97","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/6f8814f83fb0c7fe2418ed0e3fcc5af5296d3fd7"},{"sha":"4b50d8a107ea5f7165ca1693a2c81a45fb01c922","author":{"name":"Jakub Sitnicki","email":"3b80ca1f86bac5f23c55074a913c2c918a44dad8@redhat.com"},"message":"ipv6: Skip XFRM lookup if dst_entry in socket cache is valid\n\ncommit 00bc0ef5880dc7b82f9c320dead4afaad48e47be upstream.\n\nAt present we perform an xfrm_lookup() for each UDPv6 message we\nsend. The lookup involves querying the flow cache (flow_cache_lookup)\nand, in case of a cache miss, creating an XFRM bundle.\n\nIf we miss the flow cache, we can end up creating a new bundle and\nderiving the path MTU (xfrm_init_pmtu) from on an already transformed\ndst_entry, which we pass from the socket cache (sk->sk_dst_cache) down\nto xfrm_lookup(). This can happen only if we're caching the dst_entry\nin the socket, that is when we're using a connected UDP socket.\n\nTo put it another way, the path MTU shrinks each time we miss the flow\ncache, which later on leads to incorrectly fragmented payload. It can\nbe observed with ESPv6 in transport mode:\n\n  1) Set up a transformation and lower the MTU to trigger fragmentation\n    # ip xfrm policy add dir out src ::1 dst ::1 \\\n      tmpl src ::1 dst ::1 proto esp spi 1\n    # ip xfrm state add src ::1 dst ::1 \\\n      proto esp spi 1 enc 'aes' 0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b\n    # ip link set dev lo mtu 1500\n\n  2) Monitor the packet flow and set up an UDP sink\n    # tcpdump -ni lo -ttt &\n    # socat udp6-listen:12345,fork /dev/null &\n\n  3) Send a datagram that needs fragmentation with a connected socket\n    # perl -e 'print \"@\" x 1470 | socat - udp6:[::1]:12345\n    2016/06/07 18:52:52 socat[724] E read(3, 0x555bb3d5ba00, 8192): Protocol error\n    00:00:00.000000 IP6 ::1 > ::1: frag (0|1448) ESP(spi=0x00000001,seq=0x2), length 1448\n    00:00:00.000014 IP6 ::1 > ::1: frag (1448|32)\n    00:00:00.000050 IP6 ::1 > ::1: ESP(spi=0x00000001,seq=0x3), length 1272\n    (^ ICMPv6 Parameter Problem)\n    00:00:00.000022 IP6 ::1 > ::1: ESP(spi=0x00000001,seq=0x5), length 136\n\n  4) Compare it to a non-connected socket\n    # perl -e 'print \"@\" x 1500' | socat - udp6-sendto:[::1]:12345\n    00:00:40.535488 IP6 ::1 > ::1: frag (0|1448) ESP(spi=0x00000001,seq=0x6), length 1448\n    00:00:00.000010 IP6 ::1 > ::1: frag (1448|64)\n\nWhat happens in step (3) is:\n\n  1) when connecting the socket in __ip6_datagram_connect(), we\n     perform an XFRM lookup, miss the flow cache, create an XFRM\n     bundle, and cache the destination,\n\n  2) afterwards, when sending the datagram, we perform an XFRM lookup,\n     again, miss the flow cache (due to mismatch of flowi6_iif and\n     flowi6_oif, which is an issue of its own), and recreate an XFRM\n     bundle based on the cached (and already transformed) destination.\n\nTo prevent the recreation of an XFRM bundle, avoid an XFRM lookup\naltogether whenever we already have a destination entry cached in the\nsocket. This prevents the path MTU shrinkage and brings us on par with\nUDPv4.\n\nThe fix also benefits connected PINGv6 sockets, another user of\nip6_sk_dst_lookup_flow(), who also suffer messages being transformed\ntwice.\n\nJoint work with Hannes Frederic Sowa.\n\nReported-by: Jan Tluka <jtluka@redhat.com>\nSigned-off-by: Jakub Sitnicki <jkbs@redhat.com>\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Benedict Wong <benedictwong@google.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/4b50d8a107ea5f7165ca1693a2c81a45fb01c922"},{"sha":"1d253b74bbf8bd4821afdef7e8a43e27bac28da3","author":{"name":"Anna-Maria Gleixner","email":"f9bac0f0e30e9cf4bb848bd8d45768c85995065f@linutronix.de"},"message":"hrtimer: Ensure POSIX compliance (relative CLOCK_REALTIME hrtimers)\n\ncommit 48d0c9becc7f3c66874c100c126459a9da0fdced upstream.\n\nThe POSIX specification defines that relative CLOCK_REALTIME timers are not\naffected by clock modifications. Those timers have to use CLOCK_MONOTONIC\nto ensure POSIX compliance.\n\nThe introduction of the additional HRTIMER_MODE_PINNED mode broke this\nrequirement for pinned timers.\n\nThere is no user space visible impact because user space timers are not\nusing pinned mode, but for consistency reasons this needs to be fixed.\n\nCheck whether the mode has the HRTIMER_MODE_REL bit set instead of\ncomparing with HRTIMER_MODE_ABS.\n\nSigned-off-by: Anna-Maria Gleixner <anna-maria@linutronix.de>\nCc: Christoph Hellwig <hch@lst.de>\nCc: John Stultz <john.stultz@linaro.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: keescook@chromium.org\nFixes: 597d0275736d (\"timers: Framework for identifying pinned timers\")\nLink: http://lkml.kernel.org/r/20171221104205.7269-7-anna-maria@linutronix.de\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nCc: Mike Galbraith <efault@gmx.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/1d253b74bbf8bd4821afdef7e8a43e27bac28da3"},{"sha":"b033c08ea7243d4622b10d983f0e4556770e552d","author":{"name":"Sascha Hauer","email":"c00cbc2b736c26791a3822db86f8796fe9efff67@pengutronix.de"},"message":"mtd: nand: gpmi: Fix failure when a erased page has a bitflip at BBM\n\n\n[ Upstream commit fdf2e821052958a114618a95ab18a300d0b080cb ]\n\nWhen erased subpages are read then the BCH decoder returns STATUS_ERASED\nif they are all empty, or STATUS_UNCORRECTABLE if there are bitflips.\nWhen there are bitflips, we have to set these bits again to show the\nupper layers a completely erased page. When a bitflip happens in the\nexact byte where the bad block marker is, then this byte is swapped\nwith another byte in block_mark_swapping(). The correction code then\ndetects a bitflip in another subpage and no longer corrects the bitflip\nwhere it really happens.\n\nCorrect this behaviour by calling block_mark_swapping() after the\nbitflips have been corrected.\n\nIn our case UBIFS failed with this bug because it expects erased\npages to be really empty:\n\nUBIFS error (pid 187): ubifs_scan: corrupt empty space at LEB 36:118735\nUBIFS error (pid 187): ubifs_scanned_corruption: corruption at LEB 36:118735\nUBIFS error (pid 187): ubifs_scanned_corruption: first 8192 bytes from LEB 36:118735\nUBIFS error (pid 187): ubifs_scan: LEB 36 scanning failed\nUBIFS error (pid 187): do_commit: commit failed, error -117\n\nSigned-off-by: Sascha Hauer <s.hauer@pengutronix.de>\nReviewed-by: Richard Weinberger <richard@nod.at>\nAcked-by: Boris Brezillon <boris.brezillon@free-electrons.com>\nSigned-off-by: Richard Weinberger <richard@nod.at>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/b033c08ea7243d4622b10d983f0e4556770e552d"},{"sha":"b71fd46f84b69fe647df4579d44c0b7645a647c9","author":{"name":"Brendan McGrath","email":"e604d20b31cdb96eb3315700e797bde9caa5124b@redmandi.dyndns.org"},"message":"ipv6: icmp6: Allow icmp messages to be looped back\n\n\n[ Upstream commit 588753f1eb18978512b1c9b85fddb457d46f9033 ]\n\nOne example of when an ICMPv6 packet is required to be looped back is\nwhen a host acts as both a Multicast Listener and a Multicast Router.\n\nA Multicast Router will listen on address ff02::16 for MLDv2 messages.\n\nCurrently, MLDv2 messages originating from a Multicast Listener running\non the same host as the Multicast Router are not being delivered to the\nMulticast Router. This is due to dst.input being assigned the default\nvalue of dst_discard.\n\nThis results in the packet being looped back but discarded before being\ndelivered to the Multicast Router.\n\nThis patch sets dst.input to ip6_input to ensure a looped back packet\nis delivered to the Multicast Router.\n\nSigned-off-by: Brendan McGrath <redmcg@redmandi.dyndns.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/b71fd46f84b69fe647df4579d44c0b7645a647c9"},{"sha":"e9270c1debe0a78a8ae61004fffaad0a48e47ef4","author":{"name":"Al Viro","email":"de609eb4d5d70b1d38ec6642adbfc33a2781f63c@zeniv.linux.org.uk"},"message":"sget(): handle failures of register_shrinker()\n\n\n[ Upstream commit 9ee332d99e4d5a97548943b81c54668450ce641b ]\n\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/e9270c1debe0a78a8ae61004fffaad0a48e47ef4"},{"sha":"5f1076d67f458ae0db2a83ebe273b555262db11c","author":{"name":"Radu Pirea","email":"d1dd1d9c579cce51978269c04f86971b2c49c37c@microchip.com"},"message":"spi: atmel: fixed spin_lock usage inside atmel_spi_remove\n\n\n[ Upstream commit 66e900a3d225575c8b48b59ae1fe74bb6e5a65cc ]\n\nThe only part of atmel_spi_remove which needs to be atomic is hardware\nreset.\n\natmel_spi_stop_dma calls dma_terminate_all and this needs interrupts\nenabled.\natmel_spi_release_dma calls dma_release_channel and dma_release_channel\nlocks a mutex inside of spin_lock.\n\nSo the call of these functions can't be inside a spin_lock.\n\nReported-by: Jia-Ju Bai <baijiaju1990@gmail.com>\nSigned-off-by: Radu Pirea <radu.pirea@microchip.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/5f1076d67f458ae0db2a83ebe273b555262db11c"},{"sha":"5a129c18a1953ee14c173dd6af98080f17ee0ad9","author":{"name":"Alexander Kochetkov","email":"ff34906ef668000e36b2844349d7f337a2f4d1d5@gmail.com"},"message":"net: arc_emac: fix arc_emac_rx() error paths\n\n\n[ Upstream commit e688822d035b494071ecbadcccbd6f3325fb0f59 ]\n\narc_emac_rx() has some issues found by code review.\n\nIn case netdev_alloc_skb_ip_align() or dma_map_single() failure\nrx fifo entry will not be returned to EMAC.\n\nIn case dma_map_single() failure previously allocated skb became\nlost to driver. At the same time address of newly allocated skb\nwill not be provided to EMAC.\n\nSigned-off-by: Alexander Kochetkov <al.kochet@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/thegb/android_kernel_leeco_msm8996/commits/5a129c18a1953ee14c173dd6af98080f17ee0ad9"}]}
{"actor":{"display_login":"thegb"}}