{"push_id":2451817476,"size":9,"distinct_size":2,"ref":"refs/heads/standard/cgl/xilinx/base","head":"7410796422f8d7e422dcb5a1da6bb82f509db615","before":"f0e94bb7277ee90738710f46ba0c850333511528","commits":[{"sha":"5b2fd42a536252c949bfbb2fa62e9b2a33707e0a","author":{"name":"Li Zhou","email":"ebee0ce7fce11563d941785c147121be8a884596@windriver.com"},"message":"x86/dumpstack: Remove NULL task pointer convention\n\ncommit 81539169f283329fd8bc58457cc15754f683ba69 upstream\n\nshow_stack_log_lvl() and friends allow a NULL pointer for the\ntask_struct to indicate the current task.  This creates confusion and\ncan cause sneaky bugs.\n\nInstead require the caller to pass 'current' directly.\n\nThis only changes the internal workings of the dumpstack code.  The\ndump_trace() and show_stack() interfaces still allow a NULL task\npointer.  Those interfaces should also probably be fixed as well.\n\nSigned-off-by: Josh Poimboeuf <jpoimboe@redhat.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\n[lz: adapted the patch to solve context issues]\nSigned-off-by: Li Zhou <li.zhou@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/5b2fd42a536252c949bfbb2fa62e9b2a33707e0a"},{"sha":"3fca773fa8f8e28e688efbaa6a4e17214cfcede2","author":{"name":"Yue Tao","email":"4b1b1c09f4a7c3d2af95f00f78bd39b36aa598d6@windriver.com"},"message":"Merge branch 'standard/base' into standard/cgl/xilinx/base","distinct":true,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/3fca773fa8f8e28e688efbaa6a4e17214cfcede2"},{"sha":"8e80147504f6ed24b94c91bb6d33dbc9b86d749f","author":{"name":"Linus Torvalds","email":"ead7104581934751970e9decb2db5deb20a9e407@linux-foundation.org"},"message":"loop: fix concurrent lo_open/lo_release\n\ncommit ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5 upstream\n\n范龙飞 reports that KASAN can report a use-after-free in __lock_acquire.\nThe reason is due to insufficient serialization in lo_release(), which\nwill continue to use the loop device even after it has decremented the\nlo_refcnt to zero.\n\nIn the meantime, another process can come in, open the loop device\nagain as it is being shut down. Confusion ensues.\n\nReported-by: 范龙飞 <long7573@126.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Jens Axboe <axboe@kernel.dk>\nSigned-off-by: Yue Tao <Yue.Tao@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/8e80147504f6ed24b94c91bb6d33dbc9b86d749f"},{"sha":"23546b3ba302b4fd190ebe2e685e84a415f2a912","author":{"name":"Greg Kroah-Hartman","email":"4931344b09d7a7d3573e8b1ebec918e229ead9bf@linuxfoundation.org"},"message":"ACPI: sbshc: remove raw pointer from printk() message\n\ncommit 43cdd1b716b26f6af16da4e145b6578f98798bf6 upstream\n\nThere's no need to be printing a raw kernel pointer to the kernel log at\nevery boot.  So just remove it, and change the whole message to use the\ncorrect dev_info() call at the same time.\n\nReported-by: Wang Qize <wang_qize@venustech.com.cn>\nCc: All applicable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>\nSigned-off-by: Yue Tao <Yue.Tao@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/23546b3ba302b4fd190ebe2e685e84a415f2a912"},{"sha":"f1952cf58deba30387c4c5a12e2456780c5bb006","author":{"name":"Li Jinyue","email":"53fa3edc7b69d46a89e6f32c517f3d237af0ae3d@huawei.com"},"message":"futex: Prevent overflow by strengthen input validation\n\ncommit fbe0e839d1e22d88810f3ee3e2f1479be4c0aa4a upstream\n\nUBSAN reports signed integer overflow in kernel/futex.c:\n\n UBSAN: Undefined behaviour in kernel/futex.c:2041:18\n signed integer overflow:\n 0 - -2147483648 cannot be represented in type 'int'\n\nAdd a sanity check to catch negative values of nr_wake and nr_requeue.\n\nSigned-off-by: Li Jinyue <lijinyue@huawei.com>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: peterz@infradead.org\nCc: dvhart@infradead.org\nCc: stable@vger.kernel.org\nLink: https://lkml.kernel.org/r/1513242294-31786-1-git-send-email-lijinyue@huawei.com\nSigned-off-by: Liu Haitao <haitao.liu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/f1952cf58deba30387c4c5a12e2456780c5bb006"},{"sha":"ece92400beb02202d950d3435726120d14ee9ed8","author":{"name":"Shuah Khan","email":"1a8b7edcfc00bb8cbbb1f50ab3153da93b81fdf3@osg.samsung.com"},"message":"usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input\n\ncommit c6688ef9f29762e65bce325ef4acd6c675806366 upstream\n\nHarden CMD_SUBMIT path to handle malicious input that could trigger\nlarge memory allocations. Add checks to validate transfer_buffer_length\nand number_of_packets to protect against bad input requesting for\nunbounded memory allocations. Validate early in get_pipe() and return\nfailure.\n\nReported-by: Secunia Research <vuln@secunia.com>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Shuah Khan <shuahkh@osg.samsung.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Liu Haitao <haitao.liu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/ece92400beb02202d950d3435726120d14ee9ed8"},{"sha":"d07b5ed796d06f9351ddf69f8ca71023a11b4b96","author":{"name":"Håkon Bugge","email":"a0911bc20304ce46bd105e6daaf9d3b9c9394982@oracle.com"},"message":"rds: Fix NULL pointer dereference in __rds_rdma_map\n\ncommit f3069c6d33f6ae63a1668737bc78aaaa51bff7ca upstream\n\nThis is a fix for syzkaller719569, where memory registration was\nattempted without any underlying transport being loaded.\n\nAnalysis of the case reveals that it is the setsockopt() RDS_GET_MR\n(2) and RDS_GET_MR_FOR_DEST (7) that are vulnerable.\n\nHere is an example stack trace when the bug is hit:\n\nBUG: unable to handle kernel NULL pointer dereference at 00000000000000c0\nIP: __rds_rdma_map+0x36/0x440 [rds]\nPGD 2f93d03067 P4D 2f93d03067 PUD 2f93d02067 PMD 0\nOops: 0000 [#1] SMP\nModules linked in: bridge stp llc tun rpcsec_gss_krb5 nfsv4\ndns_resolver nfs fscache rds binfmt_misc sb_edac intel_powerclamp\ncoretemp kvm_intel kvm irqbypass crct10dif_pclmul c rc32_pclmul\nghash_clmulni_intel pcbc aesni_intel crypto_simd glue_helper cryptd\niTCO_wdt mei_me sg iTCO_vendor_support ipmi_si mei ipmi_devintf nfsd\nshpchp pcspkr i2c_i801 ioatd ma ipmi_msghandler wmi lpc_ich mfd_core\nauth_rpcgss nfs_acl lockd grace sunrpc ip_tables ext4 mbcache jbd2\nmgag200 i2c_algo_bit drm_kms_helper ixgbe syscopyarea ahci sysfillrect\nsysimgblt libahci mdio fb_sys_fops ttm ptp libata sd_mod mlx4_core drm\ncrc32c_intel pps_core megaraid_sas i2c_core dca dm_mirror\ndm_region_hash dm_log dm_mod\nCPU: 48 PID: 45787 Comm: repro_set2 Not tainted 4.14.2-3.el7uek.x86_64 #2\nHardware name: Oracle Corporation ORACLE SERVER X5-2L/ASM,MOBO TRAY,2U, BIOS 31110000 03/03/2017\ntask: ffff882f9190db00 task.stack: ffffc9002b994000\nRIP: 0010:__rds_rdma_map+0x36/0x440 [rds]\nRSP: 0018:ffffc9002b997df0 EFLAGS: 00010202\nRAX: 0000000000000000 RBX: ffff882fa2182580 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffffc9002b997e40 RDI: ffff882fa2182580\nRBP: ffffc9002b997e30 R08: 0000000000000000 R09: 0000000000000002\nR10: ffff885fb29e3838 R11: 0000000000000000 R12: ffff882fa2182580\nR13: ffff882fa2182580 R14: 0000000000000002 R15: 0000000020000ffc\nFS:  00007fbffa20b700(0000) GS:ffff882fbfb80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000000000c0 CR3: 0000002f98a66006 CR4: 00000000001606e0\nCall Trace:\n rds_get_mr+0x56/0x80 [rds]\n rds_setsockopt+0x172/0x340 [rds]\n ? __fget_light+0x25/0x60\n ? __fdget+0x13/0x20\n SyS_setsockopt+0x80/0xe0\n do_syscall_64+0x67/0x1b0\n entry_SYSCALL64_slow_path+0x25/0x25\nRIP: 0033:0x7fbff9b117f9\nRSP: 002b:00007fbffa20aed8 EFLAGS: 00000293 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 00000000000c84a4 RCX: 00007fbff9b117f9\nRDX: 0000000000000002 RSI: 0000400000000114 RDI: 000000000000109b\nRBP: 00007fbffa20af10 R08: 0000000000000020 R09: 00007fbff9dd7860\nR10: 0000000020000ffc R11: 0000000000000293 R12: 0000000000000000\nR13: 00007fbffa20b9c0 R14: 00007fbffa20b700 R15: 0000000000000021\n\nCode: 41 56 41 55 49 89 fd 41 54 53 48 83 ec 18 8b 87 f0 02 00 00 48\n89 55 d0 48 89 4d c8 85 c0 0f 84 2d 03 00 00 48 8b 87 00 03 00 00 <48>\n83 b8 c0 00 00 00 00 0f 84 25 03 00 0 0 48 8b 06 48 8b 56 08\n\nThe fix is to check the existence of an underlying transport in\n__rds_rdma_map().\n\nSigned-off-by: Håkon Bugge <haakon.bugge@oracle.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nAcked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Yue Tao <Yue.Tao@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/d07b5ed796d06f9351ddf69f8ca71023a11b4b96"},{"sha":"977343535f42b11810bdf14856c181eaa663b4c9","author":{"name":"Hou Tao","email":"3e98258678d766fc8032de731347d0f5060ad78c@huawei.com"},"message":"dm: fix race between dm_get_from_kobject() and __dm_destroy()\n\ncommit b9a41d21dceadf8104812626ef85dc56ee8a60ed upstream\n\nThe following BUG_ON was hit when testing repeat creation and removal of\nDM devices:\n\n    kernel BUG at drivers/md/dm.c:2919!\n    CPU: 7 PID: 750 Comm: systemd-udevd Not tainted 4.1.44\n    Call Trace:\n     [<ffffffff81649e8b>] dm_get_from_kobject+0x34/0x3a\n     [<ffffffff81650ef1>] dm_attr_show+0x2b/0x5e\n     [<ffffffff817b46d1>] ? mutex_lock+0x26/0x44\n     [<ffffffff811df7f5>] sysfs_kf_seq_show+0x83/0xcf\n     [<ffffffff811de257>] kernfs_seq_show+0x23/0x25\n     [<ffffffff81199118>] seq_read+0x16f/0x325\n     [<ffffffff811de994>] kernfs_fop_read+0x3a/0x13f\n     [<ffffffff8117b625>] __vfs_read+0x26/0x9d\n     [<ffffffff8130eb59>] ? security_file_permission+0x3c/0x44\n     [<ffffffff8117bdb8>] ? rw_verify_area+0x83/0xd9\n     [<ffffffff8117be9d>] vfs_read+0x8f/0xcf\n     [<ffffffff81193e34>] ? __fdget_pos+0x12/0x41\n     [<ffffffff8117c686>] SyS_read+0x4b/0x76\n     [<ffffffff817b606e>] system_call_fastpath+0x12/0x71\n\nThe bug can be easily triggered, if an extra delay (e.g. 10ms) is added\nbetween the test of DMF_FREEING & DMF_DELETING and dm_get() in\ndm_get_from_kobject().\n\nTo fix it, we need to ensure the test of DMF_FREEING & DMF_DELETING and\ndm_get() are done in an atomic way, so _minor_lock is used.\n\nThe other callers of dm_get() have also been checked to be OK: some\ncallers invoke dm_get() under _minor_lock, some callers invoke it under\n_hash_lock, and dm_start_request() invoke it after increasing\nmd->open_count.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Hou Tao <houtao1@huawei.com>\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>\nSigned-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/977343535f42b11810bdf14856c181eaa663b4c9"},{"sha":"7410796422f8d7e422dcb5a1da6bb82f509db615","author":{"name":"Yue Tao","email":"4b1b1c09f4a7c3d2af95f00f78bd39b36aa598d6@windriver.com"},"message":"Merge branch 'standard/base' into standard/cgl/xilinx/base","distinct":true,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/7410796422f8d7e422dcb5a1da6bb82f509db615"}]}
{"actor":{"display_login":"mseaster-wr"}}