{"push_id":2573526131,"size":37,"distinct_size":0,"ref":"refs/heads/aosp-common/upstream-linux-4.9.y","head":"872e1aead3efecaa6e4113c1c218059e9412beb7","before":"04cd74a759bf381f8f2c12e9ddb5fe8d0651c483","commits":[{"sha":"83797a770fe0b4bcbe6f19fa71404d97aaddfda4","author":{"name":"Julian Anastasov","email":"84572ef2253ef81e2d8cd8c65849f4d9a3881f47@ssi.bg"},"message":"ipvs: fix rtnl_lock lockups caused by start_sync_thread\n\ncommit 5c64576a77894a50be80be0024bed27171b55989 upstream.\n\nsyzkaller reports for wrong rtnl_lock usage in sync code [1] and [2]\n\nWe have 2 problems in start_sync_thread if error path is\ntaken, eg. on memory allocation error or failure to configure\nsockets for mcast group or addr/port binding:\n\n1. recursive locking: holding rtnl_lock while calling sock_release\nwhich in turn calls again rtnl_lock in ip_mc_drop_socket to leave\nthe mcast group, as noticed by Florian Westphal. Additionally,\nsock_release can not be called while holding sync_mutex (ABBA\ndeadlock).\n\n2. task hung: holding rtnl_lock while calling kthread_stop to\nstop the running kthreads. As the kthreads do the same to leave\nthe mcast group (sock_release -> ip_mc_drop_socket -> rtnl_lock)\nthey hang.\n\nFix the problems by calling rtnl_unlock early in the error path,\nnow sock_release is called after unlocking both mutexes.\n\nProblem 3 (task hung reported by syzkaller [2]) is variant of\nproblem 2: use _trylock to prevent one user to call rtnl_lock and\nthen while waiting for sync_mutex to block kthreads that execute\nsock_release when they are stopped by stop_sync_thread.\n\n[1]\nIPVS: stopping backup sync thread 4500 ...\nWARNING: possible recursive locking detected\n4.16.0-rc7+ #3 Not tainted\n--------------------------------------------\nsyzkaller688027/4497 is trying to acquire lock:\n  (rtnl_mutex){+.+.}, at: [<00000000bb14d7fb>] rtnl_lock+0x17/0x20\nnet/core/rtnetlink.c:74\n\nbut task is already holding lock:\nIPVS: stopping backup sync thread 4495 ...\n  (rtnl_mutex){+.+.}, at: [<00000000bb14d7fb>] rtnl_lock+0x17/0x20\nnet/core/rtnetlink.c:74\n\nother info that might help us debug this:\n  Possible unsafe locking scenario:\n\n        CPU0\n        ----\n   lock(rtnl_mutex);\n   lock(rtnl_mutex);\n\n  *** DEADLOCK ***\n\n  May be due to missing lock nesting notation\n\n2 locks held by syzkaller688027/4497:\n  #0:  (rtnl_mutex){+.+.}, at: [<00000000bb14d7fb>] rtnl_lock+0x17/0x20\nnet/core/rtnetlink.c:74\n  #1:  (ipvs->sync_mutex){+.+.}, at: [<00000000703f78e3>]\ndo_ip_vs_set_ctl+0x10f8/0x1cc0 net/netfilter/ipvs/ip_vs_ctl.c:2388\n\nstack backtrace:\nCPU: 1 PID: 4497 Comm: syzkaller688027 Not tainted 4.16.0-rc7+ #3\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS\nGoogle 01/01/2011\nCall Trace:\n  __dump_stack lib/dump_stack.c:17 [inline]\n  dump_stack+0x194/0x24d lib/dump_stack.c:53\n  print_deadlock_bug kernel/locking/lockdep.c:1761 [inline]\n  check_deadlock kernel/locking/lockdep.c:1805 [inline]\n  validate_chain kernel/locking/lockdep.c:2401 [inline]\n  __lock_acquire+0xe8f/0x3e00 kernel/locking/lockdep.c:3431\n  lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920\n  __mutex_lock_common kernel/locking/mutex.c:756 [inline]\n  __mutex_lock+0x16f/0x1a80 kernel/locking/mutex.c:893\n  mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908\n  rtnl_lock+0x17/0x20 net/core/rtnetlink.c:74\n  ip_mc_drop_socket+0x88/0x230 net/ipv4/igmp.c:2643\n  inet_release+0x4e/0x1c0 net/ipv4/af_inet.c:413\n  sock_release+0x8d/0x1e0 net/socket.c:595\n  start_sync_thread+0x2213/0x2b70 net/netfilter/ipvs/ip_vs_sync.c:1924\n  do_ip_vs_set_ctl+0x1139/0x1cc0 net/netfilter/ipvs/ip_vs_ctl.c:2389\n  nf_sockopt net/netfilter/nf_sockopt.c:106 [inline]\n  nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115\n  ip_setsockopt+0x97/0xa0 net/ipv4/ip_sockglue.c:1261\n  udp_setsockopt+0x45/0x80 net/ipv4/udp.c:2406\n  sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2975\n  SYSC_setsockopt net/socket.c:1849 [inline]\n  SyS_setsockopt+0x189/0x360 net/socket.c:1828\n  do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287\n  entry_SYSCALL_64_after_hwframe+0x42/0xb7\nRIP: 0033:0x446a69\nRSP: 002b:00007fa1c3a64da8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000446a69\nRDX: 000000000000048b RSI: 0000000000000000 RDI: 0000000000000003\nRBP: 00000000006e29fc R08: 0000000000000018 R09: 0000000000000000\nR10: 00000000200000c0 R11: 0000000000000246 R12: 00000000006e29f8\nR13: 00676e697279656b R14: 00007fa1c3a659c0 R15: 00000000006e2b60\n\n[2]\nIPVS: sync thread started: state = BACKUP, mcast_ifn = syz_tun, syncid = 4,\nid = 0\nIPVS: stopping backup sync thread 25415 ...\nINFO: task syz-executor7:25421 blocked for more than 120 seconds.\n       Not tainted 4.16.0-rc6+ #284\n\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\nsyz-executor7   D23688 25421   4408 0x00000004\nCall Trace:\n  context_switch kernel/sched/core.c:2862 [inline]\n  __schedule+0x8fb/0x1ec0 kernel/sched/core.c:3440\n  schedule+0xf5/0x430 kernel/sched/core.c:3499\n  schedule_timeout+0x1a3/0x230 kernel/time/timer.c:1777\n  do_wait_for_common kernel/sched/completion.c:86 [inline]\n  __wait_for_common kernel/sched/completion.c:107 [inline]\n  wait_for_common kernel/sched/completion.c:118 [inline]\n  wait_for_completion+0x415/0x770 kernel/sched/completion.c:139\n  kthread_stop+0x14a/0x7a0 kernel/kthread.c:530\n  stop_sync_thread+0x3d9/0x740 net/netfilter/ipvs/ip_vs_sync.c:1996\n  do_ip_vs_set_ctl+0x2b1/0x1cc0 net/netfilter/ipvs/ip_vs_ctl.c:2394\n  nf_sockopt net/netfilter/nf_sockopt.c:106 [inline]\n  nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115\n  ip_setsockopt+0x97/0xa0 net/ipv4/ip_sockglue.c:1253\n  sctp_setsockopt+0x2ca/0x63e0 net/sctp/socket.c:4154\n  sock_common_setsockopt+0x95/0xd0 net/core/sock.c:3039\n  SYSC_setsockopt net/socket.c:1850 [inline]\n  SyS_setsockopt+0x189/0x360 net/socket.c:1829\n  do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287\n  entry_SYSCALL_64_after_hwframe+0x42/0xb7\nRIP: 0033:0x454889\nRSP: 002b:00007fc927626c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 00007fc9276276d4 RCX: 0000000000454889\nRDX: 000000000000048c RSI: 0000000000000000 RDI: 0000000000000017\nRBP: 000000000072bf58 R08: 0000000000000018 R09: 0000000000000000\nR10: 0000000020000000 R11: 0000000000000246 R12: 00000000ffffffff\nR13: 000000000000051c R14: 00000000006f9b40 R15: 0000000000000001\n\nShowing all locks held in the system:\n2 locks held by khungtaskd/868:\n  #0:  (rcu_read_lock){....}, at: [<00000000a1a8f002>]\ncheck_hung_uninterruptible_tasks kernel/hung_task.c:175 [inline]\n  #0:  (rcu_read_lock){....}, at: [<00000000a1a8f002>] watchdog+0x1c5/0xd60\nkernel/hung_task.c:249\n  #1:  (tasklist_lock){.+.+}, at: [<0000000037c2f8f9>]\ndebug_show_all_locks+0xd3/0x3d0 kernel/locking/lockdep.c:4470\n1 lock held by rsyslogd/4247:\n  #0:  (&f->f_pos_lock){+.+.}, at: [<000000000d8d6983>]\n__fdget_pos+0x12b/0x190 fs/file.c:765\n2 locks held by getty/4338:\n  #0:  (&tty->ldisc_sem){++++}, at: [<00000000bee98654>]\nldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365\n  #1:  (&ldata->atomic_read_lock){+.+.}, at: [<00000000c1d180aa>]\nn_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131\n2 locks held by getty/4339:\n  #0:  (&tty->ldisc_sem){++++}, at: [<00000000bee98654>]\nldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365\n  #1:  (&ldata->atomic_read_lock){+.+.}, at: [<00000000c1d180aa>]\nn_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131\n2 locks held by getty/4340:\n  #0:  (&tty->ldisc_sem){++++}, at: [<00000000bee98654>]\nldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365\n  #1:  (&ldata->atomic_read_lock){+.+.}, at: [<00000000c1d180aa>]\nn_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131\n2 locks held by getty/4341:\n  #0:  (&tty->ldisc_sem){++++}, at: [<00000000bee98654>]\nldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365\n  #1:  (&ldata->atomic_read_lock){+.+.}, at: [<00000000c1d180aa>]\nn_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131\n2 locks held by getty/4342:\n  #0:  (&tty->ldisc_sem){++++}, at: [<00000000bee98654>]\nldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365\n  #1:  (&ldata->atomic_read_lock){+.+.}, at: [<00000000c1d180aa>]\nn_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131\n2 locks held by getty/4343:\n  #0:  (&tty->ldisc_sem){++++}, at: [<00000000bee98654>]\nldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365\n  #1:  (&ldata->atomic_read_lock){+.+.}, at: [<00000000c1d180aa>]\nn_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131\n2 locks held by getty/4344:\n  #0:  (&tty->ldisc_sem){++++}, at: [<00000000bee98654>]\nldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365\n  #1:  (&ldata->atomic_read_lock){+.+.}, at: [<00000000c1d180aa>]\nn_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131\n3 locks held by kworker/0:5/6494:\n  #0:  ((wq_completion)\"%s\"(\"ipv6_addrconf\")){+.+.}, at:\n[<00000000a062b18e>] work_static include/linux/workqueue.h:198 [inline]\n  #0:  ((wq_completion)\"%s\"(\"ipv6_addrconf\")){+.+.}, at:\n[<00000000a062b18e>] set_work_data kernel/workqueue.c:619 [inline]\n  #0:  ((wq_completion)\"%s\"(\"ipv6_addrconf\")){+.+.}, at:\n[<00000000a062b18e>] set_work_pool_and_clear_pending kernel/workqueue.c:646\n[inline]\n  #0:  ((wq_completion)\"%s\"(\"ipv6_addrconf\")){+.+.}, at:\n[<00000000a062b18e>] process_one_work+0xb12/0x1bb0 kernel/workqueue.c:2084\n  #1:  ((addr_chk_work).work){+.+.}, at: [<00000000278427d5>]\nprocess_one_work+0xb89/0x1bb0 kernel/workqueue.c:2088\n  #2:  (rtnl_mutex){+.+.}, at: [<00000000066e35ac>] rtnl_lock+0x17/0x20\nnet/core/rtnetlink.c:74\n1 lock held by syz-executor7/25421:\n  #0:  (ipvs->sync_mutex){+.+.}, at: [<00000000d414a689>]\ndo_ip_vs_set_ctl+0x277/0x1cc0 net/netfilter/ipvs/ip_vs_ctl.c:2393\n2 locks held by syz-executor7/25427:\n  #0:  (rtnl_mutex){+.+.}, at: [<00000000066e35ac>] rtnl_lock+0x17/0x20\nnet/core/rtnetlink.c:74\n  #1:  (ipvs->sync_mutex){+.+.}, at: [<00000000e6d48489>]\ndo_ip_vs_set_ctl+0x10f8/0x1cc0 net/netfilter/ipvs/ip_vs_ctl.c:2388\n1 lock held by syz-executor7/25435:\n  #0:  (rtnl_mutex){+.+.}, at: [<00000000066e35ac>] rtnl_lock+0x17/0x20\nnet/core/rtnetlink.c:74\n1 lock held by ipvs-b:2:0/25415:\n  #0:  (rtnl_mutex){+.+.}, at: [<00000000066e35ac>] rtnl_lock+0x17/0x20\nnet/core/rtnetlink.c:74\n\nReported-and-tested-by: syzbot+a46d6abf9d56b1365a72@syzkaller.appspotmail.com\nReported-and-tested-by: syzbot+5fe074c01b2032ce9618@syzkaller.appspotmail.com\nFixes: e0b26cc997d5 (\"ipvs: call rtnl_lock early\")\nSigned-off-by: Julian Anastasov <ja@ssi.bg>\nSigned-off-by: Simon Horman <horms@verge.net.au>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nCc: Zubin Mithra <zsm@chromium.org>\nCc: Guenter Roeck <groeck@chromium.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/83797a770fe0b4bcbe6f19fa71404d97aaddfda4"},{"sha":"1899f679355d34d18447e76fa76eae16299fddda","author":{"name":"Sagi Grimberg","email":"bf169a711b430cb763859053627bb76d98a96051@grimberg.me"},"message":"IB/device: Convert ib-comp-wq to be CPU-bound\n\ncommit b7363e67b23e04c23c2a99437feefac7292a88bc upstream.\n\nThis workqueue is used by our storage target mode ULPs\nvia the new CQ API. Recent observations when working\nwith very high-end flash storage devices reveal that\nUNBOUND workqueue threads can migrate between cpu cores\nand even numa nodes (although some numa locality is accounted\nfor).\n\nWhile this attribute can be useful in some workloads,\nit does not fit in very nicely with the normal\nrun-to-completion model we usually use in our target-mode\nULPs and the block-mq irq<->cpu affinity facilities.\n\nThe whole block-mq concept is that the completion will\nland on the same cpu where the submission was performed.\nThe fact that our submitter thread is migrating cpus\ncan break this locality.\n\nWe assume that as a target mode ULP, we will serve multiple\ninitiators/clients and we can spread the load enough without\nhaving to use unbound kworkers.\n\nAlso, while we're at it, expose this workqueue via sysfs which\nis harmless and can be useful for debug.\n\nSigned-off-by: Sagi Grimberg <sagi@grimberg.me>\nReviewed-by: Bart Van Assche <bart.vanassche@sandisk.com>--\nSigned-off-by: Doug Ledford <dledford@redhat.com>\nCc: Raju  Rangoju <rajur@chelsio.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/1899f679355d34d18447e76fa76eae16299fddda"},{"sha":"383250363daf01eb7aa3728c09ef8a4f6d8a3252","author":{"name":"Tom Herbert","email":"96835dd8bfa718bd6447ccc87af89ae1675daeca@quantonium.net"},"message":"kcm: Call strp_stop before strp_done in kcm_attach\n\ncommit dff8baa261174de689a44572d0ea182d7aa70598 upstream.\n\nIn kcm_attach strp_done is called when sk_user_data is already\nset to fail the attach. strp_done needs the strp to be stopped and\nwarns if it isn't. Call strp_stop in this case to eliminate the\nwarning message.\n\nReported-by: syzbot+88dfb55e4c8b770d86e3@syzkaller.appspotmail.com\nFixes: e5571240236c5652f (\"kcm: Check if sk_user_data already set in kcm_attach\"\nSigned-off-by: Tom Herbert <tom@quantonium.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/383250363daf01eb7aa3728c09ef8a4f6d8a3252"},{"sha":"7b38b6dd316e5359c70fc11df7eb27825d4f3f15","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"crypto: af_alg - fix possible uninit-value in alg_bind()\n\ncommit a466856e0b7ab269cdf9461886d007e88ff575b0 upstream.\n\nsyzbot reported :\n\nBUG: KMSAN: uninit-value in alg_bind+0xe3/0xd90 crypto/af_alg.c:162\n\nWe need to check addr_len before dereferencing sa (or uaddr)\n\nFixes: bb30b8848c85 (\"crypto: af_alg - whitelist mask and type\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nCc: Stephan Mueller <smueller@chronox.de>\nCc: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/7b38b6dd316e5359c70fc11df7eb27825d4f3f15"},{"sha":"473ac55c5e036a73455bfbf5bf7b7bffeac4fa3d","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"netlink: fix uninit-value in netlink_sendmsg\n\ncommit 6091f09c2f79730d895149bcfe3d66140288cd0e upstream.\n\nsyzbot reported :\n\nBUG: KMSAN: uninit-value in ffs arch/x86/include/asm/bitops.h:432 [inline]\nBUG: KMSAN: uninit-value in netlink_sendmsg+0xb26/0x1310 net/netlink/af_netlink.c:1851\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/473ac55c5e036a73455bfbf5bf7b7bffeac4fa3d"},{"sha":"a3cac7e26bbd944cc8bfc96c81d6784fbde594ec","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"net: fix rtnh_ok()\n\ncommit b1993a2de12c9e75c35729e2ffbc3a92d50c0d31 upstream.\n\nsyzbot reported :\n\nBUG: KMSAN: uninit-value in rtnh_ok include/net/nexthop.h:11 [inline]\nBUG: KMSAN: uninit-value in fib_count_nexthops net/ipv4/fib_semantics.c:469 [inline]\nBUG: KMSAN: uninit-value in fib_create_info+0x554/0x8d20 net/ipv4/fib_semantics.c:1091\n\n@remaining is an integer, coming from user space.\nIf it is negative we want rtnh_ok() to return false.\n\nFixes: 4e902c57417c (\"[IPv4]: FIB configuration using struct fib_config\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/a3cac7e26bbd944cc8bfc96c81d6784fbde594ec"},{"sha":"ec98618c20d0ba798798ec93fb366681f18347de","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"net: initialize skb->peeked when cloning\n\ncommit b13dda9f9aa7caceeee61c080c2e544d5f5d85e5 upstream.\n\nsyzbot reported __skb_try_recv_from_queue() was using skb->peeked\nwhile it was potentially unitialized.\n\nWe need to clear it in __skb_clone()\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/ec98618c20d0ba798798ec93fb366681f18347de"},{"sha":"45227db4a6c2174b8aaf55c4a607aa55b134a74e","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"net: fix uninit-value in __hw_addr_add_ex()\n\ncommit 77d36398d99f2565c0a8d43a86fd520a82e64bb8 upstream.\n\nsyzbot complained :\n\nBUG: KMSAN: uninit-value in memcmp+0x119/0x180 lib/string.c:861\nCPU: 0 PID: 3 Comm: kworker/0:0 Not tainted 4.16.0+ #82\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nWorkqueue: ipv6_addrconf addrconf_dad_work\nCall Trace:\n __dump_stack lib/dump_stack.c:17 [inline]\n dump_stack+0x185/0x1d0 lib/dump_stack.c:53\n kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067\n __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:676\n memcmp+0x119/0x180 lib/string.c:861\n __hw_addr_add_ex net/core/dev_addr_lists.c:60 [inline]\n __dev_mc_add+0x1c2/0x8e0 net/core/dev_addr_lists.c:670\n dev_mc_add+0x6d/0x80 net/core/dev_addr_lists.c:687\n igmp6_group_added+0x2db/0xa00 net/ipv6/mcast.c:662\n ipv6_dev_mc_inc+0xe9e/0x1130 net/ipv6/mcast.c:914\n addrconf_join_solict net/ipv6/addrconf.c:2078 [inline]\n addrconf_dad_begin net/ipv6/addrconf.c:3828 [inline]\n addrconf_dad_work+0x427/0x2150 net/ipv6/addrconf.c:3954\n process_one_work+0x12c6/0x1f60 kernel/workqueue.c:2113\n worker_thread+0x113c/0x24f0 kernel/workqueue.c:2247\n kthread+0x539/0x720 kernel/kthread.c:239\n\nFixes: f001fde5eadd (\"net: introduce a list of device addresses dev_addr_list (v6)\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/45227db4a6c2174b8aaf55c4a607aa55b134a74e"},{"sha":"543cb05defa68c8020fefb04d09420fc13d6b626","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"dccp: initialize ireq->ir_mark\n\ncommit b855ff827476adbdc2259e9895681d82b7b26065 upstream.\n\nsyzbot reported an uninit-value read of skb->mark in iptable_mangle_hook()\n\nThanks to the nice report, I tracked the problem to dccp not caring\nof ireq->ir_mark for passive sessions.\n\nBUG: KMSAN: uninit-value in ipt_mangle_out net/ipv4/netfilter/iptable_mangle.c:66 [inline]\nBUG: KMSAN: uninit-value in iptable_mangle_hook+0x5e5/0x720 net/ipv4/netfilter/iptable_mangle.c:84\nCPU: 0 PID: 5300 Comm: syz-executor3 Not tainted 4.16.0+ #81\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:17 [inline]\n dump_stack+0x185/0x1d0 lib/dump_stack.c:53\n kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067\n __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:676\n ipt_mangle_out net/ipv4/netfilter/iptable_mangle.c:66 [inline]\n iptable_mangle_hook+0x5e5/0x720 net/ipv4/netfilter/iptable_mangle.c:84\n nf_hook_entry_hookfn include/linux/netfilter.h:120 [inline]\n nf_hook_slow+0x158/0x3d0 net/netfilter/core.c:483\n nf_hook include/linux/netfilter.h:243 [inline]\n __ip_local_out net/ipv4/ip_output.c:113 [inline]\n ip_local_out net/ipv4/ip_output.c:122 [inline]\n ip_queue_xmit+0x1d21/0x21c0 net/ipv4/ip_output.c:504\n dccp_transmit_skb+0x15eb/0x1900 net/dccp/output.c:142\n dccp_xmit_packet+0x814/0x9e0 net/dccp/output.c:281\n dccp_write_xmit+0x20f/0x480 net/dccp/output.c:363\n dccp_sendmsg+0x12ca/0x12d0 net/dccp/proto.c:818\n inet_sendmsg+0x48d/0x740 net/ipv4/af_inet.c:764\n sock_sendmsg_nosec net/socket.c:630 [inline]\n sock_sendmsg net/socket.c:640 [inline]\n ___sys_sendmsg+0xec0/0x1310 net/socket.c:2046\n __sys_sendmsg net/socket.c:2080 [inline]\n SYSC_sendmsg+0x2a3/0x3d0 net/socket.c:2091\n SyS_sendmsg+0x54/0x80 net/socket.c:2087\n do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x3d/0xa2\nRIP: 0033:0x455259\nRSP: 002b:00007f1a4473dc68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f1a4473e6d4 RCX: 0000000000455259\nRDX: 0000000000000000 RSI: 0000000020b76fc8 RDI: 0000000000000015\nRBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff\nR13: 00000000000004f0 R14: 00000000006fa720 R15: 0000000000000000\n\nUninit was stored to memory at:\n kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]\n kmsan_save_stack mm/kmsan/kmsan.c:293 [inline]\n kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:684\n __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:521\n ip_queue_xmit+0x1e35/0x21c0 net/ipv4/ip_output.c:502\n dccp_transmit_skb+0x15eb/0x1900 net/dccp/output.c:142\n dccp_xmit_packet+0x814/0x9e0 net/dccp/output.c:281\n dccp_write_xmit+0x20f/0x480 net/dccp/output.c:363\n dccp_sendmsg+0x12ca/0x12d0 net/dccp/proto.c:818\n inet_sendmsg+0x48d/0x740 net/ipv4/af_inet.c:764\n sock_sendmsg_nosec net/socket.c:630 [inline]\n sock_sendmsg net/socket.c:640 [inline]\n ___sys_sendmsg+0xec0/0x1310 net/socket.c:2046\n __sys_sendmsg net/socket.c:2080 [inline]\n SYSC_sendmsg+0x2a3/0x3d0 net/socket.c:2091\n SyS_sendmsg+0x54/0x80 net/socket.c:2087\n do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x3d/0xa2\nUninit was stored to memory at:\n kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]\n kmsan_save_stack mm/kmsan/kmsan.c:293 [inline]\n kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:684\n __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:521\n inet_csk_clone_lock+0x503/0x580 net/ipv4/inet_connection_sock.c:797\n dccp_create_openreq_child+0x7f/0x890 net/dccp/minisocks.c:92\n dccp_v4_request_recv_sock+0x22c/0xe90 net/dccp/ipv4.c:408\n dccp_v6_request_recv_sock+0x290/0x2000 net/dccp/ipv6.c:414\n dccp_check_req+0x7b9/0x8f0 net/dccp/minisocks.c:197\n dccp_v4_rcv+0x12e4/0x2630 net/dccp/ipv4.c:840\n ip_local_deliver_finish+0x6ed/0xd40 net/ipv4/ip_input.c:216\n NF_HOOK include/linux/netfilter.h:288 [inline]\n ip_local_deliver+0x43c/0x4e0 net/ipv4/ip_input.c:257\n dst_input include/net/dst.h:449 [inline]\n ip_rcv_finish+0x1253/0x16d0 net/ipv4/ip_input.c:397\n NF_HOOK include/linux/netfilter.h:288 [inline]\n ip_rcv+0x119d/0x16f0 net/ipv4/ip_input.c:493\n __netif_receive_skb_core+0x47cf/0x4a80 net/core/dev.c:4562\n __netif_receive_skb net/core/dev.c:4627 [inline]\n process_backlog+0x62d/0xe20 net/core/dev.c:5307\n napi_poll net/core/dev.c:5705 [inline]\n net_rx_action+0x7c1/0x1a70 net/core/dev.c:5771\n __do_softirq+0x56d/0x93d kernel/softirq.c:285\nUninit was created at:\n kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]\n kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188\n kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314\n kmem_cache_alloc+0xaab/0xb90 mm/slub.c:2756\n reqsk_alloc include/net/request_sock.h:88 [inline]\n inet_reqsk_alloc+0xc4/0x7f0 net/ipv4/tcp_input.c:6145\n dccp_v4_conn_request+0x5cc/0x1770 net/dccp/ipv4.c:600\n dccp_v6_conn_request+0x299/0x1880 net/dccp/ipv6.c:317\n dccp_rcv_state_process+0x2ea/0x2410 net/dccp/input.c:612\n dccp_v4_do_rcv+0x229/0x340 net/dccp/ipv4.c:682\n dccp_v6_do_rcv+0x16d/0x1220 net/dccp/ipv6.c:578\n sk_backlog_rcv include/net/sock.h:908 [inline]\n __sk_receive_skb+0x60e/0xf20 net/core/sock.c:513\n dccp_v4_rcv+0x24d4/0x2630 net/dccp/ipv4.c:874\n ip_local_deliver_finish+0x6ed/0xd40 net/ipv4/ip_input.c:216\n NF_HOOK include/linux/netfilter.h:288 [inline]\n ip_local_deliver+0x43c/0x4e0 net/ipv4/ip_input.c:257\n dst_input include/net/dst.h:449 [inline]\n ip_rcv_finish+0x1253/0x16d0 net/ipv4/ip_input.c:397\n NF_HOOK include/linux/netfilter.h:288 [inline]\n ip_rcv+0x119d/0x16f0 net/ipv4/ip_input.c:493\n __netif_receive_skb_core+0x47cf/0x4a80 net/core/dev.c:4562\n __netif_receive_skb net/core/dev.c:4627 [inline]\n process_backlog+0x62d/0xe20 net/core/dev.c:5307\n napi_poll net/core/dev.c:5705 [inline]\n net_rx_action+0x7c1/0x1a70 net/core/dev.c:5771\n __do_softirq+0x56d/0x93d kernel/softirq.c:285\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/543cb05defa68c8020fefb04d09420fc13d6b626"},{"sha":"e68fb96236f46032def5d2eee26875b4d1eb0f4c","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"soreuseport: initialise timewait reuseport field\n\ncommit 3099a52918937ab86ec47038ad80d377ba16c531 upstream.\n\nsyzbot reported an uninit-value in inet_csk_bind_conflict() [1]\n\nIt turns out we never propagated sk->sk_reuseport into timewait socket.\n\n[1]\nBUG: KMSAN: uninit-value in inet_csk_bind_conflict+0x5f9/0x990 net/ipv4/inet_connection_sock.c:151\nCPU: 1 PID: 3589 Comm: syzkaller008242 Not tainted 4.16.0+ #82\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:17 [inline]\n dump_stack+0x185/0x1d0 lib/dump_stack.c:53\n kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067\n __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:676\n inet_csk_bind_conflict+0x5f9/0x990 net/ipv4/inet_connection_sock.c:151\n inet_csk_get_port+0x1d28/0x1e40 net/ipv4/inet_connection_sock.c:320\n inet6_bind+0x121c/0x1820 net/ipv6/af_inet6.c:399\n SYSC_bind+0x3f2/0x4b0 net/socket.c:1474\n SyS_bind+0x54/0x80 net/socket.c:1460\n do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x3d/0xa2\nRIP: 0033:0x4416e9\nRSP: 002b:00007ffce6d15c88 EFLAGS: 00000217 ORIG_RAX: 0000000000000031\nRAX: ffffffffffffffda RBX: 0100000000000000 RCX: 00000000004416e9\nRDX: 000000000000001c RSI: 0000000020402000 RDI: 0000000000000004\nRBP: 0000000000000000 R08: 00000000e6d15e08 R09: 00000000e6d15e08\nR10: 0000000000000004 R11: 0000000000000217 R12: 0000000000009478\nR13: 00000000006cd448 R14: 0000000000000000 R15: 0000000000000000\n\nUninit was stored to memory at:\n kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]\n kmsan_save_stack mm/kmsan/kmsan.c:293 [inline]\n kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:684\n __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:521\n tcp_time_wait+0xf17/0xf50 net/ipv4/tcp_minisocks.c:283\n tcp_rcv_state_process+0xebe/0x6490 net/ipv4/tcp_input.c:6003\n tcp_v6_do_rcv+0x11dd/0x1d90 net/ipv6/tcp_ipv6.c:1331\n sk_backlog_rcv include/net/sock.h:908 [inline]\n __release_sock+0x2d6/0x680 net/core/sock.c:2271\n release_sock+0x97/0x2a0 net/core/sock.c:2786\n tcp_close+0x277/0x18f0 net/ipv4/tcp.c:2269\n inet_release+0x240/0x2a0 net/ipv4/af_inet.c:427\n inet6_release+0xaf/0x100 net/ipv6/af_inet6.c:435\n sock_release net/socket.c:595 [inline]\n sock_close+0xe0/0x300 net/socket.c:1149\n __fput+0x49e/0xa10 fs/file_table.c:209\n ____fput+0x37/0x40 fs/file_table.c:243\n task_work_run+0x243/0x2c0 kernel/task_work.c:113\n exit_task_work include/linux/task_work.h:22 [inline]\n do_exit+0x10e1/0x38d0 kernel/exit.c:867\n do_group_exit+0x1a0/0x360 kernel/exit.c:970\n SYSC_exit_group+0x21/0x30 kernel/exit.c:981\n SyS_exit_group+0x25/0x30 kernel/exit.c:979\n do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x3d/0xa2\nUninit was stored to memory at:\n kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]\n kmsan_save_stack mm/kmsan/kmsan.c:293 [inline]\n kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:684\n __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:521\n inet_twsk_alloc+0xaef/0xc00 net/ipv4/inet_timewait_sock.c:182\n tcp_time_wait+0xd9/0xf50 net/ipv4/tcp_minisocks.c:258\n tcp_rcv_state_process+0xebe/0x6490 net/ipv4/tcp_input.c:6003\n tcp_v6_do_rcv+0x11dd/0x1d90 net/ipv6/tcp_ipv6.c:1331\n sk_backlog_rcv include/net/sock.h:908 [inline]\n __release_sock+0x2d6/0x680 net/core/sock.c:2271\n release_sock+0x97/0x2a0 net/core/sock.c:2786\n tcp_close+0x277/0x18f0 net/ipv4/tcp.c:2269\n inet_release+0x240/0x2a0 net/ipv4/af_inet.c:427\n inet6_release+0xaf/0x100 net/ipv6/af_inet6.c:435\n sock_release net/socket.c:595 [inline]\n sock_close+0xe0/0x300 net/socket.c:1149\n __fput+0x49e/0xa10 fs/file_table.c:209\n ____fput+0x37/0x40 fs/file_table.c:243\n task_work_run+0x243/0x2c0 kernel/task_work.c:113\n exit_task_work include/linux/task_work.h:22 [inline]\n do_exit+0x10e1/0x38d0 kernel/exit.c:867\n do_group_exit+0x1a0/0x360 kernel/exit.c:970\n SYSC_exit_group+0x21/0x30 kernel/exit.c:981\n SyS_exit_group+0x25/0x30 kernel/exit.c:979\n do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x3d/0xa2\nUninit was created at:\n kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]\n kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188\n kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314\n kmem_cache_alloc+0xaab/0xb90 mm/slub.c:2756\n inet_twsk_alloc+0x13b/0xc00 net/ipv4/inet_timewait_sock.c:163\n tcp_time_wait+0xd9/0xf50 net/ipv4/tcp_minisocks.c:258\n tcp_rcv_state_process+0xebe/0x6490 net/ipv4/tcp_input.c:6003\n tcp_v6_do_rcv+0x11dd/0x1d90 net/ipv6/tcp_ipv6.c:1331\n sk_backlog_rcv include/net/sock.h:908 [inline]\n __release_sock+0x2d6/0x680 net/core/sock.c:2271\n release_sock+0x97/0x2a0 net/core/sock.c:2786\n tcp_close+0x277/0x18f0 net/ipv4/tcp.c:2269\n inet_release+0x240/0x2a0 net/ipv4/af_inet.c:427\n inet6_release+0xaf/0x100 net/ipv6/af_inet6.c:435\n sock_release net/socket.c:595 [inline]\n sock_close+0xe0/0x300 net/socket.c:1149\n __fput+0x49e/0xa10 fs/file_table.c:209\n ____fput+0x37/0x40 fs/file_table.c:243\n task_work_run+0x243/0x2c0 kernel/task_work.c:113\n exit_task_work include/linux/task_work.h:22 [inline]\n do_exit+0x10e1/0x38d0 kernel/exit.c:867\n do_group_exit+0x1a0/0x360 kernel/exit.c:970\n SYSC_exit_group+0x21/0x30 kernel/exit.c:981\n SyS_exit_group+0x25/0x30 kernel/exit.c:979\n do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x3d/0xa2\n\nFixes: da5e36308d9f (\"soreuseport: TCP/IPv4 implementation\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/e68fb96236f46032def5d2eee26875b4d1eb0f4c"},{"sha":"68447d694fd41d8381090ea012185fddc8df25c5","author":{"name":"Jiri Olsa","email":"2c6594f608aa3d41e98d48846a6328831f7084ad@kernel.org"},"message":"perf: Remove superfluous allocation error check\n\ncommit bfb3d7b8b906b66551424d7636182126e1d134c8 upstream.\n\nIf the get_callchain_buffers fails to allocate the buffer it will\ndecrease the nr_callchain_events right away.\n\nThere's no point of checking the allocation error for\nnr_callchain_events > 1. Removing that check.\n\nSigned-off-by: Jiri Olsa <jolsa@kernel.org>\nTested-by: Arnaldo Carvalho de Melo <acme@redhat.com>\nCc: Alexander Shishkin <alexander.shishkin@linux.intel.com>\nCc: Andi Kleen <andi@firstfloor.org>\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: Namhyung Kim <namhyung@kernel.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: syzkaller-bugs@googlegroups.com\nCc: x86@kernel.org\nLink: http://lkml.kernel.org/r/20180415092352.12403-3-jolsa@kernel.org\nSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/68447d694fd41d8381090ea012185fddc8df25c5"},{"sha":"869f538101abb7d394a9bfdc49e0874a7a07b308","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"tcp: fix TCP_REPAIR_QUEUE bound checking\n\ncommit bf2acc943a45d2b2e8a9f1a5ddff6b6e43cc69d9 upstream.\n\nsyzbot is able to produce a nasty WARN_ON() in tcp_verify_left_out()\nwith following C-repro :\n\nsocket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3\nsetsockopt(3, SOL_TCP, TCP_REPAIR, [1], 4) = 0\nsetsockopt(3, SOL_TCP, TCP_REPAIR_QUEUE, [-1], 4) = 0\nbind(3, {sa_family=AF_INET, sin_port=htons(20002), sin_addr=inet_addr(\"0.0.0.0\")}, 16) = 0\nsendto(3, \"\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\"...,\n\t1242, MSG_FASTOPEN, {sa_family=AF_INET, sin_port=htons(20002), sin_addr=inet_addr(\"127.0.0.1\")}, 16) = 1242\nsetsockopt(3, SOL_TCP, TCP_REPAIR_WINDOW, \"\\4\\0\\0@+\\205\\0\\0\\377\\377\\0\\0\\377\\377\\377\\177\\0\\0\\0\\0\", 20) = 0\nwritev(3, [{\"\\270\", 1}], 1)             = 1\nsetsockopt(3, SOL_TCP, TCP_REPAIR_OPTIONS, \"\\10\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0|\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\"..., 386) = 0\nwritev(3, [{\"\\210v\\r[\\226\\320t\\231qwQ\\204\\264l\\254\\t\\1\\20\\245\\214p\\350H\\223\\254;\\\\\\37\\345\\307p$\"..., 3144}], 1) = 3144\n\nThe 3rd system call looks odd :\nsetsockopt(3, SOL_TCP, TCP_REPAIR_QUEUE, [-1], 4) = 0\n\nThis patch makes sure bound checking is using an unsigned compare.\n\nFixes: ee9952831cfd (\"tcp: Initial repair mode\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nCc: Pavel Emelyanov <xemul@parallels.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/869f538101abb7d394a9bfdc49e0874a7a07b308"},{"sha":"57d641003679cf452f995b6f034b567d5d4e3be3","author":{"name":"Jan Kara","email":"596727c8a0ea4db3ba2ceceedccbacd3d7b371b8@suse.cz"},"message":"bdi: Fix oops in wb_workfn()\n\ncommit b8b784958eccbf8f51ebeee65282ca3fd59ea391 upstream.\n\nSyzbot has reported that it can hit a NULL pointer dereference in\nwb_workfn() due to wb->bdi->dev being NULL. This indicates that\nwb_workfn() was called for an already unregistered bdi which should not\nhappen as wb_shutdown() called from bdi_unregister() should make sure\nall pending writeback works are completed before bdi is unregistered.\nExcept that wb_workfn() itself can requeue the work with:\n\n\tmod_delayed_work(bdi_wq, &wb->dwork, 0);\n\nand if this happens while wb_shutdown() is waiting in:\n\n\tflush_delayed_work(&wb->dwork);\n\nthe dwork can get executed after wb_shutdown() has finished and\nbdi_unregister() has cleared wb->bdi->dev.\n\nMake wb_workfn() use wakeup_wb() for requeueing the work which takes all\nthe necessary precautions against racing with bdi unregistration.\n\nCC: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>\nCC: Tejun Heo <tj@kernel.org>\nFixes: 839a8e8660b6777e7fe4e80af1a048aebe2b5977\nReported-by: syzbot <syzbot+9873874c735f2892e7e9@syzkaller.appspotmail.com>\nReviewed-by: Dave Chinner <dchinner@redhat.com>\nSigned-off-by: Jan Kara <jack@suse.cz>\nSigned-off-by: Jens Axboe <axboe@kernel.dk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/57d641003679cf452f995b6f034b567d5d4e3be3"},{"sha":"b87943f388ab24f66b4db380d47fe691a67dc44d","author":{"name":"Paul Mackerras","email":"19a0ba370c443ba08d20b5061586430ab449ee8c@ozlabs.org"},"message":"KVM: PPC: Book3S HV: Fix trap number return from __kvmppc_vcore_entry\n\ncommit a8b48a4dccea77e29462e59f1dbf0d5aa1ff167c upstream.\n\nThis fixes a bug where the trap number that is returned by\n__kvmppc_vcore_entry gets corrupted.  The effect of the corruption\nis that IPIs get ignored on POWER9 systems when the IPI is sent via\na doorbell interrupt to a CPU which is executing in a KVM guest.\nThe effect of the IPI being ignored is often that another CPU locks\nup inside smp_call_function_many() (and if that CPU is holding a\nspinlock, other CPUs then lock up inside raw_spin_lock()).\n\nThe trap number is currently held in register r12 for most of the\nassembly-language part of the guest exit path.  In that path, we\ncall kvmppc_subcore_exit_guest(), which is a C function, without\nrestoring r12 afterwards.  Depending on the kernel config and the\ncompiler, it may modify r12 or it may not, so some config/compiler\ncombinations see the bug and others don't.\n\nTo fix this, we arrange for the trap number to be stored on the\nstack from the 'guest_bypass:' label until the end of the function,\nthen the trap number is loaded and returned in r12 as before.\n\nCc: stable@vger.kernel.org # v4.8+\nFixes: fd7bacbca47a (\"KVM: PPC: Book3S HV: Fix TB corruption in guest exit path on HMI interrupt\")\nSigned-off-by: Paul Mackerras <paulus@ozlabs.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/b87943f388ab24f66b4db380d47fe691a67dc44d"},{"sha":"b8bf4b886b82585202ab4ee169718656661cb89e","author":{"name":"Wei Fang","email":"e9083e8823ccf4d1e7311b2b8bf95b8e9dfa1102@huawei.com"},"message":"f2fs: fix a dead loop in f2fs_fiemap()\n\ncommit b86e33075ed1909d8002745b56ecf73b833db143 upstream.\n\nA dead loop can be triggered in f2fs_fiemap() using the test case\nas below:\n\n\t...\n\tfd = open();\n\tfallocate(fd, 0, 0, 4294967296);\n\tioctl(fd, FS_IOC_FIEMAP, fiemap_buf);\n\t...\n\nIt's caused by an overflow in __get_data_block():\n\t...\n\tbh->b_size = map.m_len << inode->i_blkbits;\n\t...\nmap.m_len is an unsigned int, and bh->b_size is a size_t which is 64 bits\non 64 bits archtecture, type conversion from an unsigned int to a size_t\nwill result in an overflow.\n\nIn the above-mentioned case, bh->b_size will be zero, and f2fs_fiemap()\nwill call get_data_block() at block 0 again an again.\n\nFix this by adding a force conversion before left shift.\n\nSigned-off-by: Wei Fang <fangwei1@huawei.com>\nAcked-by: Chao Yu <yuchao0@huawei.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\nCc: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/b8bf4b886b82585202ab4ee169718656661cb89e"},{"sha":"b8c320884eff003581ee61c5970a2e83f513eff1","author":{"name":"Suzuki K Poulose","email":"25f0e69a3d23ed1d9a060214a9ff1a9504ba3f49@arm.com"},"message":"arm64: Add work around for Arm Cortex-A55 Erratum 1024718\n\ncommit ece1397cbc89c51914fae1aec729539cfd8bd62b upstream.\n\nSome variants of the Arm Cortex-55 cores (r0p0, r0p1, r1p0) suffer\nfrom an erratum 1024718, which causes incorrect updates when DBM/AP\nbits in a page table entry is modified without a break-before-make\nsequence. The work around is to skip enabling the hardware DBM feature\non the affected cores. The hardware Access Flag management features\nis not affected. There are some other cores suffering from this\nerrata, which could be added to the midr_list to trigger the work\naround.\n\nCc: Catalin Marinas <catalin.marinas@arm.com>\nCc: ckadabi@codeaurora.org\nReviewed-by: Dave Martin <dave.martin@arm.com>\nSigned-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>\nSigned-off-by: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/b8c320884eff003581ee61c5970a2e83f513eff1"},{"sha":"31d04ca1eb232077e7d8032bc845bba6e6465d22","author":{"name":"Timur Tabi","email":"4ea348ebd818e67772cb0086d44dc1b57ba54129@codeaurora.org"},"message":"gpioib: do not free unrequested descriptors\n\ncommit ab3dbcf78f60f46d6a0ad63b1f4b690b7a427140 upstream.\n\nIf the main loop in linehandle_create() encounters an error, it\nunwinds completely by freeing all previously requested GPIO\ndescriptors.  However, if the error occurs in the beginning of\nthe loop before that GPIO is requested, then the exit code\nattempts to free a null descriptor.  If extrachecks is enabled,\ngpiod_free() triggers a WARN_ON.\n\nInstead, keep a separate count of legitimate GPIOs so that only\nthose are freed.\n\nCc: stable@vger.kernel.org\nFixes: d7c51b47ac11 (\"gpio: userspace ABI for reading/writing GPIO lines\")\nReviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>\nSigned-off-by: Timur Tabi <timur@codeaurora.org>\nSigned-off-by: Linus Walleij <linus.walleij@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/31d04ca1eb232077e7d8032bc845bba6e6465d22"},{"sha":"2b0e672598f9ae572b69898cb235fbeffc3e2f8e","author":{"name":"Govert Overgaauw","email":"b1f76fa6e31ed284f15df7399104efe9b34fc0a1@prodrive-technologies.com"},"message":"gpio: fix aspeed_gpio unmask irq\n\ncommit f241632fd087d3d9fbd5450f4d8c8604badd8348 upstream.\n\nThe unmask function disables all interrupts in a bank when unmasking an\ninterrupt. Only disable the given interrupt.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Govert Overgaauw <govert.overgaauw@prodrive-technologies.com>\nSigned-off-by: Linus Walleij <linus.walleij@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/2b0e672598f9ae572b69898cb235fbeffc3e2f8e"},{"sha":"63e2ae9d75d4c348f47600dcef0f3d90eef7f34e","author":{"name":"Uwe Kleine-König","email":"181323dd666a182bc2d953e52d0ac3ab54cd8391@pengutronix.de"},"message":"gpio: fix error path in lineevent_create\n\ncommit f001cc351ad3309ec8736c374e90e5a4bc472d41 upstream.\n\nIf gpiod_request() fails the cleanup must not call gpiod_free().\n\nCc: stable@vger.kernel.org\nFixes: 61f922db7221 (\"gpio: userspace ABI for reading GPIO line events\")\nSigned-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>\nSigned-off-by: Linus Walleij <linus.walleij@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/63e2ae9d75d4c348f47600dcef0f3d90eef7f34e"},{"sha":"dd4e7140c4dec8ce0bacb0d0ff152653e0b85660","author":{"name":"Johan Hovold","email":"759412786bc533369b22377bf83fb9056c5b25b2@kernel.org"},"message":"rfkill: gpio: fix memory leak in probe error path\n\ncommit 4bf01ca21e2e0e4561d1a03c48c3d740418702db upstream.\n\nMake sure to free the rfkill device in case registration fails during\nprobe.\n\nFixes: 5e7ca3937fbe (\"net: rfkill: gpio: convert to resource managed allocation\")\nCc: stable <stable@vger.kernel.org>\t# 3.13\nCc: Heikki Krogerus <heikki.krogerus@linux.intel.com>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nReviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/dd4e7140c4dec8ce0bacb0d0ff152653e0b85660"}]}
{"actor":{"display_login":"Jackeagle"}}