{"push_id":2615158065,"size":57,"distinct_size":22,"ref":"refs/heads/torvalds/master","head":"918fe1b3157978ada4267468008c5f89ef101e7d","before":"4277e6b9fd44a42d13f1c47fb403167718e9bed4","commits":[{"sha":"d9f92772e8ec388d070752ee8f187ef8fa18621f","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"xfrm6: avoid potential infinite loop in _decode_session6()\n\nsyzbot found a way to trigger an infinitie loop by overflowing\n@offset variable that has been forced to use u16 for some very\nobscure reason in the past.\n\nWe probably want to look at NEXTHDR_FRAGMENT handling which looks\nwrong, in a separate patch.\n\nIn net-next, we shall try to use skb_header_pointer() instead of\npskb_may_pull().\n\nwatchdog: BUG: soft lockup - CPU#1 stuck for 134s! [syz-executor738:4553]\nModules linked in:\nirq event stamp: 13885653\nhardirqs last  enabled at (13885652): [<ffffffff878009d5>] restore_regs_and_return_to_kernel+0x0/0x2b\nhardirqs last disabled at (13885653): [<ffffffff87800905>] interrupt_entry+0xb5/0xf0 arch/x86/entry/entry_64.S:625\nsoftirqs last  enabled at (13614028): [<ffffffff84df0809>] tun_napi_alloc_frags drivers/net/tun.c:1478 [inline]\nsoftirqs last  enabled at (13614028): [<ffffffff84df0809>] tun_get_user+0x1dd9/0x4290 drivers/net/tun.c:1825\nsoftirqs last disabled at (13614032): [<ffffffff84df1b6f>] tun_get_user+0x313f/0x4290 drivers/net/tun.c:1942\nCPU: 1 PID: 4553 Comm: syz-executor738 Not tainted 4.17.0-rc3+ #40\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:check_kcov_mode kernel/kcov.c:67 [inline]\nRIP: 0010:__sanitizer_cov_trace_pc+0x20/0x50 kernel/kcov.c:101\nRSP: 0018:ffff8801d8cfe250 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13\nRAX: ffff8801d88a8080 RBX: ffff8801d7389e40 RCX: 0000000000000006\nRDX: 0000000000000000 RSI: ffffffff868da4ad RDI: ffff8801c8a53277\nRBP: ffff8801d8cfe250 R08: ffff8801d88a8080 R09: ffff8801d8cfe3e8\nR10: ffffed003b19fc87 R11: ffff8801d8cfe43f R12: ffff8801c8a5327f\nR13: 0000000000000000 R14: ffff8801c8a4e5fe R15: ffff8801d8cfe3e8\nFS:  0000000000d88940(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffff600400 CR3: 00000001acab3000 CR4: 00000000001406e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n _decode_session6+0xc1d/0x14f0 net/ipv6/xfrm6_policy.c:150\n __xfrm_decode_session+0x71/0x140 net/xfrm/xfrm_policy.c:2368\n xfrm_decode_session_reverse include/net/xfrm.h:1213 [inline]\n icmpv6_route_lookup+0x395/0x6e0 net/ipv6/icmp.c:372\n icmp6_send+0x1982/0x2da0 net/ipv6/icmp.c:551\n icmpv6_send+0x17a/0x300 net/ipv6/ip6_icmp.c:43\n ip6_input_finish+0x14e1/0x1a30 net/ipv6/ip6_input.c:305\n NF_HOOK include/linux/netfilter.h:288 [inline]\n ip6_input+0xe1/0x5e0 net/ipv6/ip6_input.c:327\n dst_input include/net/dst.h:450 [inline]\n ip6_rcv_finish+0x29c/0xa10 net/ipv6/ip6_input.c:71\n NF_HOOK include/linux/netfilter.h:288 [inline]\n ipv6_rcv+0xeb8/0x2040 net/ipv6/ip6_input.c:208\n __netif_receive_skb_core+0x2468/0x3650 net/core/dev.c:4646\n __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:4711\n netif_receive_skb_internal+0x126/0x7b0 net/core/dev.c:4785\n napi_frags_finish net/core/dev.c:5226 [inline]\n napi_gro_frags+0x631/0xc40 net/core/dev.c:5299\n tun_get_user+0x3168/0x4290 drivers/net/tun.c:1951\n tun_chr_write_iter+0xb9/0x154 drivers/net/tun.c:1996\n call_write_iter include/linux/fs.h:1784 [inline]\n do_iter_readv_writev+0x859/0xa50 fs/read_write.c:680\n do_iter_write+0x185/0x5f0 fs/read_write.c:959\n vfs_writev+0x1c7/0x330 fs/read_write.c:1004\n do_writev+0x112/0x2f0 fs/read_write.c:1039\n __do_sys_writev fs/read_write.c:1112 [inline]\n __se_sys_writev fs/read_write.c:1109 [inline]\n __x64_sys_writev+0x75/0xb0 fs/read_write.c:1109\n do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Steffen Klassert <steffen.klassert@secunet.com>\nCc: Nicolas Dichtel <nicolas.dichtel@6wind.com>\nReported-by: syzbot+0053c8...@syzkaller.appspotmail.com\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/d9f92772e8ec388d070752ee8f187ef8fa18621f"},{"sha":"b71534583f22d08c3e3563bf5100aeb5f5c9fbe5","author":{"name":"Taehee Yoo","email":"6de65b15142147918004ed846c7e65326f9b9238@gmail.com"},"message":"netfilter: nf_tables: fix NULL pointer dereference on nft_ct_helper_obj_dump()\n\nIn the nft_ct_helper_obj_dump(), always priv->helper4 is dereferenced.\nBut if family is ipv6, priv->helper6 should be dereferenced.\n\nSteps to reproduces:\n\n   #test.nft\n   table ip6 filter {\n\t   ct helper ftp {\n\t\t   type \"ftp\" protocol tcp\n\t   }\n\t   chain input {\n\t\t   type filter hook input priority 4;\n\t\t   ct helper set \"ftp\"\n\t   }\n   }\n\n   %nft -f test.nft\n   %nft list ruleset\n\nwe can see the below messages:\n\n[  916.286233] kasan: GPF could be caused by NULL-ptr deref or user memory access\n[  916.294777] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI\n[  916.302613] Modules linked in: nft_objref nf_conntrack_sip nf_conntrack_snmp nf_conntrack_broadcast nf_conntrack_ftp nft_ct nf_conntrack nf_tables nfnetlink [last unloaded: nfnetlink]\n[  916.318758] CPU: 1 PID: 2093 Comm: nft Not tainted 4.17.0-rc4+ #181\n[  916.326772] Hardware name: To be filled by O.E.M. To be filled by O.E.M./Aptio CRB, BIOS 5.6.5 07/08/2015\n[  916.338773] RIP: 0010:strlen+0x1a/0x90\n[  916.342781] RSP: 0018:ffff88010ff0f2f8 EFLAGS: 00010292\n[  916.346773] RAX: dffffc0000000000 RBX: ffff880119b26ee8 RCX: ffff88010c150038\n[  916.354777] RDX: 0000000000000002 RSI: ffff880119b26ee8 RDI: 0000000000000010\n[  916.362773] RBP: 0000000000000010 R08: 0000000000007e88 R09: ffff88010c15003c\n[  916.370773] R10: ffff88010c150037 R11: ffffed002182a007 R12: ffff88010ff04040\n[  916.378779] R13: 0000000000000010 R14: ffff880119b26f30 R15: ffff88010ff04110\n[  916.387265] FS:  00007f57a1997700(0000) GS:ffff88011b800000(0000) knlGS:0000000000000000\n[  916.394785] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  916.402778] CR2: 00007f57a0ac80f0 CR3: 000000010ff02000 CR4: 00000000001006e0\n[  916.410772] Call Trace:\n[  916.414787]  nft_ct_helper_obj_dump+0x94/0x200 [nft_ct]\n[  916.418779]  ? nft_ct_set_eval+0x560/0x560 [nft_ct]\n[  916.426771]  ? memset+0x1f/0x40\n[  916.426771]  ? __nla_reserve+0x92/0xb0\n[  916.434774]  ? memcpy+0x34/0x50\n[  916.434774]  nf_tables_fill_obj_info+0x484/0x860 [nf_tables]\n[  916.442773]  ? __nft_release_basechain+0x600/0x600 [nf_tables]\n[  916.450779]  ? lock_acquire+0x193/0x380\n[  916.454771]  ? lock_acquire+0x193/0x380\n[  916.458789]  ? nf_tables_dump_obj+0x148/0xcb0 [nf_tables]\n[  916.462777]  nf_tables_dump_obj+0x5f0/0xcb0 [nf_tables]\n[  916.470769]  ? __alloc_skb+0x30b/0x500\n[  916.474779]  netlink_dump+0x752/0xb50\n[  916.478775]  __netlink_dump_start+0x4d3/0x750\n[  916.482784]  nf_tables_getobj+0x27a/0x930 [nf_tables]\n[  916.490774]  ? nft_obj_notify+0x100/0x100 [nf_tables]\n[  916.494772]  ? nf_tables_getobj+0x930/0x930 [nf_tables]\n[  916.502579]  ? nf_tables_dump_flowtable_done+0x70/0x70 [nf_tables]\n[  916.506774]  ? nft_obj_notify+0x100/0x100 [nf_tables]\n[  916.514808]  nfnetlink_rcv_msg+0x8ab/0xa86 [nfnetlink]\n[  916.518771]  ? nfnetlink_rcv_msg+0x550/0xa86 [nfnetlink]\n[  916.526782]  netlink_rcv_skb+0x23e/0x360\n[  916.530773]  ? nfnetlink_bind+0x200/0x200 [nfnetlink]\n[  916.534778]  ? debug_check_no_locks_freed+0x280/0x280\n[  916.542770]  ? netlink_ack+0x870/0x870\n[  916.546786]  ? ns_capable_common+0xf4/0x130\n[  916.550765]  nfnetlink_rcv+0x172/0x16c0 [nfnetlink]\n[  916.554771]  ? sched_clock_local+0xe2/0x150\n[  916.558774]  ? sched_clock_cpu+0x144/0x180\n[  916.566575]  ? lock_acquire+0x380/0x380\n[  916.570775]  ? sched_clock_local+0xe2/0x150\n[  916.574765]  ? nfnetlink_net_init+0x130/0x130 [nfnetlink]\n[  916.578763]  ? sched_clock_cpu+0x144/0x180\n[  916.582770]  ? lock_acquire+0x193/0x380\n[  916.590771]  ? lock_acquire+0x193/0x380\n[  916.594766]  ? lock_acquire+0x380/0x380\n[  916.598760]  ? netlink_deliver_tap+0x262/0xa60\n[  916.602766]  ? lock_acquire+0x193/0x380\n[  916.606766]  netlink_unicast+0x3ef/0x5a0\n[  916.610771]  ? netlink_attachskb+0x630/0x630\n[  916.614763]  netlink_sendmsg+0x72a/0xb00\n[  916.618769]  ? netlink_unicast+0x5a0/0x5a0\n[  916.626766]  ? _copy_from_user+0x92/0xc0\n[  916.630773]  __sys_sendto+0x202/0x300\n[  916.634772]  ? __ia32_sys_getpeername+0xb0/0xb0\n[  916.638759]  ? lock_acquire+0x380/0x380\n[  916.642769]  ? lock_acquire+0x193/0x380\n[  916.646761]  ? finish_task_switch+0xf4/0x560\n[  916.650763]  ? __schedule+0x582/0x19a0\n[  916.655301]  ? __sched_text_start+0x8/0x8\n[  916.655301]  ? up_read+0x1c/0x110\n[  916.655301]  ? __do_page_fault+0x48b/0xaa0\n[  916.655301]  ? entry_SYSCALL_64_after_hwframe+0x59/0xbe\n[  916.655301]  __x64_sys_sendto+0xdd/0x1b0\n[  916.655301]  do_syscall_64+0x96/0x3d0\n[  916.655301]  entry_SYSCALL_64_after_hwframe+0x49/0xbe\n[  916.655301] RIP: 0033:0x7f57a0ff5e03\n[  916.655301] RSP: 002b:00007fff6367e0a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\n[  916.655301] RAX: ffffffffffffffda RBX: 00007fff6367f1e0 RCX: 00007f57a0ff5e03\n[  916.655301] RDX: 0000000000000020 RSI: 00007fff6367e110 RDI: 0000000000000003\n[  916.655301] RBP: 00007fff6367e100 R08: 00007f57a0ce9160 R09: 000000000000000c\n[  916.655301] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff6367e110\n[  916.655301] R13: 0000000000000020 R14: 00007f57a153c610 R15: 0000562417258de0\n[  916.655301] Code: ff ff ff 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 fa 53 48 c1 ea 03 48 b8 00 00 00 00 00 fc ff df 48 89 fd 48 83 ec 08 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f\n[  916.655301] RIP: strlen+0x1a/0x90 RSP: ffff88010ff0f2f8\n[  916.771929] ---[ end trace 1065e048e72479fe ]---\n[  916.777204] Kernel panic - not syncing: Fatal exception\n[  916.778158] Kernel Offset: 0x14000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)\n\nSigned-off-by: Taehee Yoo <ap420073@gmail.com>\nAcked-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/b71534583f22d08c3e3563bf5100aeb5f5c9fbe5"},{"sha":"94c752f99954797da583a84c4907ff19e92550a4","author":{"name":"Paolo Abeni","email":"6e4ffc2e3438feb7acb34f6b67e6ae17e700099c@redhat.com"},"message":"netfilter: ebtables: handle string from userspace with care\n\nstrlcpy() can't be safely used on a user-space provided string,\nas it can try to read beyond the buffer's end, if the latter is\nnot NULL terminated.\n\nLeveraging the above, syzbot has been able to trigger the following\nsplat:\n\nBUG: KASAN: stack-out-of-bounds in strlcpy include/linux/string.h:300\n[inline]\nBUG: KASAN: stack-out-of-bounds in compat_mtw_from_user\nnet/bridge/netfilter/ebtables.c:1957 [inline]\nBUG: KASAN: stack-out-of-bounds in ebt_size_mwt\nnet/bridge/netfilter/ebtables.c:2059 [inline]\nBUG: KASAN: stack-out-of-bounds in size_entry_mwt\nnet/bridge/netfilter/ebtables.c:2155 [inline]\nBUG: KASAN: stack-out-of-bounds in compat_copy_entries+0x96c/0x14a0\nnet/bridge/netfilter/ebtables.c:2194\nWrite of size 33 at addr ffff8801b0abf888 by task syz-executor0/4504\n\nCPU: 0 PID: 4504 Comm: syz-executor0 Not tainted 4.17.0-rc2+ #40\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS\nGoogle 01/01/2011\nCall Trace:\n  __dump_stack lib/dump_stack.c:77 [inline]\n  dump_stack+0x1b9/0x294 lib/dump_stack.c:113\n  print_address_description+0x6c/0x20b mm/kasan/report.c:256\n  kasan_report_error mm/kasan/report.c:354 [inline]\n  kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412\n  check_memory_region_inline mm/kasan/kasan.c:260 [inline]\n  check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267\n  memcpy+0x37/0x50 mm/kasan/kasan.c:303\n  strlcpy include/linux/string.h:300 [inline]\n  compat_mtw_from_user net/bridge/netfilter/ebtables.c:1957 [inline]\n  ebt_size_mwt net/bridge/netfilter/ebtables.c:2059 [inline]\n  size_entry_mwt net/bridge/netfilter/ebtables.c:2155 [inline]\n  compat_copy_entries+0x96c/0x14a0 net/bridge/netfilter/ebtables.c:2194\n  compat_do_replace+0x483/0x900 net/bridge/netfilter/ebtables.c:2285\n  compat_do_ebt_set_ctl+0x2ac/0x324 net/bridge/netfilter/ebtables.c:2367\n  compat_nf_sockopt net/netfilter/nf_sockopt.c:144 [inline]\n  compat_nf_setsockopt+0x9b/0x140 net/netfilter/nf_sockopt.c:156\n  compat_ip_setsockopt+0xff/0x140 net/ipv4/ip_sockglue.c:1279\n  inet_csk_compat_setsockopt+0x97/0x120 net/ipv4/inet_connection_sock.c:1041\n  compat_tcp_setsockopt+0x49/0x80 net/ipv4/tcp.c:2901\n  compat_sock_common_setsockopt+0xb4/0x150 net/core/sock.c:3050\n  __compat_sys_setsockopt+0x1ab/0x7c0 net/compat.c:403\n  __do_compat_sys_setsockopt net/compat.c:416 [inline]\n  __se_compat_sys_setsockopt net/compat.c:413 [inline]\n  __ia32_compat_sys_setsockopt+0xbd/0x150 net/compat.c:413\n  do_syscall_32_irqs_on arch/x86/entry/common.c:323 [inline]\n  do_fast_syscall_32+0x345/0xf9b arch/x86/entry/common.c:394\n  entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139\nRIP: 0023:0xf7fb3cb9\nRSP: 002b:00000000fff0c26c EFLAGS: 00000282 ORIG_RAX: 000000000000016e\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000\nRDX: 0000000000000080 RSI: 0000000020000300 RDI: 00000000000005f4\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n\nThe buggy address belongs to the page:\npage:ffffea0006c2afc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0\nflags: 0x2fffc0000000000()\nraw: 02fffc0000000000 0000000000000000 0000000000000000 00000000ffffffff\nraw: 0000000000000000 ffffea0006c20101 0000000000000000 0000000000000000\npage dumped because: kasan: bad access detected\n\nFix the issue replacing the unsafe function with strscpy() and\ntaking care of possible errors.\n\nFixes: 81e675c227ec (\"netfilter: ebtables: add CONFIG_COMPAT support\")\nReported-and-tested-by: syzbot+4e42a04e0bc33cb6c087@syzkaller.appspotmail.com\nSigned-off-by: Paolo Abeni <pabeni@redhat.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/94c752f99954797da583a84c4907ff19e92550a4"},{"sha":"97a0549b15a0b466c47f6a0143a490a082c64b4e","author":{"name":"Taehee Yoo","email":"6de65b15142147918004ed846c7e65326f9b9238@gmail.com"},"message":"netfilter: nft_meta: fix wrong value dereference in nft_meta_set_eval\n\nIn the nft_meta_set_eval, nftrace value is dereferenced as u32 from sreg.\nBut correct type is u8. so that sometimes incorrect value is dereferenced.\n\nSteps to reproduce:\n\n   %nft add table ip filter\n   %nft add chain ip filter input { type filter hook input priority 4\\; }\n   %nft add rule ip filter input nftrace set 0\n   %nft monitor\n\nSometimes, we can see trace messages.\n\n   trace id 16767227 ip filter input packet: iif \"enp2s0\"\n   ether saddr xx:xx:xx:xx:xx:xx ether daddr xx:xx:xx:xx:xx:xx\n   ip saddr 192.168.0.1 ip daddr 255.255.255.255 ip dscp cs0\n   ip ecn not-ect ip\n   trace id 16767227 ip filter input rule nftrace set 0 (verdict continue)\n   trace id 16767227 ip filter input verdict continue\n   trace id 16767227 ip filter input\n\nSigned-off-by: Taehee Yoo <ap420073@gmail.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/97a0549b15a0b466c47f6a0143a490a082c64b4e"},{"sha":"3e0f64b7dd3149f75e8652ff1df56cffeedc8fc1","author":{"name":"Pablo Neira Ayuso","email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org"},"message":"netfilter: nft_limit: fix packet ratelimiting\n\nCredit calculations for the packet ratelimiting are not correct, as per\nthe applied ratelimit of 25/second and burst 8, a total of 33 packets\nshould have been accepted.  This is true in iptables(33) but not in\nnftables (~65). For packet ratelimiting, use:\n\n\tdiv_u64(limit->nsecs, limit->rate) * limit->burst;\n\nto calculate credit, just like in iptables' xt_limit does.\n\nMoreover, use default burst in iptables, users are expecting similar\nbehaviour.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/3e0f64b7dd3149f75e8652ff1df56cffeedc8fc1"},{"sha":"52f96757905bbf0edef47f3ee6c7c784e7f8ff8a","author":{"name":"Julian Anastasov","email":"84572ef2253ef81e2d8cd8c65849f4d9a3881f47@ssi.bg"},"message":"ipvs: fix buffer overflow with sync daemon and service\n\nsyzkaller reports for buffer overflow for interface name\nwhen starting sync daemons [1]\n\nWhat we do is that we copy user structure into larger stack\nbuffer but later we search NUL past the stack buffer.\nThe same happens for sched_name when adding/editing virtual server.\n\nWe are restricted by IP_VS_SCHEDNAME_MAXLEN and IP_VS_IFNAME_MAXLEN\nbeing used as size in include/uapi/linux/ip_vs.h, so they\ninclude the space for NUL.\n\nAs using strlcpy is wrong for unsafe source, replace it with\nstrscpy and add checks to return EINVAL if source string is not\nNUL-terminated. The incomplete strlcpy fix comes from 2.6.13.\n\nFor the netlink interface reduce the len parameter for\nIPVS_DAEMON_ATTR_MCAST_IFN and IPVS_SVC_ATTR_SCHED_NAME,\nso that we get proper EINVAL.\n\n[1]\nkernel BUG at lib/string.c:1052!\ninvalid opcode: 0000 [#1] SMP KASAN\nDumping ftrace buffer:\n    (ftrace buffer empty)\nModules linked in:\nCPU: 1 PID: 373 Comm: syz-executor936 Not tainted 4.17.0-rc4+ #45\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS\nGoogle 01/01/2011\nRIP: 0010:fortify_panic+0x13/0x20 lib/string.c:1051\nRSP: 0018:ffff8801c976f800 EFLAGS: 00010282\nRAX: 0000000000000022 RBX: 0000000000000040 RCX: 0000000000000000\nRDX: 0000000000000022 RSI: ffffffff8160f6f1 RDI: ffffed00392edef6\nRBP: ffff8801c976f800 R08: ffff8801cf4c62c0 R09: ffffed003b5e4fb0\nR10: ffffed003b5e4fb0 R11: ffff8801daf27d87 R12: ffff8801c976fa20\nR13: ffff8801c976fae4 R14: ffff8801c976fae0 R15: 000000000000048b\nFS:  00007fd99f75e700(0000) GS:ffff8801daf00000(0000)\nknlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000200001c0 CR3: 00000001d6843000 CR4: 00000000001406e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n  strlen include/linux/string.h:270 [inline]\n  strlcpy include/linux/string.h:293 [inline]\n  do_ip_vs_set_ctl+0x31c/0x1d00 net/netfilter/ipvs/ip_vs_ctl.c:2388\n  nf_sockopt net/netfilter/nf_sockopt.c:106 [inline]\n  nf_setsockopt+0x7d/0xd0 net/netfilter/nf_sockopt.c:115\n  ip_setsockopt+0xd8/0xf0 net/ipv4/ip_sockglue.c:1253\n  udp_setsockopt+0x62/0xa0 net/ipv4/udp.c:2487\n  ipv6_setsockopt+0x149/0x170 net/ipv6/ipv6_sockglue.c:917\n  tcp_setsockopt+0x93/0xe0 net/ipv4/tcp.c:3057\n  sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:3046\n  __sys_setsockopt+0x1bd/0x390 net/socket.c:1903\n  __do_sys_setsockopt net/socket.c:1914 [inline]\n  __se_sys_setsockopt net/socket.c:1911 [inline]\n  __x64_sys_setsockopt+0xbe/0x150 net/socket.c:1911\n  do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287\n  entry_SYSCALL_64_after_hwframe+0x49/0xbe\nRIP: 0033:0x447369\nRSP: 002b:00007fd99f75dda8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 00000000006e39e4 RCX: 0000000000447369\nRDX: 000000000000048b RSI: 0000000000000000 RDI: 0000000000000003\nRBP: 0000000000000000 R08: 0000000000000018 R09: 0000000000000000\nR10: 00000000200001c0 R11: 0000000000000246 R12: 00000000006e39e0\nR13: 75a1ff93f0896195 R14: 6f745f3168746576 R15: 0000000000000001\nCode: 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b 48 89 df e8 d2 8f 48 fa eb\nde 55 48 89 fe 48 c7 c7 60 65 64 88 48 89 e5 e8 91 dd f3 f9 <0f> 0b 90 90\n90 90 90 90 90 90 90 90 90 55 48 89 e5 41 57 41 56\nRIP: fortify_panic+0x13/0x20 lib/string.c:1051 RSP: ffff8801c976f800\n\nReported-and-tested-by: syzbot+aac887f77319868646df@syzkaller.appspotmail.com\nFixes: e4ff67513096 (\"ipvs: add sync_maxlen parameter for the sync daemon\")\nFixes: 4da62fc70d7c (\"[IPVS]: Fix for overflows\")\nSigned-off-by: Julian Anastasov <ja@ssi.bg>\nAcked-by: Simon Horman <horms+renesas@verge.net.au>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/52f96757905bbf0edef47f3ee6c7c784e7f8ff8a"},{"sha":"4b83a9049a983b20b1ec2757727c5e39f5847ad2","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"netfilter: provide correct argument to nla_strlcpy()\n\nRecent patch forgot to remove nla_data(), upsetting syzkaller a bit.\n\nBUG: KASAN: slab-out-of-bounds in nla_strlcpy+0x13d/0x150 lib/nlattr.c:314\nRead of size 1 at addr ffff8801ad1f4fdd by task syz-executor189/4509\n\nCPU: 1 PID: 4509 Comm: syz-executor189 Not tainted 4.17.0-rc6+ #62\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x1b9/0x294 lib/dump_stack.c:113\n print_address_description+0x6c/0x20b mm/kasan/report.c:256\n kasan_report_error mm/kasan/report.c:354 [inline]\n kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412\n __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430\n nla_strlcpy+0x13d/0x150 lib/nlattr.c:314\n nfnl_acct_new+0x574/0xc50 net/netfilter/nfnetlink_acct.c:118\n nfnetlink_rcv_msg+0xdb5/0xff0 net/netfilter/nfnetlink.c:212\n netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2448\n nfnetlink_rcv+0x1fe/0x1ba0 net/netfilter/nfnetlink.c:513\n netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]\n netlink_unicast+0x58b/0x740 net/netlink/af_netlink.c:1336\n netlink_sendmsg+0x9f0/0xfa0 net/netlink/af_netlink.c:1901\n sock_sendmsg_nosec net/socket.c:629 [inline]\n sock_sendmsg+0xd5/0x120 net/socket.c:639\n sock_write_iter+0x35a/0x5a0 net/socket.c:908\n call_write_iter include/linux/fs.h:1784 [inline]\n new_sync_write fs/read_write.c:474 [inline]\n __vfs_write+0x64d/0x960 fs/read_write.c:487\n vfs_write+0x1f8/0x560 fs/read_write.c:549\n ksys_write+0xf9/0x250 fs/read_write.c:598\n __do_sys_write fs/read_write.c:610 [inline]\n __se_sys_write fs/read_write.c:607 [inline]\n __x64_sys_write+0x73/0xb0 fs/read_write.c:607\n\nFixes: 4e09fc873d92 (\"netfilter: prefer nla_strlcpy for dealing with NLA_STRING attributes\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nAcked-by: Florian Westphal <fw@strlen.de>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/4b83a9049a983b20b1ec2757727c5e39f5847ad2"},{"sha":"bdcc02cf1bb508fc700df7662f55058f651f2621","author":{"name":"Dhinakaran Pandiyan","email":"99280e7ef75c871c1b30dd1fa15a213fc9f48319@intel.com"},"message":"drm/psr: Fix missed entry in PSR setup time table.\n\nEntry corresponding to 220 us setup time was missing. I am not aware of\nany specific bug this fixes, but this could potentially result in enabling\nPSR on a panel with a higher setup time requirement than supported by the\nhardware.\n\nI verified the value is present in eDP spec versions 1.3, 1.4 and 1.4a.\n\nFixes: 6608804b3d7f (\"drm/dp: Add drm_dp_psr_setup_time()\")\nCc: stable@vger.kernel.org\nCc: Ville Syrjälä <ville.syrjala@linux.intel.com>\nCc: Jose Roberto de Souza <jose.souza@intel.com>\nCc: dri-devel@lists.freedesktop.org\nReviewed-by: José Roberto de Souza <jose.souza@intel.com>\nReviewed-by: Tarun Vyas <tarun.vyas@intel.com>\nSigned-off-by: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>\nSigned-off-by: Jani Nikula <jani.nikula@intel.com>\nLink: https://patchwork.freedesktop.org/patch/msgid/20180511195145.3829-3-dhinakaran.pandiyan@intel.com","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/bdcc02cf1bb508fc700df7662f55058f651f2621"},{"sha":"2bc5ff0bdc00d81d719dad74589317a260d583ed","author":{"name":"Tomi Valkeinen","email":"e1ca4dbb8be1acaf20734fecd2da10ed1d46a9bb@ti.com"},"message":"drm/omap: fix NULL deref crash with SDI displays\n\nFix a NULL deref bug introduced in commit 24aac6011f70 (\"drm: omapdrm:\nsdi: Allocate the sdi private data structure dynamically\").\n\nSigned-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>\nLink: https://patchwork.freedesktop.org/patch/msgid/2f803bfc-3ffe-332a-7b9a-d59a39db4630@ti.com\nFixes: 24aac6011f70 (\"drm: omapdrm: sdi: Allocate the sdi private data structure dynamically\")\nReported-by: Tony Lindgren <tony@atomide.com>\nTested-by: Tony Lindgren <tony@atomide.com>\nReviewed-by: Benoit Parrot <bparrot@ti.com>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/2bc5ff0bdc00d81d719dad74589317a260d583ed"},{"sha":"b3fb22733ae61050f8d10a1d6a8af176c5c5db1a","author":{"name":"Ondrej Zary","email":"ba324ca7b1c77fc20bb970d5aff6eea9377918a5@rainbow-software.org"},"message":"drm/i915: Disable LVDS on Radiant P845\n\nRadiant P845 does not have LVDS, only VGA.\n\nCc: stable@vger.kernel.org\nBugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105468\nSigned-off-by: Ondrej Zary <linux@rainbow-software.org>\nSigned-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>\nLink: https://patchwork.freedesktop.org/patch/msgid/20180309222204.4771-1-linux@rainbow-software.org\n(cherry picked from commit 7f7105f99b75aca4f8c2a748ed6b82c7f8be3293)\nSigned-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/b3fb22733ae61050f8d10a1d6a8af176c5c5db1a"},{"sha":"b9eb9c92899a509fe258d38dd6c214b1de69eee0","author":{"name":"Chris Wilson","email":"711c73f64afdce07b7e38039a96d2224209e9a6c@chris-wilson.co.uk"},"message":"drm/i915/lvds: Move acpi lid notification registration to registration phase\n\nDelay registering ourselves with the acpi lid notification mechanism\nuntil we are registering the connectors after initialisation is\ncomplete. This prevents a possibility of trying to handle the lid\nnotification before we are ready with the danger of chasing\nuninitialised function pointers.\n\n BUG: unable to handle kernel NULL pointer dereference at 0000000000000000\n IP:           (null)\n PGD 0 P4D 0\n Oops: 0010 [#1] PREEMPT SMP PTI\n Modules linked in: arc4(+) iwldvm(+) i915(+) mac80211 i2c_algo_bit coretemp mei_wdt iwlwifi drm_kms_helper kvm_intel wmi_bmof iTCO_wdt iTCO_vendor_support kvm snd_hda_codec_conexant snd_hda_codec_generic drm psmouse cfg80211 irqbypass input_leds pcspkr i2c_i801 snd_hda_intel snd_hda_codec thinkpad_acpi snd_hda_core mei_me lpc_ich snd_hwdep e1000e wmi nvram snd_pcm mei snd_timer shpchp ptp pps_core rfkill syscopyarea snd intel_agp sysfillrect intel_gtt soundcore sysimgblt battery led_class fb_sys_fops ac rtc_cmos agpgart evdev mac_hid acpi_cpufreq ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 fscrypto crypto_simd glue_helper cryptd aes_x86_64 xts algif_skcipher af_alg dm_crypt dm_mod sd_mod uas usb_storage serio_raw atkbd libps2 ahci libahci uhci_hcd libata scsi_mod ehci_pci\n  ehci_hcd usbcore usb_common i8042 serio\n CPU: 1 PID: 378 Comm: systemd-logind Not tainted 4.16.8-1-ARCH #1\n Hardware name: LENOVO 7454CTO/7454CTO, BIOS 6DET72WW (3.22 ) 10/25/2012\n RIP: 0010:          (null)\n RSP: 0018:ffffaf4580c33a18 EFLAGS: 00010287\n RAX: 0000000000000000 RBX: ffff947533558000 RCX: 000000000000003e\n RDX: ffffffffc0aa80c0 RSI: ffffaf4580c33a3c RDI: ffff947534e4c000\n RBP: ffff947533558338 R08: ffff947534598930 R09: ffffffffc0a928b1\n R10: ffffd8f181d5fd40 R11: 0000000000000000 R12: ffffffffc0a928b1\n R13: ffff947533558368 R14: ffffffffc0a928a9 R15: ffff947534e4c000\n FS:  00007f3dc4ddb940(0000) GS:ffff947539280000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000000 CR3: 000000006e214000 CR4: 00000000000406e0\n Call Trace:\n  ?  intel_modeset_setup_hw_state+0x385/0xf60 [i915]\n  ? __intel_display_resume+0x1e/0xc0 [i915]\n  ? intel_display_resume+0xcc/0x120 [i915]\n  ? intel_lid_notify+0xbc/0xc0 [i915]\n  ? notifier_call_chain+0x47/0x70\n  ? blocking_notifier_call_chain+0x3e/0x60\n  ? acpi_lid_notify_state+0x8f/0x1d0\n  ? acpi_lid_update_state+0x49/0x70\n  ? acpi_lid_input_open+0x60/0x90\n  ? input_open_device+0x5d/0xa0\n  ? evdev_open+0x1ba/0x1e0 [evdev]\n  ? chrdev_open+0xa3/0x1b0\n  ? cdev_put.part.0+0x20/0x20\n  ? do_dentry_open+0x14c/0x300\n  ? path_openat+0x30c/0x1240\n  ? current_time+0x16/0x60\n  ? do_filp_open+0x93/0x100\n  ? __check_object_size+0xfb/0x180\n  ? do_sys_open+0x186/0x210\n  ? do_syscall_64+0x74/0x190\n  ?  entry_SYSCALL_64_after_hwframe+0x3d/0xa2\n Code:  Bad RIP value.\n RIP:           (null) RSP: ffffaf4580c33a18\n CR2: 0000000000000000\n\nBugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=106559\nFixes: c1c7af608920 (\"drm/i915: force mode set at lid open time\")\nSigned-off-by: Chris Wilson <chris@chris-wilson.co.uk>\nCc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>\nCc: Ville Syrjälä <ville.syrjala@linux.intel.com>\nCc: Daniel Vetter <daniel.vetter@ffwll.ch>\nReviewed-by: Jani Nikula <jani.nikula@intel.com>\nLink: https://patchwork.freedesktop.org/patch/msgid/20180518074840.16194-1-chris@chris-wilson.co.uk\nCc: stable@vger.kernel.org\n(cherry picked from commit e578a570dc7c20475774d1ff993825e3bd7a7011)\nSigned-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/b9eb9c92899a509fe258d38dd6c214b1de69eee0"},{"sha":"540ead8c5a0e2910fc7bf0839982921c8f11b31c","author":{"name":"Chris Wilson","email":"711c73f64afdce07b7e38039a96d2224209e9a6c@chris-wilson.co.uk"},"message":"drm/i915/query: Protect tainted function pointer lookup\n\nSmatch identifies i915_query_ioctl() as being a potential victim of\nSpectre due to its use of a tainted user index into a function pointer\narray. Use array_index_nospec() to defang the user index before using it\nto lookup the function pointer.\n\nFixes: a446ae2c6e65 (\"drm/i915: add query uAPI\")\nSigned-off-by: Chris Wilson <chris@chris-wilson.co.uk>\nCc: Lionel Landwerlin <lionel.g.landwerlin@intel.com>\nCc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>\nCc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>\nReviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>\nLink: https://patchwork.freedesktop.org/patch/msgid/20180521210530.26008-1-chris@chris-wilson.co.uk\n(cherry picked from commit 84b510e22da7926522a257cfe295d3695346a0bd)\nSigned-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/540ead8c5a0e2910fc7bf0839982921c8f11b31c"},{"sha":"ad9d9e85072b668731f356be0a3750a3ba22a607","author":{"name":"Pablo Neira Ayuso","email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org"},"message":"netfilter: nf_tables: disable preemption in nft_update_chain_stats()\n\nThis patch fixes the following splat.\n\n[118709.054937] BUG: using smp_processor_id() in preemptible [00000000] code: test/1571\n[118709.054970] caller is nft_update_chain_stats.isra.4+0x53/0x97 [nf_tables]\n[118709.054980] CPU: 2 PID: 1571 Comm: test Not tainted 4.17.0-rc6+ #335\n[...]\n[118709.054992] Call Trace:\n[118709.055011]  dump_stack+0x5f/0x86\n[118709.055026]  check_preemption_disabled+0xd4/0xe4\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/ad9d9e85072b668731f356be0a3750a3ba22a607"},{"sha":"360cc79d9d299ce297b205508276285ceffc5fa8","author":{"name":"Taehee Yoo","email":"6de65b15142147918004ed846c7e65326f9b9238@gmail.com"},"message":"netfilter: nf_tables: fix NULL-ptr in nf_tables_dump_obj()\n\nThe table field in nft_obj_filter is not an array. In order to check\ntablename, we should check if the pointer is set.\n\nTest commands:\n\n   %nft add table ip filter\n   %nft add counter ip filter ct1\n   %nft reset counters\n\nSplat looks like:\n\n[  306.510504] kasan: CONFIG_KASAN_INLINE enabled\n[  306.516184] kasan: GPF could be caused by NULL-ptr deref or user memory access\n[  306.524775] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI\n[  306.528284] Modules linked in: nft_objref nft_counter nf_tables nfnetlink ip_tables x_tables\n[  306.528284] CPU: 0 PID: 1488 Comm: nft Not tainted 4.17.0-rc4+ #17\n[  306.528284] Hardware name: To be filled by O.E.M. To be filled by O.E.M./Aptio CRB, BIOS 5.6.5 07/08/2015\n[  306.528284] RIP: 0010:nf_tables_dump_obj+0x52c/0xa70 [nf_tables]\n[  306.528284] RSP: 0018:ffff8800b6cb7520 EFLAGS: 00010246\n[  306.528284] RAX: 0000000000000000 RBX: ffff8800b6c49820 RCX: 0000000000000000\n[  306.528284] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffffed0016d96e9a\n[  306.528284] RBP: ffff8800b6cb75c0 R08: ffffed00236fce7c R09: ffffed00236fce7b\n[  306.528284] R10: ffffffff9f6241e8 R11: ffffed00236fce7c R12: ffff880111365108\n[  306.528284] R13: 0000000000000000 R14: ffff8800b6c49860 R15: ffff8800b6c49860\n[  306.528284] FS:  00007f838b007700(0000) GS:ffff88011b600000(0000) knlGS:0000000000000000\n[  306.528284] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  306.528284] CR2: 00007ffeafabcf78 CR3: 00000000b6cbe000 CR4: 00000000001006f0\n[  306.528284] Call Trace:\n[  306.528284]  netlink_dump+0x470/0xa20\n[  306.528284]  __netlink_dump_start+0x5ae/0x690\n[  306.528284]  ? nf_tables_getobj+0x1b3/0x740 [nf_tables]\n[  306.528284]  nf_tables_getobj+0x2f5/0x740 [nf_tables]\n[  306.528284]  ? nft_obj_notify+0x100/0x100 [nf_tables]\n[  306.528284]  ? nf_tables_getobj+0x740/0x740 [nf_tables]\n[  306.528284]  ? nf_tables_dump_flowtable_done+0x70/0x70 [nf_tables]\n[  306.528284]  ? nft_obj_notify+0x100/0x100 [nf_tables]\n[  306.528284]  nfnetlink_rcv_msg+0x8ff/0x932 [nfnetlink]\n[  306.528284]  ? nfnetlink_rcv_msg+0x216/0x932 [nfnetlink]\n[  306.528284]  netlink_rcv_skb+0x1c9/0x2f0\n[  306.528284]  ? nfnetlink_bind+0x1d0/0x1d0 [nfnetlink]\n[  306.528284]  ? debug_check_no_locks_freed+0x270/0x270\n[  306.528284]  ? netlink_ack+0x7a0/0x7a0\n[  306.528284]  ? ns_capable_common+0x6e/0x110\n[ ... ]\n\nFixes: e46abbcc05aa8 (\"netfilter: nf_tables: Allow table names of up to 255 chars\")\nSigned-off-by: Taehee Yoo <ap420073@gmail.com>\nAcked-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/360cc79d9d299ce297b205508276285ceffc5fa8"},{"sha":"bbb8c61f97e3a2dd91b30d3e57b7964a67569d11","author":{"name":"Taehee Yoo","email":"6de65b15142147918004ed846c7e65326f9b9238@gmail.com"},"message":"netfilter: nf_tables: increase nft_counters_enabled in nft_chain_stats_replace()\n\nWhen a chain is updated, a counter can be attached. if so,\nthe nft_counters_enabled should be increased.\n\ntest commands:\n\n   %nft add table ip filter\n   %nft add chain ip filter input { type filter hook input priority 4\\; }\n   %iptables-compat -Z input\n   %nft delete chain ip filter input\n\nwe can see below messages.\n\n[  286.443720] jump label: negative count!\n[  286.448278] WARNING: CPU: 0 PID: 1459 at kernel/jump_label.c:197 __static_key_slow_dec_cpuslocked+0x6f/0xf0\n[  286.449144] Modules linked in: nf_tables nfnetlink ip_tables x_tables\n[  286.449144] CPU: 0 PID: 1459 Comm: nft Tainted: G        W         4.17.0-rc2+ #12\n[  286.449144] RIP: 0010:__static_key_slow_dec_cpuslocked+0x6f/0xf0\n[  286.449144] RSP: 0018:ffff88010e5176f0 EFLAGS: 00010286\n[  286.449144] RAX: 000000000000001b RBX: ffffffffc0179500 RCX: ffffffffb8a82522\n[  286.449144] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88011b7e5eac\n[  286.449144] RBP: 0000000000000000 R08: ffffed00236fce5c R09: ffffed00236fce5b\n[  286.449144] R10: ffffffffc0179503 R11: ffffed00236fce5c R12: 0000000000000000\n[  286.449144] R13: ffff88011a28e448 R14: ffff88011a28e470 R15: dffffc0000000000\n[  286.449144] FS:  00007f0384328700(0000) GS:ffff88011b600000(0000) knlGS:0000000000000000\n[  286.449144] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  286.449144] CR2: 00007f038394bf10 CR3: 0000000104a86000 CR4: 00000000001006f0\n[  286.449144] Call Trace:\n[  286.449144]  static_key_slow_dec+0x6a/0x70\n[  286.449144]  nf_tables_chain_destroy+0x19d/0x210 [nf_tables]\n[  286.449144]  nf_tables_commit+0x1891/0x1c50 [nf_tables]\n[  286.449144]  nfnetlink_rcv+0x1148/0x13d0 [nfnetlink]\n[ ... ]\n\nSigned-off-by: Taehee Yoo <ap420073@gmail.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/bbb8c61f97e3a2dd91b30d3e57b7964a67569d11"},{"sha":"c9ddf73476ff4fffb7a87bd5107a0705bf2cf64b","author":{"name":"Bart Van Assche","email":"28563a2d387a4f8f033bf7abbf80937064dfbe0c@wdc.com"},"message":"scsi: scsi_transport_srp: Fix shost to rport translation\n\nSince an SRP remote port is attached as a child to shost->shost_gendev\nand as the only child, the translation from the shost pointer into an\nrport pointer must happen by looking up the shost child that is an\nrport. This patch fixes the following KASAN complaint:\n\nBUG: KASAN: slab-out-of-bounds in srp_timed_out+0x57/0x110 [scsi_transport_srp]\nRead of size 4 at addr ffff880035d3fcc0 by task kworker/1:0H/19\n\nCPU: 1 PID: 19 Comm: kworker/1:0H Not tainted 4.16.0-rc3-dbg+ #1\nWorkqueue: kblockd blk_mq_timeout_work\nCall Trace:\ndump_stack+0x85/0xc7\nprint_address_description+0x65/0x270\nkasan_report+0x231/0x350\nsrp_timed_out+0x57/0x110 [scsi_transport_srp]\nscsi_times_out+0xc7/0x3f0 [scsi_mod]\nblk_mq_terminate_expired+0xc2/0x140\nbt_iter+0xbc/0xd0\nblk_mq_queue_tag_busy_iter+0x1c7/0x350\nblk_mq_timeout_work+0x325/0x3f0\nprocess_one_work+0x441/0xa50\nworker_thread+0x76/0x6c0\nkthread+0x1b2/0x1d0\nret_from_fork+0x24/0x30\n\nFixes: e68ca75200fe (\"scsi_transport_srp: Reduce failover time\")\nSigned-off-by: Bart Van Assche <bart.vanassche@wdc.com>\nCc: Hannes Reinecke <hare@suse.com>\nCc: Johannes Thumshirn <jthumshirn@suse.de>\nCc: Jason Gunthorpe <jgg@mellanox.com>\nCc: Doug Ledford <dledford@redhat.com>\nCc: Laurence Oberman <loberman@redhat.com>\nCc: stable@vger.kernel.org\nReviewed-by: Johannes Thumshirn <jthumshirn@suse.de>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/c9ddf73476ff4fffb7a87bd5107a0705bf2cf64b"},{"sha":"513acc5b746b8b86eb4f97efe2d874fd3087ff99","author":{"name":"David S. Miller","email":"fe08d3c717adf2ae63592e4c9aec6e3e404d8e3e@davemloft.net"},"message":"Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf\n\nPablo Neira Ayuso says:\n\n====================\nNetfilter/IPVS fixes for net\n\nThe following patchset contains Netfilter/IPVS fixes for your net tree:\n\n1) Null pointer dereference when dumping conntrack helper configuration,\n   from Taehee Yoo.\n\n2) Missing sanitization in ebtables extension name through compat,\n   from Paolo Abeni.\n\n3) Broken fetch of tracing value, from Taehee Yoo.\n\n4) Incorrect arithmetics in packet ratelimiting.\n\n5) Buffer overflow in IPVS sync daemon, from Julian Anastasov.\n\n6) Wrong argument to nla_strlcpy() in nfnetlink_{acct,cthelper},\n   from Eric Dumazet.\n\n7) Fix splat in nft_update_chain_stats().\n\n8) Null pointer dereference from object netlink dump path, from\n   Taehee Yoo.\n\n9) Missing static_branch_inc() when enabling counters in existing\n   chain, from Taehee Yoo.\n====================\n\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/513acc5b746b8b86eb4f97efe2d874fd3087ff99"},{"sha":"bbb40a0b75209734ff9286f3326171638c9f6569","author":{"name":"Mathieu Xhonneux","email":"f091cc1a3739a555220d1cb4be2a8d85ac961174@gmail.com"},"message":"ipv6: sr: fix memory OOB access in seg6_do_srh_encap/inline\n\nseg6_do_srh_encap and seg6_do_srh_inline can possibly do an\nout-of-bounds access when adding the SRH to the packet. This no longer\nhappen when expanding the skb not only by the size of the SRH (+\nouter IPv6 header), but also by skb->mac_len.\n\n[   53.793056] BUG: KASAN: use-after-free in seg6_do_srh_encap+0x284/0x620\n[   53.794564] Write of size 14 at addr ffff88011975ecfa by task ping/674\n\n[   53.796665] CPU: 0 PID: 674 Comm: ping Not tainted 4.17.0-rc3-ARCH+ #90\n[   53.796670] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),\nBIOS 1.11.0-20171110_100015-anatol 04/01/2014\n[   53.796673] Call Trace:\n[   53.796679]  <IRQ>\n[   53.796689]  dump_stack+0x71/0xab\n[   53.796700]  print_address_description+0x6a/0x270\n[   53.796707]  kasan_report+0x258/0x380\n[   53.796715]  ? seg6_do_srh_encap+0x284/0x620\n[   53.796722]  memmove+0x34/0x50\n[   53.796730]  seg6_do_srh_encap+0x284/0x620\n[   53.796741]  ? seg6_do_srh+0x29b/0x360\n[   53.796747]  seg6_do_srh+0x29b/0x360\n[   53.796756]  seg6_input+0x2e/0x2e0\n[   53.796765]  lwtunnel_input+0x93/0xd0\n[   53.796774]  ipv6_rcv+0x690/0x920\n[   53.796783]  ? ip6_input+0x170/0x170\n[   53.796791]  ? eth_gro_receive+0x2d0/0x2d0\n[   53.796800]  ? ip6_input+0x170/0x170\n[   53.796809]  __netif_receive_skb_core+0xcc0/0x13f0\n[   53.796820]  ? netdev_info+0x110/0x110\n[   53.796827]  ? napi_complete_done+0xb6/0x170\n[   53.796834]  ? e1000_clean+0x6da/0xf70\n[   53.796845]  ? process_backlog+0x129/0x2a0\n[   53.796853]  process_backlog+0x129/0x2a0\n[   53.796862]  net_rx_action+0x211/0x5c0\n[   53.796870]  ? napi_complete_done+0x170/0x170\n[   53.796887]  ? run_rebalance_domains+0x11f/0x150\n[   53.796891]  __do_softirq+0x10e/0x39e\n[   53.796894]  do_softirq_own_stack+0x2a/0x40\n[   53.796895]  </IRQ>\n[   53.796898]  do_softirq.part.16+0x54/0x60\n[   53.796900]  __local_bh_enable_ip+0x5b/0x60\n[   53.796903]  ip6_finish_output2+0x416/0x9f0\n[   53.796906]  ? ip6_dst_lookup_flow+0x110/0x110\n[   53.796909]  ? ip6_sk_dst_lookup_flow+0x390/0x390\n[   53.796911]  ? __rcu_read_unlock+0x66/0x80\n[   53.796913]  ? ip6_mtu+0x44/0xf0\n[   53.796916]  ? ip6_output+0xfc/0x220\n[   53.796918]  ip6_output+0xfc/0x220\n[   53.796921]  ? ip6_finish_output+0x2b0/0x2b0\n[   53.796923]  ? memcpy+0x34/0x50\n[   53.796926]  ip6_send_skb+0x43/0xc0\n[   53.796929]  rawv6_sendmsg+0x1216/0x1530\n[   53.796932]  ? __orc_find+0x6b/0xc0\n[   53.796934]  ? rawv6_rcv_skb+0x160/0x160\n[   53.796937]  ? __rcu_read_unlock+0x66/0x80\n[   53.796939]  ? __rcu_read_unlock+0x66/0x80\n[   53.796942]  ? is_bpf_text_address+0x1e/0x30\n[   53.796944]  ? kernel_text_address+0xec/0x100\n[   53.796946]  ? __kernel_text_address+0xe/0x30\n[   53.796948]  ? unwind_get_return_address+0x2f/0x50\n[   53.796950]  ? __save_stack_trace+0x92/0x100\n[   53.796954]  ? save_stack+0x89/0xb0\n[   53.796956]  ? kasan_kmalloc+0xa0/0xd0\n[   53.796958]  ? kmem_cache_alloc+0xd2/0x1f0\n[   53.796961]  ? prepare_creds+0x23/0x160\n[   53.796963]  ? __x64_sys_capset+0x252/0x3e0\n[   53.796966]  ? do_syscall_64+0x69/0x160\n[   53.796968]  ? entry_SYSCALL_64_after_hwframe+0x44/0xa9\n[   53.796971]  ? __alloc_pages_nodemask+0x170/0x380\n[   53.796973]  ? __alloc_pages_slowpath+0x12c0/0x12c0\n[   53.796977]  ? tty_vhangup+0x20/0x20\n[   53.796979]  ? policy_nodemask+0x1a/0x90\n[   53.796982]  ? __mod_node_page_state+0x8d/0xa0\n[   53.796986]  ? __check_object_size+0xe7/0x240\n[   53.796989]  ? __sys_sendto+0x229/0x290\n[   53.796991]  ? rawv6_rcv_skb+0x160/0x160\n[   53.796993]  __sys_sendto+0x229/0x290\n[   53.796996]  ? __ia32_sys_getpeername+0x50/0x50\n[   53.796999]  ? commit_creds+0x2de/0x520\n[   53.797002]  ? security_capset+0x57/0x70\n[   53.797004]  ? __x64_sys_capset+0x29f/0x3e0\n[   53.797007]  ? __x64_sys_rt_sigsuspend+0xe0/0xe0\n[   53.797011]  ? __do_page_fault+0x664/0x770\n[   53.797014]  __x64_sys_sendto+0x74/0x90\n[   53.797017]  do_syscall_64+0x69/0x160\n[   53.797019]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n[   53.797022] RIP: 0033:0x7f43b7a6714a\n[   53.797023] RSP: 002b:00007ffd891bd368 EFLAGS: 00000246 ORIG_RAX:\n000000000000002c\n[   53.797026] RAX: ffffffffffffffda RBX: 00000000006129c0 RCX: 00007f43b7a6714a\n[   53.797028] RDX: 0000000000000040 RSI: 00000000006129c0 RDI: 0000000000000004\n[   53.797029] RBP: 00007ffd891be640 R08: 0000000000610940 R09: 000000000000001c\n[   53.797030] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040\n[   53.797032] R13: 000000000060e6a0 R14: 0000000000008004 R15: 000000000040b661\n\n[   53.797171] Allocated by task 642:\n[   53.797460]  kasan_kmalloc+0xa0/0xd0\n[   53.797463]  kmem_cache_alloc+0xd2/0x1f0\n[   53.797465]  getname_flags+0x40/0x210\n[   53.797467]  user_path_at_empty+0x1d/0x40\n[   53.797469]  do_faccessat+0x12a/0x320\n[   53.797471]  do_syscall_64+0x69/0x160\n[   53.797473]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\n[   53.797607] Freed by task 642:\n[   53.797869]  __kasan_slab_free+0x130/0x180\n[   53.797871]  kmem_cache_free+0xa8/0x230\n[   53.797872]  filename_lookup+0x15b/0x230\n[   53.797874]  do_faccessat+0x12a/0x320\n[   53.797876]  do_syscall_64+0x69/0x160\n[   53.797878]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\n[   53.798014] The buggy address belongs to the object at ffff88011975e600\n                which belongs to the cache names_cache of size 4096\n[   53.799043] The buggy address is located 1786 bytes inside of\n                4096-byte region [ffff88011975e600, ffff88011975f600)\n[   53.800013] The buggy address belongs to the page:\n[   53.800414] page:ffffea000465d600 count:1 mapcount:0\nmapping:0000000000000000 index:0x0 compound_mapcount: 0\n[   53.801259] flags: 0x17fff0000008100(slab|head)\n[   53.801640] raw: 017fff0000008100 0000000000000000 0000000000000000\n0000000100070007\n[   53.803147] raw: dead000000000100 dead000000000200 ffff88011b185a40\n0000000000000000\n[   53.803787] page dumped because: kasan: bad access detected\n\n[   53.804384] Memory state around the buggy address:\n[   53.804788]  ffff88011975eb80: fb fb fb fb fb fb fb fb fb fb fb fb\nfb fb fb fb\n[   53.805384]  ffff88011975ec00: fb fb fb fb fb fb fb fb fb fb fb fb\nfb fb fb fb\n[   53.805979] >ffff88011975ec80: fb fb fb fb fb fb fb fb fb fb fb fb\nfb fb fb fb\n[   53.806577]                                                                 ^\n[   53.807165]  ffff88011975ed00: fb fb fb fb fb fb fb fb fb fb fb fb\nfb fb fb fb\n[   53.807762]  ffff88011975ed80: fb fb fb fb fb fb fb fb fb fb fb fb\nfb fb fb fb\n[   53.808356] ==================================================================\n[   53.808949] Disabling lock debugging due to kernel taint\n\nFixes: 6c8702c60b88 (\"ipv6: sr: add support for SRH encapsulation and injection with lwtunnels\")\nSigned-off-by: David Lebrun <dlebrun@google.com>\nSigned-off-by: Mathieu Xhonneux <m.xhonneux@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/bbb40a0b75209734ff9286f3326171638c9f6569"},{"sha":"312564269535892cc082bc80592150cd1f5e8ec3","author":{"name":"Ard Biesheuvel","email":"66d3c5fdaeea7ff1f996ad04f2c45e08ab38e2f5@linaro.org"},"message":"net: netsec: reduce DMA mask to 40 bits\n\nThe netsec network controller IP can drive 64 address bits for DMA, and\nthe DMA mask is set accordingly in the driver. However, the SynQuacer\nSoC, which is the only silicon incorporating this IP at the moment,\nintegrates this IP in a manner that leaves address bits [63:40]\nunconnected.\n\nUp until now, this has not resulted in any problems, given that the DDR\ncontroller doesn't decode those bits to begin with. However, recent\nfirmware updates for platforms incorporating this SoC allow the IOMMU\nto be enabled, which does decode address bits [47:40], and allocates\ntop down from the IOVA space, producing DMA addresses that have bits\nset that have been left unconnected.\n\nBoth the DT and ACPI (IORT) descriptions of the platform take this into\naccount, and only describe a DMA address space of 40 bits (using either\ndma-ranges DT properties, or DMA address limits in IORT named component\nnodes). However, even though our IOMMU and bus layers may take such\nlimitations into account by setting a narrower DMA mask when creating\nthe platform device, the netsec probe() entrypoint follows the common\npractice of setting the DMA mask uncondionally, according to the\ncapabilities of the IP block itself rather than to its integration into\nthe chip.\n\nIt is currently unclear what the correct fix is here. We could hack around\nit by only setting the DMA mask if it deviates from its default value of\nDMA_BIT_MASK(32). However, this makes it impossible for the bus layer to\nuse DMA_BIT_MASK(32) as the bus limit, and so it appears that a more\ncomprehensive approach is required to take DMA limits imposed by the\nSoC as a whole into account.\n\nIn the mean time, let's limit the DMA mask to 40 bits. Given that there\nis currently only one SoC that incorporates this IP, this is a reasonable\napproach that can be backported to -stable and buys us some time to come\nup with a proper fix going forward.\n\nFixes: 533dd11a12f6 (\"net: socionext: Add Synquacer NetSec driver\")\nCc: Robin Murphy <robin.murphy@arm.com>\nCc: Jassi Brar <jaswinder.singh@linaro.org>\nCc: Masahisa Kojima <masahisa.kojima@linaro.org>\nCc: Ilias Apalodimas <ilias.apalodimas@linaro.org>\nSigned-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nReviewed-by: Robin Murphy <robin.murphy@arm.com>\nAcked-by: Jassi Brar <jaswinder.singh@linaro.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/312564269535892cc082bc80592150cd1f5e8ec3"},{"sha":"52a192362932f333a7ebafd581c4d9b81da2fec8","author":{"name":"Stanislaw Gruszka","email":"1542dc81552e668e197a396f69e655c1621c300d@redhat.com"},"message":"Revert \"rt2800: use TXOP_BACKOFF for probe frames\"\n\nThis reverts commit fb47ada8dc3c30c8e7b415da155742b49536c61e.\n\nIn some situations when we set TXOP_BACKOFF, the probe frame is\nnot sent at all. What it worse then sending probe frame as part\nof AMPDU and can degrade 11n performance to 11g rates.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Stanislaw Gruszka <sgruszka@redhat.com>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/52a192362932f333a7ebafd581c4d9b81da2fec8"}]}
{"actor":{"display_login":"Jackeagle"}}