{"push_id":2360213334,"size":146,"distinct_size":146,"ref":"refs/heads/korg/stable/linux-4.9.y","head":"19c04ca5b239e6e2277a5b381d1e79482ab9bbc5","before":"80c1c8322c331586a86e58d3f95026a1265ab396","commits":[{"sha":"bd3ccdc6f922c6b7db4b7075d1b6596ddb986a98","author":{"name":"Jason Wang","email":"74f299602f66bf37e22877b931fc5996e932eb30@redhat.com"},"message":"vhost: use mutex_lock_nested() in vhost_dev_lock_vqs()\n\ncommit e9cb4239134c860e5f92c75bf5321bd377bb505b upstream.\n\nWe used to call mutex_lock() in vhost_dev_lock_vqs() which tries to\nhold mutexes of all virtqueues. This may confuse lockdep to report a\npossible deadlock because of trying to hold locks belong to same\nclass. Switch to use mutex_lock_nested() to avoid false positive.\n\nFixes: 6b1e6cc7855b0 (\"vhost: new device IOTLB API\")\nReported-by: syzbot+dbb7c1161485e61b0241@syzkaller.appspotmail.com\nSigned-off-by: Jason Wang <jasowang@redhat.com>\nAcked-by: Michael S. Tsirkin <mst@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/bd3ccdc6f922c6b7db4b7075d1b6596ddb986a98"},{"sha":"085cbbda4b4cc7dd2ba63806346881c2c2e10107","author":{"name":"Tom Herbert","email":"55bc7b18e460d0d077310393ffbc002e6fe4eaec@quantonium.net"},"message":"kcm: Check if sk_user_data already set in kcm_attach\n\ncommit e5571240236c5652f3e079b1d5866716a7ad819c upstream.\n\nThis is needed to prevent sk_user_data being overwritten.\nThe check is done under the callback lock. This should prevent\na socket from being attached twice to a KCM mux. It also prevents\na socket from being attached for other use cases of sk_user_data\nas long as the other cases set sk_user_data under the lock.\nFollowup work is needed to unify all the use cases of sk_user_data\nto use the same locking.\n\nReported-by: syzbot+114b15f2be420a8886c3@syzkaller.appspotmail.com\nFixes: ab7ac4eb9832 (\"kcm: Kernel Connection Multiplexor module\")\nSigned-off-by: Tom Herbert <tom@quantonium.net>\nReviewed-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/085cbbda4b4cc7dd2ba63806346881c2c2e10107"},{"sha":"2bb174afca6cdb90499bcd2c46e5d966d9976834","author":{"name":"Tom Herbert","email":"55bc7b18e460d0d077310393ffbc002e6fe4eaec@quantonium.net"},"message":"kcm: Only allow TCP sockets to be attached to a KCM mux\n\ncommit 581e7226a5d43f629eb6399a121f85f6a15f81be upstream.\n\nTCP sockets for IPv4 and IPv6 that are not listeners or in closed\nstated are allowed to be attached to a KCM mux.\n\nFixes: ab7ac4eb9832 (\"kcm: Kernel Connection Multiplexor module\")\nReported-by: syzbot+8865eaff7f9acd593945@syzkaller.appspotmail.com\nSigned-off-by: Tom Herbert <tom@quantonium.net>\nReviewed-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/2bb174afca6cdb90499bcd2c46e5d966d9976834"},{"sha":"758980347e174abf068ea9c8f20b6a891cffa683","author":{"name":"Johannes Berg","email":"9a5936d824e6835dfe162c5611d10d2cf40ffbad@intel.com"},"message":"cfg80211: check dev_set_name() return value\n\ncommit 59b179b48ce2a6076448a44531242ac2b3f6cef2 upstream.\n\nsyzbot reported a warning from rfkill_alloc(), and after a while\nI think that the reason is that it was doing fault injection and\nthe dev_set_name() failed, leaving the name NULL, and we didn't\ncheck the return value and got to rfkill_alloc() with a NULL name.\nSince we really don't want a NULL name, we ought to check the\nreturn value.\n\nFixes: fb28ad35906a (\"net: struct device - replace bus_id with dev_name(), dev_set_name()\")\nReported-by: syzbot+1ddfb3357e1d7bb5b5d3@syzkaller.appspotmail.com\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/758980347e174abf068ea9c8f20b6a891cffa683"},{"sha":"5d89917c5a0fbe2f5fe04bb15c6bcd0b1ebf4d24","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"xfrm: skip policies marked as dead while rehashing\n\ncommit 862591bf4f519d1b8d859af720fafeaebdd0162a upstream.\n\nsyzkaller triggered following KASAN splat:\n\nBUG: KASAN: slab-out-of-bounds in xfrm_hash_rebuild+0xdbe/0xf00 net/xfrm/xfrm_policy.c:618\nread of size 2 at addr ffff8801c8e92fe4 by task kworker/1:1/23 [..]\nWorkqueue: events xfrm_hash_rebuild [..]\n __asan_report_load2_noabort+0x14/0x20 mm/kasan/report.c:428\n xfrm_hash_rebuild+0xdbe/0xf00 net/xfrm/xfrm_policy.c:618\n process_one_work+0xbbf/0x1b10 kernel/workqueue.c:2112\n worker_thread+0x223/0x1990 kernel/workqueue.c:2246 [..]\n\nThe reproducer triggers:\n1016                 if (error) {\n1017                         list_move_tail(&walk->walk.all, &x->all);\n1018                         goto out;\n1019                 }\n\nin xfrm_policy_walk() via pfkey (it sets tiny rcv space, dump\ncallback returns -ENOBUFS).\n\nIn this case, *walk is located the pfkey socket struct, so this socket\nbecomes visible in the global policy list.\n\nIt looks like this is intentional -- phony walker has walk.dead set to 1\nand all other places skip such \"policies\".\n\nCcing original authors of the two commits that seem to expose this\nissue (first patch missed ->dead check, second patch adds pfkey\nsockets to policies dumper list).\n\nFixes: 880a6fab8f6ba5b (\"xfrm: configure policy hash table thresholds by netlink\")\nFixes: 12a169e7d8f4b1c (\"ipsec: Put dumpers on the dump list\")\nCc: Herbert Xu <herbert@gondor.apana.org.au>\nCc: Timo Teras <timo.teras@iki.fi>\nCc: Christophe Gouault <christophe.gouault@6wind.com>\nReported-by: syzbot <bot+c028095236fcb6f4348811565b75084c754dc729@syzkaller.appspotmail.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/5d89917c5a0fbe2f5fe04bb15c6bcd0b1ebf4d24"},{"sha":"274ee93f0b12ce1865579ea2bbb783642c72c31f","author":{"name":"Tetsuo Handa","email":"badf33aa2d274d0572a6b5c85bfcebfa56176677@I-love.SAKURA.ne.jp"},"message":"mm,vmscan: Make unregister_shrinker() no-op if register_shrinker() failed.\n\ncommit bb422a738f6566f7439cd347d54e321e4fe92a9f upstream.\n\nSyzbot caught an oops at unregister_shrinker() because combination of\ncommit 1d3d4437eae1bb29 (\"vmscan: per-node deferred work\") and fault\ninjection made register_shrinker() fail and the caller of\nregister_shrinker() did not check for failure.\n\n----------\n[  554.881422] FAULT_INJECTION: forcing a failure.\n[  554.881422] name failslab, interval 1, probability 0, space 0, times 0\n[  554.881438] CPU: 1 PID: 13231 Comm: syz-executor1 Not tainted 4.14.0-rc8+ #82\n[  554.881443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n[  554.881445] Call Trace:\n[  554.881459]  dump_stack+0x194/0x257\n[  554.881474]  ? arch_local_irq_restore+0x53/0x53\n[  554.881486]  ? find_held_lock+0x35/0x1d0\n[  554.881507]  should_fail+0x8c0/0xa40\n[  554.881522]  ? fault_create_debugfs_attr+0x1f0/0x1f0\n[  554.881537]  ? check_noncircular+0x20/0x20\n[  554.881546]  ? find_next_zero_bit+0x2c/0x40\n[  554.881560]  ? ida_get_new_above+0x421/0x9d0\n[  554.881577]  ? find_held_lock+0x35/0x1d0\n[  554.881594]  ? __lock_is_held+0xb6/0x140\n[  554.881628]  ? check_same_owner+0x320/0x320\n[  554.881634]  ? lock_downgrade+0x990/0x990\n[  554.881649]  ? find_held_lock+0x35/0x1d0\n[  554.881672]  should_failslab+0xec/0x120\n[  554.881684]  __kmalloc+0x63/0x760\n[  554.881692]  ? lock_downgrade+0x990/0x990\n[  554.881712]  ? register_shrinker+0x10e/0x2d0\n[  554.881721]  ? trace_event_raw_event_module_request+0x320/0x320\n[  554.881737]  register_shrinker+0x10e/0x2d0\n[  554.881747]  ? prepare_kswapd_sleep+0x1f0/0x1f0\n[  554.881755]  ? _down_write_nest_lock+0x120/0x120\n[  554.881765]  ? memcpy+0x45/0x50\n[  554.881785]  sget_userns+0xbcd/0xe20\n(...snipped...)\n[  554.898693] kasan: CONFIG_KASAN_INLINE enabled\n[  554.898724] kasan: GPF could be caused by NULL-ptr deref or user memory access\n[  554.898732] general protection fault: 0000 [#1] SMP KASAN\n[  554.898737] Dumping ftrace buffer:\n[  554.898741]    (ftrace buffer empty)\n[  554.898743] Modules linked in:\n[  554.898752] CPU: 1 PID: 13231 Comm: syz-executor1 Not tainted 4.14.0-rc8+ #82\n[  554.898755] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n[  554.898760] task: ffff8801d1dbe5c0 task.stack: ffff8801c9e38000\n[  554.898772] RIP: 0010:__list_del_entry_valid+0x7e/0x150\n[  554.898775] RSP: 0018:ffff8801c9e3f108 EFLAGS: 00010246\n[  554.898780] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\n[  554.898784] RDX: 0000000000000000 RSI: ffff8801c53c6f98 RDI: ffff8801c53c6fa0\n[  554.898788] RBP: ffff8801c9e3f120 R08: 1ffff100393c7d55 R09: 0000000000000004\n[  554.898791] R10: ffff8801c9e3ef70 R11: 0000000000000000 R12: 0000000000000000\n[  554.898795] R13: dffffc0000000000 R14: 1ffff100393c7e45 R15: ffff8801c53c6f98\n[  554.898800] FS:  0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000\n[  554.898804] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033\n[  554.898807] CR2: 00000000dbc23000 CR3: 00000001c7269000 CR4: 00000000001406e0\n[  554.898813] DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000\n[  554.898816] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600\n[  554.898818] Call Trace:\n[  554.898828]  unregister_shrinker+0x79/0x300\n[  554.898837]  ? perf_trace_mm_vmscan_writepage+0x750/0x750\n[  554.898844]  ? down_write+0x87/0x120\n[  554.898851]  ? deactivate_super+0x139/0x1b0\n[  554.898857]  ? down_read+0x150/0x150\n[  554.898864]  ? check_same_owner+0x320/0x320\n[  554.898875]  deactivate_locked_super+0x64/0xd0\n[  554.898883]  deactivate_super+0x141/0x1b0\n----------\n\nSince allowing register_shrinker() callers to call unregister_shrinker()\nwhen register_shrinker() failed can simplify error recovery path, this\npatch makes unregister_shrinker() no-op when register_shrinker() failed.\nAlso, reset shrinker->nr_deferred in case unregister_shrinker() was\nby error called twice.\n\nSigned-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>\nSigned-off-by: Aliaksei Karaliou <akaraliou.dev@gmail.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nCc: Glauber Costa <glauber@scylladb.com>\nCc: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/274ee93f0b12ce1865579ea2bbb783642c72c31f"},{"sha":"46b317167d01130c5cc98ad042b2955c58f14597","author":{"name":"Steffen Klassert","email":"e12a4e53ffae7bea4a26a8251851e5c5b883df46@secunet.com"},"message":"xfrm: Fix stack-out-of-bounds read on socket policy lookup.\n\ncommit ddc47e4404b58f03e98345398fb12d38fe291512 upstream.\n\nWhen we do tunnel or beet mode, we pass saddr and daddr from the\ntemplate to xfrm_state_find(), this is ok. On transport mode,\nwe pass the addresses from the flowi, assuming that the IP\naddresses (and address family) don't change during transformation.\nThis assumption is wrong in the IPv4 mapped IPv6 case, packet\nis IPv4 and template is IPv6.\n\nFix this by catching address family missmatches of the policy\nand the flow already before we do the lookup.\n\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/46b317167d01130c5cc98ad042b2955c58f14597"},{"sha":"85552886b454b27588d4d7a01456ab5e82daaa47","author":{"name":"Cong Wang","email":"3f5d79d28d6d48052800caba9df0b30e06fefe41@gmail.com"},"message":"xfrm: check id proto in validate_tmpl()\n\ncommit 6a53b7593233ab9e4f96873ebacc0f653a55c3e1 upstream.\n\nsyzbot reported a kernel warning in xfrm_state_fini(), which\nindicates that we have entries left in the list\nnet->xfrm.state_all whose proto is zero. And\nxfrm_id_proto_match() doesn't consider them as a match with\nIPSEC_PROTO_ANY in this case.\n\nProto with value 0 is probably not a valid value, at least\nverify_newsa_info() doesn't consider it valid either.\n\nThis patch fixes it by checking the proto value in\nvalidate_tmpl() and rejecting invalid ones, like what iproute2\ndoes in xfrm_xfrmproto_getbyname().\n\nReported-by: syzbot <syzkaller@googlegroups.com>\nCc: Steffen Klassert <steffen.klassert@secunet.com>\nCc: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/85552886b454b27588d4d7a01456ab5e82daaa47"},{"sha":"2e6712234606ce4b155723f71a3c9f52128d9266","author":{"name":"Xin Long","email":"0c651f6709819e543c4ca1708bc1021b57131127@gmail.com"},"message":"sctp: set frag_point in sctp_setsockopt_maxseg correctly\n\ncommit ecca8f88da5c4260cc2bccfefd2a24976704c366 upstream.\n\nNow in sctp_setsockopt_maxseg user_frag or frag_point can be set with\nval >= 8 and val <= SCTP_MAX_CHUNK_LEN. But both checks are incorrect.\n\nval >= 8 means frag_point can even be less than SCTP_DEFAULT_MINSEGMENT.\nThen in sctp_datamsg_from_user(), when it's value is greater than cookie\necho len and trying to bundle with cookie echo chunk, the first_len will\noverflow.\n\nThe worse case is when it's value is equal as cookie echo len, first_len\nbecomes 0, it will go into a dead loop for fragment later on. In Hangbin\nsyzkaller testing env, oom was even triggered due to consecutive memory\nallocation in that loop.\n\nBesides, SCTP_MAX_CHUNK_LEN is the max size of the whole chunk, it should\ndeduct the data header for frag_point or user_frag check.\n\nThis patch does a proper check with SCTP_DEFAULT_MINSEGMENT subtracting\nthe sctphdr and datahdr, SCTP_MAX_CHUNK_LEN subtracting datahdr when\nsetting frag_point via sockopt. It also improves sctp_setsockopt_maxseg\ncodes.\n\nSuggested-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>\nReported-by: Hangbin Liu <liuhangbin@gmail.com>\nSigned-off-by: Xin Long <lucien.xin@gmail.com>\nAcked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/2e6712234606ce4b155723f71a3c9f52128d9266"},{"sha":"7569adcf396a2b17fcc45d4172c0857e60ed32df","author":{"name":"Jens Axboe","email":"f8b120bbe297304053fa957b507156696820d130@kernel.dk"},"message":"blktrace: fix unlocked registration of tracepoints\n\ncommit a6da0024ffc19e0d47712bb5ca4fd083f76b07df upstream.\n\nWe need to ensure that tracepoints are registered and unregistered\nwith the users of them. The existing atomic count isn't enough for\nthat. Add a lock around the tracepoints, so we serialize access\nto them.\n\nThis fixes cases where we have multiple users setting up and\ntearing down tracepoints, like this:\n\nCPU: 0 PID: 2995 Comm: syzkaller857118 Not tainted\n4.14.0-rc5-next-20171018+ #36\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS\nGoogle 01/01/2011\nCall Trace:\n  __dump_stack lib/dump_stack.c:16 [inline]\n  dump_stack+0x194/0x257 lib/dump_stack.c:52\n  panic+0x1e4/0x41c kernel/panic.c:183\n  __warn+0x1c4/0x1e0 kernel/panic.c:546\n  report_bug+0x211/0x2d0 lib/bug.c:183\n  fixup_bug+0x40/0x90 arch/x86/kernel/traps.c:177\n  do_trap_no_signal arch/x86/kernel/traps.c:211 [inline]\n  do_trap+0x260/0x390 arch/x86/kernel/traps.c:260\n  do_error_trap+0x120/0x390 arch/x86/kernel/traps.c:297\n  do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:310\n  invalid_op+0x18/0x20 arch/x86/entry/entry_64.S:905\nRIP: 0010:tracepoint_add_func kernel/tracepoint.c:210 [inline]\nRIP: 0010:tracepoint_probe_register_prio+0x397/0x9a0 kernel/tracepoint.c:283\nRSP: 0018:ffff8801d1d1f6c0 EFLAGS: 00010293\nRAX: ffff8801d22e8540 RBX: 00000000ffffffef RCX: ffffffff81710f07\nRDX: 0000000000000000 RSI: ffffffff85b679c0 RDI: ffff8801d5f19818\nRBP: ffff8801d1d1f7c8 R08: ffffffff81710c10 R09: 0000000000000004\nR10: ffff8801d1d1f6b0 R11: 0000000000000003 R12: ffffffff817597f0\nR13: 0000000000000000 R14: 00000000ffffffff R15: ffff8801d1d1f7a0\n  tracepoint_probe_register+0x2a/0x40 kernel/tracepoint.c:304\n  register_trace_block_rq_insert include/trace/events/block.h:191 [inline]\n  blk_register_tracepoints+0x1e/0x2f0 kernel/trace/blktrace.c:1043\n  do_blk_trace_setup+0xa10/0xcf0 kernel/trace/blktrace.c:542\n  blk_trace_setup+0xbd/0x180 kernel/trace/blktrace.c:564\n  sg_ioctl+0xc71/0x2d90 drivers/scsi/sg.c:1089\n  vfs_ioctl fs/ioctl.c:45 [inline]\n  do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:685\n  SYSC_ioctl fs/ioctl.c:700 [inline]\n  SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691\n  entry_SYSCALL_64_fastpath+0x1f/0xbe\nRIP: 0033:0x444339\nRSP: 002b:00007ffe05bb5b18 EFLAGS: 00000206 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00000000006d66c0 RCX: 0000000000444339\nRDX: 000000002084cf90 RSI: 00000000c0481273 RDI: 0000000000000009\nRBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffffff\nR13: 00000000c0481273 R14: 0000000000000000 R15: 0000000000000000\n\nsince we can now run these in parallel. Ensure that the exported helpers\nfor doing this are grabbing the queue trace mutex.\n\nReported-by: Steven Rostedt <rostedt@goodmis.org>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Jens Axboe <axboe@kernel.dk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/7569adcf396a2b17fcc45d4172c0857e60ed32df"},{"sha":"eeb1f9bd2480eab16f77aeafacec08c82f71a972","author":{"name":"Chris Wilson","email":"4181b934c2715a2bba60cdb3cc1b35b2777d1c23@chris-wilson.co.uk"},"message":"drm: Require __GFP_NOFAIL for the legacy drm_modeset_lock_all\n\ncommit d18d1a5ac811d12f7ebc1129230312b5f2c50cb8 upstream.\n\nTo acquire all modeset locks requires a ww_ctx to be allocated. As this\nis the legacy path and the allocation small, to reduce the changes\nrequired (and complex untested error handling) to the legacy drivers, we\nsimply assume that the allocation succeeds. At present, it relies on the\ntoo-small-to-fail rule, but syzbot found that by injecting a failure\nhere we would hit the WARN. Document that this allocation must succeed\nwith __GFP_NOFAIL.\n\nSigned-off-by: Chris Wilson <chris@chris-wilson.co.uk>\nCc: Daniel Vetter <daniel.vetter@ffwll.ch>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>\nReviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>\nLink: https://patchwork.freedesktop.org/patch/msgid/20171031115535.15166-1-chris@chris-wilson.co.uk\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/eeb1f9bd2480eab16f77aeafacec08c82f71a972"},{"sha":"5fd4db305f2750418151d2d5553bfaec2956167a","author":{"name":"Jason Wang","email":"74f299602f66bf37e22877b931fc5996e932eb30@redhat.com"},"message":"ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE\n\ncommit 6e6e41c3112276288ccaf80c70916779b84bb276 upstream.\n\nTo avoid slab to warn about exceeded size, fail early if queue\noccupies more than KMALLOC_MAX_SIZE.\n\nReported-by: syzbot+e4d4f9ddd4295539735d@syzkaller.appspotmail.com\nFixes: 2e0ab8ca83c12 (\"ptr_ring: array based FIFO for pointers\")\nSigned-off-by: Jason Wang <jasowang@redhat.com>\nAcked-by: Michael S. Tsirkin <mst@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/5fd4db305f2750418151d2d5553bfaec2956167a"},{"sha":"5cab144f072bdae16f37a06efb0dad210c7ff7bb","author":{"name":"David Howells","email":"358fdf7bce8223edb2a0d846104bf62a286894d5@redhat.com"},"message":"Provide a function to create a NUL-terminated string from unterminated data\n\ncommit f35157417215ec138c920320c746fdb3e04ef1d5 upstream.\n\nProvide a function, kmemdup_nul(), that will create a NUL-terminated string\nfrom an unterminated character array where the length is known in advance.\n\nThis is better than kstrndup() in situations where we already know the\nstring length as the strnlen() in kstrndup() is superfluous.\n\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/5cab144f072bdae16f37a06efb0dad210c7ff7bb"},{"sha":"fe1cb580e84865f3c6be99b952a626323228e781","author":{"name":"Paul Moore","email":"54f65660711c038b3360dd7288dc12347ae58ba3@paul-moore.com"},"message":"selinux: ensure the context is NUL terminated in security_context_to_sid_core()\n\ncommit ef28df55ac27e1e5cd122e19fa311d886d47a756 upstream.\n\nThe syzbot/syzkaller automated tests found a problem in\nsecurity_context_to_sid_core() during early boot (before we load the\nSELinux policy) where we could potentially feed context strings without\nNUL terminators into the strcmp() function.\n\nWe already guard against this during normal operation (after the SELinux\npolicy has been loaded) by making a copy of the context strings and\nexplicitly adding a NUL terminator to the end.  The patch extends this\nprotection to the early boot case (no loaded policy) by moving the context\ncopy earlier in security_context_to_sid_core().\n\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: Paul Moore <paul@paul-moore.com>\nReviewed-By: William Roberts <william.c.roberts@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/fe1cb580e84865f3c6be99b952a626323228e781"},{"sha":"5e6f51aac15ac93605187fd11b9bc75a240a53f8","author":{"name":"Paul Moore","email":"54f65660711c038b3360dd7288dc12347ae58ba3@paul-moore.com"},"message":"selinux: skip bounded transition processing if the policy isn't loaded\n\ncommit 4b14752ec4e0d87126e636384cf37c8dd9df157c upstream.\n\nWe can't do anything reasonable in security_bounded_transition() if we\ndon't have a policy loaded, and in fact we could run into problems\nwith some of the code inside expecting a policy.  Fix these problems\nlike we do many others in security/selinux/ss/services.c by checking\nto see if the policy is loaded (ss_initialized) and returning quickly\nif it isn't.\n\nReported-by: syzbot <syzkaller-bugs@googlegroups.com>\nSigned-off-by: Paul Moore <paul@paul-moore.com>\nAcked-by: Stephen Smalley <sds@tycho.nsa.gov>\nReviewed-by: James Morris <james.l.morris@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/5e6f51aac15ac93605187fd11b9bc75a240a53f8"},{"sha":"eda4a83657b8e289560b40bb2dc33ed3b654142f","author":{"name":"Eric Biggers","email":"0106d512ed1cb672be29d4b167a07ead51709fba@google.com"},"message":"crypto: x86/twofish-3way - Fix %rbp usage\n\ncommit d8c7fe9f2a486a6e5f0d5229ca43807af5ab22c6 upstream.\n\nUsing %rbp as a temporary register breaks frame pointer convention and\nbreaks stack traces when unwinding from an interrupt in the crypto code.\n\nIn twofish-3way, we can't simply replace %rbp with another register\nbecause there are none available.  Instead, we use the stack to hold the\nvalues that %rbp, %r11, and %r12 were holding previously.  Each of these\nvalues represents the half of the output from the previous Feistel round\nthat is being passed on unchanged to the following round.  They are only\nused once per round, when they are exchanged with %rax, %rbx, and %rcx.\n\nAs a result, we free up 3 registers (one per block) and can reassign\nthem so that %rbp is not used, and additionally %r14 and %r15 are not\nused so they do not need to be saved/restored.\n\nThere may be a small overhead caused by replacing 'xchg REG, REG' with\nthe needed sequence 'mov MEM, REG; mov REG, MEM; mov REG, REG' once per\nround.  But, counterintuitively, when I tested \"ctr-twofish-3way\" on a\nHaswell processor, the new version was actually about 2% faster.\n(Perhaps 'xchg' is not as well optimized as plain moves.)\n\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nReviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/eda4a83657b8e289560b40bb2dc33ed3b654142f"},{"sha":"458d2fc92405836fc949c6779170dad18a508f0f","author":{"name":"Laura Abbott","email":"1a58644182d4410bcfd1b17f9f7459a41bdc05dd@redhat.com"},"message":"staging: android: ion: Add __GFP_NOWARN for system contig heap\n\ncommit 0c75f10312a35b149b2cebb1832316b35c2337ca upstream.\n\nsyzbot reported a warning from Ion:\n\n  WARNING: CPU: 1 PID: 3485 at mm/page_alloc.c:3926\n\n  ...\n   __alloc_pages_nodemask+0x9fb/0xd80 mm/page_alloc.c:4252\n  alloc_pages_current+0xb6/0x1e0 mm/mempolicy.c:2036\n  alloc_pages include/linux/gfp.h:492 [inline]\n  ion_system_contig_heap_allocate+0x40/0x2c0\n  drivers/staging/android/ion/ion_system_heap.c:374\n  ion_buffer_create drivers/staging/android/ion/ion.c:93 [inline]\n  ion_alloc+0x2c1/0x9e0 drivers/staging/android/ion/ion.c:420\n  ion_ioctl+0x26d/0x380 drivers/staging/android/ion/ion-ioctl.c:84\n  vfs_ioctl fs/ioctl.c:46 [inline]\n  do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686\n  SYSC_ioctl fs/ioctl.c:701 [inline]\n  SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692\n\nThis is a warning about attempting to allocate order > MAX_ORDER. This\nis coming from a userspace Ion allocation request. Since userspace is\nfree to request however much memory it wants (and the kernel is free to\ndeny its allocation), silence the allocation attempt with __GFP_NOWARN\nin case it fails.\n\nReported-by: syzbot+76e7efc4748495855a4d@syzkaller.appspotmail.com\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: Laura Abbott <labbott@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/458d2fc92405836fc949c6779170dad18a508f0f"},{"sha":"3ee287d35b25076b626898284d610465145aa43b","author":{"name":"Laura Abbott","email":"1a58644182d4410bcfd1b17f9f7459a41bdc05dd@redhat.com"},"message":"staging: android: ion: Switch from WARN to pr_warn\n\ncommit e4e179a844f52e907e550f887d0a2171f1508af1 upstream.\n\nSyzbot reported a warning with Ion:\n\nWARNING: CPU: 0 PID: 3502 at drivers/staging/android/ion/ion-ioctl.c:73 ion_ioctl+0x2db/0x380 drivers/staging/android/ion/ion-ioctl.c:73\nKernel panic - not syncing: panic_on_warn set ...\n\nThis is a warning that validation of the ioctl fields failed. This was\ndeliberately added as a warning to make it very obvious to developers that\nsomething needed to be fixed. In reality, this is overkill and disturbs\nfuzzing. Switch to pr_warn for a message instead.\n\nReported-by: syzbot+fa2d5f63ee5904a0115a@syzkaller.appspotmail.com\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: Laura Abbott <labbott@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/3ee287d35b25076b626898284d610465145aa43b"},{"sha":"7abb5e9dd5683d693376635ff05ec729216fd726","author":{"name":"Douglas Gilbert","email":"a5714ada1376582f15d7f2634532b6ba35f8f0e0@interlog.com"},"message":"blk_rq_map_user_iov: fix error override\n\ncommit 69e0927b3774563c19b5fb32e91d75edc147fb62 upstream.\n\nDuring stress tests by syzkaller on the sg driver the block layer\ninfrequently returns EINVAL. Closer inspection shows the block\nlayer was trying to return ENOMEM (which is much more\nunderstandable) but for some reason overroad that useful error.\n\nPatch below does not show this (unchanged) line:\n   ret =__blk_rq_map_user_iov(rq, map_data, &i, gfp_mask, copy);\nThat 'ret' was being overridden when that function failed.\n\nSigned-off-by: Douglas Gilbert <dgilbert@interlog.com>\nSigned-off-by: Jens Axboe <axboe@kernel.dk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/7abb5e9dd5683d693376635ff05ec729216fd726"},{"sha":"9748fd5ba546bb93d403208d2fd40dd5fc557b6b","author":{"name":"Wanpeng Li","email":"db00080a98d9e8b5f6dcf3e2f980859dd811d4ad@hotmail.com"},"message":"KVM: x86: fix escape of guest dr6 to the host\n\ncommit efdab992813fb2ed825745625b83c05032e9cda2 upstream.\n\nsyzkaller reported:\n\n   WARNING: CPU: 0 PID: 12927 at arch/x86/kernel/traps.c:780 do_debug+0x222/0x250\n   CPU: 0 PID: 12927 Comm: syz-executor Tainted: G           OE    4.15.0-rc2+ #16\n   RIP: 0010:do_debug+0x222/0x250\n   Call Trace:\n    <#DB>\n    debug+0x3e/0x70\n   RIP: 0010:copy_user_enhanced_fast_string+0x10/0x20\n    </#DB>\n    _copy_from_user+0x5b/0x90\n    SyS_timer_create+0x33/0x80\n    entry_SYSCALL_64_fastpath+0x23/0x9a\n\nThe testcase sets a watchpoint (with perf_event_open) on a buffer that is\npassed to timer_create() as the struct sigevent argument.  In timer_create(),\ncopy_from_user()'s rep movsb triggers the BP.  The testcase also sets\nthe debug registers for the guest.\n\nHowever, KVM only restores host debug registers when the host has active\nwatchpoints, which triggers a race condition when running the testcase with\nmultiple threads.  The guest's DR6.BS bit can escape to the host before\nanother thread invokes timer_create(), and do_debug() complains.\n\nThe fix is to respect do_debug()'s dr6 invariant when leaving KVM.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nCc: Paolo Bonzini <pbonzini@redhat.com>\nCc: Radim Krčmář <rkrcmar@redhat.com>\nCc: David Hildenbrand <david@redhat.com>\nCc: Dmitry Vyukov <dvyukov@google.com>\nReviewed-by: David Hildenbrand <david@redhat.com>\nSigned-off-by: Wanpeng Li <wanpeng.li@hotmail.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Radim Krčmář <rkrcmar@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-4.4/commits/9748fd5ba546bb93d403208d2fd40dd5fc557b6b"}]}
{"actor":{"display_login":"akhilnarang"}}