{"push_id":2338107759,"size":46,"distinct_size":46,"ref":"refs/heads/oreo","head":"d1c6837e0c796377faa21262c3de08333b3cadf8","before":"d5ad3233efd44d6e2ec38a2a0b6edbf6ffffe589","commits":[{"sha":"8cec497214a1512cda737f87cbdd491260acefa4","author":{"name":"Jason Wang","email":"74f299602f66bf37e22877b931fc5996e932eb30@redhat.com"},"message":"vhost_net: stop device during reset owner\n\n\n[ Upstream commit 4cd879515d686849eec5f718aeac62a70b067d82 ]\n\nWe don't stop device before reset owner, this means we could try to\nserve any virtqueue kick before reset dev->worker. This will result a\nwarn since the work was pending at llist during owner resetting. Fix\nthis by stopping device during owner reset.\n\nReported-by: syzbot+eb17c6162478cc50632c@syzkaller.appspotmail.com\nFixes: 3a4d5c94e9593 (\"vhost_net: a kernel-level virtio server\")\nSigned-off-by: Jason Wang <jasowang@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/8cec497214a1512cda737f87cbdd491260acefa4"},{"sha":"6598ee1deb37afa19a18d5dc31c6ad235df4fcd4","author":{"name":"Nikolay Aleksandrov","email":"64c6133501914790fe0371388ffd86301bcc142b@cumulusnetworks.com"},"message":"ip6mr: fix stale iterator\n\n\n[ Upstream commit 4adfa79fc254efb7b0eb3cd58f62c2c3f805f1ba ]\n\nWhen we dump the ip6mr mfc entries via proc, we initialize an iterator\nwith the table to dump but we don't clear the cache pointer which might\nbe initialized from a prior read on the same descriptor that ended. This\ncan result in lock imbalance (an unnecessary unlock) leading to other\ncrashes and hangs. Clear the cache pointer like ipmr does to fix the issue.\nThanks for the reliable reproducer.\n\nHere's syzbot's trace:\n WARNING: bad unlock balance detected!\n 4.15.0-rc3+ #128 Not tainted\n syzkaller971460/3195 is trying to release lock (mrt_lock) at:\n [<000000006898068d>] ipmr_mfc_seq_stop+0xe1/0x130 net/ipv6/ip6mr.c:553\n but there are no more locks to release!\n\n other info that might help us debug this:\n 1 lock held by syzkaller971460/3195:\n  #0:  (&p->lock){+.+.}, at: [<00000000744a6565>] seq_read+0xd5/0x13d0\n fs/seq_file.c:165\n\n stack backtrace:\n CPU: 1 PID: 3195 Comm: syzkaller971460 Not tainted 4.15.0-rc3+ #128\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS\n Google 01/01/2011\n Call Trace:\n  __dump_stack lib/dump_stack.c:17 [inline]\n  dump_stack+0x194/0x257 lib/dump_stack.c:53\n  print_unlock_imbalance_bug+0x12f/0x140 kernel/locking/lockdep.c:3561\n  __lock_release kernel/locking/lockdep.c:3775 [inline]\n  lock_release+0x5f9/0xda0 kernel/locking/lockdep.c:4023\n  __raw_read_unlock include/linux/rwlock_api_smp.h:225 [inline]\n  _raw_read_unlock+0x1a/0x30 kernel/locking/spinlock.c:255\n  ipmr_mfc_seq_stop+0xe1/0x130 net/ipv6/ip6mr.c:553\n  traverse+0x3bc/0xa00 fs/seq_file.c:135\n  seq_read+0x96a/0x13d0 fs/seq_file.c:189\n  proc_reg_read+0xef/0x170 fs/proc/inode.c:217\n  do_loop_readv_writev fs/read_write.c:673 [inline]\n  do_iter_read+0x3db/0x5b0 fs/read_write.c:897\n  compat_readv+0x1bf/0x270 fs/read_write.c:1140\n  do_compat_preadv64+0xdc/0x100 fs/read_write.c:1189\n  C_SYSC_preadv fs/read_write.c:1209 [inline]\n  compat_SyS_preadv+0x3b/0x50 fs/read_write.c:1203\n  do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline]\n  do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389\n  entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:125\n RIP: 0023:0xf7f73c79\n RSP: 002b:00000000e574a15c EFLAGS: 00000292 ORIG_RAX: 000000000000014d\n RAX: ffffffffffffffda RBX: 000000000000000f RCX: 0000000020a3afb0\n RDX: 0000000000000001 RSI: 0000000000000067 RDI: 0000000000000000\n RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\n R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n BUG: sleeping function called from invalid context at lib/usercopy.c:25\n in_atomic(): 1, irqs_disabled(): 0, pid: 3195, name: syzkaller971460\n INFO: lockdep is turned off.\n CPU: 1 PID: 3195 Comm: syzkaller971460 Not tainted 4.15.0-rc3+ #128\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS\n Google 01/01/2011\n Call Trace:\n  __dump_stack lib/dump_stack.c:17 [inline]\n  dump_stack+0x194/0x257 lib/dump_stack.c:53\n  ___might_sleep+0x2b2/0x470 kernel/sched/core.c:6060\n  __might_sleep+0x95/0x190 kernel/sched/core.c:6013\n  __might_fault+0xab/0x1d0 mm/memory.c:4525\n  _copy_to_user+0x2c/0xc0 lib/usercopy.c:25\n  copy_to_user include/linux/uaccess.h:155 [inline]\n  seq_read+0xcb4/0x13d0 fs/seq_file.c:279\n  proc_reg_read+0xef/0x170 fs/proc/inode.c:217\n  do_loop_readv_writev fs/read_write.c:673 [inline]\n  do_iter_read+0x3db/0x5b0 fs/read_write.c:897\n  compat_readv+0x1bf/0x270 fs/read_write.c:1140\n  do_compat_preadv64+0xdc/0x100 fs/read_write.c:1189\n  C_SYSC_preadv fs/read_write.c:1209 [inline]\n  compat_SyS_preadv+0x3b/0x50 fs/read_write.c:1203\n  do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline]\n  do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389\n  entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:125\n RIP: 0023:0xf7f73c79\n RSP: 002b:00000000e574a15c EFLAGS: 00000292 ORIG_RAX: 000000000000014d\n RAX: ffffffffffffffda RBX: 000000000000000f RCX: 0000000020a3afb0\n RDX: 0000000000000001 RSI: 0000000000000067 RDI: 0000000000000000\n RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\n R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n WARNING: CPU: 1 PID: 3195 at lib/usercopy.c:26 _copy_to_user+0xb5/0xc0\n lib/usercopy.c:26\n\nReported-by: syzbot <bot+eceb3204562c41a438fa1f2335e0fe4f6886d669@syzkaller.appspotmail.com>\nSigned-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/6598ee1deb37afa19a18d5dc31c6ad235df4fcd4"},{"sha":"ec1e18fda7c663dac7a2bb7b695981489aa3ff87","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"net: igmp: add a missing rcu locking section\n\n\n[ Upstream commit e7aadb27a5415e8125834b84a74477bfbee4eff5 ]\n\nNewly added igmpv3_get_srcaddr() needs to be called under rcu lock.\n\nTimer callbacks do not ensure this locking.\n\n=============================\nWARNING: suspicious RCU usage\n4.15.0+ #200 Not tainted\n-----------------------------\n./include/linux/inetdevice.h:216 suspicious rcu_dereference_check() usage!\n\nother info that might help us debug this:\n\nrcu_scheduler_active = 2, debug_locks = 1\n3 locks held by syzkaller616973/4074:\n #0:  (&mm->mmap_sem){++++}, at: [<00000000bfce669e>] __do_page_fault+0x32d/0xc90 arch/x86/mm/fault.c:1355\n #1:  ((&im->timer)){+.-.}, at: [<00000000619d2f71>] lockdep_copy_map include/linux/lockdep.h:178 [inline]\n #1:  ((&im->timer)){+.-.}, at: [<00000000619d2f71>] call_timer_fn+0x1c6/0x820 kernel/time/timer.c:1316\n #2:  (&(&im->lock)->rlock){+.-.}, at: [<000000005f833c5c>] spin_lock_bh include/linux/spinlock.h:315 [inline]\n #2:  (&(&im->lock)->rlock){+.-.}, at: [<000000005f833c5c>] igmpv3_send_report+0x98/0x5b0 net/ipv4/igmp.c:600\n\nstack backtrace:\nCPU: 0 PID: 4074 Comm: syzkaller616973 Not tainted 4.15.0+ #200\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n <IRQ>\n __dump_stack lib/dump_stack.c:17 [inline]\n dump_stack+0x194/0x257 lib/dump_stack.c:53\n lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4592\n __in_dev_get_rcu include/linux/inetdevice.h:216 [inline]\n igmpv3_get_srcaddr net/ipv4/igmp.c:329 [inline]\n igmpv3_newpack+0xeef/0x12e0 net/ipv4/igmp.c:389\n add_grhead.isra.27+0x235/0x300 net/ipv4/igmp.c:432\n add_grec+0xbd3/0x1170 net/ipv4/igmp.c:565\n igmpv3_send_report+0xd5/0x5b0 net/ipv4/igmp.c:605\n igmp_send_report+0xc43/0x1050 net/ipv4/igmp.c:722\n igmp_timer_expire+0x322/0x5c0 net/ipv4/igmp.c:831\n call_timer_fn+0x228/0x820 kernel/time/timer.c:1326\n expire_timers kernel/time/timer.c:1363 [inline]\n __run_timers+0x7ee/0xb70 kernel/time/timer.c:1666\n run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692\n __do_softirq+0x2d7/0xb85 kernel/softirq.c:285\n invoke_softirq kernel/softirq.c:365 [inline]\n irq_exit+0x1cc/0x200 kernel/softirq.c:405\n exiting_irq arch/x86/include/asm/apic.h:541 [inline]\n smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052\n apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:938\n\nFixes: a46182b00290 (\"net: igmp: Use correct source address on IGMPv3 reports\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\n\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/ec1e18fda7c663dac7a2bb7b695981489aa3ff87"},{"sha":"cafbcd523a70712ed3215f5a549d8938d00c3b7e","author":{"name":"Junxiao Bi","email":"0fbee7a611321671a74f8b0002ae086f6befb26d@oracle.com"},"message":"qlcnic: fix deadlock bug\n\n\n[ Upstream commit 233ac3891607f501f08879134d623b303838f478 ]\n\nThe following soft lockup was caught. This is a deadlock caused by\nrecusive locking.\n\nProcess kworker/u40:1:28016 was holding spin lock \"mbx->queue_lock\" in\nqlcnic_83xx_mailbox_worker(), while a softirq came in and ask the same spin\nlock in qlcnic_83xx_enqueue_mbx_cmd(). This lock should be hold by disable\nbh..\n\n[161846.962125] NMI watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [kworker/u40:1:28016]\n[161846.962367] Modules linked in: tun ocfs2 xen_netback xen_blkback xen_gntalloc xen_gntdev xen_evtchn xenfs xen_privcmd autofs4 ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs bnx2fc fcoe libfcoe libfc sunrpc 8021q mrp garp bridge stp llc bonding dm_round_robin dm_multipath iTCO_wdt iTCO_vendor_support pcspkr sb_edac edac_core i2c_i801 shpchp lpc_ich mfd_core ioatdma ipmi_devintf ipmi_si ipmi_msghandler sg ext4 jbd2 mbcache2 sr_mod cdrom sd_mod igb i2c_algo_bit i2c_core ahci libahci megaraid_sas ixgbe dca ptp pps_core vxlan udp_tunnel ip6_udp_tunnel qla2xxx scsi_transport_fc qlcnic crc32c_intel be2iscsi bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi ipv6 cxgb3 mdio libiscsi_tcp qla4xxx iscsi_boot_sysfs libiscsi scsi_transport_iscsi dm_mirror dm_region_hash dm_log dm_mod\n[161846.962454]\n[161846.962460] CPU: 1 PID: 28016 Comm: kworker/u40:1 Not tainted 4.1.12-94.5.9.el6uek.x86_64 #2\n[161846.962463] Hardware name: Oracle Corporation SUN SERVER X4-2L      /ASSY,MB,X4-2L         , BIOS 26050100 09/19/2017\n[161846.962489] Workqueue: qlcnic_mailbox qlcnic_83xx_mailbox_worker [qlcnic]\n[161846.962493] task: ffff8801f2e34600 ti: ffff88004ca5c000 task.ti: ffff88004ca5c000\n[161846.962496] RIP: e030:[<ffffffff810013aa>]  [<ffffffff810013aa>] xen_hypercall_sched_op+0xa/0x20\n[161846.962506] RSP: e02b:ffff880202e43388  EFLAGS: 00000206\n[161846.962509] RAX: 0000000000000000 RBX: ffff8801f6996b70 RCX: ffffffff810013aa\n[161846.962511] RDX: ffff880202e433cc RSI: ffff880202e433b0 RDI: 0000000000000003\n[161846.962513] RBP: ffff880202e433d0 R08: 0000000000000000 R09: ffff8801fe893200\n[161846.962516] R10: ffff8801fe400538 R11: 0000000000000206 R12: ffff880202e4b000\n[161846.962518] R13: 0000000000000050 R14: 0000000000000001 R15: 000000000000020d\n[161846.962528] FS:  0000000000000000(0000) GS:ffff880202e40000(0000) knlGS:ffff880202e40000\n[161846.962531] CS:  e033 DS: 0000 ES: 0000 CR0: 0000000080050033\n[161846.962533] CR2: 0000000002612640 CR3: 00000001bb796000 CR4: 0000000000042660\n[161846.962536] Stack:\n[161846.962538]  ffff880202e43608 0000000000000000 ffffffff813f0442 ffff880202e433b0\n[161846.962543]  0000000000000000 ffff880202e433cc ffffffff00000001 0000000000000000\n[161846.962547]  00000009813f03d6 ffff880202e433e0 ffffffff813f0460 ffff880202e43440\n[161846.962552] Call Trace:\n[161846.962555]  <IRQ>\n[161846.962565]  [<ffffffff813f0442>] ? xen_poll_irq_timeout+0x42/0x50\n[161846.962570]  [<ffffffff813f0460>] xen_poll_irq+0x10/0x20\n[161846.962578]  [<ffffffff81014222>] xen_lock_spinning+0xe2/0x110\n[161846.962583]  [<ffffffff81013f01>] __raw_callee_save_xen_lock_spinning+0x11/0x20\n[161846.962592]  [<ffffffff816e5c57>] ? _raw_spin_lock+0x57/0x80\n[161846.962609]  [<ffffffffa028acfc>] qlcnic_83xx_enqueue_mbx_cmd+0x7c/0xe0 [qlcnic]\n[161846.962623]  [<ffffffffa028e008>] qlcnic_83xx_issue_cmd+0x58/0x210 [qlcnic]\n[161846.962636]  [<ffffffffa028caf2>] qlcnic_83xx_sre_macaddr_change+0x162/0x1d0 [qlcnic]\n[161846.962649]  [<ffffffffa028cb8b>] qlcnic_83xx_change_l2_filter+0x2b/0x30 [qlcnic]\n[161846.962657]  [<ffffffff8160248b>] ? __skb_flow_dissect+0x18b/0x650\n[161846.962670]  [<ffffffffa02856e5>] qlcnic_send_filter+0x205/0x250 [qlcnic]\n[161846.962682]  [<ffffffffa0285c77>] qlcnic_xmit_frame+0x547/0x7b0 [qlcnic]\n[161846.962691]  [<ffffffff8160ac22>] xmit_one+0x82/0x1a0\n[161846.962696]  [<ffffffff8160ad90>] dev_hard_start_xmit+0x50/0xa0\n[161846.962701]  [<ffffffff81630112>] sch_direct_xmit+0x112/0x220\n[161846.962706]  [<ffffffff8160b80f>] __dev_queue_xmit+0x1df/0x5e0\n[161846.962710]  [<ffffffff8160bc33>] dev_queue_xmit_sk+0x13/0x20\n[161846.962721]  [<ffffffffa0575bd5>] bond_dev_queue_xmit+0x35/0x80 [bonding]\n[161846.962729]  [<ffffffffa05769fb>] __bond_start_xmit+0x1cb/0x210 [bonding]\n[161846.962736]  [<ffffffffa0576a71>] bond_start_xmit+0x31/0x60 [bonding]\n[161846.962740]  [<ffffffff8160ac22>] xmit_one+0x82/0x1a0\n[161846.962745]  [<ffffffff8160ad90>] dev_hard_start_xmit+0x50/0xa0\n[161846.962749]  [<ffffffff8160bb1e>] __dev_queue_xmit+0x4ee/0x5e0\n[161846.962754]  [<ffffffff8160bc33>] dev_queue_xmit_sk+0x13/0x20\n[161846.962760]  [<ffffffffa05cfa72>] vlan_dev_hard_start_xmit+0xb2/0x150 [8021q]\n[161846.962764]  [<ffffffff8160ac22>] xmit_one+0x82/0x1a0\n[161846.962769]  [<ffffffff8160ad90>] dev_hard_start_xmit+0x50/0xa0\n[161846.962773]  [<ffffffff8160bb1e>] __dev_queue_xmit+0x4ee/0x5e0\n[161846.962777]  [<ffffffff8160bc33>] dev_queue_xmit_sk+0x13/0x20\n[161846.962789]  [<ffffffffa05adf74>] br_dev_queue_push_xmit+0x54/0xa0 [bridge]\n[161846.962797]  [<ffffffffa05ae4ff>] br_forward_finish+0x2f/0x90 [bridge]\n[161846.962807]  [<ffffffff810b0dad>] ? ttwu_do_wakeup+0x1d/0x100\n[161846.962811]  [<ffffffff815f929b>] ? __alloc_skb+0x8b/0x1f0\n[161846.962818]  [<ffffffffa05ae04d>] __br_forward+0x8d/0x120 [bridge]\n[161846.962822]  [<ffffffff815f613b>] ? __kmalloc_reserve+0x3b/0xa0\n[161846.962829]  [<ffffffff810be55e>] ? update_rq_runnable_avg+0xee/0x230\n[161846.962836]  [<ffffffffa05ae176>] br_forward+0x96/0xb0 [bridge]\n[161846.962845]  [<ffffffffa05af85e>] br_handle_frame_finish+0x1ae/0x420 [bridge]\n[161846.962853]  [<ffffffffa05afc4f>] br_handle_frame+0x17f/0x260 [bridge]\n[161846.962862]  [<ffffffffa05afad0>] ? br_handle_frame_finish+0x420/0x420 [bridge]\n[161846.962867]  [<ffffffff8160d057>] __netif_receive_skb_core+0x1f7/0x870\n[161846.962872]  [<ffffffff8160d6f2>] __netif_receive_skb+0x22/0x70\n[161846.962877]  [<ffffffff8160d913>] netif_receive_skb_internal+0x23/0x90\n[161846.962884]  [<ffffffffa07512ea>] ? xenvif_idx_release+0xea/0x100 [xen_netback]\n[161846.962889]  [<ffffffff816e5a10>] ? _raw_spin_unlock_irqrestore+0x20/0x50\n[161846.962893]  [<ffffffff8160e624>] netif_receive_skb_sk+0x24/0x90\n[161846.962899]  [<ffffffffa075269a>] xenvif_tx_submit+0x2ca/0x3f0 [xen_netback]\n[161846.962906]  [<ffffffffa0753f0c>] xenvif_tx_action+0x9c/0xd0 [xen_netback]\n[161846.962915]  [<ffffffffa07567f5>] xenvif_poll+0x35/0x70 [xen_netback]\n[161846.962920]  [<ffffffff8160e01b>] napi_poll+0xcb/0x1e0\n[161846.962925]  [<ffffffff8160e1c0>] net_rx_action+0x90/0x1c0\n[161846.962931]  [<ffffffff8108aaba>] __do_softirq+0x10a/0x350\n[161846.962938]  [<ffffffff8108ae75>] irq_exit+0x125/0x130\n[161846.962943]  [<ffffffff813f03a9>] xen_evtchn_do_upcall+0x39/0x50\n[161846.962950]  [<ffffffff816e7ffe>] xen_do_hypervisor_callback+0x1e/0x40\n[161846.962952]  <EOI>\n[161846.962959]  [<ffffffff816e5c4a>] ? _raw_spin_lock+0x4a/0x80\n[161846.962964]  [<ffffffff816e5b1e>] ? _raw_spin_lock_irqsave+0x1e/0xa0\n[161846.962978]  [<ffffffffa028e279>] ? qlcnic_83xx_mailbox_worker+0xb9/0x2a0 [qlcnic]\n[161846.962991]  [<ffffffff810a14e1>] ? process_one_work+0x151/0x4b0\n[161846.962995]  [<ffffffff8100c3f2>] ? check_events+0x12/0x20\n[161846.963001]  [<ffffffff810a1960>] ? worker_thread+0x120/0x480\n[161846.963005]  [<ffffffff816e187b>] ? __schedule+0x30b/0x890\n[161846.963010]  [<ffffffff810a1840>] ? process_one_work+0x4b0/0x4b0\n[161846.963015]  [<ffffffff810a1840>] ? process_one_work+0x4b0/0x4b0\n[161846.963021]  [<ffffffff810a6b3e>] ? kthread+0xce/0xf0\n[161846.963025]  [<ffffffff810a6a70>] ? kthread_freezable_should_stop+0x70/0x70\n[161846.963031]  [<ffffffff816e6522>] ? ret_from_fork+0x42/0x70\n[161846.963035]  [<ffffffff810a6a70>] ? kthread_freezable_should_stop+0x70/0x70\n[161846.963037] Code: cc 51 41 53 b8 1c 00 00 00 0f 05 41 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 51 41 53 b8 1d 00 00 00 0f 05 <41> 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc\n\nSigned-off-by: Junxiao Bi <junxiao.bi@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/cafbcd523a70712ed3215f5a549d8938d00c3b7e"},{"sha":"0d8e72014eca79abcf9424be37023dae97141093","author":{"name":"Chunhao Lin","email":"a6fdec0ff56b2022f60393e7b8dbe0ba7ade7e02@realtek.com"},"message":"r8169: fix RTL8168EP take too long to complete driver initialization.\n\n\n[ Upstream commit 086ca23d03c0d2f4088f472386778d293e15c5f6 ]\n\nDriver check the wrong register bit in rtl_ocp_tx_cond() that keep driver\nwaiting until timeout.\n\nFix this by waiting for the right register bit.\n\nSigned-off-by: Chunhao Lin <hau@realtek.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/0d8e72014eca79abcf9424be37023dae97141093"},{"sha":"e25c5a37fcde7688ddfd5454328cde2ddf70fb57","author":{"name":"Li RongQing","email":"2237470b0bc593ba0082e1950f7d1ef11354a9d9@baidu.com"},"message":"tcp: release sk_frag.page in tcp_disconnect\n\n\n[ Upstream commit 9b42d55a66d388e4dd5550107df051a9637564fc ]\n\nsocket can be disconnected and gets transformed back to a listening\nsocket, if sk_frag.page is not released, which will be cloned into\na new socket by sk_clone_lock, but the reference count of this page\nis increased, lead to a use after free or double free issue\n\nSigned-off-by: Li RongQing <lirongqing@baidu.com>\nCc: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/e25c5a37fcde7688ddfd5454328cde2ddf70fb57"},{"sha":"60a86dc311258a3f10451884654397446ef931ad","author":{"name":"Javier Martinez Canillas","email":"1d3ac390512a520a08ec01718b53d06370fd33e5@collabora.co.uk"},"message":"ARM: exynos_defconfig: Enable options to mount a rootfs via NFS\n\ncommit 19f79ccf6d77409cd138bce8db206cdac7fd5ea7 upstream.\n\nThis patch enables the options to mount a rootfs over NFS and also\nsupport for automatic configuration of IP addresses during boot as\nneeded by NFS.\n\nSigned-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>\nSigned-off-by: Kukjin Kim <kgene@kernel.org>\nSigned-off-by: Guillaume Tucker <guillaume.tucker@collabora.com>\nReviewed-by: Krzysztof Kozlowski <krzk@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/60a86dc311258a3f10451884654397446ef931ad"},{"sha":"1b50c4e9e71a89a3b573eaee82669d50578ca74e","author":{"name":"Krzysztof Kozlowski","email":"fa33ff94ee78b0cc87406a1c5d4cb96cbd5b6ef8@samsung.com"},"message":"ARM: exynos_defconfig: Enable NFSv4 client\n\ncommit 1c1fb9b0c89a2506e556114c813a606bc1508d49 upstream.\n\nNFS client is already enabled (NFS_FS) and by default it enables clients\nfor version 2 and 3. Enable explicitly the version 4 client to utilize\nthe newer protocol.\n\nThe NFS client is especially useful for testing kernel in automated\nenvironments (network boot with network file system).\n\nSigned-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>\nReviewed-by: Javier Martinez Canillas <javier@osg.samsung.com>\nSigned-off-by: Guillaume Tucker <guillaume.tucker@collabora.com>\nReviewed-by: Krzysztof Kozlowski <krzk@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/1b50c4e9e71a89a3b573eaee82669d50578ca74e"},{"sha":"99a223bcec506dbd8de7aa3c16995b71d3ca7bb6","author":{"name":"Eric Biggers","email":"0106d512ed1cb672be29d4b167a07ead51709fba@google.com"},"message":"KEYS: encrypted: fix buffer overread in valid_master_desc()\n\ncommit 794b4bc292f5d31739d89c0202c54e7dc9bc3add upstream.\n\nWith the 'encrypted' key type it was possible for userspace to provide a\ndata blob ending with a master key description shorter than expected,\ne.g. 'keyctl add encrypted desc \"new x\" @s'.  When validating such a\nmaster key description, validate_master_desc() could read beyond the end\nof the buffer.  Fix this by using strncmp() instead of memcmp().  [Also\nclean up the code to deduplicate some logic.]\n\nCc: Mimi Zohar <zohar@linux.vnet.ibm.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: James Morris <james.l.morris@oracle.com>\nSigned-off-by: Jin Qian <jinqian@google.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/99a223bcec506dbd8de7aa3c16995b71d3ca7bb6"},{"sha":"796ab952d504dc938bbc331fa648a21ae96f6817","author":{"name":"Wang Han","email":"596bfc3ed940c62affa5c445c9b779aec34efcb5@gmail.com"},"message":"ipv4: Map neigh lookup keys in __ipv4_neigh_lookup_noref()\n\nCommit 6c16fa957e84 is an incorrect backport as we map the keys in\nstruct __ipv4_neigh_lookup(), but the correct place to add the\ncode is struct __ipv4_neigh_lookup_noref(), compared to upstream.\n\nFix it by moving the code, or fewer cases will be covered as\n__ipv4_neigh_lookup_noref() will be called unconditionally from\n__ipv4_neigh_lookup(), and it can be called from other places\nsuch as ip_output.c.\n\nFixes: 6c16fa957e84 (ipv4: Make neigh lookup keys for loopback/point-to-point devices be INADDR_ANY)\nSigned-off-by: Wang Han <wanghan1995315@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/796ab952d504dc938bbc331fa648a21ae96f6817"},{"sha":"23dd6b8717fb32fd68be8ab6cd76743e298e4100","author":{"name":"Matthew Wilcox","email":"b68326deb85f860adfc3ac32411fb6008f48b1b9@microsoft.com"},"message":"cifs: Fix missing put_xid in cifs_file_strict_mmap\n\ncommit f04a703c3d613845ae3141bfaf223489de8ab3eb upstream.\n\nIf cifs_zap_mapping() returned an error, we would return without putting\nthe xid that we got earlier.  Restructure cifs_file_strict_mmap() and\ncifs_file_mmap() to be more similar to each other and have a single\npoint of return that always puts the xid.\n\nSigned-off-by: Matthew Wilcox <mawilcox@microsoft.com>\nSigned-off-by: Steve French <smfrench@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/23dd6b8717fb32fd68be8ab6cd76743e298e4100"},{"sha":"833692a735399fc52942efc1ba3e46fd6d026f72","author":{"name":"Daniel N Pettersson","email":"ae29ab92925b3d53538dd30a5c329c26373aae63@axis.com"},"message":"cifs: Fix autonegotiate security settings mismatch\n\ncommit 9aca7e454415f7878b28524e76bebe1170911a88 upstream.\n\nAutonegotiation gives a security settings mismatch error if the SMB\nserver selects an SMBv3 dialect that isn't SMB3.02. The exact error is\n\"protocol revalidation - security settings mismatch\".\nThis can be tested using Samba v4.2 or by setting the global Samba\nsetting max protocol = SMB3_00.\n\nThe check that fails in smb3_validate_negotiate is the dialect\nverification of the negotiate info response. This is because it tries\nto verify against the protocol_id in the global smbdefault_values. The\nprotocol_id in smbdefault_values is SMB3.02.\nIn SMB2_negotiate the protocol_id in smbdefault_values isn't updated,\nit is global so it probably shouldn't be, but server->dialect is.\n\nThis patch changes the check in smb3_validate_negotiate to use\nserver->dialect instead of server->vals->protocol_id. The patch works\nwith autonegotiate and when using a specific version in the vers mount\noption.\n\nSigned-off-by: Daniel N Pettersson <danielnp@axis.com>\nSigned-off-by: Steve French <smfrench@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/833692a735399fc52942efc1ba3e46fd6d026f72"},{"sha":"9fdfac74246eeab058283035f393fc2a1bf44b78","author":{"name":"Aurelien Aptel","email":"cd571d2c99d35af3081f2c53207440bdad2eaa35@suse.com"},"message":"CIFS: zero sensitive data when freeing\n\ncommit 97f4b7276b829a8927ac903a119bef2f963ccc58 upstream.\n\nalso replaces memset()+kfree() by kzfree().\n\nSigned-off-by: Aurelien Aptel <aaptel@suse.com>\nSigned-off-by: Steve French <smfrench@gmail.com>\nReviewed-by: Pavel Shilovsky <pshilov@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/9fdfac74246eeab058283035f393fc2a1bf44b78"},{"sha":"28ef9653c18539f8123dd668ad3b28289ec0514a","author":{"name":"Thomas Gleixner","email":"352b5f5ba0189d2583768a9bb8247f98115b9038@linutronix.de"},"message":"posix-timer: Properly check sigevent->sigev_notify\n\ncommit cef31d9af908243421258f1df35a4a644604efbe upstream.\n\ntimer_create() specifies via sigevent->sigev_notify the signal delivery for\nthe new timer. The valid modes are SIGEV_NONE, SIGEV_SIGNAL, SIGEV_THREAD\nand (SIGEV_SIGNAL | SIGEV_THREAD_ID).\n\nThe sanity check in good_sigevent() is only checking the valid combination\nfor the SIGEV_THREAD_ID bit, i.e. SIGEV_SIGNAL, but if SIGEV_THREAD_ID is\nnot set it accepts any random value.\n\nThis has no real effects on the posix timer and signal delivery code, but\nit affects show_timer() which handles the output of /proc/$PID/timers. That\nfunction uses a string array to pretty print sigev_notify. The access to\nthat array has no bound checks, so random sigev_notify cause access beyond\nthe array bounds.\n\nAdd proper checks for the valid notify modes and remove the SIGEV_THREAD_ID\nmasking from various code pathes as SIGEV_NONE can never be set in\ncombination with SIGEV_THREAD_ID.\n\nReported-by: Eric Biggers <ebiggers3@gmail.com>\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nReported-by: Alexey Dobriyan <adobriyan@gmail.com>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: John Stultz <john.stultz@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/28ef9653c18539f8123dd668ad3b28289ec0514a"},{"sha":"385e124b45fe46960de2fd280fc5a99d3e7706dc","author":{"name":"Shuah Khan","email":"1a8b7edcfc00bb8cbbb1f50ab3153da93b81fdf3@osg.samsung.com"},"message":"usbip: fix stub_rx: get_pipe() to validate endpoint number\n\ncommit 635f545a7e8be7596b9b2b6a43cab6bbd5a88e43 upstream.\n\nget_pipe() routine doesn't validate the input endpoint number\nand uses to reference ep_in and ep_out arrays. Invalid endpoint\nnumber can trigger BUG(). Range check the epnum and returning\nerror instead of calling BUG().\n\nChange caller stub_recv_cmd_submit() to handle the get_pipe()\nerror return.\n\nReported-by: Secunia Research <vuln@secunia.com>\nSigned-off-by: Shuah Khan <shuahkh@osg.samsung.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/385e124b45fe46960de2fd280fc5a99d3e7706dc"},{"sha":"eebf31529012289ec20fea84e4e6fd188176be13","author":{"name":"Shuah Khan","email":"1a8b7edcfc00bb8cbbb1f50ab3153da93b81fdf3@osg.samsung.com"},"message":"usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input\n\ncommit c6688ef9f29762e65bce325ef4acd6c675806366 upstream.\n\nHarden CMD_SUBMIT path to handle malicious input that could trigger\nlarge memory allocations. Add checks to validate transfer_buffer_length\nand number_of_packets to protect against bad input requesting for\nunbounded memory allocations. Validate early in get_pipe() and return\nfailure.\n\nReported-by: Secunia Research <vuln@secunia.com>\nSigned-off-by: Shuah Khan <shuahkh@osg.samsung.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/eebf31529012289ec20fea84e4e6fd188176be13"},{"sha":"67ad0235bacc1af72dad6eac6c5ac1a072b905f7","author":{"name":"Shuah Khan","email":"1a8b7edcfc00bb8cbbb1f50ab3153da93b81fdf3@osg.samsung.com"},"message":"usbip: prevent vhci_hcd driver from leaking a socket pointer address\n\ncommit 2f2d0088eb93db5c649d2a5e34a3800a8a935fc5 upstream.\n\nWhen a client has a USB device attached over IP, the vhci_hcd driver is\nlocally leaking a socket pointer address via the\n\n/sys/devices/platform/vhci_hcd/status file (world-readable) and in debug\noutput when \"usbip --debug port\" is run.\n\nFix it to not leak. The socket pointer address is not used at the moment\nand it was made visible as a convenient way to find IP address from socket\npointer address by looking up /proc/net/{tcp,tcp6}.\n\nAs this opens a security hole, the fix replaces socket pointer address with\nsockfd.\n\nReported-by: Secunia Research <vuln@secunia.com>\nSigned-off-by: Shuah Khan <shuahkh@osg.samsung.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/67ad0235bacc1af72dad6eac6c5ac1a072b905f7"},{"sha":"4b490123f4996ccd4461cb82bcb69dd8a0364d5f","author":{"name":"Jonathan Dieter","email":"87adf5bf660404714130c2c97cef51f5434532f0@lesbg.com"},"message":"usbip: Fix potential format overflow in userspace tools\n\ncommit e5dfa3f902b9a642ae8c6997d57d7c41e384a90b upstream.\n\nThe usbip userspace tools call sprintf()/snprintf() and don't check for\nthe return value which can lead the paths to overflow, truncating the\nfinal file in the path.\n\nMore urgently, GCC 7 now warns that these aren't checked with\n-Wformat-overflow, and with -Werror enabled in configure.ac, that makes\nthese tools unbuildable.\n\nThis patch fixes these problems by replacing sprintf() with snprintf() in\none place and adding checks for the return value of snprintf().\n\nReviewed-by: Peter Senna Tschudin <peter.senna@gmail.com>\nSigned-off-by: Jonathan Dieter <jdieter@lesbg.com>\nAcked-by: Shuah Khan <shuahkh@osg.samsung.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/4b490123f4996ccd4461cb82bcb69dd8a0364d5f"},{"sha":"9ea2031f4d16771c47c97c99fb47c71f346a6dbe","author":{"name":"Andrew Goodbody","email":"72f744eb844bdd6abc5bbeabf607e2f0617fed0b@cambrionix.com"},"message":"usb: usbip: Fix possible deadlocks reported by lockdep\n\ncommit 21619792d1eca7e772ca190ba68588e57f29595b upstream.\n\nChange spin_lock calls to spin_lock_irqsave to prevent\nattmpted recursive lock taking in interrupt context.\n\nThis patch fixes Bug 109351\n  https://bugzilla.kernel.org/show_bug.cgi?id=109351\n\nSigned-off-by: Andrew Goodbody <andrew.goodbody@cambrionix.com>\nSigned-off-by: Shuah Khan <shuahkh@osg.samsung.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/9ea2031f4d16771c47c97c99fb47c71f346a6dbe"},{"sha":"a7db857299d6e98abf6fa0b6986b83abb7f1d4cb","author":{"name":"Yuyang Du","email":"f0e867e219192637be21cf77427aef9f9a34cd12@intel.com"},"message":"usbip: vhci-hcd: Add USB3 SuperSpeed support\n\ncommit 1c9de5bf428612458427943b724bea51abde520a upstream.\n\nThis patch adds a USB3 HCD to an existing USB2 HCD and provides\nthe support of SuperSpeed, in case the device can only be enumerated\nwith SuperSpeed.\n\nThe bulk of the added code in usb3_bos_desc and hub_control to support\nSuperSpeed is borrowed from the commit 1cd8fd2887e162ad (\"usb: gadget:\ndummy_hcd: add SuperSpeed support\").\n\nWith this patch, each vhci will have VHCI_HC_PORTS HighSpeed ports\nand VHCI_HC_PORTS SuperSpeed ports.\n\nSuggested-by: Krzysztof Opasiak <k.opasiak@samsung.com>\nSigned-off-by: Yuyang Du <yuyang.du@intel.com>\nAcked-by: Shuah Khan <shuahkh@osg.samsung.com>\nSigned-off-by: Shuah Khan <shuahkh@osg.samsung.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RiteshSaxena/android_kernel_xiaomi_msm8937/commits/a7db857299d6e98abf6fa0b6986b83abb7f1d4cb"}]}
{"actor":{"display_login":"RiteshSaxena"}}