{"push_id":2360599455,"size":58,"distinct_size":1,"ref":"refs/heads/caf/aosp-common/android-3.18","head":"892bba413c1cf755922bfdc0105d0c1dc1b8a297","before":"750512064cf3e471a1f467cfeaf0940762737d88","commits":[{"sha":"ebda13935a36c1d85dcacdd6d0dc8cbcdd4ca5f8","author":{"name":"Jack Morgenstein","email":"9199a894d30558f9073fe198ba069ef3e4372dd7@dev.mellanox.co.il"},"message":"IB/mlx4: Fix incorrectly releasing steerable UD QPs when have only ETH ports\n\ncommit 852f6927594d0d3e8632c889b2ab38cbc46476ad upstream.\n\nAllocating steerable UD QPs depends on having at least one IB port,\nwhile releasing those QPs does not.\n\nAs a result, when there are only ETH ports, the IB (RoCE) driver\nrequests releasing a qp range whose base qp is zero, with\nqp count zero.\n\nWhen SR-IOV is enabled, and the VF driver is running on a VM over\na hypervisor which treats such qp release calls as errors\n(rather than NOPs), we see lines in the VM message log like:\n\n mlx4_core 0002:00:02.0: Failed to release qp range base:0 cnt:0\n\nFix this by adding a check for a zero count in mlx4_release_qp_range()\n(which thus treats releasing 0 qps as a nop), and eliminating the\ncheck for device managed flow steering when releasing steerable UD QPs.\n(Freeing ib_uc_qpns_bitmap unconditionally is also OK, since it\nremains NULL when steerable UD QPs are not allocated).\n\nFixes: 4196670be786 (\"IB/mlx4: Don't allocate range of steerable UD QPs for Ethernet-only device\")\nSigned-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>\nSigned-off-by: Leon Romanovsky <leon@kernel.org>\nSigned-off-by: Jason Gunthorpe <jgg@mellanox.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/ebda13935a36c1d85dcacdd6d0dc8cbcdd4ca5f8"},{"sha":"e91e3808f894b017ad7a89be0627a847c01b75c9","author":{"name":"Bjorn Andersson","email":"823e8bbaa174806583fcc7d851531504068ef2fd@linaro.org"},"message":"PM / devfreq: Propagate error from devfreq_add_device()\n\ncommit d1bf2d30728f310f72296b54f0651ecdb09cbb12 upstream.\n\nPropagate the error of devfreq_add_device() in devm_devfreq_add_device()\nrather than statically returning ENOMEM. This makes it slightly faster\nto pinpoint the cause of a returned error.\n\nFixes: 8cd84092d35e (\"PM / devfreq: Add resource-managed function for devfreq device\")\nCc: stable@vger.kernel.org\nAcked-by: Chanwoo Choi <cw00.choi@samsung.com>\nSigned-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>\nSigned-off-by: MyungJoo Ham <myungjoo.ham@samsung.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/e91e3808f894b017ad7a89be0627a847c01b75c9"},{"sha":"ae0dd9e49bd17c6637a4485ff9f827ef200457e5","author":{"name":"Eugene Syromiatnikov","email":"0fd753f6c7c05dd1e23aa7f56ee728a20f423dd8@redhat.com"},"message":"s390: fix handling of -1 in set{,fs}[gu]id16 syscalls\n\ncommit 6dd0d2d22aa363fec075cb2577ba273ac8462e94 upstream.\n\nFor some reason, the implementation of some 16-bit ID system calls\n(namely, setuid16/setgid16 and setfsuid16/setfsgid16) used type cast\ninstead of low2highgid/low2highuid macros for converting [GU]IDs, which\nled to incorrect handling of value of -1 (which ought to be considered\ninvalid).\n\nDiscovered by strace test suite.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Eugene Syromiatnikov <esyr@redhat.com>\nSigned-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/ae0dd9e49bd17c6637a4485ff9f827ef200457e5"},{"sha":"b943222b208149c5233ce97a2f4641cfbca3d82a","author":{"name":"Viresh Kumar","email":"4ca49bc1dcfdfc376d29da1eb07a3e0b3cd46daa@linaro.org"},"message":"arm: spear600: Add missing interrupt-parent of rtc\n\ncommit 6ffb5b4f248fe53e0361b8cbc2a523b432566442 upstream.\n\nThe interrupt-parent of rtc was missing, add it.\n\nFixes: 8113ba917dfa (\"ARM: SPEAr: DT: Update device nodes\")\nCc: stable@vger.kernel.org # v3.8+\nReported-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Viresh Kumar <viresh.kumar@linaro.org>\nSigned-off-by: Olof Johansson <olof@lixom.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/b943222b208149c5233ce97a2f4641cfbca3d82a"},{"sha":"67df924c852c5864c3eec6255605fede2a7d16ed","author":{"name":"Viresh Kumar","email":"4ca49bc1dcfdfc376d29da1eb07a3e0b3cd46daa@linaro.org"},"message":"arm: spear13xx: Fix dmas cells\n\ncommit cdd10409914184c7eee5ae3e11beb890c9c16c61 upstream.\n\nThe \"dmas\" cells for the designware DMA controller need to have only 3\nproperties apart from the phandle: request line, src master and\ndestination master. But the commit 6e8887f60f60 updated it incorrectly\nwhile moving from platform code to DT. Fix it.\n\nCc: stable@vger.kernel.org # v3.10+\nFixes: 6e8887f60f60 (\"ARM: SPEAr13xx: Pass generic DW DMAC platform data from DT\")\nReported-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Viresh Kumar <viresh.kumar@linaro.org>\nSigned-off-by: Olof Johansson <olof@lixom.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/67df924c852c5864c3eec6255605fede2a7d16ed"},{"sha":"055fdc77edff024b7a991a8388f7a24f1b75d5bc","author":{"name":"Viresh Kumar","email":"4ca49bc1dcfdfc376d29da1eb07a3e0b3cd46daa@linaro.org"},"message":"arm: spear13xx: Fix spics gpio controller's warning\n\ncommit f8975cb1b8a36d0839b6365235778dd9df1d04ca upstream.\n\nThis fixes the following warning by also sending the flags argument for\ngpio controllers:\n\nProperty 'cs-gpios', cell 6 is not a phandle reference in\n/ahb/apb/spi@e0100000\n\nFixes: 8113ba917dfa (\"ARM: SPEAr: DT: Update device nodes\")\nCc: stable@vger.kernel.org # v3.8+\nReported-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Viresh Kumar <viresh.kumar@linaro.org>\nSigned-off-by: Olof Johansson <olof@lixom.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/055fdc77edff024b7a991a8388f7a24f1b75d5bc"},{"sha":"8e8992a93d66adb640631a6778a5110f01118202","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: seq: Fix regression by incorrect ioctl_mutex usages\n\nThis is the revised backport of the upstream commit\nb3defb791b26ea0683a93a4f49c77ec45ec96f10\n\nWe had another backport (e.g. 623e5c8ae32b in 4.4.115), but it applies\nthe new mutex also to the code paths that are invoked via faked\nkernel-to-kernel ioctls.  As reported recently, this leads to a\ndeadlock at suspend (or other scenarios triggering the kernel\nsequencer client).\n\nThis patch addresses the issue by taking the mutex only in the code\npaths invoked by user-space, just like the original fix patch does.\n\nReported-and-tested-by: Andres Bertens <abertensu@yahoo.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/8e8992a93d66adb640631a6778a5110f01118202"},{"sha":"45d73fe10e5be3a41c9f375bf0233e46358cd057","author":{"name":"Julia Lawall","email":"5f26763d26f96d414e30b3f33734591afe022543@lip6.fr"},"message":"drm/radeon: adjust tested variable\n\ncommit 3a61b527b4e1f285d21b6e9e623dc45cf8bb391f upstream.\n\nCheck the variable that was most recently initialized.\n\nThe semantic match that finds this problem is as follows:\n(http://coccinelle.lip6.fr/)\n\n// <smpl>\n@@\nexpression x, y, f, g, e, m;\nstatement S1,S2,S3,S4;\n@@\n\nx = f(...);\nif (\\(<+...x...+>\\&e\\)) S1 else S2\n(\nx = g(...);\n|\nm = g(...,&x,...);\n|\ny = g(...);\n*if (e)\n S3 else S4\n)\n// </smpl>\n\nSigned-off-by: Julia Lawall <Julia.Lawall@lip6.fr>\nReviewed-by: Christian König <christian.koenig@amd.com>\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/45d73fe10e5be3a41c9f375bf0233e46358cd057"},{"sha":"5b2336f021d57363a24558686f94e5f6eacad7b0","author":{"name":"Zhouyi Zhou","email":"0191e3fcd850b467fd6fa2f018097a5eaffa46ef@gmail.com"},"message":"ext4: save error to disk in __ext4_grp_locked_error()\n\ncommit 06f29cc81f0350261f59643a505010531130eea0 upstream.\n\nIn the function __ext4_grp_locked_error(), __save_error_info()\nis called to save error info in super block block, but does not sync\nthat information to disk to info the subsequence fsck after reboot.\n\nThis patch writes the error information to disk.  After this patch,\nI think there is no obvious EXT4 error handle branches which leads to\n\"Remounting filesystem read-only\" will leave the disk partition miss\nthe subsequence fsck.\n\nSigned-off-by: Zhouyi Zhou <zhouzhouyi@gmail.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nCc: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/5b2336f021d57363a24558686f94e5f6eacad7b0"},{"sha":"cd3b45b779244aa47442cdf901493c7830180eb1","author":{"name":"Ernesto A. Fernández","email":"70e26ba3376e9b8443f01b223165dc25eed48cec@gmail.com"},"message":"ext4: correct documentation for grpid mount option\n\ncommit 9f0372488cc9243018a812e8cfbf27de650b187b upstream.\n\nThe grpid option is currently described as being the same as nogrpid.\n\nSigned-off-by: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nCc: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/cd3b45b779244aa47442cdf901493c7830180eb1"},{"sha":"aacf60b6ef76ebf6a5276d2e89cf7e0961a0636c","author":{"name":"Johan Hovold","email":"c5aaa0c362db47011b825595d6a432662259e2f1@kernel.org"},"message":"video: fbdev: atmel_lcdfb: fix display-timings lookup\n\ncommit 9cb18db0701f6b74f0c45c23ad767b3ebebe37f6 upstream.\n\nFix child-node lookup during probe, which ended up searching the whole\ndevice tree depth-first starting at the parent rather than just matching\non its children.\n\nTo make things worse, the parent display node was also prematurely\nfreed.\n\nNote that the display and timings node references are never put after a\nsuccessful dt-initialisation so the nodes would leak on later probe\ndeferrals and on driver unbind.\n\nFixes: b985172b328a (\"video: atmel_lcdfb: add device tree suport\")\nCc: stable <stable@vger.kernel.org>     # 3.13\nCc: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>\nCc: Nicolas Ferre <nicolas.ferre@microchip.com>\nCc: Alexandre Belloni <alexandre.belloni@free-electrons.com>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/aacf60b6ef76ebf6a5276d2e89cf7e0961a0636c"},{"sha":"5b7d39a5daf92f56625fdda468d708a7036b9995","author":{"name":"Nicolas Pitre","email":"821418b0a29e813296bdaa58f6aecc4445fd1b69@linaro.org"},"message":"console/dummy: leave .con_font_get set to NULL\n\ncommit 724ba8b30b044aa0d94b1cd374fc15806cdd6f18 upstream.\n\nWhen this method is set, the caller expects struct console_font fields\nto be properly initialized when it returns. Leave it unset otherwise\nnonsensical (leaked kernel stack) values are returned to user space.\n\nSigned-off-by: Nicolas Pitre <nico@linaro.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/5b7d39a5daf92f56625fdda468d708a7036b9995"},{"sha":"8fae1c38b61adeca793920d879862386a0c3255d","author":{"name":"Liu Bo","email":"2320f47fd1b0bdd58584dbc8b4d320b2decf8329@oracle.com"},"message":"Btrfs: fix deadlock in run_delalloc_nocow\n\ncommit e89166990f11c3f21e1649d760dd35f9e410321c upstream.\n\n@cur_offset is not set back to what it should be (@cow_start) if\nbtrfs_next_leaf() returns something wrong, and the range [cow_start,\ncur_offset) remains locked forever.\n\ncc: <stable@vger.kernel.org>\nSigned-off-by: Liu Bo <bo.li.liu@oracle.com>\nReviewed-by: Josef Bacik <jbacik@fb.com>\nSigned-off-by: David Sterba <dsterba@suse.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/8fae1c38b61adeca793920d879862386a0c3255d"},{"sha":"6a4499b0f8f58b72444f80a3c3a4709ba1febea3","author":{"name":"Liu Bo","email":"2320f47fd1b0bdd58584dbc8b4d320b2decf8329@oracle.com"},"message":"Btrfs: fix crash due to not cleaning up tree log block's dirty bits\n\ncommit 1846430c24d66e85cc58286b3319c82cd54debb2 upstream.\n\nIn cases that the whole fs flips into readonly status due to failures in\ncritical sections, then log tree's blocks are still dirty, and this leads\nto a crash during umount time, the crash is about use-after-free,\n\numount\n -> close_ctree\n    -> stop workers\n    -> iput(btree_inode)\n       -> iput_final\n          -> write_inode_now\n\t     -> ...\n\t       -> queue job on stop'd workers\n\ncc: <stable@vger.kernel.org> v3.12+\nFixes: 681ae50917df (\"Btrfs: cleanup reserved space when freeing tree log on error\")\nSigned-off-by: Liu Bo <bo.li.liu@oracle.com>\nReviewed-by: Josef Bacik <jbacik@fb.com>\nSigned-off-by: David Sterba <dsterba@suse.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/6a4499b0f8f58b72444f80a3c3a4709ba1febea3"},{"sha":"66776836486554f2767e04a6e196e9af69f13677","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: seq: Fix racy pool initializations\n\ncommit d15d662e89fc667b90cd294b0eb45694e33144da upstream.\n\nALSA sequencer core initializes the event pool on demand by invoking\nsnd_seq_pool_init() when the first write happens and the pool is\nempty.  Meanwhile user can reset the pool size manually via ioctl\nconcurrently, and this may lead to UAF or out-of-bound accesses since\nthe function tries to vmalloc / vfree the buffer.\n\nA simple fix is to just wrap the snd_seq_pool_init() call with the\nrecently introduced client->ioctl_mutex; as the calls for\nsnd_seq_pool_init() from other side are always protected with this\nmutex, we can avoid the race.\n\nReported-by: 范龙飞 <long7573@126.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/66776836486554f2767e04a6e196e9af69f13677"},{"sha":"d61961121a46934b0c4a57747f2e774f3eef4ceb","author":{"name":"Arnd Bergmann","email":"72a0f6d3b182607e6d5c44b93e1abb7b23ee18f3@arndb.de"},"message":"ARM: dts: s5pv210: add interrupt-parent for ohci\n\ncommit 5c1037196b9ee75897c211972de370ed1336ec8f upstream.\n\nThe ohci-hcd node has an interrupt number but no interrupt-parent,\nleading to a warning with current dtc versions:\n\narch/arm/boot/dts/s5pv210-aquila.dtb: Warning (interrupts_property): Missing interrupt-parent for /soc/ohci@ec300000\narch/arm/boot/dts/s5pv210-goni.dtb: Warning (interrupts_property): Missing interrupt-parent for /soc/ohci@ec300000\narch/arm/boot/dts/s5pv210-smdkc110.dtb: Warning (interrupts_property): Missing interrupt-parent for /soc/ohci@ec300000\narch/arm/boot/dts/s5pv210-smdkv210.dtb: Warning (interrupts_property): Missing interrupt-parent for /soc/ohci@ec300000\narch/arm/boot/dts/s5pv210-torbreck.dtb: Warning (interrupts_property): Missing interrupt-parent for /soc/ohci@ec300000\n\nAs seen from the related exynos dts files, the ohci and ehci controllers\nalways share one interrupt number, and the number is the same here as\nwell, so setting the same interrupt-parent is the reasonable solution\nhere.\n\nReviewed-by: Krzysztof Kozlowski <krzk@kernel.org>\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/d61961121a46934b0c4a57747f2e774f3eef4ceb"},{"sha":"2455cf4da92bad5956ba012db37be3cebb0846fc","author":{"name":"Arnd Bergmann","email":"72a0f6d3b182607e6d5c44b93e1abb7b23ee18f3@arndb.de"},"message":"media: r820t: fix r820t_write_reg for KASAN\n\ncommit 16c3ada89cff9a8c2a0eea34ffa1aa20af3f6008 upstream.\n\nWith CONFIG_KASAN, we get an overly long stack frame due to inlining\nthe register access functions:\n\ndrivers/media/tuners/r820t.c: In function 'generic_set_freq.isra.7':\ndrivers/media/tuners/r820t.c:1334:1: error: the frame size of 2880 bytes is larger than 2048 bytes [-Werror=frame-larger-than=]\n\nThis is caused by a gcc bug that has now been fixed in gcc-8.\nTo work around the problem, we can pass the register data\nthrough a local variable that older gcc versions can optimize\nout as well.\n\nLink: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81715\n\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/2455cf4da92bad5956ba012db37be3cebb0846fc"},{"sha":"2796fe7d00e46369bc766b79bd19e2394243e565","author":{"name":"Tetsuo Handa","email":"badf33aa2d274d0572a6b5c85bfcebfa56176677@I-love.SAKURA.ne.jp"},"message":"mm,vmscan: Make unregister_shrinker() no-op if register_shrinker() failed.\n\ncommit bb422a738f6566f7439cd347d54e321e4fe92a9f upstream.\n\nSyzbot caught an oops at unregister_shrinker() because combination of\ncommit 1d3d4437eae1bb29 (\"vmscan: per-node deferred work\") and fault\ninjection made register_shrinker() fail and the caller of\nregister_shrinker() did not check for failure.\n\n----------\n[  554.881422] FAULT_INJECTION: forcing a failure.\n[  554.881422] name failslab, interval 1, probability 0, space 0, times 0\n[  554.881438] CPU: 1 PID: 13231 Comm: syz-executor1 Not tainted 4.14.0-rc8+ #82\n[  554.881443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n[  554.881445] Call Trace:\n[  554.881459]  dump_stack+0x194/0x257\n[  554.881474]  ? arch_local_irq_restore+0x53/0x53\n[  554.881486]  ? find_held_lock+0x35/0x1d0\n[  554.881507]  should_fail+0x8c0/0xa40\n[  554.881522]  ? fault_create_debugfs_attr+0x1f0/0x1f0\n[  554.881537]  ? check_noncircular+0x20/0x20\n[  554.881546]  ? find_next_zero_bit+0x2c/0x40\n[  554.881560]  ? ida_get_new_above+0x421/0x9d0\n[  554.881577]  ? find_held_lock+0x35/0x1d0\n[  554.881594]  ? __lock_is_held+0xb6/0x140\n[  554.881628]  ? check_same_owner+0x320/0x320\n[  554.881634]  ? lock_downgrade+0x990/0x990\n[  554.881649]  ? find_held_lock+0x35/0x1d0\n[  554.881672]  should_failslab+0xec/0x120\n[  554.881684]  __kmalloc+0x63/0x760\n[  554.881692]  ? lock_downgrade+0x990/0x990\n[  554.881712]  ? register_shrinker+0x10e/0x2d0\n[  554.881721]  ? trace_event_raw_event_module_request+0x320/0x320\n[  554.881737]  register_shrinker+0x10e/0x2d0\n[  554.881747]  ? prepare_kswapd_sleep+0x1f0/0x1f0\n[  554.881755]  ? _down_write_nest_lock+0x120/0x120\n[  554.881765]  ? memcpy+0x45/0x50\n[  554.881785]  sget_userns+0xbcd/0xe20\n(...snipped...)\n[  554.898693] kasan: CONFIG_KASAN_INLINE enabled\n[  554.898724] kasan: GPF could be caused by NULL-ptr deref or user memory access\n[  554.898732] general protection fault: 0000 [#1] SMP KASAN\n[  554.898737] Dumping ftrace buffer:\n[  554.898741]    (ftrace buffer empty)\n[  554.898743] Modules linked in:\n[  554.898752] CPU: 1 PID: 13231 Comm: syz-executor1 Not tainted 4.14.0-rc8+ #82\n[  554.898755] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n[  554.898760] task: ffff8801d1dbe5c0 task.stack: ffff8801c9e38000\n[  554.898772] RIP: 0010:__list_del_entry_valid+0x7e/0x150\n[  554.898775] RSP: 0018:ffff8801c9e3f108 EFLAGS: 00010246\n[  554.898780] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\n[  554.898784] RDX: 0000000000000000 RSI: ffff8801c53c6f98 RDI: ffff8801c53c6fa0\n[  554.898788] RBP: ffff8801c9e3f120 R08: 1ffff100393c7d55 R09: 0000000000000004\n[  554.898791] R10: ffff8801c9e3ef70 R11: 0000000000000000 R12: 0000000000000000\n[  554.898795] R13: dffffc0000000000 R14: 1ffff100393c7e45 R15: ffff8801c53c6f98\n[  554.898800] FS:  0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000\n[  554.898804] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033\n[  554.898807] CR2: 00000000dbc23000 CR3: 00000001c7269000 CR4: 00000000001406e0\n[  554.898813] DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000\n[  554.898816] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600\n[  554.898818] Call Trace:\n[  554.898828]  unregister_shrinker+0x79/0x300\n[  554.898837]  ? perf_trace_mm_vmscan_writepage+0x750/0x750\n[  554.898844]  ? down_write+0x87/0x120\n[  554.898851]  ? deactivate_super+0x139/0x1b0\n[  554.898857]  ? down_read+0x150/0x150\n[  554.898864]  ? check_same_owner+0x320/0x320\n[  554.898875]  deactivate_locked_super+0x64/0xd0\n[  554.898883]  deactivate_super+0x141/0x1b0\n----------\n\nSince allowing register_shrinker() callers to call unregister_shrinker()\nwhen register_shrinker() failed can simplify error recovery path, this\npatch makes unregister_shrinker() no-op when register_shrinker() failed.\nAlso, reset shrinker->nr_deferred in case unregister_shrinker() was\nby error called twice.\n\nSigned-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>\nSigned-off-by: Aliaksei Karaliou <akaraliou.dev@gmail.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nCc: Glauber Costa <glauber@scylladb.com>\nCc: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/2796fe7d00e46369bc766b79bd19e2394243e565"},{"sha":"a04a3d139ba8af2e8f5fd6c5f789e00ea3f4af34","author":{"name":"Cong Wang","email":"3f5d79d28d6d48052800caba9df0b30e06fefe41@gmail.com"},"message":"xfrm: check id proto in validate_tmpl()\n\ncommit 6a53b7593233ab9e4f96873ebacc0f653a55c3e1 upstream.\n\nsyzbot reported a kernel warning in xfrm_state_fini(), which\nindicates that we have entries left in the list\nnet->xfrm.state_all whose proto is zero. And\nxfrm_id_proto_match() doesn't consider them as a match with\nIPSEC_PROTO_ANY in this case.\n\nProto with value 0 is probably not a valid value, at least\nverify_newsa_info() doesn't consider it valid either.\n\nThis patch fixes it by checking the proto value in\nvalidate_tmpl() and rejecting invalid ones, like what iproute2\ndoes in xfrm_xfrmproto_getbyname().\n\nReported-by: syzbot <syzkaller@googlegroups.com>\nCc: Steffen Klassert <steffen.klassert@secunet.com>\nCc: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/a04a3d139ba8af2e8f5fd6c5f789e00ea3f4af34"},{"sha":"cc865060870a16d92923265a8f42454f1bf01187","author":{"name":"Paul Moore","email":"54f65660711c038b3360dd7288dc12347ae58ba3@paul-moore.com"},"message":"selinux: skip bounded transition processing if the policy isn't loaded\n\ncommit 4b14752ec4e0d87126e636384cf37c8dd9df157c upstream.\n\nWe can't do anything reasonable in security_bounded_transition() if we\ndon't have a policy loaded, and in fact we could run into problems\nwith some of the code inside expecting a policy.  Fix these problems\nlike we do many others in security/selinux/ss/services.c by checking\nto see if the policy is loaded (ss_initialized) and returning quickly\nif it isn't.\n\nReported-by: syzbot <syzkaller-bugs@googlegroups.com>\nSigned-off-by: Paul Moore <paul@paul-moore.com>\nAcked-by: Stephen Smalley <sds@tycho.nsa.gov>\nReviewed-by: James Morris <james.l.morris@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/akhilnarang/kernel_msm-3.10/commits/cc865060870a16d92923265a8f42454f1bf01187"}]}
{"actor":{"display_login":"akhilnarang"}}