{"push_id":2592783044,"size":97,"distinct_size":97,"ref":"refs/heads/odroidc2-4.14.y-em28xx","head":"ffebf8c092cc26500b2e00dcf2dd62f2de4e16c9","before":"cb6c4354c212a35fb79b40cf56a8526b4bb30f1f","commits":[{"sha":"a3d5f6ecba9923a669a5991b8dbd3398c59bf892","author":{"name":"Shuah Khan","email":"c62751f8c6ce7eb0639cab80a821801931863a4b@osg.samsung.com"},"message":"usbip: usbip_host: refine probe and disconnect debug msgs to be useful\n\ncommit 28b68acc4a88dcf91fd1dcf2577371dc9bf574cc upstream.\n\nRefine probe and disconnect debug msgs to be useful and say what is\nin progress.\n\nSigned-off-by: Shuah Khan <shuahkh@osg.samsung.com>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/a3d5f6ecba9923a669a5991b8dbd3398c59bf892"},{"sha":"cf3bcc3231ade09dd2733ca7d0f34d90ee7fe8fd","author":{"name":"Shuah Khan (Samsung OSG)","email":"90afa3c006319543993f3435e7531028bae47985@kernel.org"},"message":"usbip: usbip_host: delete device from busid_table after rebind\n\ncommit 1e180f167d4e413afccbbb4a421b48b2de832549 upstream.\n\nDevice is left in the busid_table after unbind and rebind. Rebind\ninitiates usb bus scan and the original driver claims the device.\nAfter rescan the device should be deleted from the busid_table as\nit no longer belongs to usbip_host.\n\nFix it to delete the device after device_attach() succeeds.\n\nSigned-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/cf3bcc3231ade09dd2733ca7d0f34d90ee7fe8fd"},{"sha":"5cd4dd77782e9882e0a158344fe48223c24f5c95","author":{"name":"Shuah Khan (Samsung OSG)","email":"90afa3c006319543993f3435e7531028bae47985@kernel.org"},"message":"usbip: usbip_host: run rebind from exit when module is removed\n\ncommit 7510df3f29d44685bab7b1918b61a8ccd57126a9 upstream.\n\nAfter removing usbip_host module, devices it releases are left without\na driver. For example, when a keyboard or a mass storage device are\nbound to usbip_host when it is removed, these devices are no longer\nbound to any driver.\n\nFix it to run device_attach() from the module exit routine to restore\nthe devices to their original drivers. This includes cleanup changes\nand moving device_attach() code to a common routine to be called from\nrebind_store() and usbip_host_exit().\n\nSigned-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/5cd4dd77782e9882e0a158344fe48223c24f5c95"},{"sha":"ec0c93951ecb3ab9463c9a0d0a79c69e4bcb2b2a","author":{"name":"Shuah Khan (Samsung OSG)","email":"90afa3c006319543993f3435e7531028bae47985@kernel.org"},"message":"usbip: usbip_host: fix NULL-ptr deref and use-after-free errors\n\ncommit 22076557b07c12086eeb16b8ce2b0b735f7a27e7 upstream.\n\nusbip_host updates device status without holding lock from stub probe,\ndisconnect and rebind code paths. When multiple requests to import a\ndevice are received, these unprotected code paths step all over each\nother and drive fails with NULL-ptr deref and use-after-free errors.\n\nThe driver uses a table lock to protect the busid array for adding and\ndeleting busids to the table. However, the probe, disconnect and rebind\npaths get the busid table entry and update the status without holding\nthe busid table lock. Add a new finer grain lock to protect the busid\nentry. This new lock will be held to search and update the busid entry\nfields from get_busid_idx(), add_match_busid() and del_match_busid().\n\nmatch_busid_show() does the same to access the busid entry fields.\n\nget_busid_priv() changed to return the pointer to the busid entry holding\nthe busid lock. stub_probe(), stub_disconnect() and stub_device_rebind()\ncall put_busid_priv() to release the busid lock before returning. This\nchanges fixes the unprotected code paths eliminating the race conditions\nin updating the busid entries.\n\nReported-by: Jakub Jirasek\nSigned-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/ec0c93951ecb3ab9463c9a0d0a79c69e4bcb2b2a"},{"sha":"e842726eccf347212a9568470d78be268c513aad","author":{"name":"Shuah Khan (Samsung OSG)","email":"90afa3c006319543993f3435e7531028bae47985@kernel.org"},"message":"usbip: usbip_host: fix bad unlock balance during stub_probe()\n\ncommit c171654caa875919be3c533d3518da8be5be966e upstream.\n\nstub_probe() calls put_busid_priv() in an error path when device isn't\nfound in the busid_table. Fix it by making put_busid_priv() safe to be\ncalled with null struct bus_id_priv pointer.\n\nThis problem happens when \"usbip bind\" is run without loading usbip_host\ndriver and then running modprobe. The first failed bind attempt unbinds\nthe device from the original driver and when usbip_host is modprobed,\nstub_probe() runs and doesn't find the device in its busid table and calls\nput_busid_priv(0 with null bus_id_priv pointer.\n\nusbip-host 3-10.2: 3-10.2 is not in match_busid table...  skip!\n\n[  367.359679] =====================================\n[  367.359681] WARNING: bad unlock balance detected!\n[  367.359683] 4.17.0-rc4+ #5 Not tainted\n[  367.359685] -------------------------------------\n[  367.359688] modprobe/2768 is trying to release lock (\n[  367.359689]\n==================================================================\n[  367.359696] BUG: KASAN: null-ptr-deref in print_unlock_imbalance_bug+0x99/0x110\n[  367.359699] Read of size 8 at addr 0000000000000058 by task modprobe/2768\n\n[  367.359705] CPU: 4 PID: 2768 Comm: modprobe Not tainted 4.17.0-rc4+ #5\n\nFixes: 22076557b07c (\"usbip: usbip_host: fix NULL-ptr deref and use-after-free errors\") in usb-linus\nSigned-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/e842726eccf347212a9568470d78be268c513aad"},{"sha":"13fe9058ed09d5f89c28afdf971614f0c70dc9d3","author":{"name":"Federico Cuello","email":"f5463b89a471eb176093c6a43e4929b71cf931bf@fedux.com.ar"},"message":"ALSA: usb: mixer: volume quirk for CM102-A+/102S+\n\ncommit 21493316a3c4598f308d5a9fa31cc74639c4caff upstream.\n\nCurrently it's not possible to set volume lower than 26% (it just mutes).\n\nAlso fixes this warning:\n\n  Warning! Unlikely big volume range (=9472), cval->res is probably wrong.\n  [13] FU [PCM Playback Volume] ch = 2, val = -9473/-1/1\n\n, and volume works fine for full range.\n\nSigned-off-by: Federico Cuello <fedux@fedux.com.ar>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/13fe9058ed09d5f89c28afdf971614f0c70dc9d3"},{"sha":"6283fcc9b93ac1f264416f63962730a9f5056af0","author":{"name":"Hans de Goede","email":"9fa1be1a5b5729e4c6b404f34c9ce49ff4882fd8@redhat.com"},"message":"ALSA: hda: Add Lenovo C50 All in one to the power_save blacklist\n\ncommit c8beccc19b92f5172994c0732db689c08f4f98e5 upstream.\n\nPower-saving is causing loud plops on the Lenovo C50 All in one, add it\nto the blacklist.\n\nBugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1572975\nSigned-off-by: Hans de Goede <hdegoede@redhat.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/6283fcc9b93ac1f264416f63962730a9f5056af0"},{"sha":"50c0e85887bff4b9dda38789f8cf29cd41ef4507","author":{"name":"Wenwen Wang","email":"bafc5a1ee344249d3957e4d34f33647904b567dc@umn.edu"},"message":"ALSA: control: fix a redundant-copy issue\n\ncommit 3f12888dfae2a48741c4caa9214885b3aaf350f9 upstream.\n\nIn snd_ctl_elem_add_compat(), the fields of the struct 'data' need to be\ncopied from the corresponding fields of the struct 'data32' in userspace.\nThis is achieved by invoking copy_from_user() and get_user() functions. The\nproblem here is that the 'type' field is copied twice. One is by\ncopy_from_user() and one is by get_user(). Given that the 'type' field is\nnot used between the two copies, the second copy is *completely* redundant\nand should be removed for better performance and cleanup. Also, these two\ncopies can cause inconsistent data: as the struct 'data32' resides in\nuserspace and a malicious userspace process can race to change the 'type'\nfield between the two copies to cause inconsistent data. Depending on how\nthe data is used in the future, such an inconsistency may cause potential\nsecurity risks.\n\nFor above reasons, we should take out the second copy.\n\nSigned-off-by: Wenwen Wang <wang6495@umn.edu>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/50c0e85887bff4b9dda38789f8cf29cd41ef4507"},{"sha":"45804b0e3cb3f654383db94cc46af9ee7ed3bf08","author":{"name":"Andy Shevchenko","email":"74f0c009df510614346aa771cd21959b78cdb413@linux.intel.com"},"message":"spi: pxa2xx: Allow 64-bit DMA\n\ncommit efc4a13724b852ddaa3358402a8dec024ffbcb17 upstream.\n\nCurrently the 32-bit device address only is supported for DMA. However,\nstarting from Intel Sunrisepoint PCH the DMA address of the device FIFO\ncan be 64-bit.\n\nChange the respective variable to be compatible with DMA engine\nexpectations, i.e. to phys_addr_t.\n\nFixes: 34cadd9c1bcb (\"spi: pxa2xx: Add support for Intel Sunrisepoint\")\nSigned-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/45804b0e3cb3f654383db94cc46af9ee7ed3bf08"},{"sha":"d18c3d2304de3c099f147ece9f757767e2eaeef1","author":{"name":"Kamal Dasu","email":"c38ab074b9b7f49b5ec5c771c853ef0fd1b69a17@gmail.com"},"message":"spi: bcm-qspi: Avoid setting MSPI_CDRAM_PCS for spi-nor master\n\ncommit 5eb9a07a4ae1008b67d8bcd47bddb3dae97456b7 upstream.\n\nAdded fix for probing of spi-nor device non-zero chip selects. Set\nMSPI_CDRAM_PCS (peripheral chip select) with spi master for MSPI\ncontroller and not for MSPI/BSPI spi-nor master controller. Ensure\nsetting of cs bit in chip select register on chip select change.\n\nFixes: fa236a7ef24048 (\"spi: bcm-qspi: Add Broadcom MSPI driver\")\nSigned-off-by: Kamal Dasu <kdasu.kdev@gmail.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/d18c3d2304de3c099f147ece9f757767e2eaeef1"},{"sha":"b7f0fc1f06155e55ad7c0b3e245a6fd39ca0b6e3","author":{"name":"Kamal Dasu","email":"c38ab074b9b7f49b5ec5c771c853ef0fd1b69a17@gmail.com"},"message":"spi: bcm-qspi: Always read and set BSPI_MAST_N_BOOT_CTRL\n\ncommit 602805fb618b018b7a41fbb3f93c1992b078b1ae upstream.\n\nAlways confirm the BSPI_MAST_N_BOOT_CTRL bit when enabling\nor disabling BSPI transfers.\n\nFixes: 4e3b2d236fe00 (\"spi: bcm-qspi: Add BSPI spi-nor flash controller driver\")\nSigned-off-by: Kamal Dasu <kdasu.kdev@gmail.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/b7f0fc1f06155e55ad7c0b3e245a6fd39ca0b6e3"},{"sha":"b6f6d8bfe779294e58f424bff08eab9914570d9b","author":{"name":"Andre Przywara","email":"94eb15b8f54b8e37c3f8d338296201be47dc5c3e@arm.com"},"message":"KVM: arm/arm64: VGIC/ITS save/restore: protect kvm_read_guest() calls\n\ncommit 711702b57cc3c50b84bd648de0f1ca0a378805be upstream.\n\nkvm_read_guest() will eventually look up in kvm_memslots(), which requires\neither to hold the kvm->slots_lock or to be inside a kvm->srcu critical\nsection.\nIn contrast to x86 and s390 we don't take the SRCU lock on every guest\nexit, so we have to do it individually for each kvm_read_guest() call.\nUse the newly introduced wrapper for that.\n\nCc: Stable <stable@vger.kernel.org> # 4.12+\nReported-by: Jan Glauber <jan.glauber@caviumnetworks.com>\nSigned-off-by: Andre Przywara <andre.przywara@arm.com>\nAcked-by: Christoffer Dall <christoffer.dall@arm.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/b6f6d8bfe779294e58f424bff08eab9914570d9b"},{"sha":"27ea98a4c50c7aff5cfa132c15d6c68764b493fa","author":{"name":"Andre Przywara","email":"94eb15b8f54b8e37c3f8d338296201be47dc5c3e@arm.com"},"message":"KVM: arm/arm64: VGIC/ITS: protect kvm_read_guest() calls with SRCU lock\n\ncommit bf308242ab98b5d1648c3663e753556bef9bec01 upstream.\n\nkvm_read_guest() will eventually look up in kvm_memslots(), which requires\neither to hold the kvm->slots_lock or to be inside a kvm->srcu critical\nsection.\nIn contrast to x86 and s390 we don't take the SRCU lock on every guest\nexit, so we have to do it individually for each kvm_read_guest() call.\n\nProvide a wrapper which does that and use that everywhere.\n\nNote that ending the SRCU critical section before returning from the\nkvm_read_guest() wrapper is safe, because the data has been *copied*, so\nwe don't need to rely on valid references to the memslot anymore.\n\nCc: Stable <stable@vger.kernel.org> # 4.8+\nReported-by: Jan Glauber <jan.glauber@caviumnetworks.com>\nSigned-off-by: Andre Przywara <andre.przywara@arm.com>\nAcked-by: Christoffer Dall <christoffer.dall@arm.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/27ea98a4c50c7aff5cfa132c15d6c68764b493fa"},{"sha":"92ce74164efa1e2b8b2232a1c7b562126188beb0","author":{"name":"Benjamin Herrenschmidt","email":"a7089bb6e7e92505d88aaff006cbdd60cc9120b6@kernel.crashing.org"},"message":"powerpc: Don't preempt_disable() in show_cpuinfo()\n\ncommit 349524bc0da698ec77f2057cf4a4948eb6349265 upstream.\n\nThis causes warnings from cpufreq mutex code. This is also rather\nunnecessary and ineffective. If we really want to prevent concurrent\nunplug, we could take the unplug read lock but I don't see this being\ncritical.\n\nFixes: cd77b5ce208c (\"powerpc/powernv/cpufreq: Fix the frequency read by /proc/cpuinfo\")\nSigned-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nAcked-by: Michal Suchanek <msuchanek@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/92ce74164efa1e2b8b2232a1c7b562126188beb0"},{"sha":"d2dee2253be8d2f401f23015fc5e8226772ba479","author":{"name":"Halil Pasic","email":"0e388d81f66b02b12947cb620aedbc45d9353d7f@linux.vnet.ibm.com"},"message":"vfio: ccw: fix cleanup if cp_prefetch fails\n\ncommit d66a7355717ec903d455277a550d930ba13df4a8 upstream.\n\nIf the translation of a channel program fails, we may end up attempting\nto clean up (free, unpin) stuff that never got translated (and allocated,\npinned) in the first place.\n\nBy adjusting the lengths of the chains accordingly (so the element that\nfailed, and all subsequent elements are excluded) cleanup activities\nbased on false assumptions can be avoided.\n\nLet's make sure cp_free works properly after cp_prefetch returns with an\nerror by setting ch_len of a ccw chain to the number of the translated\nCCWs on that chain.\n\nCc: stable@vger.kernel.org #v4.12+\nAcked-by: Pierre Morel <pmorel@linux.vnet.ibm.com>\nReviewed-by: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com>\nSigned-off-by: Halil Pasic <pasic@linux.vnet.ibm.com>\nSigned-off-by: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com>\nMessage-Id: <20180423110113.59385-2-bjsdjshi@linux.vnet.ibm.com>\n[CH: fixed typos]\nSigned-off-by: Cornelia Huck <cohuck@redhat.com>\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/d2dee2253be8d2f401f23015fc5e8226772ba479"},{"sha":"9a19a93bddb383548a04afaf40cec847de6296f8","author":{"name":"Steven Rostedt (VMware)","email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org"},"message":"tracing/x86/xen: Remove zero data size trace events trace_xen_mmu_flush_tlb{_all}\n\ncommit 45dd9b0666a162f8e4be76096716670cf1741f0e upstream.\n\nDoing an audit of trace events, I discovered two trace events in the xen\nsubsystem that use a hack to create zero data size trace events. This is not\nwhat trace events are for. Trace events add memory footprint overhead, and\nif all you need to do is see if a function is hit or not, simply make that\nfunction noinline and use function tracer filtering.\n\nWorse yet, the hack used was:\n\n __array(char, x, 0)\n\nWhich creates a static string of zero in length. There's assumptions about\nsuch constructs in ftrace that this is a dynamic string that is nul\nterminated. This is not the case with these tracepoints and can cause\nproblems in various parts of ftrace.\n\nNuke the trace events!\n\nLink: http://lkml.kernel.org/r/20180509144605.5a220327@gandalf.local.home\n\nCc: stable@vger.kernel.org\nFixes: 95a7d76897c1e (\"xen/mmu: Use Xen specific TLB flush instead of the generic one.\")\nReviewed-by: Juergen Gross <jgross@suse.com>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/9a19a93bddb383548a04afaf40cec847de6296f8"},{"sha":"bca7faea5410d50d2a3be4b11688f02a2fb2ee95","author":{"name":"Jann Horn","email":"0fcb39c6619aeb747ed6898bfde644ba26b24452@google.com"},"message":"tee: shm: fix use-after-free via temporarily dropped reference\n\ncommit bb765d1c331f62b59049d35607ed2e365802bef9 upstream.\n\nBump the file's refcount before moving the reference into the fd table,\nnot afterwards. The old code could drop the file's refcount to zero for a\nshort moment before calling get_file() via get_dma_buf().\n\nThis code can only be triggered on ARM systems that use Linaro's OP-TEE.\n\nFixes: 967c9cca2cc5 (\"tee: generic TEE subsystem\")\nSigned-off-by: Jann Horn <jannh@google.com>\nSigned-off-by: Jens Wiklander <jens.wiklander@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/bca7faea5410d50d2a3be4b11688f02a2fb2ee95"},{"sha":"321bc88ec098845ec93d047858a010d41be26ed9","author":{"name":"Florian Westphal","email":"cef439e78636cdab99cd2923826c5065a0743e5b@strlen.de"},"message":"netfilter: nf_tables: free set name in error path\n\ncommit 2f6adf481527c8ab8033c601f55bfb5b3712b2ac upstream.\n\nset->name must be free'd here in case ops->init fails.\n\nFixes: 387454901bd6 (\"netfilter: nf_tables: Allow set names of up to 255 chars\")\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/321bc88ec098845ec93d047858a010d41be26ed9"},{"sha":"d233f8d5bdd39ef13112147d8659bc2f5b9f6b8f","author":{"name":"Florian Westphal","email":"cef439e78636cdab99cd2923826c5065a0743e5b@strlen.de"},"message":"netfilter: nf_tables: can't fail after linking rule into active rule list\n\ncommit 569ccae68b38654f04b6842b034aa33857f605fe upstream.\n\nrules in nftables a free'd using kfree, but protected by rcu, i.e. we\nmust wait for a grace period to elapse.\n\nNormal removal patch does this, but nf_tables_newrule() doesn't obey\nthis rule during error handling.\n\nIt calls nft_trans_rule_add() *after* linking rule, and, if that\nfails to allocate memory, it unlinks the rule and then kfree() it --\nthis is unsafe.\n\nSwitch order -- first add rule to transaction list, THEN link it\nto public list.\n\nNote: nft_trans_rule_add() uses GFP_KERNEL; it will not fail so this\nis not a problem in practice (spotted only during code review).\n\nFixes: 0628b123c96d12 (\"netfilter: nfnetlink: add batch support and use it from nf_tables\")\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/d233f8d5bdd39ef13112147d8659bc2f5b9f6b8f"},{"sha":"f9882808e355376a524c53bf2e66af12c775eb5b","author":{"name":"Subash Abhinov Kasiviswanathan","email":"1dc9a55fbcba59128627e933e7c9fd67d2a78e24@codeaurora.org"},"message":"netfilter: nf_socket: Fix out of bounds access in nf_sk_lookup_slow_v{4,6}\n\ncommit 32c1733f0dd4bd11d6e65512bf4dc337c0452c8e upstream.\n\nskb_header_pointer will copy data into a buffer if data is non linear,\notherwise it will return a pointer in the linear section of the data.\nnf_sk_lookup_slow_v{4,6} always copies data of size udphdr but later\naccesses memory within the size of tcphdr (th->doff) in case of TCP\npackets. This causes a crash when running with KASAN with the following\ncall stack -\n\nBUG: KASAN: stack-out-of-bounds in xt_socket_lookup_slow_v4+0x524/0x718\nnet/netfilter/xt_socket.c:178\nRead of size 2 at addr ffffffe3d417a87c by task syz-executor/28971\nCPU: 2 PID: 28971 Comm: syz-executor Tainted: G    B   W  O    4.9.65+ #1\nCall trace:\n[<ffffff9467e8d390>] dump_backtrace+0x0/0x428 arch/arm64/kernel/traps.c:76\n[<ffffff9467e8d7e0>] show_stack+0x28/0x38 arch/arm64/kernel/traps.c:226\n[<ffffff946842d9b8>] __dump_stack lib/dump_stack.c:15 [inline]\n[<ffffff946842d9b8>] dump_stack+0xd4/0x124 lib/dump_stack.c:51\n[<ffffff946811d4b0>] print_address_description+0x68/0x258 mm/kasan/report.c:248\n[<ffffff946811d8c8>] kasan_report_error mm/kasan/report.c:347 [inline]\n[<ffffff946811d8c8>] kasan_report.part.2+0x228/0x2f0 mm/kasan/report.c:371\n[<ffffff946811df44>] kasan_report+0x5c/0x70 mm/kasan/report.c:372\n[<ffffff946811bebc>] check_memory_region_inline mm/kasan/kasan.c:308 [inline]\n[<ffffff946811bebc>] __asan_load2+0x84/0x98 mm/kasan/kasan.c:739\n[<ffffff94694d6f04>] __tcp_hdrlen include/linux/tcp.h:35 [inline]\n[<ffffff94694d6f04>] xt_socket_lookup_slow_v4+0x524/0x718 net/netfilter/xt_socket.c:178\n\nFix this by copying data into appropriate size headers based on protocol.\n\nFixes: a583636a83ea (\"inet: refactor inet[6]_lookup functions to take skb\")\nSigned-off-by: Tejaswi Tanikella <tejaswit@codeaurora.org>\nSigned-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kevinxucs/linux/commits/f9882808e355376a524c53bf2e66af12c775eb5b"}]}
{"actor":{"display_login":"kevinxucs"}}