{"push_id":3038754705,"size":117,"distinct_size":117,"ref":"refs/heads/arrow-9.x","head":"223d23d423a6e57433cac4a2e095ba05382b6554","before":"66ccec3bdc8d58eb905a8b6a194014dc6b819d27","commits":[{"sha":"5ce93bd4cc02ef3c1b25587ce65eaa84f6b4172a","author":{"name":"Steffen Klassert","email":"66deb1d63f85161cc287ce2bac0c65cb5ae958a7@secunet.com"},"message":"xfrm: Validate address prefix lengths in the xfrm selector.\n\n[ Upstream commit 07bf7908950a8b14e81aa1807e3c667eab39287a ]\n\nWe don't validate the address prefix lengths in the xfrm\nselector we got from userspace. This can lead to undefined\nbehaviour in the address matching functions if the prefix\nis too big for the given address family. Fix this by checking\nthe prefixes and refuse SA/policy insertation when a prefix\nis invalid.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Air Icy <icytxw@gmail.com>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/5ce93bd4cc02ef3c1b25587ce65eaa84f6b4172a"},{"sha":"4e16c61e87a1c3fc79253fc07cf043533b33b661","author":{"name":"Thadeu Lima de Souza Cascardo","email":"c8883472cb5fbead63941b41bccc869c7deaf90f@canonical.com"},"message":"xfrm6: call kfree_skb when skb is toobig\n\n[ Upstream commit 215ab0f021c9fea3c18b75e7d522400ee6a49990 ]\n\nAfter commit d6990976af7c5d8f55903bfb4289b6fb030bf754 (\"vti6: fix PMTU caching\nand reporting on xmit\"), some too big skbs might be potentially passed down to\n__xfrm6_output, causing it to fail to transmit but not free the skb, causing a\nleak of skb, and consequentially a leak of dst references.\n\nAfter running pmtu.sh, that shows as failure to unregister devices in a namespace:\n\n[  311.397671] unregister_netdevice: waiting for veth_b to become free. Usage count = 1\n\nThe fix is to call kfree_skb in case of transmit failures.\n\nFixes: dd767856a36e (\"xfrm6: Don't call icmpv6_send on local error\")\nSigned-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>\nReviewed-by: Sabrina Dubroca <sd@queasysnail.net>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/4e16c61e87a1c3fc79253fc07cf043533b33b661"},{"sha":"7402bc9ca983a6a4c1545a4048e8b1a859b882ba","author":{"name":"Andrei Otcheretianski","email":"52b10305096e64ebe056ebf56ccad6d200c051a9@intel.com"},"message":"mac80211: Always report TX status\n\n[ Upstream commit 8682250b3c1b75a45feb7452bc413d004cfe3778 ]\n\nIf a frame is dropped for any reason, mac80211 wouldn't report the TX\nstatus back to user space.\n\nAs the user space may rely on the TX_STATUS to kick its state\nmachines, resends etc, it's better to just report this frame as not\nacked instead.\n\nSigned-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>\nSigned-off-by: Luca Coelho <luciano.coelho@intel.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/7402bc9ca983a6a4c1545a4048e8b1a859b882ba"},{"sha":"db420bc4b798c1a5c91ce87e40011c89c118aef7","author":{"name":"Andrei Otcheretianski","email":"52b10305096e64ebe056ebf56ccad6d200c051a9@intel.com"},"message":"cfg80211: reg: Init wiphy_idx in regulatory_hint_core()\n\n[ Upstream commit 24f33e64fcd0d50a4b1a8e5b41bd0257aa66b0e8 ]\n\nCore regulatory hints didn't set wiphy_idx to WIPHY_IDX_INVALID. Since\nthe regulatory request is zeroed, wiphy_idx was always implicitly set to\n0. This resulted in updating only phy #0.\nFix that.\n\nFixes: 806a9e39670b (\"cfg80211: make regulatory_request use wiphy_idx instead of wiphy\")\nSigned-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>\nSigned-off-by: Luca Coelho <luciano.coelho@intel.com>\n[add fixes tag]\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/db420bc4b798c1a5c91ce87e40011c89c118aef7"},{"sha":"f4c24fd3b6919a7fb0fa5e858381299e593daf44","author":{"name":"Thomas Petazzoni","email":"a5d87d2bd7c424ee5cbdb4e978635bf653d5a005@free-electrons.com"},"message":"ARM: 8799/1: mm: fix pci_ioremap_io() offset check\n\n[ Upstream commit 3a58ac65e2d7969bcdf1b6acb70fa4d12a88e53e ]\n\nIO_SPACE_LIMIT is the ending address of the PCI IO space, i.e\nsomething like 0xfffff (and not 0x100000).\n\nTherefore, when offset = 0xf0000 is passed as argument, this function\nfails even though the offset + SZ_64K fits below the\nIO_SPACE_LIMIT. This makes the last chunk of 64 KB of the I/O space\nnot usable as it cannot be mapped.\n\nThis patch fixes that by substracing 1 to offset + SZ_64K, so that we\ncompare the addrss of the last byte of the I/O space against\nIO_SPACE_LIMIT instead of the address of the first byte of what is\nafter the I/O space.\n\nFixes: c2794437091a4 (\"ARM: Add fixed PCI i/o mapping\")\nSigned-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>\nAcked-by: Nicolas Pitre <nico@linaro.org>\nSigned-off-by: Russell King <rmk+kernel@armlinux.org.uk>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/f4c24fd3b6919a7fb0fa5e858381299e593daf44"},{"sha":"5217bec5a6e7bd3c95d1229fc6029d956a470060","author":{"name":"Sean Tranchetti","email":"571e0db99464eba93fabd8eb087bcaf9178c708c@codeaurora.org"},"message":"xfrm: validate template mode\n\n[ Upstream commit 32bf94fb5c2ec4ec842152d0e5937cd4bb6738fa ]\n\nXFRM mode parameters passed as part of the user templates\nin the IP_XFRM_POLICY are never properly validated. Passing\nvalues other than valid XFRM modes can cause stack-out-of-bounds\nreads to occur later in the XFRM processing:\n\n[  140.535608] ================================================================\n[  140.543058] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x17e4/0x1cc4\n[  140.550306] Read of size 4 at addr ffffffc0238a7a58 by task repro/5148\n[  140.557369]\n[  140.558927] Call trace:\n[  140.558936] dump_backtrace+0x0/0x388\n[  140.558940] show_stack+0x24/0x30\n[  140.558946] __dump_stack+0x24/0x2c\n[  140.558949] dump_stack+0x8c/0xd0\n[  140.558956] print_address_description+0x74/0x234\n[  140.558960] kasan_report+0x240/0x264\n[  140.558963] __asan_report_load4_noabort+0x2c/0x38\n[  140.558967] xfrm_state_find+0x17e4/0x1cc4\n[  140.558971] xfrm_resolve_and_create_bundle+0x40c/0x1fb8\n[  140.558975] xfrm_lookup+0x238/0x1444\n[  140.558977] xfrm_lookup_route+0x48/0x11c\n[  140.558984] ip_route_output_flow+0x88/0xc4\n[  140.558991] raw_sendmsg+0xa74/0x266c\n[  140.558996] inet_sendmsg+0x258/0x3b0\n[  140.559002] sock_sendmsg+0xbc/0xec\n[  140.559005] SyS_sendto+0x3a8/0x5a8\n[  140.559008] el0_svc_naked+0x34/0x38\n[  140.559009]\n[  140.592245] page dumped because: kasan: bad access detected\n[  140.597981] page_owner info is not active (free page?)\n[  140.603267]\n[  140.653503] ================================================================\n\nSigned-off-by: Sean Tranchetti <stranche@codeaurora.org>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/5217bec5a6e7bd3c95d1229fc6029d956a470060"},{"sha":"6879c047ae6e9b6b43e54e8a34bebb7a52467198","author":{"name":"Martin Willi","email":"54669547a225ff20cba8b75a4adca540eef25858@strongswan.org"},"message":"mac80211_hwsim: do not omit multicast announce of first added radio\n\n[ Upstream commit 28ef8b49a338dc1844e86b7954cfffc7dfa2660a ]\n\nThe allocation of hwsim radio identifiers uses a post-increment from 0,\nso the first radio has idx 0. This idx is explicitly excluded from\nmulticast announcements ever since, but it is unclear why.\n\nDrop that idx check and announce the first radio as well. This makes\nuserspace happy if it relies on these events.\n\nSigned-off-by: Martin Willi <martin@strongswan.org>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/6879c047ae6e9b6b43e54e8a34bebb7a52467198"},{"sha":"b0c52fbff860b5dd23df44fd36f48e6a52ba8bfa","author":{"name":"Matias Karhumaa","email":"1d05ebe002ba1487354d9448127f4a3db2b6229a@gmail.com"},"message":"Bluetooth: SMP: fix crash in unpairing\n\n[ Upstream commit cb28c306b93b71f2741ce1a5a66289db26715f4d ]\n\nIn case unpair_device() was called through mgmt interface at the same time\nwhen pairing was in progress, Bluetooth kernel module crash was seen.\n\n[  600.351225] general protection fault: 0000 [#1] SMP PTI\n[  600.351235] CPU: 1 PID: 11096 Comm: btmgmt Tainted: G           OE     4.19.0-rc1+ #1\n[  600.351238] Hardware name: Dell Inc. Latitude E5440/08RCYC, BIOS A18 05/14/2017\n[  600.351272] RIP: 0010:smp_chan_destroy.isra.10+0xce/0x2c0 [bluetooth]\n[  600.351276] Code: c0 0f 84 b4 01 00 00 80 78 28 04 0f 84 53 01 00 00 4d 85 ed 0f 85 ab 00 00 00 48 8b 08 48 8b 50 08 be 10 00 00 00 48 89 51 08 <48> 89 0a 48 b9 00 02 00 00 00 00 ad de 48 89 48 08 48 8b 83 00 01\n[  600.351279] RSP: 0018:ffffa9be839b3b50 EFLAGS: 00010246\n[  600.351282] RAX: ffff9c999ac565a0 RBX: ffff9c9996e98c00 RCX: ffff9c999aa28b60\n[  600.351285] RDX: dead000000000200 RSI: 0000000000000010 RDI: ffff9c999e403500\n[  600.351287] RBP: ffffa9be839b3b70 R08: 0000000000000000 R09: ffffffff92a25c00\n[  600.351290] R10: ffffa9be839b3ae8 R11: 0000000000000001 R12: ffff9c995375b800\n[  600.351292] R13: 0000000000000000 R14: ffff9c99619a5000 R15: ffff9c9962a01c00\n[  600.351295] FS:  00007fb2be27c700(0000) GS:ffff9c999e880000(0000) knlGS:0000000000000000\n[  600.351298] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  600.351300] CR2: 00007fb2bdadbad0 CR3: 000000041c328001 CR4: 00000000001606e0\n[  600.351302] Call Trace:\n[  600.351325]  smp_failure+0x4f/0x70 [bluetooth]\n[  600.351345]  smp_cancel_pairing+0x74/0x80 [bluetooth]\n[  600.351370]  unpair_device+0x1c1/0x330 [bluetooth]\n[  600.351399]  hci_sock_sendmsg+0x960/0x9f0 [bluetooth]\n[  600.351409]  ? apparmor_socket_sendmsg+0x1e/0x20\n[  600.351417]  sock_sendmsg+0x3e/0x50\n[  600.351422]  sock_write_iter+0x85/0xf0\n[  600.351429]  do_iter_readv_writev+0x12b/0x1b0\n[  600.351434]  do_iter_write+0x87/0x1a0\n[  600.351439]  vfs_writev+0x98/0x110\n[  600.351443]  ? ep_poll+0x16d/0x3d0\n[  600.351447]  ? ep_modify+0x73/0x170\n[  600.351451]  do_writev+0x61/0xf0\n[  600.351455]  ? do_writev+0x61/0xf0\n[  600.351460]  __x64_sys_writev+0x1c/0x20\n[  600.351465]  do_syscall_64+0x5a/0x110\n[  600.351471]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n[  600.351474] RIP: 0033:0x7fb2bdb62fe0\n[  600.351477] Code: 73 01 c3 48 8b 0d b8 6e 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 69 c7 2c 00 00 75 10 b8 14 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 de 80 01 00 48 89 04 24\n[  600.351479] RSP: 002b:00007ffe062cb8f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014\n[  600.351484] RAX: ffffffffffffffda RBX: 000000000255b3d0 RCX: 00007fb2bdb62fe0\n[  600.351487] RDX: 0000000000000001 RSI: 00007ffe062cb920 RDI: 0000000000000004\n[  600.351490] RBP: 00007ffe062cb920 R08: 000000000255bd80 R09: 0000000000000000\n[  600.351494] R10: 0000000000000353 R11: 0000000000000246 R12: 0000000000000001\n[  600.351497] R13: 00007ffe062cbbe0 R14: 0000000000000000 R15: 0000000000000000\n[  600.351501] Modules linked in: algif_hash algif_skcipher af_alg cmac ipt_MASQUERADE nf_conntrack_netlink nfnetlink xfrm_user xfrm_algo iptable_nat nf_nat_ipv4 xt_addrtype iptable_filter ip_tables xt_conntrack x_tables nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c br_netfilter bridge stp llc overlay arc4 nls_iso8859_1 dm_crypt intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp dell_laptop kvm_intel crct10dif_pclmul dell_smm_hwmon crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd cryptd glue_helper intel_cstate intel_rapl_perf uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev media hid_multitouch input_leds joydev serio_raw dell_wmi snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic dell_smbios dcdbas sparse_keymap\n[  600.351569]  snd_hda_intel btusb snd_hda_codec btrtl btbcm btintel snd_hda_core bluetooth(OE) snd_hwdep snd_pcm iwlmvm ecdh_generic wmi_bmof dell_wmi_descriptor snd_seq_midi mac80211 snd_seq_midi_event lpc_ich iwlwifi snd_rawmidi snd_seq snd_seq_device snd_timer cfg80211 snd soundcore mei_me mei dell_rbtn dell_smo8800 mac_hid parport_pc ppdev lp parport autofs4 hid_generic usbhid hid i915 nouveau kvmgt vfio_mdev mdev vfio_iommu_type1 vfio kvm irqbypass i2c_algo_bit ttm drm_kms_helper syscopyarea sysfillrect sysimgblt mxm_wmi psmouse ahci sdhci_pci cqhci libahci fb_sys_fops sdhci drm e1000e video wmi\n[  600.351637] ---[ end trace e49e9f1df09c94fb ]---\n[  600.351664] RIP: 0010:smp_chan_destroy.isra.10+0xce/0x2c0 [bluetooth]\n[  600.351666] Code: c0 0f 84 b4 01 00 00 80 78 28 04 0f 84 53 01 00 00 4d 85 ed 0f 85 ab 00 00 00 48 8b 08 48 8b 50 08 be 10 00 00 00 48 89 51 08 <48> 89 0a 48 b9 00 02 00 00 00 00 ad de 48 89 48 08 48 8b 83 00 01\n[  600.351669] RSP: 0018:ffffa9be839b3b50 EFLAGS: 00010246\n[  600.351672] RAX: ffff9c999ac565a0 RBX: ffff9c9996e98c00 RCX: ffff9c999aa28b60\n[  600.351674] RDX: dead000000000200 RSI: 0000000000000010 RDI: ffff9c999e403500\n[  600.351676] RBP: ffffa9be839b3b70 R08: 0000000000000000 R09: ffffffff92a25c00\n[  600.351679] R10: ffffa9be839b3ae8 R11: 0000000000000001 R12: ffff9c995375b800\n[  600.351681] R13: 0000000000000000 R14: ffff9c99619a5000 R15: ffff9c9962a01c00\n[  600.351684] FS:  00007fb2be27c700(0000) GS:ffff9c999e880000(0000) knlGS:0000000000000000\n[  600.351686] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  600.351689] CR2: 00007fb2bdadbad0 CR3: 000000041c328001 CR4: 00000000001606e0\n\nCrash happened because list_del_rcu() was called twice for smp->ltk. This\nwas possible if unpair_device was called right after ltk was generated\nbut before keys were distributed.\n\nIn this commit smp_cancel_pairing was refactored to cancel pairing if it\nis in progress and otherwise just removes keys. Once keys are removed from\nrcu list, pointers to smp context's keys are set to NULL to make sure\nremoved list items are not accessed later.\n\nThis commit also adjusts the functionality of mgmt unpair_device() little\nbit. Previously pairing was canceled only if pairing was in state that\nkeys were already generated. With this commit unpair_device() cancels\npairing already in earlier states.\n\nBug was found by fuzzing kernel SMP implementation using Synopsys\nDefensics.\n\nReported-by: Pekka Oikarainen <pekka.oikarainen@synopsys.com>\nSigned-off-by: Matias Karhumaa <matias.karhumaa@gmail.com>\nSigned-off-by: Johan Hedberg <johan.hedberg@intel.com>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/b0c52fbff860b5dd23df44fd36f48e6a52ba8bfa"},{"sha":"df2d090bc5df33e92b43b2134d118fc60e2e0c97","author":{"name":"Lubomir Rintel","email":"c9b9bbc6e9b0bc7e9cec5af1551c7b98adb9530c@v3.sk"},"message":"pxa168fb: prepare the clock\n\n[ Upstream commit d85536cde91fcfed6fb8d983783bd2b92c843939 ]\n\nAdd missing prepare/unprepare operations for fbi->clk,\nthis fixes following kernel warning:\n\n  ------------[ cut here ]------------\n  WARNING: CPU: 0 PID: 1 at drivers/clk/clk.c:874 clk_core_enable+0x2c/0x1b0\n  Enabling unprepared disp0_clk\n  Modules linked in:\n  CPU: 0 PID: 1 Comm: swapper Not tainted 4.18.0-rc8-00032-g02b43ddd4f21-dirty #25\n  Hardware name: Marvell MMP2 (Device Tree Support)\n  [<c010f7cc>] (unwind_backtrace) from [<c010cc6c>] (show_stack+0x10/0x14)\n  [<c010cc6c>] (show_stack) from [<c011dab4>] (__warn+0xd8/0xf0)\n  [<c011dab4>] (__warn) from [<c011db10>] (warn_slowpath_fmt+0x44/0x6c)\n  [<c011db10>] (warn_slowpath_fmt) from [<c043898c>] (clk_core_enable+0x2c/0x1b0)\n  [<c043898c>] (clk_core_enable) from [<c0439ec8>] (clk_core_enable_lock+0x18/0x2c)\n  [<c0439ec8>] (clk_core_enable_lock) from [<c0436698>] (pxa168fb_probe+0x464/0x6ac)\n  [<c0436698>] (pxa168fb_probe) from [<c04779a0>] (platform_drv_probe+0x48/0x94)\n  [<c04779a0>] (platform_drv_probe) from [<c0475bec>] (driver_probe_device+0x328/0x470)\n  [<c0475bec>] (driver_probe_device) from [<c0475de4>] (__driver_attach+0xb0/0x124)\n  [<c0475de4>] (__driver_attach) from [<c0473c38>] (bus_for_each_dev+0x64/0xa0)\n  [<c0473c38>] (bus_for_each_dev) from [<c0474ee0>] (bus_add_driver+0x1b8/0x230)\n  [<c0474ee0>] (bus_add_driver) from [<c0476a20>] (driver_register+0xac/0xf0)\n  [<c0476a20>] (driver_register) from [<c0102dd4>] (do_one_initcall+0xb8/0x1f0)\n  [<c0102dd4>] (do_one_initcall) from [<c0b010a0>] (kernel_init_freeable+0x294/0x2e0)\n  [<c0b010a0>] (kernel_init_freeable) from [<c07e9eb8>] (kernel_init+0x8/0x10c)\n  [<c07e9eb8>] (kernel_init) from [<c01010e8>] (ret_from_fork+0x14/0x2c)\n  Exception stack(0xd008bfb0 to 0xd008bff8)\n  bfa0:                                     00000000 00000000 00000000 00000000\n  bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000\n  bfe0: 00000000 00000000 00000000 00000000 00000013 00000000\n  ---[ end trace c0af40f9e2ed7cb4 ]---\n\nSigned-off-by: Lubomir Rintel <lkundrak@v3.sk>\n[b.zolnierkie: enhance patch description a bit]\nSigned-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/df2d090bc5df33e92b43b2134d118fc60e2e0c97"},{"sha":"644d1918531ba9d6efa74e2228df8f0dd7002b53","author":{"name":"Florian Fainelli","email":"59190c1867e3222b932a0de3c668eb2d980d69a2@gmail.com"},"message":"asix: Check for supported Wake-on-LAN modes\n\n[ Upstream commit c4ce446e33d7a0e978256ac6fea4c80e59d9de5f ]\n\nThe driver currently silently accepts unsupported Wake-on-LAN modes\n(other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user,\nwhich is confusing.\n\nFixes: 2e55cc7210fe (\"[PATCH] USB: usbnet (3/9) module for ASIX Ethernet adapters\")\nSigned-off-by: Florian Fainelli <f.fainelli@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/644d1918531ba9d6efa74e2228df8f0dd7002b53"},{"sha":"f3d71a323f51d033929ed70b53bd4bca27c7da3c","author":{"name":"Florian Fainelli","email":"59190c1867e3222b932a0de3c668eb2d980d69a2@gmail.com"},"message":"ax88179_178a: Check for supported Wake-on-LAN modes\n\n[ Upstream commit 5ba6b4aa9a410c5e2c6417df52b5e2118ea9b467 ]\n\nThe driver currently silently accepts unsupported Wake-on-LAN modes\n(other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user,\nwhich is confusing.\n\nFixes: e2ca90c276e1 (\"ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver\")\nSigned-off-by: Florian Fainelli <f.fainelli@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/f3d71a323f51d033929ed70b53bd4bca27c7da3c"},{"sha":"04d846cddb4a941b5dc5b49b677736eb0c9e8431","author":{"name":"Florian Fainelli","email":"59190c1867e3222b932a0de3c668eb2d980d69a2@gmail.com"},"message":"lan78xx: Check for supported Wake-on-LAN modes\n\n[ Upstream commit eb9ad088f96653a26b340f7c447c44cf023d5cdc ]\n\nThe driver supports a fair amount of Wake-on-LAN modes, but is not\nchecking that the user specified one that is supported.\n\nFixes: 55d7de9de6c3 (\"Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver\")\nSigned-off-by: Florian Fainelli <f.fainelli@gmail.com>\nReviewed-by: Woojung Huh <Woojung.Huh@Microchip.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/04d846cddb4a941b5dc5b49b677736eb0c9e8431"},{"sha":"24665cbd768ad4b923cce0347d9905db504048fd","author":{"name":"Florian Fainelli","email":"59190c1867e3222b932a0de3c668eb2d980d69a2@gmail.com"},"message":"sr9800: Check for supported Wake-on-LAN modes\n\n[ Upstream commit c5cb93e994ffb43b7b3b1ff10b9f928f54574a36 ]\n\nThe driver currently silently accepts unsupported Wake-on-LAN modes\n(other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user,\nwhich is confusing.\n\nFixes: 19a38d8e0aa3 (\"USB2NET : SR9800 : One chip USB2.0 USB2NET SR9800 Device Driver Support\")\nSigned-off-by: Florian Fainelli <f.fainelli@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/24665cbd768ad4b923cce0347d9905db504048fd"},{"sha":"2bb181d8a8ec755e5f977fe8e74fc81e86f7af4d","author":{"name":"Florian Fainelli","email":"59190c1867e3222b932a0de3c668eb2d980d69a2@gmail.com"},"message":"r8152: Check for supported Wake-on-LAN Modes\n\n[ Upstream commit f2750df1548bd8a2b060eb609fc43ca82811af4c ]\n\nThe driver does not check for Wake-on-LAN modes specified by an user,\nbut will conditionally set the device as wake-up enabled or not based on\nthat, which could be a very confusing user experience.\n\nFixes: 21ff2e8976b1 (\"r8152: support WOL\")\nSigned-off-by: Florian Fainelli <f.fainelli@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/2bb181d8a8ec755e5f977fe8e74fc81e86f7af4d"},{"sha":"66e43f427d5d3ee003a3a5f38a8673b8c94e2b84","author":{"name":"Florian Fainelli","email":"59190c1867e3222b932a0de3c668eb2d980d69a2@gmail.com"},"message":"smsc75xx: Check for Wake-on-LAN modes\n\n[ Upstream commit 9c734b2769a73eea2e9e9767c0e0bf839ff23679 ]\n\nThe driver does not check for Wake-on-LAN modes specified by an user,\nbut will conditionally set the device as wake-up enabled or not based on\nthat, which could be a very confusing user experience.\n\nFixes: 6c636503260d (\"smsc75xx: add wol magic packet support\")\nSigned-off-by: Florian Fainelli <f.fainelli@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/66e43f427d5d3ee003a3a5f38a8673b8c94e2b84"},{"sha":"863fdd166500af2613aad12552cf4eb503845e47","author":{"name":"Florian Fainelli","email":"59190c1867e3222b932a0de3c668eb2d980d69a2@gmail.com"},"message":"smsc95xx: Check for Wake-on-LAN modes\n\n[ Upstream commit c530c471ba37bdd9fe1c7185b01455c00ae606fb ]\n\nThe driver does not check for Wake-on-LAN modes specified by an user,\nbut will conditionally set the device as wake-up enabled or not based on\nthat, which could be a very confusing user experience.\n\nFixes: e0e474a83c18 (\"smsc95xx: add wol magic packet support\")\nSigned-off-by: Florian Fainelli <f.fainelli@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/863fdd166500af2613aad12552cf4eb503845e47"},{"sha":"4f0336a8a0084e3bbddf71af87869aa9c612669a","author":{"name":"Jiri Olsa","email":"2c6594f608aa3d41e98d48846a6328831f7084ad@redhat.com"},"message":"perf/ring_buffer: Prevent concurent ring buffer access\n\n[ Upstream commit cd6fb677ce7e460c25bdd66f689734102ec7d642 ]\n\nSome of the scheduling tracepoints allow the perf_tp_event\ncode to write to ring buffer under different cpu than the\ncode is running on.\n\nThis results in corrupted ring buffer data demonstrated in\nfollowing perf commands:\n\n  # perf record -e 'sched:sched_switch,sched:sched_wakeup' perf bench sched messaging\n  # Running 'sched/messaging' benchmark:\n  # 20 sender and receiver processes per group\n  # 10 groups == 400 processes run\n\n       Total time: 0.383 [sec]\n  [ perf record: Woken up 8 times to write data ]\n  0x42b890 [0]: failed to process type: -1765585640\n  [ perf record: Captured and wrote 4.825 MB perf.data (29669 samples) ]\n\n  # perf report --stdio\n  0x42b890 [0]: failed to process type: -1765585640\n\nThe reason for the corruption are some of the scheduling tracepoints,\nthat have __perf_task dfined and thus allow to store data to another\ncpu ring buffer:\n\n  sched_waking\n  sched_wakeup\n  sched_wakeup_new\n  sched_stat_wait\n  sched_stat_sleep\n  sched_stat_iowait\n  sched_stat_blocked\n\nThe perf_tp_event function first store samples for current cpu\nrelated events defined for tracepoint:\n\n    hlist_for_each_entry_rcu(event, head, hlist_entry)\n      perf_swevent_event(event, count, &data, regs);\n\nAnd then iterates events of the 'task' and store the sample\nfor any task's event that passes tracepoint checks:\n\n  ctx = rcu_dereference(task->perf_event_ctxp[perf_sw_context]);\n\n  list_for_each_entry_rcu(event, &ctx->event_list, event_entry) {\n    if (event->attr.type != PERF_TYPE_TRACEPOINT)\n      continue;\n    if (event->attr.config != entry->type)\n      continue;\n\n    perf_swevent_event(event, count, &data, regs);\n  }\n\nAbove code can race with same code running on another cpu,\nending up with 2 cpus trying to store under the same ring\nbuffer, which is specifically not allowed.\n\nThis patch prevents the problem, by allowing only events with the same\ncurrent cpu to receive the event.\n\nNOTE: this requires the use of (per-task-)per-cpu buffers for this\nfeature to work; perf-record does this.\n\nSigned-off-by: Jiri Olsa <jolsa@kernel.org>\n[peterz: small edits to Changelog]\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Alexander Shishkin <alexander.shishkin@linux.intel.com>\nCc: Andrew Vagin <avagin@openvz.org>\nCc: Arnaldo Carvalho de Melo <acme@kernel.org>\nCc: Arnaldo Carvalho de Melo <acme@redhat.com>\nCc: Jiri Olsa <jolsa@redhat.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Namhyung Kim <namhyung@kernel.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Stephane Eranian <eranian@google.com>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Vince Weaver <vincent.weaver@maine.edu>\nFixes: e6dab5ffab59 (\"perf/trace: Add ability to set a target task for events\")\nLink: http://lkml.kernel.org/r/20180923161343.GB15054@krava\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/4f0336a8a0084e3bbddf71af87869aa9c612669a"},{"sha":"6596d0ab8c602b6bb9f4a8423ddd7fc3acb2418f","author":{"name":"Wenwen Wang","email":"bafc5a1ee344249d3957e4d34f33647904b567dc@umn.edu"},"message":"net: cxgb3_main: fix a missing-check bug\n\n[ Upstream commit 2c05d88818ab6571816b93edce4d53703870d7ae ]\n\nIn cxgb_extension_ioctl(), the command of the ioctl is firstly copied from\nthe user-space buffer 'useraddr' to 'cmd' and checked through the\nswitch statement. If the command is not as expected, an error code\nEOPNOTSUPP is returned. In the following execution, i.e., the cases of the\nswitch statement, the whole buffer of 'useraddr' is copied again to a\nspecific data structure, according to what kind of command is requested.\nHowever, after the second copy, there is no re-check on the newly-copied\ncommand. Given that the buffer 'useraddr' is in the user space, a malicious\nuser can race to change the command between the two copies. By doing so,\nthe attacker can supply malicious data to the kernel and cause undefined\nbehavior.\n\nThis patch adds a re-check in each case of the switch statement if there is\na second copy in that case, to re-check whether the command obtained in the\nsecond copy is the same as the one in the first copy. If not, an error code\nEINVAL is returned.\n\nSigned-off-by: Wenwen Wang <wang6495@umn.edu>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/6596d0ab8c602b6bb9f4a8423ddd7fc3acb2418f"},{"sha":"9aae17f851e2828de33fa4330cf519397c9aa2bf","author":{"name":"Eric Biggers","email":"6f6115196800bbe9712b3f04c7e40093bb382fc5@google.com"},"message":"KEYS: put keyring if install_session_keyring_to_cred() fails\n\n[ Upstream commit d636bd9f12a66ea3775c9fabbf3f8e118253467a ]\n\nIn join_session_keyring(), if install_session_keyring_to_cred() were to\nfail, we would leak the keyring reference, just like in the bug fixed by\ncommit 23567fd052a9 (\"KEYS: Fix keyring ref leak in\njoin_session_keyring()\").  Fortunately this cannot happen currently, but\nwe really should be more careful.  Do this by adding and using a new\nerror label at which the keyring reference is dropped.\n\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: James Morris <james.l.morris@oracle.com>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/9aae17f851e2828de33fa4330cf519397c9aa2bf"},{"sha":"997a4944ce4fdfc5a0ce3adee367ca5daff48244","author":{"name":"Johannes Berg","email":"bff32994ff0f8d048f262a8388145a71b6071bfe@intel.com"},"message":"ipv6: suppress sparse warnings in IP6_ECN_set_ce()\n\n[ Upstream commit c15c0ab12fd62f2b19181d05c62d24bc9fa55a42 ]\n\nPass the correct type __wsum to csum_sub() and csum_add(). This doesn't\nreally change anything since __wsum really *is* __be32, but removes the\naddress space warnings from sparse.\n\nCc: Eric Dumazet <edumazet@google.com>\nFixes: 34ae6a1aa054 (\"ipv6: update skb->csum when CE mark is propagated\")\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/sujitroy/kernel_asus_sdm660/commits/997a4944ce4fdfc5a0ce3adee367ca5daff48244"}]}
{"actor":{"display_login":"sujitroy"}}