{"push_id":4045386564,"size":27,"distinct_size":0,"ref":"refs/heads/caf/aosp-common/android-4.14","head":"ca30356b2a266d209b370aceac592c1e4e7fa243","before":"f02af7b02c26ab86b73422e93cba15ded11dbb56","commits":[{"sha":"3dd3ca376c0868a718999978fcf58c3a60853fd8","author":{"name":"Takashi Iwai","email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de"},"message":"ALSA: hda - Fix potential endless loop at applying quirks\n\ncommit 333f31436d3db19f4286f8862a00ea1d8d8420a1 upstream.\n\nSince the chained quirks via chained_before flag is applied before the\ndepth check, it may lead to the endless recursive calls, when the\nchain were set up incorrectly.  Fix it by moving the depth check at\nthe beginning of the loop.\n\nFixes: 1f57825077dc (\"ALSA: hda - Add chained_before flag to the fixup entry\")\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/3dd3ca376c0868a718999978fcf58c3a60853fd8"},{"sha":"29fa79cefe6faaf148bc936ed338c02f0bd582ec","author":{"name":"Takashi Iwai","email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de"},"message":"ALSA: hda/realtek - Fix overridden device-specific initialization\n\ncommit 89781d0806c2c4f29072d3f00cb2dd4274aabc3d upstream.\n\nThe recent change to shuffle the codec initialization procedure for\nRealtek via commit 607ca3bd220f (\"ALSA: hda/realtek - EAPD turn on\nlater\") caused the silent output on some machines.  This change was\nsupposed to be safe, but it isn't actually; some devices have quirk\nsetups to override the EAPD via COEF or BTL in the additional verb\ntable, which is applied at the beginning of snd_hda_gen_init().  And\nthis EAPD setup is again overridden in alc_auto_init_amp().\n\nFor recovering from the regression, tell snd_hda_gen_init() not to\napply the verbs there by a new flag, then apply the verbs in\nalc_init().\n\nBugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204727\nFixes: 607ca3bd220f (\"ALSA: hda/realtek - EAPD turn on later\")\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/29fa79cefe6faaf148bc936ed338c02f0bd582ec"},{"sha":"fe4d826a6e6acd5425b761fdbc5407d7629077d6","author":{"name":"Hui Wang","email":"51909cde9c974b33f1f2fb15bb7fd44a1b667281@canonical.com"},"message":"ALSA: hda/realtek - Fix the problem of two front mics on a ThinkCentre\n\ncommit 2a36c16efab254dd6017efeb35ad88ecc96f2328 upstream.\n\nThis ThinkCentre machine has a new realtek codec alc222, it is not\nin the support list, we add it in the realtek.c then this machine\ncan apply FIXUPs for the realtek codec.\n\nAnd this machine has two front mics which can't be handled\nby PA so far, it uses the pin 0x18 and 0x19 as the front mics, as\na result the existing FIXUP ALC294_FIXUP_LENOVO_MIC_LOCATION doesn't\nwork on this machine. Fortunately another FIXUP\nALC283_FIXUP_HEADSET_MIC also can change the location for one of the\ntwo mics on this machine.\n\nLink: https://lore.kernel.org/r/20190904055327.9883-1-hui.wang@canonical.com\nSigned-off-by: Hui Wang <hui.wang@canonical.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/fe4d826a6e6acd5425b761fdbc5407d7629077d6"},{"sha":"d33576c260b4075930ac29a4105626658fe2b650","author":{"name":"Liangyan","email":"786331b689a588e613a72168983d38cd6e7a9324@linux.alibaba.com"},"message":"sched/fair: Don't assign runtime for throttled cfs_rq\n\ncommit 5e2d2cc2588bd3307ce3937acbc2ed03c830a861 upstream.\n\ndo_sched_cfs_period_timer() will refill cfs_b runtime and call\ndistribute_cfs_runtime to unthrottle cfs_rq, sometimes cfs_b->runtime\nwill allocate all quota to one cfs_rq incorrectly, then other cfs_rqs\nattached to this cfs_b can't get runtime and will be throttled.\n\nWe find that one throttled cfs_rq has non-negative\ncfs_rq->runtime_remaining and cause an unexpetced cast from s64 to u64\nin snippet:\n\n  distribute_cfs_runtime() {\n    runtime = -cfs_rq->runtime_remaining + 1;\n  }\n\nThe runtime here will change to a large number and consume all\ncfs_b->runtime in this cfs_b period.\n\nAccording to Ben Segall, the throttled cfs_rq can have\naccount_cfs_rq_runtime called on it because it is throttled before\nidle_balance, and the idle_balance calls update_rq_clock to add time\nthat is accounted to the task.\n\nThis commit prevents cfs_rq to be assgined new runtime if it has been\nthrottled until that distribute_cfs_runtime is called.\n\nSigned-off-by: Liangyan <liangyan.peng@linux.alibaba.com>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nReviewed-by: Valentin Schneider <valentin.schneider@arm.com>\nReviewed-by: Ben Segall <bsegall@google.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: shanpeic@linux.alibaba.com\nCc: stable@vger.kernel.org\nCc: xlpang@linux.alibaba.com\nFixes: d3d9dc330236 (\"sched: Throttle entities exceeding their allowed bandwidth\")\nLink: https://lkml.kernel.org/r/20190826121633.6538-1-liangyan.peng@linux.alibaba.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/d33576c260b4075930ac29a4105626658fe2b650"},{"sha":"1fab51be84fdcae2287f34caad1a3828e056c9c1","author":{"name":"Dan Carpenter","email":"ff341aa343d564f9e53e9dcb6996be8c04859a66@oracle.com"},"message":"drm/vmwgfx: Fix double free in vmw_recv_msg()\n\ncommit 08b0c891605acf727e43e3e03a25857d3e789b61 upstream.\n\nWe recently added a kfree() after the end of the loop:\n\n\tif (retries == RETRIES) {\n\t\tkfree(reply);\n\t\treturn -EINVAL;\n\t}\n\nThere are two problems.  First the test is wrong and because retries\nequals RETRIES if we succeed on the last iteration through the loop.\nSecond if we fail on the last iteration through the loop then the kfree\nis a double free.\n\nWhen you're reading this code, please note the break statement at the\nend of the while loop.  This patch changes the loop so that if it's not\nsuccessful then \"reply\" is NULL and we can test for that afterward.\n\nCc: <stable@vger.kernel.org>\nFixes: 6b7c3b86f0b6 (\"drm/vmwgfx: fix memory leak when too many retries have occurred\")\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nReviewed-by: Thomas Hellstrom <thellstrom@vmware.com>\nSigned-off-by: Thomas Hellstrom <thellstrom@vmware.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/1fab51be84fdcae2287f34caad1a3828e056c9c1"},{"sha":"32b803e81ce17eec816f09d5388ef0a1cc9e4c2f","author":{"name":"Gustavo Romero","email":"ce43015c4046df936ab2a5b45f555e3b8ab74301@linux.ibm.com"},"message":"powerpc/tm: Fix FP/VMX unavailable exceptions inside a transaction\n\ncommit 8205d5d98ef7f155de211f5e2eb6ca03d95a5a60 upstream.\n\nWhen we take an FP unavailable exception in a transaction we have to\naccount for the hardware FP TM checkpointed registers being\nincorrect. In this case for this process we know the current and\ncheckpointed FP registers must be the same (since FP wasn't used\ninside the transaction) hence in the thread_struct we copy the current\nFP registers to the checkpointed ones.\n\nThis copy is done in tm_reclaim_thread(). We use thread->ckpt_regs.msr\nto determine if FP was on when in userspace. thread->ckpt_regs.msr\nrepresents the state of the MSR when exiting userspace. This is setup\nby check_if_tm_restore_required().\n\nUnfortunatley there is an optimisation in giveup_all() which returns\nearly if tsk->thread.regs->msr (via local variable `usermsr`) has\nFP=VEC=VSX=SPE=0. This optimisation means that\ncheck_if_tm_restore_required() is not called and hence\nthread->ckpt_regs.msr is not updated and will contain an old value.\n\nThis can happen if due to load_fp=255 we start a userspace process\nwith MSR FP=1 and then we are context switched out. In this case\nthread->ckpt_regs.msr will contain FP=1. If that same process is then\ncontext switched in and load_fp overflows, MSR will have FP=0. If that\nprocess now enters a transaction and does an FP instruction, the FP\nunavailable will not update thread->ckpt_regs.msr (the bug) and MSR\nFP=1 will be retained in thread->ckpt_regs.msr.  tm_reclaim_thread()\nwill then not perform the required memcpy and the checkpointed FP regs\nin the thread struct will contain the wrong values.\n\nThe code path for this happening is:\n\n       Userspace:                      Kernel\n                   Start userspace\n                    with MSR FP/VEC/VSX/SPE=0 TM=1\n                      < -----\n       ...\n       tbegin\n       bne\n       fp instruction\n                   FP unavailable\n                       ---- >\n                                        fp_unavailable_tm()\n\t\t\t\t\t  tm_reclaim_current()\n\t\t\t\t\t    tm_reclaim_thread()\n\t\t\t\t\t      giveup_all()\n\t\t\t\t\t        return early since FP/VMX/VSX=0\n\t\t\t\t\t\t/* ckpt MSR not updated (Incorrect) */\n\t\t\t\t\t      tm_reclaim()\n\t\t\t\t\t        /* thread_struct ckpt FP regs contain junk (OK) */\n                                              /* Sees ckpt MSR FP=1 (Incorrect) */\n\t\t\t\t\t      no memcpy() performed\n\t\t\t\t\t        /* thread_struct ckpt FP regs not fixed (Incorrect) */\n\t\t\t\t\t  tm_recheckpoint()\n\t\t\t\t\t     /* Put junk in hardware checkpoint FP regs */\n                                         ....\n                      < -----\n                   Return to userspace\n                     with MSR TM=1 FP=1\n                     with junk in the FP TM checkpoint\n       TM rollback\n       reads FP junk\n\nThis is a data integrity problem for the current process as the FP\nregisters are corrupted. It's also a security problem as the FP\nregisters from one process may be leaked to another.\n\nThis patch moves up check_if_tm_restore_required() in giveup_all() to\nensure thread->ckpt_regs.msr is updated correctly.\n\nA simple testcase to replicate this will be posted to\ntools/testing/selftests/powerpc/tm/tm-poison.c\n\nSimilarly for VMX.\n\nThis fixes CVE-2019-15030.\n\nFixes: f48e91e87e67 (\"powerpc/tm: Fix FP and VMX register corruption\")\nCc: stable@vger.kernel.org # 4.12+\nSigned-off-by: Gustavo Romero <gromero@linux.vnet.ibm.com>\nSigned-off-by: Michael Neuling <mikey@neuling.org>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nLink: https://lore.kernel.org/r/20190904045529.23002-1-gromero@linux.vnet.ibm.com\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/32b803e81ce17eec816f09d5388ef0a1cc9e4c2f"},{"sha":"cd393b38514dc3caa916db3b4405d592bfd3c9ea","author":{"name":"Cong Wang","email":"0f114804888b88d50037b04b42e57b858d851b87@gmail.com"},"message":"xfrm: clean up xfrm protocol checks\n\ncommit dbb2483b2a46fbaf833cfb5deb5ed9cace9c7399 upstream.\n\nIn commit 6a53b7593233 (\"xfrm: check id proto in validate_tmpl()\")\nI introduced a check for xfrm protocol, but according to Herbert\nIPSEC_PROTO_ANY should only be used as a wildcard for lookup, so\nit should be removed from validate_tmpl().\n\nAnd, IPSEC_PROTO_ANY is expected to only match 3 IPSec-specific\nprotocols, this is why xfrm_state_flush() could still miss\nIPPROTO_ROUTING, which leads that those entries are left in\nnet->xfrm.state_all before exit net. Fix this by replacing\nIPSEC_PROTO_ANY with zero.\n\nThis patch also extracts the check from validate_tmpl() to\nxfrm_id_proto_valid() and uses it in parse_ipsecrequest().\nWith this, no other protocols should be added into xfrm.\n\nFixes: 6a53b7593233 (\"xfrm: check id proto in validate_tmpl()\")\nReported-by: syzbot+0bf0519d6e0de15914fe@syzkaller.appspotmail.com\nCc: Steffen Klassert <steffen.klassert@secunet.com>\nCc: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nAcked-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: Zubin Mithra <zsm@chromium.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/cd393b38514dc3caa916db3b4405d592bfd3c9ea"},{"sha":"720a6817e131b1208263f1a951d0c8ee1982950a","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"ip6: fix skb leak in ip6frag_expire_frag_queue()\n\ncommit 47d3d7fdb10a21c223036b58bd70ffdc24a472c4 upstream.\n\nSince ip6frag_expire_frag_queue() now pulls the head skb\nfrom frag queue, we should no longer use skb_get(), since\nthis leads to an skb leak.\n\nStefan Bader initially reported a problem in 4.4.stable [1] caused\nby the skb_get(), so this patch should also fix this issue.\n\n296583.091021] kernel BUG at /build/linux-6VmqmP/linux-4.4.0/net/core/skbuff.c:1207!\n[296583.091734] Call Trace:\n[296583.091749]  [<ffffffff81740e50>] __pskb_pull_tail+0x50/0x350\n[296583.091764]  [<ffffffff8183939a>] _decode_session6+0x26a/0x400\n[296583.091779]  [<ffffffff817ec719>] __xfrm_decode_session+0x39/0x50\n[296583.091795]  [<ffffffff818239d0>] icmpv6_route_lookup+0xf0/0x1c0\n[296583.091809]  [<ffffffff81824421>] icmp6_send+0x5e1/0x940\n[296583.091823]  [<ffffffff81753238>] ? __netif_receive_skb+0x18/0x60\n[296583.091838]  [<ffffffff817532b2>] ? netif_receive_skb_internal+0x32/0xa0\n[296583.091858]  [<ffffffffc0199f74>] ? ixgbe_clean_rx_irq+0x594/0xac0 [ixgbe]\n[296583.091876]  [<ffffffffc04eb260>] ? nf_ct_net_exit+0x50/0x50 [nf_defrag_ipv6]\n[296583.091893]  [<ffffffff8183d431>] icmpv6_send+0x21/0x30\n[296583.091906]  [<ffffffff8182b500>] ip6_expire_frag_queue+0xe0/0x120\n[296583.091921]  [<ffffffffc04eb27f>] nf_ct_frag6_expire+0x1f/0x30 [nf_defrag_ipv6]\n[296583.091938]  [<ffffffff810f3b57>] call_timer_fn+0x37/0x140\n[296583.091951]  [<ffffffffc04eb260>] ? nf_ct_net_exit+0x50/0x50 [nf_defrag_ipv6]\n[296583.091968]  [<ffffffff810f5464>] run_timer_softirq+0x234/0x330\n[296583.091982]  [<ffffffff8108a339>] __do_softirq+0x109/0x2b0\n\nFixes: d4289fcc9b16 (\"net: IP6 defrag: use rbtrees for IPv6 defrag\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Stefan Bader <stefan.bader@canonical.com>\nCc: Peter Oskolkov <posk@google.com>\nCc: Florian Westphal <fw@strlen.de>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Baolin Wang <baolin.wang@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/720a6817e131b1208263f1a951d0c8ee1982950a"},{"sha":"ae85d34dd87144a4ab67d63e0ec7df35230f7f7c","author":{"name":"Niklas Cassel","email":"4a914ae964eab09bbb003e1bac3d416e6139afbd@axis.com"},"message":"PCI: designware-ep: Fix find_first_zero_bit() usage\n\ncommit ad4a5becc689c3f32bbbc2b37eff89efe19dc2f9 upstream.\n\nfind_first_zero_bit()'s parameter 'size' is defined in bits,\nnot in bytes.\n\nfind_first_zero_bit() is called with size in bytes rather than bits,\nwhich thus defines a too low upper limit, causing\ndw_pcie_ep_inbound_atu() to assign iatu index #4 to both bar 4\nand bar 5, which makes bar 5 overwrite the settings set by bar 4.\n\nSince the sizes of the bitmaps are known, dynamically allocate the\nbitmaps, and use the correct size when calling find_first_zero_bit().\n\nAdditionally, make sure that ep->num_ob_windows and ep->num_ib_windows,\nwhich are obtained from device tree, are smaller than the maximum number\nof iATUs (MAX_IATU_IN/MAX_IATU_OUT).\n\nFixes: f8aed6ec624f (\"PCI: dwc: designware: Add EP mode support\")\nSigned-off-by: Niklas Cassel <niklas.cassel@axis.com>\nSigned-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>\nAcked-by: Kishon Vijay Abraham I <kishon@ti.com>\nSigned-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/ae85d34dd87144a4ab67d63e0ec7df35230f7f7c"},{"sha":"b36199bc9dada09c082b0c47516bd59b8bc38c9b","author":{"name":"Vignesh R","email":"d9be9ca3f1b2d450305e034a370ae798faff7dfb@ti.com"},"message":"PCI: dra7xx: Fix legacy INTD IRQ handling\n\ncommit 524d59f6e30aab5b618da55e604c802ccd83e708 upstream.\n\nLegacy INTD IRQ handling is broken on dra7xx due to fact that driver\nuses hwirq in range of 1-4 for INTA, INTD whereas IRQ domain is of size\n4 which is numbered 0-3. Therefore when INTD IRQ line is used with\npci-dra7xx driver following warning is seen:\n\n       WARNING: CPU: 0 PID: 1 at kernel/irq/irqdomain.c:342 irq_domain_associate+0x12c/0x1c4\n       error: hwirq 0x4 is too large for dummy\n\nFix this by using pci_irqd_intx_xlate() helper to translate the INTx 1-4\nrange into the 0-3 as done in other PCIe drivers.\n\nSuggested-by: Bjorn Helgaas <bhelgaas@google.com>\nReported-by: Chris Welch <Chris.Welch@viavisolutions.com>\nSigned-off-by: Vignesh R <vigneshr@ti.com>\nSigned-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>\nAcked-by: Kishon Vijay Abraham I <kishon@ti.com>\nSigned-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/b36199bc9dada09c082b0c47516bd59b8bc38c9b"},{"sha":"e93482df922b2811bea65c8bbcbd1725c298ec5a","author":{"name":"Tiwei Bie","email":"f338cf29d7d69ff1bc99f755ebfb0eb0accd409e@intel.com"},"message":"vhost/test: fix build for vhost test\n\ncommit 264b563b8675771834419057cbe076c1a41fb666 upstream.\n\nSince vhost_exceeds_weight() was introduced, callers need to specify\nthe packet weight and byte weight in vhost_dev_init(). Note that, the\npacket weight isn't counted in this patch to keep the original behavior\nunchanged.\n\nFixes: e82b9b0727ff (\"vhost: introduce vhost_exceeds_weight()\")\nCc: stable@vger.kernel.org\nSigned-off-by: Tiwei Bie <tiwei.bie@intel.com>\nSigned-off-by: Michael S. Tsirkin <mst@redhat.com>\nAcked-by: Jason Wang <jasowang@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/e93482df922b2811bea65c8bbcbd1725c298ec5a"},{"sha":"89ea639a2ce5023ccfefc9a85dfd436523efe78f","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"batman-adv: fix uninit-value in batadv_netlink_get_ifindex()\n\ncommit 3ee1bb7aae97324ec9078da1f00cb2176919563f upstream.\n\nbatadv_netlink_get_ifindex() needs to make sure user passed\na correct u32 attribute.\n\nsyzbot reported :\nBUG: KMSAN: uninit-value in batadv_netlink_dump_hardif+0x70d/0x880 net/batman-adv/netlink.c:968\nCPU: 1 PID: 11705 Comm: syz-executor888 Not tainted 5.1.0+ #1\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x191/0x1f0 lib/dump_stack.c:113\n kmsan_report+0x130/0x2a0 mm/kmsan/kmsan.c:622\n __msan_warning+0x75/0xe0 mm/kmsan/kmsan_instr.c:310\n batadv_netlink_dump_hardif+0x70d/0x880 net/batman-adv/netlink.c:968\n genl_lock_dumpit+0xc6/0x130 net/netlink/genetlink.c:482\n netlink_dump+0xa84/0x1ab0 net/netlink/af_netlink.c:2253\n __netlink_dump_start+0xa3a/0xb30 net/netlink/af_netlink.c:2361\n genl_family_rcv_msg net/netlink/genetlink.c:550 [inline]\n genl_rcv_msg+0xfc1/0x1a40 net/netlink/genetlink.c:627\n netlink_rcv_skb+0x431/0x620 net/netlink/af_netlink.c:2486\n genl_rcv+0x63/0x80 net/netlink/genetlink.c:638\n netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]\n netlink_unicast+0xf3e/0x1020 net/netlink/af_netlink.c:1337\n netlink_sendmsg+0x127e/0x12f0 net/netlink/af_netlink.c:1926\n sock_sendmsg_nosec net/socket.c:651 [inline]\n sock_sendmsg net/socket.c:661 [inline]\n ___sys_sendmsg+0xcc6/0x1200 net/socket.c:2260\n __sys_sendmsg net/socket.c:2298 [inline]\n __do_sys_sendmsg net/socket.c:2307 [inline]\n __se_sys_sendmsg+0x305/0x460 net/socket.c:2305\n __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2305\n do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291\n entry_SYSCALL_64_after_hwframe+0x63/0xe7\nRIP: 0033:0x440209\n\nFixes: b60620cf567b (\"batman-adv: netlink: hardif query\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: Sven Eckelmann <sven@narfation.org>\nSigned-off-by: Simon Wunderlich <sw@simonwunderlich.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/89ea639a2ce5023ccfefc9a85dfd436523efe78f"},{"sha":"28400323ea2e541b22666dfd62b6836bc97d629b","author":{"name":"Sven Eckelmann","email":"dd860110a62b19214c4ee03aec0abffecb4e86b8@narfation.org"},"message":"batman-adv: Only read OGM tvlv_len after buffer len check\n\ncommit a15d56a60760aa9dbe26343b9a0ac5228f35d445 upstream.\n\nMultiple batadv_ogm_packet can be stored in an skbuff. The functions\nbatadv_iv_ogm_send_to_if()/batadv_iv_ogm_receive() use\nbatadv_iv_ogm_aggr_packet() to check if there is another additional\nbatadv_ogm_packet in the skb or not before they continue processing the\npacket.\n\nThe length for such an OGM is BATADV_OGM_HLEN +\nbatadv_ogm_packet->tvlv_len. The check must first check that at least\nBATADV_OGM_HLEN bytes are available before it accesses tvlv_len (which is\npart of the header. Otherwise it might try read outside of the currently\navailable skbuff to get the content of tvlv_len.\n\nFixes: ef26157747d4 (\"batman-adv: tvlv - basic infrastructure\")\nReported-by: syzbot+355cab184197dbbfa384@syzkaller.appspotmail.com\nSigned-off-by: Sven Eckelmann <sven@narfation.org>\nAcked-by: Antonio Quartulli <a@unstable.cc>\nSigned-off-by: Simon Wunderlich <sw@simonwunderlich.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/28400323ea2e541b22666dfd62b6836bc97d629b"},{"sha":"dd17277c2483db588c470df406f63059f3975432","author":{"name":"Dexuan Cui","email":"cd5c9304120b3aad8158bbc6888849d74dea1dde@microsoft.com"},"message":"hv_sock: Fix hang when a connection is closed\n\n[ Upstream commit 685703b497bacea8765bb409d6b73455b73c540e ]\n\nThere is a race condition for an established connection that is being closed\nby the guest: the refcnt is 4 at the end of hvs_release() (Note: here the\n'remove_sock' is false):\n\n1 for the initial value;\n1 for the sk being in the bound list;\n1 for the sk being in the connected list;\n1 for the delayed close_work.\n\nAfter hvs_release() finishes, __vsock_release() -> sock_put(sk) *may*\ndecrease the refcnt to 3.\n\nConcurrently, hvs_close_connection() runs in another thread:\n  calls vsock_remove_sock() to decrease the refcnt by 2;\n  call sock_put() to decrease the refcnt to 0, and free the sk;\n  next, the \"release_sock(sk)\" may hang due to use-after-free.\n\nIn the above, after hvs_release() finishes, if hvs_close_connection() runs\nfaster than \"__vsock_release() -> sock_put(sk)\", then there is not any issue,\nbecause at the beginning of hvs_close_connection(), the refcnt is still 4.\n\nThe issue can be resolved if an extra reference is taken when the\nconnection is established.\n\nFixes: a9eeb998c28d (\"hv_sock: Add support for delayed close\")\nSigned-off-by: Dexuan Cui <decui@microsoft.com>\nReviewed-by: Sunil Muthuswamy <sunilmut@microsoft.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/dd17277c2483db588c470df406f63059f3975432"},{"sha":"feb93a6160b173528bd8f66d957218e7e4a30e82","author":{"name":"Christophe Leroy","email":"4e2d3d12816ace76f1cfa36c1816509bd24cf089@c-s.fr"},"message":"powerpc/64: mark start_here_multiplatform as __ref\n\n[ Upstream commit 9c4e4c90ec24652921e31e9551fcaedc26eec86d ]\n\nOtherwise, the following warning is encountered:\n\nWARNING: vmlinux.o(.text+0x3dc6): Section mismatch in reference from the variable start_here_multiplatform to the function .init.text:.early_setup()\nThe function start_here_multiplatform() references\nthe function __init .early_setup().\nThis is often because start_here_multiplatform lacks a __init\nannotation or the annotation of .early_setup is wrong.\n\nFixes: 56c46bba9bbf (\"powerpc/64: Fix booting large kernels with STRICT_KERNEL_RWX\")\nCc: Russell Currey <ruscur@russell.cc>\nSigned-off-by: Christophe Leroy <christophe.leroy@c-s.fr>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/feb93a6160b173528bd8f66d957218e7e4a30e82"},{"sha":"dc28d6a0db194f4cebb4ecef987fa0bf71f8a161","author":{"name":"Dmitry Voytik","email":"4a9ce36bc8a227a4c464212bd6836022f48f6348@gmail.com"},"message":"arm64: dts: rockchip: enable usb-host regulators at boot on rk3328-rock64\n\n[ Upstream commit 26e2d7b03ea7ff254bf78305aa44dda62e70b78e ]\n\nAfter commit ef05bcb60c1a, boot from USB drives is broken.\nFix this problem by enabling usb-host regulators during boot time.\n\nFixes: ef05bcb60c1a (\"arm64: dts: rockchip: fix vcc_host1_5v pin assign on rk3328-rock64\")\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Voytik <voytikd@gmail.com>\nSigned-off-by: Heiko Stuebner <heiko@sntech.de>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/dc28d6a0db194f4cebb4ecef987fa0bf71f8a161"},{"sha":"b53ba116d607b037fc1f8e26dec3bd9fc0090cb4","author":{"name":"Nicolas Boichat","email":"f3daba1cdc403799935674d3cd4b0e5bd1804232@chromium.org"},"message":"scripts/decode_stacktrace: match basepath using shell prefix operator, not regex\n\n[ Upstream commit 31013836a71e07751a6827f9d2ad41ef502ddaff ]\n\nThe basepath may contain special characters, which would confuse the regex\nmatcher.  ${var#prefix} does the right thing.\n\nLink: http://lkml.kernel.org/r/20190518055946.181563-1-drinkcat@chromium.org\nFixes: 67a28de47faa8358 (\"scripts/decode_stacktrace: only strip base path when a prefix of the path\")\nSigned-off-by: Nicolas Boichat <drinkcat@chromium.org>\nReviewed-by: Stephen Boyd <swboyd@chromium.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/b53ba116d607b037fc1f8e26dec3bd9fc0090cb4"},{"sha":"2eff0ac931699b8d6b5eff7779da6ccad83812eb","author":{"name":"Nathan Chancellor","email":"f65d3f2dc139dcfe7b6f0b0a466af3bc5fed8fa7@gmail.com"},"message":"clk: s2mps11: Add used attribute to s2mps11_dt_match\n\n[ Upstream commit 9c940bbe2bb47e03ca5e937d30b6a50bf9c0e671 ]\n\nClang warns after commit 8985167ecf57 (\"clk: s2mps11: Fix matching when\nbuilt as module and DT node contains compatible\"):\n\ndrivers/clk/clk-s2mps11.c:242:34: warning: variable 's2mps11_dt_match'\nis not needed and will not be emitted [-Wunneeded-internal-declaration]\nstatic const struct of_device_id s2mps11_dt_match[] = {\n                                 ^\n1 warning generated.\n\nThis warning happens when a variable is used in some construct that\ndoesn't require a reference to that variable to be emitted in the symbol\ntable; in this case, it's MODULE_DEVICE_TABLE, which only needs to hold\nthe data of the variable, not the variable itself.\n\n$ nm -S drivers/clk/clk-s2mps11.o | rg s2mps11_dt_match\n00000078 000003d4 R __mod_of__s2mps11_dt_match_device_table\n\nNormally, with device ID table variables, it means that the variable\njust needs to be tied to the device declaration at the bottom of the\nfile, like s2mps11_clk_id:\n\n$ nm -S drivers/clk/clk-s2mps11.o | rg s2mps11_clk_id\n00000000 00000078 R __mod_platform__s2mps11_clk_id_device_table\n00000000 00000078 r s2mps11_clk_id\n\nHowever, because the comment above this deliberately doesn't want this\nvariable added to .of_match_table, we need to mark s2mps11_dt_match as\n__used to silence this warning. This makes it clear to Clang that the\nvariable is used for something, even if a reference to it isn't being\nemitted.\n\nSigned-off-by: Nathan Chancellor <natechancellor@gmail.com>\nFixes: 8985167ecf57 (\"clk: s2mps11: Fix matching when built as module and DT node contains compatible\")\nSigned-off-by: Stephen Boyd <sboyd@kernel.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/2eff0ac931699b8d6b5eff7779da6ccad83812eb"},{"sha":"5b53e102b9757b2f079d42f38e2c6a355ef380a7","author":{"name":"YueHaibing","email":"87ef4e6170d5e1d30adb7567acad1fcb98f93b6e@huawei.com"},"message":"kernel/module: Fix mem leak in module_add_modinfo_attrs\n\n[ Upstream commit bc6f2a757d525e001268c3658bd88822e768f8db ]\n\nIn module_add_modinfo_attrs if sysfs_create_file\nfails, we forget to free allocated modinfo_attrs\nand roll back the sysfs files.\n\nFixes: 03e88ae1b13d (\"[PATCH] fix module sysfs files reference counting\")\nReviewed-by: Miroslav Benes <mbenes@suse.cz>\nSigned-off-by: YueHaibing <yuehaibing@huawei.com>\nSigned-off-by: Jessica Yu <jeyu@kernel.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/5b53e102b9757b2f079d42f38e2c6a355ef380a7"},{"sha":"7e9480b480a57fb4ef2e4d2c2cddbb1a31d56b33","author":{"name":"yongduan","email":"5c89969f64cf9095e1f9aa318c462f3ca5633697@tencent.com"},"message":"vhost: make sure log_num < in_num\n\ncommit 060423bfdee3f8bc6e2c1bac97de24d5415e2bc4 upstream.\n\nThe code assumes log_num < in_num everywhere, and that is true as long as\nin_num is incremented by descriptor iov count, and log_num by 1. However\nthis breaks if there's a zero sized descriptor.\n\nAs a result, if a malicious guest creates a vring desc with desc.len = 0,\nit may cause the host kernel to crash by overflowing the log array. This\nbug can be triggered during the VM migration.\n\nThere's no need to log when desc.len = 0, so just don't increment log_num\nin this case.\n\nFixes: 3a4d5c94e959 (\"vhost_net: a kernel-level virtio server\")\nCc: stable@vger.kernel.org\nReviewed-by: Lidong Chen <lidongchen@tencent.com>\nSigned-off-by: ruippan <ruippan@tencent.com>\nSigned-off-by: yongduan <yongduan@tencent.com>\nAcked-by: Michael S. Tsirkin <mst@redhat.com>\nReviewed-by: Tyler Hicks <tyhicks@canonical.com>\nSigned-off-by: Michael S. Tsirkin <mst@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.10/commits/7e9480b480a57fb4ef2e4d2c2cddbb1a31d56b33"}]}
{"actor":{"display_login":"Jackeagle"}}