{"push_id":4290269666,"size":94,"distinct_size":1,"ref":"refs/heads/stock","head":"266d1cf982caf634920666947deec6ebf270f091","before":"ca1e0617abadc5e0c2406e5e86f8b701fc57509e","commits":[{"sha":"d2fd027baff8fbcefe82d094d5a1c593e697bb56","author":{"name":"Thomas Huth","email":"9e65be74847981e55b2564b6266c57d86d3bac05@redhat.com"},"message":"KVM: s390: Test for bad access register and size at the start of S390_MEM_OP\n\ncommit a13b03bbb4575b350b46090af4dfd30e735aaed1 upstream.\n\nIf the KVM_S390_MEM_OP ioctl is called with an access register >= 16,\nthen there is certainly a bug in the calling userspace application.\nWe check for wrong access registers, but only if the vCPU was already\nin the access register mode before (i.e. the SIE block has recorded\nit). The check is also buried somewhere deep in the calling chain (in\nthe function ar_translation()), so this is somewhat hard to find.\n\nIt's better to always report an error to the userspace in case this\nfield is set wrong, and it's safer in the KVM code if we block wrong\nvalues here early instead of relying on a check somewhere deep down\nthe calling chain, so let's add another check to kvm_s390_guest_mem_op()\ndirectly.\n\nWe also should check that the \"size\" is non-zero here (thanks to Janosch\nFrank for the hint!). If we do not check the size, we could call vmalloc()\nwith this 0 value, and this will cause a kernel warning.\n\nSigned-off-by: Thomas Huth <thuth@redhat.com>\nLink: https://lkml.kernel.org/r/20190829122517.31042-1-thuth@redhat.com\nReviewed-by: Cornelia Huck <cohuck@redhat.com>\nReviewed-by: Janosch Frank <frankja@linux.ibm.com>\nReviewed-by: David Hildenbrand <david@redhat.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Christian Borntraeger <borntraeger@de.ibm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/d2fd027baff8fbcefe82d094d5a1c593e697bb56"},{"sha":"6d222a8869842ec9baf6de716de31d12898654c6","author":{"name":"Vasily Gorbik","email":"fd6608149f5f589003abf198bcd5ef1b94afa26b@linux.ibm.com"},"message":"s390/topology: avoid firing events before kobjs are created\n\ncommit f3122a79a1b0a113d3aea748e0ec26f2cb2889de upstream.\n\narch_update_cpu_topology is first called from:\nkernel_init_freeable->sched_init_smp->sched_init_domains\n\neven before cpus has been registered in:\nkernel_init_freeable->do_one_initcall->s390_smp_init\n\nDo not trigger kobject_uevent change events until cpu devices are\nactually created. Fixes the following kasan findings:\n\nBUG: KASAN: global-out-of-bounds in kobject_uevent_env+0xb40/0xee0\nRead of size 8 at addr 0000000000000020 by task swapper/0/1\n\nBUG: KASAN: global-out-of-bounds in kobject_uevent_env+0xb36/0xee0\nRead of size 8 at addr 0000000000000018 by task swapper/0/1\n\nCPU: 0 PID: 1 Comm: swapper/0 Tainted: G    B\nHardware name: IBM 3906 M04 704 (LPAR)\nCall Trace:\n([<0000000143c6db7e>] show_stack+0x14e/0x1a8)\n [<0000000145956498>] dump_stack+0x1d0/0x218\n [<000000014429fb4c>] print_address_description+0x64/0x380\n [<000000014429f630>] __kasan_report+0x138/0x168\n [<0000000145960b96>] kobject_uevent_env+0xb36/0xee0\n [<0000000143c7c47c>] arch_update_cpu_topology+0x104/0x108\n [<0000000143df9e22>] sched_init_domains+0x62/0xe8\n [<000000014644c94a>] sched_init_smp+0x3a/0xc0\n [<0000000146433a20>] kernel_init_freeable+0x558/0x958\n [<000000014599002a>] kernel_init+0x22/0x160\n [<00000001459a71d4>] ret_from_fork+0x28/0x30\n [<00000001459a71dc>] kernel_thread_starter+0x0/0x10\n\nCc: stable@vger.kernel.org\nReviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>\nSigned-off-by: Vasily Gorbik <gor@linux.ibm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/6d222a8869842ec9baf6de716de31d12898654c6"},{"sha":"21876fca3f45d01e17087057c0043ad10e3b69e5","author":{"name":"Vasily Gorbik","email":"fd6608149f5f589003abf198bcd5ef1b94afa26b@linux.ibm.com"},"message":"s390/cio: avoid calling strlen on null pointer\n\ncommit ea298e6ee8b34b3ed4366be7eb799d0650ebe555 upstream.\n\nFix the following kasan finding:\nBUG: KASAN: global-out-of-bounds in ccwgroup_create_dev+0x850/0x1140\nRead of size 1 at addr 0000000000000000 by task systemd-udevd.r/561\n\nCPU: 30 PID: 561 Comm: systemd-udevd.r Tainted: G    B\nHardware name: IBM 3906 M04 704 (LPAR)\nCall Trace:\n([<0000000231b3db7e>] show_stack+0x14e/0x1a8)\n [<0000000233826410>] dump_stack+0x1d0/0x218\n [<000000023216fac4>] print_address_description+0x64/0x380\n [<000000023216f5a8>] __kasan_report+0x138/0x168\n [<00000002331b8378>] ccwgroup_create_dev+0x850/0x1140\n [<00000002332b618a>] group_store+0x3a/0x50\n [<00000002323ac706>] kernfs_fop_write+0x246/0x3b8\n [<00000002321d409a>] vfs_write+0x132/0x450\n [<00000002321d47da>] ksys_write+0x122/0x208\n [<0000000233877102>] system_call+0x2a6/0x2c8\n\nTriggered by:\nopenat(AT_FDCWD, \"/sys/bus/ccwgroup/drivers/qeth/group\",\n\t\tO_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0666) = 16\nwrite(16, \"0.0.bd00,0.0.bd01,0.0.bd02\", 26) = 26\n\nThe problem is that __get_next_id in ccwgroup_create_dev might set \"buf\"\nbuffer pointer to NULL and explicit check for that is required.\n\nCc: stable@vger.kernel.org\nReviewed-by: Sebastian Ott <sebott@linux.ibm.com>\nSigned-off-by: Vasily Gorbik <gor@linux.ibm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/21876fca3f45d01e17087057c0043ad10e3b69e5"},{"sha":"4e913928f3a8f235f7d781efd9065c0f81c766ad","author":{"name":"Vasily Gorbik","email":"fd6608149f5f589003abf198bcd5ef1b94afa26b@linux.ibm.com"},"message":"s390/cio: exclude subchannels with no parent from pseudo check\n\ncommit ab5758848039de9a4b249d46e4ab591197eebaf2 upstream.\n\nccw console is created early in start_kernel and used before css is\ninitialized or ccw console subchannel is registered. Until then console\nsubchannel does not have a parent. For that reason assume subchannels\nwith no parent are not pseudo subchannels. This fixes the following\nkasan finding:\n\nBUG: KASAN: global-out-of-bounds in sch_is_pseudo_sch+0x8e/0x98\nRead of size 8 at addr 00000000000005e8 by task swapper/0/0\n\nCPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.0-rc8-07370-g6ac43dd12538 #2\nHardware name: IBM 2964 NC9 702 (z/VM 6.4.0)\nCall Trace:\n([<000000000012cd76>] show_stack+0x14e/0x1e0)\n [<0000000001f7fb44>] dump_stack+0x1a4/0x1f8\n [<00000000007d7afc>] print_address_description+0x64/0x3c8\n [<00000000007d75f6>] __kasan_report+0x14e/0x180\n [<00000000018a2986>] sch_is_pseudo_sch+0x8e/0x98\n [<000000000189b950>] cio_enable_subchannel+0x1d0/0x510\n [<00000000018cac7c>] ccw_device_recognition+0x12c/0x188\n [<0000000002ceb1a8>] ccw_device_enable_console+0x138/0x340\n [<0000000002cf1cbe>] con3215_init+0x25e/0x300\n [<0000000002c8770a>] console_init+0x68a/0x9b8\n [<0000000002c6a3d6>] start_kernel+0x4fe/0x728\n [<0000000000100070>] startup_continue+0x70/0xd0\n\nCc: stable@vger.kernel.org\nReviewed-by: Sebastian Ott <sebott@linux.ibm.com>\nSigned-off-by: Vasily Gorbik <gor@linux.ibm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/4e913928f3a8f235f7d781efd9065c0f81c766ad"},{"sha":"db074ca6caf0b848cc708378ac9d6dd0f85a68cc","author":{"name":"Jack Wang","email":"5318d4131c3e14c217f7a13b953512ca706e6fe3@cloud.ionos.com"},"message":"KVM: nVMX: handle page fault in vmread fix\n\nDuring backport f7eea636c3d5 (\"KVM: nVMX: handle page fault in vmread\"),\nthere was a mistake the exception reference should be passed to function\nkvm_write_guest_virt_system, instead of NULL, other wise, we will get\nNULL pointer deref, eg\n\nkvm-unit-test triggered a NULL pointer deref below:\n[  948.518437] kvm [24114]: vcpu0, guest rIP: 0x407ef9 kvm_set_msr_common: MSR_IA32_DEBUGCTLMSR 0x3, nop\n[  949.106464] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000\n[  949.106707] PGD 0 P4D 0\n[  949.106872] Oops: 0002 [#1] SMP\n[  949.107038] CPU: 2 PID: 24126 Comm: qemu-2.7 Not tainted 4.19.77-pserver #4.19.77-1+feature+daily+update+20191005.1625+a4168bb~deb9\n[  949.107283] Hardware name: Dell Inc. Precision Tower 3620/09WH54, BIOS 2.7.3 01/31/2018\n[  949.107549] RIP: 0010:kvm_write_guest_virt_system+0x12/0x40 [kvm]\n[  949.107719] Code: c0 5d 41 5c 41 5d 41 5e 83 f8 03 41 0f 94 c0 41 c1 e0 02 e9 b0 ed ff ff 0f 1f 44 00 00 48 89 f0 c6 87 59 56 00 00 01 48 89 d6 <49> c7 00 00 00 00 00 89 ca 49 c7 40 08 00 00 00 00 49 c7 40 10 00\n[  949.108044] RSP: 0018:ffffb31b0a953cb0 EFLAGS: 00010202\n[  949.108216] RAX: 000000000046b4d8 RBX: ffff9e9f415b0000 RCX: 0000000000000008\n[  949.108389] RDX: ffffb31b0a953cc0 RSI: ffffb31b0a953cc0 RDI: ffff9e9f415b0000\n[  949.108562] RBP: 00000000d2e14928 R08: 0000000000000000 R09: 0000000000000000\n[  949.108733] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffffffffc8\n[  949.108907] R13: 0000000000000002 R14: ffff9e9f4f26f2e8 R15: 0000000000000000\n[  949.109079] FS:  00007eff8694c700(0000) GS:ffff9e9f51a80000(0000) knlGS:0000000031415928\n[  949.109318] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  949.109495] CR2: 0000000000000000 CR3: 00000003be53b002 CR4: 00000000003626e0\n[  949.109671] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  949.109845] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  949.110017] Call Trace:\n[  949.110186]  handle_vmread+0x22b/0x2f0 [kvm_intel]\n[  949.110356]  ? vmexit_fill_RSB+0xc/0x30 [kvm_intel]\n[  949.110549]  kvm_arch_vcpu_ioctl_run+0xa98/0x1b30 [kvm]\n[  949.110725]  ? kvm_vcpu_ioctl+0x388/0x5d0 [kvm]\n[  949.110901]  kvm_vcpu_ioctl+0x388/0x5d0 [kvm]\n[  949.111072]  do_vfs_ioctl+0xa2/0x620\n\nSigned-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>\nAcked-by: Paolo Bonzini <pbonzini@redhat.com>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/db074ca6caf0b848cc708378ac9d6dd0f85a68cc"},{"sha":"154129a3ac9b1216ad30ccfe8d9b78146752db4c","author":{"name":"Oleksandr Suvorov","email":"caaf30134c326e5f6ddb75ab35be997484563588@toradex.com"},"message":"ASoC: Define a set of DAPM pre/post-up events\n\ncommit cfc8f568aada98f9608a0a62511ca18d647613e2 upstream.\n\nPrepare to use SND_SOC_DAPM_PRE_POST_PMU definition to\nreduce coming code size and make it more readable.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Oleksandr Suvorov <oleksandr.suvorov@toradex.com>\nReviewed-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>\nReviewed-by: Igor Opaniuk <igor.opaniuk@toradex.com>\nReviewed-by: Fabio Estevam <festevam@gmail.com>\nLink: https://lore.kernel.org/r/20190719100524.23300-2-oleksandr.suvorov@toradex.com\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/154129a3ac9b1216ad30ccfe8d9b78146752db4c"},{"sha":"0e31027173296fb2f624b2ca9e903be5c23fdd64","author":{"name":"Andrew Donnellan","email":"44ca8c041ed925606732b2a0f30e5b73c32761a8@linux.ibm.com"},"message":"powerpc/powernv: Restrict OPAL symbol map to only be readable by root\n\ncommit e7de4f7b64c23e503a8c42af98d56f2a7462bd6d upstream.\n\nCurrently the OPAL symbol map is globally readable, which seems bad as\nit contains physical addresses.\n\nRestrict it to root.\n\nFixes: c8742f85125d (\"powerpc/powernv: Expose OPAL firmware symbol map\")\nCc: stable@vger.kernel.org # v3.19+\nSuggested-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Andrew Donnellan <ajd@linux.ibm.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nLink: https://lore.kernel.org/r/20190503075253.22798-1-ajd@linux.ibm.com\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/0e31027173296fb2f624b2ca9e903be5c23fdd64"},{"sha":"35f63f5172c0b26127099613e90d024e7acd5210","author":{"name":"Marc Kleine-Budde","email":"4a0ea1158d3cc63151119c05b1bff00c0bdbf421@pengutronix.de"},"message":"can: mcp251x: mcp251x_hw_reset(): allow more time after a reset\n\ncommit d84ea2123f8d27144e3f4d58cd88c9c6ddc799de upstream.\n\nSome boards take longer than 5ms to power up after a reset, so allow\nsome retries attempts before giving up.\n\nFixes: ff06d611a31c (\"can: mcp251x: Improve mcp251x_hw_reset()\")\nCc: linux-stable <stable@vger.kernel.org>\nTested-by: Sean Nyekjaer <sean@geanix.com>\nSigned-off-by: Marc Kleine-Budde <mkl@pengutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/35f63f5172c0b26127099613e90d024e7acd5210"},{"sha":"5c7f34aa0d53aa01d2eb11fac2cf3ab70810ac15","author":{"name":"Alexander Sverdlin","email":"dace7423e438e9d50a283477134876fe17cd3341@nokia.com"},"message":"crypto: qat - Silence smp_processor_id() warning\n\ncommit 1b82feb6c5e1996513d0fb0bbb475417088b4954 upstream.\n\nIt seems that smp_processor_id() is only used for a best-effort\nload-balancing, refer to qat_crypto_get_instance_node(). It's not feasible\nto disable preemption for the duration of the crypto requests. Therefore,\njust silence the warning. This commit is similar to e7a9b05ca4\n(\"crypto: cavium - Fix smp_processor_id() warnings\").\n\nSilences the following splat:\nBUG: using smp_processor_id() in preemptible [00000000] code: cryptomgr_test/2904\ncaller is qat_alg_ablkcipher_setkey+0x300/0x4a0 [intel_qat]\nCPU: 1 PID: 2904 Comm: cryptomgr_test Tainted: P           O    4.14.69 #1\n...\nCall Trace:\n dump_stack+0x5f/0x86\n check_preemption_disabled+0xd3/0xe0\n qat_alg_ablkcipher_setkey+0x300/0x4a0 [intel_qat]\n skcipher_setkey_ablkcipher+0x2b/0x40\n __test_skcipher+0x1f3/0xb20\n ? cpumask_next_and+0x26/0x40\n ? find_busiest_group+0x10e/0x9d0\n ? preempt_count_add+0x49/0xa0\n ? try_module_get+0x61/0xf0\n ? crypto_mod_get+0x15/0x30\n ? __kmalloc+0x1df/0x1f0\n ? __crypto_alloc_tfm+0x116/0x180\n ? crypto_skcipher_init_tfm+0xa6/0x180\n ? crypto_create_tfm+0x4b/0xf0\n test_skcipher+0x21/0xa0\n alg_test_skcipher+0x3f/0xa0\n alg_test.part.6+0x126/0x2a0\n ? finish_task_switch+0x21b/0x260\n ? __schedule+0x1e9/0x800\n ? __wake_up_common+0x8d/0x140\n cryptomgr_test+0x40/0x50\n kthread+0xff/0x130\n ? cryptomgr_notify+0x540/0x540\n ? kthread_create_on_node+0x70/0x70\n ret_from_fork+0x24/0x50\n\nFixes: ed8ccaef52 (\"crypto: qat - Add support for SRIOV\")\nCc: stable@vger.kernel.org\nSigned-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/5c7f34aa0d53aa01d2eb11fac2cf3ab70810ac15"},{"sha":"918a3058f095815eff127d23503a3f1ef7de98e9","author":{"name":"Kees Cook","email":"50cb10d2be062154b17ab4d66a4eab34f1cf1c84@chromium.org"},"message":"usercopy: Avoid HIGHMEM pfn warning\n\ncommit 314eed30ede02fa925990f535652254b5bad6b65 upstream.\n\nWhen running on a system with >512MB RAM with a 32-bit kernel built with:\n\n\tCONFIG_DEBUG_VIRTUAL=y\n\tCONFIG_HIGHMEM=y\n\tCONFIG_HARDENED_USERCOPY=y\n\nall execve()s will fail due to argv copying into kmap()ed pages, and on\nusercopy checking the calls ultimately of virt_to_page() will be looking\nfor \"bad\" kmap (highmem) pointers due to CONFIG_DEBUG_VIRTUAL=y:\n\n ------------[ cut here ]------------\n kernel BUG at ../arch/x86/mm/physaddr.c:83!\n invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC\n CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.3.0-rc8 #6\n Hardware name: Dell Inc. Inspiron 1318/0C236D, BIOS A04 01/15/2009\n EIP: __phys_addr+0xaf/0x100\n ...\n Call Trace:\n  __check_object_size+0xaf/0x3c0\n  ? __might_sleep+0x80/0xa0\n  copy_strings+0x1c2/0x370\n  copy_strings_kernel+0x2b/0x40\n  __do_execve_file+0x4ca/0x810\n  ? kmem_cache_alloc+0x1c7/0x370\n  do_execve+0x1b/0x20\n  ...\n\nThe check is from arch/x86/mm/physaddr.c:\n\n\tVIRTUAL_BUG_ON((phys_addr >> PAGE_SHIFT) > max_low_pfn);\n\nDue to the kmap() in fs/exec.c:\n\n\t\tkaddr = kmap(kmapped_page);\n\t...\n\tif (copy_from_user(kaddr+offset, str, bytes_to_copy)) ...\n\nNow we can fetch the correct page to avoid the pfn check. In both cases,\nhardened usercopy will need to walk the page-span checker (if enabled)\nto do sanity checking.\n\nReported-by: Randy Dunlap <rdunlap@infradead.org>\nTested-by: Randy Dunlap <rdunlap@infradead.org>\nFixes: f5509cc18daa (\"mm: Hardened usercopy\")\nCc: Matthew Wilcox <willy@infradead.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>\nLink: https://lore.kernel.org/r/201909171056.7F2FFD17@keescook\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/918a3058f095815eff127d23503a3f1ef7de98e9"},{"sha":"75be612c1e28d413e25f2acafb1754e9be7b5f90","author":{"name":"Li RongQing","email":"965d1e8acb10851f18858d35fe417400fefa6d90@baidu.com"},"message":"timer: Read jiffies once when forwarding base clk\n\ncommit e430d802d6a3aaf61bd3ed03d9404888a29b9bf9 upstream.\n\nThe timer delayed for more than 3 seconds warning was triggered during\ntesting.\n\n  Workqueue: events_unbound sched_tick_remote\n  RIP: 0010:sched_tick_remote+0xee/0x100\n  ...\n  Call Trace:\n   process_one_work+0x18c/0x3a0\n   worker_thread+0x30/0x380\n   kthread+0x113/0x130\n   ret_from_fork+0x22/0x40\n\nThe reason is that the code in collect_expired_timers() uses jiffies\nunprotected:\n\n    if (next_event > jiffies)\n        base->clk = jiffies;\n\nAs the compiler is allowed to reload the value base->clk can advance\nbetween the check and the store and in the worst case advance farther than\nnext event. That causes the timer expiry to be delayed until the wheel\npointer wraps around.\n\nConvert the code to use READ_ONCE()\n\nFixes: 236968383cf5 (\"timers: Optimize collect_expired_timers() for NOHZ\")\nSigned-off-by: Li RongQing <lirongqing@baidu.com>\nSigned-off-by: Liang ZhiCheng <liangzhicheng@baidu.com>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: stable@vger.kernel.org\nLink: https://lkml.kernel.org/r/1568894687-14499-1-git-send-email-lirongqing@baidu.com\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/75be612c1e28d413e25f2acafb1754e9be7b5f90"},{"sha":"156f149f7749d6f26163798389e0cbac501bc579","author":{"name":"Rasmus Villemoes","email":"ba324ca7b1c77fc20bb970d5aff6eea9377918a5@rasmusvillemoes.dk"},"message":"watchdog: imx2_wdt: fix min() calculation in imx2_wdt_set_timeout\n\ncommit 144783a80cd2cbc45c6ce17db649140b65f203dd upstream.\n\nConverting from ms to s requires dividing by 1000, not multiplying. So\nthis is currently taking the smaller of new_timeout and 1.28e8,\ni.e. effectively new_timeout.\n\nThe driver knows what it set max_hw_heartbeat_ms to, so use that\nvalue instead of doing a division at run-time.\n\nFWIW, this can easily be tested by booting into a busybox shell and\ndoing \"watchdog -t 5 -T 130 /dev/watchdog\" - without this patch, the\nwatchdog fires after 130&127 == 2 seconds.\n\nFixes: b07e228eee69 \"watchdog: imx2_wdt: Fix set_timeout for big timeout values\"\nCc: stable@vger.kernel.org # 5.2 plus anything the above got backported to\nSigned-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>\nReviewed-by: Guenter Roeck <linux@roeck-us.net>\nLink: https://lore.kernel.org/r/20190812131356.23039-1-linux@rasmusvillemoes.dk\nSigned-off-by: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/156f149f7749d6f26163798389e0cbac501bc579"},{"sha":"2f2f3ffa761793f2db2f3b0bc6476a069061cb9c","author":{"name":"Johan Hovold","email":"759412786bc533369b22377bf83fb9056c5b25b2@kernel.org"},"message":"ieee802154: atusb: fix use-after-free at disconnect\n\ncommit 7fd25e6fc035f4b04b75bca6d7e8daa069603a76 upstream.\n\nThe disconnect callback was accessing the hardware-descriptor private\ndata after having having freed it.\n\nFixes: 7490b008d123 (\"ieee802154: add support for atusb transceiver\")\nCc: stable <stable@vger.kernel.org>     # 4.2\nCc: Alexander Aring <alex.aring@gmail.com>\nReported-by: syzbot+f4509a9138a1472e7e80@syzkaller.appspotmail.com\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Stefan Schmidt <stefan@datenfreihafen.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/2f2f3ffa761793f2db2f3b0bc6476a069061cb9c"},{"sha":"eec7ef3096bfbf58c3a4ce4cf822605ead62ccb7","author":{"name":"Johannes Berg","email":"bff32994ff0f8d048f262a8388145a71b6071bfe@intel.com"},"message":"cfg80211: initialize on-stack chandefs\n\ncommit f43e5210c739fe76a4b0ed851559d6902f20ceb1 upstream.\n\nIn a few places we don't properly initialize on-stack chandefs,\nresulting in EDMG data to be non-zero, which broke things.\n\nAdditionally, in a few places we rely on the driver to init the\ndata completely, but perhaps we shouldn't as non-EDMG drivers\nmay not initialize the EDMG data, also initialize it there.\n\nCc: stable@vger.kernel.org\nFixes: 2a38075cd0be (\"nl80211: Add support for EDMG channels\")\nReported-by: Dmitry Osipenko <digetx@gmail.com>\nTested-by: Dmitry Osipenko <digetx@gmail.com>\nLink: https://lore.kernel.org/r/1569239475-I2dcce394ecf873376c386a78f31c2ec8b538fa25@changeid\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/eec7ef3096bfbf58c3a4ce4cf822605ead62ccb7"},{"sha":"1e42dec1953c165755759b92fca3dc0cdcfbd657","author":{"name":"Sascha Hauer","email":"c00cbc2b736c26791a3822db86f8796fe9efff67@pengutronix.de"},"message":"ima: always return negative code for error\n\n[ Upstream commit f5e1040196dbfe14c77ce3dfe3b7b08d2d961e88 ]\n\nintegrity_kernel_read() returns the number of bytes read. If this is\na short read then this positive value is returned from\nima_calc_file_hash_atfm(). Currently this is only indirectly called from\nima_calc_file_hash() and this function only tests for the return value\nbeing zero or nonzero and also doesn't forward the return value.\nNevertheless there's no point in returning a positive value as an error,\nso translate a short read into -EINVAL.\n\nSigned-off-by: Sascha Hauer <s.hauer@pengutronix.de>\nSigned-off-by: Mimi Zohar <zohar@linux.ibm.com>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/1e42dec1953c165755759b92fca3dc0cdcfbd657"},{"sha":"14793a8ff6239f30073960f4016166580aa56013","author":{"name":"Jia-Ju Bai","email":"4f6d392e422d1b8f381e5a7c1b9b3c46d9851e8b@gmail.com"},"message":"fs: nfs: Fix possible null-pointer dereferences in encode_attrs()\n\n[ Upstream commit e2751463eaa6f9fec8fea80abbdc62dbc487b3c5 ]\n\nIn encode_attrs(), there is an if statement on line 1145 to check\nwhether label is NULL:\n    if (label && (attrmask[2] & FATTR4_WORD2_SECURITY_LABEL))\n\nWhen label is NULL, it is used on lines 1178-1181:\n    *p++ = cpu_to_be32(label->lfs);\n    *p++ = cpu_to_be32(label->pi);\n    *p++ = cpu_to_be32(label->len);\n    p = xdr_encode_opaque_fixed(p, label->label, label->len);\n\nTo fix these bugs, label is checked before being used.\n\nThese bugs are found by a static analysis tool STCheck written by us.\n\nSigned-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>\nSigned-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/14793a8ff6239f30073960f4016166580aa56013"},{"sha":"16a56a80c71720a055a815d4cb078955dec025ec","author":{"name":"Chengguang Xu","email":"8ebc0bfff0a70eab65388e77d52e77c065b8e864@zoho.com.cn"},"message":"9p: avoid attaching writeback_fid on mmap with type PRIVATE\n\n[ Upstream commit c87a37ebd40b889178664c2c09cc187334146292 ]\n\nCurrently on mmap cache policy, we always attach writeback_fid\nwhether mmap type is SHARED or PRIVATE. However, in the use case\nof kata-container which combines 9p(Guest OS) with overlayfs(Host OS),\nthis behavior will trigger overlayfs' copy-up when excute command\ninside container.\n\nLink: http://lkml.kernel.org/r/20190820100325.10313-1-cgxu519@zoho.com.cn\nSigned-off-by: Chengguang Xu <cgxu519@zoho.com.cn>\nSigned-off-by: Dominique Martinet <dominique.martinet@cea.fr>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/16a56a80c71720a055a815d4cb078955dec025ec"},{"sha":"6fdcfc060e3e61f0714c56158675cdf99d052221","author":{"name":"Igor Druzhinin","email":"784725034387df2329b632f671cc72728f84f887@citrix.com"},"message":"xen/pci: reserve MCFG areas earlier\n\n[ Upstream commit a4098bc6eed5e31e0391bcc068e61804c98138df ]\n\nIf MCFG area is not reserved in E820, Xen by default will defer its usage\nuntil Dom0 registers it explicitly after ACPI parser recognizes it as\na reserved resource in DSDT. Having it reserved in E820 is not\nmandatory according to \"PCI Firmware Specification, rev 3.2\" (par. 4.1.2)\nand firmware is free to keep a hole in E820 in that place. Xen doesn't know\nwhat exactly is inside this hole since it lacks full ACPI view of the\nplatform therefore it's potentially harmful to access MCFG region\nwithout additional checks as some machines are known to provide\ninconsistent information on the size of the region.\n\nNow xen_mcfg_late() runs after acpi_init() which is too late as some basic\nPCI enumeration starts exactly there as well. Trying to register a device\nprior to MCFG reservation causes multiple problems with PCIe extended\ncapability initializations in Xen (e.g. SR-IOV VF BAR sizing). There are\nno convenient hooks for us to subscribe to so register MCFG areas earlier\nupon the first invocation of xen_add_device(). It should be safe to do once\nsince all the boot time buses must have their MCFG areas in MCFG table\nalready and we don't support PCI bus hot-plug.\n\nSigned-off-by: Igor Druzhinin <igor.druzhinin@citrix.com>\nReviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nSigned-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/6fdcfc060e3e61f0714c56158675cdf99d052221"},{"sha":"3f2533b6abf76f26e3c247b6e41964d2c23a3e17","author":{"name":"Luis Henriques","email":"970f1ed5a2c9fbd0b464b57d4c5592f81fb91ff0@suse.com"},"message":"ceph: fix directories inode i_blkbits initialization\n\n[ Upstream commit 750670341a24cb714e624e0fd7da30900ad93752 ]\n\nWhen filling an inode with info from the MDS, i_blkbits is being\ninitialized using fl_stripe_unit, which contains the stripe unit in\nbytes.  Unfortunately, this doesn't make sense for directories as they\nhave fl_stripe_unit set to '0'.  This means that i_blkbits will be set\nto 0xff, causing an UBSAN undefined behaviour in i_blocksize():\n\n  UBSAN: Undefined behaviour in ./include/linux/fs.h:731:12\n  shift exponent 255 is too large for 32-bit type 'int'\n\nFix this by initializing i_blkbits to CEPH_BLOCK_SHIFT if fl_stripe_unit\nis zero.\n\nSigned-off-by: Luis Henriques <lhenriques@suse.com>\nReviewed-by: Jeff Layton <jlayton@kernel.org>\nSigned-off-by: Ilya Dryomov <idryomov@gmail.com>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/3f2533b6abf76f26e3c247b6e41964d2c23a3e17"},{"sha":"60991fefbbed8a26ef0ddfba1b1ab42435954ea4","author":{"name":"Erqi Chen","email":"795592a8b7c4f01039ead394086cc4f6fb36ff82@gmail.com"},"message":"ceph: reconnect connection if session hang in opening state\n\n[ Upstream commit 71a228bc8d65900179e37ac309e678f8c523f133 ]\n\nIf client mds session is evicted in CEPH_MDS_SESSION_OPENING state,\nmds won't send session msg to client, and delayed_work skip\nCEPH_MDS_SESSION_OPENING state session, the session hang forever.\n\nAllow ceph_con_keepalive to reconnect a session in OPENING to avoid\nsession hang. Also, ensure that we skip sessions in RESTARTING and\nREJECTED states since those states can't be resurrected by issuing\na keepalive.\n\nLink: https://tracker.ceph.com/issues/41551\nSigned-off-by: Erqi Chen chenerqi@gmail.com\nReviewed-by: \"Yan, Zheng\" <zyan@redhat.com>\nSigned-off-by: Jeff Layton <jlayton@kernel.org>\nSigned-off-by: Ilya Dryomov <idryomov@gmail.com>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":false,"url":"https://api.github.com/repos/mylove90/android_kernel_xiaomi_onc/commits/60991fefbbed8a26ef0ddfba1b1ab42435954ea4"}]}
{"actor":{"display_login":"mylove90"}}