{"push_id":2223529620,"size":203,"distinct_size":0,"ref":"refs/heads/c8.1","head":"c1b52d21d336e8a482fc9c658b47284b2c7ad427","before":"db8497bea1fd571a781274fa88758fcc2dfd0afc","commits":[{"sha":"8166486b5c28b39a2a4854b120367cc102f6c8e2","author":{"name":"Dan Cartier","email":"6160358b46512acc0ce0f09fa799a1678cf92ef4@gmail.com"},"message":"defconfig: NSD-Candy\n\nWoven from fibers of rabid wolves' fur, composed of a million\nshards of glass from centuries of broken BrewHaus mugs, and incarnated\nusing a 10 Terawatt \"Never Settle...\" Van der Graaf generator.\n\nIn other words... Thanks to Martin, GzR and OP for the kernel base!","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/8166486b5c28b39a2a4854b120367cc102f6c8e2"},{"sha":"c7f8dfa22463395effd27e0d763c0e77b6d05244","author":{"name":"NoSpamDan","email":"b5950096b3a2f98790058fd7fd4b39a269601c6a@users.noreply.github.com"},"message":"Merge pull request #2 from GZR-Kernels/8.0\n\n4.4.97 upstream","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/c7f8dfa22463395effd27e0d763c0e77b6d05244"},{"sha":"2a2665dec58d35de9ab5a9c197ac3d55afd37886","author":{"name":"NoSpamDan","email":"b5950096b3a2f98790058fd7fd4b39a269601c6a@users.noreply.github.com"},"message":"Merge pull request #3 from GZR-Kernels/8.0\n\nLinux 4.4.98","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/2a2665dec58d35de9ab5a9c197ac3d55afd37886"},{"sha":"43cd7f38612df31fbd929588c065cfbc42102aab","author":{"name":"Eric Biggers","email":"0106d512ed1cb672be29d4b167a07ead51709fba@google.com"},"message":"crypto: hmac - require that the underlying hash algorithm is unkeyed\n\ncommit af3ff8045bbf3e32f1a448542e73abb4c8ceb6f1 upstream.\n\nBecause the HMAC template didn't check that its underlying hash\nalgorithm is unkeyed, trying to use \"hmac(hmac(sha3-512-generic))\"\nthrough AF_ALG or through KEYCTL_DH_COMPUTE resulted in the inner HMAC\nbeing used without having been keyed, resulting in sha3_update() being\ncalled without sha3_init(), causing a stack buffer overflow.\n\nThis is a very old bug, but it seems to have only started causing real\nproblems when SHA-3 support was added (requires CONFIG_CRYPTO_SHA3)\nbecause the innermost hash's state is ->import()ed from a zeroed buffer,\nand it just so happens that other hash algorithms are fine with that,\nbut SHA-3 is not.  However, there could be arch or hardware-dependent\nhash algorithms also affected; I couldn't test everything.\n\nFix the bug by introducing a function crypto_shash_alg_has_setkey()\nwhich tests whether a shash algorithm is keyed.  Then update the HMAC\ntemplate to require that its underlying hash algorithm is unkeyed.\n\nHere is a reproducer:\n\n    #include <linux/if_alg.h>\n    #include <sys/socket.h>\n\n    int main()\n    {\n        int algfd;\n        struct sockaddr_alg addr = {\n            .salg_type = \"hash\",\n            .salg_name = \"hmac(hmac(sha3-512-generic))\",\n        };\n        char key[4096] = { 0 };\n\n        algfd = socket(AF_ALG, SOCK_SEQPACKET, 0);\n        bind(algfd, (const struct sockaddr *)&addr, sizeof(addr));\n        setsockopt(algfd, SOL_ALG, ALG_SET_KEY, key, sizeof(key));\n    }\n\nHere was the KASAN report from syzbot:\n\n    BUG: KASAN: stack-out-of-bounds in memcpy include/linux/string.h:341  [inline]\n    BUG: KASAN: stack-out-of-bounds in sha3_update+0xdf/0x2e0  crypto/sha3_generic.c:161\n    Write of size 4096 at addr ffff8801cca07c40 by task syzkaller076574/3044\n\n    CPU: 1 PID: 3044 Comm: syzkaller076574 Not tainted 4.14.0-mm1+ #25\n    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  Google 01/01/2011\n    Call Trace:\n      __dump_stack lib/dump_stack.c:17 [inline]\n      dump_stack+0x194/0x257 lib/dump_stack.c:53\n      print_address_description+0x73/0x250 mm/kasan/report.c:252\n      kasan_report_error mm/kasan/report.c:351 [inline]\n      kasan_report+0x25b/0x340 mm/kasan/report.c:409\n      check_memory_region_inline mm/kasan/kasan.c:260 [inline]\n      check_memory_region+0x137/0x190 mm/kasan/kasan.c:267\n      memcpy+0x37/0x50 mm/kasan/kasan.c:303\n      memcpy include/linux/string.h:341 [inline]\n      sha3_update+0xdf/0x2e0 crypto/sha3_generic.c:161\n      crypto_shash_update+0xcb/0x220 crypto/shash.c:109\n      shash_finup_unaligned+0x2a/0x60 crypto/shash.c:151\n      crypto_shash_finup+0xc4/0x120 crypto/shash.c:165\n      hmac_finup+0x182/0x330 crypto/hmac.c:152\n      crypto_shash_finup+0xc4/0x120 crypto/shash.c:165\n      shash_digest_unaligned+0x9e/0xd0 crypto/shash.c:172\n      crypto_shash_digest+0xc4/0x120 crypto/shash.c:186\n      hmac_setkey+0x36a/0x690 crypto/hmac.c:66\n      crypto_shash_setkey+0xad/0x190 crypto/shash.c:64\n      shash_async_setkey+0x47/0x60 crypto/shash.c:207\n      crypto_ahash_setkey+0xaf/0x180 crypto/ahash.c:200\n      hash_setkey+0x40/0x90 crypto/algif_hash.c:446\n      alg_setkey crypto/af_alg.c:221 [inline]\n      alg_setsockopt+0x2a1/0x350 crypto/af_alg.c:254\n      SYSC_setsockopt net/socket.c:1851 [inline]\n      SyS_setsockopt+0x189/0x360 net/socket.c:1830\n      entry_SYSCALL_64_fastpath+0x1f/0x96\n\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/43cd7f38612df31fbd929588c065cfbc42102aab"},{"sha":"8a311b0462b59d12cb14e82e626d3612d988135b","author":{"name":"Eric Biggers","email":"0106d512ed1cb672be29d4b167a07ead51709fba@google.com"},"message":"crypto: salsa20 - fix blkcipher_walk API usage\n\ncommit ecaaab5649781c5a0effdaf298a925063020500e upstream.\n\nWhen asked to encrypt or decrypt 0 bytes, both the generic and x86\nimplementations of Salsa20 crash in blkcipher_walk_done(), either when\ndoing 'kfree(walk->buffer)' or 'free_page((unsigned long)walk->page)',\nbecause walk->buffer and walk->page have not been initialized.\n\nThe bug is that Salsa20 is calling blkcipher_walk_done() even when\nnothing is in 'walk.nbytes'.  But blkcipher_walk_done() is only meant to\nbe called when a nonzero number of bytes have been provided.\n\nThe broken code is part of an optimization that tries to make only one\ncall to salsa20_encrypt_bytes() to process inputs that are not evenly\ndivisible by 64 bytes.  To fix the bug, just remove this \"optimization\"\nand use the blkcipher_walk API the same way all the other users do.\n\nReproducer:\n\n    #include <linux/if_alg.h>\n    #include <sys/socket.h>\n    #include <unistd.h>\n\n    int main()\n    {\n            int algfd, reqfd;\n            struct sockaddr_alg addr = {\n                    .salg_type = \"skcipher\",\n                    .salg_name = \"salsa20\",\n            };\n            char key[16] = { 0 };\n\n            algfd = socket(AF_ALG, SOCK_SEQPACKET, 0);\n            bind(algfd, (void *)&addr, sizeof(addr));\n            reqfd = accept(algfd, 0, 0);\n            setsockopt(algfd, SOL_ALG, ALG_SET_KEY, key, sizeof(key));\n            read(reqfd, key, sizeof(key));\n    }\n\nReported-by: syzbot <syzkaller@googlegroups.com>\nFixes: eb6f13eb9f81 (\"[CRYPTO] salsa20_generic: Fix multi-page processing\")\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/8a311b0462b59d12cb14e82e626d3612d988135b"},{"sha":"c60db4f68593e381571fdf9e2111363e1793cdf4","author":{"name":"NeilBrown","email":"2d905a3497a379bccf401a15c6d441d61e66863c@suse.com"},"message":"autofs: fix careless error in recent commit\n\ncommit 302ec300ef8a545a7fc7f667e5fd743b091c2eeb upstream.\n\nCommit ecc0c469f277 (\"autofs: don't fail mount for transient error\") was\nmeant to replace an 'if' with a 'switch', but instead added the 'switch'\nleaving the case in place.\n\nLink: http://lkml.kernel.org/r/87zi6wstmw.fsf@notabene.neil.brown.name\nFixes: ecc0c469f277 (\"autofs: don't fail mount for transient error\")\nReported-by: Ben Hutchings <ben.hutchings@codethink.co.uk>\nSigned-off-by: NeilBrown <neilb@suse.com>\nCc: Ian Kent <raven@themaw.net>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/c60db4f68593e381571fdf9e2111363e1793cdf4"},{"sha":"a34419b3f6a277b4da240f7b7a5e8be4d5c2356b","author":{"name":"Changbin Du","email":"5f6b755b7a1cb5f1a44f6ef41b5dc943725490e0@intel.com"},"message":"tracing: Allocate mask_str buffer dynamically\n\ncommit 90e406f96f630c07d631a021fd4af10aac913e77 upstream.\n\nThe default NR_CPUS can be very large, but actual possible nr_cpu_ids\nusually is very small. For my x86 distribution, the NR_CPUS is 8192 and\nnr_cpu_ids is 4. About 2 pages are wasted.\n\nMost machines don't have so many CPUs, so define a array with NR_CPUS\njust wastes memory. So let's allocate the buffer dynamically when need.\n\nWith this change, the mutext tracing_cpumask_update_lock also can be\nremoved now, which was used to protect mask_str.\n\nLink: http://lkml.kernel.org/r/1512013183-19107-1-git-send-email-changbin.du@intel.com\n\nFixes: 36dfe9252bd4c (\"ftrace: make use of tracing_cpumask\")\nSigned-off-by: Changbin Du <changbin.du@intel.com>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/a34419b3f6a277b4da240f7b7a5e8be4d5c2356b"},{"sha":"05de6fa5c0e2fbbed4d41eaf2b474a863c544532","author":{"name":"David Kozub","email":"8d92f3fff8275a0fad56bc8fc43f95cd318a9b0b@linux.fjfi.cvut.cz"},"message":"USB: uas and storage: Add US_FL_BROKEN_FUA for another JMicron JMS567 ID\n\ncommit 62354454625741f0569c2cbe45b2d192f8fd258e upstream.\n\nThere is another JMS567-based USB3 UAS enclosure (152d:0578) that fails\nwith the following error:\n\n[sda] tag#0 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE\n[sda] tag#0 Sense Key : Illegal Request [current]\n[sda] tag#0 Add. Sense: Invalid field in cdb\n\nThe issue occurs both with UAS (occasionally) and mass storage\n(immediately after mounting a FS on a disk in the enclosure).\n\nEnabling US_FL_BROKEN_FUA quirk solves this issue.\n\nThis patch adds an UNUSUAL_DEV with US_FL_BROKEN_FUA for the enclosure\nfor both UAS and mass storage.\n\nSigned-off-by: David Kozub <zub@linux.fjfi.cvut.cz>\nAcked-by: Alan Stern <stern@rowland.harvard.edu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/05de6fa5c0e2fbbed4d41eaf2b474a863c544532"},{"sha":"dfdf5fa3e6647c0fc02be8d857b6b8b7098946ff","author":{"name":"Alan Stern","email":"5c4cbde65af01ad64f5b2177d0cd78ab5b01e5a1@rowland.harvard.edu"},"message":"USB: core: prevent malicious bNumInterfaces overflow\n\ncommit 48a4ff1c7bb5a32d2e396b03132d20d552c0eca7 upstream.\n\nA malicious USB device with crafted descriptors can cause the kernel\nto access unallocated memory by setting the bNumInterfaces value too\nhigh in a configuration descriptor.  Although the value is adjusted\nduring parsing, this adjustment is skipped in one of the error return\npaths.\n\nThis patch prevents the problem by setting bNumInterfaces to 0\ninitially.  The existing code already sets it to the proper value\nafter parsing is complete.\n\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/dfdf5fa3e6647c0fc02be8d857b6b8b7098946ff"},{"sha":"2862cfca39894ac265fbb5cde9a3ff90c02201f3","author":{"name":"Shuah Khan","email":"1a8b7edcfc00bb8cbbb1f50ab3153da93b81fdf3@osg.samsung.com"},"message":"usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer\n\ncommit be6123df1ea8f01ee2f896a16c2b7be3e4557a5a upstream.\n\nstub_send_ret_submit() handles urb with a potential null transfer_buffer,\nwhen it replays a packet with potential malicious data that could contain\na null buffer. Add a check for the condition when actual_length > 0 and\ntransfer_buffer is null.\n\nReported-by: Secunia Research <vuln@secunia.com>\nSigned-off-by: Shuah Khan <shuahkh@osg.samsung.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/2862cfca39894ac265fbb5cde9a3ff90c02201f3"},{"sha":"8c7c3d5b785f539da3f45920c7c1ab5de5727ba7","author":{"name":"Yan, Zheng","email":"4e33043b9e887a36cd530f51f0e1fa2ef4064591@redhat.com"},"message":"ceph: drop negative child dentries before try pruning inode's alias\n\ncommit 040d786032bf59002d374b86d75b04d97624005c upstream.\n\nNegative child dentry holds reference on inode's alias, it makes\nd_prune_aliases() do nothing.\n\nSigned-off-by: \"Yan, Zheng\" <zyan@redhat.com>\nReviewed-by: Jeff Layton <jlayton@redhat.com>\nSigned-off-by: Ilya Dryomov <idryomov@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/8c7c3d5b785f539da3f45920c7c1ab5de5727ba7"},{"sha":"ffc7565746bb2fc063fc0f484c55ef6d8951a6ee","author":{"name":"Sukumar Ghorai","email":"3e656f7c140e806224747163253f76f93d9c798c@intel.com"},"message":"Bluetooth: btusb: driver to enable the usb-wakeup feature\n\ncommit a0085f2510e8976614ad8f766b209448b385492f upstream.\n\nBT-Controller connected as platform non-root-hub device and\nusb-driver initialize such device with wakeup disabled,\nRef. usb_new_device().\n\nAt present wakeup-capability get enabled by hid-input device from usb\nfunction driver(e.g. BT HID device) at runtime. Again some functional\ndriver does not set usb-wakeup capability(e.g LE HID device implement\nas HID-over-GATT), and can't wakeup the host on USB.\n\nMost of the device operation (such as mass storage) initiated from host\n(except HID) and USB wakeup aligned with host resume procedure. For BT\ndevice, usb-wakeup capability need to enable form btusc driver as a\ngeneric solution for multiple profile use case and required for USB remote\nwakeup (in-bus wakeup) while host is suspended. Also usb-wakeup feature\nneed to enable/disable with HCI interface up and down.\n\nSigned-off-by: Sukumar Ghorai <sukumar.ghorai@intel.com>\nSigned-off-by: Amit K Bag <amit.k.bag@intel.com>\nAcked-by: Oliver Neukum <oneukum@suse.com>\nSigned-off-by: Marcel Holtmann <marcel@holtmann.org>\nCc: Matthias Kaehlcke <mka@chromium.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/ffc7565746bb2fc063fc0f484c55ef6d8951a6ee"},{"sha":"f98ee9c0007bfe8f4465fabc762372add67d18fb","author":{"name":"Mathias Nyman","email":"6f76a2d91b00c1a813d5588fd87cc784fe96486e@linux.intel.com"},"message":"xhci: Don't add a virt_dev to the devs array before it's fully allocated\n\ncommit 5d9b70f7d52eb14bb37861c663bae44de9521c35 upstream.\n\nAvoid null pointer dereference if some function is walking through the\ndevs array accessing members of a new virt_dev that is mid allocation.\n\nAdd the virt_dev to xhci->devs[i] _after_ the virt_device and all its\nmembers are properly allocated.\n\nissue found by KASAN: null-ptr-deref in xhci_find_slot_id_by_port\n\n\"Quick analysis suggests that xhci_alloc_virt_device() is not mutex\nprotected. If so, there is a time frame where xhci->devs[slot_id] is set\nbut not fully initialized. Specifically, xhci->devs[i]->udev can be NULL.\"\n\nSigned-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/f98ee9c0007bfe8f4465fabc762372add67d18fb"},{"sha":"af36d95af55f4bac94128875491671771d3d4916","author":{"name":"Steven Rostedt","email":"9f626a07de58780741a9085807c77fd646ef3459@goodmis.org"},"message":"sched/rt: Do not pull from current CPU if only one CPU to pull\n\ncommit f73c52a5bcd1710994e53fbccc378c42b97a06b6 upstream.\n\nDaniel Wagner reported a crash on the BeagleBone Black SoC.\n\nThis is a single CPU architecture, and does not have a functional\narch_send_call_function_single_ipi() implementation which can crash\nthe kernel if that is called.\n\nAs it only has one CPU, it shouldn't be called, but if the kernel is\ncompiled for SMP, the push/pull RT scheduling logic now calls it for\nirq_work if the one CPU is overloaded, it can use that function to call\nitself and crash the kernel.\n\nIdeally, we should disable the SCHED_FEAT(RT_PUSH_IPI) if the system\nonly has a single CPU. But SCHED_FEAT is a constant if sched debugging\nis turned off. Another fix can also be used, and this should also help\nwith normal SMP machines. That is, do not initiate the pull code if\nthere's only one RT overloaded CPU, and that CPU happens to be the\ncurrent CPU that is scheduling in a lower priority task.\n\nEven on a system with many CPUs, if there's many RT tasks waiting to\nrun on a single CPU, and that CPU schedules in another RT task of lower\npriority, it will initiate the PULL logic in case there's a higher\npriority RT task on another CPU that is waiting to run. But if there is\nno other CPU with waiting RT tasks, it will initiate the RT pull logic\non itself (as it still has RT tasks waiting to run). This is a wasted\neffort.\n\nNot only does this help with SMP code where the current CPU is the only\none with RT overloaded tasks, it should also solve the issue that\nDaniel encountered, because it will prevent the PULL logic from\nexecuting, as there's only one CPU on the system, and the check added\nhere will cause it to exit the RT pull code.\n\nReported-by: Daniel Wagner <wagi@monom.org>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nAcked-by: Peter Zijlstra <peterz@infradead.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: linux-rt-users <linux-rt-users@vger.kernel.org>\nFixes: 4bdced5c9 (\"sched/rt: Simplify the IPI based RT balancing logic\")\nLink: http://lkml.kernel.org/r/20171202130454.4cbbfe8d@vmware.local.home\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/af36d95af55f4bac94128875491671771d3d4916"},{"sha":"52425e042843c935f35480192610fca850283578","author":{"name":"Adam Wallis","email":"54271b36968162b8e3697fc2c5ab959b17f1aa90@codeaurora.org"},"message":"dmaengine: dmatest: move callback wait queue to thread context\n\ncommit 6f6a23a213be51728502b88741ba6a10cda2441d upstream.\n\nCommit adfa543e7314 (\"dmatest: don't use set_freezable_with_signal()\")\nintroduced a bug (that is in fact documented by the patch commit text)\nthat leaves behind a dangling pointer. Since the done_wait structure is\nallocated on the stack, future invocations to the DMATEST can produce\nundesirable results (e.g., corrupted spinlocks).\n\nCommit a9df21e34b42 (\"dmaengine: dmatest: warn user when dma test times\nout\") attempted to WARN the user that the stack was likely corrupted but\ndid not fix the actual issue.\n\nThis patch fixes the issue by pushing the wait queue and callback\nstructs into the the thread structure. If a failure occurs due to time,\ndmaengine_terminate_all will force the callback to safely call\nwake_up_all() without possibility of using a freed pointer.\n\nBug: https://bugzilla.kernel.org/show_bug.cgi?id=197605\nFixes: adfa543e7314 (\"dmatest: don't use set_freezable_with_signal()\")\nReviewed-by: Sinan Kaya <okaya@codeaurora.org>\nSuggested-by: Shunyong Yang <shunyong.yang@hxt-semitech.com>\nSigned-off-by: Adam Wallis <awallis@codeaurora.org>\nSigned-off-by: Vinod Koul <vinod.koul@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/52425e042843c935f35480192610fca850283578"},{"sha":"2c367edaba650af3d58fd68b6600fc4cbed77c1a","author":{"name":"Eryu Guan","email":"45502b4e6bb91b83dadf3368d4bc13ef83516b00@redhat.com"},"message":"ext4: fix fdatasync(2) after fallocate(2) operation\n\ncommit c894aa97577e47d3066b27b32499ecf899bfa8b0 upstream.\n\nCurrently, fallocate(2) with KEEP_SIZE followed by a fdatasync(2)\nthen crash, we'll see wrong allocated block number (stat -c %b), the\nblocks allocated beyond EOF are all lost. fstests generic/468\nexposes this bug.\n\nCommit 67a7d5f561f4 (\"ext4: fix fdatasync(2) after extent\nmanipulation operations\") fixed all the other extent manipulation\noperation paths such as hole punch, zero range, collapse range etc.,\nbut forgot the fallocate case.\n\nSo similarly, fix it by recording the correct journal tid in ext4\ninode in fallocate(2) path, so that ext4_sync_file() will wait for\nthe right tid to be committed on fdatasync(2).\n\nThis addresses the test failure in xfstests test generic/468.\n\nSigned-off-by: Eryu Guan <eguan@redhat.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/2c367edaba650af3d58fd68b6600fc4cbed77c1a"},{"sha":"ef7ce82bc28065fd916fc1c0f7e00c2151fcd8a0","author":{"name":"Chandan Rajendra","email":"0a920ebe0aa6bf1286a30051cd5bc35b8c220801@linux.vnet.ibm.com"},"message":"ext4: fix crash when a directory's i_size is too small\n\ncommit 9d5afec6b8bd46d6ed821aa1579634437f58ef1f upstream.\n\nOn a ppc64 machine, when mounting a fuzzed ext2 image (generated by\nfsfuzzer) the following call trace is seen,\n\nVFS: brelse: Trying to free free buffer\nWARNING: CPU: 1 PID: 6913 at /root/repos/linux/fs/buffer.c:1165 .__brelse.part.6+0x24/0x40\n.__brelse.part.6+0x20/0x40 (unreliable)\n.ext4_find_entry+0x384/0x4f0\n.ext4_lookup+0x84/0x250\n.lookup_slow+0xdc/0x230\n.walk_component+0x268/0x400\n.path_lookupat+0xec/0x2d0\n.filename_lookup+0x9c/0x1d0\n.vfs_statx+0x98/0x140\n.SyS_newfstatat+0x48/0x80\nsystem_call+0x58/0x6c\n\nThis happens because the directory that ext4_find_entry() looks up has\ninode->i_size that is less than the block size of the filesystem. This\ncauses 'nblocks' to have a value of zero. ext4_bread_batch() ends up not\nreading any of the directory file's blocks. This renders the entries in\nbh_use[] array to continue to have garbage data. buffer_uptodate() on\nbh_use[0] can then return a zero value upon which brelse() function is\ninvoked.\n\nThis commit fixes the bug by returning -ENOENT when the directory file\nhas no associated blocks.\n\nReported-by: Abdul Haleem <abdhalee@linux.vnet.ibm.com>\nSigned-off-by: Chandan Rajendra <chandan@linux.vnet.ibm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/ef7ce82bc28065fd916fc1c0f7e00c2151fcd8a0"},{"sha":"13e86efb2eee6bd1f2d0aae5b0273e8e65683c9d","author":{"name":"Eric Biggers","email":"0106d512ed1cb672be29d4b167a07ead51709fba@google.com"},"message":"KEYS: add missing permission check for request_key() destination\n\ncommit 4dca6ea1d9432052afb06baf2e3ae78188a4410b upstream.\n\nWhen the request_key() syscall is not passed a destination keyring, it\nlinks the requested key (if constructed) into the \"default\" request-key\nkeyring.  This should require Write permission to the keyring.  However,\nthere is actually no permission check.\n\nThis can be abused to add keys to any keyring to which only Search\npermission is granted.  This is because Search permission allows joining\nthe keyring.  keyctl_set_reqkey_keyring(KEY_REQKEY_DEFL_SESSION_KEYRING)\nthen will set the default request-key keyring to the session keyring.\nThen, request_key() can be used to add keys to the keyring.\n\nBoth negatively and positively instantiated keys can be added using this\nmethod.  Adding negative keys is trivial.  Adding a positive key is a\nbit trickier.  It requires that either /sbin/request-key positively\ninstantiates the key, or that another thread adds the key to the process\nkeyring at just the right time, such that request_key() misses it\ninitially but then finds it in construct_alloc_key().\n\nFix this bug by checking for Write permission to the keyring in\nconstruct_get_dest_keyring() when the default keyring is being used.\n\nWe don't do the permission check for non-default keyrings because that\nwas already done by the earlier call to lookup_user_key().  Also,\nrequest_key_and_link() is currently passed a 'struct key *' rather than\na key_ref_t, so the \"possessed\" bit is unavailable.\n\nWe also don't do the permission check for the \"requestor keyring\", to\ncontinue to support the use case described by commit 8bbf4976b59f\n(\"KEYS: Alter use of key instantiation link-to-keyring argument\") where\n/sbin/request-key recursively calls request_key() to add keys to the\noriginal requestor's destination keyring.  (I don't know of any users\nwho actually do that, though...)\n\nFixes: 3e30148c3d52 (\"[PATCH] Keys: Make request-key create an authorisation key\")\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/13e86efb2eee6bd1f2d0aae5b0273e8e65683c9d"},{"sha":"75252bfe9e493a314d62e820aea07a6c48dea833","author":{"name":"Ilan peer","email":"a53deebf22f18092e166fe671085ec3af21faca2@intel.com"},"message":"mac80211: Fix addition of mesh configuration element\n\ncommit 57629915d568c522ac1422df7bba4bee5b5c7a7c upstream.\n\nThe code was setting the capabilities byte to zero,\nafter it was already properly set previously. Fix it.\n\nThe bug was found while debugging hwsim mesh tests failures\nthat happened since the commit mentioned below.\n\nFixes: 76f43b4c0a93 (\"mac80211: Remove invalid flag operations in mesh TSF synchronization\")\nSigned-off-by: Ilan Peer <ilan.peer@intel.com>\nReviewed-by: Masashi Honma <masashi.honma@gmail.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nCc: Richard Schütz <rschuetz@uni-koblenz.de>\nCc: Mathias Kretschmer <mathias.kretschmer@fit.fraunhofer.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/75252bfe9e493a314d62e820aea07a6c48dea833"},{"sha":"a1d72bc18e776f8c5fc5918fc4f4a2795f31a416","author":{"name":"Javier Martinez Canillas","email":"3143756678d9bea1c63e1e9bb72bc089a9106bec@osg.samsung.com"},"message":"usb: phy: isp1301: Add OF device ID table\n\n\n[ Upstream commit fd567653bdb908009b650f079bfd4b63169e2ac4 ]\n\nThe driver doesn't have a struct of_device_id table but supported devices\nare registered via Device Trees. This is working on the assumption that a\nI2C device registered via OF will always match a legacy I2C device ID and\nthat the MODALIAS reported will always be of the form i2c:<device>.\n\nBut this could change in the future so the correct approach is to have an\nOF device ID table if the devices are registered via OF.\n\nSigned-off-by: Javier Martinez Canillas <javier@osg.samsung.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/CandyDevices/kernel_oneplus_msm8998/commits/a1d72bc18e776f8c5fc5918fc4f4a2795f31a416"}]}
{"actor":{"display_login":"NoSpamDan"}}