{"push_id":2071729783,"size":30,"distinct_size":0,"ref":"refs/heads/standard/tiny/common-pc","head":"fc9498481df3d7a6b85a35d98a12c4f25c2985ce","before":"35a62996b2e103e1b494168812fe679acea3f332","commits":[{"sha":"78c45940f20be7e4515eff8df14e18e803fbebd2","author":{"name":"jxu4","email":"bade7c6b415dd6f24a4d6f0ff4fcb09a0021dcfa@windriver.com"},"message":"sysrq : fix Show Regs call trace\n\nWhen kernel configuration SMP,PREEMPT and DEBUG_PREEMPT are enabled,\necho 1 >/proc/sys/kernel/sysrq\necho p >/proc/sysrq-trigger\nkernel will print call trace as below:\nsysrq: SysRq : Show Regs\nBUG: using __this_cpu_read() in preemptible [00000000] code: sh/435\ncaller is __this_cpu_preempt_check+0x18/0x20\nCPU: 0 PID: 435 Comm: sh Not tainted 4.8.22-WR9.0.0.9_standard #1\nHardware name: AXM56xx Victoria (DT)\nCall trace:\n[<ffffff8008088e80>] dump_backtrace+0x0/0x1d0\n[<ffffff8008089074>] show_stack+0x24/0x30\n[<ffffff8008447970>] dump_stack+0x90/0xb0\n[<ffffff8008463950>] check_preemption_disabled+0x100/0x108\n[<ffffff8008463998>] __this_cpu_preempt_check+0x18/0x20\n[<ffffff80084c9194>] sysrq_handle_showregs+0x1c/0x40\n[<ffffff80084c9c7c>] __handle_sysrq+0x12c/0x1a0\n[<ffffff80084ca140>] write_sysrq_trigger+0x60/0x70\n[<ffffff8008251e00>] proc_reg_write+0x90/0xd0\n[<ffffff80081f1788>] __vfs_write+0x48/0x90\n[<ffffff80081f241c>] vfs_write+0xa4/0x190\n[<ffffff80081f3354>] SyS_write+0x54/0xb0\n[<ffffff80080833f0>] el0_svc_naked+0x24/0x28\n\nThis happens because when echo p >/proc/sysrq-trigger,\nget_irq_regs() is called outside of interrupt context,\nin this situation,if preemption is enabled,kernel will\nprint the call trace. So add a judgement to avoid it.\n\nSigned-off-by: jxu4 <jibin.xu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/78c45940f20be7e4515eff8df14e18e803fbebd2"},{"sha":"8e541c8d6b8635b5055fcee972ecfda3e54208b9","author":{"name":"Jin Qian","email":"0a9aa3d3574a19f4323dcc26c6c102ebcca97ce1@google.com"},"message":"f2fs: sanity check checkpoint segno and blkoff\n\ncommit 15d3042a937c13f5d9244241c7a9c8416ff6e82a upstream\n\nMake sure segno and blkoff read from raw image are valid.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Jin Qian <jinqian@google.com>\n[Jaegeuk Kim: adjust minor coding style]\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\nSigned-off-by: Wenlin Kang <wenlin.kang@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/8e541c8d6b8635b5055fcee972ecfda3e54208b9"},{"sha":"3115d51560332e633b3736ee22de3d22b481b680","author":{"name":"Jin Qian","email":"0a9aa3d3574a19f4323dcc26c6c102ebcca97ce1@google.com"},"message":"f2fs: sanity check segment count\n\ncommit b9dd46188edc2f0d1f37328637860bb65a771124 upstream\n\nF2FS uses 4 bytes to represent block address. As a result, supported\nsize of disk is 16 TB and it equals to 16 * 1024 * 1024 / 2 segments.\n\nSigned-off-by: Jin Qian <jinqian@google.com>\nSigned-off-by: Jaegeuk Kim <jaegeuk@kernel.org>\nSigned-off-by: Wenlin Kang <wenlin.kang@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/3115d51560332e633b3736ee22de3d22b481b680"},{"sha":"6a7e7d787bbabef2b65404e845a54c77b23fb754","author":{"name":"Vladis Dronov","email":"41435c47c64e54f8ec26bbc1be6d7972ea4d40bd@redhat.com"},"message":"xfrm: policy: check policy direction value\n\ncommit 7bab09631c2a303f87a7eb7e3d69e888673b9b7e upstream\n\nThe 'dir' parameter in xfrm_migrate() is a user-controlled byte which is used\nas an array index. This can lead to an out-of-bound access, kernel lockup and\nDoS. Add a check for the 'dir' value.\n\nThis fixes CVE-2017-11600.\n\nReferences: https://bugzilla.redhat.com/show_bug.cgi?id=1474928\nFixes: 80c9abaabf42 (\"[XFRM]: Extension for dynamic update of endpoint address(es)\")\nCc: <stable@vger.kernel.org> # v2.6.21-rc1\nReported-by: \"bo Zhang\" <zhangbo5891001@gmail.com>\nSigned-off-by: Vladis Dronov <vdronov@redhat.com>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: Catalin Enache <catalin.enache@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/6a7e7d787bbabef2b65404e845a54c77b23fb754"},{"sha":"c46ce1260e8edbba9af1ccc4242faf2daac9a541","author":{"name":"Liu Haitao","email":"42e5f562ada7e025bad5a5e820d980771d3a8544@windriver.com"},"message":"tcp: Fix CVE-2017-14106\n\nWhen tcp_disconnect() is called, inet_csk_delack_init() sets\nicsk->icsk_ack.rcv_mss to 0.\n\nThis could potentially cause tcp_recvmsg() =>tcp_cleanup_rbuf() =>\n__tcp_select_window() call path to have division by 0 issue.\nSo this patch initializes rcv_mss to TCP_MIN_MSS instead of 0.\n\nReference:\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-14106\n\nUpstream patch:\n\nhttps://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/commit/?id=499350a5a6e7\n\nUpstream-Status: Accepted\n\nCVE:CVE-2017-14106\n\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: Wei Wang <weiwan@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: Neal Cardwell <ncardwell@google.com>\nSigned-off-by: Yuchung Cheng <ycheng@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Haitao Liu <Haitao.Liu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/c46ce1260e8edbba9af1ccc4242faf2daac9a541"},{"sha":"8b854c20fa76e45f0edf6eaf45ea3d00f4104c36","author":{"name":"Ben Seri","email":"9c85637c38b80821c7bd8a03bde7b59da81ab77d@armis.com"},"message":"Bluetooth: Properly check L2CAP config option output buffer length\n\ncommit e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 upstream\n\nValidate the output buffer length for L2CAP config requests and responses\nto avoid overflowing the stack buffer used for building the option blocks.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Ben Seri <ben@armis.com>\nSigned-off-by: Marcel Holtmann <marcel@holtmann.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Jibin Xu <jibin.xu@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/8b854c20fa76e45f0edf6eaf45ea3d00f4104c36"},{"sha":"869babb9e27eaee092a22eb23c0237a33ff928c4","author":{"name":"Li Zhou","email":"ebee0ce7fce11563d941785c147121be8a884596@windriver.com"},"message":"mtd: mtdblock: avoid __might_sleep warnings in mtd_erase\n\nIn the erase_write function of mtdblock.c,\n\"set_current_state(TASK_INTERRUPTIBLE)\" before calling mtd_erase will\ncause below  warning:\n\ndo not call blocking ops when !TASK_RUNNING; state=1 set at [<ffffff80085810e0>] erase_write+0x0/0x160\n------------[ cut here ]------------\nWARNING: CPU: 3 PID: 323 at .../kernel/sched/core.c:7586 __might_sleep+0x8c/0x98\n......\nCall trace:\n......\n[<ffffff80080c8054>] __might_sleep+0x8c/0x98\n[<ffffff800882cd5c>] mutex_lock+0x2c/0x80\n[<ffffff800858ea94>] spi_nor_lock_and_prep+0x2c/0xa8\n[<ffffff800858f5d0>] spi_nor_erase+0x50/0x230\n[<ffffff800857da38>] part_erase+0x40/0x78\n[<ffffff800857a300>] mtd_erase+0x60/0xa0\n[<ffffff8008581198>] erase_write+0xb8/0x160\n[<ffffff8008581288>] write_cached_data+0x48/0x60\n[<ffffff800858135c>] mtdblock_release+0x2c/0x70\n[<ffffff8008580d3c>] blktrans_release+0x9c/0xd8\n[<ffffff80082435ac>] __blkdev_put+0x29c/0x318\n[<ffffff80082439fc>] blkdev_put+0x54/0x150\n[<ffffff8008243b24>] blkdev_close+0x2c/0x40\n[<ffffff8008203a58>] __fput+0xa8/0x1e8\n[<ffffff8008203c38>] ____fput+0x20/0x30\n[<ffffff80080bd76c>] task_work_run+0xdc/0x110\n[<ffffff8008089824>] do_notify_resume+0x8c/0x98\n[<ffffff80080835e8>] work_pending+0x10/0x14\n\nHere change from function schedule to wait_woken to avoid this issue.\n\nset_current_state(TASK_INTERRUPTIBLE) is called before mtd_erase.\nIn mtd_erase, mutex_lock is called by spi_nor_erase.\nSo above warning is got. The reason is:\nIn mutex_lock, blocking primitives will set (and therefore destroy)\ncurrent->state. Since it will exit with TASK_RUNNING, we should make\nsure we enter with it, otherwise we will destroy state.\n\nWe can't move set_current_state(TASK_INTERRUPTIBLE) to be after mtd_erase\nto solve this issue, because wake_up is called by spi_nor_erase in\nmtd_erase. If neither TASK_INTERRUPTIBLE nor TASK_UNINTERRUPTIBLE is set,\nnothing will be done by this wake_up. Then schedule() is called next,\nit will always wait there and never return.\n\nIf use wait_woken and DEFINE_WAIT_FUNC(wait, woken_wake_function)\ninstead, TASK_INTERRUPTIBLE can be set when calling wait_woken\n(after mtd_erase). A special flag (WQ_FLAG_WOKEN) is to be used in\nthe flags field of the wait queue entry. If wake_up happens in\nmtd_erase, woken_wake_function will be called, and this flag will\nbe set. Next wait_woken() sees that flag, it knows that the wakeup\nalready occurred and doesn't block. Otherwise, the wakeup has not\noccurred, so wait_woken() can safely call schedule() to wait.\nThus the warning is avoid and there is no functional change.\n\nSigned-off-by: Li Zhou <li.zhou@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/869babb9e27eaee092a22eb23c0237a33ff928c4"},{"sha":"9f5bd98f36cce950fd2ba71d6262dd8331022e68","author":{"name":"Qiuxu Zhuo","email":"6fa4ec670f8ae0ce28d95c03927221fa32ffcc64@intel.com"},"message":"i2c: i801: Restore the presence state of P2SB PCI device after reading BAR\n\ncommit bfd4473b850c8cfaa1cdf56b8ef52fae4e8a6ee5 upstream.\n\nSun, Yunying reported the following failure on Denverton micro-server:\n\n EDAC DEBUG: pnd2_init:\n EDAC DEBUG: pnd2_probe:\n EDAC DEBUG: dnv_rd_reg: Read b_cr_tolud_pci=00000000_80000000\n EDAC DEBUG: dnv_rd_reg: Read b_cr_touud_lo_pci=00000000_80000000\n EDAC DEBUG: dnv_rd_reg: Read b_cr_touud_hi_pci=00000000_00000004\n EDAC DEBUG: dnv_rd_reg: Read b_cr_asym_mem_region0_mchbar=00000000_00000000\n EDAC DEBUG: dnv_rd_reg: Read b_cr_asym_mem_region1_mchbar=00000000_00000000\n EDAC DEBUG: dnv_rd_reg: Read b_cr_mot_out_base_mchbar=00000000_00000000\n EDAC DEBUG: dnv_rd_reg: Read b_cr_mot_out_mask_mchbar=00000000_00000000\n EDAC pnd2: Failed to register device with error -19.\n\nOn Denverton micro-server, the presence of the P2SB bridge PCI device is\nenabled or disabled by the item 'RelaxSecConf' in BIOS setup menu. When\n'RelaxSecConf' is enabled, the P2SB PCI device is present and the pnd2_edac\nEDAC driver also uses it to get BAR. Hiding the P2SB PCI device caused the\npnd2_edac EDAC driver failed to get BAR then reported the above failure.\n\nTherefor, store the presence state of P2SB PCI device before unhiding it\nfor reading BAR and restore the presence state after reading BAR.\n\nSigned-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>\nReported-by: Yunying Sun <yunying.sun@intel.com>\nTested-by: Yunying Sun <yunying.sun@intel.com>\nReviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>\nSigned-off-by: Wolfram Sang <wsa@the-dreams.de>\nSigned-off-by: Liwei Song <liwei.song@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/9f5bd98f36cce950fd2ba71d6262dd8331022e68"},{"sha":"67524d362b5b810b7b573f1d8506b42fd99dd005","author":{"name":"Gustavo A. R. Silva","email":"4b411d321e41f8f6965e5524af22579e66e9d999@embeddedor.com"},"message":"EDAC, pnd2: Return proper error value from apl_rd_reg()\n\ncommit ee514c7a2379385fcec363f2f5f8db4eb56bc48c upstream.\n\nAdd code comment to make it clear that the fall-through is intentional\nand, OR ret with its previous value to avoid overwriting it so that\ncallers can check the correct return value.\n\nSigned-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>\nCc: Qiuxu Zhuo <qiuxu.zhuo@intel.com>\nCc: Tony Luck <tony.luck@intel.com>\nCc: linux-edac <linux-edac@vger.kernel.org>\nLink: http://lkml.kernel.org/r/20170622220535.GA4896@embeddedgus\n[ Massage a bit. ]\nSigned-off-by: Borislav Petkov <bp@suse.de>\n\nSigned-off-by: Liwei Song <liwei.song@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/67524d362b5b810b7b573f1d8506b42fd99dd005"},{"sha":"2de196d74506c5db3d6277292ce5b8348243563c","author":{"name":"Colin Ian King","email":"61b69653f478c16de27cbf2a77617b5a614a704a@canonical.com"},"message":"EDAC, pnd2: Make function sbi_send() static\n\ncommit 77641dacead2cbfe22d10f4e7c07867d86900057 upstream.\n\nThe function sbi_send() is local to just pnd2_edac.c and does not need\nto be in global scope, so make it static.\n\nSigned-off-by: Colin Ian King <colin.king@canonical.com>\nCc: Tony Luck <tony.luck@intel.com>\nCc: linux-edac <linux-edac@vger.kernel.org>\nLink: http://lkml.kernel.org/r/20170623084855.9197-1-colin.king@canonical.com\nSigned-off-by: Borislav Petkov <bp@suse.de>\nSigned-off-by: Liwei Song <liwei.song@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/2de196d74506c5db3d6277292ce5b8348243563c"},{"sha":"dc689a2115e517d3d179e08ce9327d5dc000dd43","author":{"name":"Tony Luck","email":"f73696e9a45bbe02c02d176fe62ff743ab0dbe2b@intel.com"},"message":"EDAC, pnd2: Fix Apollo Lake DIMM detection\n\ncommit 164c29244d4beb9a105102c42821f4925e4a0c7a upstream.\n\nNon-existent or empty DIMM slots result in error return from\nRD_REGP(). But we shouldn't give up on failure.\n\nSo long as we find at least one DIMM we can continue.\n\nSigned-off-by: Tony Luck <tony.luck@intel.com>\nCc: Qiuxu Zhuo <qiuxu.zhuo@intel.com>\nCc: linux-edac <linux-edac@vger.kernel.org>\nLink: http://lkml.kernel.org/r/20170628234407.21521-1-tony.luck@intel.com\nSigned-off-by: Borislav Petkov <bp@suse.de>\nSigned-off-by: Liwei Song <liwei.song@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/dc689a2115e517d3d179e08ce9327d5dc000dd43"},{"sha":"4cd60200ff71c086bbfb001b752c871c11b63fd1","author":{"name":"Tony Luck","email":"f73696e9a45bbe02c02d176fe62ff743ab0dbe2b@intel.com"},"message":"EDAC, pnd2: Build in a minimal sideband driver for Apollo Lake\n\ncommit 3e5d2bd19138d6683f69de26a34d7eb9ab3823ed upstream.\n\nI've been waing a long time for the generic sideband driver to\nappear. Patience has run out, so include the minimum here to\njust read registers.\n\nSigned-off-by: Tony Luck <tony.luck@intel.com>\nCc: Aristeu Rozanski <arozansk@redhat.com>\nCc: Mauro Carvalho Chehab <mchehab@osg.samsung.com>\nCc: Patrick Geary <patrickg@supermicro.com>\nCc: Qiuxu Zhuo <qiuxu.zhuo@intel.com>\nCc: linux-edac <linux-edac@vger.kernel.org>\nLink: http://lkml.kernel.org/r/20170803210536.5662-1-tony.luck@intel.com\nSigned-off-by: Borislav Petkov <bp@suse.de>\nSigned-off-by: Liwei Song <liwei.song@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/4cd60200ff71c086bbfb001b752c871c11b63fd1"},{"sha":"e9ca4b7a358d62270e431ad381f193079736d4d4","author":{"name":"Qiuxu Zhuo","email":"6fa4ec670f8ae0ce28d95c03927221fa32ffcc64@intel.com"},"message":"EDAC, pnd2: Mask off the lower four bits of a BAR\n\ncommit d84676a9e12817c8435e836911800bdcc67928a0 upstream.\n\nBit[0] of BAR is always zero. Bit[2:1] and bit[3] of BAR contain the\ninformation of 'type' and the 'prefetchable' accordingly. Therefore,\nmask the lower four bits to retrieve the actual base address of a BAR.\n\nSigned-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>\nCc: Tony Luck <tony.luck@intel.com>\nCc: linux-edac <linux-edac@vger.kernel.org>\nLink: http://lkml.kernel.org/r/20170814154813.21619-1-qiuxu.zhuo@intel.com\nSigned-off-by: Borislav Petkov <bp@suse.de>\nSigned-off-by: Liwei Song <liwei.song@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/e9ca4b7a358d62270e431ad381f193079736d4d4"},{"sha":"62b5f7b06f312d91ae4480fe31d78d147642a677","author":{"name":"Qiuxu Zhuo","email":"6fa4ec670f8ae0ce28d95c03927221fa32ffcc64@intel.com"},"message":"EDAC, pnd2: Conditionally unhide/hide the P2SB PCI device to read BAR\n\ncommit 5fd77cb3bac77f690d1d9cf57dc7851fcb3e7945 upstream.\n\nOn Deverton server, the P2SB PCI device (DEV:1F, FUN:1) is used by multiple\ndevice drivers.\n\nIf it's hidden by some device driver (e.g. with the i801 I2C driver,\nthe commit\n\n  9424693035a5 (\"i2c: i801: Create iTCO device on newer Intel PCHs\")\n\nunconditionally hid the P2SB PCI device wrongly) it will make the\npnd2_edac driver read out an invalid BAR value of 0xffffffff and then\nfail on ioremap().\n\nTherefore, store the presence state of P2SB PCI device before unhiding\nit for reading BAR and restore the presence state after reading BAR.\n\nSigned-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>\nCc: Tony Luck <tony.luck@intel.com>\nCc: linux-edac <linux-edac@vger.kernel.org>\nCc: linux-i2c@vger.kernel.org\nLink: http://lkml.kernel.org/r/20170814154845.21663-1-qiuxu.zhuo@intel.com\nSigned-off-by: Borislav Petkov <bp@suse.de>\nSigned-off-by: Liwei Song <liwei.song@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/62b5f7b06f312d91ae4480fe31d78d147642a677"},{"sha":"2ce1c9b72afa2ee61ae85613f3ea70700a2c3a39","author":{"name":"Qiuxu Zhuo","email":"6fa4ec670f8ae0ce28d95c03927221fa32ffcc64@intel.com"},"message":"EDAC, pnd2: Properly toggle hidden state for P2SB PCI device\n\ncommit bc8f10babcc27c1f4d8e80d91cc543eabf9125c4 upstream.\n\nProperly handle hidden state of P2SB PCI device (DEV:D, FUN:0) for\nApollo Lake.\n\nSigned-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>\nCc: Tony Luck <tony.luck@intel.com>\nCc: linux-edac <linux-edac@vger.kernel.org>\nLink: http://lkml.kernel.org/r/20170814154905.21707-1-qiuxu.zhuo@intel.com\nSigned-off-by: Borislav Petkov <bp@suse.de>\nSigned-off-by: Liwei Song <liwei.song@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/2ce1c9b72afa2ee61ae85613f3ea70700a2c3a39"},{"sha":"c241e022e6e86662af85b717f6cd223f19affcd9","author":{"name":"Dan Carpenter","email":"60b2bf2bc0bec4ca4a4b046ca7ef9255248abff8@oracle.com"},"message":"scsi: qla2xxx: Fix an integer overflow in sysfs code\n\ncommit e6f77540c067b48dee10f1e33678415bfcc89017 upstream\n\nThe value of \"size\" comes from the user.  When we add \"start + size\" it\ncould lead to an integer overflow bug.\n\nIt means we vmalloc() a lot more memory than we had intended.  I believe\nthat on 64 bit systems vmalloc() can succeed even if we ask it to\nallocate huge 4GB buffers.  So we would get memory corruption and likely\na crash when we call ha->isp_ops->write_optrom() and ->read_optrom().\n\nOnly root can trigger this bug.\n\nLink: https://bugzilla.kernel.org/show_bug.cgi?id=194061\n\nCc: <stable@vger.kernel.org>\nFixes: b7cc176c9eb3 (\"[SCSI] qla2xxx: Allow region-based flash-part accesses.\")\nReported-by: shqking <shqking@gmail.com>\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Li Zhou <li.zhou@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/c241e022e6e86662af85b717f6cd223f19affcd9"},{"sha":"d85e9085e813737156b04b6d2750090857c7f5a4","author":{"name":"Murray McAllister","email":"e0120c78f475955b0d3b01b3e5bbd0b9fd2f2d24@insomniasec.com"},"message":"drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()\n\ncommit 36274ab8c596f1240c606bb514da329add2a1bcd upstream\n\nBefore memory allocations vmw_surface_define_ioctl() checks the\nupper-bounds of a user-supplied size, but does not check if the\nsupplied size is 0.\n\nAdd check to avoid NULL pointer dereferences.\n\nCc: <stable@vger.kernel.org>\nSigned-off-by: Murray McAllister <murray.mcallister@insomniasec.com>\nReviewed-by: Sinclair Yeh <syeh@vmware.com>\nSigned-off-by: Zhixiong Chi <zhixiong.chi@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/d85e9085e813737156b04b6d2750090857c7f5a4"},{"sha":"660af25f13ec946a11568edc2273312ce4b4951c","author":{"name":"Vladis Dronov","email":"41435c47c64e54f8ec26bbc1be6d7972ea4d40bd@redhat.com"},"message":"drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()\n\ncommit ee9c4e681ec4f58e42a83cb0c22a0289ade1aacf upstream\n\nThe 'req->mip_levels' parameter in vmw_gb_surface_define_ioctl() is\na user-controlled 'uint32_t' value which is used as a loop count limit.\nThis can lead to a kernel lockup and DoS. Add check for 'req->mip_levels'.\n\nReferences:\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1437431\n\nCc: <stable@vger.kernel.org>\nSigned-off-by: Vladis Dronov <vdronov@redhat.com>\nReviewed-by: Sinclair Yeh <syeh@vmware.com>\nSigned-off-by: Qi Hou <qi.hou@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/660af25f13ec946a11568edc2273312ce4b4951c"},{"sha":"3b0ccd40ad622df6f314fca8fbb8371aba9aef8f","author":{"name":"Seunghun Han","email":"a840ccba1f7163117d09130a533ba0b40a452e66@gmail.com"},"message":"ACPICA: Namespace: fix operand cache leak\n\nACPICA commit a23325b2e583556eae88ed3f764e457786bf4df6\n\nI found some ACPI operand cache leaks in ACPI early abort cases.\n\nBoot log of ACPI operand cache leak is as follows:\n>[    0.174332] ACPI: Added _OSI(Module Device)\n>[    0.175504] ACPI: Added _OSI(Processor Device)\n>[    0.176010] ACPI: Added _OSI(3.0 _SCP Extensions)\n>[    0.177032] ACPI: Added _OSI(Processor Aggregator Device)\n>[    0.178284] ACPI: SCI (IRQ16705) allocation failed\n>[    0.179352] ACPI Exception: AE_NOT_ACQUIRED, Unable to install\nSystem Control Interrupt handler (20160930/evevent-131)\n>[    0.180008] ACPI: Unable to start the ACPI Interpreter\n>[    0.181125] ACPI Error: Could not remove SCI handler\n(20160930/evmisc-281)\n>[    0.184068] kmem_cache_destroy Acpi-Operand: Slab cache still has\nobjects\n>[    0.185358] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.10.0-rc3 #2\n>[    0.186820] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\nvirtual_box 12/01/2006\n>[    0.188000] Call Trace:\n>[    0.188000]  ? dump_stack+0x5c/0x7d\n>[    0.188000]  ? kmem_cache_destroy+0x224/0x230\n>[    0.188000]  ? acpi_sleep_proc_init+0x22/0x22\n>[    0.188000]  ? acpi_os_delete_cache+0xa/0xd\n>[    0.188000]  ? acpi_ut_delete_caches+0x3f/0x7b\n>[    0.188000]  ? acpi_terminate+0x5/0xf\n>[    0.188000]  ? acpi_init+0x288/0x32e\n>[    0.188000]  ? __class_create+0x4c/0x80\n>[    0.188000]  ? video_setup+0x7a/0x7a\n>[    0.188000]  ? do_one_initcall+0x4e/0x1b0\n>[    0.188000]  ? kernel_init_freeable+0x194/0x21a\n>[    0.188000]  ? rest_init+0x80/0x80\n>[    0.188000]  ? kernel_init+0xa/0x100\n>[    0.188000]  ? ret_from_fork+0x25/0x30\n\nWhen early abort is occurred due to invalid ACPI information, Linux kernel\nterminates ACPI by calling acpi_terminate() function. The function calls\nacpi_ns_terminate() function to delete namespace data and ACPI operand cache\n(acpi_gbl_module_code_list).\n\nBut the deletion code in acpi_ns_terminate() function is wrapped in\nACPI_EXEC_APP definition, therefore the code is only executed when the\ndefinition exists. If the define doesn't exist, ACPI operand cache\n(acpi_gbl_module_code_list) is leaked, and stack dump is shown in kernel log.\n\nThis causes a security threat because the old kernel (<= 4.9) shows memory\nlocations of kernel functions in stack dump, therefore kernel ASLR can be\nneutralized.\n\nTo fix ACPI operand leak for enhancing security, I made a patch which\nremoves the ACPI_EXEC_APP define in acpi_ns_terminate() function for\nexecuting the deletion code unconditionally.\n\nLink: https://github.com/acpica/acpica/commit/a23325b2\nSigned-off-by: Seunghun Han <kkamagui@gmail.com>\nSigned-off-by: Lv Zheng <lv.zheng@intel.com>\nSigned-off-by: Bob Moore <robert.moore@intel.com>\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>\nSigned-off-by: Qi Hou <qi.hou@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/3b0ccd40ad622df6f314fca8fbb8371aba9aef8f"},{"sha":"e29249c7dc816296dcbc48cc8ee4731992fa48bd","author":{"name":"Willem de Bruijn","email":"86b583cfb6b08f85a219d9441a0068d5b14d5476@google.com"},"message":"packet: fix tp_reserve race in packet_set_ring\n\ncommit c27927e372f0785f3303e8fad94b85945e2c97b7 upstream\n\nUpdates to tp_reserve can race with reads of the field in\npacket_set_ring. Avoid this by holding the socket lock during\nupdates in setsockopt PACKET_RESERVE.\n\nThis bug was discovered by syzkaller.\n\nFixes: 8913336a7e8d (\"packet: add PACKET_RESERVE sockopt\")\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: Willem de Bruijn <willemb@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Qi Hou <qi.hou@windriver.com>","distinct":false,"url":"https://api.github.com/repos/WindRiver-Labs/kernel-4.8.x/commits/e29249c7dc816296dcbc48cc8ee4731992fa48bd"}]}
{"actor":{"display_login":"mseaster-wr"}}