{"push_id":1938865264,"size":13,"distinct_size":13,"ref":"refs/heads/cm-14.1","head":"d96522404ccff1dbbebe65dcdbb6124b2fcee2fb","before":"d587a3657f0e471b0c6c633c20cf45b100fb9a3a","commits":[{"sha":"006d2c6914f9293820e7c46853128952b5b9e23f","author":{"name":"Theodore Ts'o","email":"27d72d8f7672ec04389c6b6ff53fcc4e9145bb77@mit.edu"},"message":"ext4: lock the xattr block before checksuming it\n\ncommit dac7a4b4b1f664934e8b713f529b629f67db313c upstream.\n\nWe must lock the xattr block before calculating or verifying the\nchecksum in order to avoid spurious checksum failures.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=193661\n\nReported-by: Colin Ian King <colin.king@canonical.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\n[bwh: Backported to 3.16: adjust context]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/M2Repos/android_kernel_meizu_m2/commits/006d2c6914f9293820e7c46853128952b5b9e23f"},{"sha":"31afcc63457bb48403cb3d1179c0e8eb5a975082","author":{"name":"Seunghun Han","email":"a840ccba1f7163117d09130a533ba0b40a452e66@gmail.com"},"message":"UPSTREAM: x86/acpi: Prevent out of bound access caused by broken ACPI tables\n\nThe bus_irq argument of mp_override_legacy_irq() is used as the index into\nthe isa_irq_to_gsi[] array. The bus_irq argument originates from\nACPI_MADT_TYPE_IO_APIC and ACPI_MADT_TYPE_INTERRUPT items in the ACPI\ntables, but is nowhere sanity checked.\n\nThat allows broken or malicious ACPI tables to overwrite memory, which\nmight cause malfunction, panic or arbitrary code execution.\n\nAdd a sanity check and emit a warning when that triggers.\n\n[ tglx: Added warning and rewrote changelog ]\n\nSigned-off-by: Seunghun Han <kkamagui@gmail.com>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: security@kernel.org\nCc: \"Rafael J. Wysocki\" <rjw@rjwysocki.net>\nCc: stable@vger.kernel.org\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\n(cherry picked from commit dad5ab0db8deac535d03e3fe3d8f2892173fa6a4)\nBug: 64253928\nChange-Id: I34c8305afb582298618cf8e6d889985134137265","distinct":true,"url":"https://api.github.com/repos/M2Repos/android_kernel_meizu_m2/commits/31afcc63457bb48403cb3d1179c0e8eb5a975082"},{"sha":"2e4400a590d38bb1f93572c4cf493b58b7cf1369","author":{"name":"Jan Kara","email":"7bb7087018cc5fef3c041f6f038f586664845dbf@suse.cz"},"message":"ext4: Don't clear SGID when inheriting ACLs\n\nWhen new directory 'DIR1' is created in a directory 'DIR0' with SGID bit\nset, DIR1 is expected to have SGID bit set (and owning group equal to\nthe owning group of 'DIR0'). However when 'DIR0' also has some default\nACLs that 'DIR1' inherits, setting these ACLs will result in SGID bit on\n'DIR1' to get cleared if user is not member of the owning group.\n\nFix the problem by moving posix_acl_update_mode() out of\n__ext4_set_acl() into ext4_set_acl(). That way the function will not be\ncalled when inheriting ACLs which is what we want as it prevents SGID\nbit clearing and the mode has been properly set by posix_acl_create()\nanyway.\n\nFixes: 073931017b49d9458aa351605b43a7e34598caef\nCC: stable@vger.kernel.org\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nSigned-off-by: Jan Kara <jack@suse.cz>\nReviewed-by: Andreas Gruenbacher <agruenba@redhat.com>\n[@nathanchance: Backport to 3.10]\nSigned-off-by: Nathan Chancellor <natechancellor@gmail.com>\nSigned-off-by: Joe Maples <joe@frap129.org>\n\nSigned-off-by: Mister Oyster <oysterized@gmail.com>","distinct":true,"url":"https://api.github.com/repos/M2Repos/android_kernel_meizu_m2/commits/2e4400a590d38bb1f93572c4cf493b58b7cf1369"},{"sha":"70b86db2ee9436f85fb88ae7f9fb8895739b6f27","author":{"name":"Zheng Li","email":"3a6c175e96d3898fc384bb44cf87bdc9b169f91a@ericsson.com"},"message":"ipv6: Should use consistent conditional judgement for ip6 fragment between __ip6_append_data and ip6_finish_output\n\nThere is an inconsistent conditional judgement between __ip6_append_data\nand ip6_finish_output functions, the variable length in __ip6_append_data\njust include the length of application's payload and udp6 header, don't\ninclude the length of ipv6 header, but in ip6_finish_output use\n(skb->len > ip6_skb_dst_mtu(skb)) as judgement, and skb->len include the\nlength of ipv6 header.\n\nThat causes some particular application's udp6 payloads whose length are\nbetween (MTU - IPv6 Header) and MTU were fragmented by ip6_fragment even\nthough the rst->dev support UFO feature.\n\nAdd the length of ipv6 header to length in __ip6_append_data to keep\nconsistent conditional judgement as ip6_finish_output for ip6 fragment.\n\nSigned-off-by: Zheng Li <james.z.li@ericsson.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Joe Maples <joe@frap129.org>","distinct":true,"url":"https://api.github.com/repos/M2Repos/android_kernel_meizu_m2/commits/70b86db2ee9436f85fb88ae7f9fb8895739b6f27"},{"sha":"655c2df26277eb04c6a714003726aa301dd25621","author":{"name":"Joel Fernandes","email":"0df231208759e708e4dc2476a705ad16c197fb80@google.com"},"message":"pstore: Make spinlock per zone instead of global\n\nCurrently pstore has a global spinlock for all zones. Since the zones\nare independent and modify different areas of memory, there's no need\nto have a global lock, so we should use a per-zone lock as introduced\nhere. Also, when ramoops's ftrace use-case has a FTRACE_PER_CPU flag\nintroduced later, which splits the ftrace memory area into a single zone\nper CPU, it will eliminate the need for locking. In preparation for this,\nmake the locking optional.\n\nSigned-off-by: Joel Fernandes <joelaf@google.com>\n[kees: updated commit message]\nSigned-off-by: Kees Cook <keescook@chromium.org>\nSigned-off-by: Joe Maples <joe@frap129.org>","distinct":true,"url":"https://api.github.com/repos/M2Repos/android_kernel_meizu_m2/commits/655c2df26277eb04c6a714003726aa301dd25621"},{"sha":"95d2ffaaa3e7db26ee9ff45b8e46ec1cc41ad3fb","author":{"name":"Joel Fernandes","email":"0df231208759e708e4dc2476a705ad16c197fb80@google.com"},"message":"pstore: Allow prz to control need for locking\n\nIn preparation of not locking at all for certain buffers depending on if\nthere's contention, make locking optional depending on the initialization\nof the prz.\n\nSigned-off-by: Joel Fernandes <joelaf@google.com>\n[kees: moved locking flag into prz instead of via caller arguments]\nSigned-off-by: Kees Cook <keescook@chromium.org>\nSigned-off-by: Joe Maples <joe@frap129.org>","distinct":true,"url":"https://api.github.com/repos/M2Repos/android_kernel_meizu_m2/commits/95d2ffaaa3e7db26ee9ff45b8e46ec1cc41ad3fb"},{"sha":"2be80c83a25c14d5de60eab6c2f53c2f2df06917","author":{"name":"Kees Cook","email":"999bfbbf6e15a9d6aba3dfebadcec55340f87c3f@chromium.org"},"message":"pstore: Correctly initialize spinlock and flags\n\nThe ram backend wasn't always initializing its spinlock correctly. Since\nit was coming from kzalloc memory, though, it was harmless on\narchitectures that initialize unlocked spinlocks to 0 (at least x86 and\nARM). This also fixes a possibly ignored flag setting too.\n\nWhen running under CONFIG_DEBUG_SPINLOCK, the following Oops was visible:\n\n[    0.760836] persistent_ram: found existing buffer, size 29988, start 29988\n[    0.765112] persistent_ram: found existing buffer, size 30105, start 30105\n[    0.769435] persistent_ram: found existing buffer, size 118542, start 118542\n[    0.785960] persistent_ram: found existing buffer, size 0, start 0\n[    0.786098] persistent_ram: found existing buffer, size 0, start 0\n[    0.786131] pstore: using zlib compression\n[    0.790716] BUG: spinlock bad magic on CPU#0, swapper/0/1\n[    0.790729]  lock: 0xffffffc0d1ca9bb0, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0\n[    0.790742] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.10.0-rc2+ #913\n[    0.790747] Hardware name: Google Kevin (DT)\n[    0.790750] Call trace:\n[    0.790768] [<ffffff900808ae88>] dump_backtrace+0x0/0x2bc\n[    0.790780] [<ffffff900808b164>] show_stack+0x20/0x28\n[    0.790794] [<ffffff9008460ee0>] dump_stack+0xa4/0xcc\n[    0.790809] [<ffffff9008113cfc>] spin_dump+0xe0/0xf0\n[    0.790821] [<ffffff9008113d3c>] spin_bug+0x30/0x3c\n[    0.790834] [<ffffff9008113e28>] do_raw_spin_lock+0x50/0x1b8\n[    0.790846] [<ffffff9008a2d2ec>] _raw_spin_lock_irqsave+0x54/0x6c\n[    0.790862] [<ffffff90083ac3b4>] buffer_size_add+0x48/0xcc\n[    0.790875] [<ffffff90083acb34>] persistent_ram_write+0x60/0x11c\n[    0.790888] [<ffffff90083aab1c>] ramoops_pstore_write_buf+0xd4/0x2a4\n[    0.790900] [<ffffff90083a9d3c>] pstore_console_write+0xf0/0x134\n[    0.790912] [<ffffff900811c304>] console_unlock+0x48c/0x5e8\n[    0.790923] [<ffffff900811da18>] register_console+0x3b0/0x4d4\n[    0.790935] [<ffffff90083aa7d0>] pstore_register+0x1a8/0x234\n[    0.790947] [<ffffff90083ac250>] ramoops_probe+0x6b8/0x7d4\n[    0.790961] [<ffffff90085ca548>] platform_drv_probe+0x7c/0xd0\n[    0.790972] [<ffffff90085c76ac>] driver_probe_device+0x1b4/0x3bc\n[    0.790982] [<ffffff90085c7ac8>] __device_attach_driver+0xc8/0xf4\n[    0.790996] [<ffffff90085c4bfc>] bus_for_each_drv+0xb4/0xe4\n[    0.791006] [<ffffff90085c7414>] __device_attach+0xd0/0x158\n[    0.791016] [<ffffff90085c7b18>] device_initial_probe+0x24/0x30\n[    0.791026] [<ffffff90085c648c>] bus_probe_device+0x50/0xe4\n[    0.791038] [<ffffff90085c35b8>] device_add+0x3a4/0x76c\n[    0.791051] [<ffffff90087d0e84>] of_device_add+0x74/0x84\n[    0.791062] [<ffffff90087d19b8>] of_platform_device_create_pdata+0xc0/0x100\n[    0.791073] [<ffffff90087d1a2c>] of_platform_device_create+0x34/0x40\n[    0.791086] [<ffffff900903c910>] of_platform_default_populate_init+0x58/0x78\n[    0.791097] [<ffffff90080831fc>] do_one_initcall+0x88/0x160\n[    0.791109] [<ffffff90090010ac>] kernel_init_freeable+0x264/0x31c\n[    0.791123] [<ffffff9008a25bd0>] kernel_init+0x18/0x11c\n[    0.791133] [<ffffff9008082ec0>] ret_from_fork+0x10/0x50\n[    0.793717] console [pstore-1] enabled\n[    0.797845] pstore: Registered ramoops as persistent store backend\n[    0.804647] ramoops: attached 0x100000@0xf7edc000, ecc: 0/0\n\nFixes: 663deb47880f (\"pstore: Allow prz to control need for locking\")\nFixes: 109704492ef6 (\"pstore: Make spinlock per zone instead of global\")\nReported-by: Brian Norris <briannorris@chromium.org>\nSigned-off-by: Kees Cook <keescook@chromium.org>\nSigned-off-by: Joe Maples <joe@frap129.org>","distinct":true,"url":"https://api.github.com/repos/M2Repos/android_kernel_meizu_m2/commits/2be80c83a25c14d5de60eab6c2f53c2f2df06917"},{"sha":"27a9929d2af57582fff8ff1f0665b6685583caca","author":{"name":"Kees Cook","email":"999bfbbf6e15a9d6aba3dfebadcec55340f87c3f@chromium.org"},"message":"pstore: Use dynamic spinlock initializer\n\nThe per-prz spinlock should be using the dynamic initializer so that\nlockdep can correctly track it. Without this, under lockdep, we get a\nwarning at boot that the lock is in non-static memory.\n\nFixes: 109704492ef6 (\"pstore: Make spinlock per zone instead of global\")\nFixes: 76d5692a5803 (\"pstore: Correctly initialize spinlock and flags\")\nSigned-off-by: Kees Cook <keescook@chromium.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Joe Maples <joe@frap129.org>","distinct":true,"url":"https://api.github.com/repos/M2Repos/android_kernel_meizu_m2/commits/27a9929d2af57582fff8ff1f0665b6685583caca"},{"sha":"b6f7070eb09bd55b547f2a11556db35bdadccae6","author":{"name":"Daniel Borkmann","email":"9e2dfb17275f5090f9361bcf2ab5dba6b506e7e6@redhat.com"},"message":"net: sctp: fix race for one-to-many sockets in sendmsg's auto associate\n\nI.e. one-to-many sockets in SCTP are not required to explicitly\ncall into connect(2) or sctp_connectx(2) prior to data exchange.\nInstead, they can directly invoke sendmsg(2) and the SCTP stack\nwill automatically trigger connection establishment through 4WHS\nvia sctp_primitive_ASSOCIATE(). However, this in its current\nimplementation is racy: INIT is being sent out immediately (as\nit cannot be bundled anyway) and the rest of the DATA chunks are\nqueued up for later xmit when connection is established, meaning\nsendmsg(2) will return successfully. This behaviour can result\nin an undesired side-effect that the kernel made the application\nthink the data has already been transmitted, although none of it\nhas actually left the machine, worst case even after close(2)'ing\nthe socket.\n\nInstead, when the association from client side has been shut down\ne.g. first gracefully through SCTP_EOF and then close(2), the\nclient could afterwards still receive the server's INIT_ACK due\nto a connection with higher latency. This INIT_ACK is then considered\nout of the blue and hence responded with ABORT as there was no\nalive assoc found anymore. This can be easily reproduced f.e.\nwith sctp_test application from lksctp. One way to fix this race\nis to wait for the handshake to actually complete.\n\nThe fix defers waiting after sctp_primitive_ASSOCIATE() and\nsctp_primitive_SEND() succeeded, so that DATA chunks cooked up\nfrom sctp_sendmsg() have already been placed into the output\nqueue through the side-effect interpreter, and therefore can then\nbe bundeled together with COOKIE_ECHO control chunks.\n\nstrace from example application (shortened):\n\nsocket(PF_INET, SOCK_SEQPACKET, IPPROTO_SCTP) = 3\nsendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr(\"192.168.1.115\")},\n           msg_iov(1)=[{\"hello\", 5}], msg_controllen=0, msg_flags=0}, 0) = 5\nsendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr(\"192.168.1.115\")},\n           msg_iov(1)=[{\"hello\", 5}], msg_controllen=0, msg_flags=0}, 0) = 5\nsendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr(\"192.168.1.115\")},\n           msg_iov(1)=[{\"hello\", 5}], msg_controllen=0, msg_flags=0}, 0) = 5\nsendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr(\"192.168.1.115\")},\n           msg_iov(1)=[{\"hello\", 5}], msg_controllen=0, msg_flags=0}, 0) = 5\nsendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr(\"192.168.1.115\")},\n           msg_iov(0)=[], msg_controllen=48, {cmsg_len=48, cmsg_level=0x84 /* SOL_??? */, cmsg_type=, ...},\n           msg_flags=0}, 0) = 0 // graceful shutdown for SOCK_SEQPACKET via SCTP_EOF\nclose(3) = 0\n\ntcpdump before patch (fooling the application):\n\n22:33:36.306142 IP 192.168.1.114.41462 > 192.168.1.115.8888: sctp (1) [INIT] [init tag: 3879023686] [rwnd: 106496] [OS: 10] [MIS: 65535] [init TSN: 3139201684]\n22:33:36.316619 IP 192.168.1.115.8888 > 192.168.1.114.41462: sctp (1) [INIT ACK] [init tag: 3345394793] [rwnd: 106496] [OS: 10] [MIS: 10] [init TSN: 3380109591]\n22:33:36.317600 IP 192.168.1.114.41462 > 192.168.1.115.8888: sctp (1) [ABORT]\n\ntcpdump after patch:\n\n14:28:58.884116 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [INIT] [init tag: 438593213] [rwnd: 106496] [OS: 10] [MIS: 65535] [init TSN: 3092969729]\n14:28:58.888414 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [INIT ACK] [init tag: 381429855] [rwnd: 106496] [OS: 10] [MIS: 10] [init TSN: 2141904492]\n14:28:58.888638 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [COOKIE ECHO] , (2) [DATA] (B)(E) [TSN: 3092969729] [...]\n14:28:58.893278 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [COOKIE ACK] , (2) [SACK] [cum ack 3092969729] [a_rwnd 106491] [#gap acks 0] [#dup tsns 0]\n14:28:58.893591 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [DATA] (B)(E) [TSN: 3092969730] [...]\n14:28:59.096963 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [SACK] [cum ack 3092969730] [a_rwnd 106496] [#gap acks 0] [#dup tsns 0]\n14:28:59.097086 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [DATA] (B)(E) [TSN: 3092969731] [...] , (2) [DATA] (B)(E) [TSN: 3092969732] [...]\n14:28:59.103218 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [SACK] [cum ack 3092969732] [a_rwnd 106486] [#gap acks 0] [#dup tsns 0]\n14:28:59.103330 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [SHUTDOWN]\n14:28:59.107793 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [SHUTDOWN ACK]\n14:28:59.107890 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [SHUTDOWN COMPLETE]\n\nLooks like this bug is from the pre-git history museum. ;)\n\nFixes: 08707d5482df (\"lksctp-2_5_31-0_5_1.patch\")\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nAcked-by: Vlad Yasevich <vyasevich@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Joe Maples <joe@frap129.org>","distinct":true,"url":"https://api.github.com/repos/M2Repos/android_kernel_meizu_m2/commits/b6f7070eb09bd55b547f2a11556db35bdadccae6"},{"sha":"8be59437c651b49330c4cd8e52c3270a3c55e919","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"net: skb_needs_check() accepts CHECKSUM_NONE for tx\n\nMy recent change missed fact that UFO would perform a complete\nUDP checksum before segmenting in frags.\n\nIn this case skb->ip_summed is set to CHECKSUM_NONE.\n\nWe need to add this valid case to skb_needs_check()\n\nFixes: b2504a5dbef3 (\"net: reduce skb_warn_bad_offload() noise\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Willem de Bruijn <willemb@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Joe Maples <joe@frap129.org>","distinct":true,"url":"https://api.github.com/repos/M2Repos/android_kernel_meizu_m2/commits/8be59437c651b49330c4cd8e52c3270a3c55e919"},{"sha":"601d7287546f30051f7c349bfef1b8bbc8ae69a5","author":{"name":"Steffen Klassert","email":"e12a4e53ffae7bea4a26a8251851e5c5b883df46@secunet.com"},"message":"xfrm: Don't use sk_family for socket policy lookups\n\nOn IPv4-mapped IPv6 addresses sk_family is AF_INET6,\nbut the flow informations are created based on AF_INET.\nSo the routing set up 'struct flowi4' but we try to\naccess 'struct flowi6' what leads to an out of bounds\naccess. Fix this by using the family we get with the\ndst_entry, like we do it for the standard policy lookup.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: Joe Maples <joe@frap129.org>","distinct":true,"url":"https://api.github.com/repos/M2Repos/android_kernel_meizu_m2/commits/601d7287546f30051f7c349bfef1b8bbc8ae69a5"},{"sha":"c2f1b3601cf60ac5f567fda5a233a02ca14b364a","author":{"name":"fire855","email":"6f2e2fb9a1de2b038ea94ea925ad803ead27afee@gmail.com"},"message":"Merge mediatek security patches\n\n* Revert : Merge mediatek security patches (14326e25d3fc3b4d780c2d9d2eebbe3231ad5376)\n* Reapply : 14326e25d3fc3b4d780c2d9d2eebbe3231ad5376\n\nSigned-off-by: Mister Oyster <oysterized@gmail.com>","distinct":true,"url":"https://api.github.com/repos/M2Repos/android_kernel_meizu_m2/commits/c2f1b3601cf60ac5f567fda5a233a02ca14b364a"},{"sha":"d96522404ccff1dbbebe65dcdbb6124b2fcee2fb","author":{"name":"Mister Oyster","email":"dc0c819b008ce687a7f89349149f82de3cbbae07@gmail.com"},"message":"mtk: gps: upstream changes","distinct":true,"url":"https://api.github.com/repos/M2Repos/android_kernel_meizu_m2/commits/d96522404ccff1dbbebe65dcdbb6124b2fcee2fb"}]}
{"actor":{"display_login":"Dinolek"}}