{"push_id":2041046276,"size":11,"distinct_size":11,"ref":"refs/heads/drm-tip","head":"c5e232301059b06a09fa2352c4c23de7ca3172e5","before":"6bcaf2275e52e258c737bc355e73072640be5ac3","commits":[{"sha":"19b592dae895aad10b84246b0e12caad04e9eb0d","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: seq: Add sanity check for user-space pointer delivery\n\nThe sequencer event may contain a user-space pointer with its\nSNDRV_SEQ_EXT_USRPTR bit, and we assure that its delivery is limited\nwith non-atomic mode.  Otherwise the copy_from_user() may hit the\nfault and cause a problem.  Although the core code doesn't set such a\nflag (only set at snd_seq_write()), any wild driver may set it\nmistakenly and lead to an unexpected crash.\n\nThis patch adds a sanity check of such events at the delivery core\ncode to filter out the invalid invocation in the atomic mode.\n\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/freedesktop/drm-tip/commits/19b592dae895aad10b84246b0e12caad04e9eb0d"},{"sha":"124751d5e63c823092060074bd0abaae61aaa9c4","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: usb-audio: Kill stray URB at exiting\n\nUSB-audio driver may leave a stray URB for the mixer interrupt when it\nexits by some error during probe.  This leads to a use-after-free\nerror as spotted by syzkaller like:\n  ==================================================================\n  BUG: KASAN: use-after-free in snd_usb_mixer_interrupt+0x604/0x6f0\n  Call Trace:\n   <IRQ>\n   __dump_stack lib/dump_stack.c:16\n   dump_stack+0x292/0x395 lib/dump_stack.c:52\n   print_address_description+0x78/0x280 mm/kasan/report.c:252\n   kasan_report_error mm/kasan/report.c:351\n   kasan_report+0x23d/0x350 mm/kasan/report.c:409\n   __asan_report_load8_noabort+0x19/0x20 mm/kasan/report.c:430\n   snd_usb_mixer_interrupt+0x604/0x6f0 sound/usb/mixer.c:2490\n   __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779\n   ....\n\n  Allocated by task 1484:\n   save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59\n   save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n   set_track mm/kasan/kasan.c:459\n   kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551\n   kmem_cache_alloc_trace+0x11e/0x2d0 mm/slub.c:2772\n   kmalloc ./include/linux/slab.h:493\n   kzalloc ./include/linux/slab.h:666\n   snd_usb_create_mixer+0x145/0x1010 sound/usb/mixer.c:2540\n   create_standard_mixer_quirk+0x58/0x80 sound/usb/quirks.c:516\n   snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560\n   create_composite_quirk+0x1c4/0x3e0 sound/usb/quirks.c:59\n   snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560\n   usb_audio_probe+0x1040/0x2c10 sound/usb/card.c:618\n   ....\n\n  Freed by task 1484:\n   save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59\n   save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n   set_track mm/kasan/kasan.c:459\n   kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:524\n   slab_free_hook mm/slub.c:1390\n   slab_free_freelist_hook mm/slub.c:1412\n   slab_free mm/slub.c:2988\n   kfree+0xf6/0x2f0 mm/slub.c:3919\n   snd_usb_mixer_free+0x11a/0x160 sound/usb/mixer.c:2244\n   snd_usb_mixer_dev_free+0x36/0x50 sound/usb/mixer.c:2250\n   __snd_device_free+0x1ff/0x380 sound/core/device.c:91\n   snd_device_free_all+0x8f/0xe0 sound/core/device.c:244\n   snd_card_do_free sound/core/init.c:461\n   release_card_device+0x47/0x170 sound/core/init.c:181\n   device_release+0x13f/0x210 drivers/base/core.c:814\n   ....\n\nActually such a URB is killed properly at disconnection when the\ndevice gets probed successfully, and what we need is to apply it for\nthe error-path, too.\n\nIn this patch, we apply snd_usb_mixer_disconnect() at releasing.\nAlso introduce a new flag, disconnected, to struct usb_mixer_interface\nfor not performing the disconnection procedure twice.\n\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/freedesktop/drm-tip/commits/124751d5e63c823092060074bd0abaae61aaa9c4"},{"sha":"dc2279e169f0676b969014c02689c4bbb069ad01","author":{"name":"Mika Kuoppala","email":"4f6c5aa64408eebf7c5a75a8d3acd995810a94fd@linux.intel.com"},"message":"drm/i915: Use execlists_num_ports instead of size of array\n\nThere is function to tell how many ports we have, so use it.\nWe still have direct relationship with array size and port count,\nso no harm was done.\n\nFixes: 76e70087d360 (\"drm/i915: Make execlist port count variable\")\nCc: Mika Kuoppala <mika.kuoppala@intel.com>\nCc: Chris Wilson <chris@chris-wilson.co.uk>\nSigned-off-by: Mika Kuoppala <mika.kuoppala@intel.com>\nReviewed-by: Chris Wilson <chris@chris-wilson.co.uk>\nReviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>\nLink: https://patchwork.freedesktop.org/patch/msgid/20171010114857.13108-1-mika.kuoppala@intel.com","distinct":true,"url":"https://api.github.com/repos/freedesktop/drm-tip/commits/dc2279e169f0676b969014c02689c4bbb069ad01"},{"sha":"86201d54aa0aa896386d9809c2ff96470d3cd269","author":{"name":"Mika Kuoppala","email":"4f6c5aa64408eebf7c5a75a8d3acd995810a94fd@linux.intel.com"},"message":"Merge remote-tracking branch 'drm-intel/drm-intel-next-queued' into drm-tip\n\n# Conflicts:\n#\tdrivers/gpu/drm/i915/intel_display.c\n#\tdrivers/gpu/drm/i915/intel_runtime_pm.c","distinct":true,"url":"https://api.github.com/repos/freedesktop/drm-tip/commits/86201d54aa0aa896386d9809c2ff96470d3cd269"},{"sha":"71386f7286038e73d997227725f866675ffdeece","author":{"name":"Mika Kuoppala","email":"4f6c5aa64408eebf7c5a75a8d3acd995810a94fd@linux.intel.com"},"message":"Merge remote-tracking branch 'airlied/drm-next' into drm-tip","distinct":true,"url":"https://api.github.com/repos/freedesktop/drm-tip/commits/71386f7286038e73d997227725f866675ffdeece"},{"sha":"3ca76ba42f34946d902d8a720ee817a6e24e53b7","author":{"name":"Mika Kuoppala","email":"4f6c5aa64408eebf7c5a75a8d3acd995810a94fd@linux.intel.com"},"message":"Merge remote-tracking branch 'sound/for-next' into drm-tip","distinct":true,"url":"https://api.github.com/repos/freedesktop/drm-tip/commits/3ca76ba42f34946d902d8a720ee817a6e24e53b7"},{"sha":"afd7873e543ac07edec9baa805f34635f740f657","author":{"name":"Mika Kuoppala","email":"4f6c5aa64408eebf7c5a75a8d3acd995810a94fd@linux.intel.com"},"message":"Merge remote-tracking branch 'sound/for-linus' into drm-tip","distinct":true,"url":"https://api.github.com/repos/freedesktop/drm-tip/commits/afd7873e543ac07edec9baa805f34635f740f657"},{"sha":"9be9b05859853c7fbab9fd4faa45b9466a7a508b","author":{"name":"Mika Kuoppala","email":"4f6c5aa64408eebf7c5a75a8d3acd995810a94fd@linux.intel.com"},"message":"Merge remote-tracking branch 'drm-intel/topic/core-for-CI' into drm-tip","distinct":true,"url":"https://api.github.com/repos/freedesktop/drm-tip/commits/9be9b05859853c7fbab9fd4faa45b9466a7a508b"},{"sha":"c886be5db17fe7fea512fccff8f06a313a77e799","author":{"name":"Mika Kuoppala","email":"4f6c5aa64408eebf7c5a75a8d3acd995810a94fd@linux.intel.com"},"message":"Merge remote-tracking branch 'drm-misc/drm-misc-next' into drm-tip","distinct":true,"url":"https://api.github.com/repos/freedesktop/drm-tip/commits/c886be5db17fe7fea512fccff8f06a313a77e799"},{"sha":"b32aa61303adb7c806d114e88052d05ddb03041d","author":{"name":"Mika Kuoppala","email":"4f6c5aa64408eebf7c5a75a8d3acd995810a94fd@linux.intel.com"},"message":"Merge remote-tracking branch 'drm-misc/drm-misc-fixes' into drm-tip","distinct":true,"url":"https://api.github.com/repos/freedesktop/drm-tip/commits/b32aa61303adb7c806d114e88052d05ddb03041d"},{"sha":"c5e232301059b06a09fa2352c4c23de7ca3172e5","author":{"name":"Mika Kuoppala","email":"4f6c5aa64408eebf7c5a75a8d3acd995810a94fd@linux.intel.com"},"message":"drm-tip: 2017y-10m-10d-13h-29m-53s UTC integration manifest","distinct":true,"url":"https://api.github.com/repos/freedesktop/drm-tip/commits/c5e232301059b06a09fa2352c4c23de7ca3172e5"}]}
{"actor":{"display_login":"fdo-mirror"}}