{"push_id":2138124944,"size":33,"distinct_size":12,"ref":"refs/heads/aosp/android-3.18","head":"e0393a4d0df78b63c9ece775121cd6a5cf2431a3","before":"20e0cbdf8b301084f6a581defc1a492280f0a999","commits":[{"sha":"30cd7c3c8c54ee523497e37c05e4f53fd8802634","author":{"name":"Ard Biesheuvel","email":"80b89d4a5c0c8f00cebbb9c7d8a672c776f22af1@linaro.org"},"message":"UPSTREAM: ARM: 8318/1: treat CPU feature register fields as signed quantities\n\nThe various CPU feature registers consist of 4-bit blocks that\nrepresent signed quantities, whose positive values represent\nincremental features, and whose negative values are reserved.\n\nTo improve forward compatibility, update the feature detection\ncode to take possible future higher values into account, but\nignore negative values.\n\nSigned-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>\n(cherry picked from commit b8c9592b4a6c93211c8163888a97880d608503b5)\nChange-Id: Ib43b6b4a24015704ed57bbe536af8ad07530e246\nSigned-off-by: Eric Biggers <ebiggers@google.com>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/30cd7c3c8c54ee523497e37c05e4f53fd8802634"},{"sha":"145ab1f4d09a7af1220241c5452c5254cbdd9780","author":{"name":"Ard Biesheuvel","email":"80b89d4a5c0c8f00cebbb9c7d8a672c776f22af1@linaro.org"},"message":"UPSTREAM: ARM: 8319/1: advertise availability of v8 Crypto instructions\n\nWhen running the 32-bit ARM kernel on ARMv8 capable bare metal (e.g.,\n32-bit Android userland and kernel on a Cortex-A53), or as a KVM guest\non a 64-bit host, we should advertise the availability of the Crypto\ninstructions, so that userland libraries such as OpenSSL may use them.\n(Support for the v8 Crypto instructions in the 32-bit build was added\nto OpenSSL more than six months ago)\n\nThis adds the ID feature bit detection, and sets elf_hwcap2 accordingly.\n\nSigned-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>\n(cherry picked from commit a092aedb8115c16cb49bc64dd09cb20471ff942b)\nChange-Id: I14b20ebdaad29812fbbdb7bfc3661531950a54aa\nSigned-off-by: Eric Biggers <ebiggers@google.com>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/145ab1f4d09a7af1220241c5452c5254cbdd9780"},{"sha":"2aa408b18c3b2c25408c645e0970bf31f5dac859","author":{"name":"Vladimir Murzin","email":"d238da7533c76cfba8ad7a15752031e962fc43c9@arm.com"},"message":"UPSTREAM: ARM: 8563/1: fix demoting HWCAP_SWP\n\nCommit b8c9592 \"ARM: 8318/1: treat CPU feature register fields as signed\nquantities\" accidentally altered cpuid register used to demote\nHWCAP_SWP.\nARM ARM says that SyncPrim_instrs bits in ID_ISAR3 should be used with\nSynchPrim_instrs_frac from ID_ISAR4. So, follow this rule.\n\nSigned-off-by: Vladimir Murzin <vladimir.murzin@arm.com>\nAcked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>\n(cherry picked from commit 03f1217e5fafac8eb9e28aa8d04a67b6db1e435b)\nChange-Id: Iaec80be5c2ec4f46421a78dae4521f7bca22a2ab\nSigned-off-by: Eric Biggers <ebiggers@google.com>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/2aa408b18c3b2c25408c645e0970bf31f5dac859"},{"sha":"57545cc3e0ad6001738c46fbd624a0b150de27fd","author":{"name":"Vladimir Murzin","email":"d238da7533c76cfba8ad7a15752031e962fc43c9@arm.com"},"message":"UPSTREAM: ARM: 8564/1: fix cpu feature extracting helper\n\nCommit b8c9592 \"ARM: 8318/1: treat CPU feature register fields as signed\nquantities\" introduced helper to extract signed quantities of 4-bit\nblocks. However, with a current code feature with value 0b1000 isn't\nrejected as negative. So fix the \"if\" condition.\n\nReported-by: Jonathan Brawn <Jon.Brawn@arm.com>\nSigned-off-by: Vladimir Murzin <vladimir.murzin@arm.com>\nAcked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>\n(cherry picked from commit ac36a881b72a1e9831f1c59abf935868c90685cf)\nChange-Id: I7745736681331f8f18740675044612ad538c2ce3\nSigned-off-by: Eric Biggers <ebiggers@google.com>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/57545cc3e0ad6001738c46fbd624a0b150de27fd"},{"sha":"2a2ea6ca1f7521f563db0469184096bdd76cd347","author":{"name":"Ard Biesheuvel","email":"80b89d4a5c0c8f00cebbb9c7d8a672c776f22af1@linaro.org"},"message":"BACKPORT: crypto: arm - AES in ECB/CBC/CTR/XTS modes using ARMv8 Crypto Extensions\n\nThis implements the ECB, CBC, CTR and XTS asynchronous block ciphers\nusing the AArch32 versions of the ARMv8 Crypto Extensions for AES.\n\nSigned-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\n(cherry-picked from commit 86464859cc77ecfd989ad5c912bef167b1128b0b)\nChange-Id: I5d666b976345633243af9bfb690118895a319249\nSigned-off-by: Eric Biggers <ebiggers@google.com>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/2a2ea6ca1f7521f563db0469184096bdd76cd347"},{"sha":"203a37f418509e0117fbd95583daeecdc078dcda","author":{"name":"Ard Biesheuvel","email":"80b89d4a5c0c8f00cebbb9c7d8a672c776f22af1@linaro.org"},"message":"UPSTREAM: crypto: arm/aes - streamline AES-192 code path\n\nThis trims off a couple of instructions of the total size of the\ncore AES transform by reordering the final branch in the AES-192\ncode path with the rounds that are performed regardless of whether\nthe branch is taken or not. Other than the slight size reduction,\nthis has no performance benefit.\n\nFix up a comment regarding the prototype of this function while\nwe're at it.\n\nSigned-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\n(cherry picked from commit 6499e8cfaa8f5d041b20af24d8409dec9f3ac3d0)\nChange-Id: If77f938fba6b3cbfb3af577d40f668f18aef8290\nSigned-off-by: Eric Biggers <ebiggers@google.com>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/203a37f418509e0117fbd95583daeecdc078dcda"},{"sha":"c071afe2b97eece9faffa8525f29de7c41e6419c","author":{"name":"Ard Biesheuvel","email":"80b89d4a5c0c8f00cebbb9c7d8a672c776f22af1@linaro.org"},"message":"UPSTREAM: crypto: arm/aes-ctr - fix NULL dereference in tail processing\n\nThe AES-CTR glue code avoids calling into the blkcipher API for the\ntail portion of the walk, by comparing the remainder of walk.nbytes\nmodulo AES_BLOCK_SIZE with the residual nbytes, and jumping straight\ninto the tail processing block if they are equal. This tail processing\nblock checks whether nbytes != 0, and does nothing otherwise.\n\nHowever, in case of an allocation failure in the blkcipher layer, we\nmay enter this code with walk.nbytes == 0, while nbytes > 0. In this\ncase, we should not dereference the source and destination pointers,\nsince they may be NULL. So instead of checking for nbytes != 0, check\nfor (walk.nbytes % AES_BLOCK_SIZE) != 0, which implies the former in\nnon-error conditions.\n\nFixes: 86464859cc77 (\"crypto: arm - AES in ECB/CBC/CTR/XTS modes using ARMv8 Crypto Extensions\")\nCc: stable@vger.kernel.org\nReported-by: xiakaixu <xiakaixu@huawei.com>\nSigned-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\n(cherry picked from commit f82e90b28654804ab72881d577d87c3d5c65e2bc)\nChange-Id: Ie3b6479e96bb5c39cd89d2e575b983cc90021615\nSigned-off-by: Eric Biggers <ebiggers@google.com>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/c071afe2b97eece9faffa8525f29de7c41e6419c"},{"sha":"073c2ede2b59fe1242de5210bbc3bd9636d67260","author":{"name":"Ard Biesheuvel","email":"80b89d4a5c0c8f00cebbb9c7d8a672c776f22af1@linaro.org"},"message":"UPSTREAM: crypto: arm/aes-ce - fix for big endian\n\nThe AES key schedule generation is mostly endian agnostic, with the\nexception of the rotation and the incorporation of the round constant\nat the start of each round. So implement a big endian specific version\nof that part to make the whole routine big endian compatible.\n\nFixes: 86464859cc77 (\"crypto: arm - AES in ECB/CBC/CTR/XTS modes using ARMv8 Crypto Extensions\")\nSigned-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\n(cherry picked from commit 58010fa6f71c9577922b22e46014b95a4ec80fa0)\nChange-Id: I7eb0dc2f91c6ceba66f67a81c0d87aafdfd484a1\nSigned-off-by: Eric Biggers <ebiggers@google.com>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/073c2ede2b59fe1242de5210bbc3bd9636d67260"},{"sha":"009697541b5fce2a1df26b19216d7cb2af554a72","author":{"name":"Ard Biesheuvel","email":"80b89d4a5c0c8f00cebbb9c7d8a672c776f22af1@linaro.org"},"message":"UPSTREAM: arm64: crypto: reduce priority of core AES cipher\n\nThe asynchronous, merged implementations of AES in CBC, CTR and XTS\nmodes are preferred when available (i.e., when instantiating ablkciphers\nexplicitly). However, the synchronous core AES cipher combined with the\ngeneric CBC mode implementation will produce a 'cbc(aes)' blkcipher that\nis callable asynchronously as well. To prevent this implementation from\nbeing used when the accelerated asynchronous implemenation is also\navailable, lower its priority to 250 (i.e., below the asynchronous\nmodule's priority of 300).\n\nSigned-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nSigned-off-by: Catalin Marinas <catalin.marinas@arm.com>\n(cherry-picked from commit 08c6781cfaa196d4b257ec043c17e8746d9284e3)\nChange-Id: I50cd239615906dd70bf0a1bf945d40c9d95a3c00\nSigned-off-by: Eric Biggers <ebiggers@google.com>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/009697541b5fce2a1df26b19216d7cb2af554a72"},{"sha":"175a1da8548f93f0d3f9152885b11a807428d38d","author":{"name":"Eric Biggers","email":"0106d512ed1cb672be29d4b167a07ead51709fba@google.com"},"message":"ANDROID: arm: crypto: reduce priority of bit-sliced AES cipher\n\nAll the aes-bs (bit-sliced) and aes-ce (cryptographic extensions)\nalgorithms had a priority of 300.  This is undesirable because it means\nan aes-bs algorithm may be used when an aes-ce algorithm is available.\nThe aes-ce algorithms have much better performance.\n\nFix it by decreasing the priority of the aes-bs algorithms to 250.\n\nThis was fixed upstream by commit cc477bf64573 (\"crypto: arm/aes -\nreplace bit-sliced OpenSSL NEON code\"), but it was just a small part of\na complete rewrite.  This patch just fixes the priority bug.\n\nChange-Id: I478d67bfd77cb3807853b00976aae8496bb7f5ae\nSigned-off-by: Eric Biggers <ebiggers@google.com>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/175a1da8548f93f0d3f9152885b11a807428d38d"},{"sha":"458359bf7762a1bc4cde9671054680ff3c62f4d8","author":{"name":"Ard Biesheuvel","email":"80b89d4a5c0c8f00cebbb9c7d8a672c776f22af1@linaro.org"},"message":"BACKPORT: crypto: arm - add support for SHA-224/256 using ARMv8 Crypto Extensions\n\nThis implements the SHA-224/256 secure hash algorithm using the AArch32\nversions of the ARMv8 Crypto Extensions for SHA2.\n\nSigned-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\n(cherry-picked from commit 006d0624fa0d71787448cacee0195bf20f2d47c8)\n(increased .cra_priority to 300 because this kernel already had\n commit f2f770d74a8d (\"crypto: arm/sha256 - Add optimized SHA-256/224\")\n backported to it too)\nChange-Id: I2ba82e37426abe77c43f69e8bbd414e75d2dff14\nSigned-off-by: Eric Biggers <ebiggers@google.com>","distinct":true,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/458359bf7762a1bc4cde9671054680ff3c62f4d8"},{"sha":"41f612ae707e301e334872416582460674d03ef6","author":{"name":"Greg Kroah-Hartman","email":"4931344b09d7a7d3573e8b1ebec918e229ead9bf@linuxfoundation.org"},"message":"Revert \"ceph: unlock dangling spinlock in try_flush_caps()\"\n\nThis reverts commit 55d4aa12af57ea7782f0c8bbc3b01e44673b05ba which is\ncommit 6c2838fbdedb9b72a81c931d49e56b229b6cdbca upstream.\n\nThe locking issue was not a problem in 3.18, and now sparse rightly\ncomplains about this being an issue, so go back to the \"correct\" code.\n\nCc: Jeff Layton <jlayton@redhat.com>\nCc: \"Yan, Zheng\" <zyan@redhat.com>\nCc: Ilya Dryomov <idryomov@gmail.com>\nReported-by: kbuild test robot <fengguang.wu@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/41f612ae707e301e334872416582460674d03ef6"},{"sha":"6891c6fd2a500d1f39d1426765f610bdc2c2a39d","author":{"name":"Johannes Berg","email":"9a5936d824e6835dfe162c5611d10d2cf40ffbad@intel.com"},"message":"mac80211: accept key reinstall without changing anything\n\ncommit fdf7cb4185b60c68e1a75e61691c4afdc15dea0e upstream.\n\nWhen a key is reinstalled we can reset the replay counters\netc. which can lead to nonce reuse and/or replay detection\nbeing impossible, breaking security properties, as described\nin the \"KRACK attacks\".\n\nIn particular, CVE-2017-13080 applies to GTK rekeying that\nhappened in firmware while the host is in D3, with the second\npart of the attack being done after the host wakes up. In\nthis case, the wpa_supplicant mitigation isn't sufficient\nsince wpa_supplicant doesn't know the GTK material.\n\nIn case this happens, simply silently accept the new key\ncoming from userspace but don't take any action on it since\nit's the same key; this keeps the PN replay counters intact.\n\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nCc: Ben Hutchings <ben.hutchings@codethink.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/6891c6fd2a500d1f39d1426765f610bdc2c2a39d"},{"sha":"32025b5c58605cdc0552d7976d010f10fa13f28a","author":{"name":"Jason A. Donenfeld","email":"99e030c4305a4e4b1828d232b8797d3ca296d80a@zx2c4.com"},"message":"mac80211: use constant time comparison with keys\n\ncommit 2bdd713b92a9cade239d3c7d15205a09f556624d upstream.\n\nOtherwise we risk leaking information via timing side channel.\n\nFixes: fdf7cb4185b6 (\"mac80211: accept key reinstall without changing anything\")\nSigned-off-by: Jason A. Donenfeld <Jason@zx2c4.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nCc: Ben Hutchings <ben.hutchings@codethink.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/32025b5c58605cdc0552d7976d010f10fa13f28a"},{"sha":"241d7ab103703ef4060ff205aed0643378d013a1","author":{"name":"Johannes Berg","email":"9a5936d824e6835dfe162c5611d10d2cf40ffbad@intel.com"},"message":"mac80211: don't compare TKIP TX MIC key in reinstall prevention\n\ncommit cfbb0d90a7abb289edc91833d0905931f8805f12 upstream.\n\nFor the reinstall prevention, the code I had added compares the\nwhole key. It turns out though that iwlwifi firmware doesn't\nprovide the TKIP TX MIC key as it's not needed in client mode,\nand thus the comparison will always return false.\n\nFor client mode, thus always zero out the TX MIC key part before\ndoing the comparison in order to avoid accepting the reinstall\nof the key with identical encryption and RX MIC key, but not the\nsame TX MIC key (since the supplicant provides the real one.)\n\nFixes: fdf7cb4185b6 (\"mac80211: accept key reinstall without changing anything\")\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nCc: Ben Hutchings <ben.hutchings@codethink.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/241d7ab103703ef4060ff205aed0643378d013a1"},{"sha":"32530efaed51e4df01e2bc151822143d23ae403a","author":{"name":"Alan Stern","email":"5c4cbde65af01ad64f5b2177d0cd78ab5b01e5a1@rowland.harvard.edu"},"message":"usb: usbtest: fix NULL pointer dereference\n\ncommit 7c80f9e4a588f1925b07134bb2e3689335f6c6d8 upstream.\n\nIf the usbtest driver encounters a device with an IN bulk endpoint but\nno OUT bulk endpoint, it will try to dereference a NULL pointer\n(out->desc.bEndpointAddress).  The problem can be solved by adding a\nmissing test.\n\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>\nCc: Ben Hutchings <ben.hutchings@codethink.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/32530efaed51e4df01e2bc151822143d23ae403a"},{"sha":"c0f26c8f0562869e43e5001bed22817e6019d456","author":{"name":"Dmitry Torokhov","email":"e82e0cc9230e3683c557741cb5a2c8321ee072ee@gmail.com"},"message":"Input: ims-psu - check if CDC union descriptor is sane\n\ncommit ea04efee7635c9120d015dcdeeeb6988130cb67a upstream.\n\nBefore trying to use CDC union descriptor, try to validate whether that it\nis sane by checking that intf->altsetting->extra is big enough and that\ndescriptor bLength is not too big and not too small.\n\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nCc: Ben Hutchings <ben.hutchings@codethink.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/c0f26c8f0562869e43e5001bed22817e6019d456"},{"sha":"84ea7fc42294c7bbc4f6dc9ee7aa57366c9cf0c7","author":{"name":"Greg Kroah-Hartman","email":"4931344b09d7a7d3573e8b1ebec918e229ead9bf@linuxfoundation.org"},"message":"Revert \"ARM: dts: imx53-qsb-common: fix FEC pinmux config\"\n\nThis reverts commit 2eb85ef18c6570e8a59643cd8d5a66122461b1fc which is\ncommit 8b649e426336d7d4800ff9c82858328f4215ba01 upstream.\n\nTurns out not to be a good idea in the stable kernels for now as Patrick\nwrites:\n\tAs discussed for 4.4 stable queue this patch might break\n\texisting machines, if they use a different pinmux configuration\n\twith their own bootloader.\n\nReported-by: Patrick Brünn <P.Bruenn@beckhoff.com>\nCc: Shawn Guo <shawnguo@kernel.org>\nCc: Sasha Levin <alexander.levin@verizon.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/84ea7fc42294c7bbc4f6dc9ee7aa57366c9cf0c7"},{"sha":"5b0a3512492f4e5b47cadaa609d62e0363de667c","author":{"name":"Craig Gallek","email":"c6e2ad0efde8bc3e999e384eb1af5b8a235c7f1f@google.com"},"message":"tun/tap: sanitize TUNSETSNDBUF input\n\n\n[ Upstream commit 93161922c658c714715686cd0cf69b090cb9bf1d ]\n\nSyzkaller found several variants of the lockup below by setting negative\nvalues with the TUNSETSNDBUF ioctl.  This patch adds a sanity check\nto both the tun and tap versions of this ioctl.\n\n  watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [repro:2389]\n  Modules linked in:\n  irq event stamp: 329692056\n  hardirqs last  enabled at (329692055): [<ffffffff824b8381>] _raw_spin_unlock_irqrestore+0x31/0x75\n  hardirqs last disabled at (329692056): [<ffffffff824b9e58>] apic_timer_interrupt+0x98/0xb0\n  softirqs last  enabled at (35659740): [<ffffffff824bc958>] __do_softirq+0x328/0x48c\n  softirqs last disabled at (35659731): [<ffffffff811c796c>] irq_exit+0xbc/0xd0\n  CPU: 0 PID: 2389 Comm: repro Not tainted 4.14.0-rc7 #23\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n  task: ffff880009452140 task.stack: ffff880006a20000\n  RIP: 0010:_raw_spin_lock_irqsave+0x11/0x80\n  RSP: 0018:ffff880006a27c50 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10\n  RAX: ffff880009ac68d0 RBX: ffff880006a27ce0 RCX: 0000000000000000\n  RDX: 0000000000000001 RSI: ffff880006a27ce0 RDI: ffff880009ac6900\n  RBP: ffff880006a27c60 R08: 0000000000000000 R09: 0000000000000000\n  R10: 0000000000000001 R11: 000000000063ff00 R12: ffff880009ac6900\n  R13: ffff880006a27cf8 R14: 0000000000000001 R15: ffff880006a27cf8\n  FS:  00007f4be4838700(0000) GS:ffff88000cc00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000000020101000 CR3: 0000000009616000 CR4: 00000000000006f0\n  Call Trace:\n   prepare_to_wait+0x26/0xc0\n   sock_alloc_send_pskb+0x14e/0x270\n   ? remove_wait_queue+0x60/0x60\n   tun_get_user+0x2cc/0x19d0\n   ? __tun_get+0x60/0x1b0\n   tun_chr_write_iter+0x57/0x86\n   __vfs_write+0x156/0x1e0\n   vfs_write+0xf7/0x230\n   SyS_write+0x57/0xd0\n   entry_SYSCALL_64_fastpath+0x1f/0xbe\n  RIP: 0033:0x7f4be4356df9\n  RSP: 002b:00007ffc18101c08 EFLAGS: 00000293 ORIG_RAX: 0000000000000001\n  RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f4be4356df9\n  RDX: 0000000000000046 RSI: 0000000020101000 RDI: 0000000000000005\n  RBP: 00007ffc18101c40 R08: 0000000000000001 R09: 0000000000000001\n  R10: 0000000000000001 R11: 0000000000000293 R12: 0000559c75f64780\n  R13: 00007ffc18101d30 R14: 0000000000000000 R15: 0000000000000000\n\nFixes: 33dccbb050bb (\"tun: Limit amount of queued packets per device\")\nFixes: 20d29d7a916a (\"net: macvtap driver\")\nSigned-off-by: Craig Gallek <kraig@google.com>\nReviewed-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/5b0a3512492f4e5b47cadaa609d62e0363de667c"},{"sha":"54bcfd5d715280ae21adabf724df68f4f3bf9051","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"tcp: fix tcp_mtu_probe() vs highest_sack\n\n\n[ Upstream commit 2b7cda9c35d3b940eb9ce74b30bbd5eb30db493d ]\n\nBased on SNMP values provided by Roman, Yuchung made the observation\nthat some crashes in tcp_sacktag_walk() might be caused by MTU probing.\n\nLooking at tcp_mtu_probe(), I found that when a new skb was placed\nin front of the write queue, we were not updating tcp highest sack.\n\nIf one skb is freed because all its content was copied to the new skb\n(for MTU probing), then tp->highest_sack could point to a now freed skb.\n\nBad things would then happen, including infinite loops.\n\nThis patch renames tcp_highest_sack_combine() and uses it\nfrom tcp_mtu_probe() to fix the bug.\n\nNote that I also removed one test against tp->sacked_out,\nsince we want to replace tp->highest_sack regardless of whatever\ncondition, since keeping a stale pointer to freed skb is a recipe\nfor disaster.\n\nFixes: a47e5a988a57 (\"[TCP]: Convert highest_sack to sk_buff to allow direct access\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>\nReported-by: Roman Gushchin <guro@fb.com>\nReported-by: Oleksandr Natalenko <oleksandr@natalenko.name>\nAcked-by: Alexei Starovoitov <ast@kernel.org>\nAcked-by: Neal Cardwell <ncardwell@google.com>\nAcked-by: Yuchung Cheng <ycheng@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/54bcfd5d715280ae21adabf724df68f4f3bf9051"}]}
{"actor":{"display_login":"Jackeagle"}}