payload: {"push_id":3562551280,"size":11,"distinct_size":11,"ref":"refs/heads/master","head":"f2bc9c908dfe3f56fe4ca4d92e5c5be80963b973","before":"83a50840e72a5a964b4704fcdc2fbb2d771015ab","commits":[{"sha":"c01c348ecdc66085e44912c97368809612231520","author":{"name":"Alan Stern","email":"75ea6bb7bfc1186f92d26164de5f9268c9a45b59@rowland.harvard.edu"},"message":"USB: core: Fix unterminated string returned by usb_string()\n\nSome drivers (such as the vub300 MMC driver) expect usb_string() to\nreturn a properly NUL-terminated string, even when an error occurs.\n(In fact, vub300's probe routine doesn't bother to check the return\ncode from usb_string().)  When the driver goes on to use an\nunterminated string, it leads to kernel errors such as\nstack-out-of-bounds, as found by the syzkaller USB fuzzer.\n\nAn out-of-range string index argument is not at all unlikely, given\nthat some devices don't provide string descriptors and therefore list\n0 as the value for their string indexes.  This patch makes\nusb_string() return a properly terminated empty string along with the\n-EINVAL error code when an out-of-range index is encountered.\n\nAnd since a USB string index is a single-byte value, indexes >= 256\nare just as invalid as values of 0 or below.\n\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-by: syzbot+b75b85111c10b8d680f1@syzkaller.appspotmail.com\nCC: <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kzlin129/linux/commits/c01c348ecdc66085e44912c97368809612231520"},{"sha":"fc834e607ae3d18e1a20bca3f9a2d7f52ea7a2be","author":{"name":"Alan Stern","email":"75ea6bb7bfc1186f92d26164de5f9268c9a45b59@rowland.harvard.edu"},"message":"USB: dummy-hcd: Fix failure to give back unlinked URBs\n\nThe syzkaller USB fuzzer identified a failure mode in which dummy-hcd\nwould never give back an unlinked URB.  This causes usb_kill_urb() to\nhang, leading to WARNINGs and unkillable threads.\n\nIn dummy-hcd, all URBs are given back by the dummy_timer() routine as\nit scans through the list of pending URBS.  Failure to give back URBs\ncan be caused by failure to start or early exit from the scanning\nloop.  The code currently has two such pathways: One is triggered when\nan unsupported bus transfer speed is encountered, and the other by\nexhausting the simulated bandwidth for USB transfers during a frame.\n\nThis patch removes those two paths, thereby allowing all unlinked URBs\nto be given back in a timely manner.  It adds a check for the bus\nspeed when the gadget first starts running, so that dummy_timer() will\nnever thereafter encounter an unsupported speed.  And it prevents the\nloop from exiting as soon as the total bandwidth has been used up (the\nscanning loop continues, giving back unlinked URBs as they are found,\nbut not transferring any more data).\n\nThanks to Andrey Konovalov for manually running the syzkaller fuzzer\nto help track down the source of the bug.\n\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-and-tested-by: syzbot+d919b0f29d7b5a4994b9@syzkaller.appspotmail.com\nCC: <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kzlin129/linux/commits/fc834e607ae3d18e1a20bca3f9a2d7f52ea7a2be"},{"sha":"c2b71462d294cf517a0bc6e4fd6424d7cee5596f","author":{"name":"Alan Stern","email":"75ea6bb7bfc1186f92d26164de5f9268c9a45b59@rowland.harvard.edu"},"message":"USB: core: Fix bug caused by duplicate interface PM usage counter\n\nThe syzkaller fuzzer reported a bug in the USB hub driver which turned\nout to be caused by a negative runtime-PM usage counter.  This allowed\na hub to be runtime suspended at a time when the driver did not expect\nit.  The symptom is a WARNING issued because the hub's status URB is\nsubmitted while it is already active:\n\n\tURB 0000000031fb463e submitted while active\n\tWARNING: CPU: 0 PID: 2917 at drivers/usb/core/urb.c:363\n\nThe negative runtime-PM usage count was caused by an unfortunate\ndesign decision made when runtime PM was first implemented for USB.\nAt that time, USB class drivers were allowed to unbind from their\ninterfaces without balancing the usage counter (i.e., leaving it with\na positive count).  The core code would take care of setting the\ncounter back to 0 before allowing another driver to bind to the\ninterface.\n\nLater on when runtime PM was implemented for the entire kernel, the\nopposite decision was made: Drivers were required to balance their\nruntime-PM get and put calls.  In order to maintain backward\ncompatibility, however, the USB subsystem adapted to the new\nimplementation by keeping an independent usage counter for each\ninterface and using it to automatically adjust the normal usage\ncounter back to 0 whenever a driver was unbound.\n\nThis approach involves duplicating information, but what is worse, it\ndoesn't work properly in cases where a USB class driver delays\ndecrementing the usage counter until after the driver's disconnect()\nroutine has returned and the counter has been adjusted back to 0.\nDoing so would cause the usage counter to become negative.  There's\neven a warning about this in the USB power management documentation!\n\nAs it happens, this is exactly what the hub driver does.  The\nkick_hub_wq() routine increments the runtime-PM usage counter, and the\ncorresponding decrement is carried out by hub_event() in the context\nof the hub_wq work-queue thread.  This work routine may sometimes run\nafter the driver has been unbound from its interface, and when it does\nit causes the usage counter to go negative.\n\nIt is not possible for hub_disconnect() to wait for a pending\nhub_event() call to finish, because hub_disconnect() is called with\nthe device lock held and hub_event() acquires that lock.  The only\nfeasible fix is to reverse the original design decision: remove the\nduplicate interface-specific usage counter and require USB drivers to\nbalance their runtime PM gets and puts.  As far as I know, all\nexisting drivers currently do this.\n\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-and-tested-by: syzbot+7634edaea4d0b341c625@syzkaller.appspotmail.com\nCC: <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kzlin129/linux/commits/c2b71462d294cf517a0bc6e4fd6424d7cee5596f"},{"sha":"c409ca3be3c6ff3a1eeb303b191184e80d412862","author":{"name":"Malte Leip","email":"f86269caa3ec46342a6486a451f859b034c33bf5@leip.net"},"message":"usb: usbip: fix isoc packet num validation in get_pipe\n\nChange the validation of number_of_packets in get_pipe to compare the\nnumber of packets to a fixed maximum number of packets allowed, set to\nbe 1024. This number was chosen due to it being used by other drivers as\nwell, for example drivers/usb/host/uhci-q.c\n\nBackground/reason:\nThe get_pipe function in stub_rx.c validates the number of packets in\nisochronous mode and aborts with an error if that number is too large,\nin order to prevent malicious input from possibly triggering large\nmemory allocations. This was previously done by checking whether\npdu->u.cmd_submit.number_of_packets is bigger than the number of packets\nthat would be needed for pdu->u.cmd_submit.transfer_buffer_length bytes\nif all except possibly the last packet had maximum length, given by\nusb_endpoint_maxp(epd) *  usb_endpoint_maxp_mult(epd). This leads to an\nerror if URBs with packets shorter than the maximum possible length are\nsubmitted, which is allowed according to\nDocumentation/driver-api/usb/URB.rst and occurs for example with the\nsnd-usb-audio driver.\n\nFixes: c6688ef9f297 (\"usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input\")\nSigned-off-by: Malte Leip <malte@leip.net>\nCc: stable <stable@vger.kernel.org>\nAcked-by: Shuah Khan <skhan@linuxfoundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kzlin129/linux/commits/c409ca3be3c6ff3a1eeb303b191184e80d412862"},{"sha":"ef61eb43ada6c1d6b94668f0f514e4c268093ff3","author":{"name":"Alan Stern","email":"75ea6bb7bfc1186f92d26164de5f9268c9a45b59@rowland.harvard.edu"},"message":"USB: yurex: Fix protection fault after device removal\n\nThe syzkaller USB fuzzer found a general-protection-fault bug in the\nyurex driver.  The fault occurs when a device has been unplugged; the\ndriver's interrupt-URB handler logs an error message referring to the\ndevice by name, after the device has been unregistered and its name\ndeallocated.\n\nThis problem is caused by the fact that the interrupt URB isn't\ncancelled until the driver's private data structure is released, which\ncan happen long after the device is gone.  The cure is to make sure\nthat the interrupt URB is killed before yurex_disconnect() returns;\nthis is exactly the sort of thing that usb_poison_urb() was meant for.\n\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-and-tested-by: syzbot+2eb9121678bdb36e6d57@syzkaller.appspotmail.com\nCC: <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kzlin129/linux/commits/ef61eb43ada6c1d6b94668f0f514e4c268093ff3"},{"sha":"c114944d7d67f24e71562fcfc18d550ab787e4d4","author":{"name":"Alan Stern","email":"75ea6bb7bfc1186f92d26164de5f9268c9a45b59@rowland.harvard.edu"},"message":"USB: w1 ds2490: Fix bug caused by improper use of altsetting array\n\nThe syzkaller USB fuzzer spotted a slab-out-of-bounds bug in the\nds2490 driver.  This bug is caused by improper use of the altsetting\narray in the usb_interface structure (the array's entries are not\nalways stored in numerical order), combined with a naive assumption\nthat all interfaces probed by the driver will have the expected number\nof altsettings.\n\nThe bug can be fixed by replacing references to the possibly\nnon-existent intf->altsetting[alt] entry with the guaranteed-to-exist\nintf->cur_altsetting entry.\n\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-and-tested-by: syzbot+d65f673b847a1a96cdba@syzkaller.appspotmail.com\nCC: <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kzlin129/linux/commits/c114944d7d67f24e71562fcfc18d550ab787e4d4"},{"sha":"b1da6a51871c6929dced1a7fad81990988b36ed6","author":{"name":"Jan Kara","email":"596727c8a0ea4db3ba2ceceedccbacd3d7b371b8@suse.cz"},"message":"fsnotify: Fix NULL ptr deref in fanotify_get_fsid()\n\nfanotify_get_fsid() is reading mark->connector->fsid under srcu. It can\nhappen that it sees mark not fully initialized or mark that is already\ndetached from the object list. In these cases mark->connector\ncan be NULL leading to NULL ptr dereference. Fix the problem by\nbeing careful when reading mark->connector and check it for being NULL.\nAlso use WRITE_ONCE when writing the mark just to prevent compiler from\ndoing something stupid.\n\nReported-by: syzbot+15927486a4f1bfcbaf91@syzkaller.appspotmail.com\nFixes: 77115225acc6 (\"fanotify: cache fsid in fsnotify_mark_connector\")\nSigned-off-by: Jan Kara <jack@suse.cz>","distinct":true,"url":"https://api.github.com/repos/kzlin129/linux/commits/b1da6a51871c6929dced1a7fad81990988b36ed6"},{"sha":"dfbd199a7cfe3e3cd8531e1353cdbd7175bfbc5e","author":{"name":"Paulo Alcantara","email":"fd077434a7c3095bfe440741787d02f6a7bab07e@paulo.ac"},"message":"selinux: use kernel linux/socket.h for genheaders and mdp\n\nWhen compiling genheaders and mdp from a newer host kernel, the\nfollowing error happens:\n\n    In file included from scripts/selinux/genheaders/genheaders.c:18:\n    ./security/selinux/include/classmap.h:238:2: error: #error New\n    address family defined, please update secclass_map.  #error New\n    address family defined, please update secclass_map.  ^~~~~\n    make[3]: *** [scripts/Makefile.host:107:\n    scripts/selinux/genheaders/genheaders] Error 1 make[2]: ***\n    [scripts/Makefile.build:599: scripts/selinux/genheaders] Error 2\n    make[1]: *** [scripts/Makefile.build:599: scripts/selinux] Error 2\n    make[1]: *** Waiting for unfinished jobs....\n\nInstead of relying on the host definition, include linux/socket.h in\nclassmap.h to have PF_MAX.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Paulo Alcantara <paulo@paulo.ac>\nAcked-by: Stephen Smalley <sds@tycho.nsa.gov>\n[PM: manually merge in mdp.c, subject line tweaks]\nSigned-off-by: Paul Moore <paul@paul-moore.com>","distinct":true,"url":"https://api.github.com/repos/kzlin129/linux/commits/dfbd199a7cfe3e3cd8531e1353cdbd7175bfbc5e"},{"sha":"fea27bc7ff43a8beb6bebe6d4fe9eb889e185d4a","author":{"name":"Linus Torvalds","email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org"},"message":"Merge tag 'selinux-pr-20190429' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux\n\nPull selinux fix from Paul Moore:\n \"One small patch for the stable folks to fix a problem when building\n  against the latest glibc.\n\n  I'll be honest and say that I'm not really thrilled with the idea of\n  sending this up right now, but Greg is a little annoyed so here I\n  figured I would at least send this\"\n\n* tag 'selinux-pr-20190429' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:\n  selinux: use kernel linux/socket.h for genheaders and mdp","distinct":true,"url":"https://api.github.com/repos/kzlin129/linux/commits/fea27bc7ff43a8beb6bebe6d4fe9eb889e185d4a"},{"sha":"bf3bd966dfd7d9582f50e9bd08b15922197cd277","author":{"name":"Linus Torvalds","email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org"},"message":"Merge tag 'usb-5.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB fixes from Greg KH:\n \"Here are some small USB fixes for a bunch of warnings/errors that the\n  syzbot has been finding with it's new-found ability to stress-test the\n  USB layer.\n\n  All of these are tiny, but fix real issues, and are marked for stable\n  as well. All of these have had lots of testing in linux-next as well\"\n\n* tag 'usb-5.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:\n  USB: w1 ds2490: Fix bug caused by improper use of altsetting array\n  USB: yurex: Fix protection fault after device removal\n  usb: usbip: fix isoc packet num validation in get_pipe\n  USB: core: Fix bug caused by duplicate interface PM usage counter\n  USB: dummy-hcd: Fix failure to give back unlinked URBs\n  USB: core: Fix unterminated string returned by usb_string()","distinct":true,"url":"https://api.github.com/repos/kzlin129/linux/commits/bf3bd966dfd7d9582f50e9bd08b15922197cd277"},{"sha":"f2bc9c908dfe3f56fe4ca4d92e5c5be80963b973","author":{"name":"Linus Torvalds","email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org"},"message":"Merge tag 'fsnotify_for_v5.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs\n\nPull fsnotify fix from Jan Kara:\n \"A fix of user trigerable NULL pointer dereference syzbot has recently\n  spotted.\n\n  The problem was introduced in this merge window so no CC stable is\n  needed\"\n\n* tag 'fsnotify_for_v5.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:\n  fsnotify: Fix NULL ptr deref in fanotify_get_fsid()","distinct":true,"url":"https://api.github.com/repos/kzlin129/linux/commits/f2bc9c908dfe3f56fe4ca4d92e5c5be80963b973"}]}
other: {"actor":{"display_login":"kzlin129"}}