| <?xml version="1.0" encoding="utf-8"?><manifest revision="e2fecc6cebfbe4ffc5ca537cbaa23e8c5c30fc21"> |
| <notice>Your sources have been sync'd successfully.</notice> |
| <remote fetch="https://android.googlesource.com" name="aosp" review="https://android-review.googlesource.com"/> |
| <remote alias="cros" fetch="https://chromium.googlesource.com/" name="chromium"/> |
| <remote fetch="https://chromium.googlesource.com" name="cros" review="https://chromium-review.googlesource.com"/> |
| <default remote="cros" revision="refs/heads/master" sync-j="8"/> |
| <project name="aosp/platform/external/dbus-binding-generator" path="src/aosp/external/dbus-binding-generator" revision="aefc886d79a17c983df42a462e3a32a9175a42a5" upstream="refs/heads/master"/> |
| <project name="aosp/platform/external/libbrillo" path="src/aosp/external/libbrillo" revision="ce533da748d089c6f1cbd8a0b3b22713a5e229a6" upstream="refs/heads/master"/> |
| <project name="aosp/platform/external/libchrome" path="src/aosp/external/libchrome" revision="b86156c4a5e2cb10b69a2bccbade9b8d359f3662" upstream="refs/heads/master"/> |
| <project name="aosp/platform/external/modp_b64" path="src/third_party/modp_b64" revision="99dc13926931cedfd2e4e582c33ef657d0645c5c" upstream="refs/heads/master"/> |
| <project name="aosp/platform/system/connectivity/apmanager" path="src/aosp/system/connectivity/apmanager" revision="b606f03ee5a4d7a5f5f78cc980a447f08d94f9df" upstream="refs/heads/master"/> |
| <project name="aosp/platform/system/connectivity/shill" path="src/aosp/system/connectivity/shill" revision="0820a9e45f6c8b808c554b85ef1aae7c3a60787a" upstream="refs/heads/master"/> |
| <project name="aosp/platform/system/firewalld" path="src/aosp/system/firewalld" revision="87c3339226126dfdbd70c7e7cd5fd35d599affba" upstream="refs/heads/master"/> |
| <project name="aosp/platform/system/tpm" path="src/aosp/system/tpm" revision="694a4b0604a7bd916ca108678d7547971687833c" upstream="refs/heads/master"/> |
| <project name="aosp/platform/system/update_engine" path="src/aosp/system/update_engine" revision="d63fab316ce21410b9afba0fc8daf817562bb2e5" upstream="refs/heads/master"/> |
| <project name="aosp/platform/system/webservd" path="src/aosp/system/webservd" revision="4da81ccb6cbe745c0f4c6e272963082a08eae7ab" upstream="refs/heads/master"/> |
| <project name="apps/libapps" path="src/third_party/libapps" revision="6cec52ab8e442a4ec35c16907187f4e1a21a286f" upstream="refs/heads/master"> |
| <annotation name="branch-mode" value="pin"/> |
| </project> |
| <project name="chromium/deps/libmtp" path="chromium/src/third_party/libmtp" remote="chromium" revision="4a93e2cfc133473ae58f17374c32669eea9a8912" upstream="refs/heads/master"/> |
| <project name="chromium/src/third_party/hwcplus" remote="chromium" revision="e66a31e54e12906e86dc59f95b458889f025c505" upstream="refs/heads/master"/> |
| <project groups="minilayout,buildtools,labtools" name="chromium/tools/depot_tools" remote="chromium" revision="1c822ade1f731ec35a3d2d3be8805f773df22c4c"/> |
| <project groups="minilayout,buildtools,labtools" name="chromiumos/chromite" path="chromite" revision="b8fb1bff1866371a7e5d083ceca92b19e943c015" upstream="refs/heads/master"> |
| <copyfile dest="AUTHORS" src="AUTHORS"/> |
| <copyfile dest="LICENSE" src="LICENSE"/> |
| </project> |
| <project groups="minilayout,buildtools" name="chromiumos/chromite/pip_packages" path="chromite/venv/pip_packages" revision="e6f67995422c55319c5f1840bbe06efc7f1b8ade" upstream="refs/heads/master"/> |
| <project name="chromiumos/manifest" path="manifest" revision="589dced034f6321beec7027a778985a6458429b6" upstream="refs/heads/master"/> |
| <project groups="minilayout" name="chromiumos/overlays/board-overlays" path="src/overlays" revision="47ca5090574a8f8bd07eb35cb289b49d94bc8f8b" upstream="refs/heads/master"/> |
| <project groups="minilayout,labtools" name="chromiumos/overlays/chromiumos-overlay" path="src/third_party/chromiumos-overlay" revision="4b5b4310f47a2980993c941cd8c78a46b737e07a" sync-c="true" upstream="refs/heads/master"/> |
| <project groups="minilayout,labtools" name="chromiumos/overlays/eclass-overlay" path="src/third_party/eclass-overlay" revision="4b7783530bf6becbb364ce5aaaef068dc11c9a56" upstream="refs/heads/master"/> |
| <project groups="minilayout,labtools" name="chromiumos/overlays/portage-stable" path="src/third_party/portage-stable" revision="1fc3b5dbd31e1eb02fe737f9cda59ed38ffeaf73" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/arc-camera" path="src/platform/arc-camera" revision="07257507ce3cfb30e1e3c4c1a0eb4f0cb6fbe23d" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/assets" path="src/platform/assets" revision="abcb13ba07474d106a45da7eb266a96eb9369516" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/audiotest" path="src/platform/audiotest" revision="65db5b778b0dc72778c86e0e8ce47ab353a1bf74" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/battery_updater" path="src/platform/battery_updater" revision="32463c6de8e8c98d4b1711937bc7678afc121a85" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/bmpblk" path="src/platform/bmpblk" revision="1c971a6cb97481c7fee41991453a22c552aeead7" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/bootcache" path="src/platform/bootcache" revision="ebe3a0995e90026433ffc62b7aeed6cad1f28694" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/btsocket" path="src/platform/btsocket" revision="1b65449a647c99556511df30b8ab660b98acce7f" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/chameleon" path="src/platform/chameleon" revision="91e048d29e1962f951985a7d92d06f5ff62e2a0e" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/chromiumos-assets" path="src/platform/chromiumos-assets" revision="05ce8d3c59a2d8e765b3beb2e1a69e7fcf59e5ba" upstream="refs/heads/master"/> |
| <project groups="minilayout,buildtools" name="chromiumos/platform/crostestutils" path="src/platform/crostestutils" revision="1084d3a6d20056c9f2bb528a86bc76da4fdd98ba" upstream="refs/heads/master"/> |
| <project groups="minilayout,buildtools,labtools" name="chromiumos/platform/crosutils" path="src/scripts" revision="aaab1a30d44ec5fb7bd03cd18089c212792d4641" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/depthcharge" path="src/platform/depthcharge" revision="f2a835ff24960d226ba34cc88b9938e38748de38" upstream="refs/heads/master"/> |
| <project groups="minilayout,buildtools" name="chromiumos/platform/dev-util" path="src/platform/dev" revision="8a4d3ff6a11c3e9ea4e1e2c1c2e09a4226c1d8ef" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/dm-verity" path="src/platform/verity" revision="5d5faf68cdb05e477f0637f517f4926a0db1394a" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/drm-tests" path="src/platform/drm-tests" revision="69cdb24c55805aa4591cc21ac714d0d6e28ba3d2" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/ec" path="src/platform/ec" revision="b2bc2341978884cf0bde01c1b9de06ea0c092576" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/experimental" path="src/platform/experimental" revision="0c9b56092424c370eff748b25d49caceb9a18dab" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/factory" path="src/platform/factory" revision="9e6131d588966cb1980477bf2d23b8a67c3c8317" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/factory_installer" path="src/platform/factory_installer" revision="c2e2fbeef92eb2391dbda5d4fca3eaf7bbfa9b1d" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/firmware" path="src/platform/firmware" revision="d4d9d4cc86de09d41832c28d806bc27f2a42be1f" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/frecon" path="src/platform/frecon" revision="45896023df222fd0cc1e075a9392b414bd42330b" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/gestures" path="src/platform/gestures" revision="5a656849c7d2b0d0ddbe0ac6d300c1e2fada0bb4" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/go-seccomp" path="src/platform/go-seccomp" revision="0280326e5bd212fcfbe3696e113730045debae74" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/google-breakpad" path="src/third_party/breakpad" revision="1f574b52c6c34e457b16bc451a52874dde91e4b0" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/imageloader" path="src/platform/imageloader" revision="a2f81a7dadb8b7405bb40792a4029ebeb0fef70c" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/initramfs" path="src/platform/initramfs" revision="54dc255bca390aede0d235c8e1b43638ced40fb9" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/inputcontrol" path="src/platform/inputcontrol" revision="ae0b15dc322bab9bf6d7c4fcd5f77d488766a275" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/jabra_vold" path="src/platform/jabra_vold" revision="a8c3932d01fabc008b139dea8628e36ece910d19" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/libevdev" path="src/platform/libevdev" revision="9f7a1961eb4726211e18abd147d5a11a4ea86744" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/memento_softwareupdate" path="src/platform/memento_softwareupdate" revision="3c7204287bbc8f4341f546857216389bdff58e51" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/microbenchmark" path="src/platform/microbenchmark" revision="d5ea30febe406c5b486325dfae926564f3a46efd" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/minigbm" path="src/platform/minigbm" revision="fe46031f72c987dada675eff49e2bde3a214cbca" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/monitor_reconfig" path="src/platform/monitor_reconfig" revision="f022d19d84f232290b596beeb26347f62442e7eb" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/mosys" path="src/platform/mosys" revision="f02817689d5d30ffec64317421ada990327d7aba" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/mtpd" path="src/platform/mtpd" revision="44148fe605b952132644f0d0e5ccea7cfcc6d6c8" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/mtplot" path="src/platform/mtplot" revision="5e4f631e633384751f582bd9db5f4d6eb2112494" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/mttools" path="src/platform/mttools" revision="9efd0e1723cd45709bd0d34e8e7bbfd15967f0d5" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/punybench" path="src/platform/punybench" revision="5a230ee17756dc43ff732932dcb52899c06a4d09" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/system_api" path="src/platform/system_api" revision="cf870c647c94090e2a427106b63e3fcc33170db9" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/touch_firmware_test" path="src/platform/touch_firmware_test" revision="60b56a7ea3d7c689648357e0c5f444c4f17a573d" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/touch_noise_filter" path="src/platform/touch_noise_filter" revision="6b0aba12a385f4d3a7a47641a3a919018032f6f8" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/touch_updater" path="src/platform/touch_updater" revision="d8b5f58cce85eb43659726931c1b963929fce8fc" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/touchbot" path="src/platform/touchbot" revision="75d8f1bfbbb3dfc870fcbc22f53cd16b66ac7f23" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/touchpad-tests" path="src/platform/touchpad-tests" revision="d2e7d94a834b54511ca57e6359839f9ca86d6d04" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/tpm" path="src/third_party/tpm" revision="0cba6cadd1bea1ce3717779201d594c4c9131dc2" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/tpm_lite" path="src/platform/tpm_lite" revision="066c7f963b3ef733716251b666e0af0afd03b4fe" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/trunks" path="src/platform/trunks" revision="92dbe8c9e7fcf8acf67805fd5e25e85aa371f673" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/uboot-env" path="src/platform/uboot-env" revision="108ebbfac4d13d11e1940216434c368384ee0c0b" upstream="refs/heads/master"/> |
| <project groups="buildtools" name="chromiumos/platform/vboot_reference" path="src/platform/vboot_reference" revision="2a77e0389598adf98783d16ff7f92013c190f27e" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/vpd" path="src/platform/vpd" revision="2648b0e4aa4f11dbe36efb8ef7a2383d987893e5" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/webplot" path="src/platform/webplot" revision="bbd5ea22ef9f8e109e363b26958d9a2fc8921f0f" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/wireless_automation" path="src/platform/wireless_automation" revision="d7177dbd464f2952e10309bf1eef56bb31a7f8ad" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/workarounds" path="src/platform/workarounds" revision="30cab56de921f5be2d24c2e83bcd4ad5631b2d9b" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/xf86-input-cmt" path="src/platform/xf86-input-cmt" revision="3f2ffc921952e57a4343463b0679d90b80b51fc7" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/xorg-conf" path="src/platform/xorg-conf" revision="985d0d7edf399fa6214a198b8a15b805f71e95bd" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform2" path="src/platform2" revision="5531127b63b40e4f9ead1b60f9f60fe501ad45d4" upstream="refs/heads/master"/> |
| <project groups="minilayout,buildtools,labtools" name="chromiumos/repohooks" path="src/repohooks" revision="fdbac8e95ef6153ab23370ea1586a86f462dbe5f" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/adhd" path="src/third_party/adhd" revision="ab8b080818103752ef23fa164734cf7deeec5a08" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/android_mtdutils" path="src/third_party/android_mtdutils" revision="9bcfc3ee238f16925e9aaa4573129784ebb397e7" upstream="chromeos"/> |
| <project name="chromiumos/third_party/arm-trusted-firmware" path="src/third_party/arm-trusted-firmware" revision="a8de89c97461b7cc13a596db8771c30843b06405"> |
| <annotation name="branch-mode" value="create"/> |
| </project> |
| <project name="chromiumos/third_party/atheros" path="src/third_party/atheros" revision="52a5bdaa8930c14ee42518354de3e5ec09911c6b" upstream="refs/heads/master"/> |
| <project groups="buildtools,labtools" name="chromiumos/third_party/autotest" path="src/third_party/autotest/files" revision="f99ca97af9b32de96bf34f33cb3b3e0ea9e106a7" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/bluez" path="src/third_party/bluez" revision="8593a6481601e447f1ee20f5ca3b19fe4b7d846b" upstream="refs/heads/chromeos-5.41"/> |
| <project name="chromiumos/third_party/bootstub" path="src/third_party/bootstub" revision="5ac54e8d3d305c2c6c7297e8e54d3cf7e4629b29" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/broadcom" path="src/third_party/broadcom" revision="4070e7161f2f1a1a22027a744eb868500688f0b6" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/cbootimage" path="src/third_party/cbootimage" revision="b7d5b2d6a6dd05874d86ee900ff441d261f9034c" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/chrontel" path="src/third_party/chrontel" revision="7bcd0328d0eeef6a0539bd0ba80cd9a545e6cf4a" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/coreboot" path="src/third_party/coreboot" revision="7ed65cd063c7afd12f9434d1f19f95d4611f020e" upstream="refs/heads/chromeos-2016.05"/> |
| <project name="chromiumos/third_party/coreboot/blobs" path="src/third_party/coreboot/3rdparty/blobs" revision="9ba07035ed0acb28902cce826ea833cf531d57c1" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/cryptoc" path="src/third_party/cryptoc" revision="7c350b9428c7d478559e25b368d0da66098d2cae" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/cypress-tools" path="src/third_party/cypress-tools" revision="043fba1c35f89cce95f804bf6d4f01cfc23a6c21" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/daisydog" path="src/third_party/daisydog" revision="7c7238c2304b3bbd0385ef01884ff4b39a981c46" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/dbus-cplusplus" path="src/third_party/dbus-c++" revision="904f49fd770dd559800523edd91c1226e131655d" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/dbus-spy" path="src/third_party/dbus-spy" revision="0e04421c73b24536de7fcc1886da469d8b7a2a41" upstream="refs/heads/master"/> |
| <project groups="minilayout,buildtools" name="chromiumos/third_party/dpkt" path="chromite/third_party/dpkt" revision="f5259728b1294412bee945df9708efba09ea9160"> |
| <annotation name="branch-mode" value="pin"/> |
| </project> |
| <project name="chromiumos/third_party/edk2" path="src/third_party/edk2" revision="0aa39d284043be61b5f1222afdffd39a5abaf3aa" upstream="refs/heads/chromeos-2014.04"/> |
| <project name="chromiumos/third_party/em100" path="src/third_party/em100" revision="6e60dbae5bf62cd0ffffb9fc5ca9ba93e831ee88" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/flashmap" path="src/third_party/flashmap" revision="caf3f93f753df5ff089df615e465d46122bee123" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/flashrom" path="src/third_party/flashrom" revision="65be03acd87ee481b3adce642314889c498f423a" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/gcc" path="src/third_party/gcc" revision="a2bc87ab8851051e765d60626a6997f63ddfe00e" upstream="refs/heads/master"/> |
| <project groups="minilayout,buildtools" name="chromiumos/third_party/gdata" path="chromite/third_party/gdata" revision="fe7e5c90a9827feb66ed446b2d297a1618b25272" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/gdmwimax" path="src/third_party/gdmwimax" revision="e8236b4b2d66b1972e4f84955a238134acd7f6a1" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/gobi3k-sdk" path="src/third_party/gobi3k-sdk" revision="69702c400e274984a24d08fcaefe3952d5dcb36e" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/grub2" path="src/third_party/grub2" revision="df6034c59cb2d847f9e780cf2def30c5c9b8305f" upstream="refs/heads/master"/> |
| <project groups="labtools" name="chromiumos/third_party/hdctools" path="src/third_party/hdctools" revision="7ac895aa5041440f3bb378e83b6ecc7132762d61" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/hostap" path="src/third_party/wpa_supplicant" revision="d6b3c0423de0222cdb4fb2c145c71909b4ea2386" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/hwcplus-drm" path="src/third_party/hwcplus-drm" revision="7376a8da1c961115a61d7a3cb23bb13e4153583d" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/ibus-chewing" path="src/third_party/ibus-chewing/files" revision="7a9514a0844eb5eb90ab96f62484a6af9e4a0d6d" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/ibus-xkb-layouts" path="src/third_party/ibus-xkb-layouts/files" revision="6af015110aa92dc2eed88a9f704634c3eff53b14" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/kernel" path="src/third_party/kernel/v3.8" revision="4996fd199a7ff9bbc1d6d793ad75c28c507731fd" upstream="refs/heads/chromeos-3.8"/> |
| <project name="chromiumos/third_party/kernel" path="src/third_party/kernel/v3.10" revision="32c92dfbff199f9af1f813cd6e976996ec71a770" upstream="refs/heads/chromeos-3.10"/> |
| <project name="chromiumos/third_party/kernel" path="src/third_party/kernel/v3.14" revision="07dd175236560dac1bd22a9bae8bbb94e657a22c" upstream="refs/heads/chromeos-3.14"/> |
| <project name="chromiumos/third_party/kernel" path="src/third_party/kernel/v3.18" revision="e3073f7020715a684d594c462e69fe76f7764bf8" upstream="refs/heads/chromeos-3.18"/> |
| <project name="chromiumos/third_party/kernel" path="src/third_party/kernel/v4.4" revision="ecb5582ff60cd5b14a732bda8b21f8d0d9e6381a" upstream="refs/heads/chromeos-4.4"/> |
| <project name="chromiumos/third_party/khronos" path="src/third_party/khronos" revision="bbd199f8f3dc9c2a49cfecfc7956fe7706d9f0e9" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/libc-bench" path="src/third_party/libc-bench" revision="76793dd4b09191a78a78180012718e72d792717f" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/libdrm" path="src/third_party/libdrm" revision="4914a5a2fdbf04e1fbad9a169ec0a3a490d81917" upstream="refs/heads/chromeos-2.4.70"/> |
| <project name="chromiumos/third_party/libmbim" path="src/third_party/libmbim" revision="c4e2949edeed01ca3b810729a7af0d265c49629b" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/libqmi" path="src/third_party/libqmi" revision="a436c551cf226af66cdb3dd74ee3971d0b1dae04" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/libresample" path="src/third_party/libresample" revision="cc9f20f439396b7d45e94b8301edd95d33f26a46" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/libscrypt" path="src/third_party/libscrypt" revision="b45c53f9418a6eff2c8ed98703a55f96029304b1" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/libsigrok" path="src/third_party/libsigrok" revision="199fe31115c76231746f5953271795d58679561c" upstream="refs/heads/chromeos"/> |
| <project name="chromiumos/third_party/libsigrok-cli" path="src/third_party/sigrok-cli" revision="c9edfa218e5a5972531b6f4a3ece8d33a44ae1b5" upstream="refs/heads/chromeos"/> |
| <project name="chromiumos/third_party/libsigrokdecode" path="src/third_party/libsigrokdecode" revision="3279c2825684c7009775b731d0a9e37815778282" upstream="refs/heads/chromeos"/> |
| <project name="chromiumos/third_party/libv4lplugins" path="src/third_party/libv4lplugins" revision="e79d5093d0c93b9072f45415b29e12b2740db25e" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/linux-firmware" path="src/third_party/linux-firmware" revision="c66b0798c4201e75556831684aca2e61aa32de4f" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/ltp" path="src/third_party/ltp" revision="7df860dd2389c5c9a5b2ed9ac8a7f1d48d6fed03" upstream="refs/heads/chromeos-20150119"/> |
| <project name="chromiumos/third_party/marvell" path="src/third_party/marvell" revision="b5d3741d042bde7941284303712c3790ab4e489d" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/memtest" path="src/third_party/memtest" revision="3d4be6e3bfd819856e38a82e35c206fec4551851" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/mesa" path="src/third_party/arc-mesa" revision="9f9e1b4b944f545a366ef1fdfb6981aabd3cf30a" upstream="refs/heads/arc-12.1.0-pre2"/> |
| <project name="chromiumos/third_party/mesa" path="src/third_party/mesa" revision="6ef50efc1079e544d7fe912aba219e8907cb0cbd" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/mesa" path="src/third_party/mesa-img" revision="129178893b2260df22db96327c5ca9c2ce7db046" upstream="refs/heads/mesa-img"/> |
| <project name="chromiumos/third_party/minifakedns" path="src/third_party/miniFakeDns" revision="6184bea119dea53da539727fe8c2a116f98cef24" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/mmc-utils" path="src/third_party/mmc-utils" revision="bcc3e2e4246431be511be3959a11cd9733bedd29" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/modemmanager-next" path="src/third_party/modemmanager-next" revision="d759387adb6b4079241f7d1f2a145738acad929b" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/opencryptoki" path="src/third_party/opencryptoki" revision="b67690aeeb4174b2253db18a9c1b19eeb219a4ef" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/ply-image" path="src/third_party/ply-image" revision="6cf4e4cd968bb72ade54e423e2b97eb3a80c6de9" upstream="refs/heads/master"/> |
| <project groups="minilayout,buildtools" name="chromiumos/third_party/pyelftools" path="chromite/third_party/pyelftools" revision="19b3e610c86fcadb837d252c794cb5e8008826ae" upstream="refs/heads/master-0.22"/> |
| <project name="chromiumos/third_party/rootdev" path="src/third_party/rootdev" revision="5d7d7ff513315abd103d0c95e92ae646c1a7688c" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/seabios" path="src/third_party/seabios" revision="3004147dd3707e600772ec6c5d37beac7f4b8eb4" upstream="refs/heads/chromeos-2014.11.03"/> |
| <project name="chromiumos/third_party/sysbios" path="src/third_party/sysbios" revision="33e1db34b8162de72a5e9bbbc44e6bce38978396" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/tegra-power-query" path="src/third_party/tegra-power-query" revision="66f1f0d949f4ca4836c1a65b622629205240e37a" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/tegrastats" path="src/third_party/tegrastats" revision="1be161a89525d840e1f6d1f21b3f45645a7dedb3" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/tlsdate" path="src/third_party/tlsdate" revision="78a898a0b196b4b683a08dfa34128e39bad9c340" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/tpm-emulator" path="src/third_party/tpm-emulator" revision="310a21ef24ace14b4d6e8095172445494f54ff25" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/tpm2" path="src/third_party/tpm2" revision="07ec984d630c89128306671ec42b964236ce4eaf" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/trousers" path="src/third_party/trousers" revision="71d4fee1dc6db9bd22f6866571895b753f222ff5" upstream="refs/heads/master-0.3.13"/> |
| <project name="chromiumos/third_party/u-boot" path="src/third_party/u-boot/files" revision="cc72f5c47c758892b0f41257b0dd441a506ffdcd" upstream="refs/heads/chromeos-v2013.06"/> |
| <project name="chromiumos/third_party/u-boot" path="src/third_party/u-boot/next" revision="b30f38206f17aa73cda0a2fdaf4dc705527315ba" upstream="refs/heads/chromeos-v2015.07-rc1"/> |
| <project name="chromiumos/third_party/whining" path="src/third_party/whining" revision="bcf721d62d6a4c4c162c63714371fa4349df53bc" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/xf86-video-armsoc" path="src/third_party/xf86-video-armsoc" revision="30370e9dbf7ba0e457ee7de297d2ad6c269a00be" upstream="refs/heads/master"/> |
| <project groups="minilayout,buildtools" name="external/swarming.client" path="chromite/third_party/swarming.client" remote="chromium" revision="715861067a7cc8d20d2d629b6d76d796c004feb4"/> |
| <project name="linux-syscall-support" path="src/third_party/breakpad/src/third_party/lss" revision="3f6478ac95edf86cd3da300c2c0d34a438f5dbeb"/> |
| <project name="platform/bootable/recovery" path="src/aosp/bootable/recovery" remote="aosp" revision="c470dc8681364b4e00bda0a28386a20d6b5f6048" upstream="refs/heads/master"/> |
| <project name="platform/external/bsdiff" path="src/aosp/external/bsdiff" remote="aosp" revision="f26b5b670aadde708d3279d1eb153d28b226304c" upstream="refs/heads/master"/> |
| <project name="platform/external/minijail" path="src/aosp/external/minijail" remote="aosp" revision="7559dfe9ed16455e03f68d9aa0a5a65747e6a174" upstream="refs/heads/master"/> |
| <project name="platform/hardware/libhardware" path="src/platform/libhardware" remote="aosp" revision="9fe1a712fbc0dc52e101105d5014b147fe1125d3" upstream="refs/heads/master"/> |
| <project name="platform/system/bt" path="src/platform/bt" remote="aosp" revision="135db4f34477342b53242abfe9beec0262854389" upstream="refs/heads/master"/> |
| <project name="platform/system/core" path="src/platform/core" remote="aosp" revision="e631e470e059d84388f3aacfe11a3fa60a584ba7" upstream="refs/heads/master"/> |
| <project name="toolchain/binutils" path="src/aosp/toolchain/binutils" remote="aosp" revision="082ed0f10cf59b53381cefda2f90247e2a81015b" upstream="refs/heads/master"/> |
| <project name="toolchain/gcc" path="src/aosp/toolchain/gcc" remote="aosp" revision="41f3e25635616c067b9ee272304e6f86ac8ee9db"/> |
| <repo-hooks enabled-list="pre-upload" in-project="chromiumos/repohooks"/> |
| <pending_commit branch="chromeos-3.18" change_id="I86d005d468187204fc0052caeacc3b287869ead9" commit="e491127374c9cf349424d9f2acc281de89c52f94" commit_message="UPSTREAM: block: fix use-after-free in sys_ioprio_get() get_task_ioprio() accesses the task->io_context without holding the task lock and thus can race with exit_io_context(), leading to a use-after-free. The reproducer below hits this within a few seconds on my 4-core QEMU VM: int main(int argc, char **argv) { pid_t pid, child; long nproc, i; /* ioprio_set(IOPRIO_WHO_PROCESS, 0, IOPRIO_PRIO_VALUE(IOPRIO_CLASS_IDLE, 0)); */ syscall(SYS_ioprio_set, 1, 0, 0x6000); nproc = sysconf(_SC_NPROCESSORS_ONLN); for (i = 0; i < nproc; i++) { pid = fork(); assert(pid != -1); if (pid == 0) { for (;;) { pid = fork(); assert(pid != -1); if (pid == 0) { _exit(0); } else { child = wait(NULL); assert(child == pid); } } } pid = fork(); assert(pid != -1); if (pid == 0) { for (;;) { /* ioprio_get(IOPRIO_WHO_PGRP, 0); */ syscall(SYS_ioprio_get, 2, 0); } } } for (;;) { /* ioprio_get(IOPRIO_WHO_PGRP, 0); */ syscall(SYS_ioprio_get, 2, 0); } return 0; } This gets us KASAN dumps like this: [ 35.526914] ================================================================== [ 35.530009] BUG: KASAN: out-of-bounds in get_task_ioprio+0x7b/0x90 at addr ffff880066f34e6c [ 35.530009] Read of size 2 by task ioprio-gpf/363 [ 35.530009] ============================================================================= [ 35.530009] BUG blkdev_ioc (Not tainted): kasan: bad access detected [ 35.530009] ----------------------------------------------------------------------------- [ 35.530009] Disabling lock debugging due to kernel taint [ 35.530009] INFO: Allocated in create_task_io_context+0x2b/0x370 age=0 cpu=0 pid=360 [ 35.530009] ___slab_alloc+0x55d/0x5a0 [ 35.530009] __slab_alloc.isra.20+0x2b/0x40 [ 35.530009] kmem_cache_alloc_node+0x84/0x200 [ 35.530009] create_task_io_context+0x2b/0x370 [ 35.530009] get_task_io_context+0x92/0xb0 [ 35.530009] copy_process.part.8+0x5029/0x5660 [ 35.530009] _do_fork+0x155/0x7e0 [ 35.530009] SyS_clone+0x19/0x20 [ 35.530009] do_syscall_64+0x195/0x3a0 [ 35.530009] return_from_SYSCALL_64+0x0/0x6a [ 35.530009] INFO: Freed in put_io_context+0xe7/0x120 age=0 cpu=0 pid=1060 [ 35.530009] __slab_free+0x27b/0x3d0 [ 35.530009] kmem_cache_free+0x1fb/0x220 [ 35.530009] put_io_context+0xe7/0x120 [ 35.530009] put_io_context_active+0x238/0x380 [ 35.530009] exit_io_context+0x66/0x80 [ 35.530009] do_exit+0x158e/0x2b90 [ 35.530009] do_group_exit+0xe5/0x2b0 [ 35.530009] SyS_exit_group+0x1d/0x20 [ 35.530009] entry_SYSCALL_64_fastpath+0x1a/0xa4 [ 35.530009] INFO: Slab 0xffffea00019bcd00 objects=20 used=4 fp=0xffff880066f34ff0 flags=0x1fffe0000004080 [ 35.530009] INFO: Object 0xffff880066f34e58 @offset=3672 fp=0x0000000000000001 [ 35.530009] ================================================================== Fix it by grabbing the task lock while we poke at the io_context. Change-Id: I86d005d468187204fc0052caeacc3b287869ead9 Cc: stable@vger.kernel.org Reported-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Omar Sandoval <osandov@fb.com> Signed-off-by: Jens Axboe <axboe@fb.com> Signed-off-by: Bernie Thompson <bhthompson@google.com> Reviewed-on: https://chromium-review.googlesource.com/409076 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Ricky Zhou <rickyz@chromium.org> " fail_count="0" gerrit_number="409076" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="3" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/76/409076/3" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.18" change_id="Ic5841bf8def1dd1a4b87df263503a46d92f125e1" commit="4b0a93c2b190705132dd5dfbf47198da71efba64" commit_message="UPSTREAM: block: fix use-after-free in seq file I got a KASAN report of use-after-free: ================================================================== BUG: KASAN: use-after-free in klist_iter_exit+0x61/0x70 at addr ffff8800b6581508 Read of size 8 by task trinity-c1/315 ============================================================================= BUG kmalloc-32 (Not tainted): kasan: bad access detected ----------------------------------------------------------------------------- Disabling lock debugging due to kernel taint INFO: Allocated in disk_seqf_start+0x66/0x110 age=144 cpu=1 pid=315 ___slab_alloc+0x4f1/0x520 __slab_alloc.isra.58+0x56/0x80 kmem_cache_alloc_trace+0x260/0x2a0 disk_seqf_start+0x66/0x110 traverse+0x176/0x860 seq_read+0x7e3/0x11a0 proc_reg_read+0xbc/0x180 do_loop_readv_writev+0x134/0x210 do_readv_writev+0x565/0x660 vfs_readv+0x67/0xa0 do_preadv+0x126/0x170 SyS_preadv+0xc/0x10 do_syscall_64+0x1a1/0x460 return_from_SYSCALL_64+0x0/0x6a INFO: Freed in disk_seqf_stop+0x42/0x50 age=160 cpu=1 pid=315 __slab_free+0x17a/0x2c0 kfree+0x20a/0x220 disk_seqf_stop+0x42/0x50 traverse+0x3b5/0x860 seq_read+0x7e3/0x11a0 proc_reg_read+0xbc/0x180 do_loop_readv_writev+0x134/0x210 do_readv_writev+0x565/0x660 vfs_readv+0x67/0xa0 do_preadv+0x126/0x170 SyS_preadv+0xc/0x10 do_syscall_64+0x1a1/0x460 return_from_SYSCALL_64+0x0/0x6a CPU: 1 PID: 315 Comm: trinity-c1 Tainted: G B 4.7.0+ #62 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 ffffea0002d96000 ffff880119b9f918 ffffffff81d6ce81 ffff88011a804480 ffff8800b6581500 ffff880119b9f948 ffffffff8146c7bd ffff88011a804480 ffffea0002d96000 ffff8800b6581500 fffffffffffffff4 ffff880119b9f970 Call Trace: [<ffffffff81d6ce81>] dump_stack+0x65/0x84 [<ffffffff8146c7bd>] print_trailer+0x10d/0x1a0 [<ffffffff814704ff>] object_err+0x2f/0x40 [<ffffffff814754d1>] kasan_report_error+0x221/0x520 [<ffffffff8147590e>] __asan_report_load8_noabort+0x3e/0x40 [<ffffffff83888161>] klist_iter_exit+0x61/0x70 [<ffffffff82404389>] class_dev_iter_exit+0x9/0x10 [<ffffffff81d2e8ea>] disk_seqf_stop+0x3a/0x50 [<ffffffff8151f812>] seq_read+0x4b2/0x11a0 [<ffffffff815f8fdc>] proc_reg_read+0xbc/0x180 [<ffffffff814b24e4>] do_loop_readv_writev+0x134/0x210 [<ffffffff814b4c45>] do_readv_writev+0x565/0x660 [<ffffffff814b8a17>] vfs_readv+0x67/0xa0 [<ffffffff814b8de6>] do_preadv+0x126/0x170 [<ffffffff814b92ec>] SyS_preadv+0xc/0x10 This problem can occur in the following situation: open() - pread() - .seq_start() - iter = kmalloc() // succeeds - seqf->private = iter - .seq_stop() - kfree(seqf->private) - pread() - .seq_start() - iter = kmalloc() // fails - .seq_stop() - class_dev_iter_exit(seqf->private) // boom! old pointer As the comment in disk_seqf_stop() says, stop is called even if start failed, so we need to reinitialise the private pointer to NULL when seq iteration stops. An alternative would be to set the private pointer to NULL when the kmalloc() in disk_seqf_start() fails. Change-Id: Ic5841bf8def1dd1a4b87df263503a46d92f125e1 Cc: stable@vger.kernel.org Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com> Acked-by: Tejun Heo <tj@kernel.org> Signed-off-by: Jens Axboe <axboe@fb.com> Signed-off-by: Bernie Thompson <bhthompson@google.com> Reviewed-on: https://chromium-review.googlesource.com/409077 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Ricky Zhou <rickyz@chromium.org> " fail_count="0" gerrit_number="409077" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="3" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/77/409077/3" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.18" change_id="I8e6dcba9ad46916d835c430644a1ce2007603691" commit="f04d7559a5e200ba033d64a2f96a1f4f4e79eb84" commit_message="UPSTREAM: sg: Fix double-free when drives detach during SG_IO In sg_common_write(), we free the block request and return -ENODEV if the device is detached in the middle of the SG_IO ioctl(). Unfortunately, sg_finish_rem_req() also tries to free srp->rq, so we end up freeing rq->cmd in the already free rq object, and then free the object itself out from under the current user. This ends up corrupting random memory via the list_head on the rq object. The most common crash trace I saw is this: ------------[ cut here ]------------ kernel BUG at block/blk-core.c:1420! Call Trace: [<ffffffff81281eab>] blk_put_request+0x5b/0x80 [<ffffffffa0069e5b>] sg_finish_rem_req+0x6b/0x120 [sg] [<ffffffffa006bcb9>] sg_common_write.isra.14+0x459/0x5a0 [sg] [<ffffffff8125b328>] ? selinux_file_alloc_security+0x48/0x70 [<ffffffffa006bf95>] sg_new_write.isra.17+0x195/0x2d0 [sg] [<ffffffffa006cef4>] sg_ioctl+0x644/0xdb0 [sg] [<ffffffff81170f80>] do_vfs_ioctl+0x90/0x520 [<ffffffff81258967>] ? file_has_perm+0x97/0xb0 [<ffffffff811714a1>] SyS_ioctl+0x91/0xb0 [<ffffffff81602afb>] tracesys+0xdd/0xe2 RIP [<ffffffff81281e04>] __blk_put_request+0x154/0x1a0 The solution is straightforward: just set srp->rq to NULL in the failure branch so that sg_finish_rem_req() doesn't attempt to re-free it. Additionally, since sg_rq_end_io() will never be called on the object when this happens, we need to free memory backing ->cmd if it isn't embedded in the object itself. KASAN was extremely helpful in finding the root cause of this bug. Change-Id: I8e6dcba9ad46916d835c430644a1ce2007603691 Signed-off-by: Calvin Owens <calvinowens@fb.com> Acked-by: Douglas Gilbert <dgilbert@interlog.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Bernie Thompson <bhthompson@google.com> Reviewed-on: https://chromium-review.googlesource.com/409078 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Ricky Zhou <rickyz@chromium.org> " fail_count="0" gerrit_number="409078" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="3" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/78/409078/3" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.18" change_id="I51d459ba00d2ae2030be070d020e2d6c5c26fe49" commit="a4a6f86cb922fbcd682c7361b85288701214fda5" commit_message="UPSTREAM: [media] xc2028: avoid use after free If struct xc2028_config is passed without a firmware name, the following trouble may happen: [11009.907205] xc2028 5-0061: type set to XCeive xc2028/xc3028 tuner [11009.907491] ================================================================== [11009.907750] BUG: KASAN: use-after-free in strcmp+0x96/0xb0 at addr ffff8803bd78ab40 [11009.907992] Read of size 1 by task modprobe/28992 [11009.907994] ============================================================================= [11009.907997] BUG kmalloc-16 (Tainted: G W ): kasan: bad access detected [11009.907999] ----------------------------------------------------------------------------- [11009.908008] INFO: Allocated in xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd] age=0 cpu=3 pid=28992 [11009.908012] ___slab_alloc+0x581/0x5b0 [11009.908014] __slab_alloc+0x51/0x90 [11009.908017] __kmalloc+0x27b/0x350 [11009.908022] xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd] [11009.908026] usb_hcd_submit_urb+0x1e8/0x1c60 [11009.908029] usb_submit_urb+0xb0e/0x1200 [11009.908032] usb_serial_generic_write_start+0xb6/0x4c0 [11009.908035] usb_serial_generic_write+0x92/0xc0 [11009.908039] usb_console_write+0x38a/0x560 [11009.908045] call_console_drivers.constprop.14+0x1ee/0x2c0 [11009.908051] console_unlock+0x40d/0x900 [11009.908056] vprintk_emit+0x4b4/0x830 [11009.908061] vprintk_default+0x1f/0x30 [11009.908064] printk+0x99/0xb5 [11009.908067] kasan_report_error+0x10a/0x550 [11009.908070] __asan_report_load1_noabort+0x43/0x50 [11009.908074] INFO: Freed in xc2028_set_config+0x90/0x630 [tuner_xc2028] age=1 cpu=3 pid=28992 [11009.908077] __slab_free+0x2ec/0x460 [11009.908080] kfree+0x266/0x280 [11009.908083] xc2028_set_config+0x90/0x630 [tuner_xc2028] [11009.908086] xc2028_attach+0x310/0x8a0 [tuner_xc2028] [11009.908090] em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb] [11009.908094] em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb] [11009.908098] em28xx_dvb_init+0x81/0x8a [em28xx_dvb] [11009.908101] em28xx_register_extension+0xd9/0x190 [em28xx] [11009.908105] em28xx_dvb_register+0x10/0x1000 [em28xx_dvb] [11009.908108] do_one_initcall+0x141/0x300 [11009.908111] do_init_module+0x1d0/0x5ad [11009.908114] load_module+0x6666/0x9ba0 [11009.908117] SyS_finit_module+0x108/0x130 [11009.908120] entry_SYSCALL_64_fastpath+0x16/0x76 [11009.908123] INFO: Slab 0xffffea000ef5e280 objects=25 used=25 fp=0x (null) flags=0x2ffff8000004080 [11009.908126] INFO: Object 0xffff8803bd78ab40 @offset=2880 fp=0x0000000000000001 [11009.908130] Bytes b4 ffff8803bd78ab30: 01 00 00 00 2a 07 00 00 9d 28 00 00 01 00 00 00 ....*....(...... [11009.908133] Object ffff8803bd78ab40: 01 00 00 00 00 00 00 00 b0 1d c3 6a 00 88 ff ff ...........j.... [11009.908137] CPU: 3 PID: 28992 Comm: modprobe Tainted: G B W 4.5.0-rc1+ #43 [11009.908140] Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0350.2015.0812.1722 08/12/2015 [11009.908142] ffff8803bd78a000 ffff8802c273f1b8 ffffffff81932007 ffff8803c6407a80 [11009.908148] ffff8802c273f1e8 ffffffff81556759 ffff8803c6407a80 ffffea000ef5e280 [11009.908153] ffff8803bd78ab40 dffffc0000000000 ffff8802c273f210 ffffffff8155ccb4 [11009.908158] Call Trace: [11009.908162] [<ffffffff81932007>] dump_stack+0x4b/0x64 [11009.908165] [<ffffffff81556759>] print_trailer+0xf9/0x150 [11009.908168] [<ffffffff8155ccb4>] object_err+0x34/0x40 [11009.908171] [<ffffffff8155f260>] kasan_report_error+0x230/0x550 [11009.908175] [<ffffffff81237d71>] ? trace_hardirqs_off_caller+0x21/0x290 [11009.908179] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908182] [<ffffffff8155f5c3>] __asan_report_load1_noabort+0x43/0x50 [11009.908185] [<ffffffff8155ea00>] ? __asan_register_globals+0x50/0xa0 [11009.908189] [<ffffffff8194cea6>] ? strcmp+0x96/0xb0 [11009.908192] [<ffffffff8194cea6>] strcmp+0x96/0xb0 [11009.908196] [<ffffffffa13ba4ac>] xc2028_set_config+0x15c/0x630 [tuner_xc2028] [11009.908200] [<ffffffffa13bac90>] xc2028_attach+0x310/0x8a0 [tuner_xc2028] [11009.908203] [<ffffffff8155ea78>] ? memset+0x28/0x30 [11009.908206] [<ffffffffa13ba980>] ? xc2028_set_config+0x630/0x630 [tuner_xc2028] [11009.908211] [<ffffffffa157a59a>] em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb] [11009.908215] [<ffffffffa157aa2a>] ? em28xx_dvb_init.part.3+0x37c/0x5cf4 [em28xx_dvb] [11009.908219] [<ffffffffa157a3a1>] ? hauppauge_hvr930c_init+0x487/0x487 [em28xx_dvb] [11009.908222] [<ffffffffa01795ac>] ? lgdt330x_attach+0x1cc/0x370 [lgdt330x] [11009.908226] [<ffffffffa01793e0>] ? i2c_read_demod_bytes.isra.2+0x210/0x210 [lgdt330x] [11009.908230] [<ffffffff812e87d0>] ? ref_module.part.15+0x10/0x10 [11009.908233] [<ffffffff812e56e0>] ? module_assert_mutex_or_preempt+0x80/0x80 [11009.908238] [<ffffffffa157af92>] em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb] [11009.908242] [<ffffffffa157a6ae>] ? em28xx_attach_xc3028.constprop.7+0x30d/0x30d [em28xx_dvb] [11009.908245] [<ffffffff8195222d>] ? string+0x14d/0x1f0 [11009.908249] [<ffffffff8195381f>] ? symbol_string+0xff/0x1a0 [11009.908253] [<ffffffff81953720>] ? uuid_string+0x6f0/0x6f0 [11009.908257] [<ffffffff811a775e>] ? __kernel_text_address+0x7e/0xa0 [11009.908260] [<ffffffff8104b02f>] ? print_context_stack+0x7f/0xf0 [11009.908264] [<ffffffff812e9846>] ? __module_address+0xb6/0x360 [11009.908268] [<ffffffff8137fdc9>] ? is_ftrace_trampoline+0x99/0xe0 [11009.908271] [<ffffffff811a775e>] ? __kernel_text_address+0x7e/0xa0 [11009.908275] [<ffffffff81240a70>] ? debug_check_no_locks_freed+0x290/0x290 [11009.908278] [<ffffffff8104a24b>] ? dump_trace+0x11b/0x300 [11009.908282] [<ffffffffa13e8143>] ? em28xx_register_extension+0x23/0x190 [em28xx] [11009.908285] [<ffffffff81237d71>] ? trace_hardirqs_off_caller+0x21/0x290 [11009.908289] [<ffffffff8123ff56>] ? trace_hardirqs_on_caller+0x16/0x590 [11009.908292] [<ffffffff812404dd>] ? trace_hardirqs_on+0xd/0x10 [11009.908296] [<ffffffffa13e8143>] ? em28xx_register_extension+0x23/0x190 [em28xx] [11009.908299] [<ffffffff822dcbb0>] ? mutex_trylock+0x400/0x400 [11009.908302] [<ffffffff810021a1>] ? do_one_initcall+0x131/0x300 [11009.908306] [<ffffffff81296dc7>] ? call_rcu_sched+0x17/0x20 [11009.908309] [<ffffffff8159e708>] ? put_object+0x48/0x70 [11009.908314] [<ffffffffa1579f11>] em28xx_dvb_init+0x81/0x8a [em28xx_dvb] [11009.908317] [<ffffffffa13e81f9>] em28xx_register_extension+0xd9/0x190 [em28xx] [11009.908320] [<ffffffffa0150000>] ? 0xffffffffa0150000 [11009.908324] [<ffffffffa0150010>] em28xx_dvb_register+0x10/0x1000 [em28xx_dvb] [11009.908327] [<ffffffff810021b1>] do_one_initcall+0x141/0x300 [11009.908330] [<ffffffff81002070>] ? try_to_run_init_process+0x40/0x40 [11009.908333] [<ffffffff8123ff56>] ? trace_hardirqs_on_caller+0x16/0x590 [11009.908337] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908340] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908343] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908346] [<ffffffff8155ea37>] ? __asan_register_globals+0x87/0xa0 [11009.908350] [<ffffffff8144da7b>] do_init_module+0x1d0/0x5ad [11009.908353] [<ffffffff812f2626>] load_module+0x6666/0x9ba0 [11009.908356] [<ffffffff812e9c90>] ? symbol_put_addr+0x50/0x50 [11009.908361] [<ffffffffa1580037>] ? em28xx_dvb_init.part.3+0x5989/0x5cf4 [em28xx_dvb] [11009.908366] [<ffffffff812ebfc0>] ? module_frob_arch_sections+0x20/0x20 [11009.908369] [<ffffffff815bc940>] ? open_exec+0x50/0x50 [11009.908374] [<ffffffff811671bb>] ? ns_capable+0x5b/0xd0 [11009.908377] [<ffffffff812f5e58>] SyS_finit_module+0x108/0x130 [11009.908379] [<ffffffff812f5d50>] ? SyS_init_module+0x1f0/0x1f0 [11009.908383] [<ffffffff81004044>] ? lockdep_sys_exit_thunk+0x12/0x14 [11009.908394] [<ffffffff822e6936>] entry_SYSCALL_64_fastpath+0x16/0x76 [11009.908396] Memory state around the buggy address: [11009.908398] ffff8803bd78aa00: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908401] ffff8803bd78aa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908403] >ffff8803bd78ab00: fc fc fc fc fc fc fc fc 00 00 fc fc fc fc fc fc [11009.908405] ^ [11009.908407] ffff8803bd78ab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908409] ffff8803bd78ac00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908411] ================================================================== In order to avoid it, let's set the cached value of the firmware name to NULL after freeing it. While here, return an error if the memory allocation fails. Change-Id: I51d459ba00d2ae2030be070d020e2d6c5c26fe49 Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Bernie Thompson <bhthompson@google.com> Reviewed-on: https://chromium-review.googlesource.com/409079 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Ricky Zhou <rickyz@chromium.org> " fail_count="0" gerrit_number="409079" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="3" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/79/409079/3" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.18" change_id="I393682b8165d16598c118d1463a05e9d60c68127" commit="a2dc59c88aeb0c80e4b45640ed805bc66b612ca4" commit_message="UPSTREAM: tcp: fix use after free in tcp_xmit_retransmit_queue() When tcp_sendmsg() allocates a fresh and empty skb, it puts it at the tail of the write queue using tcp_add_write_queue_tail() Then it attempts to copy user data into this fresh skb. If the copy fails, we undo the work and remove the fresh skb. Unfortunately, this undo lacks the change done to tp->highest_sack and we can leave a dangling pointer (to a freed skb) Later, tcp_xmit_retransmit_queue() can dereference this pointer and access freed memory. For regular kernels where memory is not unmapped, this might cause SACK bugs because tcp_highest_sack_seq() is buggy, returning garbage instead of tp->snd_nxt, but with various debug features like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel. This bug was found by Marco Grassi thanks to syzkaller. Change-Id: I393682b8165d16598c118d1463a05e9d60c68127 Fixes: 6859d49475d4 ("[TCP]: Abstract tp->highest_sack accessing & point to next skb") Reported-by: Marco Grassi <marco.gra@gmail.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Ilpo Jrvinen <ilpo.jarvinen@helsinki.fi> Cc: Yuchung Cheng <ycheng@google.com> Cc: Neal Cardwell <ncardwell@google.com> Acked-by: Neal Cardwell <ncardwell@google.com> Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Bernie Thompson <bhthompson@google.com> Reviewed-on: https://chromium-review.googlesource.com/409080 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Ricky Zhou <rickyz@chromium.org> " fail_count="0" gerrit_number="409080" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="3" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/80/409080/3" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.18" change_id="I0c2cad76a554dc84565710b413bc08837468342c" commit="3f6d42000da64bafe0e5a3443dac7b79d93a1c99" commit_message="UPSTREAM: perf: Fix race in swevent hash There's a race on CPU unplug where we free the swevent hash array while it can still have events on. This will result in a use-after-free which is BAD. Simply do not free the hash array on unplug. This leaves the thing around and no use-after-free takes place. When the last swevent dies, we do a for_each_possible_cpu() iteration anyway to clean these up, at which time we'll free it, so no leakage will occur. Change-Id: I0c2cad76a554dc84565710b413bc08837468342c Reported-by: Sasha Levin <sasha.levin@oracle.com> Tested-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stephane Eranian <eranian@google.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Vince Weaver <vincent.weaver@maine.edu> Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Bernie Thompson <bhthompson@google.com> Reviewed-on: https://chromium-review.googlesource.com/409081 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Ricky Zhou <rickyz@chromium.org> " fail_count="0" gerrit_number="409081" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="3" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/81/409081/3" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.18" change_id="Ifc04bbf2879f56436c6455d2f7675d9dc2a3a1ec" commit="f60e21b5d4e14c148a58dddfd0c414a26eee080a" commit_message="UPSTREAM: tty: Prevent ldisc drivers from re-using stale tty fields Line discipline drivers may mistakenly misuse ldisc-related fields when initializing. For example, a failure to initialize tty->receive_room in the N_GIGASET_M101 line discipline was recently found and fixed [1]. Now, the N_X25 line discipline has been discovered accessing the previous line discipline's already-freed private data [2]. Harden the ldisc interface against misuse by initializing revelant tty fields before instancing the new line discipline. [1] commit fd98e9419d8d622a4de91f76b306af6aa627aa9c Author: Tilman Schmidt <tilman@imap.cc> Date: Tue Jul 14 00:37:13 2015 +0200 isdn/gigaset: reset tty->receive_room when attaching ser_gigaset [2] Report from Sasha Levin <sasha.levin@oracle.com> [ 634.336761] ================================================================== [ 634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0 [ 634.339558] Read of size 4 by task syzkaller_execu/8981 [ 634.340359] ============================================================================= [ 634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected ... [ 634.405018] Call Trace: [ 634.405277] dump_stack (lib/dump_stack.c:52) [ 634.405775] print_trailer (mm/slub.c:655) [ 634.406361] object_err (mm/slub.c:662) [ 634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236) [ 634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279) [ 634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1)) [ 634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447) [ 634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567) [ 634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879) [ 634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607) [ 634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613) [ 634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188) Change-Id: Ifc04bbf2879f56436c6455d2f7675d9dc2a3a1ec Cc: Tilman Schmidt <tilman@imap.cc> Cc: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Bernie Thompson <bhthompson@google.com> Reviewed-on: https://chromium-review.googlesource.com/409082 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Ricky Zhou <rickyz@chromium.org> " fail_count="0" gerrit_number="409082" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="3" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/82/409082/3" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.18" change_id="I7d677c780054e70bcdb764d7cc5074c20d8f389e" commit="72146239b0241ff56ddc28e05d8fcaacf36911c1" commit_message="UPSTREAM: assoc_array: don't call compare_object() on a node Changes since V1: fixed the description and added KASan warning. In assoc_array_insert_into_terminal_node(), we call the compare_object() method on all non-empty slots, even when they're not leaves, passing a pointer to an unexpected structure to compare_object(). Currently it causes an out-of-bound read access in keyring_compare_object detected by KASan (see below). The issue is easily reproduced with keyutils testsuite. Only call compare_object() when the slot is a leave. KASan warning: ================================================================== BUG: KASAN: slab-out-of-bounds in keyring_compare_object+0x213/0x240 at addr ffff880060a6f838 Read of size 8 by task keyctl/1655 ============================================================================= BUG kmalloc-192 (Not tainted): kasan: bad access detected ----------------------------------------------------------------------------- Disabling lock debugging due to kernel taint INFO: Allocated in assoc_array_insert+0xfd0/0x3a60 age=69 cpu=1 pid=1647 ___slab_alloc+0x563/0x5c0 __slab_alloc+0x51/0x90 kmem_cache_alloc_trace+0x263/0x300 assoc_array_insert+0xfd0/0x3a60 __key_link_begin+0xfc/0x270 key_create_or_update+0x459/0xaf0 SyS_add_key+0x1ba/0x350 entry_SYSCALL_64_fastpath+0x12/0x76 INFO: Slab 0xffffea0001829b80 objects=16 used=8 fp=0xffff880060a6f550 flags=0x3fff8000004080 INFO: Object 0xffff880060a6f740 @offset=5952 fp=0xffff880060a6e5d1 Bytes b4 ffff880060a6f730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f740: d1 e5 a6 60 00 88 ff ff 0e 00 00 00 00 00 00 00 ...`............ Object ffff880060a6f750: 02 cf 8e 60 00 88 ff ff 02 c0 8e 60 00 88 ff ff ...`.......`.... Object ffff880060a6f760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f7a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f7b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f7c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f7d0: 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f7e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object ffff880060a6f7f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ CPU: 0 PID: 1655 Comm: keyctl Tainted: G B 4.5.0-rc4-kasan+ #291 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 0000000000000000 000000001b2800b4 ffff880060a179e0 ffffffff81b60491 ffff88006c802900 ffff880060a6f740 ffff880060a17a10 ffffffff815e2969 ffff88006c802900 ffffea0001829b80 ffff880060a6f740 ffff880060a6e650 Call Trace: [<ffffffff81b60491>] dump_stack+0x85/0xc4 [<ffffffff815e2969>] print_trailer+0xf9/0x150 [<ffffffff815e9454>] object_err+0x34/0x40 [<ffffffff815ebe50>] kasan_report_error+0x230/0x550 [<ffffffff819949be>] ? keyring_get_key_chunk+0x13e/0x210 [<ffffffff815ec62d>] __asan_report_load_n_noabort+0x5d/0x70 [<ffffffff81994cc3>] ? keyring_compare_object+0x213/0x240 [<ffffffff81994cc3>] keyring_compare_object+0x213/0x240 [<ffffffff81bc238c>] assoc_array_insert+0x86c/0x3a60 [<ffffffff81bc1b20>] ? assoc_array_cancel_edit+0x70/0x70 [<ffffffff8199797d>] ? __key_link_begin+0x20d/0x270 [<ffffffff8199786c>] __key_link_begin+0xfc/0x270 [<ffffffff81993389>] key_create_or_update+0x459/0xaf0 [<ffffffff8128ce0d>] ? trace_hardirqs_on+0xd/0x10 [<ffffffff81992f30>] ? key_type_lookup+0xc0/0xc0 [<ffffffff8199e19d>] ? lookup_user_key+0x13d/0xcd0 [<ffffffff81534763>] ? memdup_user+0x53/0x80 [<ffffffff819983ea>] SyS_add_key+0x1ba/0x350 [<ffffffff81998230>] ? key_get_type_from_user.constprop.6+0xa0/0xa0 [<ffffffff828bcf4e>] ? retint_user+0x18/0x23 [<ffffffff8128cc7e>] ? trace_hardirqs_on_caller+0x3fe/0x580 [<ffffffff81004017>] ? trace_hardirqs_on_thunk+0x17/0x19 [<ffffffff828bc432>] entry_SYSCALL_64_fastpath+0x12/0x76 Memory state around the buggy address: ffff880060a6f700: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 ffff880060a6f780: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc >ffff880060a6f800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff880060a6f880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff880060a6f900: fc fc fc fc fc fc 00 00 00 00 00 00 00 00 00 00 ================================================================== Change-Id: I7d677c780054e70bcdb764d7cc5074c20d8f389e Signed-off-by: Jerome Marchand <jmarchan@redhat.com> Signed-off-by: David Howells <dhowells@redhat.com> cc: stable@vger.kernel.org Signed-off-by: Bernie Thompson <bhthompson@google.com> Reviewed-on: https://chromium-review.googlesource.com/409083 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Ricky Zhou <rickyz@chromium.org> " fail_count="0" gerrit_number="409083" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="3" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/83/409083/3" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.18" change_id="I07abf450b20144b2db2beec41daadf9e0a14b5c6" commit="bf7f54334f8fb3f134b01fc1236968e6b95f60b3" commit_message="UPSTREAM: proc: prevent accessing /proc/<PID>/environ until it's ready If /proc/<PID>/environ gets read before the envp[] array is fully set up in create_{aout,elf,elf_fdpic,flat}_tables(), we might end up trying to read more bytes than are actually written, as env_start will already be set but env_end will still be zero, making the range calculation underflow, allowing to read beyond the end of what has been written. Fix this as it is done for /proc/<PID>/cmdline by testing env_end for zero. It is, apparently, intentionally set last in create_*_tables(). This bug was found by the PaX size_overflow plugin that detected the arithmetic underflow of 'this_len = env_end - (env_start + src)' when env_end is still zero. The expected consequence is that userland trying to access /proc/<PID>/environ of a not yet fully set up process may get inconsistent data as we're in the middle of copying in the environment variables. Change-Id: I07abf450b20144b2db2beec41daadf9e0a14b5c6 Fixes: https://forums.grsecurity.net/viewtopic.php?f=3&t=4363 Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=116461 Signed-off-by: Mathias Krause <minipli@googlemail.com> Cc: Emese Revfy <re.emese@gmail.com> Cc: Pax Team <pageexec@freemail.hu> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Mateusz Guzik <mguzik@redhat.com> Cc: Alexey Dobriyan <adobriyan@gmail.com> Cc: Cyrill Gorcunov <gorcunov@openvz.org> Cc: Jarod Wilson <jarod@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit 8148a73c9901a8794a50f950083c00ccf97d43b3) Signed-off-by: Bernie Thompson <bhthompson@google.com> Reviewed-on: https://chromium-review.googlesource.com/409084 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org> " fail_count="0" gerrit_number="409084" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="3" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/84/409084/3" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.14" change_id="Ic5841bf8def1dd1a4b87df263503a46d92f125e1" commit="866edc60f7ac5a8b31e492ad280ee4bfc3ed0f60" commit_message="UPSTREAM: block: fix use-after-free in seq file I got a KASAN report of use-after-free: ================================================================== BUG: KASAN: use-after-free in klist_iter_exit+0x61/0x70 at addr ffff8800b6581508 Read of size 8 by task trinity-c1/315 ============================================================================= BUG kmalloc-32 (Not tainted): kasan: bad access detected ----------------------------------------------------------------------------- Disabling lock debugging due to kernel taint INFO: Allocated in disk_seqf_start+0x66/0x110 age=144 cpu=1 pid=315 ___slab_alloc+0x4f1/0x520 __slab_alloc.isra.58+0x56/0x80 kmem_cache_alloc_trace+0x260/0x2a0 disk_seqf_start+0x66/0x110 traverse+0x176/0x860 seq_read+0x7e3/0x11a0 proc_reg_read+0xbc/0x180 do_loop_readv_writev+0x134/0x210 do_readv_writev+0x565/0x660 vfs_readv+0x67/0xa0 do_preadv+0x126/0x170 SyS_preadv+0xc/0x10 do_syscall_64+0x1a1/0x460 return_from_SYSCALL_64+0x0/0x6a INFO: Freed in disk_seqf_stop+0x42/0x50 age=160 cpu=1 pid=315 __slab_free+0x17a/0x2c0 kfree+0x20a/0x220 disk_seqf_stop+0x42/0x50 traverse+0x3b5/0x860 seq_read+0x7e3/0x11a0 proc_reg_read+0xbc/0x180 do_loop_readv_writev+0x134/0x210 do_readv_writev+0x565/0x660 vfs_readv+0x67/0xa0 do_preadv+0x126/0x170 SyS_preadv+0xc/0x10 do_syscall_64+0x1a1/0x460 return_from_SYSCALL_64+0x0/0x6a CPU: 1 PID: 315 Comm: trinity-c1 Tainted: G B 4.7.0+ #62 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 ffffea0002d96000 ffff880119b9f918 ffffffff81d6ce81 ffff88011a804480 ffff8800b6581500 ffff880119b9f948 ffffffff8146c7bd ffff88011a804480 ffffea0002d96000 ffff8800b6581500 fffffffffffffff4 ffff880119b9f970 Call Trace: [<ffffffff81d6ce81>] dump_stack+0x65/0x84 [<ffffffff8146c7bd>] print_trailer+0x10d/0x1a0 [<ffffffff814704ff>] object_err+0x2f/0x40 [<ffffffff814754d1>] kasan_report_error+0x221/0x520 [<ffffffff8147590e>] __asan_report_load8_noabort+0x3e/0x40 [<ffffffff83888161>] klist_iter_exit+0x61/0x70 [<ffffffff82404389>] class_dev_iter_exit+0x9/0x10 [<ffffffff81d2e8ea>] disk_seqf_stop+0x3a/0x50 [<ffffffff8151f812>] seq_read+0x4b2/0x11a0 [<ffffffff815f8fdc>] proc_reg_read+0xbc/0x180 [<ffffffff814b24e4>] do_loop_readv_writev+0x134/0x210 [<ffffffff814b4c45>] do_readv_writev+0x565/0x660 [<ffffffff814b8a17>] vfs_readv+0x67/0xa0 [<ffffffff814b8de6>] do_preadv+0x126/0x170 [<ffffffff814b92ec>] SyS_preadv+0xc/0x10 This problem can occur in the following situation: open() - pread() - .seq_start() - iter = kmalloc() // succeeds - seqf->private = iter - .seq_stop() - kfree(seqf->private) - pread() - .seq_start() - iter = kmalloc() // fails - .seq_stop() - class_dev_iter_exit(seqf->private) // boom! old pointer As the comment in disk_seqf_stop() says, stop is called even if start failed, so we need to reinitialise the private pointer to NULL when seq iteration stops. An alternative would be to set the private pointer to NULL when the kmalloc() in disk_seqf_start() fails. Change-Id: Ic5841bf8def1dd1a4b87df263503a46d92f125e1 Cc: stable@vger.kernel.org Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com> Acked-by: Tejun Heo <tj@kernel.org> Signed-off-by: Jens Axboe <axboe@fb.com> Signed-off-by: Bernie Thompson <bhthompson@google.com> Reviewed-on: https://chromium-review.googlesource.com/411503 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Ricky Zhou <rickyz@chromium.org> " fail_count="0" gerrit_number="411503" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="1" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/03/411503/1" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.14" change_id="I51d459ba00d2ae2030be070d020e2d6c5c26fe49" commit="849b268455ccfd6f2f0cdbe7c265bea12aa2573c" commit_message="UPSTREAM: [media] xc2028: avoid use after free If struct xc2028_config is passed without a firmware name, the following trouble may happen: [11009.907205] xc2028 5-0061: type set to XCeive xc2028/xc3028 tuner [11009.907491] ================================================================== [11009.907750] BUG: KASAN: use-after-free in strcmp+0x96/0xb0 at addr ffff8803bd78ab40 [11009.907992] Read of size 1 by task modprobe/28992 [11009.907994] ============================================================================= [11009.907997] BUG kmalloc-16 (Tainted: G W ): kasan: bad access detected [11009.907999] ----------------------------------------------------------------------------- [11009.908008] INFO: Allocated in xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd] age=0 cpu=3 pid=28992 [11009.908012] ___slab_alloc+0x581/0x5b0 [11009.908014] __slab_alloc+0x51/0x90 [11009.908017] __kmalloc+0x27b/0x350 [11009.908022] xhci_urb_enqueue+0x214/0x14c0 [xhci_hcd] [11009.908026] usb_hcd_submit_urb+0x1e8/0x1c60 [11009.908029] usb_submit_urb+0xb0e/0x1200 [11009.908032] usb_serial_generic_write_start+0xb6/0x4c0 [11009.908035] usb_serial_generic_write+0x92/0xc0 [11009.908039] usb_console_write+0x38a/0x560 [11009.908045] call_console_drivers.constprop.14+0x1ee/0x2c0 [11009.908051] console_unlock+0x40d/0x900 [11009.908056] vprintk_emit+0x4b4/0x830 [11009.908061] vprintk_default+0x1f/0x30 [11009.908064] printk+0x99/0xb5 [11009.908067] kasan_report_error+0x10a/0x550 [11009.908070] __asan_report_load1_noabort+0x43/0x50 [11009.908074] INFO: Freed in xc2028_set_config+0x90/0x630 [tuner_xc2028] age=1 cpu=3 pid=28992 [11009.908077] __slab_free+0x2ec/0x460 [11009.908080] kfree+0x266/0x280 [11009.908083] xc2028_set_config+0x90/0x630 [tuner_xc2028] [11009.908086] xc2028_attach+0x310/0x8a0 [tuner_xc2028] [11009.908090] em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb] [11009.908094] em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb] [11009.908098] em28xx_dvb_init+0x81/0x8a [em28xx_dvb] [11009.908101] em28xx_register_extension+0xd9/0x190 [em28xx] [11009.908105] em28xx_dvb_register+0x10/0x1000 [em28xx_dvb] [11009.908108] do_one_initcall+0x141/0x300 [11009.908111] do_init_module+0x1d0/0x5ad [11009.908114] load_module+0x6666/0x9ba0 [11009.908117] SyS_finit_module+0x108/0x130 [11009.908120] entry_SYSCALL_64_fastpath+0x16/0x76 [11009.908123] INFO: Slab 0xffffea000ef5e280 objects=25 used=25 fp=0x (null) flags=0x2ffff8000004080 [11009.908126] INFO: Object 0xffff8803bd78ab40 @offset=2880 fp=0x0000000000000001 [11009.908130] Bytes b4 ffff8803bd78ab30: 01 00 00 00 2a 07 00 00 9d 28 00 00 01 00 00 00 ....*....(...... [11009.908133] Object ffff8803bd78ab40: 01 00 00 00 00 00 00 00 b0 1d c3 6a 00 88 ff ff ...........j.... [11009.908137] CPU: 3 PID: 28992 Comm: modprobe Tainted: G B W 4.5.0-rc1+ #43 [11009.908140] Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0350.2015.0812.1722 08/12/2015 [11009.908142] ffff8803bd78a000 ffff8802c273f1b8 ffffffff81932007 ffff8803c6407a80 [11009.908148] ffff8802c273f1e8 ffffffff81556759 ffff8803c6407a80 ffffea000ef5e280 [11009.908153] ffff8803bd78ab40 dffffc0000000000 ffff8802c273f210 ffffffff8155ccb4 [11009.908158] Call Trace: [11009.908162] [<ffffffff81932007>] dump_stack+0x4b/0x64 [11009.908165] [<ffffffff81556759>] print_trailer+0xf9/0x150 [11009.908168] [<ffffffff8155ccb4>] object_err+0x34/0x40 [11009.908171] [<ffffffff8155f260>] kasan_report_error+0x230/0x550 [11009.908175] [<ffffffff81237d71>] ? trace_hardirqs_off_caller+0x21/0x290 [11009.908179] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908182] [<ffffffff8155f5c3>] __asan_report_load1_noabort+0x43/0x50 [11009.908185] [<ffffffff8155ea00>] ? __asan_register_globals+0x50/0xa0 [11009.908189] [<ffffffff8194cea6>] ? strcmp+0x96/0xb0 [11009.908192] [<ffffffff8194cea6>] strcmp+0x96/0xb0 [11009.908196] [<ffffffffa13ba4ac>] xc2028_set_config+0x15c/0x630 [tuner_xc2028] [11009.908200] [<ffffffffa13bac90>] xc2028_attach+0x310/0x8a0 [tuner_xc2028] [11009.908203] [<ffffffff8155ea78>] ? memset+0x28/0x30 [11009.908206] [<ffffffffa13ba980>] ? xc2028_set_config+0x630/0x630 [tuner_xc2028] [11009.908211] [<ffffffffa157a59a>] em28xx_attach_xc3028.constprop.7+0x1f9/0x30d [em28xx_dvb] [11009.908215] [<ffffffffa157aa2a>] ? em28xx_dvb_init.part.3+0x37c/0x5cf4 [em28xx_dvb] [11009.908219] [<ffffffffa157a3a1>] ? hauppauge_hvr930c_init+0x487/0x487 [em28xx_dvb] [11009.908222] [<ffffffffa01795ac>] ? lgdt330x_attach+0x1cc/0x370 [lgdt330x] [11009.908226] [<ffffffffa01793e0>] ? i2c_read_demod_bytes.isra.2+0x210/0x210 [lgdt330x] [11009.908230] [<ffffffff812e87d0>] ? ref_module.part.15+0x10/0x10 [11009.908233] [<ffffffff812e56e0>] ? module_assert_mutex_or_preempt+0x80/0x80 [11009.908238] [<ffffffffa157af92>] em28xx_dvb_init.part.3+0x8e4/0x5cf4 [em28xx_dvb] [11009.908242] [<ffffffffa157a6ae>] ? em28xx_attach_xc3028.constprop.7+0x30d/0x30d [em28xx_dvb] [11009.908245] [<ffffffff8195222d>] ? string+0x14d/0x1f0 [11009.908249] [<ffffffff8195381f>] ? symbol_string+0xff/0x1a0 [11009.908253] [<ffffffff81953720>] ? uuid_string+0x6f0/0x6f0 [11009.908257] [<ffffffff811a775e>] ? __kernel_text_address+0x7e/0xa0 [11009.908260] [<ffffffff8104b02f>] ? print_context_stack+0x7f/0xf0 [11009.908264] [<ffffffff812e9846>] ? __module_address+0xb6/0x360 [11009.908268] [<ffffffff8137fdc9>] ? is_ftrace_trampoline+0x99/0xe0 [11009.908271] [<ffffffff811a775e>] ? __kernel_text_address+0x7e/0xa0 [11009.908275] [<ffffffff81240a70>] ? debug_check_no_locks_freed+0x290/0x290 [11009.908278] [<ffffffff8104a24b>] ? dump_trace+0x11b/0x300 [11009.908282] [<ffffffffa13e8143>] ? em28xx_register_extension+0x23/0x190 [em28xx] [11009.908285] [<ffffffff81237d71>] ? trace_hardirqs_off_caller+0x21/0x290 [11009.908289] [<ffffffff8123ff56>] ? trace_hardirqs_on_caller+0x16/0x590 [11009.908292] [<ffffffff812404dd>] ? trace_hardirqs_on+0xd/0x10 [11009.908296] [<ffffffffa13e8143>] ? em28xx_register_extension+0x23/0x190 [em28xx] [11009.908299] [<ffffffff822dcbb0>] ? mutex_trylock+0x400/0x400 [11009.908302] [<ffffffff810021a1>] ? do_one_initcall+0x131/0x300 [11009.908306] [<ffffffff81296dc7>] ? call_rcu_sched+0x17/0x20 [11009.908309] [<ffffffff8159e708>] ? put_object+0x48/0x70 [11009.908314] [<ffffffffa1579f11>] em28xx_dvb_init+0x81/0x8a [em28xx_dvb] [11009.908317] [<ffffffffa13e81f9>] em28xx_register_extension+0xd9/0x190 [em28xx] [11009.908320] [<ffffffffa0150000>] ? 0xffffffffa0150000 [11009.908324] [<ffffffffa0150010>] em28xx_dvb_register+0x10/0x1000 [em28xx_dvb] [11009.908327] [<ffffffff810021b1>] do_one_initcall+0x141/0x300 [11009.908330] [<ffffffff81002070>] ? try_to_run_init_process+0x40/0x40 [11009.908333] [<ffffffff8123ff56>] ? trace_hardirqs_on_caller+0x16/0x590 [11009.908337] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908340] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908343] [<ffffffff8155e926>] ? kasan_unpoison_shadow+0x36/0x50 [11009.908346] [<ffffffff8155ea37>] ? __asan_register_globals+0x87/0xa0 [11009.908350] [<ffffffff8144da7b>] do_init_module+0x1d0/0x5ad [11009.908353] [<ffffffff812f2626>] load_module+0x6666/0x9ba0 [11009.908356] [<ffffffff812e9c90>] ? symbol_put_addr+0x50/0x50 [11009.908361] [<ffffffffa1580037>] ? em28xx_dvb_init.part.3+0x5989/0x5cf4 [em28xx_dvb] [11009.908366] [<ffffffff812ebfc0>] ? module_frob_arch_sections+0x20/0x20 [11009.908369] [<ffffffff815bc940>] ? open_exec+0x50/0x50 [11009.908374] [<ffffffff811671bb>] ? ns_capable+0x5b/0xd0 [11009.908377] [<ffffffff812f5e58>] SyS_finit_module+0x108/0x130 [11009.908379] [<ffffffff812f5d50>] ? SyS_init_module+0x1f0/0x1f0 [11009.908383] [<ffffffff81004044>] ? lockdep_sys_exit_thunk+0x12/0x14 [11009.908394] [<ffffffff822e6936>] entry_SYSCALL_64_fastpath+0x16/0x76 [11009.908396] Memory state around the buggy address: [11009.908398] ffff8803bd78aa00: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908401] ffff8803bd78aa80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908403] >ffff8803bd78ab00: fc fc fc fc fc fc fc fc 00 00 fc fc fc fc fc fc [11009.908405] ^ [11009.908407] ffff8803bd78ab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908409] ffff8803bd78ac00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [11009.908411] ================================================================== In order to avoid it, let's set the cached value of the firmware name to NULL after freeing it. While here, return an error if the memory allocation fails. Change-Id: I51d459ba00d2ae2030be070d020e2d6c5c26fe49 Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> Signed-off-by: Bernie Thompson <bhthompson@google.com> Reviewed-on: https://chromium-review.googlesource.com/411504 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Ricky Zhou <rickyz@chromium.org> " fail_count="0" gerrit_number="411504" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="1" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/04/411504/1" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.14" change_id="I393682b8165d16598c118d1463a05e9d60c68127" commit="32dcd5622f0c8542d5599b804c100af3f83b9ef2" commit_message="UPSTREAM: tcp: fix use after free in tcp_xmit_retransmit_queue() When tcp_sendmsg() allocates a fresh and empty skb, it puts it at the tail of the write queue using tcp_add_write_queue_tail() Then it attempts to copy user data into this fresh skb. If the copy fails, we undo the work and remove the fresh skb. Unfortunately, this undo lacks the change done to tp->highest_sack and we can leave a dangling pointer (to a freed skb) Later, tcp_xmit_retransmit_queue() can dereference this pointer and access freed memory. For regular kernels where memory is not unmapped, this might cause SACK bugs because tcp_highest_sack_seq() is buggy, returning garbage instead of tp->snd_nxt, but with various debug features like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel. This bug was found by Marco Grassi thanks to syzkaller. Change-Id: I393682b8165d16598c118d1463a05e9d60c68127 Fixes: 6859d49475d4 ("[TCP]: Abstract tp->highest_sack accessing & point to next skb") Reported-by: Marco Grassi <marco.gra@gmail.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Ilpo Jrvinen <ilpo.jarvinen@helsinki.fi> Cc: Yuchung Cheng <ycheng@google.com> Cc: Neal Cardwell <ncardwell@google.com> Acked-by: Neal Cardwell <ncardwell@google.com> Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Bernie Thompson <bhthompson@google.com> Reviewed-on: https://chromium-review.googlesource.com/411505 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Ricky Zhou <rickyz@chromium.org> " fail_count="0" gerrit_number="411505" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="1" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/05/411505/1" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.14" change_id="Ifc04bbf2879f56436c6455d2f7675d9dc2a3a1ec" commit="0af317be45218e08dcc9448d92773e478a896e16" commit_message="UPSTREAM: tty: Prevent ldisc drivers from re-using stale tty fields Line discipline drivers may mistakenly misuse ldisc-related fields when initializing. For example, a failure to initialize tty->receive_room in the N_GIGASET_M101 line discipline was recently found and fixed [1]. Now, the N_X25 line discipline has been discovered accessing the previous line discipline's already-freed private data [2]. Harden the ldisc interface against misuse by initializing revelant tty fields before instancing the new line discipline. [1] commit fd98e9419d8d622a4de91f76b306af6aa627aa9c Author: Tilman Schmidt <tilman@imap.cc> Date: Tue Jul 14 00:37:13 2015 +0200 isdn/gigaset: reset tty->receive_room when attaching ser_gigaset [2] Report from Sasha Levin <sasha.levin@oracle.com> [ 634.336761] ================================================================== [ 634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0 [ 634.339558] Read of size 4 by task syzkaller_execu/8981 [ 634.340359] ============================================================================= [ 634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected ... [ 634.405018] Call Trace: [ 634.405277] dump_stack (lib/dump_stack.c:52) [ 634.405775] print_trailer (mm/slub.c:655) [ 634.406361] object_err (mm/slub.c:662) [ 634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236) [ 634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279) [ 634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1)) [ 634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447) [ 634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567) [ 634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879) [ 634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607) [ 634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613) [ 634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188) Change-Id: Ifc04bbf2879f56436c6455d2f7675d9dc2a3a1ec Cc: Tilman Schmidt <tilman@imap.cc> Cc: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Bernie Thompson <bhthompson@google.com> Reviewed-on: https://chromium-review.googlesource.com/411506 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Ricky Zhou <rickyz@chromium.org> " fail_count="0" gerrit_number="411506" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="1" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/06/411506/1" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.18" change_id="Ie82876e34d7945befc33764735a269167d9987c8" commit="8bd3229a726ae1425de970b026d0299ff9565694" commit_message="CHROMIUM: net: NETDEV_ALLOC_SKB_FROM_SLAB BUG=b:32495669 TEST=Testing using IXIA veriwave, connectivity stress test. Adding a new configure option NETDEV_ALLOC_SKB_FROM_SLAB to allow drivers to allocate skb using kmallc() instead of page fragment based allocation. __netdev_alloc_frag() tries to alloc pages starting from order-3 and build skb from it. Many sk_buff can be built from a order-3 page and this page can not be freed if any of those sk_buff is still in use. OOM has been observed in embedded networking device under heavy networking load with streams of different priorities. In this case, lower priority packets being queued up are preventing pages being released and those pages could worth a lot more memory than sk_buff actually used. Change-Id: Ie82876e34d7945befc33764735a269167d9987c8 Signed-off-by: Kan Yan <kyan@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/411346 Commit-Ready: Kan Yan <kyan@google.com> Tested-by: Kan Yan <kyan@google.com> Reviewed-by: Dmitry Torokhov <dtor@chromium.org> Reviewed-by: Eric Dumazet <edumazet@google.com> " fail_count="0" gerrit_number="411346" owner_email="kyan@google.com" pass_count="0" patch_number="3" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/46/411346/3" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.18" change_id="Iebd1ddeefbbbccf2ed732a27452565c0253cd9f0" commit="d29a1c53aa64e37614832f0bb11a6540a275731c" commit_message="CHROMIUM: config: Enable NETDEV_ALLOC_SKB_FROM_SLAB BUG=b:32495669 TEST=testing using IXIA veriwave, connectivity stress test. Change-Id: Iebd1ddeefbbbccf2ed732a27452565c0253cd9f0 Signed-off-by: Kan Yan <kyan@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/411347 Commit-Ready: Kan Yan <kyan@google.com> Tested-by: Kan Yan <kyan@google.com> Reviewed-by: Dmitry Torokhov <dtor@chromium.org> " fail_count="0" gerrit_number="411347" owner_email="kyan@google.com" pass_count="0" patch_number="3" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/47/411347/3" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.18" change_id="I6d9258dc473dab7da28496cd1687126a7563945b" commit="99b5a1298b1b1277c02cccf91cd9353c29e177b9" commit_message="CHROMIUM: config: renormalize splitconfigs BUG=None TEST=None Change-Id: I6d9258dc473dab7da28496cd1687126a7563945b Signed-off-by: Kan Yan <kyan@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/411348 Commit-Ready: Kan Yan <kyan@google.com> Tested-by: Kan Yan <kyan@google.com> Reviewed-by: Dmitry Torokhov <dtor@chromium.org> " fail_count="0" gerrit_number="411348" owner_email="kyan@google.com" pass_count="0" patch_number="3" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/48/411348/3" remote="cros" total_fail_count="0"/><pending_commit branch="master" change_id="I0969b3c25d187f1de025f53f9a61fd298c9631c4" commit="1ecd2a3ed440b4bb10a69323082289f10b3a4947" commit_message="Pyro: Add battery FUD support Add battery FUD support BUG=chrome-os-partner:59771 BRANCH=None TEST=make buildall Change-Id: I0969b3c25d187f1de025f53f9a61fd298c9631c4 Signed-off-by: Bruce.Wan <Bruce.Wan@quantatw.com> Reviewed-on: https://chromium-review.googlesource.com/410963 Commit-Ready: Keith Tzeng <keith.tzeng@quantatw.com> Tested-by: Keith Tzeng <keith.tzeng@quantatw.com> Reviewed-by: Shawn N <shawnn@chromium.org> " fail_count="0" gerrit_number="410963" owner_email="Bruce.Wan@quantatw.com" pass_count="0" patch_number="2" project="chromiumos/platform/ec" project_url="https://chromium-review.googlesource.com/chromiumos/platform/ec" ref="refs/changes/63/410963/2" remote="cros" total_fail_count="0"/><pending_commit branch="master" change_id="I43ae3f4ed3493375f28593d48b6abaa4ba637127" commit="fc733903e3a3d44e2dfd9a6153447fdbcb0985cd" commit_message="lakitu: add After=local-fs-pre.target in var-lib-cloud.mount var-lib-cloud.mount needs /var/ to be mounted. The latter is done by chromeos_startup script. This new dependency will guarantee that this mount is attempted only after chomeos_startup completes. BUG=b:31500664 TEST=system boots without errors Change-Id: I43ae3f4ed3493375f28593d48b6abaa4ba637127 Reviewed-on: https://chromium-review.googlesource.com/411961 Commit-Ready: Andrey Ulanov <andreyu@google.com> Tested-by: Andrey Ulanov <andreyu@google.com> Reviewed-by: Amey Deshpande <ameyd@google.com> " fail_count="0" gerrit_number="411961" owner_email="andreyu@google.com" pass_count="0" patch_number="1" project="chromiumos/overlays/board-overlays" project_url="https://chromium-review.googlesource.com/chromiumos/overlays/board-overlays" ref="refs/changes/61/411961/1" remote="cros" total_fail_count="0"/><pending_commit branch="master" change_id="Ic46f153ce8ed0b39294644a01eba8e06f2abe1c6" commit="a0dbf1c7a437b387c0a9beeb9cfeba9c0febc390" commit_message="makefile: Add help target This just adds some basic output as a reminder of what targets do what. BUG=none BRANCH=none TEST=make help shows useful output Change-Id: Ic46f153ce8ed0b39294644a01eba8e06f2abe1c6 Signed-off-by: Martin Roth <martinroth@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/403497 Reviewed-by: Aseda Aboagye <aaboagye@chromium.org> " fail_count="0" gerrit_number="403497" owner_email="martinroth@chromium.org" pass_count="0" patch_number="3" project="chromiumos/platform/ec" project_url="https://chromium-review.googlesource.com/chromiumos/platform/ec" ref="refs/changes/97/403497/3" remote="cros" total_fail_count="0"/><pending_commit branch="master" change_id="I3a705a99e6caf45acecb4bc730461408ecd14481" commit="c3d4f87417be64c2bc06e0961f38c4e95f1e43d8" commit_message="[cbuildbot] Disable more broken tests for toolchain builders. BUG=None TEST=ran ./run_tests Change-Id: I3a705a99e6caf45acecb4bc730461408ecd14481 Reviewed-on: https://chromium-review.googlesource.com/411390 Commit-Ready: Caroline Tice <cmtice@chromium.org> Tested-by: Caroline Tice <cmtice@chromium.org> Reviewed-by: Caroline Tice <cmtice@chromium.org> " fail_count="0" gerrit_number="411390" owner_email="cmtice@chromium.org" pass_count="0" patch_number="3" project="chromiumos/chromite" project_url="https://chromium-review.googlesource.com/chromiumos/chromite" ref="refs/changes/90/411390/3" remote="cros" total_fail_count="0"/><lkgm version="8996.0.0-rc1"/></manifest> |
