| <?xml version="1.0" encoding="utf-8"?><manifest revision="62a1d9cbef1a0bd68d2cb1b257c13072e3956926"> |
| <notice>Your sources have been sync'd successfully.</notice> |
| <remote fetch="https://android.googlesource.com" name="aosp" review="https://android-review.googlesource.com"/> |
| <remote alias="cros" fetch="https://chromium.googlesource.com/" name="chromium"/> |
| <remote fetch="https://chromium.googlesource.com" name="cros" review="https://chromium-review.googlesource.com"/> |
| <remote fetch="https://weave.googlesource.com" name="weave" review="https://weave-review.googlesource.com"/> |
| <default remote="cros" revision="refs/heads/master" sync-j="8"/> |
| <project name="aosp/platform/external/dbus-binding-generator" path="src/aosp/external/dbus-binding-generator" revision="275101a142d7d9c195c9c08a5af40ef9d070edd7" upstream="refs/heads/master"/> |
| <project name="aosp/platform/external/libbrillo" path="src/aosp/external/libbrillo" revision="1c8c1f93cff10c5a9b6fe396b6d3b739c2380792" upstream="refs/heads/master"/> |
| <project name="aosp/platform/external/libchrome" path="src/aosp/external/libchrome" revision="6430a2797e1dfb3af1b83a17640150d216037698" upstream="refs/heads/master"/> |
| <project name="aosp/platform/external/modp_b64" path="src/third_party/modp_b64" revision="99dc13926931cedfd2e4e582c33ef657d0645c5c" upstream="refs/heads/master"/> |
| <project name="aosp/platform/system/connectivity/apmanager" path="src/aosp/system/connectivity/apmanager" revision="685fba094dc8bcc556ff23e4330811d96bd17599" upstream="refs/heads/master"/> |
| <project name="aosp/platform/system/connectivity/shill" path="src/aosp/system/connectivity/shill" revision="1bc1824ef7b9dc50de8c042f0c472c10a7f29b38" upstream="refs/heads/master"/> |
| <project name="aosp/platform/system/firewalld" path="src/aosp/system/firewalld" revision="3d8e6ae763671ec2e7160e0cb93cf358865f7851" upstream="refs/heads/master"/> |
| <project name="aosp/platform/system/tpm" path="src/aosp/system/tpm" revision="fe3feb9e9ba681c63ea67391c70b7fff5b421141" upstream="refs/heads/master"/> |
| <project name="aosp/platform/system/update_engine" path="src/aosp/system/update_engine" revision="4d34c18e5ce29d138c7946cc817dee8b3fce7cf0" upstream="refs/heads/master"/> |
| <project name="aosp/platform/system/webservd" path="src/aosp/system/webservd" revision="8f325b7f28a4b3042753fb006bdbe95db98768cc" upstream="refs/heads/master"/> |
| <project name="apps/libapps" path="src/third_party/libapps" revision="5162fccd14657dfbd9c50cc1057d92368a4659b8" upstream="refs/heads/master"> |
| <annotation name="branch-mode" value="pin"/> |
| </project> |
| <project name="chromium/deps/libmtp" path="chromium/src/third_party/libmtp" remote="chromium" revision="4a93e2cfc133473ae58f17374c32669eea9a8912" upstream="refs/heads/master"/> |
| <project name="chromium/src/third_party/hwcplus" remote="chromium" revision="264120496730522ef3e5cc60b80a3953af1ac2cc" upstream="refs/heads/master"/> |
| <project groups="minilayout,buildtools,labtools" name="chromium/tools/depot_tools" remote="chromium" revision="1c822ade1f731ec35a3d2d3be8805f773df22c4c"/> |
| <project groups="minilayout,buildtools,labtools,sysmon,devserver" name="chromiumos/chromite" path="chromite" revision="f5851306304f8a1ddaaa67bfc8c658c119dc5454" upstream="refs/heads/master"> |
| <copyfile dest="AUTHORS" src="AUTHORS"/> |
| <copyfile dest="LICENSE" src="LICENSE"/> |
| </project> |
| <project name="chromiumos/graphyte" path="src/platform/graphyte" revision="e6f98087c8bd9420bebf4e0f28cc52cbca61fa20" upstream="refs/heads/master"/> |
| <project name="chromiumos/infra/suite_scheduler" path="infra/suite_scheduler" revision="f61a998565223c4cf6c7e1b43f2e288d94a8f08f" upstream="refs/heads/master"/> |
| <project groups="minilayout,buildtools,chromeos-admin,labtools,sysmon,devserver" name="chromiumos/infra_virtualenv" path="infra_virtualenv" revision="d1b1621d2d75b642639ab3ff956b85da451573f8" upstream="refs/heads/master"/> |
| <project name="chromiumos/manifest" path="manifest" revision="06186f8ed49dfaf27c72a0652d54510edb6539fb" upstream="refs/heads/master"/> |
| <project groups="minilayout" name="chromiumos/overlays/board-overlays" path="src/overlays" revision="c2f41ba02eba01dc3d25ee1e6fb2b6a2a9d440a3" upstream="refs/heads/master"/> |
| <project groups="minilayout,labtools" name="chromiumos/overlays/chromiumos-overlay" path="src/third_party/chromiumos-overlay" revision="eac0211df4d0339bf70dc88b8aa5d73b9c15a732" sync-c="true" upstream="refs/heads/master"/> |
| <project groups="minilayout,labtools" name="chromiumos/overlays/eclass-overlay" path="src/third_party/eclass-overlay" revision="31828d5a70040a035c6954b8fc09b92b5a9fd4b2" upstream="refs/heads/master"/> |
| <project groups="minilayout,labtools" name="chromiumos/overlays/portage-stable" path="src/third_party/portage-stable" revision="97ff6b0103f9fc59c2fe28110065ab3aa3db1ae7" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/arc-camera" path="src/platform/arc-camera" revision="b73d9118e76c3970f0a3d1e98b21ea29983a3cd6" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/assets" path="src/platform/assets" revision="4c52693b101710d97295d5160db26d9f4a3fb93d" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/audiotest" path="src/platform/audiotest" revision="95141ed333ea52f1b25e70d413bdeb7c07f33d2b" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/battery_updater" path="src/platform/battery_updater" revision="32463c6de8e8c98d4b1711937bc7678afc121a85" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/bmpblk" path="src/platform/bmpblk" revision="b178478ad8dc99ec4a5d0f39cbed80c5a86c43c5" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/bootcache" path="src/platform/bootcache" revision="ebe3a0995e90026433ffc62b7aeed6cad1f28694" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/btsocket" path="src/platform/btsocket" revision="1b65449a647c99556511df30b8ab660b98acce7f" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/chameleon" path="src/platform/chameleon" revision="7ef568c1dd0808fe4adc77374db9d0a4a4367a67" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/chromiumos-assets" path="src/platform/chromiumos-assets" revision="2f1ee8448a886ce1abad9c0e8741582244f8ab40" upstream="refs/heads/master"/> |
| <project groups="minilayout,buildtools" name="chromiumos/platform/crostestutils" path="src/platform/crostestutils" revision="78c97d8495a3ff08bc634acee5bf5ae4432288f6" upstream="refs/heads/master"/> |
| <project groups="minilayout,buildtools,labtools" name="chromiumos/platform/crosutils" path="src/scripts" revision="63d6c461b86b05dc8f4e1d80ffc637ecffd09daf" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/depthcharge" path="src/platform/depthcharge" revision="e0edb52a1e5ce1731610e092343608b384a33ff8" upstream="refs/heads/master"/> |
| <project groups="minilayout,buildtools,devserver" name="chromiumos/platform/dev-util" path="src/platform/dev" revision="447ad9d610433e6d34e4db04057357ef9f73a0f2" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/dm-verity" path="src/platform/verity" revision="5d5faf68cdb05e477f0637f517f4926a0db1394a" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/drm-tests" path="src/platform/drm-tests" revision="59ff9f9b438ba1350dfaeea438bc4a34a4bbe190" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/ec" path="src/platform/ec" revision="68efc2a175d15edd16fa4c96f1b64ba1b9e145d7" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/experimental" path="src/platform/experimental" revision="0c9b56092424c370eff748b25d49caceb9a18dab" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/factory" path="src/platform/factory" revision="e6d451276168df6d0fccb102527d7f49814132dd" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/factory_installer" path="src/platform/factory_installer" revision="262f49ab9054bd5363569eb7e115d9e1d7e0b719" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/firmware" path="src/platform/firmware" revision="421e3a402916bf7595439564cd28372c694a1089" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/frecon" path="src/platform/frecon" revision="3ccfd38dce51bdcf28f0c1c5beec0a08a128bec3" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/gestures" path="src/platform/gestures" revision="5a656849c7d2b0d0ddbe0ac6d300c1e2fada0bb4" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/go-seccomp" path="src/platform/go-seccomp" revision="0280326e5bd212fcfbe3696e113730045debae74" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/google-breakpad" path="src/third_party/breakpad" revision="cc1deb44521d41125f5d617940a654c58c794325" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/imageloader" path="src/platform/imageloader" revision="eac26041fd4d1d5c0328e529696ca82d353cb632" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/initramfs" path="src/platform/initramfs" revision="a0f0b6ba3da4e4bcf9ffd277e903b19c75501fca" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/inputcontrol" path="src/platform/inputcontrol" revision="ae0b15dc322bab9bf6d7c4fcd5f77d488766a275" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/jabra_vold" path="src/platform/jabra_vold" revision="9e21dc27a8cdc1409251fcd5e90e23f313100b59" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/libevdev" path="src/platform/libevdev" revision="9f7a1961eb4726211e18abd147d5a11a4ea86744" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/memento_softwareupdate" path="src/platform/memento_softwareupdate" revision="c7ff5188fb31541c3c6173e8171155f965760883" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/minigbm" path="src/platform/minigbm" revision="bc7dc78e795caa97ad26045b9247f1e0584e69ba" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/moblab" path="src/platform/moblab" revision="dca599879cab0dba8ed32ef3a5d1b82e26524732" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/monitor_reconfig" path="src/platform/monitor_reconfig" revision="f022d19d84f232290b596beeb26347f62442e7eb" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/mosys" path="src/platform/mosys" revision="0ce18dffe0ceb374f7ab67d9d83efadd5b2cce11" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/mtpd" path="src/platform/mtpd" revision="e2da245689e83bc4eb7abb4cd73e06124618550b" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/mtplot" path="src/platform/mtplot" revision="5e4f631e633384751f582bd9db5f4d6eb2112494" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/mttools" path="src/platform/mttools" revision="8da2c778eafaa0eb961308fcb5426dde45b08c5f" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/newblue" path="src/platform/newblue" revision="3703e8a79698c78864d3e5610341c64338f4600a" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/punybench" path="src/platform/punybench" revision="5a230ee17756dc43ff732932dcb52899c06a4d09" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/system_api" path="src/platform/system_api" revision="2060d21131cbddaa506108851c974fd813687495" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/touch_firmware_test" path="src/platform/touch_firmware_test" revision="95a5fb7a1e4526ed8c8e641431f66f22f302cddc" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/touch_noise_filter" path="src/platform/touch_noise_filter" revision="f1eb895f7ea70ad99bbe60508fda825923c35af6" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/touch_updater" path="src/platform/touch_updater" revision="12833c807a65117b7c4d27bb4471309f815bab39" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/touchbot" path="src/platform/touchbot" revision="75d8f1bfbbb3dfc870fcbc22f53cd16b66ac7f23" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/touchpad-tests" path="src/platform/touchpad-tests" revision="d2e7d94a834b54511ca57e6359839f9ca86d6d04" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/tpm" path="src/third_party/tpm" revision="0cba6cadd1bea1ce3717779201d594c4c9131dc2" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/tpm_lite" path="src/platform/tpm_lite" revision="066c7f963b3ef733716251b666e0af0afd03b4fe" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/uboot-env" path="src/platform/uboot-env" revision="108ebbfac4d13d11e1940216434c368384ee0c0b" upstream="refs/heads/master"/> |
| <project groups="buildtools" name="chromiumos/platform/vboot_reference" path="src/platform/vboot_reference" revision="50d1282e856953616d3d3e7be31aa0f9fefd0f9a" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/vpd" path="src/platform/vpd" revision="510ca879933b137d8bc841fda6911a5e290f51c9" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/webplot" path="src/platform/webplot" revision="bbd5ea22ef9f8e109e363b26958d9a2fc8921f0f" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/xf86-input-cmt" path="src/platform/xf86-input-cmt" revision="3f2ffc921952e57a4343463b0679d90b80b51fc7" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform/xorg-conf" path="src/platform/xorg-conf" revision="2532ff5e2a9ce8ded3207b0b26639f204ea8f26f" upstream="refs/heads/master"/> |
| <project name="chromiumos/platform2" path="src/platform2" revision="c69ea9b1292491306bb749aba1f015d8374b26fb" upstream="refs/heads/master"/> |
| <project groups="minilayout,buildtools,labtools" name="chromiumos/repohooks" path="src/repohooks" revision="f9d41b3c36126579c60665c847834b624bf7b174" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/adhd" path="src/third_party/adhd" revision="77fa3d86f29287aa87004c9e1b9abf543f08cd3b" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/android_mtdutils" path="src/third_party/android_mtdutils" revision="9bcfc3ee238f16925e9aaa4573129784ebb397e7" upstream="chromeos"/> |
| <project name="chromiumos/third_party/arm-trusted-firmware" path="src/third_party/arm-trusted-firmware" revision="a8de89c97461b7cc13a596db8771c30843b06405" upstream="refs/heads/upstream_mirror/master"> |
| <annotation name="branch-mode" value="create"/> |
| </project> |
| <project name="chromiumos/third_party/atheros" path="src/third_party/atheros" revision="52a5bdaa8930c14ee42518354de3e5ec09911c6b" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/atrusctl" path="src/third_party/atrusctl" revision="e0f32d96db2abf92548b8962ca8a0da7916e87d1" upstream="refs/heads/master"/> |
| <project groups="buildtools,labtools,devserver" name="chromiumos/third_party/autotest" path="src/third_party/autotest/files" revision="4cefffc8b537472a853e55967926c658639159c2" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/bluez" path="src/third_party/bluez" revision="758a5e9425a1c95a32591499367bbeeab001109c" upstream="refs/heads/chromeos-5.41"/> |
| <project name="chromiumos/third_party/bootstub" path="src/third_party/bootstub" revision="5ac54e8d3d305c2c6c7297e8e54d3cf7e4629b29" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/broadcom" path="src/third_party/broadcom" revision="4070e7161f2f1a1a22027a744eb868500688f0b6" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/cbootimage" path="src/third_party/cbootimage" revision="b7d5b2d6a6dd05874d86ee900ff441d261f9034c" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/chrontel" path="src/third_party/chrontel" revision="7bcd0328d0eeef6a0539bd0ba80cd9a545e6cf4a" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/coreboot" path="src/third_party/coreboot" revision="59823d9403579d337c9b16b8f9319fa513717f26" upstream="refs/heads/chromeos-2016.05"/> |
| <project name="chromiumos/third_party/coreboot/blobs" path="src/third_party/coreboot/3rdparty/blobs" revision="9ba07035ed0acb28902cce826ea833cf531d57c1" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/cryptoc" path="src/third_party/cryptoc" revision="6283eeeaf5ccebcca982d5318b36d49e7b32cb6d" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/cypress-tools" path="src/third_party/cypress-tools" revision="043fba1c35f89cce95f804bf6d4f01cfc23a6c21" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/daisydog" path="src/third_party/daisydog" revision="60338a8ef06d801b6d2e343dbb14697a16f85c1b" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/dbus-cplusplus" path="src/third_party/dbus-c++" revision="904f49fd770dd559800523edd91c1226e131655d" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/dbus-spy" path="src/third_party/dbus-spy" revision="0e04421c73b24536de7fcc1886da469d8b7a2a41" upstream="refs/heads/master"/> |
| <project groups="minilayout,buildtools" name="chromiumos/third_party/dpkt" path="chromite/third_party/dpkt" revision="f5259728b1294412bee945df9708efba09ea9160"> |
| <annotation name="branch-mode" value="pin"/> |
| </project> |
| <project name="chromiumos/third_party/edk2" path="src/third_party/edk2" revision="0aa39d284043be61b5f1222afdffd39a5abaf3aa" upstream="refs/heads/chromeos-2014.04"/> |
| <project name="chromiumos/third_party/em100" path="src/third_party/em100" revision="6e60dbae5bf62cd0ffffb9fc5ca9ba93e831ee88" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/flashmap" path="src/third_party/flashmap" revision="caf3f93f753df5ff089df615e465d46122bee123" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/flashrom" path="src/third_party/flashrom" revision="1bb61e18651f8b4b1838968469164642637d48a9" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/gcc" path="src/third_party/gcc" revision="a2bc87ab8851051e765d60626a6997f63ddfe00e" upstream="refs/heads/master"/> |
| <project groups="minilayout,buildtools" name="chromiumos/third_party/gdata" path="chromite/third_party/gdata" revision="fe7e5c90a9827feb66ed446b2d297a1618b25272" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/gdmwimax" path="src/third_party/gdmwimax" revision="e8236b4b2d66b1972e4f84955a238134acd7f6a1" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/gobi3k-sdk" path="src/third_party/gobi3k-sdk" revision="5e5d1a65cbf855609e4d7c9c425615090a834704" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/grub2" path="src/third_party/grub2" revision="df6034c59cb2d847f9e780cf2def30c5c9b8305f" upstream="refs/heads/master"/> |
| <project groups="labtools" name="chromiumos/third_party/hdctools" path="src/third_party/hdctools" revision="2c96c905e1924eb16762c2b0902826c27f9409c3" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/hostap" path="src/third_party/wpa_supplicant" revision="7e62cc7051730828a9d6cf86d19cdb0c6e0ed620" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/hwcplus-drm" path="src/third_party/hwcplus-drm" revision="7376a8da1c961115a61d7a3cb23bb13e4153583d" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/kernel" path="src/third_party/kernel/v3.8" revision="d3425edeec4c35e5c27a76b49bc8d734b06499c7" upstream="refs/heads/chromeos-3.8"/> |
| <project name="chromiumos/third_party/kernel" path="src/third_party/kernel/v3.10" revision="52f149dc997b16abd4f056d4348c9b9639c61de6" upstream="refs/heads/chromeos-3.10"/> |
| <project name="chromiumos/third_party/kernel" path="src/third_party/kernel/v3.14" revision="ddb56e72316dbead19e930e047ed68564e85062b" upstream="refs/heads/chromeos-3.14"/> |
| <project name="chromiumos/third_party/kernel" path="src/third_party/kernel/v3.18" revision="b06505d238d0322df17428c7fabe4196de2a9ae7" upstream="refs/heads/chromeos-3.18"/> |
| <project name="chromiumos/third_party/kernel" path="src/third_party/kernel/v4.4" revision="b0c9a351814431f30c066a5a9a756ebcea006123" upstream="refs/heads/chromeos-4.4"/> |
| <project name="chromiumos/third_party/khronos" path="src/third_party/khronos" revision="bbd199f8f3dc9c2a49cfecfc7956fe7706d9f0e9" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/kvmtool" path="src/third_party/kvmtool" revision="05661cbc54ade1371995b65348ed524d25bfc034" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/libc-bench" path="src/third_party/libc-bench" revision="76793dd4b09191a78a78180012718e72d792717f" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/libdrm" path="src/third_party/libdrm" revision="0c7748b56694e9b00537f27bbe9edb11c78ce08f" upstream="refs/heads/chromeos-2.4.70"/> |
| <project name="chromiumos/third_party/libmbim" path="src/third_party/libmbim" revision="afc1b877083133dbb52958d1a9e1b621761c06ab" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/libqmi" path="src/third_party/libqmi" revision="064b61254f513fe6d2c7f3ccbb63c91da0fce61b" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/libresample" path="src/third_party/libresample" revision="cc9f20f439396b7d45e94b8301edd95d33f26a46" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/libscrypt" path="src/third_party/libscrypt" revision="b45c53f9418a6eff2c8ed98703a55f96029304b1" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/libsigrok" path="src/third_party/libsigrok" revision="199fe31115c76231746f5953271795d58679561c" upstream="refs/heads/chromeos"/> |
| <project name="chromiumos/third_party/libsigrok-cli" path="src/third_party/sigrok-cli" revision="c9edfa218e5a5972531b6f4a3ece8d33a44ae1b5" upstream="refs/heads/chromeos"/> |
| <project name="chromiumos/third_party/libsigrokdecode" path="src/third_party/libsigrokdecode" revision="3279c2825684c7009775b731d0a9e37815778282" upstream="refs/heads/chromeos"/> |
| <project name="chromiumos/third_party/libv4lplugins" path="src/third_party/libv4lplugins" revision="e79d5093d0c93b9072f45415b29e12b2740db25e" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/linux-firmware" path="src/third_party/linux-firmware" revision="3aaa522989516d3ab6b09c7be87f37f82ef82547" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/ltp" path="src/third_party/ltp" revision="7df860dd2389c5c9a5b2ed9ac8a7f1d48d6fed03" upstream="refs/heads/chromeos-20150119"/> |
| <project name="chromiumos/third_party/marvell" path="src/third_party/marvell" revision="b5d3741d042bde7941284303712c3790ab4e489d" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/memtest" path="src/third_party/memtest" revision="3d4be6e3bfd819856e38a82e35c206fec4551851" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/mesa" path="src/third_party/arc-mesa" revision="2b9ed2c6be718b42ec633887938f132725927b9d" upstream="refs/heads/arc-12.1.0-pre2"/> |
| <project name="chromiumos/third_party/mesa" path="src/third_party/mesa" revision="9baf1ff8fc06d8c986e55465f77427d416ecd710" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/mesa" path="src/third_party/mesa-img" revision="129178893b2260df22db96327c5ca9c2ce7db046" upstream="refs/heads/mesa-img"/> |
| <project name="chromiumos/third_party/minifakedns" path="src/third_party/miniFakeDns" revision="6184bea119dea53da539727fe8c2a116f98cef24" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/mmc-utils" path="src/third_party/mmc-utils" revision="bcc3e2e4246431be511be3959a11cd9733bedd29" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/modemmanager-next" path="src/third_party/modemmanager-next" revision="382aba7033803c84057b015c74d861d5907e7784" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/nfs-ganesha" path="src/third_party/nfs-ganesha" revision="0ca03501dfd49f8091a04f941c05a71246b24bf4" upstream="refs/heads/V2.3-stable"/> |
| <project name="chromiumos/third_party/ntirpc" path="src/third_party/ntirpc" revision="9188a4c63881f5c26283ac05132f97a408a67462" upstream="refs/heads/V1.3.3-cros"/> |
| <project name="chromiumos/third_party/opencryptoki" path="src/third_party/opencryptoki" revision="b67690aeeb4174b2253db18a9c1b19eeb219a4ef" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/ply-image" path="src/third_party/ply-image" revision="6cf4e4cd968bb72ade54e423e2b97eb3a80c6de9" upstream="refs/heads/master"/> |
| <project groups="minilayout,buildtools" name="chromiumos/third_party/pyelftools" path="chromite/third_party/pyelftools" revision="19b3e610c86fcadb837d252c794cb5e8008826ae" upstream="refs/heads/master-0.22"/> |
| <project name="chromiumos/third_party/rootdev" path="src/third_party/rootdev" revision="5d7d7ff513315abd103d0c95e92ae646c1a7688c" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/seabios" path="src/third_party/seabios" revision="3004147dd3707e600772ec6c5d37beac7f4b8eb4" upstream="refs/heads/chromeos-2014.11.03"/> |
| <project name="chromiumos/third_party/sysbios" path="src/third_party/sysbios" revision="33e1db34b8162de72a5e9bbbc44e6bce38978396" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/tegra-power-query" path="src/third_party/tegra-power-query" revision="66f1f0d949f4ca4836c1a65b622629205240e37a" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/tegrastats" path="src/third_party/tegrastats" revision="1be161a89525d840e1f6d1f21b3f45645a7dedb3" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/tlsdate" path="src/third_party/tlsdate" revision="78a898a0b196b4b683a08dfa34128e39bad9c340" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/toolchain-utils" path="src/third_party/toolchain-utils" revision="92470bc29ad10b5c6409c1ba76697082fa6ef3ee" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/tpm-emulator" path="src/third_party/tpm-emulator" revision="310a21ef24ace14b4d6e8095172445494f54ff25" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/tpm2" path="src/third_party/tpm2" revision="1a68fe6fa860f563e8b45e3826110ceec75d61a8" upstream="refs/heads/master"/> |
| <project name="chromiumos/third_party/trousers" path="src/third_party/trousers" revision="71d4fee1dc6db9bd22f6866571895b753f222ff5" upstream="refs/heads/master-0.3.13"/> |
| <project name="chromiumos/third_party/u-boot" path="src/third_party/u-boot/files" revision="cc72f5c47c758892b0f41257b0dd441a506ffdcd" upstream="refs/heads/chromeos-v2013.06"/> |
| <project name="chromiumos/third_party/u-boot" path="src/third_party/u-boot/next" revision="b30f38206f17aa73cda0a2fdaf4dc705527315ba" upstream="refs/heads/chromeos-v2015.07-rc1"/> |
| <project name="chromiumos/third_party/whining" path="src/third_party/whining" revision="bcf721d62d6a4c4c162c63714371fa4349df53bc" upstream="refs/heads/master"/> |
| <project name="external/git.kernel.org/fs/xfs/xfstests-dev" path="src/third_party/xfstests" revision="de86b28517076f30dbef77443512667c15b634cb" upstream="refs/heads/master"/> |
| <project groups="minilayout,buildtools" name="external/swarming.client" path="chromite/third_party/swarming.client" remote="chromium" revision="715861067a7cc8d20d2d629b6d76d796c004feb4"/> |
| <project name="linux-syscall-support" path="src/third_party/breakpad/src/third_party/lss" revision="c555f533313986d29c827eb59c7bd99fd37b3ec4"/> |
| <project name="platform/bootable/recovery" path="src/aosp/bootable/recovery" remote="aosp" revision="b694ba8aab0e60b530beaeb079017ec2cf0ad10a" upstream="refs/heads/master"/> |
| <project name="platform/external/bsdiff" path="src/aosp/external/bsdiff" remote="aosp" revision="218dfb0239d17e53cf5ffea4e5e3699312d4318e" upstream="refs/heads/master"/> |
| <project name="platform/external/libmojo" path="src/aosp/external/libmojo" remote="aosp" revision="9575f95555d46b57a7d3d01564a7bbbcf326f222" upstream="refs/heads/master"/> |
| <project name="platform/external/minijail" path="src/aosp/external/minijail" remote="aosp" revision="8d35c2ec75c854b746489e583bef716eb278b422" upstream="refs/heads/master"/> |
| <project name="platform/system/core" path="src/platform/core" remote="aosp" revision="5e148a58b8cf98d2443f8d7fb04a0b615c8aa4eb" upstream="refs/heads/master"/> |
| <project name="toolchain/binutils" path="src/aosp/toolchain/binutils" remote="aosp" revision="9bf6cbf6dd88777719c5757922aff0190ec46539" upstream="refs/heads/master"/> |
| <project name="toolchain/gcc" path="src/aosp/toolchain/gcc" remote="aosp" revision="32c89c19b042a12b5a1bf0153299154ea5435c03"/> |
| <project name="weave/libweave" path="src/weave/libweave" remote="weave" revision="8b213b097455da06d13c19f48ecfce235e2b1faa" upstream="refs/heads/refactor-01-2017"/> |
| <repo-hooks enabled-list="pre-upload" in-project="chromiumos/repohooks"/> |
| <pending_commit branch="master" change_id="Ib4acbeae87f783a0713d7c0fd60ba17f44de8c52" commit="a20ec029505ec1ddbdc867f4f927e2ee9852e6e6" commit_message="breakpad: update lss deps This has fixed ARM assembly. BUG=chromium:693313 TEST=build still works Change-Id: Ib4acbeae87f783a0713d7c0fd60ba17f44de8c52 Reviewed-on: https://chromium-review.googlesource.com/449912 Commit-Ready: Mike Frysinger <vapier@chromium.org> Tested-by: Mike Frysinger <vapier@chromium.org> Reviewed-by: Ben Chan <benchan@chromium.org> " fail_count="0" gerrit_number="449912" owner_email="vapier@chromium.org" pass_count="0" patch_number="1" project="chromiumos/manifest" project_url="https://chromium-review.googlesource.com/chromiumos/manifest" ref="refs/changes/12/449912/1" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-4.4" change_id="I022b00ef5777c2b2b87168cf4f96d8bbd51e7c64" commit="6326a2d5f18c59bb73468ac2401c0dea714b2686" commit_message="UPSTREAM: mmc: sdhci-acpi: Set MMC_CAP_AGGRESSIVE_PM for Broxton controllers Set MMC_CAP_AGGRESSIVE_PM for Broxton host controllers. Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> (cherry picked from commit 706e86e9de7cfd5220784f6329d92f65de883d71) Signed-off-by: Azhar Shaikh <azhar.shaikh@intel.com> BUG=b:35648535 TEST=with sd card inserted and no activity being done on the sd card SD host controller driver goes to suspend after 3secs of inactivity Change-Id: I022b00ef5777c2b2b87168cf4f96d8bbd51e7c64 Reviewed-on: https://chromium-review.googlesource.com/448173 Commit-Ready: Azhar Shaikh <azhar.shaikh@intel.com> Tested-by: Michael Cheng <michael.cheng@intel.com> Reviewed-by: Benson Leung <bleung@chromium.org> " fail_count="0" gerrit_number="448173" owner_email="azhar.shaikh@intel.com" pass_count="0" patch_number="2" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/73/448173/2" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-4.4" change_id="Ie907374cfd0f524db60792386e286f0df6cbe880" commit="5afdd5370503558eb10925f489215b0da57217a0" commit_message="UPSTREAM: mmc: sdhci-pci: Set MMC_CAP_AGGRESSIVE_PM for Broxton controllers Set MMC_CAP_AGGRESSIVE_PM for Broxton host controllers. Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> (cherry picked from commit e8ef51763106dc40037c9ae207acf505bb4b71b1) BUG=b:35648535 TEST=with sd card inserted and no activity being done on the sd card SD host controller driver goes to suspend after 3secs of inactivity Change-Id: Ie907374cfd0f524db60792386e286f0df6cbe880 Reviewed-on: https://chromium-review.googlesource.com/448174 Commit-Ready: Azhar Shaikh <azhar.shaikh@intel.com> Tested-by: Michael Cheng <michael.cheng@intel.com> Reviewed-by: Benson Leung <bleung@chromium.org> " fail_count="0" gerrit_number="448174" owner_email="azhar.shaikh@intel.com" pass_count="0" patch_number="2" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/74/448174/2" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-4.4" change_id="I161769a98e292ee1e31f894161babab35773e8dc" commit="84a0eda2a68c2de7f1cbb2df32a1615dd3340859" commit_message="UPSTREAM: mmc: It is not an error for the card to be removed while suspended A card can be removed while it is runtime suspended. Do not print an error message. Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> (cherry picked from commit 520322d92eab66b6fee562557fdd201b01cd6240) Signed-off-by: Azhar Shaikh <azhar.shaikh@intel.com> BUG=b:35648535 TEST=with sd card inserted and no activity being done on the sd card SD host controller driver goes to suspend after 3secs of inactivity Change-Id: I161769a98e292ee1e31f894161babab35773e8dc Signed-off-by: Azhar Shaikh <azhar.shaikh@intel.com> Reviewed-on: https://chromium-review.googlesource.com/448175 Tested-by: Michael Cheng <michael.cheng@intel.com> Reviewed-by: Benson Leung <bleung@chromium.org> " fail_count="0" gerrit_number="448175" owner_email="azhar.shaikh@intel.com" pass_count="0" patch_number="2" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/75/448175/2" remote="cros" total_fail_count="0"/><pending_commit branch="master" change_id="I48bc06aefc881ec0bde0a7d6d21d39900a7826f8" commit="d33ac4afaedafaa335a9264f505f60f86b413a38" commit_message="termina: add initial project-termina overlay BUG=chromium:694897 TEST=with tatl/tael overlays, build_packages --board=ta{t,e}l succeeds Change-Id: I48bc06aefc881ec0bde0a7d6d21d39900a7826f8 Reviewed-on: https://chromium-review.googlesource.com/427300 Commit-Ready: Stephen Barber <smbarber@chromium.org> Tested-by: Stephen Barber <smbarber@chromium.org> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org> " fail_count="0" gerrit_number="427300" owner_email="smbarber@chromium.org" pass_count="0" patch_number="12" project="chromiumos/overlays/board-overlays" project_url="https://chromium-review.googlesource.com/chromiumos/overlays/board-overlays" ref="refs/changes/00/427300/12" remote="cros" total_fail_count="0"/><pending_commit branch="master" change_id="I3fd2a0527ba7749d19fdd60bdb2da0923189a4aa" commit="53d5eb2bcfdcc758f5030c95f479bf893605f3af" commit_message="tatl: add initial board overlay BUG=chromium:694897 TEST=setup_board, build_packages, then package_to_container target-termina-os CQ-DEPEND=CL:438926 Change-Id: I3fd2a0527ba7749d19fdd60bdb2da0923189a4aa Reviewed-on: https://chromium-review.googlesource.com/427301 Commit-Ready: Stephen Barber <smbarber@chromium.org> Tested-by: Stephen Barber <smbarber@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org> " fail_count="0" gerrit_number="427301" owner_email="smbarber@chromium.org" pass_count="0" patch_number="13" project="chromiumos/overlays/board-overlays" project_url="https://chromium-review.googlesource.com/chromiumos/overlays/board-overlays" ref="refs/changes/01/427301/13" remote="cros" total_fail_count="0"/><pending_commit branch="master" change_id="I4b38e820f0c1f44557affd71f767611285e1900d" commit="20bbb9161ce1478f4b364102dd1c96e071ece79c" commit_message="tael: add initial board overlay BUG=chromium:694897 TEST=setup_board, build_packages, then package_to_container target-termina-os Change-Id: I4b38e820f0c1f44557affd71f767611285e1900d Reviewed-on: https://chromium-review.googlesource.com/427302 Commit-Ready: Stephen Barber <smbarber@chromium.org> Tested-by: Stephen Barber <smbarber@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org> " fail_count="0" gerrit_number="427302" owner_email="smbarber@chromium.org" pass_count="0" patch_number="14" project="chromiumos/overlays/board-overlays" project_url="https://chromium-review.googlesource.com/chromiumos/overlays/board-overlays" ref="refs/changes/02/427302/14" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-4.4" change_id="Id3ca79327161ebc68f7d5fdd45075aebcfd75dbd" commit="68d88d88565db535d652d40b8f9b9dd2a8817162" commit_message="CHROMIUM: arm64: dts: rockchip: add scarlet base on gru BUG=chrome-os-partner:62923 TEST=make kernel without any error Change-Id: Id3ca79327161ebc68f7d5fdd45075aebcfd75dbd Signed-off-by: Chris Zhong <zyw@rock-chips.com> Reviewed-on: https://chromium-review.googlesource.com/440788 Commit-Ready: Brian Norris <briannorris@chromium.org> Tested-by: Brian Norris <briannorris@chromium.org> Reviewed-by: Brian Norris <briannorris@chromium.org> " fail_count="0" gerrit_number="440788" owner_email="zyw@rock-chips.com" pass_count="0" patch_number="14" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/88/440788/14" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-4.4" change_id="I307fcf82590de392a50407cdd6bdc46dc610b0b8" commit="1f14f8fbc91c7474f6799979952f16512abc8fac" commit_message="UPSTREAM: reset: add of_reset_control_get_by_index() Add of_reset_control_get_by_index() to allow the drivers to get reset device without knowing its name. BUG=chrome-os-partner:62134 TEST=check mipi screen, it can display normally (cherry-picked from: c0a13aa6da5da19f9eedb562b226ec585aabdca9) Signed-off-by: Vince Hsu <vinceh@nvidia.com> [jonathanh@nvidia.com: Updated stub function to return -ENOTSUPP instead of -ENOSYS which should only be used for system calls.] Signed-off-by: Jon Hunter <jonathanh@nvidia.com> Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Chris Zhong <zyw@rock-chips.com> Change-Id: I307fcf82590de392a50407cdd6bdc46dc610b0b8 Reviewed-on: https://chromium-review.googlesource.com/442948 Commit-Ready: Brian Norris <briannorris@chromium.org> Tested-by: Brian Norris <briannorris@chromium.org> Reviewed-by: Brian Norris <briannorris@chromium.org> " fail_count="0" gerrit_number="442948" owner_email="zyw@rock-chips.com" pass_count="0" patch_number="7" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/48/442948/7" remote="cros" total_fail_count="1"/><pending_commit branch="chromeos-4.4" change_id="I94e63835805789a4534b7c4076f8936f4df88930" commit="4e8e85166b9e2007667810e3bb22c1e05e20ecf0" commit_message="UPSTREAM: reset: Fix of_reset_control_get() for consistent return values When of_reset_control_get() is called without connection ID it returns -ENOENT when the 'resets' property doesn't exists or is an empty entry. However when a connection ID is given it returns -EINVAL when the 'resets' property doesn't exists or the requested name can't be found. This is because the error code returned by of_property_match_string() is just passed down as an index to of_parse_phandle_with_args(), which then returns -EINVAL. To get a consistent return value with both code paths we must return -ENOENT when of_property_match_string() fails. BUG=chrome-os-partner:62134 TEST=check mipi screen, it can display normally (cherry picked from commit 3d81216fde465e76c5eae98f61d3666163634395) Change-Id: I94e63835805789a4534b7c4076f8936f4df88930 Signed-off-by: Alban Bedel <albeu@free.fr> Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Chris Zhong <zyw@rock-chips.com> Reviewed-on: https://chromium-review.googlesource.com/442949 Commit-Ready: Brian Norris <briannorris@chromium.org> Tested-by: Brian Norris <briannorris@chromium.org> Reviewed-by: Brian Norris <briannorris@chromium.org> " fail_count="0" gerrit_number="442949" owner_email="zyw@rock-chips.com" pass_count="0" patch_number="7" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/49/442949/7" remote="cros" total_fail_count="1"/><pending_commit branch="chromeos-3.18" change_id="I3a4fc7440f2e7ac54c781fa2394b7528f64a2b71" commit="873b909d7bff8d7fdca28da8b691581348ccd0c0" commit_message="UPSTREAM: l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind() Lock socket before checking the SOCK_ZAPPED flag in l2tp_ip6_bind(). Without lock, a concurrent call could modify the socket flags between the sock_flag(sk, SOCK_ZAPPED) test and the lock_sock() call. This way, a socket could be inserted twice in l2tp_ip6_bind_table. Releasing it would then leave a stale pointer there, generating use-after-free errors when walking through the list or modifying adjacent entries. BUG: KASAN: use-after-free in l2tp_ip6_close+0x22e/0x290 at addr ffff8800081b0ed8 Write of size 8 by task syz-executor/10987 CPU: 0 PID: 10987 Comm: syz-executor Not tainted 4.8.0+ #39 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014 ffff880031d97838 ffffffff829f835b ffff88001b5a1640 ffff8800081b0ec0 ffff8800081b15a0 ffff8800081b6d20 ffff880031d97860 ffffffff8174d3cc ffff880031d978f0 ffff8800081b0e80 ffff88001b5a1640 ffff880031d978e0 Call Trace: [<ffffffff829f835b>] dump_stack+0xb3/0x118 lib/dump_stack.c:15 [<ffffffff8174d3cc>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:156 [< inline >] print_address_description mm/kasan/report.c:194 [<ffffffff8174d666>] kasan_report_error+0x1f6/0x4d0 mm/kasan/report.c:283 [< inline >] kasan_report mm/kasan/report.c:303 [<ffffffff8174db7e>] __asan_report_store8_noabort+0x3e/0x40 mm/kasan/report.c:329 [< inline >] __write_once_size ./include/linux/compiler.h:249 [< inline >] __hlist_del ./include/linux/list.h:622 [< inline >] hlist_del_init ./include/linux/list.h:637 [<ffffffff8579047e>] l2tp_ip6_close+0x22e/0x290 net/l2tp/l2tp_ip6.c:239 [<ffffffff850b2dfd>] inet_release+0xed/0x1c0 net/ipv4/af_inet.c:415 [<ffffffff851dc5a0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:422 [<ffffffff84c4581d>] sock_release+0x8d/0x1d0 net/socket.c:570 [<ffffffff84c45976>] sock_close+0x16/0x20 net/socket.c:1017 [<ffffffff817a108c>] __fput+0x28c/0x780 fs/file_table.c:208 [<ffffffff817a1605>] ____fput+0x15/0x20 fs/file_table.c:244 [<ffffffff813774f9>] task_work_run+0xf9/0x170 [<ffffffff81324aae>] do_exit+0x85e/0x2a00 [<ffffffff81326dc8>] do_group_exit+0x108/0x330 [<ffffffff81348cf7>] get_signal+0x617/0x17a0 kernel/signal.c:2307 [<ffffffff811b49af>] do_signal+0x7f/0x18f0 [<ffffffff810039bf>] exit_to_usermode_loop+0xbf/0x150 arch/x86/entry/common.c:156 [< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:190 [<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0 arch/x86/entry/common.c:259 [<ffffffff85e4d726>] entry_SYSCALL_64_fastpath+0xc4/0xc6 Object at ffff8800081b0ec0, in cache L2TP/IPv6 size: 1448 Allocated: PID = 10987 [ 1116.897025] [<ffffffff811ddcb6>] save_stack_trace+0x16/0x20 [ 1116.897025] [<ffffffff8174c736>] save_stack+0x46/0xd0 [ 1116.897025] [<ffffffff8174c9ad>] kasan_kmalloc+0xad/0xe0 [ 1116.897025] [<ffffffff8174cee2>] kasan_slab_alloc+0x12/0x20 [ 1116.897025] [< inline >] slab_post_alloc_hook mm/slab.h:417 [ 1116.897025] [< inline >] slab_alloc_node mm/slub.c:2708 [ 1116.897025] [< inline >] slab_alloc mm/slub.c:2716 [ 1116.897025] [<ffffffff817476a8>] kmem_cache_alloc+0xc8/0x2b0 mm/slub.c:2721 [ 1116.897025] [<ffffffff84c4f6a9>] sk_prot_alloc+0x69/0x2b0 net/core/sock.c:1326 [ 1116.897025] [<ffffffff84c58ac8>] sk_alloc+0x38/0xae0 net/core/sock.c:1388 [ 1116.897025] [<ffffffff851ddf67>] inet6_create+0x2d7/0x1000 net/ipv6/af_inet6.c:182 [ 1116.897025] [<ffffffff84c4af7b>] __sock_create+0x37b/0x640 net/socket.c:1153 [ 1116.897025] [< inline >] sock_create net/socket.c:1193 [ 1116.897025] [< inline >] SYSC_socket net/socket.c:1223 [ 1116.897025] [<ffffffff84c4b46f>] SyS_socket+0xef/0x1b0 net/socket.c:1203 [ 1116.897025] [<ffffffff85e4d685>] entry_SYSCALL_64_fastpath+0x23/0xc6 Freed: PID = 10987 [ 1116.897025] [<ffffffff811ddcb6>] save_stack_trace+0x16/0x20 [ 1116.897025] [<ffffffff8174c736>] save_stack+0x46/0xd0 [ 1116.897025] [<ffffffff8174cf61>] kasan_slab_free+0x71/0xb0 [ 1116.897025] [< inline >] slab_free_hook mm/slub.c:1352 [ 1116.897025] [< inline >] slab_free_freelist_hook mm/slub.c:1374 [ 1116.897025] [< inline >] slab_free mm/slub.c:2951 [ 1116.897025] [<ffffffff81748b28>] kmem_cache_free+0xc8/0x330 mm/slub.c:2973 [ 1116.897025] [< inline >] sk_prot_free net/core/sock.c:1369 [ 1116.897025] [<ffffffff84c541eb>] __sk_destruct+0x32b/0x4f0 net/core/sock.c:1444 [ 1116.897025] [<ffffffff84c5aca4>] sk_destruct+0x44/0x80 net/core/sock.c:1452 [ 1116.897025] [<ffffffff84c5ad33>] __sk_free+0x53/0x220 net/core/sock.c:1460 [ 1116.897025] [<ffffffff84c5af23>] sk_free+0x23/0x30 net/core/sock.c:1471 [ 1116.897025] [<ffffffff84c5cb6c>] sk_common_release+0x28c/0x3e0 ./include/net/sock.h:1589 [ 1116.897025] [<ffffffff8579044e>] l2tp_ip6_close+0x1fe/0x290 net/l2tp/l2tp_ip6.c:243 [ 1116.897025] [<ffffffff850b2dfd>] inet_release+0xed/0x1c0 net/ipv4/af_inet.c:415 [ 1116.897025] [<ffffffff851dc5a0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:422 [ 1116.897025] [<ffffffff84c4581d>] sock_release+0x8d/0x1d0 net/socket.c:570 [ 1116.897025] [<ffffffff84c45976>] sock_close+0x16/0x20 net/socket.c:1017 [ 1116.897025] [<ffffffff817a108c>] __fput+0x28c/0x780 fs/file_table.c:208 [ 1116.897025] [<ffffffff817a1605>] ____fput+0x15/0x20 fs/file_table.c:244 [ 1116.897025] [<ffffffff813774f9>] task_work_run+0xf9/0x170 [ 1116.897025] [<ffffffff81324aae>] do_exit+0x85e/0x2a00 [ 1116.897025] [<ffffffff81326dc8>] do_group_exit+0x108/0x330 [ 1116.897025] [<ffffffff81348cf7>] get_signal+0x617/0x17a0 kernel/signal.c:2307 [ 1116.897025] [<ffffffff811b49af>] do_signal+0x7f/0x18f0 [ 1116.897025] [<ffffffff810039bf>] exit_to_usermode_loop+0xbf/0x150 arch/x86/entry/common.c:156 [ 1116.897025] [< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:190 [ 1116.897025] [<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0 arch/x86/entry/common.c:259 [ 1116.897025] [<ffffffff85e4d726>] entry_SYSCALL_64_fastpath+0xc4/0xc6 Memory state around the buggy address: ffff8800081b0d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8800081b0e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8800081b0e80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ^ ffff8800081b0f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8800081b0f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== The same issue exists with l2tp_ip_bind() and l2tp_ip_bind_table. Fixes: c51ce49735c1 ("l2tp: fix oops in L2TP IP sockets for connect() AF_UNSPEC case") Reported-by: Baozeng Ding <sploving1@gmail.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Baozeng Ding <sploving1@gmail.com> Signed-off-by: Guillaume Nault <g.nault@alphalink.fr> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit 32c231164b762dddefa13af5a0101032c70b50ef) Signed-off-by: Bernie Thompson <bhthompson@google.com> BUG=b:35995865 TEST=None Change-Id: I3a4fc7440f2e7ac54c781fa2394b7528f64a2b71 Reviewed-on: https://chromium-review.googlesource.com/450599 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Guenter Roeck <groeck@chromium.org> " fail_count="0" gerrit_number="450599" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="1" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/99/450599/1" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.18" change_id="I5b581ead205ddabb406d1f888e833177d3320bc5" commit="ff59e66c16044268f8ba8fa7aa6869b6b26c60c1" commit_message="UPSTREAM: mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] This fixes CVE-2016-8650. If mpi_powm() is given a zero exponent, it wants to immediately return either 1 or 0, depending on the modulus. However, if the result was initalised with zero limb space, no limbs space is allocated and a NULL-pointer exception ensues. Fix this by allocating a minimal amount of limb space for the result when the 0-exponent case when the result is 1 and not touching the limb space when the result is 0. This affects the use of RSA keys and X.509 certificates that carry them. BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6 PGD 0 Oops: 0002 [#1] SMP Modules linked in: CPU: 3 PID: 3014 Comm: keyctl Not tainted 4.9.0-rc6-fscache+ #278 Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014 task: ffff8804011944c0 task.stack: ffff880401294000 RIP: 0010:[<ffffffff8138ce5d>] [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6 RSP: 0018:ffff880401297ad8 EFLAGS: 00010212 RAX: 0000000000000000 RBX: ffff88040868bec0 RCX: ffff88040868bba0 RDX: ffff88040868b260 RSI: ffff88040868bec0 RDI: ffff88040868bee0 RBP: ffff880401297ba8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000047 R11: ffffffff8183b210 R12: 0000000000000000 R13: ffff8804087c7600 R14: 000000000000001f R15: ffff880401297c50 FS: 00007f7a7918c700(0000) GS:ffff88041fb80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000401250000 CR4: 00000000001406e0 Stack: ffff88040868bec0 0000000000000020 ffff880401297b00 ffffffff81376cd4 0000000000000100 ffff880401297b10 ffffffff81376d12 ffff880401297b30 ffffffff81376f37 0000000000000100 0000000000000000 ffff880401297ba8 Call Trace: [<ffffffff81376cd4>] ? __sg_page_iter_next+0x43/0x66 [<ffffffff81376d12>] ? sg_miter_get_next_page+0x1b/0x5d [<ffffffff81376f37>] ? sg_miter_next+0x17/0xbd [<ffffffff8138ba3a>] ? mpi_read_raw_from_sgl+0xf2/0x146 [<ffffffff8132a95c>] rsa_verify+0x9d/0xee [<ffffffff8132acca>] ? pkcs1pad_sg_set_buf+0x2e/0xbb [<ffffffff8132af40>] pkcs1pad_verify+0xc0/0xe1 [<ffffffff8133cb5e>] public_key_verify_signature+0x1b0/0x228 [<ffffffff8133d974>] x509_check_for_self_signed+0xa1/0xc4 [<ffffffff8133cdde>] x509_cert_parse+0x167/0x1a1 [<ffffffff8133d609>] x509_key_preparse+0x21/0x1a1 [<ffffffff8133c3d7>] asymmetric_key_preparse+0x34/0x61 [<ffffffff812fc9f3>] key_create_or_update+0x145/0x399 [<ffffffff812fe227>] SyS_add_key+0x154/0x19e [<ffffffff81001c2b>] do_syscall_64+0x80/0x191 [<ffffffff816825e4>] entry_SYSCALL64_slow_path+0x25/0x25 Code: 56 41 55 41 54 53 48 81 ec a8 00 00 00 44 8b 71 04 8b 42 04 4c 8b 67 18 45 85 f6 89 45 80 0f 84 b4 06 00 00 85 c0 75 2f 41 ff ce <49> c7 04 24 01 00 00 00 b0 01 75 0b 48 8b 41 18 48 83 38 01 0f RIP [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6 RSP <ffff880401297ad8> CR2: 0000000000000000 ---[ end trace d82015255d4a5d8d ]--- Basically, this is a backport of a libgcrypt patch: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=patch;h=6e1adb05d290aeeb1c230c763970695f4a538526 Fixes: cdec9cb5167a ("crypto: GnuPG based MPI lib - source files (part 1)") Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com> Signed-off-by: David Howells <dhowells@redhat.com> cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com> cc: linux-ima-devel@lists.sourceforge.net cc: stable@vger.kernel.org Signed-off-by: James Morris <james.l.morris@oracle.com> BUG=b:35995865 TEST=None Change-Id: I5b581ead205ddabb406d1f888e833177d3320bc5 Signed-off-by: Bernie Thompson <bhthompson@google.com> Reviewed-on: https://chromium-review.googlesource.com/450600 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Guenter Roeck <groeck@chromium.org> " fail_count="0" gerrit_number="450600" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="1" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/00/450600/1" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-2016.05" change_id="I48ab543143d3de9be46608fc12d78e09decf8d79" commit="f8ce8b0f9a464573e6251b77b15494ecf6430eb7" commit_message="Gru: change the sd power sequency In the safety considerations, we should make sure the slot of SD is enabled first, since we want to the power switch of corresponding is powered up. The different boards have the different power switch for sdmmc. Some power switch IC need turn on delay for long time. let's move the slot power of SD to romstage and avoid explicit delays or per-board. BRANCH=none BUG=b:35813418, b:35573103 TEST=check the signal for children of gru, and boot up from sd card. Change-Id: I48ab543143d3de9be46608fc12d78e09decf8d79 Signed-off-by: Caesar Wang <wxt@rock-chips.com> Reviewed-on: https://chromium-review.googlesource.com/447076 Reviewed-by: Julius Werner <jwerner@chromium.org> " fail_count="0" gerrit_number="447076" owner_email="wxt@rock-chips.com" pass_count="0" patch_number="6" project="chromiumos/third_party/coreboot" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/coreboot" ref="refs/changes/76/447076/6" remote="cros" total_fail_count="0"/><pending_commit branch="master" change_id="I81db2a4f5995b5ad53e1279920ca80ad9fd77512" commit="d9374ac3f4f32fb976b6b1aa2bd607d78586ac00" commit_message="Register TriageRelevantChanges instance in build_status.SlaveStatus. Register TriageRelevantChanges instance in SlaveStatus. Check TriageRelevantChanges.ShouldWait in SlaveStatus.ShouldWait. BUG=chromium:677178 TEST=unit_tests Change-Id: I81db2a4f5995b5ad53e1279920ca80ad9fd77512 Reviewed-on: https://chromium-review.googlesource.com/444849 Commit-Ready: Ningning Xia <nxia@chromium.org> Tested-by: Ningning Xia <nxia@chromium.org> Reviewed-by: Aviv Keshet <akeshet@chromium.org> " fail_count="1" gerrit_number="444849" owner_email="nxia@chromium.org" pass_count="0" patch_number="5" project="chromiumos/chromite" project_url="https://chromium-review.googlesource.com/chromiumos/chromite" ref="refs/changes/49/444849/5" remote="cros" total_fail_count="1"/><pending_commit branch="master" change_id="I2233a3e13dea7edd750753c1c33fedfbf309ae2c" commit="52188cfb2fdff0c58eb4ec7757a6c73c2962ea43" commit_message="[autotest] improve the testing push error message Include the log file path and link to the debug page in the email sent to deputy BUG=chromium:698299 TEST=unittest Change-Id: I2233a3e13dea7edd750753c1c33fedfbf309ae2c Reviewed-on: https://chromium-review.googlesource.com/446031 Commit-Ready: Shuqian Zhao <shuqianz@chromium.org> Tested-by: Shuqian Zhao <shuqianz@chromium.org> Reviewed-by: Richard Barnette <jrbarnette@google.com> " fail_count="6" gerrit_number="446031" owner_email="shuqianz@chromium.org" pass_count="0" patch_number="2" project="chromiumos/third_party/autotest" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/autotest" ref="refs/changes/31/446031/2" remote="cros" total_fail_count="6"/><pending_commit branch="master" change_id="I6d2d6d2f969ed2ad61fa7008b8b8e41093418f37" commit="35a46fa9a4ceed2e2eae83e663522a5c8e9ebb11" commit_message="Update TTS Engine extension to use an event page. This CL updates the TTS Engine extension to: 1. Use an event page, allowing ChromeOS to tear it down when it is not actively in-use. Chrome will also avoid loading the extension at startup, until it is actually used, which allows the TTS controller to query the extension's manifest for the set of supported voices without causing the event page to be loaded. Chrome will only (re-)load the extension to dispatch onSpeak, or system-upgrade, events to it. 2. Tear down the Native Client subcomponent when idle, rather than just disconnecting the audio output stream. Active NaCl plugins cause the event page to stay in-use, effectively creating a reference-cycle and preventing Chrome tearing them down when idle. This can save as much as 70MB of memory usage in long-running sessions, and helps avoid the TTS components running for users who aren't actually using TTS. BUG=chromium:616636 TEST=Open Task Manager. Load a web-site which queries TTS capabilities, e.g. https://www.guardian.co.uk. Observe that TTS extension does not load, or loads but then unloads again within a minute or so. Change-Id: I6d2d6d2f969ed2ad61fa7008b8b8e41093418f37 Reviewed-on: https://chromium-review.googlesource.com/447000 Commit-Ready: James Weatherall <wez@chromium.org> Tested-by: Dominic Mazzoni <dmazzoni@chromium.org> Reviewed-by: David Tseng <dtseng@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org> " fail_count="1" gerrit_number="447000" owner_email="wez@chromium.org" pass_count="0" patch_number="4" project="chromiumos/platform/assets" project_url="https://chromium-review.googlesource.com/chromiumos/platform/assets" ref="refs/changes/00/447000/4" remote="cros" total_fail_count="1"/><pending_commit branch="master" change_id="Ia375ea2e920d6b4ade7d2d735798b237221c1aa2" commit="2ba20850f29c6f637d796643a42ddb49bbbd05f8" commit_message="bootstrap: bootstrap -> cbuildbot_launch. Bootstrap is a heavily overloaded term, and I wanted to pick something better before this goes into production and becomes locked down. This script runs at TOT, and lauches cbuildbot to perform a build an a branch (or not) in a safe way. BUG=chromium:684887 TEST=run_tests Change-Id: Ia375ea2e920d6b4ade7d2d735798b237221c1aa2 Reviewed-on: https://chromium-review.googlesource.com/449026 Commit-Ready: Don Garrett <dgarrett@chromium.org> Tested-by: Don Garrett <dgarrett@chromium.org> Reviewed-by: Autumn Quinn <autumn@chromium.org> Reviewed-by: Don Garrett <dgarrett@chromium.org> " fail_count="1" gerrit_number="449026" owner_email="dgarrett@chromium.org" pass_count="0" patch_number="1" project="chromiumos/chromite" project_url="https://chromium-review.googlesource.com/chromiumos/chromite" ref="refs/changes/26/449026/1" remote="cros" total_fail_count="1"/><pending_commit branch="master" change_id="I4a9d3a765f6de84ac1a6f3e903171a505bc37d6c" commit="d63428005e6edc2d121c7782843775851bf918fa" commit_message="pyro: Name USB port numbers appropriately Some USB PD port numbers are not named. Some numbers are named using I2C port names. This patch fixes them Follow reef setting. BUG=none BRANCH=reef TEST=make buildall Change-Id: I4a9d3a765f6de84ac1a6f3e903171a505bc37d6c Signed-off-by: Bruce.Wan <Bruce.Wan@quantatw.com> Reviewed-on: https://chromium-review.googlesource.com/449123 Commit-Ready: Keith Tzeng <keith.tzeng@quantatw.com> Tested-by: Keith Tzeng <keith.tzeng@quantatw.com> Reviewed-by: Aaron Durbin <adurbin@chromium.org> " fail_count="0" gerrit_number="449123" owner_email="Bruce.Wan@quantatw.com" pass_count="0" patch_number="2" project="chromiumos/platform/ec" project_url="https://chromium-review.googlesource.com/chromiumos/platform/ec" ref="refs/changes/23/449123/2" remote="cros" total_fail_count="0"/><pending_commit branch="master" change_id="Idd01a0ccc632d4477614490b4efb212b633a293a" commit="cf65b9fb57b3add851446ddc077ed117f7da77f0" commit_message="Dumpstate when the Android container failed to boot. BUG=b:34858945 TEST=Test manually with _WAIT_FOR_ANDROID_BOOT_SECONDS = 5 Change-Id: Idd01a0ccc632d4477614490b4efb212b633a293a Reviewed-on: https://chromium-review.googlesource.com/449553 Commit-Ready: Kazuhiro Inaba <kinaba@chromium.org> Tested-by: Kazuhiro Inaba <kinaba@chromium.org> Reviewed-by: Luis Hector Chavez <lhchavez@chromium.org> Reviewed-by: Kazuhiro Inaba <kinaba@chromium.org> " fail_count="0" gerrit_number="449553" owner_email="hirono@chromium.org" pass_count="0" patch_number="1" project="chromiumos/third_party/autotest" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/autotest" ref="refs/changes/53/449553/1" remote="cros" total_fail_count="0"/><pending_commit branch="master" change_id="If5964ba7416ebfdf235acb5bdaf7d911331b85ef" commit="88fb8b261eb2d4d19ba791e2a6f346cafe08045c" commit_message="pyro: Set RW boot power threshold to 18w Follow reef setting. BUG=none BRANCH=reef TEST=make buildall Change-Id: If5964ba7416ebfdf235acb5bdaf7d911331b85ef Signed-off-by: Bruce.Wan <Bruce.Wan@quantatw.com> Reviewed-on: https://chromium-review.googlesource.com/449560 Commit-Ready: Keith Tzeng <keith.tzeng@quantatw.com> Tested-by: Keith Tzeng <keith.tzeng@quantatw.com> Reviewed-by: Aaron Durbin <adurbin@chromium.org> " fail_count="0" gerrit_number="449560" owner_email="Bruce.Wan@quantatw.com" pass_count="0" patch_number="1" project="chromiumos/platform/ec" project_url="https://chromium-review.googlesource.com/chromiumos/platform/ec" ref="refs/changes/60/449560/1" remote="cros" total_fail_count="0"/><pending_commit branch="master" change_id="I707a59f458cac4f15b7b9e2f9bf37f684f9dbb0d" commit="984330627766d6111550e41215a082d2d5fcb019" commit_message="Adds the default setting for cloud_notification_topic. The default setting is pointing to the staging topic for testing. We will point it to production topic when the feature is released. BUG=chromium:680198 TEST=Manually. Change-Id: I707a59f458cac4f15b7b9e2f9bf37f684f9dbb0d Reviewed-on: https://chromium-review.googlesource.com/450030 Commit-Ready: Michael Tang <ntang@chromium.org> Tested-by: Michael Tang <ntang@chromium.org> Reviewed-by: Jinsong Mu <jinsong@google.com> " fail_count="1" gerrit_number="450030" owner_email="ntang@chromium.org" pass_count="0" patch_number="1" project="chromiumos/third_party/autotest" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/autotest" ref="refs/changes/30/450030/1" remote="cros" total_fail_count="1"/><pending_commit branch="chromeos-5.41" change_id="I09efb50a85e6014ebdd12ae5608d8725f1f20fd2" commit="edcbe3e2fea3b911e8367a9cf95682db76e5cbdb" commit_message="bluez: Load BT board data based on country code BT board data file PS_ASIC-<country-code>.pst is loaded based on country code. If not exist, default BT board data file PS_ASIC.pst would be loaded. This patch is released from QCA. BUG=b:35587372 TEST=Verified right board data loaded with country code us, ca and gb. Change-Id: I09efb50a85e6014ebdd12ae5608d8725f1f20fd2 Reviewed-on: https://chromium-review.googlesource.com/450398 Commit-Ready: Yixiang Li <yixiang@google.com> Tested-by: Yixiang Li <yixiang@google.com> Reviewed-by: Kan Yan <kyan@google.com> " fail_count="0" gerrit_number="450398" owner_email="yixiang@google.com" pass_count="0" patch_number="3" project="chromiumos/third_party/bluez" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/bluez" ref="refs/changes/98/450398/3" remote="cros" total_fail_count="0"/><pending_commit branch="master" change_id="Ifc464be5e161bebe61513cf204131f8bab49677b" commit="b3aec1ee90acb9dcddc54e8234004c077293f9ee" commit_message="touchpad-cmt: match only PID=5028 for Google's Centroiding Touchpad Match only PID=5028 for the Centroiding touchpad to prevent affecting other trackpads. BUG=b/35775010 TEST=`emerge-eve chromeos-base/gestures-conf` and check that the file has correct content. Change-Id: Ifc464be5e161bebe61513cf204131f8bab49677b Reviewed-on: https://chromium-review.googlesource.com/450417 Commit-Ready: Wei-Ning Huang <wnhuang@chromium.org> Tested-by: Wei-Ning Huang <wnhuang@chromium.org> Reviewed-by: Nicolas Boichat <drinkcat@chromium.org> " fail_count="0" gerrit_number="450417" owner_email="wnhuang@chromium.org" pass_count="0" patch_number="2" project="chromiumos/platform/xorg-conf" project_url="https://chromium-review.googlesource.com/chromiumos/platform/xorg-conf" ref="refs/changes/17/450417/2" remote="cros" total_fail_count="2"/><pending_commit branch="chromeos-3.14" change_id="I3a4fc7440f2e7ac54c781fa2394b7528f64a2b71" commit="75aac749b9b67cb07d83d213d7bbb0952ff79881" commit_message="UPSTREAM: l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind() Lock socket before checking the SOCK_ZAPPED flag in l2tp_ip6_bind(). Without lock, a concurrent call could modify the socket flags between the sock_flag(sk, SOCK_ZAPPED) test and the lock_sock() call. This way, a socket could be inserted twice in l2tp_ip6_bind_table. Releasing it would then leave a stale pointer there, generating use-after-free errors when walking through the list or modifying adjacent entries. BUG: KASAN: use-after-free in l2tp_ip6_close+0x22e/0x290 at addr ffff8800081b0ed8 Write of size 8 by task syz-executor/10987 CPU: 0 PID: 10987 Comm: syz-executor Not tainted 4.8.0+ #39 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014 ffff880031d97838 ffffffff829f835b ffff88001b5a1640 ffff8800081b0ec0 ffff8800081b15a0 ffff8800081b6d20 ffff880031d97860 ffffffff8174d3cc ffff880031d978f0 ffff8800081b0e80 ffff88001b5a1640 ffff880031d978e0 Call Trace: [<ffffffff829f835b>] dump_stack+0xb3/0x118 lib/dump_stack.c:15 [<ffffffff8174d3cc>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:156 [< inline >] print_address_description mm/kasan/report.c:194 [<ffffffff8174d666>] kasan_report_error+0x1f6/0x4d0 mm/kasan/report.c:283 [< inline >] kasan_report mm/kasan/report.c:303 [<ffffffff8174db7e>] __asan_report_store8_noabort+0x3e/0x40 mm/kasan/report.c:329 [< inline >] __write_once_size ./include/linux/compiler.h:249 [< inline >] __hlist_del ./include/linux/list.h:622 [< inline >] hlist_del_init ./include/linux/list.h:637 [<ffffffff8579047e>] l2tp_ip6_close+0x22e/0x290 net/l2tp/l2tp_ip6.c:239 [<ffffffff850b2dfd>] inet_release+0xed/0x1c0 net/ipv4/af_inet.c:415 [<ffffffff851dc5a0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:422 [<ffffffff84c4581d>] sock_release+0x8d/0x1d0 net/socket.c:570 [<ffffffff84c45976>] sock_close+0x16/0x20 net/socket.c:1017 [<ffffffff817a108c>] __fput+0x28c/0x780 fs/file_table.c:208 [<ffffffff817a1605>] ____fput+0x15/0x20 fs/file_table.c:244 [<ffffffff813774f9>] task_work_run+0xf9/0x170 [<ffffffff81324aae>] do_exit+0x85e/0x2a00 [<ffffffff81326dc8>] do_group_exit+0x108/0x330 [<ffffffff81348cf7>] get_signal+0x617/0x17a0 kernel/signal.c:2307 [<ffffffff811b49af>] do_signal+0x7f/0x18f0 [<ffffffff810039bf>] exit_to_usermode_loop+0xbf/0x150 arch/x86/entry/common.c:156 [< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:190 [<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0 arch/x86/entry/common.c:259 [<ffffffff85e4d726>] entry_SYSCALL_64_fastpath+0xc4/0xc6 Object at ffff8800081b0ec0, in cache L2TP/IPv6 size: 1448 Allocated: PID = 10987 [ 1116.897025] [<ffffffff811ddcb6>] save_stack_trace+0x16/0x20 [ 1116.897025] [<ffffffff8174c736>] save_stack+0x46/0xd0 [ 1116.897025] [<ffffffff8174c9ad>] kasan_kmalloc+0xad/0xe0 [ 1116.897025] [<ffffffff8174cee2>] kasan_slab_alloc+0x12/0x20 [ 1116.897025] [< inline >] slab_post_alloc_hook mm/slab.h:417 [ 1116.897025] [< inline >] slab_alloc_node mm/slub.c:2708 [ 1116.897025] [< inline >] slab_alloc mm/slub.c:2716 [ 1116.897025] [<ffffffff817476a8>] kmem_cache_alloc+0xc8/0x2b0 mm/slub.c:2721 [ 1116.897025] [<ffffffff84c4f6a9>] sk_prot_alloc+0x69/0x2b0 net/core/sock.c:1326 [ 1116.897025] [<ffffffff84c58ac8>] sk_alloc+0x38/0xae0 net/core/sock.c:1388 [ 1116.897025] [<ffffffff851ddf67>] inet6_create+0x2d7/0x1000 net/ipv6/af_inet6.c:182 [ 1116.897025] [<ffffffff84c4af7b>] __sock_create+0x37b/0x640 net/socket.c:1153 [ 1116.897025] [< inline >] sock_create net/socket.c:1193 [ 1116.897025] [< inline >] SYSC_socket net/socket.c:1223 [ 1116.897025] [<ffffffff84c4b46f>] SyS_socket+0xef/0x1b0 net/socket.c:1203 [ 1116.897025] [<ffffffff85e4d685>] entry_SYSCALL_64_fastpath+0x23/0xc6 Freed: PID = 10987 [ 1116.897025] [<ffffffff811ddcb6>] save_stack_trace+0x16/0x20 [ 1116.897025] [<ffffffff8174c736>] save_stack+0x46/0xd0 [ 1116.897025] [<ffffffff8174cf61>] kasan_slab_free+0x71/0xb0 [ 1116.897025] [< inline >] slab_free_hook mm/slub.c:1352 [ 1116.897025] [< inline >] slab_free_freelist_hook mm/slub.c:1374 [ 1116.897025] [< inline >] slab_free mm/slub.c:2951 [ 1116.897025] [<ffffffff81748b28>] kmem_cache_free+0xc8/0x330 mm/slub.c:2973 [ 1116.897025] [< inline >] sk_prot_free net/core/sock.c:1369 [ 1116.897025] [<ffffffff84c541eb>] __sk_destruct+0x32b/0x4f0 net/core/sock.c:1444 [ 1116.897025] [<ffffffff84c5aca4>] sk_destruct+0x44/0x80 net/core/sock.c:1452 [ 1116.897025] [<ffffffff84c5ad33>] __sk_free+0x53/0x220 net/core/sock.c:1460 [ 1116.897025] [<ffffffff84c5af23>] sk_free+0x23/0x30 net/core/sock.c:1471 [ 1116.897025] [<ffffffff84c5cb6c>] sk_common_release+0x28c/0x3e0 ./include/net/sock.h:1589 [ 1116.897025] [<ffffffff8579044e>] l2tp_ip6_close+0x1fe/0x290 net/l2tp/l2tp_ip6.c:243 [ 1116.897025] [<ffffffff850b2dfd>] inet_release+0xed/0x1c0 net/ipv4/af_inet.c:415 [ 1116.897025] [<ffffffff851dc5a0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:422 [ 1116.897025] [<ffffffff84c4581d>] sock_release+0x8d/0x1d0 net/socket.c:570 [ 1116.897025] [<ffffffff84c45976>] sock_close+0x16/0x20 net/socket.c:1017 [ 1116.897025] [<ffffffff817a108c>] __fput+0x28c/0x780 fs/file_table.c:208 [ 1116.897025] [<ffffffff817a1605>] ____fput+0x15/0x20 fs/file_table.c:244 [ 1116.897025] [<ffffffff813774f9>] task_work_run+0xf9/0x170 [ 1116.897025] [<ffffffff81324aae>] do_exit+0x85e/0x2a00 [ 1116.897025] [<ffffffff81326dc8>] do_group_exit+0x108/0x330 [ 1116.897025] [<ffffffff81348cf7>] get_signal+0x617/0x17a0 kernel/signal.c:2307 [ 1116.897025] [<ffffffff811b49af>] do_signal+0x7f/0x18f0 [ 1116.897025] [<ffffffff810039bf>] exit_to_usermode_loop+0xbf/0x150 arch/x86/entry/common.c:156 [ 1116.897025] [< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:190 [ 1116.897025] [<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0 arch/x86/entry/common.c:259 [ 1116.897025] [<ffffffff85e4d726>] entry_SYSCALL_64_fastpath+0xc4/0xc6 Memory state around the buggy address: ffff8800081b0d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8800081b0e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8800081b0e80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ^ ffff8800081b0f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8800081b0f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== The same issue exists with l2tp_ip_bind() and l2tp_ip_bind_table. Fixes: c51ce49735c1 ("l2tp: fix oops in L2TP IP sockets for connect() AF_UNSPEC case") Reported-by: Baozeng Ding <sploving1@gmail.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Baozeng Ding <sploving1@gmail.com> Signed-off-by: Guillaume Nault <g.nault@alphalink.fr> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit 32c231164b762dddefa13af5a0101032c70b50ef) Signed-off-by: Bernie Thompson <bhthompson@google.com> BUG=b:35995865 TEST=None Change-Id: I3a4fc7440f2e7ac54c781fa2394b7528f64a2b71 Reviewed-on: https://chromium-review.googlesource.com/450698 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Guenter Roeck <groeck@chromium.org> " fail_count="0" gerrit_number="450698" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="1" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/98/450698/1" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.14" change_id="I5b581ead205ddabb406d1f888e833177d3320bc5" commit="0fdee430bd8d05aa57a4ee4205b2aa4ada45b436" commit_message="UPSTREAM: mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] This fixes CVE-2016-8650. If mpi_powm() is given a zero exponent, it wants to immediately return either 1 or 0, depending on the modulus. However, if the result was initalised with zero limb space, no limbs space is allocated and a NULL-pointer exception ensues. Fix this by allocating a minimal amount of limb space for the result when the 0-exponent case when the result is 1 and not touching the limb space when the result is 0. This affects the use of RSA keys and X.509 certificates that carry them. BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6 PGD 0 Oops: 0002 [#1] SMP Modules linked in: CPU: 3 PID: 3014 Comm: keyctl Not tainted 4.9.0-rc6-fscache+ #278 Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014 task: ffff8804011944c0 task.stack: ffff880401294000 RIP: 0010:[<ffffffff8138ce5d>] [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6 RSP: 0018:ffff880401297ad8 EFLAGS: 00010212 RAX: 0000000000000000 RBX: ffff88040868bec0 RCX: ffff88040868bba0 RDX: ffff88040868b260 RSI: ffff88040868bec0 RDI: ffff88040868bee0 RBP: ffff880401297ba8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000047 R11: ffffffff8183b210 R12: 0000000000000000 R13: ffff8804087c7600 R14: 000000000000001f R15: ffff880401297c50 FS: 00007f7a7918c700(0000) GS:ffff88041fb80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000401250000 CR4: 00000000001406e0 Stack: ffff88040868bec0 0000000000000020 ffff880401297b00 ffffffff81376cd4 0000000000000100 ffff880401297b10 ffffffff81376d12 ffff880401297b30 ffffffff81376f37 0000000000000100 0000000000000000 ffff880401297ba8 Call Trace: [<ffffffff81376cd4>] ? __sg_page_iter_next+0x43/0x66 [<ffffffff81376d12>] ? sg_miter_get_next_page+0x1b/0x5d [<ffffffff81376f37>] ? sg_miter_next+0x17/0xbd [<ffffffff8138ba3a>] ? mpi_read_raw_from_sgl+0xf2/0x146 [<ffffffff8132a95c>] rsa_verify+0x9d/0xee [<ffffffff8132acca>] ? pkcs1pad_sg_set_buf+0x2e/0xbb [<ffffffff8132af40>] pkcs1pad_verify+0xc0/0xe1 [<ffffffff8133cb5e>] public_key_verify_signature+0x1b0/0x228 [<ffffffff8133d974>] x509_check_for_self_signed+0xa1/0xc4 [<ffffffff8133cdde>] x509_cert_parse+0x167/0x1a1 [<ffffffff8133d609>] x509_key_preparse+0x21/0x1a1 [<ffffffff8133c3d7>] asymmetric_key_preparse+0x34/0x61 [<ffffffff812fc9f3>] key_create_or_update+0x145/0x399 [<ffffffff812fe227>] SyS_add_key+0x154/0x19e [<ffffffff81001c2b>] do_syscall_64+0x80/0x191 [<ffffffff816825e4>] entry_SYSCALL64_slow_path+0x25/0x25 Code: 56 41 55 41 54 53 48 81 ec a8 00 00 00 44 8b 71 04 8b 42 04 4c 8b 67 18 45 85 f6 89 45 80 0f 84 b4 06 00 00 85 c0 75 2f 41 ff ce <49> c7 04 24 01 00 00 00 b0 01 75 0b 48 8b 41 18 48 83 38 01 0f RIP [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6 RSP <ffff880401297ad8> CR2: 0000000000000000 ---[ end trace d82015255d4a5d8d ]--- Basically, this is a backport of a libgcrypt patch: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=patch;h=6e1adb05d290aeeb1c230c763970695f4a538526 Fixes: cdec9cb5167a ("crypto: GnuPG based MPI lib - source files (part 1)") Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com> Signed-off-by: David Howells <dhowells@redhat.com> cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com> cc: linux-ima-devel@lists.sourceforge.net cc: stable@vger.kernel.org Signed-off-by: James Morris <james.l.morris@oracle.com> BUG=b:35995865 TEST=None Change-Id: I5b581ead205ddabb406d1f888e833177d3320bc5 Signed-off-by: Bernie Thompson <bhthompson@google.com> Reviewed-on: https://chromium-review.googlesource.com/450699 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Guenter Roeck <groeck@chromium.org> " fail_count="0" gerrit_number="450699" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="1" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/99/450699/1" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.10" change_id="I3a4fc7440f2e7ac54c781fa2394b7528f64a2b71" commit="d3afda231e425ab9492ad7f2e431c6cb4b2b6625" commit_message="UPSTREAM: l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind() Lock socket before checking the SOCK_ZAPPED flag in l2tp_ip6_bind(). Without lock, a concurrent call could modify the socket flags between the sock_flag(sk, SOCK_ZAPPED) test and the lock_sock() call. This way, a socket could be inserted twice in l2tp_ip6_bind_table. Releasing it would then leave a stale pointer there, generating use-after-free errors when walking through the list or modifying adjacent entries. BUG: KASAN: use-after-free in l2tp_ip6_close+0x22e/0x290 at addr ffff8800081b0ed8 Write of size 8 by task syz-executor/10987 CPU: 0 PID: 10987 Comm: syz-executor Not tainted 4.8.0+ #39 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014 ffff880031d97838 ffffffff829f835b ffff88001b5a1640 ffff8800081b0ec0 ffff8800081b15a0 ffff8800081b6d20 ffff880031d97860 ffffffff8174d3cc ffff880031d978f0 ffff8800081b0e80 ffff88001b5a1640 ffff880031d978e0 Call Trace: [<ffffffff829f835b>] dump_stack+0xb3/0x118 lib/dump_stack.c:15 [<ffffffff8174d3cc>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:156 [< inline >] print_address_description mm/kasan/report.c:194 [<ffffffff8174d666>] kasan_report_error+0x1f6/0x4d0 mm/kasan/report.c:283 [< inline >] kasan_report mm/kasan/report.c:303 [<ffffffff8174db7e>] __asan_report_store8_noabort+0x3e/0x40 mm/kasan/report.c:329 [< inline >] __write_once_size ./include/linux/compiler.h:249 [< inline >] __hlist_del ./include/linux/list.h:622 [< inline >] hlist_del_init ./include/linux/list.h:637 [<ffffffff8579047e>] l2tp_ip6_close+0x22e/0x290 net/l2tp/l2tp_ip6.c:239 [<ffffffff850b2dfd>] inet_release+0xed/0x1c0 net/ipv4/af_inet.c:415 [<ffffffff851dc5a0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:422 [<ffffffff84c4581d>] sock_release+0x8d/0x1d0 net/socket.c:570 [<ffffffff84c45976>] sock_close+0x16/0x20 net/socket.c:1017 [<ffffffff817a108c>] __fput+0x28c/0x780 fs/file_table.c:208 [<ffffffff817a1605>] ____fput+0x15/0x20 fs/file_table.c:244 [<ffffffff813774f9>] task_work_run+0xf9/0x170 [<ffffffff81324aae>] do_exit+0x85e/0x2a00 [<ffffffff81326dc8>] do_group_exit+0x108/0x330 [<ffffffff81348cf7>] get_signal+0x617/0x17a0 kernel/signal.c:2307 [<ffffffff811b49af>] do_signal+0x7f/0x18f0 [<ffffffff810039bf>] exit_to_usermode_loop+0xbf/0x150 arch/x86/entry/common.c:156 [< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:190 [<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0 arch/x86/entry/common.c:259 [<ffffffff85e4d726>] entry_SYSCALL_64_fastpath+0xc4/0xc6 Object at ffff8800081b0ec0, in cache L2TP/IPv6 size: 1448 Allocated: PID = 10987 [ 1116.897025] [<ffffffff811ddcb6>] save_stack_trace+0x16/0x20 [ 1116.897025] [<ffffffff8174c736>] save_stack+0x46/0xd0 [ 1116.897025] [<ffffffff8174c9ad>] kasan_kmalloc+0xad/0xe0 [ 1116.897025] [<ffffffff8174cee2>] kasan_slab_alloc+0x12/0x20 [ 1116.897025] [< inline >] slab_post_alloc_hook mm/slab.h:417 [ 1116.897025] [< inline >] slab_alloc_node mm/slub.c:2708 [ 1116.897025] [< inline >] slab_alloc mm/slub.c:2716 [ 1116.897025] [<ffffffff817476a8>] kmem_cache_alloc+0xc8/0x2b0 mm/slub.c:2721 [ 1116.897025] [<ffffffff84c4f6a9>] sk_prot_alloc+0x69/0x2b0 net/core/sock.c:1326 [ 1116.897025] [<ffffffff84c58ac8>] sk_alloc+0x38/0xae0 net/core/sock.c:1388 [ 1116.897025] [<ffffffff851ddf67>] inet6_create+0x2d7/0x1000 net/ipv6/af_inet6.c:182 [ 1116.897025] [<ffffffff84c4af7b>] __sock_create+0x37b/0x640 net/socket.c:1153 [ 1116.897025] [< inline >] sock_create net/socket.c:1193 [ 1116.897025] [< inline >] SYSC_socket net/socket.c:1223 [ 1116.897025] [<ffffffff84c4b46f>] SyS_socket+0xef/0x1b0 net/socket.c:1203 [ 1116.897025] [<ffffffff85e4d685>] entry_SYSCALL_64_fastpath+0x23/0xc6 Freed: PID = 10987 [ 1116.897025] [<ffffffff811ddcb6>] save_stack_trace+0x16/0x20 [ 1116.897025] [<ffffffff8174c736>] save_stack+0x46/0xd0 [ 1116.897025] [<ffffffff8174cf61>] kasan_slab_free+0x71/0xb0 [ 1116.897025] [< inline >] slab_free_hook mm/slub.c:1352 [ 1116.897025] [< inline >] slab_free_freelist_hook mm/slub.c:1374 [ 1116.897025] [< inline >] slab_free mm/slub.c:2951 [ 1116.897025] [<ffffffff81748b28>] kmem_cache_free+0xc8/0x330 mm/slub.c:2973 [ 1116.897025] [< inline >] sk_prot_free net/core/sock.c:1369 [ 1116.897025] [<ffffffff84c541eb>] __sk_destruct+0x32b/0x4f0 net/core/sock.c:1444 [ 1116.897025] [<ffffffff84c5aca4>] sk_destruct+0x44/0x80 net/core/sock.c:1452 [ 1116.897025] [<ffffffff84c5ad33>] __sk_free+0x53/0x220 net/core/sock.c:1460 [ 1116.897025] [<ffffffff84c5af23>] sk_free+0x23/0x30 net/core/sock.c:1471 [ 1116.897025] [<ffffffff84c5cb6c>] sk_common_release+0x28c/0x3e0 ./include/net/sock.h:1589 [ 1116.897025] [<ffffffff8579044e>] l2tp_ip6_close+0x1fe/0x290 net/l2tp/l2tp_ip6.c:243 [ 1116.897025] [<ffffffff850b2dfd>] inet_release+0xed/0x1c0 net/ipv4/af_inet.c:415 [ 1116.897025] [<ffffffff851dc5a0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:422 [ 1116.897025] [<ffffffff84c4581d>] sock_release+0x8d/0x1d0 net/socket.c:570 [ 1116.897025] [<ffffffff84c45976>] sock_close+0x16/0x20 net/socket.c:1017 [ 1116.897025] [<ffffffff817a108c>] __fput+0x28c/0x780 fs/file_table.c:208 [ 1116.897025] [<ffffffff817a1605>] ____fput+0x15/0x20 fs/file_table.c:244 [ 1116.897025] [<ffffffff813774f9>] task_work_run+0xf9/0x170 [ 1116.897025] [<ffffffff81324aae>] do_exit+0x85e/0x2a00 [ 1116.897025] [<ffffffff81326dc8>] do_group_exit+0x108/0x330 [ 1116.897025] [<ffffffff81348cf7>] get_signal+0x617/0x17a0 kernel/signal.c:2307 [ 1116.897025] [<ffffffff811b49af>] do_signal+0x7f/0x18f0 [ 1116.897025] [<ffffffff810039bf>] exit_to_usermode_loop+0xbf/0x150 arch/x86/entry/common.c:156 [ 1116.897025] [< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:190 [ 1116.897025] [<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0 arch/x86/entry/common.c:259 [ 1116.897025] [<ffffffff85e4d726>] entry_SYSCALL_64_fastpath+0xc4/0xc6 Memory state around the buggy address: ffff8800081b0d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8800081b0e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8800081b0e80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ^ ffff8800081b0f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8800081b0f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== The same issue exists with l2tp_ip_bind() and l2tp_ip_bind_table. Fixes: c51ce49735c1 ("l2tp: fix oops in L2TP IP sockets for connect() AF_UNSPEC case") Reported-by: Baozeng Ding <sploving1@gmail.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Baozeng Ding <sploving1@gmail.com> Signed-off-by: Guillaume Nault <g.nault@alphalink.fr> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit 32c231164b762dddefa13af5a0101032c70b50ef) Signed-off-by: Bernie Thompson <bhthompson@google.com> BUG=b:35995865 TEST=None Change-Id: I3a4fc7440f2e7ac54c781fa2394b7528f64a2b71 Reviewed-on: https://chromium-review.googlesource.com/450700 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Guenter Roeck <groeck@chromium.org> " fail_count="0" gerrit_number="450700" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="1" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/00/450700/1" remote="cros" total_fail_count="0"/><pending_commit branch="master" change_id="I19a64aa473977b5f89c0b83371af88a808aa9a5b" commit="35c02d5e752b5f9b3f5e5ab4bfc31bc60914ed0b" commit_message="Add LoadComponent API in ImageLoader dbus adapter. This change is related to chrome cl 2731253003 and exposes the LoadComponent API. BUG=698767 TEST=NONE Change-Id: I19a64aa473977b5f89c0b83371af88a808aa9a5b Reviewed-on: https://chromium-review.googlesource.com/450502 Commit-Ready: Xiaochu Liu <xiaochu@chromium.org> Tested-by: Xiaochu Liu <xiaochu@chromium.org> Reviewed-by: Greg Kerr <kerrnel@chromium.org> Reviewed-by: Joshua Pawlicki <waffles@chromium.org> " fail_count="0" gerrit_number="450502" owner_email="xiaochu@chromium.org" pass_count="0" patch_number="3" project="chromiumos/platform/system_api" project_url="https://chromium-review.googlesource.com/chromiumos/platform/system_api" ref="refs/changes/02/450502/3" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.10" change_id="I5b581ead205ddabb406d1f888e833177d3320bc5" commit="9258cddb63f748d8382235a05d93456ed2adbfc7" commit_message="UPSTREAM: mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] This fixes CVE-2016-8650. If mpi_powm() is given a zero exponent, it wants to immediately return either 1 or 0, depending on the modulus. However, if the result was initalised with zero limb space, no limbs space is allocated and a NULL-pointer exception ensues. Fix this by allocating a minimal amount of limb space for the result when the 0-exponent case when the result is 1 and not touching the limb space when the result is 0. This affects the use of RSA keys and X.509 certificates that carry them. BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6 PGD 0 Oops: 0002 [#1] SMP Modules linked in: CPU: 3 PID: 3014 Comm: keyctl Not tainted 4.9.0-rc6-fscache+ #278 Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014 task: ffff8804011944c0 task.stack: ffff880401294000 RIP: 0010:[<ffffffff8138ce5d>] [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6 RSP: 0018:ffff880401297ad8 EFLAGS: 00010212 RAX: 0000000000000000 RBX: ffff88040868bec0 RCX: ffff88040868bba0 RDX: ffff88040868b260 RSI: ffff88040868bec0 RDI: ffff88040868bee0 RBP: ffff880401297ba8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000047 R11: ffffffff8183b210 R12: 0000000000000000 R13: ffff8804087c7600 R14: 000000000000001f R15: ffff880401297c50 FS: 00007f7a7918c700(0000) GS:ffff88041fb80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000401250000 CR4: 00000000001406e0 Stack: ffff88040868bec0 0000000000000020 ffff880401297b00 ffffffff81376cd4 0000000000000100 ffff880401297b10 ffffffff81376d12 ffff880401297b30 ffffffff81376f37 0000000000000100 0000000000000000 ffff880401297ba8 Call Trace: [<ffffffff81376cd4>] ? __sg_page_iter_next+0x43/0x66 [<ffffffff81376d12>] ? sg_miter_get_next_page+0x1b/0x5d [<ffffffff81376f37>] ? sg_miter_next+0x17/0xbd [<ffffffff8138ba3a>] ? mpi_read_raw_from_sgl+0xf2/0x146 [<ffffffff8132a95c>] rsa_verify+0x9d/0xee [<ffffffff8132acca>] ? pkcs1pad_sg_set_buf+0x2e/0xbb [<ffffffff8132af40>] pkcs1pad_verify+0xc0/0xe1 [<ffffffff8133cb5e>] public_key_verify_signature+0x1b0/0x228 [<ffffffff8133d974>] x509_check_for_self_signed+0xa1/0xc4 [<ffffffff8133cdde>] x509_cert_parse+0x167/0x1a1 [<ffffffff8133d609>] x509_key_preparse+0x21/0x1a1 [<ffffffff8133c3d7>] asymmetric_key_preparse+0x34/0x61 [<ffffffff812fc9f3>] key_create_or_update+0x145/0x399 [<ffffffff812fe227>] SyS_add_key+0x154/0x19e [<ffffffff81001c2b>] do_syscall_64+0x80/0x191 [<ffffffff816825e4>] entry_SYSCALL64_slow_path+0x25/0x25 Code: 56 41 55 41 54 53 48 81 ec a8 00 00 00 44 8b 71 04 8b 42 04 4c 8b 67 18 45 85 f6 89 45 80 0f 84 b4 06 00 00 85 c0 75 2f 41 ff ce <49> c7 04 24 01 00 00 00 b0 01 75 0b 48 8b 41 18 48 83 38 01 0f RIP [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6 RSP <ffff880401297ad8> CR2: 0000000000000000 ---[ end trace d82015255d4a5d8d ]--- Basically, this is a backport of a libgcrypt patch: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=patch;h=6e1adb05d290aeeb1c230c763970695f4a538526 Fixes: cdec9cb5167a ("crypto: GnuPG based MPI lib - source files (part 1)") Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com> Signed-off-by: David Howells <dhowells@redhat.com> cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com> cc: linux-ima-devel@lists.sourceforge.net cc: stable@vger.kernel.org Signed-off-by: James Morris <james.l.morris@oracle.com> BUG=b:35995865 TEST=None Change-Id: I5b581ead205ddabb406d1f888e833177d3320bc5 Signed-off-by: Bernie Thompson <bhthompson@google.com> Reviewed-on: https://chromium-review.googlesource.com/450701 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Guenter Roeck <groeck@chromium.org> " fail_count="0" gerrit_number="450701" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="1" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/01/450701/1" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.8" change_id="I3a4fc7440f2e7ac54c781fa2394b7528f64a2b71" commit="4070e9a5ba261115afd6cae76af57fcf900bc5c0" commit_message="UPSTREAM: l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind() Lock socket before checking the SOCK_ZAPPED flag in l2tp_ip6_bind(). Without lock, a concurrent call could modify the socket flags between the sock_flag(sk, SOCK_ZAPPED) test and the lock_sock() call. This way, a socket could be inserted twice in l2tp_ip6_bind_table. Releasing it would then leave a stale pointer there, generating use-after-free errors when walking through the list or modifying adjacent entries. BUG: KASAN: use-after-free in l2tp_ip6_close+0x22e/0x290 at addr ffff8800081b0ed8 Write of size 8 by task syz-executor/10987 CPU: 0 PID: 10987 Comm: syz-executor Not tainted 4.8.0+ #39 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014 ffff880031d97838 ffffffff829f835b ffff88001b5a1640 ffff8800081b0ec0 ffff8800081b15a0 ffff8800081b6d20 ffff880031d97860 ffffffff8174d3cc ffff880031d978f0 ffff8800081b0e80 ffff88001b5a1640 ffff880031d978e0 Call Trace: [<ffffffff829f835b>] dump_stack+0xb3/0x118 lib/dump_stack.c:15 [<ffffffff8174d3cc>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:156 [< inline >] print_address_description mm/kasan/report.c:194 [<ffffffff8174d666>] kasan_report_error+0x1f6/0x4d0 mm/kasan/report.c:283 [< inline >] kasan_report mm/kasan/report.c:303 [<ffffffff8174db7e>] __asan_report_store8_noabort+0x3e/0x40 mm/kasan/report.c:329 [< inline >] __write_once_size ./include/linux/compiler.h:249 [< inline >] __hlist_del ./include/linux/list.h:622 [< inline >] hlist_del_init ./include/linux/list.h:637 [<ffffffff8579047e>] l2tp_ip6_close+0x22e/0x290 net/l2tp/l2tp_ip6.c:239 [<ffffffff850b2dfd>] inet_release+0xed/0x1c0 net/ipv4/af_inet.c:415 [<ffffffff851dc5a0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:422 [<ffffffff84c4581d>] sock_release+0x8d/0x1d0 net/socket.c:570 [<ffffffff84c45976>] sock_close+0x16/0x20 net/socket.c:1017 [<ffffffff817a108c>] __fput+0x28c/0x780 fs/file_table.c:208 [<ffffffff817a1605>] ____fput+0x15/0x20 fs/file_table.c:244 [<ffffffff813774f9>] task_work_run+0xf9/0x170 [<ffffffff81324aae>] do_exit+0x85e/0x2a00 [<ffffffff81326dc8>] do_group_exit+0x108/0x330 [<ffffffff81348cf7>] get_signal+0x617/0x17a0 kernel/signal.c:2307 [<ffffffff811b49af>] do_signal+0x7f/0x18f0 [<ffffffff810039bf>] exit_to_usermode_loop+0xbf/0x150 arch/x86/entry/common.c:156 [< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:190 [<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0 arch/x86/entry/common.c:259 [<ffffffff85e4d726>] entry_SYSCALL_64_fastpath+0xc4/0xc6 Object at ffff8800081b0ec0, in cache L2TP/IPv6 size: 1448 Allocated: PID = 10987 [ 1116.897025] [<ffffffff811ddcb6>] save_stack_trace+0x16/0x20 [ 1116.897025] [<ffffffff8174c736>] save_stack+0x46/0xd0 [ 1116.897025] [<ffffffff8174c9ad>] kasan_kmalloc+0xad/0xe0 [ 1116.897025] [<ffffffff8174cee2>] kasan_slab_alloc+0x12/0x20 [ 1116.897025] [< inline >] slab_post_alloc_hook mm/slab.h:417 [ 1116.897025] [< inline >] slab_alloc_node mm/slub.c:2708 [ 1116.897025] [< inline >] slab_alloc mm/slub.c:2716 [ 1116.897025] [<ffffffff817476a8>] kmem_cache_alloc+0xc8/0x2b0 mm/slub.c:2721 [ 1116.897025] [<ffffffff84c4f6a9>] sk_prot_alloc+0x69/0x2b0 net/core/sock.c:1326 [ 1116.897025] [<ffffffff84c58ac8>] sk_alloc+0x38/0xae0 net/core/sock.c:1388 [ 1116.897025] [<ffffffff851ddf67>] inet6_create+0x2d7/0x1000 net/ipv6/af_inet6.c:182 [ 1116.897025] [<ffffffff84c4af7b>] __sock_create+0x37b/0x640 net/socket.c:1153 [ 1116.897025] [< inline >] sock_create net/socket.c:1193 [ 1116.897025] [< inline >] SYSC_socket net/socket.c:1223 [ 1116.897025] [<ffffffff84c4b46f>] SyS_socket+0xef/0x1b0 net/socket.c:1203 [ 1116.897025] [<ffffffff85e4d685>] entry_SYSCALL_64_fastpath+0x23/0xc6 Freed: PID = 10987 [ 1116.897025] [<ffffffff811ddcb6>] save_stack_trace+0x16/0x20 [ 1116.897025] [<ffffffff8174c736>] save_stack+0x46/0xd0 [ 1116.897025] [<ffffffff8174cf61>] kasan_slab_free+0x71/0xb0 [ 1116.897025] [< inline >] slab_free_hook mm/slub.c:1352 [ 1116.897025] [< inline >] slab_free_freelist_hook mm/slub.c:1374 [ 1116.897025] [< inline >] slab_free mm/slub.c:2951 [ 1116.897025] [<ffffffff81748b28>] kmem_cache_free+0xc8/0x330 mm/slub.c:2973 [ 1116.897025] [< inline >] sk_prot_free net/core/sock.c:1369 [ 1116.897025] [<ffffffff84c541eb>] __sk_destruct+0x32b/0x4f0 net/core/sock.c:1444 [ 1116.897025] [<ffffffff84c5aca4>] sk_destruct+0x44/0x80 net/core/sock.c:1452 [ 1116.897025] [<ffffffff84c5ad33>] __sk_free+0x53/0x220 net/core/sock.c:1460 [ 1116.897025] [<ffffffff84c5af23>] sk_free+0x23/0x30 net/core/sock.c:1471 [ 1116.897025] [<ffffffff84c5cb6c>] sk_common_release+0x28c/0x3e0 ./include/net/sock.h:1589 [ 1116.897025] [<ffffffff8579044e>] l2tp_ip6_close+0x1fe/0x290 net/l2tp/l2tp_ip6.c:243 [ 1116.897025] [<ffffffff850b2dfd>] inet_release+0xed/0x1c0 net/ipv4/af_inet.c:415 [ 1116.897025] [<ffffffff851dc5a0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:422 [ 1116.897025] [<ffffffff84c4581d>] sock_release+0x8d/0x1d0 net/socket.c:570 [ 1116.897025] [<ffffffff84c45976>] sock_close+0x16/0x20 net/socket.c:1017 [ 1116.897025] [<ffffffff817a108c>] __fput+0x28c/0x780 fs/file_table.c:208 [ 1116.897025] [<ffffffff817a1605>] ____fput+0x15/0x20 fs/file_table.c:244 [ 1116.897025] [<ffffffff813774f9>] task_work_run+0xf9/0x170 [ 1116.897025] [<ffffffff81324aae>] do_exit+0x85e/0x2a00 [ 1116.897025] [<ffffffff81326dc8>] do_group_exit+0x108/0x330 [ 1116.897025] [<ffffffff81348cf7>] get_signal+0x617/0x17a0 kernel/signal.c:2307 [ 1116.897025] [<ffffffff811b49af>] do_signal+0x7f/0x18f0 [ 1116.897025] [<ffffffff810039bf>] exit_to_usermode_loop+0xbf/0x150 arch/x86/entry/common.c:156 [ 1116.897025] [< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:190 [ 1116.897025] [<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0 arch/x86/entry/common.c:259 [ 1116.897025] [<ffffffff85e4d726>] entry_SYSCALL_64_fastpath+0xc4/0xc6 Memory state around the buggy address: ffff8800081b0d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8800081b0e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8800081b0e80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ^ ffff8800081b0f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8800081b0f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== The same issue exists with l2tp_ip_bind() and l2tp_ip_bind_table. Fixes: c51ce49735c1 ("l2tp: fix oops in L2TP IP sockets for connect() AF_UNSPEC case") Reported-by: Baozeng Ding <sploving1@gmail.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Baozeng Ding <sploving1@gmail.com> Signed-off-by: Guillaume Nault <g.nault@alphalink.fr> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit 32c231164b762dddefa13af5a0101032c70b50ef) Signed-off-by: Bernie Thompson <bhthompson@google.com> BUG=b:35995865 TEST=None Change-Id: I3a4fc7440f2e7ac54c781fa2394b7528f64a2b71 Reviewed-on: https://chromium-review.googlesource.com/450702 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Guenter Roeck <groeck@chromium.org> " fail_count="0" gerrit_number="450702" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="1" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/02/450702/1" remote="cros" total_fail_count="0"/><pending_commit branch="chromeos-3.8" change_id="I5b581ead205ddabb406d1f888e833177d3320bc5" commit="daaeb1352d0b6f80888bf262ff4612baf810aca5" commit_message="UPSTREAM: mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] This fixes CVE-2016-8650. If mpi_powm() is given a zero exponent, it wants to immediately return either 1 or 0, depending on the modulus. However, if the result was initalised with zero limb space, no limbs space is allocated and a NULL-pointer exception ensues. Fix this by allocating a minimal amount of limb space for the result when the 0-exponent case when the result is 1 and not touching the limb space when the result is 0. This affects the use of RSA keys and X.509 certificates that carry them. BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6 PGD 0 Oops: 0002 [#1] SMP Modules linked in: CPU: 3 PID: 3014 Comm: keyctl Not tainted 4.9.0-rc6-fscache+ #278 Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014 task: ffff8804011944c0 task.stack: ffff880401294000 RIP: 0010:[<ffffffff8138ce5d>] [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6 RSP: 0018:ffff880401297ad8 EFLAGS: 00010212 RAX: 0000000000000000 RBX: ffff88040868bec0 RCX: ffff88040868bba0 RDX: ffff88040868b260 RSI: ffff88040868bec0 RDI: ffff88040868bee0 RBP: ffff880401297ba8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000047 R11: ffffffff8183b210 R12: 0000000000000000 R13: ffff8804087c7600 R14: 000000000000001f R15: ffff880401297c50 FS: 00007f7a7918c700(0000) GS:ffff88041fb80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000401250000 CR4: 00000000001406e0 Stack: ffff88040868bec0 0000000000000020 ffff880401297b00 ffffffff81376cd4 0000000000000100 ffff880401297b10 ffffffff81376d12 ffff880401297b30 ffffffff81376f37 0000000000000100 0000000000000000 ffff880401297ba8 Call Trace: [<ffffffff81376cd4>] ? __sg_page_iter_next+0x43/0x66 [<ffffffff81376d12>] ? sg_miter_get_next_page+0x1b/0x5d [<ffffffff81376f37>] ? sg_miter_next+0x17/0xbd [<ffffffff8138ba3a>] ? mpi_read_raw_from_sgl+0xf2/0x146 [<ffffffff8132a95c>] rsa_verify+0x9d/0xee [<ffffffff8132acca>] ? pkcs1pad_sg_set_buf+0x2e/0xbb [<ffffffff8132af40>] pkcs1pad_verify+0xc0/0xe1 [<ffffffff8133cb5e>] public_key_verify_signature+0x1b0/0x228 [<ffffffff8133d974>] x509_check_for_self_signed+0xa1/0xc4 [<ffffffff8133cdde>] x509_cert_parse+0x167/0x1a1 [<ffffffff8133d609>] x509_key_preparse+0x21/0x1a1 [<ffffffff8133c3d7>] asymmetric_key_preparse+0x34/0x61 [<ffffffff812fc9f3>] key_create_or_update+0x145/0x399 [<ffffffff812fe227>] SyS_add_key+0x154/0x19e [<ffffffff81001c2b>] do_syscall_64+0x80/0x191 [<ffffffff816825e4>] entry_SYSCALL64_slow_path+0x25/0x25 Code: 56 41 55 41 54 53 48 81 ec a8 00 00 00 44 8b 71 04 8b 42 04 4c 8b 67 18 45 85 f6 89 45 80 0f 84 b4 06 00 00 85 c0 75 2f 41 ff ce <49> c7 04 24 01 00 00 00 b0 01 75 0b 48 8b 41 18 48 83 38 01 0f RIP [<ffffffff8138ce5d>] mpi_powm+0x32/0x7e6 RSP <ffff880401297ad8> CR2: 0000000000000000 ---[ end trace d82015255d4a5d8d ]--- Basically, this is a backport of a libgcrypt patch: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=patch;h=6e1adb05d290aeeb1c230c763970695f4a538526 Fixes: cdec9cb5167a ("crypto: GnuPG based MPI lib - source files (part 1)") Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com> Signed-off-by: David Howells <dhowells@redhat.com> cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com> cc: linux-ima-devel@lists.sourceforge.net cc: stable@vger.kernel.org Signed-off-by: James Morris <james.l.morris@oracle.com> BUG=b:35995865 TEST=None Change-Id: I5b581ead205ddabb406d1f888e833177d3320bc5 Signed-off-by: Bernie Thompson <bhthompson@google.com> Reviewed-on: https://chromium-review.googlesource.com/450703 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> Reviewed-by: Guenter Roeck <groeck@chromium.org> " fail_count="0" gerrit_number="450703" owner_email="bhthompson@chromium.org" pass_count="0" patch_number="1" project="chromiumos/third_party/kernel" project_url="https://chromium-review.googlesource.com/chromiumos/third_party/kernel" ref="refs/changes/03/450703/1" remote="cros" total_fail_count="0"/><lkgm version="9344.0.0-rc3"/></manifest> |
