GitHub PushEvent at 2014-09-27 23:59:49
Repository: kernel_samsung_smdk4412
Actor: fusionjack
Payload: {"shas":[["48e65c40187c037bae91c1cf5500bbc0692ab093","d2f0bc2f6cbabd319d2e18d1e6732f98155b1100@gmx.at","bcmdhd wireless: Fix off by one in initialization.\n\nAn sprintf in dhd_write_macaddr wrote a rogue null byte after the buffer.\nFound with CONFIG_CC_STACKPROTECTOR=y (idea of Lanchon at XDA Developers [1]).\n\n[1]: http://forum.xda-developers.com/showthread.php?p=55306602\n\nPanic, on a Samsung Galaxy S2 i9100, was:\n\n<0>[   26.412257] c1 Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: bf013a2c\n<0>[   26.412315] c1\n<4>[   26.412334] c1 Backtrace:\n<4>[   26.412382] c1 [<c064e5b8>] (dump_backtrace+0x0/0x10c) from [<c0b91e6c>] (dump_stack+0x18/0x1c)\n<4>[   26.412439] c1  r6:e211e820 r5:c0ed4760 r4:c0f5c940 r3:271aed5c\n<4>[   26.412496] c1 [<c0b91e54>] (dump_stack+0x0/0x1c) from [<c0b92204>] (panic+0x80/0x1ac)\n<4>[   26.412561] c1 [<c0b92184>] (panic+0x0/0x1ac) from [<c0684be0>] (init_oops_id+0x0/0x58)\n<4>[   26.412613] c1  r3:271aed5c r2:271aed00 r1:bf013a2c r0:c0cb8880\n<4>[   26.412663] c1  r7:e273bc32\n<4>[   26.412742] c1 [<c0684bc4>] (__stack_chk_fail+0x0/0x1c) from [<bf013a2c>] (dhd_write_macaddr+0x2e4/0x310 [dhd])\n<4>[   26.412864] c1 [<bf013748>] (dhd_write_macaddr+0x0/0x310 [dhd]) from [<bf01a554>] (dhd_bus_start+0x1a4/0x2e0 [dhd])\n<4>[   26.412985] c1 [<bf01a3b0>] (dhd_bus_start+0x0/0x2e0 [dhd]) from [<bf020558>] (dhdsdio_probe+0x4a4/0x72c [dhd])\n<4>[   26.413097] c1 [<bf0200b4>] (dhdsdio_probe+0x0/0x72c [dhd]) from [<bf00c0ec>] (bcmsdh_probe+0xf8/0x150 [dhd])\n<4>[   26.413206] c1 [<bf00bff4>] (bcmsdh_probe+0x0/0x150 [dhd]) from [<bf00e038>] (bcmsdh_sdmmc_probe+0x54/0xbc [dhd])\n<4>[   26.413304] c1 [<bf00dfe4>] (bcmsdh_sdmmc_probe+0x0/0xbc [dhd]) from [<c09a7fe8>] (sdio_bus_probe+0xfc/0x108)\n<4>[   26.413368] c1  r5:e2d97000 r4:e2d97008\n<4>[   26.413414] c1 [<c09a7eec>] (sdio_bus_probe+0x0/0x108) from [<c0896764>] (driver_probe_device+0x94/0x1a8)\n<4>[   26.413474] c1  r8:00000000 r7:bf067414 r6:e2d9703c r5:c0f6ddb8 r4:e2d97008\n<4>[   26.413531] c1 r3:c09a7eec\n<4>[   26.413563] c1 [<c08966d0>] (driver_probe_device+0x0/0x1a8) from [<c089690c>] (__driver_attach+0x94/0x98)\n<4>[   26.413624] c1  r7:e2e631e0 r6:e2d9703c r5:bf067414 r4:e2d97008\n<4>[   26.413683] c1 [<c0896878>] (__driver_attach+0x0/0x98) from [<c0895678>] (bus_for_each_dev+0x4c/0x94)\n<4>[   26.413742] c1  r6:c0896878 r5:bf067414 r4:00000000 r3:c0896878\n<4>[   26.413799] c1 [<c089562c>] (bus_for_each_dev+0x0/0x94) from [<c0896428>] (driver_attach+0x24/0x28)\n<4>[   26.413857] c1  r6:c0f02af0 r5:bf067414 r4:bf067414\n<4>[   26.413904] c1 [<c0896404>] (driver_attach+0x0/0x28) from [<c08960c8>] (bus_add_driver+0x180/0x250)\n<4>[   26.413970] c1 [<c0895f48>] (bus_add_driver+0x0/0x250) from [<c0896e14>] (driver_register+0x80/0x150)\n<4>[   26.414037] c1 [<c0896d94>] (driver_register+0x0/0x150) from [<c09a8128>] (sdio_register_driver+0x2c/0x30)\n<4>[   26.414131] c1 [<c09a80fc>] (sdio_register_driver+0x0/0x30) from [<bf00e250>] (sdio_function_init+0x3c/0x8c [dhd])\n<4>[   26.414244] c1 [<bf00e214>] (sdio_function_init+0x0/0x8c [dhd]) from [<bf00c19c>] (bcmsdh_register+0x1c/0x24 [dhd])\n<4>[   26.414311] c1  r5:00000004 r4:bf06a3c4\n<4>[   26.414398] c1 [<bf00c180>] (bcmsdh_register+0x0/0x24 [dhd]) from [<bf027990>] (dhd_bus_register+0x24/0x48 [dhd])\n<4>[   26.414515] c1 [<bf02796c>] (dhd_bus_register+0x0/0x48 [dhd]) from [<bf07618c>] (init_module+0x18c/0x284 [dhd])\n<4>[   26.414610] c1 [<bf076000>] (init_module+0x0/0x284 [dhd]) from [<c06448f8>] (do_one_initcall+0x128/0x1a8)\n<4>[   26.414683] c1 [<c06447d0>] (do_one_initcall+0x0/0x1a8) from [<c06b9710>] (sys_init_module+0xdf8/0x1b1c)\n<4>[   26.414756] c1 [<c06b8918>] (sys_init_module+0x0/0x1b1c) from [<c064a8c0>] (ret_fast_syscall+0x0/0x30)\n<2>[   26.414861] c0 CPU0: stopping\n<4>[   26.414886] c0 Backtrace:\n<4>[   26.414920] c0 [<c064e5b8>] (dump_backtrace+0x0/0x10c) from [<c0b91e6c>] (dump_stack+0x18/0x1c)\n<4>[   26.414977] c0  r6:c0d54000 r5:c0eb5d08 r4:00000006 r3:271aed5c\n<4>[   26.415039] c0 [<c0b91e54>] (dump_stack+0x0/0x1c) from [<c06444bc>] (do_IPI+0x258/0x29c)\n<4>[   26.415102] c0 [<c0644264>] (do_IPI+0x0/0x29c) from [<c064a340>] (__irq_svc+0x80/0x130)\n<4>[   26.415156] c0 Exception stack(0xc0d55ef0 to 0xc0d55f38)\n<4>[   26.415197] c0 5ee0:                                     3b9ac9ff 540deacd 01c99e53 00072679\n<4>[   26.415258] c0 5f00: c0f5a468 00000000 c0d54000 00000000 c1b540a8 412fc091 00000000 c0d55f64\n<4>[   26.415317] c0 5f20: 540deacd c0d55f38 c06aa768 c065bd78 20000013 ffffffff\n<4>[   26.415380] c0 [<c065bd3c>] (exynos4_enter_idle+0x0/0x174) from [<c099a890>] (cpuidle_idle_call+0xa4/0x120)\n<4>[   26.415442] c0  r7:00000000 r6:00000001 r5:c0f815ac r4:c1b540b8\n<4>[   26.415498] c0 [<c099a7ec>] (cpuidle_idle_call+0x0/0x120) from [<c064bd40>] (cpu_idle+0xc4/0x100)\n<4>[   26.415554] c0  r8:4000406a r7:c0ba09a8 r6:c0f59ec4 r5:c0ebd8c4 r4:c0d54000\n<4>[   26.415610] c0 r3:c099a7ec\n<4>[   26.415641] c0 [<c064bc7c>] (cpu_idle+0x0/0x100) from [<c0b83238>] (rest_init+0x8c/0xa4)\n<4>[   26.415694] c0  r7:c1b51180 r6:c0f59e00 r5:00000002 r4:c0d54000\n<4>[   26.415752] c0 [<c0b831ac>] (rest_init+0x0/0xa4) from [<c00089c4>] (start_kernel+0x2dc/0x330)\n<4>[   26.415807] c0  r5:c063d944 r4:c0eb5d34\n<4>[   26.415845] c0 [<c00086e8>] (start_kernel+0x0/0x330) from [<40008044>] (0x40008044)\n\nChange-Id: Iaa907383e196fdf787ae4660977b58de79212de1","Christian Neumüller",true],["418d1dc841c4f29f32a47dbafcb3b5d89544d05d","d2f0bc2f6cbabd319d2e18d1e6732f98155b1100@gmx.at","bcmdhd wireless: Fix more off by one errors.\n\nThese were not detected by the stack protector, either because the functions\nwhere not called or because the corruption hits a local variable.\n\nChange-Id: I385c81b133ee09c28df56597df3fb25d9c063f43","Christian Neumüller",true],["63ff3f7dfed8f84145ff20b8c74ba40b85541305","d2f0bc2f6cbabd319d2e18d1e6732f98155b1100@gmx.at","bcmdhd wireless: Fix sprintf/sscanf format strings.\n\n%X is int. This is too wide for the chars used there, so use %hhx instead. Avoid\nundefined pointer casts from char* to unsigned int* in sscanf calls.\n\nAlso use the already defined MACF and update it with %hhx instead of typing this\nlong format string all over again.\nAdd MACF_U which is the same as MACF but with uppercase hex (%hhX instead of %hhx).\n\nChange-Id: Idd2465e0d05bca9b05566abeec05a5ad59a577ad","Christian Neumüller",true],["33c32ce932db4708a23dc05a16eca746ad51bdf0","d688953a19dcb476c5fb90e6abba87f77b09be65@gmail.com","Bluetooth: Cancel power_on and power_off work\n\n* This is not exact upstream patch but replica\n  functions that will do similar function.\n* Thanks to Dorimanx.\n\nSigned-off-by: Pranav Vashi <neobuddy89@gmail.com>","Pranav Vashi",true],["66aafa0065cf2b635e827696d498111d955b05f1","64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com","Bluetooth: fix possible info leak in bt_sock_recvmsg()\n\nIn case the socket is already shutting down, bt_sock_recvmsg() returns\nwith 0 without updating msg_namelen leading to net/socket.c leaking the\nlocal, uninitialized sockaddr_storage variable to userland -- 128 bytes\nof kernel stack memory.\n\nFix this by moving the msg_namelen assignment in front of the shutdown\ntest.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Marcel Holtmann <marcel@holtmann.org>\nCc: Gustavo Padovan <gustavo@padovan.org>\nCc: Johan Hedberg <johan.hedberg@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Pranav Vashi <neobuddy89@gmail.com>","Mathias Krause",true],["a93229d6c344e72affa3a182106368abc97f7fa6","5db23874f34e45d59c69d81cd72d048d558566d7@gmail.com","mm: vmscan: reduce swappiness to 10%","anarkia1976",true],["19083fcacb8ae3bcd9338bdb03bbed8aee14c1de","55184e841a05d5233609b6ff75384d8204937664@yahoo.de","defconfig: Disable SCHED_DEBUG\n\nChange-Id: Ibae18112e7e709c7c6128ae908cc0f9b9056e13c","fusionjack",true],["7f64ec55d2a7db74c856b79c1920fb16907931ce","69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org","Fix gcc-4.9.0 miscompilation of load_balance() in scheduler\n\ncommit 2062afb4f804afef61cbe62a30cac9a46e58e067 upstream.\n\nMichel Dänzer and a couple of other people reported inexplicable random\noopses in the scheduler, and the cause turns out to be gcc mis-compiling\nthe load_balance() function when debugging is enabled.  The gcc bug\napparently goes back to gcc-4.5, but slight optimization changes means\nthat it now showed up as a problem in 4.9.0 and 4.9.1.\n\nThe instruction scheduling problem causes gcc to schedule a spill\noperation to before the stack frame has been created, which in turn can\ncorrupt the spilled value if an interrupt comes in.  There may be other\neffects of this bug too, but that's the code generation problem seen in\nMichel's case.\n\nThis is fixed in current gcc HEAD, but the workaround as suggested by\nMarkus Trippelsdorf is pretty simple: use -fno-var-tracking-assignments\nwhen compiling the kernel, which disables the gcc code that causes the\nproblem.  This can result in slightly worse debug information for\nvariable accesses, but that is infinitely preferable to actual code\ngeneration problems.\n\nDoing this unconditionally (not just for CONFIG_DEBUG_INFO) also allows\nnon-debug builds to verify that the debug build would be identical: we\ncan do\n\n    export GCC_COMPARE_DEBUG=1\n\nto make gcc internally verify that the result of the build is\nindependent of the \"-g\" flag (it will make the compiler build everything\ntwice, toggling the debug flag, and compare the results).\n\nWithout the \"-fno-var-tracking-assignments\" option, the build would fail\n(even with 4.8.3 that didn't show the actual stack frame bug) with a gcc\ncompare failure.\n\nSee also gcc bugzilla:\n\n  https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61801\n\nReported-by: Michel Dänzer <michel@daenzer.net>\nSuggested-by: Markus Trippelsdorf <markus@trippelsdorf.de>\nCc: Jakub Jelinek <jakub@redhat.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","Linus Torvalds",true],["814840f9410954c636c31201d6d8cbe0e1b00282","4bada73e411a9c678a318a79d04d7df4a5fc4429@gmail.com","Remove more kernel debugging\n\nSigned-off-by: Chet Kener <Cl3Kener@gmail.com>\n\nConflicts:\n\tinit/Kconfig\n\nChange-Id: I9d5e94ab9e5f1e29344a79e8c967f60abf7d3134","Chet Kener",true]],"size":9,"ref":"refs/heads/kk4.4","head":"814840f9410954c636c31201d6d8cbe0e1b00282"}