{"push_id":1285859054,"size":28,"distinct_size":28,"ref":"refs/heads/cm-13.0","head":"da60e23196b4e33a2d459814f484456b662b92df","before":"06f97d93a8e2a0c5bdd945db7ac40e0b40bc8893","commits":[{"sha":"034c83287e9798026febb22ea6f3db655644b60a","author":{"name":"Daniel Borkmann","email":"9e2dfb17275f5090f9361bcf2ab5dba6b506e7e6@redhat.com"},"message":"net: sctp: fix skb leakage in COOKIE ECHO path of chunk->auth_chunk\n\n[ Upstream commit c485658bae87faccd7aed540fd2ca3ab37992310 ]\n\nWhile working on ec0223ec48a9 (\"net: sctp: fix sctp_sf_do_5_1D_ce to\nverify if we/peer is AUTH capable\"), we noticed that there's a skb\nmemory leakage in the error path.\n\nRunning the same reproducer as in ec0223ec48a9 and by unconditionally\njumping to the error label (to simulate an error condition) in\nsctp_sf_do_5_1D_ce() receive path lets kmemleak detector bark about\nthe unfreed chunk->auth_chunk skb clone:\n\nUnreferenced object 0xffff8800b8f3a000 (size 256):\n  comm \"softirq\", pid 0, jiffies 4294769856 (age 110.757s)\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    89 ab 75 5e d4 01 58 13 00 00 00 00 00 00 00 00  ..u^..X.........\n  backtrace:\n    [<ffffffff816660be>] kmemleak_alloc+0x4e/0xb0\n    [<ffffffff8119f328>] kmem_cache_alloc+0xc8/0x210\n    [<ffffffff81566929>] skb_clone+0x49/0xb0\n    [<ffffffffa0467459>] sctp_endpoint_bh_rcv+0x1d9/0x230 [sctp]\n    [<ffffffffa046fdbc>] sctp_inq_push+0x4c/0x70 [sctp]\n    [<ffffffffa047e8de>] sctp_rcv+0x82e/0x9a0 [sctp]\n    [<ffffffff815abd38>] ip_local_deliver_finish+0xa8/0x210\n    [<ffffffff815a64af>] nf_reinject+0xbf/0x180\n    [<ffffffffa04b4762>] nfqnl_recv_verdict+0x1d2/0x2b0 [nfnetlink_queue]\n    [<ffffffffa04aa40b>] nfnetlink_rcv_msg+0x14b/0x250 [nfnetlink]\n    [<ffffffff815a3269>] netlink_rcv_skb+0xa9/0xc0\n    [<ffffffffa04aa7cf>] nfnetlink_rcv+0x23f/0x408 [nfnetlink]\n    [<ffffffff815a2bd8>] netlink_unicast+0x168/0x250\n    [<ffffffff815a2fa1>] netlink_sendmsg+0x2e1/0x3f0\n    [<ffffffff8155cc6b>] sock_sendmsg+0x8b/0xc0\n    [<ffffffff8155d449>] ___sys_sendmsg+0x369/0x380\n\nWhat happens is that commit bbd0d59809f9 clones the skb containing\nthe AUTH chunk in sctp_endpoint_bh_rcv() when having the edge case\nthat an endpoint requires COOKIE-ECHO chunks to be authenticated:\n\n  ---------- INIT[RANDOM; CHUNKS; HMAC-ALGO] ---------->\n  <------- INIT-ACK[RANDOM; CHUNKS; HMAC-ALGO] ---------\n  ------------------ AUTH; COOKIE-ECHO ---------------->\n  <-------------------- COOKIE-ACK ---------------------\n\nWhen we enter sctp_sf_do_5_1D_ce() and before we actually get to\nthe point where we process (and subsequently free) a non-NULL\nchunk->auth_chunk, we could hit the \"goto nomem_init\" path from\nan error condition and thus leave the cloned skb around w/o\nfreeing it.\n\nThe fix is to centrally free such clones in sctp_chunk_destroy()\nhandler that is invoked from sctp_chunk_free() after all refs have\ndropped; and also move both kfree_skb(chunk->auth_chunk) there,\nso that chunk->auth_chunk is either NULL (since sctp_chunkify()\nallocs new chunks through kmem_cache_zalloc()) or non-NULL with\na valid skb pointer. chunk->skb and chunk->auth_chunk are the\nonly skbs in the sctp_chunk structure that need to be handeled.\n\nWhile at it, we should use consume_skb() for both. It is the same\nas dev_kfree_skb() but more appropriately named as we are not\na device but a protocol. Also, this effectively replaces the\nkfree_skb() from both invocations into consume_skb(). Functions\nare the same only that kfree_skb() assumes that the frame was\nbeing dropped after a failure (e.g. for tools like drop monitor),\nusage of consume_skb() seems more appropriate in function\nsctp_chunk_destroy() though.\n\nFixes: bbd0d59809f9 (\"[SCTP]: Implement the receive and verification of AUTH chunk\")\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nCc: Vlad Yasevich <yasevich@gmail.com>\nCc: Neil Horman <nhorman@tuxdriver.com>\nAcked-by: Vlad Yasevich <vyasevich@gmail.com>\nAcked-by: Neil Horman <nhorman@tuxdriver.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/034c83287e9798026febb22ea6f3db655644b60a"},{"sha":"31e216f88996eb2a039e0581e28c25b5077333e4","author":{"name":"Linus Lüssing","email":"a5c6a8a492e92d195952376875d6b60c8f2e89b8@web.de"},"message":"bridge: multicast: add sanity check for query source addresses\n\n[ Upstream commit 6565b9eeef194afbb3beec80d6dd2447f4091f8c ]\n\nMLD queries are supposed to have an IPv6 link-local source address\naccording to RFC2710, section 4 and RFC3810, section 5.1.14. This patch\nadds a sanity check to ignore such broken MLD queries.\n\nWithout this check, such malformed MLD queries can result in a\ndenial of service: The queries are ignored by any MLD listener\ntherefore they will not respond with an MLD report. However,\nwithout this patch these malformed MLD queries would enable the\nsnooping part in the bridge code, potentially shutting down the\naccording ports towards these hosts for multicast traffic as the\nbridge did not learn about these listeners.\n\nReported-by: Jan Stancek <jstancek@redhat.com>\nSigned-off-by: Linus Lüssing <linus.luessing@web.de>\nReviewed-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/31e216f88996eb2a039e0581e28c25b5077333e4"},{"sha":"a1423c8da493f124c4abc0f2e922f608a7dd6924","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"net: unix: non blocking recvmsg() should not return -EINTR\n\n[ Upstream commit de1443916791d75fdd26becb116898277bb0273f ]\n\nSome applications didn't expect recvmsg() on a non blocking socket\ncould return -EINTR. This possibility was added as a side effect\nof commit b3ca9b02b00704 (\"net: fix multithreaded signal handling in\nunix recv routines\").\n\nTo hit this bug, you need to be a bit unlucky, as the u->readlock\nmutex is usually held for very small periods.\n\nFixes: b3ca9b02b00704 (\"net: fix multithreaded signal handling in unix recv routines\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Rainer Weikusat <rweikusat@mobileactivedefense.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/a1423c8da493f124c4abc0f2e922f608a7dd6924"},{"sha":"174d9191d086210e8683858411ea02acfae41137","author":{"name":"Sabrina Dubroca","email":"4970d9e510e008c61ce99b43933c9aaa332864d8@queasysnail.net"},"message":"ipv6: don't set DST_NOCOUNT for remotely added routes\n\n[ Upstream commit c88507fbad8055297c1d1e21e599f46960cbee39 ]\n\nDST_NOCOUNT should only be used if an authorized user adds routes\nlocally. In case of routes which are added on behalf of router\nadvertisments this flag must not get used as it allows an unlimited\nnumber of routes getting added remotely.\n\nSigned-off-by: Sabrina Dubroca <sd@queasysnail.net>\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/174d9191d086210e8683858411ea02acfae41137"},{"sha":"df5e1d3c8ccb6792ef1b22ce7eee6a5991844cec","author":{"name":"Peter Boström","email":"587e8c81e7a80f42bb77fcf4d6504e499999d933@netrounds.com"},"message":"vlan: Set correct source MAC address with TX VLAN offload enabled\n\n[ Upstream commit dd38743b4cc2f86be250eaf156cf113ba3dd531a ]\n\nWith TX VLAN offload enabled the source MAC address for frames sent using the\nVLAN interface is currently set to the address of the real interface. This is\nwrong since the VLAN interface may be configured with a different address.\n\nThe bug was introduced in commit 2205369a314e12fcec4781cc73ac9c08fc2b47de\n(\"vlan: Fix header ops passthru when doing TX VLAN offload.\").\n\nThis patch sets the source address before calling the create function of the\nreal interface.\n\nSigned-off-by: Peter Boström <peter.bostrom@netrounds.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/df5e1d3c8ccb6792ef1b22ce7eee6a5991844cec"},{"sha":"4d561551aa690e0fa0cb8870e0ac5f593700ef02","author":{"name":"Matthew Leach","email":"c14b28f083c1a01b280a9eec3e8662dd97c9de83@arm.com"},"message":"net: socket: error on a negative msg_namelen\n\n[ Upstream commit dbb490b96584d4e958533fb637f08b557f505657 ]\n\nWhen copying in a struct msghdr from the user, if the user has set the\nmsg_namelen parameter to a negative value it gets clamped to a valid\nsize due to a comparison between signed and unsigned values.\n\nEnsure the syscall errors when the user passes in a negative value.\n\nSigned-off-by: Matthew Leach <matthew.leach@arm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/4d561551aa690e0fa0cb8870e0ac5f593700ef02"},{"sha":"1ee76c59c6b0433afa60d99c09231e06030067bf","author":{"name":"Heiner Kallweit","email":"1616ecc56de43592c0803b930974fe44cd6fa6e9@web.de"},"message":"ipv6: Avoid unnecessary temporary addresses being generated\n\n[ Upstream commit ecab67015ef6e3f3635551dcc9971cf363cc1cd5 ]\n\ntmp_prefered_lft is an offset to ifp->tstamp, not now. Therefore\nage needs to be added to the condition.\n\nAge calculation in ipv6_create_tempaddr is different from the one\nin addrconf_verify and doesn't consider ADDRCONF_TIMER_FUZZ_MINUS.\nThis can cause age in ipv6_create_tempaddr to be less than the one\nin addrconf_verify and therefore unnecessary temporary address to\nbe generated.\nUse age calculation as in addrconf_modify to avoid this.\n\nSigned-off-by: Heiner Kallweit <heiner.kallweit@web.de>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/1ee76c59c6b0433afa60d99c09231e06030067bf"},{"sha":"1590b990716c9ffb9eab83f889012576174ed54a","author":{"name":"lucien","email":"0c651f6709819e543c4ca1708bc1021b57131127@gmail.com"},"message":"ipv6: ip6_append_data_mtu do not handle the mtu of the second fragment properly\n\n[ Upstream commit e367c2d03dba4c9bcafad24688fadb79dd95b218 ]\n\nIn ip6_append_data_mtu(), when the xfrm mode is not tunnel(such as\ntransport),the ipsec header need to be added in the first fragment, so the mtu\nwill decrease to reserve space for it, then the second fragment come, the mtu\nshould be turn back, as the commit 0c1833797a5a6ec23ea9261d979aa18078720b74\nsaid.  however, in the commit a493e60ac4bbe2e977e7129d6d8cbb0dd236be, it use\n*mtu = min(*mtu, ...) to change the mtu, which lead to the new mtu is alway\nequal with the first fragment's. and cannot turn back.\n\nwhen I test through  ping6 -c1 -s5000 $ip (mtu=1280):\n...frag (0|1232) ESP(spi=0x00002000,seq=0xb), length 1232\n...frag (1232|1216)\n...frag (2448|1216)\n...frag (3664|1216)\n...frag (4880|164)\n\nwhich should be:\n...frag (0|1232) ESP(spi=0x00001000,seq=0x1), length 1232\n...frag (1232|1232)\n...frag (2464|1232)\n...frag (3696|1232)\n...frag (4928|116)\n\nso delete the min() when change back the mtu.\n\nSigned-off-by: Xin Long <lucien.xin@gmail.com>\nFixes: 75a493e60ac4bb (\"ipv6: ip6_append_data_mtu did not care about pmtudisc and frag_size\")\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/1590b990716c9ffb9eab83f889012576174ed54a"},{"sha":"d7496cb6bf3f2813bc6a919684fca975d36564d7","author":{"name":"Michael S. Tsirkin","email":"c8104c37f4446f6713fc8bfd2c2b00e48b8bea2d@redhat.com"},"message":"vhost: fix total length when packets are too short\n\n[ Upstream commit d8316f3991d207fe32881a9ac20241be8fa2bad0 ]\n\nWhen mergeable buffers are disabled, and the\nincoming packet is too large for the rx buffer,\nget_rx_bufs returns success.\n\nThis was intentional in order for make recvmsg\ntruncate the packet and then handle_rx would\ndetect err != sock_len and drop it.\n\nUnfortunately we pass the original sock_len to\nrecvmsg - which means we use parts of iov not fully\nvalidated.\n\nFix this up by detecting this overrun and doing packet drop\nimmediately.\n\nCVE-2014-0077\n\nSigned-off-by: Michael S. Tsirkin <mst@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/d7496cb6bf3f2813bc6a919684fca975d36564d7"},{"sha":"8dee81f3367f5dd9e68067b3869cac4faebc0161","author":{"name":"Michael S. Tsirkin","email":"c8104c37f4446f6713fc8bfd2c2b00e48b8bea2d@redhat.com"},"message":"vhost: validate vhost_get_vq_desc return value\n\n[ Upstream commit a39ee449f96a2cd44ce056d8a0a112211a9b1a1f ]\n\nvhost fails to validate negative error code\nfrom vhost_get_vq_desc causing\na crash: we are using -EFAULT which is 0xfffffff2\nas vector size, which exceeds the allocated size.\n\nThe code in question was introduced in commit\n8dd014adfea6f173c1ef6378f7e5e7924866c923\n    vhost-net: mergeable buffers support\n\nCVE-2014-0055\n\nSigned-off-by: Michael S. Tsirkin <mst@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/8dee81f3367f5dd9e68067b3869cac4faebc0161"},{"sha":"c5e1ded488e9e6b66ff028988ef807eaea09c3be","author":{"name":"Paul Durrant","email":"c378796420fc802cbeacc00115688c977ff895c2@citrix.com"},"message":"xen-netback: remove pointless clause from if statement\n\n[ Upstream commit 0576eddf24df716d8570ef8ca11452a9f98eaab2 ]\n\nThis patch removes a test in start_new_rx_buffer() that checks whether\na copy operation is less than MAX_BUFFER_OFFSET in length, since\nMAX_BUFFER_OFFSET is defined to be PAGE_SIZE and the only caller of\nstart_new_rx_buffer() already limits copy operations to PAGE_SIZE or less.\n\nSigned-off-by: Paul Durrant <paul.durrant@citrix.com>\nCc: Ian Campbell <ian.campbell@citrix.com>\nCc: Wei Liu <wei.liu2@citrix.com>\nCc: Sander Eikelenboom <linux@eikelenboom.it>\nReported-By: Sander Eikelenboom <linux@eikelenboom.it>\nTested-By: Sander Eikelenboom <linux@eikelenboom.it>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/c5e1ded488e9e6b66ff028988ef807eaea09c3be"},{"sha":"df5a5ad175b7c31be5f6269d2a9dfa94c7be9ae9","author":{"name":"Hannes Frederic Sowa","email":"384333b8ca49bccf53afadd43ca0007cb9efc1df@stressinduktion.org"},"message":"ipv6: some ipv6 statistic counters failed to disable bh\n\n[ Upstream commit 43a43b6040165f7b40b5b489fe61a4cb7f8c4980 ]\n\nAfter commit c15b1ccadb323ea (\"ipv6: move DAD and addrconf_verify\nprocessing to workqueue\") some counters are now updated in process context\nand thus need to disable bh before doing so, otherwise deadlocks can\nhappen on 32-bit archs. Fabio Estevam noticed this while while mounting\na NFS volume on an ARM board.\n\nAs a compensation for missing this I looked after the other *_STATS_BH\nand found three other calls which need updating:\n\n1) icmp6_send: ip6_fragment -> icmpv6_send -> icmp6_send (error handling)\n2) ip6_push_pending_frames: rawv6_sendmsg -> rawv6_push_pending_frames -> ...\n   (only in case of icmp protocol with raw sockets in error handling)\n3) ping6_v6_sendmsg (error handling)\n\nFixes: c15b1ccadb323ea (\"ipv6: move DAD and addrconf_verify processing to workqueue\")\nReported-by: Fabio Estevam <festevam@gmail.com>\nTested-by: Fabio Estevam <fabio.estevam@freescale.com>\nCc: Eric Dumazet <eric.dumazet@gmail.com>\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/df5a5ad175b7c31be5f6269d2a9dfa94c7be9ae9"},{"sha":"eb062e6a8b68b818328298704d4b4457cca8cdea","author":{"name":"Pablo Neira","email":"e233074affeb074ecf6c27664a0f4073308430fb@netfilter.org"},"message":"netlink: don't compare the nul-termination in nla_strcmp\n\n[ Upstream commit 8b7b932434f5eee495b91a2804f5b64ebb2bc835 ]\n\nnla_strcmp compares the string length plus one, so it's implicitly\nincluding the nul-termination in the comparison.\n\n int nla_strcmp(const struct nlattr *nla, const char *str)\n {\n        int len = strlen(str) + 1;\n        ...\n                d = memcmp(nla_data(nla), str, len);\n\nHowever, if NLA_STRING is used, userspace can send us a string without\nthe nul-termination. This is a problem since the string\ncomparison will not match as the last byte may be not the\nnul-termination.\n\nFix this by skipping the comparison of the nul-termination if the\nattribute data is nul-terminated. Suggested by Thomas Graf.\n\nCc: Florian Westphal <fw@strlen.de>\nCc: Thomas Graf <tgraf@suug.ch>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/eb062e6a8b68b818328298704d4b4457cca8cdea"},{"sha":"83f96c6623729bbc8229a043a3656aeeb9a13a27","author":{"name":"YOSHIFUJI Hideaki","email":"8dfb83a6ba87656d71c9c5528cf242885e0512d3@linux-ipv6.org"},"message":"isdnloop: Validate NUL-terminated strings from user.\n\n[ Upstream commit 77bc6bed7121936bb2e019a8c336075f4c8eef62 ]\n\nReturn -EINVAL unless all of user-given strings are correctly\nNUL-terminated.\n\nSigned-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/83f96c6623729bbc8229a043a3656aeeb9a13a27"},{"sha":"3f5efe7093ed99cec889624025e626331cfd8f3b","author":{"name":"Dan Carpenter","email":"60b2bf2bc0bec4ca4a4b046ca7ef9255248abff8@oracle.com"},"message":"isdnloop: several buffer overflows\n\n[ Upstream commit 7563487cbf865284dcd35e9ef5a95380da046737 ]\n\nThere are three buffer overflows addressed in this patch.\n\n1) In isdnloop_fake_err() we add an 'E' to a 60 character string and\nthen copy it into a 60 character buffer.  I have made the destination\nbuffer 64 characters and I'm changed the sprintf() to a snprintf().\n\n2) In isdnloop_parse_cmd(), p points to a 6 characters into a 60\ncharacter buffer so we have 54 characters.  The ->eazlist[] is 11\ncharacters long.  I have modified the code to return if the source\nbuffer is too long.\n\n3) In isdnloop_command() the cbuf[] array was 60 characters long but the\nmax length of the string then can be up to 79 characters.  I made the\ncbuf array 80 characters long and changed the sprintf() to snprintf().\nI also removed the temporary \"dial\" buffer and changed it to use \"p\"\ndirectly.\n\nUnfortunately, we pass the \"cbuf\" string from isdnloop_command() to\nisdnloop_writecmd() which truncates anything over 60 characters to make\nit fit in card->omsg[].  (It can accept values up to 255 characters so\nlong as there is a '\\n' character every 60 characters).  For now I have\njust fixed the memory corruption bug and left the other problems in this\ndriver alone.\n\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/3f5efe7093ed99cec889624025e626331cfd8f3b"},{"sha":"f99a15436caf087afb470232209331f4835b311f","author":{"name":"Sasha Levin","email":"3eff170737f7f759a98f81ff6bf07d3c251c0277@oracle.com"},"message":"rds: prevent dereference of a NULL device in rds_iw_laddr_check\n\n[ Upstream commit bf39b4247b8799935ea91d90db250ab608a58e50 ]\n\nBinding might result in a NULL device which is later dereferenced\nwithout checking.\n\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/f99a15436caf087afb470232209331f4835b311f"},{"sha":"3816bca356cf25d06b73e22ba768402139e7cae9","author":{"name":"oftedal","email":"d1ccb6f7dcaac158bc35f232bd2b6af637a6ec4b@gmail.com"},"message":"sparc: PCI: Fix incorrect address calculation of PCI Bridge windows on Simba-bridges\n\n[ Upstream commit 557fc5873ef178c4b3e1e36a42db547ecdc43f9b ]\n\nThe SIMBA APB Bridges lacks the 'ranges' of-property describing the\nPCI I/O and memory areas located beneath the bridge. Faking this\ninformation has been performed by reading range registers in the\nAPB bridge, and calculating the corresponding areas.\n\nIn commit 01f94c4a6ced476ce69b895426fc29bfc48c69bd\n(\"Fix sabre pci controllers with new probing scheme.\") a bug was\nintroduced into this calculation, causing the PCI memory areas\nto be calculated incorrectly: The shift size was set to be\nidentical for I/O and MEM ranges, which is incorrect.\n\nThis patch set the shift size of the MEM range back to the\nvalue used before 01f94c4a6ced476ce69b895426fc29bfc48c69bd.\n\nSigned-off-by: Kjetil Oftedal <oftedal@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/3816bca356cf25d06b73e22ba768402139e7cae9"},{"sha":"6fc17a2fb394a31fed2d88e4b3b6ac39f793f07d","author":{"name":"Dave Kleikamp","email":"24324fc4f213173a9791b5072d02e6f4a53085f5@oracle.com"},"message":"Revert \"sparc64: Fix __copy_{to,from}_user_inatomic defines.\"\n\n[ Upstream commit 16932237f2978a2265662f8de4af743b1f55a209 ]\n\nThis reverts commit 145e1c0023585e0e8f6df22316308ec61c5066b2.\n\nThis commit broke the behavior of __copy_from_user_inatomic when\nit is only partially successful. Instead of returning the number\nof bytes not copied, it now returns 1. This translates to the\nwrong value being returned by iov_iter_copy_from_user_atomic.\n\nxfstests generic/246 and LTP writev01 both fail on btrfs and nfs\nbecause of this.\n\nSigned-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>\nCc: Hugh Dickins <hughd@google.com>\nCc: David S. Miller <davem@davemloft.net>\nCc: sparclinux@vger.kernel.org\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/6fc17a2fb394a31fed2d88e4b3b6ac39f793f07d"},{"sha":"e716143553c008006e2d02e54fe570344b5398b3","author":{"name":"Paul Gortmaker","email":"264b51cb15b0a4c1eb7ed3e5fe7b22f5d4e19c36@windriver.com"},"message":"sparc32: fix build failure for arch_jump_label_transform\n\n[ Upstream commit 4f6500fff5f7644a03c46728fd7ef0f62fa6940b ]\n\nIn arch/sparc/Kernel/Makefile, we see:\n\n   obj-$(CONFIG_SPARC64)   += jump_label.o\n\nHowever, the Kconfig selects HAVE_ARCH_JUMP_LABEL unconditionally\nfor all SPARC.  This in turn leads to the following failure when\ndoing allmodconfig coverage builds:\n\nkernel/built-in.o: In function `__jump_label_update':\njump_label.c:(.text+0x8560c): undefined reference to `arch_jump_label_transform'\nkernel/built-in.o: In function `arch_jump_label_transform_static':\n(.text+0x85cf4): undefined reference to `arch_jump_label_transform'\nmake: *** [vmlinux] Error 1\n\nChange HAVE_ARCH_JUMP_LABEL to be conditional on SPARC64 so that it\nmatches the Makefile.\n\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/e716143553c008006e2d02e54fe570344b5398b3"},{"sha":"dc8af675a77221dd1b65b09a66818b3db9312bbc","author":{"name":"Dave Kleikamp","email":"24324fc4f213173a9791b5072d02e6f4a53085f5@oracle.com"},"message":"sparc64: don't treat 64-bit syscall return codes as 32-bit\n\n[ Upstream commit 1535bd8adbdedd60a0ee62e28fd5225d66434371 ]\n\nWhen checking a system call return code for an error,\nlinux_sparc_syscall was sign-extending the lower 32-bit value and\ncomparing it to -ERESTART_RESTARTBLOCK. lseek can return valid return\ncodes whose lower 32-bits alone would indicate a failure (such as 4G-1).\nUse the whole 64-bit value to check for errors. Only the 32-bit path\nshould sign extend the lower 32-bit value.\n\nSigned-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>\nAcked-by: Bob Picco <bob.picco@oracle.com>\nAcked-by: Allen Pais <allen.pais@oracle.com>\nCc: David S. Miller <davem@davemloft.net>\nCc: sparclinux@vger.kernel.org\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/sigma-1/android_kernel_samsung_n1awifi/commits/dc8af675a77221dd1b65b09a66818b3db9312bbc"}]}
{"actor":{"display_login":"sigma-1"}}