{"push_id":1354494217,"size":118,"distinct_size":118,"ref":"refs/heads/n","head":"74b36acdd4a9e49cc5c4ca90d6900dfbfd4d4c1a","before":"850fd5b806b0e1c7e8558a4d84c1a6c2ece43755","commits":[{"sha":"71895cd0ffb3dca631f53ab93fc6c97e22b5a63a","author":{"name":"Dan Carpenter","email":"60b2bf2bc0bec4ca4a4b046ca7ef9255248abff8@oracle.com"},"message":"irda: precedence bug in irlmp_seq_hb_idx()\n\n[ Upstream commit 50010c20597d14667eff0fdb628309986f195230 ]\n\nThis is decrementing the pointer, instead of the value stored in the\npointer.  KASan detects it as an out of bounds reference.\n\nReported-by: \"Berry Cheng 程君(成淼)\" <chengmiao.cj@alibaba-inc.com>\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/71895cd0ffb3dca631f53ab93fc6c97e22b5a63a"},{"sha":"dd6314ca0dac0f1f8e2485564575af6e3c98e56e","author":{"name":"Guillaume Nault","email":"3f2beb9890afcf959ec304431b991035a559d9bd@alphalink.fr"},"message":"ppp: fix pppoe_dev deletion condition in pppoe_release()\n\n[ Upstream commit 1acea4f6ce1b1c0941438aca75dd2e5c6b09db60 ]\n\nWe can't rely on PPPOX_ZOMBIE to decide whether to clear po->pppoe_dev.\nPPPOX_ZOMBIE can be set by pppoe_disc_rcv() even when po->pppoe_dev is\nNULL. So we have no guarantee that (sk->sk_state & PPPOX_ZOMBIE) implies\n(po->pppoe_dev != NULL).\nSince we're releasing a PPPoE socket, we want to release the pppoe_dev\nif it exists and reset sk_state to PPPOX_DEAD, no matter the previous\nvalue of sk_state. So we can just check for po->pppoe_dev and avoid any\nassumption on sk->sk_state.\n\nFixes: 2b018d57ff18 (\"pppoe: drop PPPOX_ZOMBIEs in pppoe_release\")\nSigned-off-by: Guillaume Nault <g.nault@alphalink.fr>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/dd6314ca0dac0f1f8e2485564575af6e3c98e56e"},{"sha":"852dd212b2433ef4bc54c56682712d541f977d79","author":{"name":"Sowmini Varadhan","email":"d514d90220d99e5ba0bfa7a084112fdf2760b3de@oracle.com"},"message":"RDS-TCP: Recover correctly from pskb_pull()/pksb_trim() failure in rds_tcp_data_recv\n\n[ Upstream commit 8ce675ff39b9958d1c10f86cf58e357efaafc856 ]\n\nEither of pskb_pull() or pskb_trim() may fail under low memory conditions.\nIf rds_tcp_data_recv() ignores such failures, the application will\nreceive corrupted data because the skb has not been correctly\ncarved to the RDS datagram size.\n\nAvoid this by handling pskb_pull/pskb_trim failure in the same\nmanner as the skb_clone failure: bail out of rds_tcp_data_recv(), and\nretry via the deferred call to rds_send_worker() that gets set up on\nENOMEM from rds_tcp_read_sock()\n\nSigned-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>\nAcked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/852dd212b2433ef4bc54c56682712d541f977d79"},{"sha":"4c4016c1e015730968878ce3cf386fdece570108","author":{"name":"Carol L Soto","email":"5b6470d60ec3a57878c0864163bac8cf5d0d88af@linux.vnet.ibm.com"},"message":"net/mlx4: Copy/set only sizeof struct mlx4_eqe bytes\n\n[ Upstream commit c02b05011fadf8e409e41910217ca689f2fc9d91 ]\n\nWhen doing memcpy/memset of EQEs, we should use sizeof struct\nmlx4_eqe as the base size and not caps.eqe_size which could be bigger.\n\nIf caps.eqe_size is bigger than the struct mlx4_eqe then we corrupt\ndata in the master context.\n\nWhen using a 64 byte stride, the memcpy copied over 63 bytes to the\nslave_eq structure.  This resulted in copying over the entire eqe of\ninterest, including its ownership bit -- and also 31 bytes of garbage\ninto the next WQE in the slave EQ -- which did NOT include the ownership\nbit (and therefore had no impact).\n\nHowever, once the stride is increased to 128, we are overwriting the\nownership bits of *three* eqes in the slave_eq struct.  This results\nin an incorrect ownership bit for those eqes, which causes the eq to\nseem to be full. The issue therefore surfaced only once 128-byte EQEs\nstarted being used in SRIOV and (overarchitectures that have 128/256\nbyte cache-lines such as PPC) - e.g after commit 77507aa249ae\n\"net/mlx4_core: Enable CQE/EQE stride support\".\n\nFixes: 08ff32352d6f ('mlx4: 64-byte CQE/EQE support')\nSigned-off-by: Carol L Soto <clsoto@linux.vnet.ibm.com>\nSigned-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>\nSigned-off-by: Or Gerlitz <ogerlitz@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/4c4016c1e015730968878ce3cf386fdece570108"},{"sha":"32486e08bb54d9dce8147115645b6cfa202f71bb","author":{"name":"Phil Reid","email":"3029a7466dc36215fa0da25180deffc5f5e7b138@electromag.com.au"},"message":"stmmac: Correctly report PTP capabilities.\n\n[ Upstream commit e6dbe1eb2db0d7a14991c06278dd3030c45fb825 ]\n\npriv->hwts_*_en indicate if timestamping is enabled/disabled at run\ntime. But  priv->dma_cap.time_stamp  and priv->dma_cap.atime_stamp\nindicates HW is support for PTPv1/PTPv2.\n\nSigned-off-by: Phil Reid <preid@electromag.com.au>\nAcked-by: Richard Cochran <richardcochran@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/32486e08bb54d9dce8147115645b6cfa202f71bb"},{"sha":"ba49afe13e93e4beabe70ea7ef39411926619d9c","author":{"name":"Ani Sinha","email":"9476debd07781d3f32288179ee6b768b6260b928@arista.com"},"message":"ipmr: fix possible race resulting from improper usage of IP_INC_STATS_BH() in preemptible context.\n\n[ Upstream commit 44f49dd8b5a606870a1f21101522a0f9c4414784 ]\n\nFixes the following kernel BUG :\n\nBUG: using __this_cpu_add() in preemptible [00000000] code: bash/2758\ncaller is __this_cpu_preempt_check+0x13/0x15\nCPU: 0 PID: 2758 Comm: bash Tainted: P           O   3.18.19 #2\n ffffffff8170eaca ffff880110d1b788 ffffffff81482b2a 0000000000000000\n 0000000000000000 ffff880110d1b7b8 ffffffff812010ae ffff880007cab800\n ffff88001a060800 ffff88013a899108 ffff880108b84240 ffff880110d1b7c8\nCall Trace:\n[<ffffffff81482b2a>] dump_stack+0x52/0x80\n[<ffffffff812010ae>] check_preemption_disabled+0xce/0xe1\n[<ffffffff812010d4>] __this_cpu_preempt_check+0x13/0x15\n[<ffffffff81419d60>] ipmr_queue_xmit+0x647/0x70c\n[<ffffffff8141a154>] ip_mr_forward+0x32f/0x34e\n[<ffffffff8141af76>] ip_mroute_setsockopt+0xe03/0x108c\n[<ffffffff810553fc>] ? get_parent_ip+0x11/0x42\n[<ffffffff810e6974>] ? pollwake+0x4d/0x51\n[<ffffffff81058ac0>] ? default_wake_function+0x0/0xf\n[<ffffffff810553fc>] ? get_parent_ip+0x11/0x42\n[<ffffffff810613d9>] ? __wake_up_common+0x45/0x77\n[<ffffffff81486ea9>] ? _raw_spin_unlock_irqrestore+0x1d/0x32\n[<ffffffff810618bc>] ? __wake_up_sync_key+0x4a/0x53\n[<ffffffff8139a519>] ? sock_def_readable+0x71/0x75\n[<ffffffff813dd226>] do_ip_setsockopt+0x9d/0xb55\n[<ffffffff81429818>] ? unix_seqpacket_sendmsg+0x3f/0x41\n[<ffffffff813963fe>] ? sock_sendmsg+0x6d/0x86\n[<ffffffff813959d4>] ? sockfd_lookup_light+0x12/0x5d\n[<ffffffff8139650a>] ? SyS_sendto+0xf3/0x11b\n[<ffffffff810d5738>] ? new_sync_read+0x82/0xaa\n[<ffffffff813ddd19>] compat_ip_setsockopt+0x3b/0x99\n[<ffffffff813fb24a>] compat_raw_setsockopt+0x11/0x32\n[<ffffffff81399052>] compat_sock_common_setsockopt+0x18/0x1f\n[<ffffffff813c4d05>] compat_SyS_setsockopt+0x1a9/0x1cf\n[<ffffffff813c4149>] compat_SyS_socketcall+0x180/0x1e3\n[<ffffffff81488ea1>] cstar_dispatch+0x7/0x1e\n\nSigned-off-by: Ani Sinha <ani@arista.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/ba49afe13e93e4beabe70ea7ef39411926619d9c"},{"sha":"b66515953eb57cc2ff6f76c56e729bd823d117d5","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"net: avoid NULL deref in inet_ctl_sock_destroy()\n\n[ Upstream commit 8fa677d2706d325d71dab91bf6e6512c05214e37 ]\n\nUnder low memory conditions, tcp_sk_init() and icmp_sk_init()\ncan both iterate on all possible cpus and call inet_ctl_sock_destroy(),\nwith eventual NULL pointer.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/b66515953eb57cc2ff6f76c56e729bd823d117d5"},{"sha":"d6cf28dcf4ae993fdab4bd315b21a3251cce6e65","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"net: fix a race in dst_release()\n\n[ Upstream commit d69bbf88c8d0b367cf3e3a052f6daadf630ee566 ]\n\nOnly cpu seeing dst refcount going to 0 can safely\ndereference dst->flags.\n\nOtherwise an other cpu might already have freed the dst.\n\nFixes: 27b75c95f10d (\"net: avoid RCU for NOCACHE dst\")\nReported-by: Greg Thelen <gthelen@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/d6cf28dcf4ae993fdab4bd315b21a3251cce6e65"},{"sha":"8796b1743b7b200378986bccec500999540cedb4","author":{"name":"Jason Wang","email":"74f299602f66bf37e22877b931fc5996e932eb30@redhat.com"},"message":"virtio-net: drop NETIF_F_FRAGLIST\n\n[ Upstream commit 48900cb6af4282fa0fb6ff4d72a81aa3dadb5c39 ]\n\nvirtio declares support for NETIF_F_FRAGLIST, but assumes\nthat there are at most MAX_SKB_FRAGS + 2 fragments which isn't\nalways true with a fraglist.\n\nA longer fraglist in the skb will make the call to skb_to_sgvec overflow\nthe sg array, leading to memory corruption.\n\nDrop NETIF_F_FRAGLIST so we only get what we can handle.\n\nCc: Michael S. Tsirkin <mst@redhat.com>\nSigned-off-by: Jason Wang <jasowang@redhat.com>\nAcked-by: Michael S. Tsirkin <mst@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/8796b1743b7b200378986bccec500999540cedb4"},{"sha":"d9758b4e930bd87fa51bfb6343e58d9a9f45e321","author":{"name":"Sasha Levin","email":"3eff170737f7f759a98f81ff6bf07d3c251c0277@oracle.com"},"message":"RDS: verify the underlying transport exists before creating a connection\n\n[ Upstream commit 74e98eb085889b0d2d4908f59f6e00026063014f ]\n\nThere was no verification that an underlying transport exists when creating\na connection, this would cause dereferencing a NULL ptr.\n\nIt might happen on sockets that weren't properly bound before attempting to\nsend a message, which will cause a NULL ptr deref:\n\n[135546.047719] kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN\n[135546.051270] Modules linked in:\n[135546.051781] CPU: 4 PID: 15650 Comm: trinity-c4 Not tainted 4.2.0-next-20150902-sasha-00041-gbaa1222-dirty #2527\n[135546.053217] task: ffff8800835bc000 ti: ffff8800bc708000 task.ti: ffff8800bc708000\n[135546.054291] RIP: __rds_conn_create (net/rds/connection.c:194)\n[135546.055666] RSP: 0018:ffff8800bc70fab0  EFLAGS: 00010202\n[135546.056457] RAX: dffffc0000000000 RBX: 0000000000000f2c RCX: ffff8800835bc000\n[135546.057494] RDX: 0000000000000007 RSI: ffff8800835bccd8 RDI: 0000000000000038\n[135546.058530] RBP: ffff8800bc70fb18 R08: 0000000000000001 R09: 0000000000000000\n[135546.059556] R10: ffffed014d7a3a23 R11: ffffed014d7a3a21 R12: 0000000000000000\n[135546.060614] R13: 0000000000000001 R14: ffff8801ec3d0000 R15: 0000000000000000\n[135546.061668] FS:  00007faad4ffb700(0000) GS:ffff880252000000(0000) knlGS:0000000000000000\n[135546.062836] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n[135546.063682] CR2: 000000000000846a CR3: 000000009d137000 CR4: 00000000000006a0\n[135546.064723] Stack:\n[135546.065048]  ffffffffafe2055c ffffffffafe23fc1 ffffed00493097bf ffff8801ec3d0008\n[135546.066247]  0000000000000000 00000000000000d0 0000000000000000 ac194a24c0586342\n[135546.067438]  1ffff100178e1f78 ffff880320581b00 ffff8800bc70fdd0 ffff880320581b00\n[135546.068629] Call Trace:\n[135546.069028] ? __rds_conn_create (include/linux/rcupdate.h:856 net/rds/connection.c:134)\n[135546.069989] ? rds_message_copy_from_user (net/rds/message.c:298)\n[135546.071021] rds_conn_create_outgoing (net/rds/connection.c:278)\n[135546.071981] rds_sendmsg (net/rds/send.c:1058)\n[135546.072858] ? perf_trace_lock (include/trace/events/lock.h:38)\n[135546.073744] ? lockdep_init (kernel/locking/lockdep.c:3298)\n[135546.074577] ? rds_send_drop_to (net/rds/send.c:976)\n[135546.075508] ? __might_fault (./arch/x86/include/asm/current.h:14 mm/memory.c:3795)\n[135546.076349] ? __might_fault (mm/memory.c:3795)\n[135546.077179] ? rds_send_drop_to (net/rds/send.c:976)\n[135546.078114] sock_sendmsg (net/socket.c:611 net/socket.c:620)\n[135546.078856] SYSC_sendto (net/socket.c:1657)\n[135546.079596] ? SYSC_connect (net/socket.c:1628)\n[135546.080510] ? trace_dump_stack (kernel/trace/trace.c:1926)\n[135546.081397] ? ring_buffer_unlock_commit (kernel/trace/ring_buffer.c:2479 kernel/trace/ring_buffer.c:2558 kernel/trace/ring_buffer.c:2674)\n[135546.082390] ? trace_buffer_unlock_commit (kernel/trace/trace.c:1749)\n[135546.083410] ? trace_event_raw_event_sys_enter (include/trace/events/syscalls.h:16)\n[135546.084481] ? do_audit_syscall_entry (include/trace/events/syscalls.h:16)\n[135546.085438] ? trace_buffer_unlock_commit (kernel/trace/trace.c:1749)\n[135546.085515] rds_ib_laddr_check(): addr 36.74.25.172 ret -99 node type -1\n\nAcked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/d9758b4e930bd87fa51bfb6343e58d9a9f45e321"},{"sha":"140437c5d1c813970ceffbc48d5b6c9e403c5ec8","author":{"name":"Marek Szyprowski","email":"4d0ab7dac85d754388f4be3549f400e336faa58a@samsung.com"},"message":"ARM: 8426/1: dma-mapping: add missing range check in dma_mmap()\n\ncommit 371f0f085f629fc0f66695f572373ca4445a67ad upstream.\n\ndma_mmap() function in IOMMU-based dma-mapping implementation lacked\na check for valid range of mmap parameters (offset and buffer size), what\nmight have caused access beyond the allocated buffer. This patch fixes\nthis issue.\n\nSigned-off-by: Marek Szyprowski <m.szyprowski@samsung.com>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/140437c5d1c813970ceffbc48d5b6c9e403c5ec8"},{"sha":"6a7a57d96fef11ab5167e5a3826c92907ce5e7a3","author":{"name":"Marek Szyprowski","email":"4d0ab7dac85d754388f4be3549f400e336faa58a@samsung.com"},"message":"ARM: 8427/1: dma-mapping: add support for offset parameter in dma_mmap()\n\ncommit 7e31210349e9e03a9a4dff31ab5f2bc83e8e84f5 upstream.\n\nIOMMU-based dma_mmap() implementation lacked proper support for offset\nparameter used in mmap call (it always assumed that mapping starts from\noffset zero). This patch adds support for offset parameter to IOMMU-based\nimplementation.\n\nSigned-off-by: Marek Szyprowski <m.szyprowski@samsung.com>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/6a7a57d96fef11ab5167e5a3826c92907ce5e7a3"},{"sha":"733a9b3191edcf066cacbb819df3d009d42fd11c","author":{"name":"Florian Fainelli","email":"244da8ca84c0b82369d8dd3f15015e61f28f6fe5@gmail.com"},"message":"ARM: orion: Fix DSA platform device after mvmdio conversion\n\ncommit d836ace65ee98d7079bc3c5afdbcc0e27dca20a3 upstream.\n\nDSA expects the host_dev pointer to be the device structure associated\nwith the MDIO bus controller driver. First commit breaking that was\nc3a07134e6aa (\"mv643xx_eth: convert to use the Marvell Orion MDIO\ndriver\"), and then, it got completely under the radar for a while.\n\nReported-by: Frans van de Wiel <fvdw@fvdw.eu>\nFixes: c3a07134e6aa (\"mv643xx_eth: convert to use the Marvell Orion MDIO driver\")\nSigned-off-by: Florian Fainelli <f.fainelli@gmail.com>\nSigned-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/733a9b3191edcf066cacbb819df3d009d42fd11c"},{"sha":"d5906127cbdb2df9856979e66a20d5b3a4d81ba7","author":{"name":"Paolo Bonzini","email":"7438500e0207b21c4e5dfca8d2a7898734cd7706@redhat.com"},"message":"x86/setup: Extend low identity map to cover whole kernel range\n\ncommit f5f3497cad8c8416a74b9aaceb127908755d020a upstream.\n\nOn 32-bit systems, the initial_page_table is reused by\nefi_call_phys_prolog as an identity map to call\nSetVirtualAddressMap.  efi_call_phys_prolog takes care of\nconverting the current CPU's GDT to a physical address too.\n\nFor PAE kernels the identity mapping is achieved by aliasing the\nfirst PDPE for the kernel memory mapping into the first PDPE\nof initial_page_table.  This makes the EFI stub's trick \"just work\".\n\nHowever, for non-PAE kernels there is no guarantee that the identity\nmapping in the initial_page_table extends as far as the GDT; in this\ncase, accesses to the GDT will cause a page fault (which quickly becomes\na triple fault).  Fix this by copying the kernel mappings from\nswapper_pg_dir to initial_page_table twice, both at PAGE_OFFSET and at\nidentity mapping.\n\nFor some reason, this is only reproducible with QEMU's dynamic translation\nmode, and not for example with KVM.  However, even under KVM one can clearly\nsee that the page table is bogus:\n\n    $ qemu-system-i386 -pflash OVMF.fd -M q35 vmlinuz0 -s -S -daemonize\n    $ gdb\n    (gdb) target remote localhost:1234\n    (gdb) hb *0x02858f6f\n    Hardware assisted breakpoint 1 at 0x2858f6f\n    (gdb) c\n    Continuing.\n\n    Breakpoint 1, 0x02858f6f in ?? ()\n    (gdb) monitor info registers\n    ...\n    GDT=     0724e000 000000ff\n    IDT=     fffbb000 000007ff\n    CR0=0005003b CR2=ff896000 CR3=032b7000 CR4=00000690\n    ...\n\nThe page directory is sane:\n\n    (gdb) x/4wx 0x32b7000\n    0x32b7000:\t0x03398063\t0x03399063\t0x0339a063\t0x0339b063\n    (gdb) x/4wx 0x3398000\n    0x3398000:\t0x00000163\t0x00001163\t0x00002163\t0x00003163\n    (gdb) x/4wx 0x3399000\n    0x3399000:\t0x00400003\t0x00401003\t0x00402003\t0x00403003\n\nbut our particular page directory entry is empty:\n\n    (gdb) x/1wx 0x32b7000 + (0x724e000 >> 22) * 4\n    0x32b7070:\t0x00000000\n\n[ It appears that you can skate past this issue if you don't receive\n  any interrupts while the bogus GDT pointer is loaded, or if you avoid\n  reloading the segment registers in general.\n\n  Andy Lutomirski provides some additional insight:\n\n   \"AFAICT it's entirely permissible for the GDTR and/or LDT\n    descriptor to point to unmapped memory.  Any attempt to use them\n    (segment loads, interrupts, IRET, etc) will try to access that memory\n    as if the access came from CPL 0 and, if the access fails, will\n    generate a valid page fault with CR2 pointing into the GDT or\n    LDT.\"\n\n  Up until commit 23a0d4e8fa6d (\"efi: Disable interrupts around EFI\n  calls, not in the epilog/prolog calls\") interrupts were disabled\n  around the prolog and epilog calls, and the functional GDT was\n  re-installed before interrupts were re-enabled.\n\n  Which explains why no one has hit this issue until now. ]\n\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nReported-by: Laszlo Ersek <lersek@redhat.com>\nCc: <stable@vger.kernel.org>\nCc: Borislav Petkov <bp@alien8.de>\nCc: \"H. Peter Anvin\" <hpa@zytor.com>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Ingo Molnar <mingo@kernel.org>\nCc: Andy Lutomirski <luto@amacapital.net>\nSigned-off-by: Matt Fleming <matt.fleming@intel.com>\n[ Updated changelog. ]\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/d5906127cbdb2df9856979e66a20d5b3a4d81ba7"},{"sha":"40e2fa123cef06e4bdfb9f97ebeacbb11c44cda1","author":{"name":"Krzysztof Mazur","email":"3aa2e1151f06c0d91136b89eeba44817aed9e55b@podlesie.net"},"message":"x86/setup: Fix low identity map for >= 2GB kernel range\n\ncommit 68accac392d859d24adcf1be3a90e41f978bd54c upstream.\n\nThe commit f5f3497cad8c extended the low identity mapping. However, if\nthe kernel uses more than 2 GB (VMSPLIT_2G_OPT or VMSPLIT_1G memory\nsplit), the normal memory mapping is overwritten by the low identity\nmapping causing a crash. To avoid overwritting, limit the low identity\nmap to cover only memory before kernel range (PAGE_OFFSET).\n\nFixes: f5f3497cad8c \"x86/setup: Extend low identity map to cover whole kernel range\nSigned-off-by: Krzysztof Mazur <krzysiek@podlesie.net>\nCc: Andy Lutomirski <luto@amacapital.net>\nCc: Borislav Petkov <bp@alien8.de>\nCc: Laszlo Ersek <lersek@redhat.com>\nCc: Matt Fleming <matt.fleming@intel.com>\nCc: Paolo Bonzini <pbonzini@redhat.com>\nLink: http://lkml.kernel.org/r/1446815916-22105-1-git-send-email-krzysiek@podlesie.net\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/40e2fa123cef06e4bdfb9f97ebeacbb11c44cda1"},{"sha":"1bb89cf80bfb2514b8e2a5c31fd9ffe8b5316f5f","author":{"name":"Borislav Petkov","email":"eb590213a9667d8ba86dc1d7da45a37c724b7836@suse.de"},"message":"x86/cpu: Call verify_cpu() after having entered long mode too\n\ncommit 04633df0c43d710e5f696b06539c100898678235 upstream.\n\nWhen we get loaded by a 64-bit bootloader, kernel entry point is\nstartup_64 in head_64.S. We don't trust any and all bootloaders because\nsome will fiddle with CPU configuration so we go ahead and massage each\nCPU into sanity again.\n\nFor example, some dell BIOSes have this XD disable feature which set\nIA32_MISC_ENABLE[34] and disable NX. This might be some dumb workaround\nfor other OSes but Linux sure doesn't need it.\n\nA similar thing is present in the Surface 3 firmware - see\nhttps://bugzilla.kernel.org/show_bug.cgi?id=106051 - which sets this bit\nonly on the BSP:\n\n  # rdmsr -a 0x1a0\n  400850089\n  850089\n  850089\n  850089\n\nI know, right?!\n\nThere's not even an off switch in there.\n\nSo fix all those cases by sanitizing the 64-bit entry point too. For\nthat, make verify_cpu() callable in 64-bit mode also.\n\nRequested-and-debugged-by: \"H. Peter Anvin\" <hpa@zytor.com>\nReported-and-tested-by: Bastien Nocera <bugzilla@hadess.net>\nSigned-off-by: Borislav Petkov <bp@suse.de>\nCc: Matt Fleming <matt@codeblueprint.co.uk>\nCc: Peter Zijlstra <peterz@infradead.org>\nLink: http://lkml.kernel.org/r/1446739076-21303-1-git-send-email-bp@alien8.de\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/1bb89cf80bfb2514b8e2a5c31fd9ffe8b5316f5f"},{"sha":"5ff3bc2007ffa4df03426fd70d008199836ebbcb","author":{"name":"Andrew Cooper","email":"ce6e7acce1f5d55db389f61db68b4ce33f3ea3e3@citrix.com"},"message":"x86/cpu: Fix SMAP check in PVOPS environments\n\ncommit 581b7f158fe0383b492acd1ce3fb4e99d4e57808 upstream.\n\nThere appears to be no formal statement of what pv_irq_ops.save_fl() is\nsupposed to return precisely.  Native returns the full flags, while lguest and\nXen only return the Interrupt Flag, and both have comments by the\nimplementations stating that only the Interrupt Flag is looked at.  This may\nhave been true when initially implemented, but no longer is.\n\nTo make matters worse, the Xen PVOP leaves the upper bits undefined, making\nthe BUG_ON() undefined behaviour.  Experimentally, this now trips for 32bit PV\nguests on Broadwell hardware.  The BUG_ON() is consistent for an individual\nbuild, but not consistent for all builds.  It has also been a sitting timebomb\nsince SMAP support was introduced.\n\nUse native_save_fl() instead, which will obtain an accurate view of the AC\nflag.\n\nSigned-off-by: Andrew Cooper <andrew.cooper3@citrix.com>\nReviewed-by: David Vrabel <david.vrabel@citrix.com>\nTested-by: Rusty Russell <rusty@rustcorp.com.au>\nCc: Rusty Russell <rusty@rustcorp.com.au>\nCc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nCc: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nCc: <lguest@lists.ozlabs.org>\nCc: Xen-devel <xen-devel@lists.xen.org>\nLink: http://lkml.kernel.org/r/1433323874-6927-1-git-send-email-andrew.cooper3@citrix.com\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/5ff3bc2007ffa4df03426fd70d008199836ebbcb"},{"sha":"301561a14a081b4588e0eb01f54320e9403baedc","author":{"name":"Maxime Ripard","email":"27dbea1ad2d497b6a7e1902696ec74054301d6da@free-electrons.com"},"message":"net: mvneta: Fix CPU_MAP registers initialisation\n\ncommit 2502d0ef272da7058ef303b849a2c8dc324c2e2e upstream.\n\nThe CPU_MAP register is duplicated for each CPUs at different addresses,\neach instance being at a different address.\n\nHowever, the code so far was using CONFIG_NR_CPUS to initialise the CPU_MAP\nregisters for each registers, while the SoCs embed at most 4 CPUs.\n\nThis is especially an issue with multi_v7_defconfig, where CONFIG_NR_CPUS\nis currently set to 16, resulting in writes to registers that are not\nCPU_MAP.\n\nFixes: c5aff18204da (\"net: mvneta: driver for Marvell Armada 370/XP network unit\")\nSigned-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>\nSigned-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/301561a14a081b4588e0eb01f54320e9403baedc"},{"sha":"d971eb0cd3ad085ce3fe6da1fed3d5baa80bc9c2","author":{"name":"Dan Carpenter","email":"60b2bf2bc0bec4ca4a4b046ca7ef9255248abff8@oracle.com"},"message":"mwifiex: fix mwifiex_rdeeprom_read()\n\ncommit 1f9c6e1bc1ba5f8a10fcd6e99d170954d7c6d382 upstream.\n\nThere were several bugs here.\n\n1)  The done label was in the wrong place so we didn't copy any\n    information out when there was no command given.\n\n2)  We were using PAGE_SIZE as the size of the buffer instead of\n    \"PAGE_SIZE - pos\".\n\n3)  snprintf() returns the number of characters that would have been\n    printed if there were enough space.  If there was not enough space\n    (and we had fixed the memory corruption bug #2) then it would result\n    in an information leak when we do simple_read_from_buffer().  I've\n    changed it to use scnprintf() instead.\n\nI also removed the initialization at the start of the function, because\nI thought it made the code a little more clear.\n\nFixes: 5e6e3a92b9a4 ('wireless: mwifiex: initial commit for Marvell mwifiex driver')\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nAcked-by: Amitkumar Karwar <akarwar@marvell.com>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/d971eb0cd3ad085ce3fe6da1fed3d5baa80bc9c2"},{"sha":"dd1f73c90f1f23c7749b17c3b9f82096eee72343","author":{"name":"Johannes Berg","email":"9a5936d824e6835dfe162c5611d10d2cf40ffbad@intel.com"},"message":"mac80211: fix driver RSSI event calculations\n\ncommit 8ec6d97871f37e4743678ea4a455bd59580aa0f4 upstream.\n\nThe ifmgd->ave_beacon_signal value cannot be taken as is for\ncomparisons, it must be divided by since it's represented\nlike that for better accuracy of the EWMA calculations. This\nwould lead to invalid driver RSSI events. Fix the used value.\n\nFixes: 615f7b9bb1f8 (\"mac80211: add driver RSSI threshold events\")\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ScrewdAOSP/kernel_lge_bullhead/commits/dd1f73c90f1f23c7749b17c3b9f82096eee72343"}]}
{"actor":{"display_login":"Megatron007"}}