{"push_id":1441795399,"size":422,"distinct_size":422,"ref":"refs/heads/cm-14.1","head":"23ad0a89865862f368eb08c08e1558b5507c214c","before":"77e9bdbbc1e7df7a206ca940580ea74b68e622b8","commits":[{"sha":"ce9588a047eae53baf1607a408a8d1d5363f5fde","author":{"name":"Ben Hutchings","email":"9c85637c38b80821c7bd8a03bde7b59da81ab77d@decadent.org.uk"},"message":"pipe: Fix buffer offset after partially failed read\n\nQuoting the RHEL advisory:\n\n> It was found that the fix for CVE-2015-1805 incorrectly kept buffer\n> offset and buffer length in sync on a failed atomic read, potentially\n> resulting in a pipe buffer state corruption. A local, unprivileged user\n> could use this flaw to crash the system or leak kernel memory to user\n> space. (CVE-2016-0774, Moderate)\n\nThe same flawed fix was applied to stable branches from 2.6.32.y to\n3.14.y inclusive, and I was able to reproduce the issue on 3.2.y.\nWe need to give pipe_iov_copy_to_user() a separate offset variable\nand only update the buffer offset if it succeeds.\n\nReferences: https://rhn.redhat.com/errata/RHSA-2016-0103.html\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/ce9588a047eae53baf1607a408a8d1d5363f5fde"},{"sha":"c9950bcb9176a740bc82df4174022c974cb601db","author":{"name":"Kamal Mostafa","email":"4e00da2bd05698b8728096b5cf26e061b3071b8a@canonical.com"},"message":"x86/iopl/64: Properly context-switch IOPL on Xen PV\n\ncommit b7a584598aea7ca73140cb87b40319944dd3393f upstream.\n\nFrom: Andy Lutomirski <luto@kernel.org>\n\nOn Xen PV, regs->flags doesn't reliably reflect IOPL and the\nexit-to-userspace code doesn't change IOPL.  We need to context\nswitch it manually.\n\nI'm doing this without going through paravirt because this is\nspecific to Xen PV.  After the dust settles, we can merge this with\nthe 32-bit code, tidy up the iopl syscall implementation, and remove\nthe set_iopl pvop entirely.\n\nFixes XSA-171.\n\nReviewewd-by: Jan Beulich <JBeulich@suse.com>\nSigned-off-by: Andy Lutomirski <luto@kernel.org>\nCc: Andrew Cooper <andrew.cooper3@citrix.com>\nCc: Andy Lutomirski <luto@amacapital.net>\nCc: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nCc: Borislav Petkov <bp@alien8.de>\nCc: Brian Gerst <brgerst@gmail.com>\nCc: David Vrabel <david.vrabel@citrix.com>\nCc: Denys Vlasenko <dvlasenk@redhat.com>\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: Jan Beulich <JBeulich@suse.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nLink: http://lkml.kernel.org/r/693c3bd7aeb4d3c27c92c622b7d0f554a458173c.1458162709.git.luto@kernel.org\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\n[ kamal: backport to 3.19-stable: no X86_FEATURE_XENPV so just call\n  xen_pv_domain() directly ]\nAcked-by: Andy Lutomirski <luto@kernel.org>\nSigned-off-by: Kamal Mostafa <kamal@canonical.com>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/c9950bcb9176a740bc82df4174022c974cb601db"},{"sha":"308f438aa483b50a316122af37e215085f073b86","author":{"name":"Eryu Guan","email":"fa2ecac546f88ebcf0cdbed021158276ba9e8154@gmail.com"},"message":"ext4: fix NULL pointer dereference in ext4_mark_inode_dirty()\n\ncommit 5e1021f2b6dff1a86a468a1424d59faae2bc63c1 upstream.\n\next4_reserve_inode_write() in ext4_mark_inode_dirty() could fail on\nerror (e.g. EIO) and iloc.bh can be NULL in this case. But the error is\nignored in the following \"if\" condition and ext4_expand_extra_isize()\nmight be called with NULL iloc.bh set, which triggers NULL pointer\ndereference.\n\nThis is uncovered by commit 8b4953e13f4c (\"ext4: reserve code points for\nthe project quota feature\"), which enlarges the ext4_inode size, and\nrun the following script on new kernel but with old mke2fs:\n\n  #/bin/bash\n  mnt=/mnt/ext4\n  devname=ext4-error\n  dev=/dev/mapper/$devname\n  fsimg=/home/fs.img\n\n  trap cleanup 0 1 2 3 9 15\n\n  cleanup()\n  {\n          umount $mnt >/dev/null 2>&1\n          dmsetup remove $devname\n          losetup -d $backend_dev\n          rm -f $fsimg\n          exit 0\n  }\n\n  rm -f $fsimg\n  fallocate -l 1g $fsimg\n  backend_dev=`losetup -f --show $fsimg`\n  devsize=`blockdev --getsz $backend_dev`\n\n  good_tab=\"0 $devsize linear $backend_dev 0\"\n  error_tab=\"0 $devsize error $backend_dev 0\"\n\n  dmsetup create $devname --table \"$good_tab\"\n\n  mkfs -t ext4 $dev\n  mount -t ext4 -o errors=continue,strictatime $dev $mnt\n\n  dmsetup load $devname --table \"$error_tab\" && dmsetup resume $devname\n  echo 3 > /proc/sys/vm/drop_caches\n  ls -l $mnt\n  exit 0\n\n[ Patch changed to simplify the function a tiny bit. -- Ted ]\n\nSigned-off-by: Eryu Guan <guaneryu@gmail.com>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/308f438aa483b50a316122af37e215085f073b86"},{"sha":"a4a4f1cd733fe5b345db4e8cc19bb8868d562a8a","author":{"name":"Joe Perches","email":"d2ff8d83efb8d5aeb4f4e85388fa7e6f5a2df730@perches.com"},"message":"compiler-gcc: integrate the various compiler-gcc[345].h files\n\ncommit cb984d101b30eb7478d32df56a0023e4603cba7f upstream.\n\nAs gcc major version numbers are going to advance rather rapidly in the\nfuture, there's no real value in separate files for each compiler\nversion.\n\nDeduplicate some of the macros #defined in each file too.\n\nNeaten comments using normal kernel commenting style.\n\nSigned-off-by: Joe Perches <joe@perches.com>\nCc: Andi Kleen <andi@firstfloor.org>\nCc: Michal Marek <mmarek@suse.cz>\nCc: Segher Boessenkool <segher@kernel.crashing.org>\nCc: Sasha Levin <levinsasha928@gmail.com>\nCc: Anton Blanchard <anton@samba.org>\nCc: Alan Modra <amodra@gmail.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n[ philm: backport to 3.10-stable ]\nSigned-off-by: Philip M�ller <philm@manjaro.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/a4a4f1cd733fe5b345db4e8cc19bb8868d562a8a"},{"sha":"d4d37e92e07e914642935865c6316afc3fe15a14","author":{"name":"Behan Webster","email":"89ff55df8dec2a7b887258721ec351b303b21a36@converseincode.com"},"message":"x86: LLVMLinux: Fix \"incomplete type const struct x86cpu_device_id\"\n\ncommit c4586256f0c440bc2bdb29d2cbb915f0ca785d26 upstream.\n\nSimilar to the fix in 40413dcb7b273bda681dca38e6ff0bbb3728ef11\n\nMODULE_DEVICE_TABLE(x86cpu, ...) expects the struct to be called struct\nx86cpu_device_id, and not struct x86_cpu_id which is what is used in the rest\nof the kernel code.  Although gcc seems to ignore this error, clang fails\nwithout this define to fix the name.\n\nCode from drivers/thermal/x86_pkg_temp_thermal.c\nstatic const struct x86_cpu_id __initconst pkg_temp_thermal_ids[] = { ... };\nMODULE_DEVICE_TABLE(x86cpu, pkg_temp_thermal_ids);\n\nError from clang:\ndrivers/thermal/x86_pkg_temp_thermal.c:577:1: error: variable has\n      incomplete type 'const struct x86cpu_device_id'\nMODULE_DEVICE_TABLE(x86cpu, pkg_temp_thermal_ids);\n^\ninclude/linux/module.h:145:3: note: expanded from macro\n      'MODULE_DEVICE_TABLE'\n  MODULE_GENERIC_TABLE(type##_device, name)\n  ^\ninclude/linux/module.h:87:32: note: expanded from macro\n      'MODULE_GENERIC_TABLE'\nextern const struct gtype##_id __mod_##gtype##_table            \\\n                               ^\n<scratch space>:143:1: note: expanded from here\n__mod_x86cpu_device_table\n^\ndrivers/thermal/x86_pkg_temp_thermal.c:577:1: note: forward declaration of\n      'struct x86cpu_device_id'\ninclude/linux/module.h:145:3: note: expanded from macro\n      'MODULE_DEVICE_TABLE'\n  MODULE_GENERIC_TABLE(type##_device, name)\n  ^\ninclude/linux/module.h:87:21: note: expanded from macro\n      'MODULE_GENERIC_TABLE'\nextern const struct gtype##_id __mod_##gtype##_table            \\\n                    ^\n<scratch space>:141:1: note: expanded from here\nx86cpu_device_id\n^\n1 error generated.\n\nSigned-off-by: Behan Webster <behanw@converseincode.com>\nSigned-off-by: Jan-Simon M�ller <dl9pf@gmx.de>\nAcked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: philm@manjaro.org\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/d4d37e92e07e914642935865c6316afc3fe15a14"},{"sha":"a6821c1796d76e8b51c8ec9f05f603569bd7c918","author":{"name":"Radim Kr��m����","email":"468295613cb0a835b9dff6e08fea8a1219c56a14@redhat.com"},"message":"KVM: i8254: change PIT discard tick policy\n\ncommit 7dd0fdff145c5be7146d0ac06732ae3613412ac1 upstream.\n\nDiscard policy uses ack_notifiers to prevent injection of PIT interrupts\nbefore EOI from the last one.\n\nThis patch changes the policy to always try to deliver the interrupt,\nwhich makes a difference when its vector is in ISR.\nOld implementation would drop the interrupt, but proposed one injects to\nIRR, like real hardware would.\n\nThe old policy breaks legacy NMI watchdogs, where PIT is used through\nvirtual wire (LVT0): PIT never sends an interrupt before receiving EOI,\nthus a guest deadlock with disabled interrupts will stop NMIs.\n\nNote that NMI doesn't do EOI, so PIT also had to send a normal interrupt\nthrough IOAPIC.  (KVM's PIT is deeply rotten and luckily not used much\nin modern systems.)\n\nEven though there is a chance of regressions, I think we can fix the\nLVT0 NMI bug without introducing a new tick policy.\n\nCc: <stable@vger.kernel.org>\nReported-by: Yuki Shibuya <shibuya.yk@ncos.nec.co.jp>\nReviewed-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Radim Krčmář <rkrcmar@redhat.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/a6821c1796d76e8b51c8ec9f05f603569bd7c918"},{"sha":"f556290916cc40b8504f9f20baf21e7099a77376","author":{"name":"Paolo Bonzini","email":"7438500e0207b21c4e5dfca8d2a7898734cd7706@redhat.com"},"message":"KVM: fix spin_lock_init order on x86\n\ncommit e9ad4ec8379ad1ba6f68b8ca1c26b50b5ae0a327 upstream.\n\nMoving the initialization earlier is needed in 4.6 because\nkvm_arch_init_vm is now using mmu_lock, causing lockdep to\ncomplain:\n\n[  284.440294] INFO: trying to register non-static key.\n[  284.445259] the code is fine but needs lockdep annotation.\n[  284.450736] turning off the locking correctness validator.\n...\n[  284.528318]  [<ffffffff810aecc3>] lock_acquire+0xd3/0x240\n[  284.533733]  [<ffffffffa0305aa0>] ? kvm_page_track_register_notifier+0x20/0x60 [kvm]\n[  284.541467]  [<ffffffff81715581>] _raw_spin_lock+0x41/0x80\n[  284.546960]  [<ffffffffa0305aa0>] ? kvm_page_track_register_notifier+0x20/0x60 [kvm]\n[  284.554707]  [<ffffffffa0305aa0>] kvm_page_track_register_notifier+0x20/0x60 [kvm]\n[  284.562281]  [<ffffffffa02ece70>] kvm_mmu_init_vm+0x20/0x30 [kvm]\n[  284.568381]  [<ffffffffa02dbf7a>] kvm_arch_init_vm+0x1ea/0x200 [kvm]\n[  284.574740]  [<ffffffffa02bff3f>] kvm_dev_ioctl+0xbf/0x4d0 [kvm]\n\nHowever, it also helps fixing a preexisting problem, which is why this\npatch is also good for stable kernels: kvm_create_vm was incrementing\ncurrent->mm->mm_count but not decrementing it at the out_err label (in\ncase kvm_init_mmu_notifier failed).  The new initialization order makes\nit possible to add the required mmdrop without adding a new error label.\n\nReported-by: Borislav Petkov <bp@alien8.de>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/f556290916cc40b8504f9f20baf21e7099a77376"},{"sha":"a3fda4b44dc0a885a08d634e423cfb7e0dfb99e1","author":{"name":"Dan Carpenter","email":"60b2bf2bc0bec4ca4a4b046ca7ef9255248abff8@oracle.com"},"message":"EDAC, amd64_edac: Shift wrapping issue in f1x_get_norm_dct_addr()\n\ncommit 6f3508f61c814ee852c199988a62bd954c50dfc1 upstream.\n\ndct_sel_base_off is declared as a u64 but we're only using the lower 32\nbits because of a shift wrapping bug. This can possibly truncate the\nupper 16 bits of DctSelBaseOffset[47:26], causing us to misdecode the CS\nrow.\n\nFixes: c8e518d5673d ('amd64_edac: Sanitize f10_get_base_addr_offset')\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nCc: Aravind Gopalakrishnan <Aravind.Gopalakrishnan@amd.com>\nCc: linux-edac <linux-edac@vger.kernel.org>\nCc: <stable@vger.kernel.org>\nLink: http://lkml.kernel.org/r/20160120095451.GB19898@mwanda\nSigned-off-by: Borislav Petkov <bp@suse.de>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/a3fda4b44dc0a885a08d634e423cfb7e0dfb99e1"},{"sha":"fa75115240f1930d2364484047ba6bb88ac2a6d2","author":{"name":"Bjorn Helgaas","email":"d58560f8a8eaa2bf0a57092b2469a9a49461ac56@google.com"},"message":"PCI: Disable IO/MEM decoding for devices with non-compliant BARs\n\ncommit b84106b4e2290c081cdab521fa832596cdfea246 upstream.\n\nThe PCI config header (first 64 bytes of each device's config space) is\ndefined by the PCI spec so generic software can identify the device and\nmanage its usage of I/O, memory, and IRQ resources.\n\nSome non-spec-compliant devices put registers other than BARs where the\nBARs should be.  When the PCI core sizes these \"BARs\", the reads and writes\nit does may have unwanted side effects, and the \"BAR\" may appear to\ndescribe non-sensical address space.\n\nAdd a flag bit to mark non-compliant devices so we don't touch their BARs.\nTurn off IO/MEM decoding to prevent the devices from consuming address\nspace, since we can't read the BARs to find out what that address space\nwould be.\n\nSigned-off-by: Bjorn Helgaas <bhelgaas@google.com>\nTested-by: Andi Kleen <ak@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/fa75115240f1930d2364484047ba6bb88ac2a6d2"},{"sha":"bb37dac1d940c3bfee710c925460a769c00ad7a7","author":{"name":"H. Peter Anvin","email":"2dad3f7077c675f93d9f139c5cc03297031ec6b0@linux.intel.com"},"message":"linux/const.h: Add _BITUL() and _BITULL()\n\ncommit 2fc016c5bd8aad2e201cdf71b9fb4573f94775bd upstream.\n\nAdd macros for single bit definitions of a specific type.  These are\nsimilar to the BIT() macro that already exists, but with a few\nexceptions:\n\n1. The namespace is such that they can be used in uapi definitions.\n2. The type is set with the _AC() macro to allow it to be used in\n   assembly.\n3. The type is explicitly specified to be UL or ULL.\n\nSigned-off-by: H. Peter Anvin <hpa@linux.intel.com>\nLink: http://lkml.kernel.org/n/tip-nbca8p7cg6jyjoit7klh3o91@git.kernel.org\n[wt: backported to 3.10 only to keep next patch clean]\n\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/bb37dac1d940c3bfee710c925460a769c00ad7a7"},{"sha":"f85cb76155fb908b966a422a1a4f6b5f7cce5de2","author":{"name":"H. Peter Anvin","email":"2dad3f7077c675f93d9f139c5cc03297031ec6b0@linux.intel.com"},"message":"x86: Rename X86_CR4_RDWRGSFS to X86_CR4_FSGSBASE\n\ncommit afcbf13fa6d53d8a97eafaca1dcb344331d2ce0c upstream.\n\nRename X86_CR4_RDWRGSFS to X86_CR4_FSGSBASE to match the SDM.\n\nSigned-off-by: H. Peter Anvin <hpa@linux.intel.com>\nCc: Marcelo Tosatti <mtosatti@redhat.com>\nCc: Gleb Natapov <gleb@redhat.com>\nLink: http://lkml.kernel.org/n/tip-buq1evi5dpykxx7ak6amaam0@git.kernel.org\n[wt: backported to 3.10 only to keep next patch clean]\n\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/f85cb76155fb908b966a422a1a4f6b5f7cce5de2"},{"sha":"a47831b0d8428904ef290ad06e3acbd3bb5a8312","author":{"name":"H. Peter Anvin","email":"2dad3f7077c675f93d9f139c5cc03297031ec6b0@linux.intel.com"},"message":"x86, processor-flags: Fix the datatypes and add bit number defines\n\ncommit d1fbefcb3aa608599a3c9e4582cbeeb6ba6c8939 upstream.\n\nThe control registers are unsigned long (32 bits on i386, 64 bits on\nx86-64), and so make that manifest in the data type for the various\nconstants.  Add defines with a _BIT suffix which defines the bit\nnumber, as opposed to the bit mask.\n\nThis should resolve some issues with ~bitmask that Linus discovered.\n\nReported-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: H. Peter Anvin <hpa@linux.intel.com>\nLink: http://lkml.kernel.org/n/tip-cwckhbrib2aux1qbteaebij0@git.kernel.org\n[wt: backported to 3.10 only to keep next patch clean]\n\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/a47831b0d8428904ef290ad06e3acbd3bb5a8312"},{"sha":"721485b62f0f23cf243309ee746cb8d66bd2a079","author":{"name":"Andy Lutomirski","email":"3cb7d5a8804519b67b2d7945dee31e85c91c02f9@kernel.org"},"message":"x86/iopl: Fix iopl capability check on Xen PV\n\ncommit c29016cf41fe9fa994a5ecca607cf5f1cd98801e upstream.\n\niopl(3) is supposed to work if iopl is already 3, even if\nunprivileged.  This didn't work right on Xen PV.  Fix it.\n\nReviewewd-by: Jan Beulich <JBeulich@suse.com>\nSigned-off-by: Andy Lutomirski <luto@kernel.org>\nCc: Andrew Cooper <andrew.cooper3@citrix.com>\nCc: Andy Lutomirski <luto@amacapital.net>\nCc: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nCc: Borislav Petkov <bp@alien8.de>\nCc: Brian Gerst <brgerst@gmail.com>\nCc: David Vrabel <david.vrabel@citrix.com>\nCc: Denys Vlasenko <dvlasenk@redhat.com>\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: Jan Beulich <JBeulich@suse.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: stable@vger.kernel.org\nLink: http://lkml.kernel.org/r/8ce12013e6e4c0a44a97e316be4a6faff31bd5ea.1458162709.git.luto@kernel.org\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/721485b62f0f23cf243309ee746cb8d66bd2a079"},{"sha":"64adb59fc5aec77495432307754228432ce6968d","author":{"name":"Douglas Gilbert","email":"a5714ada1376582f15d7f2634532b6ba35f8f0e0@interlog.com"},"message":"sg: fix dxferp in from_to case\n\ncommit 5ecee0a3ee8d74b6950cb41e8989b0c2174568d4 upstream.\n\nOne of the strange things that the original sg driver did was let the\nuser provide both a data-out buffer (it followed the sg_header+cdb)\n_and_ specify a reply length greater than zero. What happened was that\nthe user data-out buffer was copied into some kernel buffers and then\nthe mid level was told a read type operation would take place with the\ndata from the device overwriting the same kernel buffers. The user would\nthen read those kernel buffers back into the user space.\n\nFrom what I can tell, the above action was broken by commit fad7f01e61bf\n(\"sg: set dxferp to NULL for READ with the older SG interface\") in 2008\nand syzkaller found that out recently.\n\nMake sure that a user space pointer is passed through when data follows\nthe sg_header structure and command.  Fix the abnormal case when a\nnon-zero reply_len is also given.\n\nFixes: fad7f01e61bf737fe8a3740d803f000db57ecac6\nCc: <stable@vger.kernel.org> #v2.6.28+\nSigned-off-by: Douglas Gilbert <dgilbert@interlog.com>\nReviewed-by: Ewan Milne <emilne@redhat.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/64adb59fc5aec77495432307754228432ce6968d"},{"sha":"324d4df9b16f52fc991c91a2dc0cfe31e4894c17","author":{"name":"Raghava Aditya Renukunta","email":"3e9e5147ecbd2b03675c7cf25262cbec220bcc4f@pmcs.com"},"message":"aacraid: Fix memory leak in aac_fib_map_free\n\ncommit f88fa79a61726ce9434df9b4aede36961f709f17 upstream.\n\naac_fib_map_free() calls pci_free_consistent() without checking that\ndev->hw_fib_va is not NULL and dev->max_fib_size is not zero.If they are\nindeed NULL/0, this will result in a hang as pci_free_consistent() will\nattempt to invalidate cache for the entire 64-bit address space\n(which would take a very long time).\n\nFixed by adding a check to make sure that dev->hw_fib_va and\ndev->max_fib_size are not NULL and 0 respectively.\n\nFixes: 9ad5204d6 - \"[SCSI]aacraid: incorrect dma mapping mask during blinked recover or user initiated reset\"\nCc: stable@vger.kernel.org\n\nSigned-off-by: Raghava Aditya Renukunta <raghavaaditya.renukunta@pmcs.com>\nReviewed-by: Johannes Thumshirn <jthumshirn@suse.de>\nReviewed-by: Tomas Henzl <thenzl@redhat.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/324d4df9b16f52fc991c91a2dc0cfe31e4894c17"},{"sha":"eb236fd583ed1138fa1a66151db27e093316f128","author":{"name":"Maurizio Lombardi","email":"d2b383f139ba0f66023b518da6bf284418813077@redhat.com"},"message":"be2iscsi: set the boot_kset pointer to NULL in case of failure\n\ncommit 84bd64993f916bcf86270c67686ecf4cea7b8933 upstream.\n\nIn beiscsi_setup_boot_info(), the boot_kset pointer should be set to\nNULL in case of failure otherwise an invalid pointer dereference may\noccur later.\n\nCc: <stable@vger.kernel.org>\nSigned-off-by: Maurizio Lombardi <mlombard@redhat.com>\nReviewed-by: Johannes Thumshirn <jthumshirn@suse.de>\nReviewed-by: Jitendra Bhivare <jitendra.bhivare@broadcom.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/eb236fd583ed1138fa1a66151db27e093316f128"},{"sha":"68d8ecd4c48051273bbf611c53c260e24a528422","author":{"name":"Oliver Neukum","email":"af55dedc0d50bd691239218b486da844e4a16906@suse.com"},"message":"usb: retry reset if a device times out\n\ncommit 264904ccc33c604d4b3141bbd33808152dfac45b upstream.\n\nSome devices I got show an inability to operate right after\npower on if they are already connected. They are beyond recovery\nif the descriptors are requested multiple times. So in case of\na timeout we rather bail early and reset again. But it must be\ndone only on the first loop lest we get into a reset/time out\nspiral that can be overcome with a retry.\n\nThis patch is a rework of a patch that fell through the cracks.\nhttp://www.spinics.net/lists/linux-usb/msg103263.html\n\nSigned-off-by: Oliver Neukum <oneukum@suse.com>\nCC: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/68d8ecd4c48051273bbf611c53c260e24a528422"},{"sha":"d5f0867608e0fd8369de929d272ecb3ad7e5e654","author":{"name":"Oliver Neukum","email":"af55dedc0d50bd691239218b486da844e4a16906@suse.com"},"message":"USB: cdc-acm: more sanity checking\n\ncommit 8835ba4a39cf53f705417b3b3a94eb067673f2c9 upstream.\n\nAn attack has become available which pretends to be a quirky\ndevice circumventing normal sanity checks and crashes the kernel\nby an insufficient number of interfaces. This patch adds a check\nto the code path for quirky devices.\n\nSigned-off-by: Oliver Neukum <ONeukum@suse.com>\nCC: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/d5f0867608e0fd8369de929d272ecb3ad7e5e654"},{"sha":"28fa0e461bedf9c74932a9fca4b0be9eb440312d","author":{"name":"Josh Boyer","email":"e24ddf329890aac7d3872652a1775b5739162df4@fedoraproject.org"},"message":"USB: iowarrior: fix oops with malicious USB descriptors\n\ncommit 4ec0ef3a82125efc36173062a50624550a900ae0 upstream.\n\nThe iowarrior driver expects at least one valid endpoint.  If given\nmalicious descriptors that specify 0 for the number of endpoints,\nit will crash in the probe function.  Ensure there is at least\none endpoint on the interface before using it.\n\nThe full report of this issue can be found here:\nhttp://seclists.org/bugtraq/2016/Mar/87\n\nReported-by: Ralf Spenneberg <ralf@spenneberg.net>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Josh Boyer <jwboyer@fedoraproject.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/28fa0e461bedf9c74932a9fca4b0be9eb440312d"},{"sha":"1b282e30c7e0ee96c89de0faa6cb5e4e6be45e7b","author":{"name":"Oliver Neukum","email":"af55dedc0d50bd691239218b486da844e4a16906@suse.com"},"message":"USB: usb_driver_claim_interface: add sanity checking\n\ncommit 0b818e3956fc1ad976bee791eadcbb3b5fec5bfd upstream.\n\nAttacks that trick drivers into passing a NULL pointer\nto usb_driver_claim_interface() using forged descriptors are\nknown. This thwarts them by sanity checking.\n\nSigned-off-by: Oliver Neukum <ONeukum@suse.com>\nCC: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_htc_flounder/commits/1b282e30c7e0ee96c89de0faa6cb5e4e6be45e7b"}]}
{"actor":{"display_login":"cm-gerrit"}}