{"push_id":1098576066,"size":262,"distinct_size":262,"ref":"refs/heads/korg/linux-4.1.y","head":"54419e3efcd6677e4b0841666e2fc605d2e5df86","before":"206f91a12c5f69c9b4dfd4e0029043794a046933","commits":[{"sha":"6abe3345f34c113503a5b3f66bd8eb65d980c27f","author":{"email":"9fb354e0a5603a0331399c18f4aa5aab2f9d9c5b@canonical.com","name":"David Henningsson"},"message":"ALSA: hda - Fixup inverted internal mic for Lenovo E50-80\n\n[ Upstream commit 56f27013482c0803d978b667fe85de04ce9357cd ]\n\nInform userspace that one channel of the internal mic has reversed\npolarity, so it does not attempt to add both channels together and\nend up with silence.\n\nCc: stable@vger.kernel.org\nReported-by: Andrzej Mendel <andrzej.mendel@gmail.com>\nAlsa-info: http://www.alsa-project.org/db/?f=3088f82a0cf977855f92af9db8ad406c04f71efa\nBugLink: https://bugs.launchpad.net/bugs/1529624\nSigned-off-by: David Henningsson <david.henningsson@canonical.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/6abe3345f34c113503a5b3f66bd8eb65d980c27f"},{"sha":"97828b710a99325ef8ffeeac7f9f3e356419ed51","author":{"email":"759412786bc533369b22377bf83fb9056c5b25b2@oljud.se","name":"Johan Rastén"},"message":"ALSA: usb-audio: Set correct type for some UAC2 mixer controls.\n\n[ Upstream commit 27c41dad3a012c5acead1d903d1743297457b69c ]\n\nChanged ctl type for Input Gain Control and Input Gain Pad Control to\nUSB_MIXER_S16 as per section 5.2.5.7.11-12 in the USB Audio Class 2.0\ndefinition.\n\nSigned-off-by: Johan Rastén <johan@oljud.se>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/97828b710a99325ef8ffeeac7f9f3e356419ed51"},{"sha":"8d34309045f7d29641305cb2340df008b22c4c5c","author":{"email":"354106e416911844661e1603d99ecf7d1c318dda@jusst.de","name":"Julian Scheel"},"message":"ALSA: usb-audio: Fix parameter block size for UAC2 control requests\n\n[ Upstream commit bc18e31c3042f14fa5f2ff5c21136e2fdf4140f8 ]\n\nUSB Audio Class version 2.0 supports three different parameter block sizes for\nCUR requests, which are 1 byte (5.2.3.1 Layout 1 Parameter Block), 2 bytes\n(5.2.3.2 Layout 2 Parameter Block) and 4 bytes (5.2.3.3 Layout 3 Parameter\nBlock). Use the correct size according to the specific control as it was\nalready done for UACv1. The allocated block size for control requests is\nincreased to support the 4 byte worst case.\n\nSigned-off-by: Julian Scheel <julian@jusst.de>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/8d34309045f7d29641305cb2340df008b22c4c5c"},{"sha":"30e821e1c1f3a6a2d11616a7bb65da28da388f78","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ALSA: usb-audio: Avoid nested autoresume calls\n\n[ Upstream commit 47ab154593827b1a8f0713a2b9dd445753d551d8 ]\n\nAfter the recent fix of runtime PM for USB-audio driver, we got a\nlockdep warning like:\n\n  =============================================\n  [ INFO: possible recursive locking detected ]\n  4.2.0-rc8+ #61 Not tainted\n  ---------------------------------------------\n  pulseaudio/980 is trying to acquire lock:\n   (&chip->shutdown_rwsem){.+.+.+}, at: [<ffffffffa0355dac>] snd_usb_autoresume+0x1d/0x52 [snd_usb_audio]\n  but task is already holding lock:\n   (&chip->shutdown_rwsem){.+.+.+}, at: [<ffffffffa0355dac>] snd_usb_autoresume+0x1d/0x52 [snd_usb_audio]\n\nThis comes from snd_usb_autoresume() invoking down_read() and it's\nused in a nested way.  Although it's basically safe, per se (as these\nare read locks), it's better to reduce such spurious warnings.\n\nThe read lock is needed to guarantee the execution of \"shutdown\"\n(cleanup at disconnection) task after all concurrent tasks are\nfinished.  This can be implemented in another better way.\n\nAlso, the current check of chip->in_pm isn't good enough for\nprotecting the racy execution of multiple auto-resumes.\n\nThis patch rewrites the logic of snd_usb_autoresume() & co; namely,\n- The recursive call of autopm is avoided by the new refcount,\n  chip->active.  The chip->in_pm flag is removed accordingly.\n- Instead of rwsem, another refcount, chip->usage_count, is introduced\n  for tracking the period to delay the shutdown procedure.  At\n  the last clear of this refcount, wake_up() to the shutdown waiter is\n  called.\n- The shutdown flag is replaced with shutdown atomic count; this is\n  for reducing the lock.\n- Two new helpers are introduced to simplify the management of these\n  refcounts; snd_usb_lock_shutdown() increases the usage_count, checks\n  the shutdown state, and does autoresume.  snd_usb_unlock_shutdown()\n  does the opposite.  Most of mixer and other codes just need this,\n  and simply returns an error if it receives an error from lock.\n\nFixes: 9003ebb13f61 ('ALSA: usb-audio: Fix runtime PM unbalance')\nReported-and-tested-by: Alexnader Kuleshov <kuleshovmail@gmail.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/30e821e1c1f3a6a2d11616a7bb65da28da388f78"},{"sha":"46a190e6a3cd8223534614d306ab76b4811b6cc5","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ALSA: usb-audio: Avoid calling usb_autopm_put_interface() at disconnect\n\n[ Upstream commit 5c06d68bc2a174a6b82dce9f100f55173b9a5189 ]\n\nALSA PCM may still have a leftover instance after disconnection and\nit delays its release.  The problem is that the PCM close code path of\nUSB-audio driver has a call of snd_usb_autosuspend().  This involves\nwith the call of usb_autopm_put_interface() and it may lead to a\nkernel Oops due to the NULL object like:\n\n BUG: unable to handle kernel NULL pointer dereference at 0000000000000190\n IP: [<ffffffff815ae7ef>] usb_autopm_put_interface+0xf/0x30 PGD 0\n Call Trace:\n  [<ffffffff8173bd94>] snd_usb_autosuspend+0x14/0x20\n  [<ffffffff817461bc>] snd_usb_pcm_close.isra.14+0x5c/0x90\n  [<ffffffff8174621f>] snd_usb_playback_close+0xf/0x20\n  [<ffffffff816ef58a>] snd_pcm_release_substream.part.36+0x3a/0x90\n  [<ffffffff816ef6b3>] snd_pcm_release+0xa3/0xb0\n  [<ffffffff816debb0>] snd_disconnect_release+0xd0/0xe0\n  [<ffffffff8114d417>] __fput+0x97/0x1d0\n  [<ffffffff8114d589>] ____fput+0x9/0x10\n  [<ffffffff8109e452>] task_work_run+0x72/0x90\n  [<ffffffff81088510>] do_exit+0x280/0xa80\n  [<ffffffff8108996a>] do_group_exit+0x3a/0xa0\n  [<ffffffff8109261f>] get_signal+0x1df/0x540\n  [<ffffffff81040903>] do_signal+0x23/0x620\n  [<ffffffff8114c128>] ? do_readv_writev+0x128/0x200\n  [<ffffffff810012e1>] prepare_exit_to_usermode+0x91/0xd0\n  [<ffffffff810013ba>] syscall_return_slowpath+0x9a/0x120\n  [<ffffffff817587cd>] ? __sys_recvmsg+0x5d/0x70\n  [<ffffffff810d2765>] ? ktime_get_ts64+0x45/0xe0\n  [<ffffffff8115dea0>] ? SyS_poll+0x60/0xf0\n  [<ffffffff818d2327>] int_ret_from_sys_call+0x25/0x8f\n\nWe have already a check of disconnection in snd_usb_autoresume(), but\nthe check is missing its counterpart.  The fix is just to put the same\ncheck in snd_usb_autosuspend(), too.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=109431\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/46a190e6a3cd8223534614d306ab76b4811b6cc5"},{"sha":"a0eb05f661f7b67c497e9647f4fb7593260d4e58","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ALSA: hda - Fix noise on Dell Latitude E6440\n\n[ Upstream commit 86f799b82f5c011404ddef54600bc5e99b7e0cf2 ]\n\nDell Latitude E6440 (1028:05bd) needs the same fixup as applied to\nother Latitude E7xxx models for the click noise due to the recent\npower-saving changes.\n\nBugzilla: http://bugzilla.opensuse.org/show_bug.cgi?id=954876\nCc: <stable@vger.kernel.org> # v4.1+\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/a0eb05f661f7b67c497e9647f4fb7593260d4e58"},{"sha":"1c0c659983aeb05bbc500f1d3f9ba8082313bb12","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ALSA: hda - Add fixup for Dell Latitidue E6540\n\n[ Upstream commit cf52103a218744f3fd18111325c28e95aa9cd226 ]\n\nAnother Dell model, another fixup entry: Latitude E6540 needs the same\nfixup as other Latitude E series as workaround for noise problems.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=104341\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/1c0c659983aeb05bbc500f1d3f9ba8082313bb12"},{"sha":"af24c621219ec87b221c1bbade56a506bf09deb9","author":{"email":"b3e8ff7ac1c7e75661e16152a5dce1ff36a3e140@adirat.com","name":"Ioan-Adrian Ratiu"},"message":"HID: usbhid: fix recursive deadlock\n\n[ Upstream commit e470127e9606b1fa151c4184243e61296d1e0c0f ]\n\nThe critical section protected by usbhid->lock in hid_ctrl() is too\nbig and because of this it causes a recursive deadlock. \"Too big\" means\nthe case statement and the call to hid_input_report() do not need to be\nprotected by the spinlock (no URB operations are done inside them).\n\nThe deadlock happens because in certain rare cases drivers try to grab\nthe lock while handling the ctrl irq which grabs the lock before them\nas described above. For example newer wacom tablets like 056a:033c try\nto reschedule proximity reads from wacom_intuos_schedule_prox_event()\ncalling hid_hw_request() -> usbhid_request() -> usbhid_submit_report()\nwhich tries to grab the usbhid lock already held by hid_ctrl().\n\nThere are two ways to get out of this deadlock:\n    1. Make the drivers work \"around\" the ctrl critical region, in the\n    wacom case for ex. by delaying the scheduling of the proximity read\n    request itself to a workqueue.\n    2. Shrink the critical region so the usbhid lock protects only the\n    instructions which modify usbhid state, calling hid_input_report()\n    with the spinlock unlocked, allowing the device driver to grab the\n    lock first, finish and then grab the lock afterwards in hid_ctrl().\n\nThis patch implements the 2nd solution.\n\nSigned-off-by: Ioan-Adrian Ratiu <adi@adirat.com>\nSigned-off-by: Jiri Kosina <jkosina@suse.cz>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/af24c621219ec87b221c1bbade56a506bf09deb9"},{"sha":"7abe6e3537a321a332dc6320f22f27e3e11db750","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ALSA: hda - Implement loopback control switch for Realtek and other codecs\n\n[ Upstream commit e7fdd52779a6c2b49d457f452296a77c8cffef6a ]\n\nMany codecs, typically found on Realtek codecs, have the analog\nloopback path merged to the secondary input of the middle of the\noutput paths.  Currently, we don't offer the dynamic switching in such\nconfiguration but let each loopback path mute by itself.\n\nThis should work well in theory, but in reality, we often see that\nsuch a dead loopback path causes some background noises even if all\nthe elements get muted.  Such a problem has been fixed by adding the\nquirk accordingly to disable aamix, and it's the right fix, per se.\nThe only problem is that it's not so trivial to achieve it; user needs\nto pass a hint string via patch module option or sysfs.\n\nThis patch gives a bit improvement on the situation: it adds \"Loopback\nMixing\" control element for such codecs like other codecs (e.g. IDT or\nVIA codecs) with the individual loopback paths.  User can turn on/off\nthe loopback path simply via a mixer app.\n\nFor keeping the compatibility, the loopback is still enabled on these\ncodecs.  But user can try to turn it off if experiencing a suspicious\nbackground or click noise on the fly, then build a static fixup later\nonce after the problem is addressed.\n\nOther than the addition of the loopback enable/disablement control,\nthere should be no changes.\n\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/7abe6e3537a321a332dc6320f22f27e3e11db750"},{"sha":"8cf0abcfb3b1ce60a9bd866db451a093dc015233","author":{"email":"c41808f1f1b2f68f735a9a29ebf17ff9d0e25dc6@linux.vnet.ibm.com","name":"Raghavendra K T"},"message":"sched: Fix crash in sched_init_numa()\n\n[ Upstream commit 9c03ee147193645be4c186d3688232fa438c57c7 ]\n\nThe following PowerPC commit:\n\n  c118baf80256 (\"arch/powerpc/mm/numa.c: do not allocate bootmem memory for non existing nodes\")\n\navoids allocating bootmem memory for non existent nodes.\n\nBut when DEBUG_PER_CPU_MAPS=y is enabled, my powerNV system failed to boot\nbecause in sched_init_numa(), cpumask_or() operation was done on\nunallocated nodes.\n\nFix that by making cpumask_or() operation only on existing nodes.\n\n[ Tested with and w/o DEBUG_PER_CPU_MAPS=y on x86 and PowerPC. ]\n\nReported-by: Jan Stancek <jstancek@redhat.com>\nTested-by: Jan Stancek <jstancek@redhat.com>\nSigned-off-by: Raghavendra K T <raghavendra.kt@linux.vnet.ibm.com>\nCc: <gkurz@linux.vnet.ibm.com>\nCc: <grant.likely@linaro.org>\nCc: <nikunj@linux.vnet.ibm.com>\nCc: <vdavydov@parallels.com>\nCc: <linuxppc-dev@lists.ozlabs.org>\nCc: <linux-mm@kvack.org>\nCc: <peterz@infradead.org>\nCc: <benh@kernel.crashing.org>\nCc: <paulus@samba.org>\nCc: <mpe@ellerman.id.au>\nCc: <anton@samba.org>\nLink: http://lkml.kernel.org/r/1452884483-11676-1-git-send-email-raghavendra.kt@linux.vnet.ibm.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/8cf0abcfb3b1ce60a9bd866db451a093dc015233"},{"sha":"93d310f6cfd51d7158e2901b0f75babeaf97f3c3","author":{"email":"7a0e50e3f6a0939db82b6a8a423c08a163896f41@redhat.com","name":"Benjamin Tissoires"},"message":"HID: multitouch: fix input mode switching on some Elan panels\n\n[ Upstream commit 73e7d63efb4d774883a338997943bfa59e127085 ]\n\nas reported by https://bugzilla.kernel.org/show_bug.cgi?id=108481\n\nThis bug reports mentions 6d4f5440 (\"HID: multitouch: Fetch feature\nreports on demand for Win8 devices\") as the origin of the problem but this\ncommit actually masked 2 firmware bugs that are annihilating each other:\n\nThe report descriptor declares two features in reports 3 and 5:\n\n0x05, 0x0d,                    // Usage Page (Digitizers)             318\n0x09, 0x0e,                    // Usage (Device Configuration)        320\n0xa1, 0x01,                    // Collection (Application)            322\n0x85, 0x03,                    //  Report ID (3)                      324\n0x09, 0x22,                    //  Usage (Finger)                     326\n0xa1, 0x00,                    //  Collection (Physical)              328\n0x09, 0x52,                    //   Usage (Inputmode)                 330\n0x15, 0x00,                    //   Logical Minimum (0)               332\n0x25, 0x0a,                    //   Logical Maximum (10)              334\n0x75, 0x08,                    //   Report Size (8)                   336\n0x95, 0x02,                    //   Report Count (2)                  338\n0xb1, 0x02,                    //   Feature (Data,Var,Abs)            340\n0xc0,                          //  End Collection                     342\n0x09, 0x22,                    //  Usage (Finger)                     343\n0xa1, 0x00,                    //  Collection (Physical)              345\n0x85, 0x05,                    //   Report ID (5)                     347\n0x09, 0x57,                    //   Usage (Surface Switch)            349\n0x09, 0x58,                    //   Usage (Button Switch)             351\n0x15, 0x00,                    //   Logical Minimum (0)               353\n0x75, 0x01,                    //   Report Size (1)                   355\n0x95, 0x02,                    //   Report Count (2)                  357\n0x25, 0x03,                    //   Logical Maximum (3)               359\n0xb1, 0x02,                    //   Feature (Data,Var,Abs)            361\n0x95, 0x0e,                    //   Report Count (14)                 363\n0xb1, 0x03,                    //   Feature (Cnst,Var,Abs)            365\n0xc0,                          //  End Collection                     367\n\nThe report ID 3 presents 2 input mode features, while only the first one\nis handled by the device. Given that we did not checked if one was\npreviously assigned, we were dealing with the ignored featured and we\nshould never have been able to switch this panel into the multitouch mode.\n\nHowever, the firmware presents an other bugs which allowed 6d4f5440\nto counteract the faulty report descriptor. When we request the values\nof the feature 5, the firmware answers \"03 03 00\". The fields are correct\nbut the report id is wrong. Before 6d4f5440, we retrieved all the features\nand injected them in the system. So when we called report 5, we injected\nin the system the report 3 with the values \"03 00\".\nSetting the second input mode to 03 in this report changed it to \"03 03\"\nand the touchpad switched to the mt mode. We could have set anything\nin the second field because the actual value (the first 03 in this report)\nwas given by the query of report ID 5.\n\nTo sum up: 2 bugs in the firmware were hiding that we were accessing the\nwrong feature.\n\nSigned-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>\nSigned-off-by: Jiri Kosina <jkosina@suse.cz>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/93d310f6cfd51d7158e2901b0f75babeaf97f3c3"},{"sha":"ab88ce5feca4204ecf4e7ef6c6693ff67edc2169","author":{"email":"1ff1d5ceb421971f93e6626b02a9591b29d7600e@thejh.net","name":"Jann Horn"},"message":"ptrace: use fsuid, fsgid, effective creds for fs access checks\n\n[ Upstream commit caaee6234d05a58c5b4d05e7bf766131b810a657 ]\n\nBy checking the effective credentials instead of the real UID / permitted\ncapabilities, ensure that the calling process actually intended to use its\ncredentials.\n\nTo ensure that all ptrace checks use the correct caller credentials (e.g.\nin case out-of-tree code or newly added code omits the PTRACE_MODE_*CREDS\nflag), use two new flags and require one of them to be set.\n\nThe problem was that when a privileged task had temporarily dropped its\nprivileges, e.g.  by calling setreuid(0, user_uid), with the intent to\nperform following syscalls with the credentials of a user, it still passed\nptrace access checks that the user would not be able to pass.\n\nWhile an attacker should not be able to convince the privileged task to\nperform a ptrace() syscall, this is a problem because the ptrace access\ncheck is reused for things in procfs.\n\nIn particular, the following somewhat interesting procfs entries only rely\non ptrace access checks:\n\n /proc/$pid/stat - uses the check for determining whether pointers\n     should be visible, useful for bypassing ASLR\n /proc/$pid/maps - also useful for bypassing ASLR\n /proc/$pid/cwd - useful for gaining access to restricted\n     directories that contain files with lax permissions, e.g. in\n     this scenario:\n     lrwxrwxrwx root root /proc/13020/cwd -> /root/foobar\n     drwx------ root root /root\n     drwxr-xr-x root root /root/foobar\n     -rw-r--r-- root root /root/foobar/secret\n\nTherefore, on a system where a root-owned mode 6755 binary changes its\neffective credentials as described and then dumps a user-specified file,\nthis could be used by an attacker to reveal the memory layout of root's\nprocesses or reveal the contents of files he is not allowed to access\n(through /proc/$pid/cwd).\n\n[akpm@linux-foundation.org: fix warning]\nSigned-off-by: Jann Horn <jann@thejh.net>\nAcked-by: Kees Cook <keescook@chromium.org>\nCc: Casey Schaufler <casey@schaufler-ca.com>\nCc: Oleg Nesterov <oleg@redhat.com>\nCc: Ingo Molnar <mingo@redhat.com>\nCc: James Morris <james.l.morris@oracle.com>\nCc: \"Serge E. Hallyn\" <serge.hallyn@ubuntu.com>\nCc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>\nCc: Andy Lutomirski <luto@kernel.org>\nCc: Al Viro <viro@zeniv.linux.org.uk>\nCc: \"Eric W. Biederman\" <ebiederm@xmission.com>\nCc: Willy Tarreau <w@1wt.eu>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/ab88ce5feca4204ecf4e7ef6c6693ff67edc2169"},{"sha":"3e77cb858ce67861e142186e3b131c04ddbc6edd","author":{"email":"3318dc5ce3e4fb7c28a0b841b6801c884e1d0896@metafoo.de","name":"Lars-Peter Clausen"},"message":"iio: adis_buffer: Fix out-of-bounds memory access\n\n[ Upstream commit d590faf9e8f8509a0a0aa79c38e87fcc6b913248 ]\n\nThe SPI tx and rx buffers are both supposed to be scan_bytes amount of\nbytes large and a common allocation is used to allocate both buffers. This\nputs the beginning of the tx buffer scan_bytes bytes after the rx buffer.\nThe initialization of the tx buffer pointer is done adding scan_bytes to\nthe beginning of the rx buffer, but since the rx buffer is of type __be16\nthis will actually add two times as much and the tx buffer ends up pointing\nafter the allocated buffer.\n\nFix this by using scan_count, which is scan_bytes / 2, instead of\nscan_bytes when initializing the tx buffer pointer.\n\nFixes: aacff892cbd5 (\"staging:iio:adis: Preallocate transfer message\")\nSigned-off-by: Lars-Peter Clausen <lars@metafoo.de>\nCc: <Stable@vger.kernel.org>\nSigned-off-by: Jonathan Cameron <jic23@kernel.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/3e77cb858ce67861e142186e3b131c04ddbc6edd"},{"sha":"5b20b25abab6faba0c91a4d7ccde93e134f29d6d","author":{"email":"e9e238ed8689f868e810067ba004813963311d01@gmail.com","name":"Yong Li"},"message":"iio: dac: mcp4725: set iio name property in sysfs\n\n[ Upstream commit 97a249e98a72d6b79fb7350a8dd56b147e9d5bdb ]\n\nWithout this change, the name entity for mcp4725 is missing in\n/sys/bus/iio/devices/iio\\:device*/name\n\nWith this change, name is reported correctly\n\nSigned-off-by: Yong Li <sdliyong@gmail.com>\nCc: <Stable@vger.kernel.org>\nSigned-off-by: Jonathan Cameron <jic23@kernel.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/5b20b25abab6faba0c91a4d7ccde93e134f29d6d"},{"sha":"17fe8c8b306e4b76078b8b103e1f344970409378","author":{"email":"3807cf899f217da549814bf6c330d3b6e6819ccf@gmail.com","name":"Akinobu Mita"},"message":"iio: pressure: mpl115: fix temperature offset sign\n\n[ Upstream commit 431386e783a3a6c8b7707bee32d18c353b8688b2 ]\n\nAccording to the datasheet, the resolusion of temperature sensor is\n-5.35 counts/C. Temperature ADC is 472 counts at 25C.\n(https://www.sparkfun.com/datasheets/Sensors/Pressure/MPL115A1.pdf\nNOTE: This is older revision, but this information is removed from the\nlatest datasheet from nxp somehow)\n\nTemp [C] = (Tadc - 472) / -5.35 + 25\n         = (Tadc - 605.750000) * -0.186915888\n\nSo the correct offset is -605.750000.\n\nSigned-off-by: Akinobu Mita <akinobu.mita@gmail.com>\nAcked-by: Peter Meerwald-Stadler <pmeerw@pmeerw.net>\nCc: <Stable@vger.kernel.org>\nSigned-off-by: Jonathan Cameron <jic23@kernel.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/17fe8c8b306e4b76078b8b103e1f344970409378"},{"sha":"24e6deaf40a702d1f6bf3cc7b809945cca867c58","author":{"email":"1001e8702733cced254345e193c88aaa47a4f5de@atomide.com","name":"Tony Lindgren"},"message":"ARM: OMAP2+: Fix l2_inv_api_params for rodata\n\n[ Upstream commit 0a0b13275558c32bbf6241464a7244b1ffd5afb3 ]\n\nWe don't want to write to .text, so let's move l2_inv_api_params\nto .data and access it via a pointer.\n\nCc: Kees Cook <keescook@chromium.org>\nCc: Laura Abbott <labbott@redhat.com>\nCc: Nishanth Menon <nm@ti.com>\nCc: Richard Woodruff <r-woodruff2@ti.com>\nCc: Russell King <linux@arm.linux.org.uk>\nCc: Tero Kristo <t-kristo@ti.com>\nAcked-by: Nicolas Pitre <nico@linaro.org>\nCc: stable@vger.kernel.org # v4.0+\nFixes: 1e6b48116a95 (\"ARM: mm: allow non-text sections to be\nnon-executable\")\nSigned-off-by: Tony Lindgren <tony@atomide.com>\n\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/24e6deaf40a702d1f6bf3cc7b809945cca867c58"},{"sha":"b7fcd843be1d376f5e43226227707422f74901c7","author":{"email":"1c24ea00d8ce704dffa3997c81be1310fc2bbac6@libc.org","name":"Rich Felker"},"message":"MAINTAINERS: return arch/sh to maintained state, with new maintainers\n\n[ Upstream commit 114bf37e04d839b555b3dc460b5e6ce156f49cf0 ]\n\nAdd Yoshinori Sato and Rich Felker as maintainers for arch/sh\n(SUPERH).\n\nSigned-off-by: Rich Felker <dalias@libc.org>\nSigned-off-by: Yoshinori Sato <ysato@users.sourceforge.jp>\nAcked-by: D. Jeff Dionne <jeff@uClinux.org>\nAcked-by: Rob Landley <rob@landley.net>\nAcked-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nAcked-by: Simon Horman <horms+renesas@verge.net.au>\nAcked-by: Geert Uytterhoeven <geert+renesas@glider.be>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/b7fcd843be1d376f5e43226227707422f74901c7"},{"sha":"89d27e325a9cb38435074039a43c9d95c1f389ec","author":{"email":"df9728c9e5104131c08c7adb03af425394842596@rustcorp.com.au","name":"Rusty Russell"},"message":"module: wrapper for symbol name.\n\n[ Upstream commit 2e7bac536106236104e9e339531ff0fcdb7b8147 ]\n\nThis trivial wrapper adds clarity and makes the following patch\nsmaller.\n\nCc: stable@kernel.org\nSigned-off-by: Rusty Russell <rusty@rustcorp.com.au>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/89d27e325a9cb38435074039a43c9d95c1f389ec"},{"sha":"0e3029cfab4a7884b32e1b2d3c19c12eded9804a","author":{"email":"4d9e23a041ac966f5316a7481300d4ae12e806fe@redhat.com","name":"Dave Chinner"},"message":"dax: don't abuse get_block mapping for endio callbacks\n\n[ Upstream commit e842f2903908934187af7232fb5b21da527d1757 ]\n\ndax_fault() currently relies on the get_block callback to attach an\nio completion callback to the mapping buffer head so that it can\nrun unwritten extent conversion after zeroing allocated blocks.\n\nInstead of this hack, pass the conversion callback directly into\ndax_fault() similar to the get_block callback. When the filesystem\nallocates unwritten extents, it will set the buffer_unwritten()\nflag, and hence the dax_fault code can call the completion function\nin the contexts where it is necessary without overloading the\nmapping buffer head.\n\nNote: The changes to ext4 to use this interface are suspect at best.\nIn fact, the way ext4 did this end_io assignment in the first place\nlooks suspect because it only set a completion callback when there\nwasn't already some other write() call taking place on the same\ninode. The ext4 end_io code looks rather intricate and fragile with\nall it's reference counting and passing to different contexts for\nmodification via inode private pointers that aren't protected by\nlocks...\n\nSigned-off-by: Dave Chinner <dchinner@redhat.com>\nAcked-by: Jan Kara <jack@suse.cz>\nSigned-off-by: Dave Chinner <david@fromorbit.com>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/0e3029cfab4a7884b32e1b2d3c19c12eded9804a"},{"sha":"a7635d6a0849007d2192bc02c038cc1b9d91b274","author":{"email":"596727c8a0ea4db3ba2ceceedccbacd3d7b371b8@suse.com","name":"Jan Kara"},"message":"ext4: fix bh->b_state corruption\n\n[ Upstream commit ed8ad83808f009ade97ebbf6519bc3a97fefbc0c ]\n\next4 can update bh->b_state non-atomically in _ext4_get_block() and\next4_da_get_block_prep(). Usually this is fine since bh is just a\ntemporary storage for mapping information on stack but in some cases it\ncan be fully living bh attached to a page. In such case non-atomic\nupdate of bh->b_state can race with an atomic update which then gets\nlost. Usually when we are mapping bh and thus updating bh->b_state\nnon-atomically, nobody else touches the bh and so things work out fine\nbut there is one case to especially worry about: ext4_finish_bio() uses\nBH_Uptodate_Lock on the first bh in the page to synchronize handling of\nPageWriteback state. So when blocksize < pagesize, we can be atomically\nmodifying bh->b_state of a buffer that actually isn't under IO and thus\ncan race e.g. with delalloc trying to map that buffer. The result is\nthat we can mistakenly set / clear BH_Uptodate_Lock bit resulting in the\ncorruption of PageWriteback state or missed unlock of BH_Uptodate_Lock.\n\nFix the problem by always updating bh->b_state bits atomically.\n\nCC: stable@vger.kernel.org\nReported-by: Nikolay Borisov <kernel@kyup.com>\nSigned-off-by: Jan Kara <jack@suse.cz>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/a7635d6a0849007d2192bc02c038cc1b9d91b274"}]}