{"push_id":1398222823,"size":49,"distinct_size":49,"ref":"refs/heads/cm-14.1","head":"386fc1ce12650fbd09ecb830c2b094575f0c4624","before":"7b6723f8278f845e1299b4c2d7186eb8e9efd1be","commits":[{"sha":"523ff1c207b2dbef1384d78c096b890d8f01d069","author":{"name":"Alberto97","email":"7e698329ce67c109a7d37e62879d5cb8156736ef@gmail.com"},"message":"addison: Add Motorola Kernel Version\n\nChange-Id: Ic10bff0abb99e94aa38fd5a6f5cb72f2fe23878a","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/523ff1c207b2dbef1384d78c096b890d8f01d069"},{"sha":"64dd6c19e662b53903b60c0667a69aa5b6511bff","author":{"name":"Al Viro","email":"2a537e97523ffee458777df5f34a2f8c9964f945@ZenIV.linux.org.uk"},"message":"net: validate the range we feed to iov_iter_init() in sys_sendto/sys_recvfrom\n\nCc: stable@vger.kernel.org # v3.19\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/64dd6c19e662b53903b60c0667a69aa5b6511bff"},{"sha":"32c499cc256d3cbb225c653582248cff50ea02f6","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"BACKPORT: ipv6: add complete rcu protection around np->opt\n\n(cherry pick from commit 45f6fad84cc305103b28d73482b344d7f5b76f39)\n\nThis patch addresses multiple problems :\n\nUDP/RAW sendmsg() need to get a stable struct ipv6_txoptions\nwhile socket is not locked : Other threads can change np->opt\nconcurrently. Dmitry posted a syzkaller\n(http://github.com/google/syzkaller) program desmonstrating\nuse-after-free.\n\nStarting with TCP/DCCP lockless listeners, tcp_v6_syn_recv_sock()\nand dccp_v6_request_recv_sock() also need to use RCU protection\nto dereference np->opt once (before calling ipv6_dup_options())\n\nThis patch adds full RCU protection to np->opt\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nBug: 28746669\nChange-Id: I9654ba44a4a710a08f8b23bfd8205d205a95607c","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/32c499cc256d3cbb225c653582248cff50ea02f6"},{"sha":"b0938d6f921e44cc443f8141f7adf86bc6c2e017","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: seq: Fix race at timer setup and close\n\nALSA sequencer code has an open race between the timer setup ioctl and\nthe close of the client.  This was triggered by syzkaller fuzzer, and\na use-after-free was caught there as a result.\n\nThis patch papers over it by adding a proper queue->timer_mutex lock\naround the timer-related calls in the relevant code path.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/b0938d6f921e44cc443f8141f7adf86bc6c2e017"},{"sha":"2cbff3f89396748c4b7daedb26a3c58f95181b2d","author":{"name":"Kangjie Lu","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"UPSTREAM: ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS\n\n(cherry pick from commit cec8f96e49d9be372fdb0c3836dcf31ec71e457e)\n\nThe stack object “tread” has a total size of 32 bytes. Its field\n“event” and “val” both contain 4 bytes padding. These 8 bytes\npadding bytes are sent to user without being initialized.\n\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nBug: 28980557\nChange-Id: I963a8f5f7ae828787c655c9b89121d3844474513","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/2cbff3f89396748c4b7daedb26a3c58f95181b2d"},{"sha":"56604ee47fc371fd00ed16c394a02e39fc6bf361","author":{"name":"Kangjie Lu","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"UPSTREAM: ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt\n\n(cherry pick from commit e4ec8cc8039a7063e24204299b462bd1383184a5)\n\nThe stack object “r1” has a total size of 32 bytes. Its field\n“event” and “val” both contain 4 bytes padding. These 8 bytes\npadding bytes are sent to user without being initialized.\n\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nBug: 28980217\nChange-Id: I756d05a328a133c1c67132301434c6817be0a2a6","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/56604ee47fc371fd00ed16c394a02e39fc6bf361"},{"sha":"9e7a57302bee7feba83c87235fec1951d1f4c433","author":{"name":"Kangjie Lu","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"UPSTREAM: ALSA: timer: Fix leak in events via snd_timer_user_ccallback\n\n(cherry pick from commit 9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6)\n\nThe stack object “r1” has a total size of 32 bytes. Its field\n“event” and “val” both contain 4 bytes padding. These 8 bytes\npadding bytes are sent to user without being initialized.\n\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nBug: 28980217\nChange-Id: I0ba03af4d0620bcbc7a808d083295b7c97aba56d","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/9e7a57302bee7feba83c87235fec1951d1f4c433"},{"sha":"e350d5e4e34365965167b21c52234c43d88e7e08","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"UPSTREAM: ALSA: timer: Fix race among timer ioctls\n\n(cherry picked from commit af368027a49a751d6ff4ee9e3f9961f35bb4fede)\n\nALSA timer ioctls have an open race and this may lead to a\nuse-after-free of timer instance object.  A simplistic fix is to make\neach ioctl exclusive.  We have already tread_sem for controlling the\ntread, and extend this as a global mutex to be applied to each ioctl.\n\nThe downside is, of course, the worse concurrency.  But these ioctls\naren't to be parallel accessible, in anyway, so it should be fine to\nserialize there.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nTested-by: Dmitry Vyukov <dvyukov@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nChange-Id: I1ac52f1cba5e7408fd88c8fc1c30ca2e83967ebb\nBug: 28694392","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/e350d5e4e34365965167b21c52234c43d88e7e08"},{"sha":"5bca8042215489b4a7376c0990367dab41e25965","author":{"name":"Deva Ramasubramanian","email":"3d3b7edbac9b2886d40c9edd3584464c1b141343@codeaurora.org"},"message":"media: Init the reserved fields of struct media_link_desc\n\nstruct media_link_desc is copy_to_user'ed as the return value of\nMEDIA_IOC_ENUM_LINKS. When copying, the driver is omitting to initialise\nthe reserved fields.  This commit fixes that by initialising the\nreserved fields to 0.\n\nCRs-Fixed: 570757\nChange-Id: I230e2666c0845cc36399518a0f2c94db664382d1\nSigned-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/5bca8042215489b4a7376c0990367dab41e25965"},{"sha":"c5928a0d87a40441b9f45fcd67a6e2f844efe411","author":{"name":"Avijit Kanti Das","email":"3c405aac8f37fef3100e89723dde793f6b5f32df@codeaurora.org"},"message":"net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()\n\nmemset() the structure ethtool_wolinfo that has padded bytes\nbut the padded bytes have not been zeroed out.\n\nChange-Id: If3fd2d872a1b1ab9521d937b86a29fc468a8bbfe\nSigned-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/c5928a0d87a40441b9f45fcd67a6e2f844efe411"},{"sha":"5db14dcd7a4e5e80984c783810421acc5103c82f","author":{"name":"Kangjie Lu","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"USB: usbfs: fix potential infoleak in devio\n\nThe stack object “ci” has a total size of 8 bytes. Its last 3 bytes\nare padding bytes which are not initialized and leaked to userland\nvia “copy_to_user”.\n\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/5db14dcd7a4e5e80984c783810421acc5103c82f"},{"sha":"2847ab088c4ec6926ae53f263ea09e36b0c2effa","author":{"name":"Kangjie Lu","email":"c6dbead15f805a0881e9469feef97d17b99af2f6@gmail.com"},"message":"BACKPORT: net: fix infoleak in rtnetlink\n\n(cherry pick from commit 5f8e44741f9f216e33736ea4ec65ca9ac03036e6)\n\nThe stack object “map” has a total size of 32 bytes. Its last 4\nbytes are padding generated by compiler. These padding bytes are\nnot initialized and sent out via “nla_put”.\n\nSigned-off-by: Kangjie Lu <kjlu@gatech.edu>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nBug: 28620102\nChange-Id: If3f19c8ec398adc5ef6fc779328141e2de87772e","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/2847ab088c4ec6926ae53f263ea09e36b0c2effa"},{"sha":"8929856b7bdbd93b752405f507c7e449387f943b","author":{"name":"Dan Carpenter","email":"60b2bf2bc0bec4ca4a4b046ca7ef9255248abff8@oracle.com"},"message":"UPSTREAM: KEYS: potential uninitialized variable\n\n(cherry picked from commit 38327424b40bcebe2de92d07312c89360ac9229a)\n\nIf __key_link_begin() failed then \"edit\" would be uninitialized.  I've\nadded a check to fix that.\n\nThis allows a random user to crash the kernel, though it's quite\ndifficult to achieve.  There are three ways it can be done as the user\nwould have to cause an error to occur in __key_link():\n\n (1) Cause the kernel to run out of memory.  In practice, this is difficult\n     to achieve without ENOMEM cropping up elsewhere and aborting the\n     attempt.\n\n (2) Revoke the destination keyring between the keyring ID being looked up\n     and it being tested for revocation.  In practice, this is difficult to\n     time correctly because the KEYCTL_REJECT function can only be used\n     from the request-key upcall process.  Further, users can only make use\n     of what's in /sbin/request-key.conf, though this does including a\n     rejection debugging test - which means that the destination keyring\n     has to be the caller's session keyring in practice.\n\n (3) Have just enough key quota available to create a key, a new session\n     keyring for the upcall and a link in the session keyring, but not then\n     sufficient quota to create a link in the nominated destination keyring\n     so that it fails with EDQUOT.\n\nThe bug can be triggered using option (3) above using something like the\nfollowing:\n\n\techo 80 >/proc/sys/kernel/keys/root_maxbytes\n\tkeyctl request2 user debug:fred negate @t\n\nThe above sets the quota to something much lower (80) to make the bug\neasier to trigger, but this is dependent on the system.  Note also that\nthe name of the keyring created contains a random number that may be\nbetween 1 and 10 characters in size, so may throw the test off by\nchanging the amount of quota used.\n\nAssuming the failure occurs, something like the following will be seen:\n\n\tkfree_debugcheck: out of range ptr 6b6b6b6b6b6b6b68h\n\t------------[ cut here ]------------\n\tkernel BUG at ../mm/slab.c:2821!\n\t...\n\tRIP: 0010:[<ffffffff811600f9>] kfree_debugcheck+0x20/0x25\n\tRSP: 0018:ffff8804014a7de8  EFLAGS: 00010092\n\tRAX: 0000000000000034 RBX: 6b6b6b6b6b6b6b68 RCX: 0000000000000000\n\tRDX: 0000000000040001 RSI: 00000000000000f6 RDI: 0000000000000300\n\tRBP: ffff8804014a7df0 R08: 0000000000000001 R09: 0000000000000000\n\tR10: ffff8804014a7e68 R11: 0000000000000054 R12: 0000000000000202\n\tR13: ffffffff81318a66 R14: 0000000000000000 R15: 0000000000000001\n\t...\n\tCall Trace:\n\t  kfree+0xde/0x1bc\n\t  assoc_array_cancel_edit+0x1f/0x36\n\t  __key_link_end+0x55/0x63\n\t  key_reject_and_link+0x124/0x155\n\t  keyctl_reject_key+0xb6/0xe0\n\t  keyctl_negate_key+0x10/0x12\n\t  SyS_keyctl+0x9f/0xe7\n\t  do_syscall_64+0x63/0x13a\n\t  entry_SYSCALL64_slow_path+0x25/0x25\n\nFixes: f70e2e06196a ('KEYS: Do preallocation for __key_link()')\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\ncc: stable@vger.kernel.org\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nChange-Id: Ia9616cce142a616beea0ef20bde49129939d2d2d\nBug: 29823941","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/8929856b7bdbd93b752405f507c7e449387f943b"},{"sha":"558b17663c6e1f218a630782181844a855eadfae","author":{"name":"Rainer Weikusat","email":"83eef5bb46142d818cc9ec09a206a7f5abed4070@mobileactivedefense.com"},"message":"UPSTREAM: unix: avoid use-after-free in ep_remove_wait_queue\n\n(cherry picked from commit 7d267278a9ece963d77eefec61630223fce08c6c)\n\nRainer Weikusat <rweikusat@mobileactivedefense.com> writes:\nAn AF_UNIX datagram socket being the client in an n:1 association with\nsome server socket is only allowed to send messages to the server if the\nreceive queue of this socket contains at most sk_max_ack_backlog\ndatagrams. This implies that prospective writers might be forced to go\nto sleep despite none of the message presently enqueued on the server\nreceive queue were sent by them. In order to ensure that these will be\nwoken up once space becomes again available, the present unix_dgram_poll\nroutine does a second sock_poll_wait call with the peer_wait wait queue\nof the server socket as queue argument (unix_dgram_recvmsg does a wake\nup on this queue after a datagram was received). This is inherently\nproblematic because the server socket is only guaranteed to remain alive\nfor as long as the client still holds a reference to it. In case the\nconnection is dissolved via connect or by the dead peer detection logic\nin unix_dgram_sendmsg, the server socket may be freed despite \"the\npolling mechanism\" (in particular, epoll) still has a pointer to the\ncorresponding peer_wait queue. There's no way to forcibly deregister a\nwait queue with epoll.\n\nBased on an idea by Jason Baron, the patch below changes the code such\nthat a wait_queue_t belonging to the client socket is enqueued on the\npeer_wait queue of the server whenever the peer receive queue full\ncondition is detected by either a sendmsg or a poll. A wake up on the\npeer queue is then relayed to the ordinary wait queue of the client\nsocket via wake function. The connection to the peer wait queue is again\ndissolved if either a wake up is about to be relayed or the client\nsocket reconnects or a dead peer is detected or the client socket is\nitself closed. This enables removing the second sock_poll_wait from\nunix_dgram_poll, thus avoiding the use-after-free, while still ensuring\nthat no blocked writer sleeps forever.\n\nSigned-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com>\nFixes: ec0d215f9420 (\"af_unix: fix 'poll for write'/connected DGRAM sockets\")\nReviewed-by: Jason Baron <jbaron@akamai.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nChange-Id: Ia374ee061195088f8c777940baa75cedbe897f4e\nBug: 29119002","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/558b17663c6e1f218a630782181844a855eadfae"},{"sha":"58ffebe1e6d4abb5b51a92ebbbf6e27ada8cd92c","author":{"name":"Rainer Weikusat","email":"83eef5bb46142d818cc9ec09a206a7f5abed4070@mobileactivedefense.com"},"message":"UPSTREAM: af_unix: Guard against other == sk in unix_dgram_sendmsg\n\n(cherry picked from commit a5527dda344fff0514b7989ef7a755729769daa1)\n\nThe unix_dgram_sendmsg routine use the following test\n\nif (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {\n\nto determine if sk and other are in an n:1 association (either\nestablished via connect or by using sendto to send messages to an\nunrelated socket identified by address). This isn't correct as the\nspecified address could have been bound to the sending socket itself or\nbecause this socket could have been connected to itself by the time of\nthe unix_peer_get but disconnected before the unix_state_lock(other). In\nboth cases, the if-block would be entered despite other == sk which\nmight either block the sender unintentionally or lead to trying to unlock\nthe same spin lock twice for a non-blocking send. Add a other != sk\ncheck to guard against this.\n\nFixes: 7d267278a9ec (\"unix: avoid use-after-free in ep_remove_wait_queue\")\nReported-By: Philipp Hahn <pmhahn@pmhahn.de>\nSigned-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com>\nTested-by: Philipp Hahn <pmhahn@pmhahn.de>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n\nFixes: Change-Id: Ia374ee061195088f8c777940baa75cedbe897f4e\n       (\"UPSTREAM: unix: avoid use-after-free in ep_remove_wait_queue\")\nChange-Id: I4ebef6a390df3487903b166b837e34c653e01cb2\nSigned-off-by: Amit Pundir <amit.pundir@linaro.org>","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/58ffebe1e6d4abb5b51a92ebbbf6e27ada8cd92c"},{"sha":"b888cee0f3af5679ca68eaaf87b35a1a885b8246","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"UPSTREAM: netfilter: x_tables: fix unconditional helper\n\n(cherry pick from commit 54d83fc74aa9ec72794373cb47432c5f7fb1a309)\n\nBen Hawkes says:\n\n In the mark_source_chains function (net/ipv4/netfilter/ip_tables.c) it\n is possible for a user-supplied ipt_entry structure to have a large\n next_offset field. This field is not bounds checked prior to writing a\n counter value at the supplied offset.\n\nProblem is that mark_source_chains should not have been called --\nthe rule doesn't have a next entry, so its supposed to return\nan absolute verdict of either ACCEPT or DROP.\n\nHowever, the function conditional() doesn't work as the name implies.\nIt only checks that the rule is using wildcard address matching.\n\nHowever, an unconditional rule must also not be using any matches\n(no -m args).\n\nThe underflow validator only checked the addresses, therefore\npassing the 'unconditional absolute verdict' test, while\nmark_source_chains also tested for presence of matches, and thus\nproceeeded to the next (not-existent) rule.\n\nUnify this so that all the callers have same idea of 'unconditional rule'.\n\nReported-by: Ben Hawkes <hawkes@google.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nChange-Id: I47ec0713ac563ac244200c7b2c54f09a91aceabc\nBug: 28940694","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/b888cee0f3af5679ca68eaaf87b35a1a885b8246"},{"sha":"12dc2f0886b412e0097b07d3db45ca7ccc30c028","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"UPSTREAM: netfilter: x_tables: validate e->target_offset early\n\n(cherry pick from commit bdf533de6968e9686df777dc178486f600c6e617)\n\nWe should check that e->target_offset is sane before\nmark_source_chains gets called since it will fetch the target entry\nfor loop detection.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nChange-Id: Ic2dbc31c9525d698e94d4d8875886acf3524abbd\nBug: 29637687","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/12dc2f0886b412e0097b07d3db45ca7ccc30c028"},{"sha":"00be99cfb81abd035c1c74be0fc2267c7d0226e7","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"UPSTREAM: netfilter: x_tables: make sure e->next_offset covers remaining blob size\n\n(cherry pick from commit 6e94e0cfb0887e4013b3b930fa6ab1fe6bb6ba91)\n\nOtherwise this function may read data beyond the ruleset blob.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nChange-Id: I9d19ecf3e00a2d52817b35b9042623927895c005\nBug: 29637687","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/00be99cfb81abd035c1c74be0fc2267c7d0226e7"},{"sha":"558bc54d27f888f6bbcd7f9219d4e95d50e94c6e","author":{"name":"Bjørn Mork","email":"73004647096653cb035375f893ae959ac7bd4f38@mork.no"},"message":"UPSTREAM: cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind\n\n(cherry pick from commit 4d06dd537f95683aba3651098ae288b7cbff8274)\n\nusbnet_link_change will call schedule_work and should be\navoided if bind is failing. Otherwise we will end up with\nscheduled work referring to a netdev which has gone away.\n\nInstead of making the call conditional, we can just defer\nit to usbnet_probe, using the driver_info flag made for\nthis purpose.\n\nFixes: 8a34b0ae8778 (\"usbnet: cdc_ncm: apply usbnet_link_change\")\nReported-by: Andrey Konovalov <andreyknvl@gmail.com>\nSuggested-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Bjørn Mork <bjorn@mork.no>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nChange-Id: Id9a6d02bdd98bf495d26595cf2cc90e480746186\nBug: 28744625","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/558bc54d27f888f6bbcd7f9219d4e95d50e94c6e"},{"sha":"21a8af2f859f713c73041c0b41798fba1f775f1e","author":{"name":"Oliver Neukum","email":"af55dedc0d50bd691239218b486da844e4a16906@suse.com"},"message":"UPSTREAM: usbnet: cleanup after bind() in probe()\n\n(cherry pick from commit 1666984c8625b3db19a9abc298931d35ab7bc64b)\n\nIn case bind() works, but a later error forces bailing\nin probe() in error cases work and a timer may be scheduled.\nThey must be killed. This fixes an error case related to\nthe double free reported in\nhttp://www.spinics.net/lists/netdev/msg367669.html\nand needs to go on top of Linus' fix to cdc-ncm.\n\nChange-Id: Ie61e9aa65dc46e5f64d936337c673b0ae169bd2b\nSigned-off-by: Oliver Neukum <ONeukum@suse.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nBug: 28744625","distinct":true,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8953/commits/21a8af2f859f713c73041c0b41798fba1f775f1e"}]}
{"actor":{"display_login":"Alberto97"}}