{"push_id":1098111658,"size":164,"distinct_size":164,"ref":"refs/heads/t100ta-v4.4","head":"080dc6c85d75c90b238a93ff91c80462ca47a9b9","before":"02b6ca6ed85a00447e1724a7147c1f4cc65c9540","commits":[{"sha":"5b616a05de88d4be0136156a26fae9da855939f6","author":{"email":"8d0fc11caeb4659419f0ba3104eb4a9d30848d42@canonical.com","name":"Ming Lei"},"message":"block: partition: initialize percpuref before sending out KOBJ_ADD\n\ncommit b30a337ca27c4f40439e4bfb290cba5f88d73bb7 upstream.\n\nThe initialization of partition's percpu_ref should have been done before\nsending out KOBJ_ADD uevent, which may cause userspace to read partition\ntable. So the uninitialized percpu_ref may be accessed in data path.\n\nThis patch fixes this issue reported by Naveen.\n\nReported-by: Naveen Kaje <nkaje@codeaurora.org>\nTested-by: Naveen Kaje <nkaje@codeaurora.org>\nFixes: 6c71013ecb7e2(block: partition: convert percpu ref)\nSigned-off-by: Ming Lei <ming.lei@canonical.com>\nSigned-off-by: Jens Axboe <axboe@fb.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/5b616a05de88d4be0136156a26fae9da855939f6"},{"sha":"9fed24fe30c1217c640d2b38403034c2c7fdce12","author":{"email":"8d0fc11caeb4659419f0ba3104eb4a9d30848d42@canonical.com","name":"Ming Lei"},"message":"block: loop: fix filesystem corruption in case of aio/dio\n\ncommit a7297a6a3a3322b054592e8e988981d2f5f29cc4 upstream.\n\nStarting from commit e36f620428(block: split bios to max possible length),\nblock core starts to split bio in the middle of bvec.\n\nUnfortunately loop dio/aio doesn't consider this situation, and\nalways treat 'iter.iov_offset' as zero. Then filesystem corruption\nis observed.\n\nThis patch figures out the offset of the base bvevc via\n'bio->bi_iter.bi_bvec_done' and fixes the issue by passing the offset\nto iov iterator.\n\nFixes: e36f6204288088f (block: split bios to max possible length)\nCc: Keith Busch <keith.busch@intel.com>\nCc: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Ming Lei <ming.lei@canonical.com>\nSigned-off-by: Jens Axboe <axboe@fb.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/9fed24fe30c1217c640d2b38403034c2c7fdce12"},{"sha":"adbe236b953f4537f9e5ce86d1c7ace613dec38c","author":{"email":"e7984595ec0368ff920a7b3521dc7093683f6f26@intel.com","name":"Tony Luck"},"message":"x86/mce: Avoid using object after free in genpool\n\ncommit a3125494cff084b098c80bb36fbe2061ffed9d52 upstream.\n\nWhen we loop over all queued machine check error records to pass them\nto the registered notifiers we use llist_for_each_entry(). But the loop\ncalls gen_pool_free() for the entry in the body of the loop - and then\nthe iterator looks at node->next after the free.\n\nUse llist_for_each_entry_safe() instead.\n\nSigned-off-by: Tony Luck <tony.luck@intel.com>\nSigned-off-by: Borislav Petkov <bp@suse.de>\nCc: Gong Chen <gong.chen@linux.intel.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: linux-edac <linux-edac@vger.kernel.org>\nLink: http://lkml.kernel.org/r/0205920@agluck-desk.sc.intel.com\nLink: http://lkml.kernel.org/r/1459929916-12852-4-git-send-email-bp@alien8.de\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/adbe236b953f4537f9e5ce86d1c7ace613dec38c"},{"sha":"1c8497d2035d95e4e26bdf6cec34150bfb972776","author":{"email":"af3a1abb318f80516a89043d3cf305795fb8380c@google.com","name":"David Matlack"},"message":"kvm: x86: do not leak guest xcr0 into host interrupt handlers\n\ncommit fc5b7f3bf1e1414bd4e91db6918c85ace0c873a5 upstream.\n\nAn interrupt handler that uses the fpu can kill a KVM VM, if it runs\nunder the following conditions:\n - the guest's xcr0 register is loaded on the cpu\n - the guest's fpu context is not loaded\n - the host is using eagerfpu\n\nNote that the guest's xcr0 register and fpu context are not loaded as\npart of the atomic world switch into \"guest mode\". They are loaded by\nKVM while the cpu is still in \"host mode\".\n\nUsage of the fpu in interrupt context is gated by irq_fpu_usable(). The\ninterrupt handler will look something like this:\n\nif (irq_fpu_usable()) {\n        kernel_fpu_begin();\n\n        [... code that uses the fpu ...]\n\n        kernel_fpu_end();\n}\n\nAs long as the guest's fpu is not loaded and the host is using eager\nfpu, irq_fpu_usable() returns true (interrupted_kernel_fpu_idle()\nreturns true). The interrupt handler proceeds to use the fpu with\nthe guest's xcr0 live.\n\nkernel_fpu_begin() saves the current fpu context. If this uses\nXSAVE[OPT], it may leave the xsave area in an undesirable state.\nAccording to the SDM, during XSAVE bit i of XSTATE_BV is not modified\nif bit i is 0 in xcr0. So it's possible that XSTATE_BV[i] == 1 and\nxcr0[i] == 0 following an XSAVE.\n\nkernel_fpu_end() restores the fpu context. Now if any bit i in\nXSTATE_BV == 1 while xcr0[i] == 0, XRSTOR generates a #GP. The\nfault is trapped and SIGSEGV is delivered to the current process.\n\nOnly pre-4.2 kernels appear to be vulnerable to this sequence of\nevents. Commit 653f52c (\"kvm,x86: load guest FPU context more eagerly\")\nfrom 4.2 forces the guest's fpu to always be loaded on eagerfpu hosts.\n\nThis patch fixes the bug by keeping the host's xcr0 loaded outside\nof the interrupts-disabled region where KVM switches into guest mode.\n\nSuggested-by: Andy Lutomirski <luto@amacapital.net>\nSigned-off-by: David Matlack <dmatlack@google.com>\n[Move load after goto cancel_injection. - Paolo]\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/1c8497d2035d95e4e26bdf6cec34150bfb972776"},{"sha":"5716a93fef70b4d305e9b3afea50c3027d22cc3c","author":{"email":"a16cc0c82647c52d401177f8e50567df5499e36c@arm.com","name":"Marc Zyngier"},"message":"KVM: arm/arm64: Handle forward time correction gracefully\n\ncommit 1c5631c73fc2261a5df64a72c155cb53dcdc0c45 upstream.\n\nOn a host that runs NTP, corrections can have a direct impact on\nthe background timer that we program on the behalf of a vcpu.\n\nIn particular, NTP performing a forward correction will result in\na timer expiring sooner than expected from a guest point of view.\nNot a big deal, we kick the vcpu anyway.\n\nBut on wake-up, the vcpu thread is going to perform a check to\nfind out whether or not it should block. And at that point, the\ntimer check is going to say \"timer has not expired yet, go back\nto sleep\". This results in the timer event being lost forever.\n\nThere are multiple ways to handle this. One would be record that\nthe timer has expired and let kvm_cpu_has_pending_timer return\ntrue in that case, but that would be fairly invasive. Another is\nto check for the \"short sleep\" condition in the hrtimer callback,\nand restart the timer for the remaining time when the condition\nis detected.\n\nThis patch implements the latter, with a bit of refactoring in\norder to avoid too much code duplication.\n\nReported-by: Alexander Graf <agraf@suse.de>\nReviewed-by: Alexander Graf <agraf@suse.de>\nSigned-off-by: Marc Zyngier <marc.zyngier@arm.com>\nSigned-off-by: Christoffer Dall <christoffer.dall@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/5716a93fef70b4d305e9b3afea50c3027d22cc3c"},{"sha":"4bb48b5f95a9e40451e259e295d03cd301740440","author":{"email":"c1574519d727edaf2e16b260e452051ef77bf018@ti.com","name":"Lokesh Vutla"},"message":"ARM: dts: AM43x-epos: Fix clk parent for synctimer\n\ncommit cfe1580a6415bc37fd62d79eb8102a618f7650b2 upstream.\n\ncommit 55ee7017ee31 (\"arm: omap2: board-generic: use omap4_local_timer_init\nfor AM437x\") makes synctimer32k as the clocksource on AM43xx. By default\nthe synctimer32k is clocked by 32K RTC OSC on AM43xx. But this 32K RTC OSC\nis not available on epos boards which makes it fail to boot.\n\nSynctimer32k can also be clocked by a peripheral PLL, so making this as\nclock parent for synctimer3k on epos boards.\n\nFixes: 55ee7017ee31 (\"arm: omap2: board-generic: use omap4_local_timer_init for AM437x\")\nReported-by: Nishanth Menon <nm@ti.com>\nSigned-off-by: Lokesh Vutla <lokeshvutla@ti.com>\nSigned-off-by: Tony Lindgren <tony@atomide.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/4bb48b5f95a9e40451e259e295d03cd301740440"},{"sha":"c6cf3b71df047f61b568795fe926f107806eae82","author":{"email":"cbb7353e6d953ef360baf960c122346276c6e320@puiterwijk.org","name":"Patrick Uiterwijk"},"message":"ARM: mvebu: Correct unit address for linksys\n\ncommit 199831c77c50e6913e893b6bc268ba9f4a9a2bf8 upstream.\n\nThe USB2 port for Armada 38x is defined to be at 58000, not at\n50000.\n\nFixes: 2d0a7addbd10 (\"ARM: Kirkwood: Add support for many Synology NAS devices\")\nSigned-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>\nAcked-by: Imre Kaloz <kaloz@openwrt.org>\nSigned-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/c6cf3b71df047f61b568795fe926f107806eae82"},{"sha":"81b5ed00246258100df11c87f118a27f0ebceba3","author":{"email":"50c3c575ce2bb12c45e20736ce59e86fe81915b4@ti.com","name":"Nishanth Menon"},"message":"ARM: OMAP2: Fix up interconnect barrier initialization for DRA7\n\ncommit 456e8d53482537616899a146b706eccd095404e6 upstream.\n\nThe following commits:\ncommit 3fa609755c11 (\"ARM: omap2: restore OMAP4 barrier behaviour\")\ncommit f746929ffdc8 (\"Revert \"ARM: OMAP4: remove dead kconfig option OMAP4_ERRATA_I688\"\")\nand\ncommit ea827ad5ffbb (\"ARM: DRA7: Provide proper IO map table\")\ncame in around the same time, unfortunately this seem to have missed\ninitializing the barrier for DRA7 platforms - omap5_map_io was reused\nfor dra7 till it was split out by the last patch. barrier_init\nneeds to be hence carried forward as it is valid for DRA7 family of\nprocessors as they are for OMAP5.\n\nFixes: ea827ad5ffbb7 (\"ARM: DRA7: Provide proper IO map table\")\nReported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>\nReported-by: Tomi Valkeinen <tomi.valkeinen@ti.com>\nCc: Russell King <rmk+kernel@arm.linux.org.uk>\nSigned-off-by: Nishanth Menon <nm@ti.com>\nReviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>\nSigned-off-by: Tony Lindgren <tony@atomide.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/81b5ed00246258100df11c87f118a27f0ebceba3"},{"sha":"882e790b572a7dadf5323e373d0139bfbc6dce15","author":{"email":"c1574519d727edaf2e16b260e452051ef77bf018@ti.com","name":"Lokesh Vutla"},"message":"ARM: OMAP2+: hwmod: Fix updating of sysconfig register\n\ncommit 3ca4a238106dedc285193ee47f494a6584b6fd2f upstream.\n\nCommit 127500ccb766f (\"ARM: OMAP2+: Only write the sysconfig on idle\nwhen necessary\") talks about verification of sysconfig cache value before\nupdating it, only during idle path. But the patch is adding the\nverification in the enable path. So, adding the check in a proper place\nas per the commit description.\n\nNot keeping this check during enable path as there is a chance of losing\ncontext and it is safe to do on idle as the context of the register will\nnever be lost while the device is active.\n\nSigned-off-by: Lokesh Vutla <lokeshvutla@ti.com>\nAcked-by: Tero Kristo <t-kristo@ti.com>\nCc: Jon Hunter <jonathanh@nvidia.com>\nFixes: commit 127500ccb766 \"ARM: OMAP2+: Only write the sysconfig on idle when necessary\"\n[paul@pwsan.com: appears to have been caused by my own mismerge of the\n originally posted patch]\nSigned-off-by: Paul Walmsley <paul@pwsan.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/882e790b572a7dadf5323e373d0139bfbc6dce15"},{"sha":"6905c7a4aa1ef675825bc2ab56fd965a573ffb74","author":{"email":"d3643b417d7bb29446cdadf5ebe2f94cac95db45@redhat.com","name":"Jerome Marchand"},"message":"assoc_array: don't call compare_object() on a node\n\ncommit 8d4a2ec1e0b41b0cf9a0c5cd4511da7f8e4f3de2 upstream.\n\nChanges since V1: fixed the description and added KASan warning.\n\nIn assoc_array_insert_into_terminal_node(), we call the\ncompare_object() method on all non-empty slots, even when they're\nnot leaves, passing a pointer to an unexpected structure to\ncompare_object(). Currently it causes an out-of-bound read access\nin keyring_compare_object detected by KASan (see below). The issue\nis easily reproduced with keyutils testsuite.\nOnly call compare_object() when the slot is a leave.\n\nKASan warning:\n==================================================================\nBUG: KASAN: slab-out-of-bounds in keyring_compare_object+0x213/0x240 at addr ffff880060a6f838\nRead of size 8 by task keyctl/1655\n=============================================================================\nBUG kmalloc-192 (Not tainted): kasan: bad access detected\n-----------------------------------------------------------------------------\n\nDisabling lock debugging due to kernel taint\nINFO: Allocated in assoc_array_insert+0xfd0/0x3a60 age=69 cpu=1 pid=1647\n\t___slab_alloc+0x563/0x5c0\n\t__slab_alloc+0x51/0x90\n\tkmem_cache_alloc_trace+0x263/0x300\n\tassoc_array_insert+0xfd0/0x3a60\n\t__key_link_begin+0xfc/0x270\n\tkey_create_or_update+0x459/0xaf0\n\tSyS_add_key+0x1ba/0x350\n\tentry_SYSCALL_64_fastpath+0x12/0x76\nINFO: Slab 0xffffea0001829b80 objects=16 used=8 fp=0xffff880060a6f550 flags=0x3fff8000004080\nINFO: Object 0xffff880060a6f740 @offset=5952 fp=0xffff880060a6e5d1\n\nBytes b4 ffff880060a6f730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f740: d1 e5 a6 60 00 88 ff ff 0e 00 00 00 00 00 00 00  ...`............\nObject ffff880060a6f750: 02 cf 8e 60 00 88 ff ff 02 c0 8e 60 00 88 ff ff  ...`.......`....\nObject ffff880060a6f760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f7a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f7b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f7c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f7d0: 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f7e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject ffff880060a6f7f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nCPU: 0 PID: 1655 Comm: keyctl Tainted: G    B           4.5.0-rc4-kasan+ #291\nHardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n 0000000000000000 000000001b2800b4 ffff880060a179e0 ffffffff81b60491\n ffff88006c802900 ffff880060a6f740 ffff880060a17a10 ffffffff815e2969\n ffff88006c802900 ffffea0001829b80 ffff880060a6f740 ffff880060a6e650\nCall Trace:\n [<ffffffff81b60491>] dump_stack+0x85/0xc4\n [<ffffffff815e2969>] print_trailer+0xf9/0x150\n [<ffffffff815e9454>] object_err+0x34/0x40\n [<ffffffff815ebe50>] kasan_report_error+0x230/0x550\n [<ffffffff819949be>] ? keyring_get_key_chunk+0x13e/0x210\n [<ffffffff815ec62d>] __asan_report_load_n_noabort+0x5d/0x70\n [<ffffffff81994cc3>] ? keyring_compare_object+0x213/0x240\n [<ffffffff81994cc3>] keyring_compare_object+0x213/0x240\n [<ffffffff81bc238c>] assoc_array_insert+0x86c/0x3a60\n [<ffffffff81bc1b20>] ? assoc_array_cancel_edit+0x70/0x70\n [<ffffffff8199797d>] ? __key_link_begin+0x20d/0x270\n [<ffffffff8199786c>] __key_link_begin+0xfc/0x270\n [<ffffffff81993389>] key_create_or_update+0x459/0xaf0\n [<ffffffff8128ce0d>] ? trace_hardirqs_on+0xd/0x10\n [<ffffffff81992f30>] ? key_type_lookup+0xc0/0xc0\n [<ffffffff8199e19d>] ? lookup_user_key+0x13d/0xcd0\n [<ffffffff81534763>] ? memdup_user+0x53/0x80\n [<ffffffff819983ea>] SyS_add_key+0x1ba/0x350\n [<ffffffff81998230>] ? key_get_type_from_user.constprop.6+0xa0/0xa0\n [<ffffffff828bcf4e>] ? retint_user+0x18/0x23\n [<ffffffff8128cc7e>] ? trace_hardirqs_on_caller+0x3fe/0x580\n [<ffffffff81004017>] ? trace_hardirqs_on_thunk+0x17/0x19\n [<ffffffff828bc432>] entry_SYSCALL_64_fastpath+0x12/0x76\nMemory state around the buggy address:\n ffff880060a6f700: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00\n ffff880060a6f780: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc\n>ffff880060a6f800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n                                        ^\n ffff880060a6f880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff880060a6f900: fc fc fc fc fc fc 00 00 00 00 00 00 00 00 00 00\n==================================================================\n\nSigned-off-by: Jerome Marchand <jmarchan@redhat.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/6905c7a4aa1ef675825bc2ab56fd965a573ffb74"},{"sha":"6a20c0a043a73e39b5cd952d7eaf7fd7831e73ac","author":{"email":"f66f867dbd8b5577c23781552a3f5577f8093dfe@intel.com","name":"Rafal Redzimski"},"message":"usb: xhci: applying XHCI_PME_STUCK_QUIRK to Intel BXT B0 host\n\ncommit 0d46faca6f887a849efb07c1655b5a9f7c288b45 upstream.\n\nBroxton B0 also requires XHCI_PME_STUCK_QUIRK.\nAdding PCI device ID for Broxton B and adding to quirk.\n\nSigned-off-by: Rafal Redzimski <rafal.f.redzimski@intel.com>\nSigned-off-by: Robert Dobrowolski <robert.dobrowolski@linux.intel.com>\nSigned-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/6a20c0a043a73e39b5cd952d7eaf7fd7831e73ac"},{"sha":"ba7aa9a970dc12054252042e2b30e1dedcdc5968","author":{"email":"2d4473c5e67eb83655334d4e9a7757f781607241@linux.intel.com","name":"Mathias Nyman"},"message":"xhci: resume USB 3 roothub first\n\ncommit 671ffdff5b13314b1fc65d62cf7604b873fb5dc4 upstream.\n\nGive USB3 devices a better chance to enumerate at USB 3 speeds if\nthey are connected to a suspended host.\nSolves an issue with NEC uPD720200 host hanging when partially\nenumerating a USB3 device as USB2 after host controller runtime resume.\n\nTested-by: Mike Murdoch <main.haarp@gmail.com>\nSigned-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/ba7aa9a970dc12054252042e2b30e1dedcdc5968"},{"sha":"bb6adb50beb03da007c63e86866f6be81d671075","author":{"email":"0e8503a5d55e00d5d2190cff62ef5fd449aa2247@linux.intel.com","name":"Lu Baolu"},"message":"usb: xhci: fix wild pointers in xhci_mem_cleanup\n\ncommit 71504062a7c34838c3fccd92c447f399d3cb5797 upstream.\n\nThis patch fixes some wild pointers produced by xhci_mem_cleanup.\nThese wild pointers will cause system crash if xhci_mem_cleanup()\nis called twice.\n\nReported-and-tested-by: Pengcheng Li <lpc.li@hisilicon.com>\nSigned-off-by: Lu Baolu <baolu.lu@linux.intel.com>\nSigned-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/bb6adb50beb03da007c63e86866f6be81d671075"},{"sha":"0eb1e16bf9feb36441440b0bd9fb0ced0fcdfdb6","author":{"email":"2d4473c5e67eb83655334d4e9a7757f781607241@linux.intel.com","name":"Mathias Nyman"},"message":"xhci: fix 10 second timeout on removal of PCI hotpluggable xhci controllers\n\ncommit 98d74f9ceaefc2b6c4a6440050163a83be0abede upstream.\n\nPCI hotpluggable xhci controllers such as some Alpine Ridge solutions will\nremove the xhci controller from the PCI bus when the last USB device is\ndisconnected.\n\nAdd a flag to indicate that the host is being removed to avoid queueing\nconfigure_endpoint commands for the dropped endpoints.\nFor PCI hotplugged controllers this will prevent 5 second command timeouts\nFor static xhci controllers the configure_endpoint command is not needed\nin the removal case as everything will be returned, freed, and the\ncontroller is reset.\n\nFor now the flag is only set for PCI connected host controllers.\n\nSigned-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/0eb1e16bf9feb36441440b0bd9fb0ced0fcdfdb6"},{"sha":"95b9219e05dafdb76b0707e815e5314cc0cf91af","author":{"email":"04cf2c2574baabfc5ae18f8b0a977a0dc89b9ea3@linux.intel.com","name":"Robert Dobrowolski"},"message":"usb: hcd: out of bounds access in for_each_companion\n\ncommit e86103a75705c7c530768f4ffaba74cf382910f2 upstream.\n\nOn BXT platform Host Controller and Device Controller figure as\nsame PCI device but with different device function. HCD should\nnot pass data to Device Controller but only to Host Controllers.\nChecking if companion device is Host Controller, otherwise skip.\n\nSigned-off-by: Robert Dobrowolski <robert.dobrowolski@linux.intel.com>\nAcked-by: Alan Stern <stern@rowland.harvard.edu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/95b9219e05dafdb76b0707e815e5314cc0cf91af"},{"sha":"e4c7ab76586146820b394e0176f286f5a2e70cb3","author":{"email":"3318dc5ce3e4fb7c28a0b841b6801c884e1d0896@metafoo.de","name":"Lars-Peter Clausen"},"message":"usb: gadget: f_fs: Fix use-after-free\n\ncommit 38740a5b87d53ceb89eb2c970150f6e94e00373a upstream.\n\nWhen using asynchronous read or write operations on the USB endpoints the\nissuer of the IO request is notified by calling the ki_complete() callback\nof the submitted kiocb when the URB has been completed.\n\nCalling this ki_complete() callback will free kiocb. Make sure that the\nstructure is no longer accessed beyond that point, otherwise undefined\nbehaviour might occur.\n\nFixes: 2e4c7553cd6f (\"usb: gadget: f_fs: add aio support\")\nSigned-off-by: Lars-Peter Clausen <lars@metafoo.de>\nSigned-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/e4c7ab76586146820b394e0176f286f5a2e70cb3"},{"sha":"9d58f322ee18ffaca1e0b67d90ab811ad75e62a6","author":{"email":"85e533f2e78486213c4d69f71462342ec0c62734@redhat.com","name":"Mike Snitzer"},"message":"dm cache metadata: fix READ_LOCK macros and cleanup WRITE_LOCK macros\n\ncommit 9567366fefddeaea4ed1d713270535d93a3b3c76 upstream.\n\nThe READ_LOCK macro was incorrectly returning -EINVAL if\ndm_bm_is_read_only() was true -- it will always be true once the cache\nmetadata transitions to read-only by dm_cache_metadata_set_read_only().\n\nWrap READ_LOCK and WRITE_LOCK multi-statement macros in do {} while(0).\nAlso, all accesses of the 'cmd' argument passed to these related macros\nare now encapsulated in parenthesis.\n\nA follow-up patch can be developed to eliminate the use of macros in\nfavor of pure C code.  Avoiding that now given that this needs to apply\nto stable@.\n\nReported-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>\nFixes: d14fcf3dd79 (\"dm cache: make sure every metadata function checks fail_io\")\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/9d58f322ee18ffaca1e0b67d90ab811ad75e62a6"},{"sha":"be5cbaf31cd318f8aaeeff901f6d27232dfa965f","author":{"email":"66a3b93d545e0fa5c865f471397da50205c9fefc@gmail.com","name":"Ahmed Samy"},"message":"dm cache metadata: fix cmd_read_lock() acquiring write lock\n\ncommit 6545b60baaf880b0cd29a5e89dbe745a06027e89 upstream.\n\nCommit 9567366fefdd (\"dm cache metadata: fix READ_LOCK macros and\ncleanup WRITE_LOCK macros\") uses down_write() instead of down_read() in\ncmd_read_lock(), yet up_read() is used to release the lock in\nREAD_UNLOCK().  Fix it.\n\nFixes: 9567366fefdd (\"dm cache metadata: fix READ_LOCK macros and cleanup WRITE_LOCK macros\")\nSigned-off-by: Ahmed Samy <f.fallen45@gmail.com>\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/be5cbaf31cd318f8aaeeff901f6d27232dfa965f"},{"sha":"ed643d220692bfc2bfec9fe618d102f13a5dae9f","author":{"email":"b3080efc1c7085402d23faba8e79c211a1eda81f@gmail.com","name":"Rui Salvaterra"},"message":"lib: lz4: fixed zram with lz4 on big endian machines\n\ncommit 3e26a691fe3fe1e02a76e5bab0c143ace4b137b4 upstream.\n\nBased on Sergey's test patch [1], this fixes zram with lz4 compression\non big endian cpus.\n\nNote that the 64-bit preprocessor test is not a cleanup, it's part of\nthe fix, since those identifiers are bogus (for example, __ppc64__\nisn't defined anywhere else in the kernel, which means we'd fall into\nthe 32-bit definitions on ppc64).\n\nTested on ppc64 with no regression on x86_64.\n\n[1] http://marc.info/?l=linux-kernel&m=145994470805853&w=4\n\nSuggested-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>\nSigned-off-by: Rui Salvaterra <rsalvaterra@gmail.com>\nReviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/ed643d220692bfc2bfec9fe618d102f13a5dae9f"},{"sha":"9b3bd581a0492bdfe788539ca65a14da570faad1","author":{"email":"ead5052bef9b6b56b51f87cdc5b831be775ee6fb@canonical.com","name":"Seth Forshee"},"message":"debugfs: Make automount point inodes permanently empty\n\ncommit 87243deb88671f70def4c52dfa7ca7830707bd31 upstream.\n\nStarting with 4.1 the tracing subsystem has its own filesystem\nwhich is automounted in the tracing subdirectory of debugfs.\nPrior to this debugfs could be bind mounted in a cloned mount\nnamespace, but if tracefs has been mounted under debugfs this\nnow fails because there is a locked child mount. This creates\na regression for container software which bind mounts debugfs\nto satisfy the assumption of some userspace software.\n\nIn other pseudo filesystems such as proc and sysfs we're already\ncreating mountpoints like this in such a way that no dirents can\nbe created in the directories, allowing them to be exceptions to\nsome MNT_LOCKED tests. In fact we're already do this for the\ntracefs mountpoint in sysfs.\n\nDo the same in debugfs_create_automount(), since the intention\nhere is clearly to create a mountpoint. This fixes the regression,\nas locked child mounts on permanently empty directories do not\ncause a bind mount to fail.\n\nSigned-off-by: Seth Forshee <seth.forshee@canonical.com>\nAcked-by: Serge Hallyn <serge.hallyn@canonical.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TheDrHax/t100ta_kernel/commits/9b3bd581a0492bdfe788539ca65a14da570faad1"}]}