{"push_id":1253800837,"size":1000,"distinct_size":0,"ref":"refs/heads/n","head":"77830d6b4dd36600d8d3137264c9039c424d725a","before":"1d4611756e47c66f02c7c0c36f1ebc3912938d4f","commits":[{"sha":"ce2d9d54c06ac47ed658bc0cdc77f3abb40afe31","author":{"name":"Greg Kroah-Hartman","email":"4931344b09d7a7d3573e8b1ebec918e229ead9bf@linuxfoundation.org"},"message":"Linux 3.10.85\n\nChange-Id: I8151b85707b6f872569b051652ba6e821688f0c8","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/ce2d9d54c06ac47ed658bc0cdc77f3abb40afe31"},{"sha":"27849e8e595e9145c15f907e7f52155aec2f9353","author":{"name":"Tarun Karra","email":"2510a0714f96c923ea81ac473307af04ae122ae5@codeaurora.org"},"message":"msm: kgsl: Fix power api's used in fault interrupt sysfs control\n\nSysfs control of fault interrupt is using incorrect GPU power\ncontrol api's. *_clk api should not be used by rest of the\nGPU driver, use the correct api for consistency.\n\nSigned-off-by: Tarun Karra <tkarra@codeaurora.org>\nSigned-off-by: Pranav Vashi <neobuddy89@gmail.com>","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/27849e8e595e9145c15f907e7f52155aec2f9353"},{"sha":"1fba941088956af1bd95ffd4f9f7ebcb9fdcfb2e","author":{"name":"Venkat Gopalakrishnan","email":"1aea4bfea139e12d03cc2306ea5599fb29560086@codeaurora.org"},"message":"mmc: sdhci: Fix unclocked register access\n\nDuring platform driver probe we call mmc_start_host in sdhci_add_host,\nwhich could start the mmc_rescan work immediately and trigger a runtime\nsuspend. This creates a race condition where the clocks could be turned off\neven before the probe has completed leading to unclocked register access.\n\nSigned-off-by: Venkat Gopalakrishnan <venkatg@codeaurora.org>\nSigned-off-by: Pranav Vashi <neobuddy89@gmail.com>","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/1fba941088956af1bd95ffd4f9f7ebcb9fdcfb2e"},{"sha":"d3ef13fb6ea0369146d291309483d644932956da","author":{"name":"Tahsin Erdogan","email":"f575aabfcf931cdd93bfc82db2c7bb41f58ee7dd@google.com"},"message":"block: Make CFQ default to IOPS mode on SSDs\n\nCFQ idling causes reduced IOPS throughput on non-rotational disks.\nSince disk head seeking is not applicable to SSDs, it doesn't really\nhelp performance by anticipating future near-by IO requests.\n\nBy turning off idling (and switching to IOPS mode), we allow other\nprocesses to dispatch IO requests down to the driver and so increase IO\nthroughput.\n\nFollowing FIO benchmark results were taken on a cloud SSD offering with\nidling on and off:\n\nIdling     iops    avg-lat(ms)    stddev            bw\n------------------------------------------------------\n    On     7054    90.107         38.697     28217KB/s\n   Off    29255    21.836         11.730    117022KB/s\n\nfio --name=temp --size=100G --time_based --ioengine=libaio \\\n    --randrepeat=0 --direct=1 --invalidate=1 --verify=0 \\\n    --verify_fatal=0 --rw=randread --blocksize=4k --group_reporting=1 \\\n    --filename=/dev/sdb --runtime=10 --iodepth=64 --numjobs=10\n\nAnd the following is from a local SSD run:\n\nIdling     iops    avg-lat(ms)    stddev            bw\n------------------------------------------------------\n    On    19320    33.043         14.068     77281KB/s\n   Off    21626    29.465         12.662     86507KB/s\n\nfio --name=temp --size=5G --time_based --ioengine=libaio \\\n    --randrepeat=0 --direct=1 --invalidate=1 --verify=0 \\\n    --verify_fatal=0 --rw=randread --blocksize=4k --group_reporting=1 \\\n    --filename=/fio_data --runtime=10 --iodepth=64 --numjobs=10\n\nReviewed-by: Nauman Rafique <nauman@google.com>\nSigned-off-by: Tahsin Erdogan <tahsin@google.com>\nSigned-off-by: Jens Axboe <axboe@fb.com>\nSigned-off-by: Pranav Vashi <neobuddy89@gmail.com>","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/d3ef13fb6ea0369146d291309483d644932956da"},{"sha":"56a4d7636dcd291c09617d60695dae0a0d76b810","author":{"name":"Jens Axboe","email":"f8b120bbe297304053fa957b507156696820d130@fb.com"},"message":"cfq-iosched: fix the setting of IOPS mode on SSDs\n\nA previous commit wanted to make CFQ default to IOPS mode on\nnon-rotational storage, however it did so when the queue was\ninitialized and the non-rotational flag is only set later on\nin the probe.\n\nAdd an elevator hook that gets called off the add_disk() path,\nat that point we know that feature probing has finished, and\nwe can reliably check for the various flags that drivers can\nset.\n\nFixes: 41c0126b (\"block: Make CFQ default to IOPS mode on SSDs\")\nTested-by: Romain Francoise <romain@orebokech.com>\nSigned-off-by: Jens Axboe <axboe@fb.com>\nSigned-off-by: Pranav Vashi <neobuddy89@gmail.com>","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/56a4d7636dcd291c09617d60695dae0a0d76b810"},{"sha":"20e3bca73c11d843b6d6d94c9bbc8e3237d914e7","author":{"name":"Sahitya Tummala","email":"b7bf508aab3e5632db28abf288bf9b4635713caf@codeaurora.org"},"message":"mmc: core: Fix error handling of MMC_BLK_DATA_ERR\n\nAvoid retrying using single block for read commands that\nfail with MMC_BLK_DATA_ERR. The single block read retry\nis needed only in case of a CRC error for which\nMMC_BLK_ECC_ERR will be set anyway by mmc_blk_err_check().\n\nSigned-off-by: Sahitya Tummala <stummala@codeaurora.org>\nSigned-off-by: Pranav Vashi <neobuddy89@gmail.com>","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/20e3bca73c11d843b6d6d94c9bbc8e3237d914e7"},{"sha":"cad41dde4e77551e2e9e85dac6a9c310eb55d1ef","author":{"name":"Talel Shenhar","email":"6f87d6a35f71247c15741dfc953993d1966dbb6e@codeaurora.org"},"message":"mmc: block: fix flush timeout error handling\n\nThe eMMC card can go into \"reset state\" due to several\nreasons and without host involvement,\ne.g. low voltage detection.\nThis kind of eMMC card reset requires eMMC host to\nre-initialize the eMMC card.\nIn case of eMMC card reset, eMMC card firmware sets its\nstate to \"reset state\" which allows CMD0 only.\nIn case the eMMC host is in the middle of FLUSH request it will\nget timeout which will cause the driver to requeue the flush\nrequest and try it later on.\nThe problem with this is that no one is going to initialize\nthe eMMC card to move out of \"reset state\", hence, the flush\nrequest will keep on failing over and over again.\nThis commit adds a device reset for the case where flush request\nfails due to timeout.\n\nSigned-off-by: Talel Shenhar <tatias@codeaurora.org>\nSigned-off-by: Pranav Vashi <neobuddy89@gmail.com>","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/cad41dde4e77551e2e9e85dac6a9c310eb55d1ef"},{"sha":"53dd3f715addc0e8df7d1db823a19a383154ffe7","author":{"name":"Kirill A. Shutemov","email":"e4d0c2966af3c70025b28e24a0f33104c6291010@linux.intel.com"},"message":"mm: avoid setting up anonymous pages into file mapping\n\ncommit 6b7339f4c31ad69c8e9c0b2859276e22cf72176d upstream.\n\nReading page fault handler code I've noticed that under right\ncircumstances kernel would map anonymous pages into file mappings: if\nthe VMA doesn't have vm_ops->fault() and the VMA wasn't fully populated\non ->mmap(), kernel would handle page fault to not populated pte with\ndo_anonymous_page().\n\nLet's change page fault handler to use do_anonymous_page() only on\nanonymous VMA (->vm_ops == NULL) and make sure that the VMA is not\nshared.\n\nFor file mappings without vm_ops->fault() or shred VMA without vm_ops,\npage fault on pte_none() entry would lead to SIGBUS.\n\nSigned-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>\nAcked-by: Oleg Nesterov <oleg@redhat.com>\nCc: Andrew Morton <akpm@linux-foundation.org>\nCc: Willy Tarreau <w@1wt.eu>\nCc: stable@vger.kernel.org\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/53dd3f715addc0e8df7d1db823a19a383154ffe7"},{"sha":"1ff8eccdef9fde16a8da2fc7478c0cbb668616ef","author":{"name":"Al Viro","email":"2a537e97523ffee458777df5f34a2f8c9964f945@ZenIV.linux.org.uk"},"message":"freeing unlinked file indefinitely delayed\n\ncommit 75a6f82a0d10ef8f13cd8fe7212911a0252ab99e upstream.\n\n\tNormally opening a file, unlinking it and then closing will have\nthe inode freed upon close() (provided that it's not otherwise busy and\nhas no remaining links, of course).  However, there's one case where that\ndoes *not* happen.  Namely, if you open it by fhandle with cold dcache,\nthen unlink() and close().\n\n\tIn normal case you get d_delete() in unlink(2) notice that dentry\nis busy and unhash it; on the final dput() it will be forcibly evicted from\ndcache, triggering iput() and inode removal.  In this case, though, we end\nup with *two* dentries - disconnected (created by open-by-fhandle) and\nregular one (used by unlink()).  The latter will have its reference to inode\ndropped just fine, but the former will not - it's considered hashed (it\nis on the ->s_anon list), so it will stay around until the memory pressure\nwill finally do it in.  As the result, we have the final iput() delayed\nindefinitely.  It's trivial to reproduce -\n\nvoid flush_dcache(void)\n{\n        system(\"mount -o remount,rw /\");\n}\n\nstatic char buf[20 * 1024 * 1024];\n\nmain()\n{\n        int fd;\n        union {\n                struct file_handle f;\n                char buf[MAX_HANDLE_SZ];\n        } x;\n        int m;\n\n        x.f.handle_bytes = sizeof(x);\n        chdir(\"/root\");\n        mkdir(\"foo\", 0700);\n        fd = open(\"foo/bar\", O_CREAT | O_RDWR, 0600);\n        close(fd);\n        name_to_handle_at(AT_FDCWD, \"foo/bar\", &x.f, &m, 0);\n        flush_dcache();\n        fd = open_by_handle_at(AT_FDCWD, &x.f, O_RDWR);\n        unlink(\"foo/bar\");\n        write(fd, buf, sizeof(buf));\n        system(\"df .\");\t\t\t/* 20Mb eaten */\n        close(fd);\n        system(\"df .\");\t\t\t/* should've freed those 20Mb */\n        flush_dcache();\n        system(\"df .\");\t\t\t/* should be the same as #2 */\n}\n\nwill spit out something like\nFilesystem     1K-blocks   Used Available Use% Mounted on\n/dev/root         322023 303843      1131 100% /\nFilesystem     1K-blocks   Used Available Use% Mounted on\n/dev/root         322023 303843      1131 100% /\nFilesystem     1K-blocks   Used Available Use% Mounted on\n/dev/root         322023 283282     21692  93% /\n- inode gets freed only when dentry is finally evicted (here we trigger\nthan by remount; normally it would've happened in response to memory\npressure hell knows when).\n\nAcked-by: J. Bruce Fields <bfields@fieldses.org>\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/1ff8eccdef9fde16a8da2fc7478c0cbb668616ef"},{"sha":"83a0196835d5d475341c67758f82279b2f13611e","author":{"name":"Martin Schwidefsky","email":"9888847d934b0a2b68638ec948181961d68813c8@de.ibm.com"},"message":"s390/sclp: clear upper register halves in _sclp_print_early\n\ncommit f9c87a6f46d508eae0d9ae640be98d50f237f827 upstream.\n\nIf the kernel is compiled with gcc 5.1 and the XZ compression option\nthe decompress_kernel function calls _sclp_print_early in 64-bit mode\nwhile the content of the upper register half of %r6 is non-zero.\nThis causes a specification exception on the servc instruction in\n_sclp_servc.\n\nThe _sclp_print_early function saves and restores the upper registers\nhalves but it fails to clear them for the 31-bit code of the mini sclp\ndriver.\n\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/83a0196835d5d475341c67758f82279b2f13611e"},{"sha":"bca25ebd5b0298f15be9d391f6e102055823c8e1","author":{"name":"Alexey Brodkin","email":"00e1475b58c40168fd81030071cb38630a735fc1@synopsys.com"},"message":"ARC: make sure instruction_pointer() returns unsigned value\n\ncommit f51e2f1911122879eefefa4c592dea8bf794b39c upstream.\n\nCurrently instruction_pointer() returns pt_regs->ret and so return value\nis of type \"long\", which implicitly stands for \"signed long\".\n\nWhile that's perfectly fine when dealing with 32-bit values if return\nvalue of instruction_pointer() gets assigned to 64-bit variable sign\nextension may happen.\n\nAnd at least in one real use-case it happens already.\nIn perf_prepare_sample() return value of perf_instruction_pointer()\n(which is an alias to instruction_pointer() in case of ARC) is assigned\nto (struct perf_sample_data)->ip (which type is \"u64\").\n\nAnd what we see if instuction pointer points to user-space application\nthat in case of ARC lays below 0x8000_0000 \"ip\" gets set properly with\nleading 32 zeros. But if instruction pointer points to kernel address\nspace that starts from 0x8000_0000 then \"ip\" is set with 32 leadig\n\"f\"-s. I.e. id instruction_pointer() returns 0x8100_0000, \"ip\" will be\nassigned with 0xffff_ffff__8100_0000. Which is obviously wrong.\n\nIn particular that issuse broke output of perf, because perf was unable\nto associate addresses like 0xffff_ffff__8100_0000 with anything from\n/proc/kallsyms.\n\nThat's what we used to see:\n ----------->8----------\n  6.27%  ls       [unknown]                [k] 0xffffffff8046c5cc\n  2.96%  ls       libuClibc-0.9.34-git.so  [.] memcpy\n  2.25%  ls       libuClibc-0.9.34-git.so  [.] memset\n  1.66%  ls       [unknown]                [k] 0xffffffff80666536\n  1.54%  ls       libuClibc-0.9.34-git.so  [.] 0x000224d6\n  1.18%  ls       libuClibc-0.9.34-git.so  [.] 0x00022472\n ----------->8----------\n\nWith that change perf output looks much better now:\n ----------->8----------\n  8.21%  ls       [kernel.kallsyms]        [k] memset\n  3.52%  ls       libuClibc-0.9.34-git.so  [.] memcpy\n  2.11%  ls       libuClibc-0.9.34-git.so  [.] malloc\n  1.88%  ls       libuClibc-0.9.34-git.so  [.] memset\n  1.64%  ls       [kernel.kallsyms]        [k] _raw_spin_unlock_irqrestore\n  1.41%  ls       [kernel.kallsyms]        [k] __d_lookup_rcu\n ----------->8----------\n\nSigned-off-by: Alexey Brodkin <abrodkin@synopsys.com>\nCc: arc-linux-dev@synopsys.com\nCc: linux-kernel@vger.kernel.org\nSigned-off-by: Vineet Gupta <vgupta@synopsys.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/bca25ebd5b0298f15be9d391f6e102055823c8e1"},{"sha":"9fc56eee7472810c67f6420e20fafd4711f573b4","author":{"name":"Thomas Gleixner","email":"352b5f5ba0189d2583768a9bb8247f98115b9038@linutronix.de"},"message":"genirq: Prevent resend to interrupts marked IRQ_NESTED_THREAD\n\ncommit 75a06189fc508a2acf470b0b12710362ffb2c4b1 upstream.\n\nThe resend mechanism happily calls the interrupt handler of interrupts\nwhich are marked IRQ_NESTED_THREAD from softirq context. This can\nresult in crashes because the interrupt handler is not the proper way\nto invoke the device handlers. They must be invoked via\nhandle_nested_irq.\n\nPrevent the resend even if the interrupt has no valid parent irq\nset. Its better to have a lost interrupt than a crashing machine.\n\nReported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/9fc56eee7472810c67f6420e20fafd4711f573b4"},{"sha":"9c83d09a4b8fb346c018a4f9792d82169cb369ff","author":{"name":"Dominic Sacré","email":"0c783e240d738b6304ff492db6e95679960c705f@gmx.de"},"message":"ALSA: usb-audio: Add MIDI support for Steinberg MI2/MI4\n\ncommit 0689a86ae814f39af94a9736a0a5426dd82eb107 upstream.\n\nThe Steinberg MI2 and MI4 interfaces are compatible with the USB class\naudio spec, but the MIDI part of the devices is reported as a vendor\nspecific interface.\n\nThis patch adds entries to quirks-table.h to recognize the MIDI\nendpoints. Audio functionality was already working and is unaffected by\nthis change.\n\nSigned-off-by: Dominic Sacré <dominic.sacre@gmx.de>\nSigned-off-by: Albert Huitsing <albert@huitsing.nl>\nAcked-by: Clemens Ladisch <clemens@ladisch.de>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/9c83d09a4b8fb346c018a4f9792d82169cb369ff"},{"sha":"882fc46077946dc802cb7316b40dce3e60a36a6a","author":{"name":"Yao-Wen Mao","email":"bcdbcc1939765a989e4dcbbb88a0933e9ae8a96b@google.com"},"message":"ALSA: usb-audio: add dB range mapping for some devices\n\ncommit 2d1cb7f658fb9c3ba8f9dab8aca297d4dfdec835 upstream.\n\nAdd the correct dB ranges of Bose Companion 5 and Drangonfly DAC 1.2.\n\nSigned-off-by: Yao-Wen Mao <yaowen@google.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/882fc46077946dc802cb7316b40dce3e60a36a6a"},{"sha":"827586581a0124e46bef016ea21f02667c37de90","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: hda - Fix MacBook Pro 5,2 quirk\n\ncommit 649ccd08534ee26deb2e5b08509800d0e95167f5 upstream.\n\nMacBook Pro 5,2 with ALC889 codec had already a fixup entry, but this\nseems not working correctly, a fix for pin NID 0x15 is needed in\naddition.  It's equivalent with the fixup for MacBook Air 1,1, so use\nthis instead.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=102131\nReported-and-tested-by: Jeffery Miller <jefferym@gmail.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/827586581a0124e46bef016ea21f02667c37de90"},{"sha":"415bfbf710edfe380598531cf0713fabf041fd27","author":{"name":"Seymour, Shane M","email":"b4cd7e3cdf0c9d3196f47615e5dbcceee566a04d@hp.com"},"message":"st: null pointer dereference panic caused by use after kref_put by st_open\n\ncommit e7ac6c6666bec0a354758a1298d3231e4a635362 upstream.\n\nTwo SLES11 SP3 servers encountered similar crashes simultaneously\nfollowing some kind of SAN/tape target issue:\n\n...\nqla2xxx [0000:81:00.0]-801c:3: Abort command issued nexus=3:0:2 --  1 2002.\nqla2xxx [0000:81:00.0]-801c:3: Abort command issued nexus=3:0:2 --  1 2002.\nqla2xxx [0000:81:00.0]-8009:3: DEVICE RESET ISSUED nexus=3:0:2 cmd=ffff882f89c2c7c0.\nqla2xxx [0000:81:00.0]-800c:3: do_reset failed for cmd=ffff882f89c2c7c0.\nqla2xxx [0000:81:00.0]-800f:3: DEVICE RESET FAILED: Task management failed nexus=3:0:2 cmd=ffff882f89c2c7c0.\nqla2xxx [0000:81:00.0]-8009:3: TARGET RESET ISSUED nexus=3:0:2 cmd=ffff882f89c2c7c0.\nqla2xxx [0000:81:00.0]-800c:3: do_reset failed for cmd=ffff882f89c2c7c0.\nqla2xxx [0000:81:00.0]-800f:3: TARGET RESET FAILED: Task management failed nexus=3:0:2 cmd=ffff882f89c2c7c0.\nqla2xxx [0000:81:00.0]-8012:3: BUS RESET ISSUED nexus=3:0:2.\nqla2xxx [0000:81:00.0]-802b:3: BUS RESET SUCCEEDED nexus=3:0:2.\nqla2xxx [0000:81:00.0]-505f:3: Link is operational (8 Gbps).\nqla2xxx [0000:81:00.0]-8018:3: ADAPTER RESET ISSUED nexus=3:0:2.\nqla2xxx [0000:81:00.0]-00af:3: Performing ISP error recovery - ha=ffff88bf04d18000.\n rport-3:0-0: blocked FC remote port time out: removing target and saving binding\nqla2xxx [0000:81:00.0]-505f:3: Link is operational (8 Gbps).\nqla2xxx [0000:81:00.0]-8017:3: ADAPTER RESET SUCCEEDED nexus=3:0:2.\n rport-2:0-0: blocked FC remote port time out: removing target and saving binding\nsg_rq_end_io: device detached\nBUG: unable to handle kernel NULL pointer dereference at 00000000000002a8\nIP: [<ffffffff8133b268>] __pm_runtime_idle+0x28/0x90\nPGD 7e6586f067 PUD 7e5af06067 PMD 0 [1739975.390354] Oops: 0002 [#1] SMP\nCPU 0\n...\nSupported: No, Proprietary modules are loaded [1739975.390463]\nPid: 27965, comm: ABCD Tainted: PF           X 3.0.101-0.29-default #1 HP ProLiant DL580 Gen8\nRIP: 0010:[<ffffffff8133b268>]  [<ffffffff8133b268>] __pm_runtime_idle+0x28/0x90\nRSP: 0018:ffff8839dc1e7c68  EFLAGS: 00010202\nRAX: 0000000000000000 RBX: ffff883f0592fc00 RCX: 0000000000000090\nRDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000138\nRBP: 0000000000000138 R08: 0000000000000010 R09: ffffffff81bd39d0\nR10: 00000000000009c0 R11: ffffffff81025790 R12: 0000000000000001\nR13: ffff883022212b80 R14: 0000000000000004 R15: ffff883022212b80\nFS:  00007f8e54560720(0000) GS:ffff88407f800000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b\nCR2: 00000000000002a8 CR3: 0000007e6ced6000 CR4: 00000000001407f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\nProcess ABCD (pid: 27965, threadinfo ffff8839dc1e6000, task ffff883592e0c640)\nStack:\n ffff883f0592fc00 00000000fffffffa 0000000000000001 ffff883022212b80\n ffff883eff772400 ffffffffa03fa309 0000000000000000 0000000000000000\n ffffffffa04003a0 ffff883f063196c0 ffff887f0379a930 ffffffff8115ea1e\nCall Trace:\n [<ffffffffa03fa309>] st_open+0x129/0x240 [st]\n [<ffffffff8115ea1e>] chrdev_open+0x13e/0x200\n [<ffffffff811588a8>] __dentry_open+0x198/0x310\n [<ffffffff81167d74>] do_last+0x1f4/0x800\n [<ffffffff81168fe9>] path_openat+0xd9/0x420\n [<ffffffff8116946c>] do_filp_open+0x4c/0xc0\n [<ffffffff8115a00f>] do_sys_open+0x17f/0x250\n [<ffffffff81468d92>] system_call_fastpath+0x16/0x1b\n [<00007f8e4f617fd0>] 0x7f8e4f617fcf\nCode: eb d3 90 48 83 ec 28 40 f6 c6 04 48 89 6c 24 08 4c 89 74 24 20 48 89 fd 48 89 1c 24 4c 89 64 24 10 41 89 f6 4c 89 6c 24 18 74 11 <f0> ff 8f 70 01 00 00 0f 94 c0 45 31 ed 84 c0 74 2b 4c 8d a5 a0\nRIP  [<ffffffff8133b268>] __pm_runtime_idle+0x28/0x90\n RSP <ffff8839dc1e7c68>\nCR2: 00000000000002a8\n\nAnalysis reveals the cause of the crash to be due to STp->device\nbeing NULL. The pointer was NULLed via scsi_tape_put(STp) when it\ncalls scsi_tape_release(). In st_open() we jump to err_out after\nscsi_block_when_processing_errors() completes and returns the\ndevice as offline (sdev_state was SDEV_DEL):\n\n1180 /* Open the device. Needs to take the BKL only because of incrementing the SCSI host\n1181    module count. */\n1182 static int st_open(struct inode *inode, struct file *filp)\n1183 {\n1184         int i, retval = (-EIO);\n1185         int resumed = 0;\n1186         struct scsi_tape *STp;\n1187         struct st_partstat *STps;\n1188         int dev = TAPE_NR(inode);\n1189         char *name;\n...\n1217         if (scsi_autopm_get_device(STp->device) < 0) {\n1218                 retval = -EIO;\n1219                 goto err_out;\n1220         }\n1221         resumed = 1;\n1222         if (!scsi_block_when_processing_errors(STp->device)) {\n1223                 retval = (-ENXIO);\n1224                 goto err_out;\n1225         }\n...\n1264  err_out:\n1265         normalize_buffer(STp->buffer);\n1266         spin_lock(&st_use_lock);\n1267         STp->in_use = 0;\n1268         spin_unlock(&st_use_lock);\n1269         scsi_tape_put(STp); <-- STp->device = 0 after this\n1270         if (resumed)\n1271                 scsi_autopm_put_device(STp->device);\n1272         return retval;\n\nThe ref count for the struct scsi_tape had already been reduced\nto 1 when the .remove method of the st module had been called.\nThe kref_put() in scsi_tape_put() caused scsi_tape_release()\nto be called:\n\n0266 static void scsi_tape_put(struct scsi_tape *STp)\n0267 {\n0268         struct scsi_device *sdev = STp->device;\n0269\n0270         mutex_lock(&st_ref_mutex);\n0271         kref_put(&STp->kref, scsi_tape_release); <-- calls this\n0272         scsi_device_put(sdev);\n0273         mutex_unlock(&st_ref_mutex);\n0274 }\n\nIn scsi_tape_release() the struct scsi_device in the struct\nscsi_tape gets set to NULL:\n\n4273 static void scsi_tape_release(struct kref *kref)\n4274 {\n4275         struct scsi_tape *tpnt = to_scsi_tape(kref);\n4276         struct gendisk *disk = tpnt->disk;\n4277\n4278         tpnt->device = NULL; <<<---- where the dev is nulled\n4279\n4280         if (tpnt->buffer) {\n4281                 normalize_buffer(tpnt->buffer);\n4282                 kfree(tpnt->buffer->reserved_pages);\n4283                 kfree(tpnt->buffer);\n4284         }\n4285\n4286         disk->private_data = NULL;\n4287         put_disk(disk);\n4288         kfree(tpnt);\n4289         return;\n4290 }\n\nAlthough the problem was reported on SLES11.3 the problem appears\nin linux-next as well.\n\nThe crash is fixed by reordering the code so we no longer access\nthe struct scsi_tape after the kref_put() is done on it in st_open().\n\nSigned-off-by: Shane Seymour <shane.seymour@hp.com>\nSigned-off-by: Darren Lavender <darren.lavender@hp.com>\nReviewed-by: Johannes Thumshirn <jthumshirn@suse.com>\nAcked-by: Kai Mäkisara <kai.makisara@kolumbus.fi>\nSigned-off-by: James Bottomley <JBottomley@Odin.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/415bfbf710edfe380598531cf0713fabf041fd27"},{"sha":"d56c86e6ed3885038cdb62ce59c10073e93e5796","author":{"name":"Tom Hughes","email":"55bc7b18e460d0d077310393ffbc002e6fe4eaec@compton.nu"},"message":"mac80211: clear subdir_stations when removing debugfs\n\ncommit 4479004e6409087d1b4986881dc98c6c15dffb28 upstream.\n\nIf we don't do this, and we then fail to recreate the debugfs\ndirectory during a mode change, then we will fail later trying\nto add stations to this now bogus directory:\n\nBUG: unable to handle kernel NULL pointer dereference at 0000006c\nIP: [<c0a92202>] mutex_lock+0x12/0x30\nCall Trace:\n[<c0678ab4>] start_creating+0x44/0xc0\n[<c0679203>] debugfs_create_dir+0x13/0xf0\n[<f8a938ae>] ieee80211_sta_debugfs_add+0x6e/0x490 [mac80211]\n\nSigned-off-by: Tom Hughes <tom@compton.nu>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/d56c86e6ed3885038cdb62ce59c10073e93e5796"},{"sha":"88c457053f0fa8bb3723c239195ff915d3fdf798","author":{"name":"Joakim Tjernlund","email":"3736abe2c3717f106e2fd124355525df7a33da64@transmode.se"},"message":"mmc: sdhci-esdhc: Make 8BIT bus work\n\ncommit 8e91125ff3f57f15c6568e2a6d32743b3f7815e4 upstream.\n\nSupport for 8BIT bus with was added some time ago to sdhci-esdhc but\nthen missed to remove the 8BIT from the reserved bit mask which made\n8BIT non functional.\n\nFixes: 66b50a00992d (\"mmc: esdhc: Add support for 8-bit bus width and..\")\nSigned-off-by: Joakim Tjernlund <joakim.tjernlund@transmode.se>\nSigned-off-by: Ulf Hansson <ulf.hansson@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/88c457053f0fa8bb3723c239195ff915d3fdf798"},{"sha":"382d04989f6682ad990806e2926fb3a8166f8702","author":{"name":"Jingju Hou","email":"6599cca8885007547b2245a91ee17ad3c6c48d10@marvell.com"},"message":"mmc: sdhci-pxav3: fix platform_data is not initialized\n\ncommit 9cd76049f0d90ae241f5ad80e311489824527000 upstream.\n\npdev->dev.platform_data is not initialized if match is true in function\nsdhci_pxav3_probe. Just local variable pdata is assigned the return value\nfrom function pxav3_get_mmc_pdata().\n\nstatic int sdhci_pxav3_probe(struct platform_device *pdev) {\n\n    struct sdhci_pxa_platdata *pdata = pdev->dev.platform_data;\n    ...\n    if (match) {\n\t\tret = mmc_of_parse(host->mmc);\n\t\tif (ret)\n\t\t\tgoto err_of_parse;\n\t\tsdhci_get_of_property(pdev);\n\t\tpdata = pxav3_get_mmc_pdata(dev);\n     }\n     ...\n}\n\nSigned-off-by: Jingju Hou <houjingj@marvell.com>\nFixes: b650352dd3df(\"mmc: sdhci-pxa: Add device tree support\")\nSigned-off-by: Ulf Hansson <ulf.hansson@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/382d04989f6682ad990806e2926fb3a8166f8702"},{"sha":"09b60844ee0af45ba88d8985140571250f143a67","author":{"name":"NeilBrown","email":"2d905a3497a379bccf401a15c6d441d61e66863c@suse.com"},"message":"md/raid1: fix test for 'was read error from last working device'.\n\ncommit 34cab6f42003cb06f48f86a86652984dec338ae9 upstream.\n\nWhen we get a read error from the last working device, we don't\ntry to repair it, and don't fail the device.  We simple report a\nread error to the caller.\n\nHowever the current test for 'is this the last working device' is\nwrong.\nWhen there is only one fully working device, it assumes that a\nnon-faulty device is that device.  However a spare which is rebuilding\nwould be non-faulty but so not the only working device.\n\nSo change the test from \"!Faulty\" to \"In_sync\".  If ->degraded says\nthere is only one fully working device and this device is in_sync,\nthis must be the one.\n\nThis bug has existed since we allowed read_balance to read from\na recovering spare in v3.0\n\nReported-and-tested-by: Alexander Lyakas <alex.bolshoy@gmail.com>\nFixes: 76073054c95b (\"md/raid1: clean up read_balance.\")\nSigned-off-by: NeilBrown <neilb@suse.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/moepda/android_kernel_moto_shamu_npr/commits/09b60844ee0af45ba88d8985140571250f143a67"}]}
{"actor":{"display_login":"moepda"}}