{"push_id":1368397426,"size":17,"distinct_size":17,"ref":"refs/heads/korg/linux-3.10.y","head":"7828a9658951301a3fd83daa4ed0a607d370399e","before":"2ecaf1d025af0f481d00b3701ffbcc600dcab076","commits":[{"sha":"baa032f71a5afac624f3626243ac26e5bef1adea","author":{"name":"Willy Tarreau","email":"660f093d7e527fcd150800cea013d3ef87632346@1wt.eu"},"message":"Revert \"powerpc/tm: Always reclaim in start_thread() for exec() class syscalls\"\n\nThis reverts commit 8110080dc53335d5dd99b123144a6174f19ffc65.\n\nGuenter noticed that this breaks PPC build when CONFIG_PPC_TRANSACTIONAL_MEM\nis set, because this patch was not for 3.10.\n\nCc: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/baa032f71a5afac624f3626243ac26e5bef1adea"},{"sha":"b49f7a4a3298efa81ef22b83c3818733a48858c2","author":{"name":"Jason S. McMullan","email":"03daf1315a8d2edcd601a5e919928792968500b2@netronome.com"},"message":"PCI: Support PCIe devices with short cfg_size\n\ncommit c20aecf6963d1273d8f6d61c042b4845441ca592 upstream.\n\nIf a device quirk modifies the pci_dev->cfg_size to be less than\nPCI_CFG_SPACE_EXP_SIZE (4096), but greater than PCI_CFG_SPACE_SIZE (256),\nthe PCI sysfs interface truncates the readable size to PCI_CFG_SPACE_SIZE.\n\nAllow sysfs access to config space up to cfg_size, even if the device\ndoesn't support the entire 4096-byte PCIe config space.\n\nNote that pci_read_config() and pci_write_config() limit access to\ndev->cfg_size even though pcie_config_attr contains 4096 (the maximum\nsize).\n\nSigned-off-by: Jason S. McMullan <jason.mcmullan@netronome.com>\n[simon: edited changelog]\nSigned-off-by: Simon Horman <simon.horman@netronome.com>\n[bhelgaas: more changelog edits]\nSigned-off-by: Bjorn Helgaas <bhelgaas@google.com>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/b49f7a4a3298efa81ef22b83c3818733a48858c2"},{"sha":"a4697a4c170a161d37f595544da7484d18ca1e76","author":{"name":"Jason S. McMullan","email":"03daf1315a8d2edcd601a5e919928792968500b2@netronome.com"},"message":"PCI: Add Netronome vendor and device IDs\n\ncommit a755e169031dac9ebaed03302c4921687c271d62 upstream.\n\nDevice IDs for the Netronome NFP3200, NFP3240, NFP6000, and NFP6000 SR-IOV\ndevices.\n\nSigned-off-by: Jason S. McMullan <jason.mcmullan@netronome.com>\n[simon: edited changelog]\nSigned-off-by: Simon Horman <simon.horman@netronome.com>\nSigned-off-by: Bjorn Helgaas <bhelgaas@google.com>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/a4697a4c170a161d37f595544da7484d18ca1e76"},{"sha":"b0e39bc161a1359110a56b0f28fcc6551d5353fd","author":{"name":"Jason S. McMullan","email":"03daf1315a8d2edcd601a5e919928792968500b2@netronome.com"},"message":"PCI: Limit config space size for Netronome NFP6000 family\n\ncommit 9f33a2ae59f24452c1076749deb615bccd435ca9 upstream.\n\nThe NFP6000 has an erratum where reading/writing to PCI config space\naddresses above 0x600 can cause the NFP to generate PCIe completion\ntimeouts.\n\nLimit the NFP6000's config space size to 0x600 bytes.\n\nSigned-off-by: Jason S. McMullan <jason.mcmullan@netronome.com>\n[simon: edited changelog]\nSigned-off-by: Simon Horman <simon.horman@netronome.com>\nSigned-off-by: Bjorn Helgaas <bhelgaas@google.com>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/b0e39bc161a1359110a56b0f28fcc6551d5353fd"},{"sha":"0c8b61323bb6d7adc98ced4b2f21b38e780dd2de","author":{"name":"Simon Horman","email":"f7123f56b775f32434663a1d9bc86525ea0b75ec@netronome.com"},"message":"PCI: Add Netronome NFP4000 PF device ID\n\ncommit 69874ec233871a62e1bc8c89e643993af93a8630 upstream.\n\nAdd the device ID for the PF of the NFP4000.  The device ID for the VF,\n0x6003, is already present as PCI_DEVICE_ID_NETRONOME_NFP6000_VF.\n\nSigned-off-by: Simon Horman <simon.horman@netronome.com>\nSigned-off-by: Bjorn Helgaas <bhelgaas@google.com>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/0c8b61323bb6d7adc98ced4b2f21b38e780dd2de"},{"sha":"af2e23465a7ecd9f281506e238451d536a8e8f14","author":{"name":"Simon Horman","email":"f7123f56b775f32434663a1d9bc86525ea0b75ec@netronome.com"},"message":"PCI: Limit config space size for Netronome NFP4000\n\ncommit c2e771b02792d222cbcd9617fe71482a64f52647 upstream.\n\nLike the NFP6000, the NFP4000 as an erratum where reading/writing to PCI\nconfig space addresses above 0x600 can cause the NFP to generate PCIe\ncompletion timeouts.\n\nLimit the NFP4000's PF's config space size to 0x600 bytes as is already\ndone for the NFP6000.\n\nThe NFP4000's VF is 0x6004 (PCI_DEVICE_ID_NETRONOME_NFP6000_VF), the same\ndevice ID as the NFP6000's VF.  Thus, its config space is already limited\nby the existing use of quirk_nfp6000().\n\nSigned-off-by: Simon Horman <simon.horman@netronome.com>\nSigned-off-by: Bjorn Helgaas <bhelgaas@google.com>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/af2e23465a7ecd9f281506e238451d536a8e8f14"},{"sha":"2c0ffdb8571a7d123e7546b0d8240a6a31c6cd91","author":{"name":"Dave Carroll","email":"b29f82b30544672af64ad35fbbcd8c458c682cf4@microsemi.com"},"message":"aacraid: Check size values after double-fetch from user\n\ncommit fa00c437eef8dc2e7b25f8cd868cfa405fcc2bb3 upstream.\n\nIn aacraid's ioctl_send_fib() we do two fetches from userspace, one the\nget the fib header's size and one for the fib itself. Later we use the\nsize field from the second fetch to further process the fib. If for some\nreason the size from the second fetch is different than from the first\nfix, we may encounter an out-of- bounds access in aac_fib_send(). We\nalso check the sender size to insure it is not out of bounds. This was\nreported in https://bugzilla.kernel.org/show_bug.cgi?id=116751 and was\nassigned CVE-2016-6480.\n\nReported-by: Pengfei Wang <wpengfeinudt@gmail.com>\nFixes: 7c00ffa31 '[SCSI] 2.6 aacraid: Variable FIB size (updated patch)'\nCc: stable@vger.kernel.org\nSigned-off-by: Dave Carroll <david.carroll@microsemi.com>\nReviewed-by: Johannes Thumshirn <jthumshirn@suse.de>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/2c0ffdb8571a7d123e7546b0d8240a6a31c6cd91"},{"sha":"40605334e4a94d005e78684beed7f38fe7e23729","author":{"name":"Yinghai Lu","email":"a937ac6bd902974249c050ded6c056a9879800aa@kernel.org"},"message":"megaraid_sas: Fix probing cards without io port\n\ncommit e7f851684efb3377e9c93aca7fae6e76212e5680 upstream.\n\nFound one megaraid_sas HBA probe fails,\n\n[  187.235190] scsi host2: Avago SAS based MegaRAID driver\n[  191.112365] megaraid_sas 0000:89:00.0: BAR 0: can't reserve [io  0x0000-0x00ff]\n[  191.120548] megaraid_sas 0000:89:00.0: IO memory region busy!\n\nand the card has resource like,\n[  125.097714] pci 0000:89:00.0: [1000:005d] type 00 class 0x010400\n[  125.104446] pci 0000:89:00.0: reg 0x10: [io  0x0000-0x00ff]\n[  125.110686] pci 0000:89:00.0: reg 0x14: [mem 0xce400000-0xce40ffff 64bit]\n[  125.118286] pci 0000:89:00.0: reg 0x1c: [mem 0xce300000-0xce3fffff 64bit]\n[  125.125891] pci 0000:89:00.0: reg 0x30: [mem 0xce200000-0xce2fffff pref]\n\nthat does not io port resource allocated from BIOS, and kernel can not\nassign one as io port shortage.\n\nThe driver is only looking for MEM, and should not fail.\n\nIt turns out megasas_init_fw() etc are using bar index as mask.  index 1\nis used as mask 1, so that pci_request_selected_regions() is trying to\nrequest BAR0 instead of BAR1.\n\nFix all related reference.\n\nFixes: b6d5d8808b4c (\"megaraid_sas: Use lowest memory bar for SR-IOV VF support\")\nSigned-off-by: Yinghai Lu <yinghai@kernel.org>\nAcked-by: Kashyap Desai <kashyap.desai@broadcom.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/40605334e4a94d005e78684beed7f38fe7e23729"},{"sha":"c0a803c102d6d82f08ccfa2c2c526da7f0cfb0f0","author":{"name":"Dan Carpenter","email":"60b2bf2bc0bec4ca4a4b046ca7ef9255248abff8@oracle.com"},"message":"crypto: nx - off by one bug in nx_of_update_msc()\n\ncommit e514cc0a492a3f39ef71b31590a7ef67537ee04b upstream.\n\nThe props->ap[] array is defined like this:\n\n\tstruct alg_props ap[NX_MAX_FC][NX_MAX_MODE][3];\n\nSo we can see that if msc->fc and msc->mode are == to NX_MAX_FC or\nNX_MAX_MODE then we're off by one.\n\nFixes: ae0222b7289d ('powerpc/crypto: nx driver code supporting nx encryption')\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/c0a803c102d6d82f08ccfa2c2c526da7f0cfb0f0"},{"sha":"479c12a03b99cab376b02b28aab81ea450f2137a","author":{"name":"Ian Abbott","email":"494c7f4da2ed9b356b47e2dfeca52bf8ebbb3680@mev.co.uk"},"message":"staging: comedi: daqboard2000: bug fix board type matching code\n\ncommit 80e162ee9b31d77d851b10f8c5299132be1e120f upstream.\n\n`daqboard2000_find_boardinfo()` is supposed to check if the\nDaqBoard/2000 series model is supported, based on the PCI subvendor and\nsubdevice ID.  The current code is wrong as it is comparing the PCI\ndevice's subdevice ID to an expected, fixed value for the subvendor ID.\nIt should be comparing the PCI device's subvendor ID to this fixed\nvalue.  Correct it.\n\nFixes: 7e8401b23e7f (\"staging: comedi: daqboard2000: add back\nsubsystem_device check\")\nSigned-off-by: Ian Abbott <abbotti@mev.co.uk>\nCc: <stable@vger.kernel.org> # 3.7+\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/479c12a03b99cab376b02b28aab81ea450f2137a"},{"sha":"40772621b96c5c05e3cb28d60f43bd77f963cabd","author":{"name":"Dan Carpenter","email":"60b2bf2bc0bec4ca4a4b046ca7ef9255248abff8@oracle.com"},"message":"ACPI / sysfs: fix error code in get_status()\n\ncommit f18ebc211e259d4f591e39e74b2aa2de226c9a1d upstream.\n\nThe problem with ornamental, do-nothing gotos is that they lead to\n\"forgot to set the error code\" bugs.  We should be returning -EINVAL\nhere but we don't.  It leads to an uninitalized variable in\ncounter_show():\n\n    drivers/acpi/sysfs.c:603 counter_show()\n    error: uninitialized symbol 'status'.\n\nFixes: 1c8fce27e275 (ACPI: introduce drivers/acpi/sysfs.c)\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/40772621b96c5c05e3cb28d60f43bd77f963cabd"},{"sha":"afac3781d218861569ff1b4ced4f8a29be997ed4","author":{"name":"Andrea Arcangeli","email":"8f0ff3ae3e0410649e6b0c52f3097c492f04482f@redhat.com"},"message":"mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED\n\ncommit ad33bb04b2a6cee6c1f99fabb15cddbf93ff0433 upstream.\n\npmd_trans_unstable()/pmd_none_or_trans_huge_or_clear_bad() were\nintroduced to locklessy (but atomically) detect when a pmd is a regular\n(stable) pmd or when the pmd is unstable and can infinitely transition\nfrom pmd_none() and pmd_trans_huge() from under us, while only holding\nthe mmap_sem for reading (for writing not).\n\nWhile holding the mmap_sem only for reading, MADV_DONTNEED can run from\nunder us and so before we can assume the pmd to be a regular stable pmd\nwe need to compare it against pmd_none() and pmd_trans_huge() in an\natomic way, with pmd_trans_unstable().  The old pmd_trans_huge() left a\ntiny window for a race.\n\nUseful applications are unlikely to notice the difference as doing\nMADV_DONTNEED concurrently with a page fault would lead to undefined\nbehavior.\n\n[js] 3.12 backport: no pmd_devmap in 3.12 yet.\n\n[akpm@linux-foundation.org: tidy up comment grammar/layout]\nSigned-off-by: Andrea Arcangeli <aarcange@redhat.com>\nReported-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Vlastimil Babka <vbabka@suse.cz>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/afac3781d218861569ff1b4ced4f8a29be997ed4"},{"sha":"fea24c07f635457eaa7b8422b5300e7b49e57a2b","author":{"name":"James Hogan","email":"00935fde11ed589f6e5a2cfc70182e355d2baa37@imgtec.com"},"message":"MIPS: KVM: Check for pfn noslot case\n\ncommit ba913e4f72fc9cfd03dad968dfb110eb49211d80 upstream.\n\nWhen mapping a page into the guest we error check using is_error_pfn(),\nhowever this doesn't detect a value of KVM_PFN_NOSLOT, indicating an\nerror HVA for the page. This can only happen on MIPS right now due to\nunusual memslot management (e.g. being moved / removed / resized), or\nwith an Enhanced Virtual Memory (EVA) configuration where the default\nKVM_HVA_ERR_* and kvm_is_error_hva() definitions are unsuitable (fixed\nin a later patch). This case will be treated as a pfn of zero, mapping\nthe first page of physical memory into the guest.\n\nIt would appear the MIPS KVM port wasn't updated prior to being merged\n(in v3.10) to take commit 81c52c56e2b4 (\"KVM: do not treat noslot pfn as\na error pfn\") into account (merged v3.8), which converted a bunch of\nis_error_pfn() calls to is_error_noslot_pfn(). Switch to using\nis_error_noslot_pfn() instead to catch this case properly.\n\nFixes: 858dd5d45733 (\"KVM/MIPS32: MMU/TLB operations for the Guest.\")\nSigned-off-by: James Hogan <james.hogan@imgtec.com>\nCc: Paolo Bonzini <pbonzini@redhat.com>\nCc: \"Radim KrÄmÃ¡Å\" <rkrcmar@redhat.com>\nCc: Ralf Baechle <ralf@linux-mips.org>\nCc: linux-mips@linux-mips.org\nCc: kvm@vger.kernel.org\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\n[james.hogan@imgtec.com: Backport to v3.16.y]\nSigned-off-by: James Hogan <james.hogan@imgtec.com>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/fea24c07f635457eaa7b8422b5300e7b49e57a2b"},{"sha":"72f0c1143c836de1af5edae0aba1d2db80f9ccd0","author":{"name":"Jann Horn","email":"56d347afa87ea2ef19771afd2a88746144865893@thejh.net"},"message":"security: let security modules use PTRACE_MODE_* with bitmasks\n\ncommit 3dfb7d8cdbc7ea0c2970450e60818bb3eefbad69 upstream.\n\nIt looks like smack and yama weren't aware that the ptrace mode\ncan have flags ORed into it - PTRACE_MODE_NOAUDIT until now, but\nonly for /proc/$pid/stat, and with the PTRACE_MODE_*CREDS patch,\nall modes have flags ORed into them.\n\nSigned-off-by: Jann Horn <jann@thejh.net>\nAcked-by: Kees Cook <keescook@chromium.org>\nAcked-by: Casey Schaufler <casey@schaufler-ca.com>\nCc: Oleg Nesterov <oleg@redhat.com>\nCc: Ingo Molnar <mingo@redhat.com>\nCc: James Morris <james.l.morris@oracle.com>\nCc: \"Serge E. Hallyn\" <serge.hallyn@ubuntu.com>\nCc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>\nCc: Andy Lutomirski <luto@kernel.org>\nCc: Al Viro <viro@zeniv.linux.org.uk>\nCc: \"Eric W. Biederman\" <ebiederm@xmission.com>\nCc: Willy Tarreau <w@1wt.eu>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n[wt: no smk_ptrace_mode() in 3.10]\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/72f0c1143c836de1af5edae0aba1d2db80f9ccd0"},{"sha":"4cebb475eb0f713547dcbdd8c11be535930b1660","author":{"name":"Wei Liu","email":"fa4f319e660138b996995f45a8e22bf1fdae6f2a@citrix.com"},"message":"xen-netback: ref count shared rings\n\n... so that we can make sure the rings are not freed until all SKBs in\ninternal queues are consumed.\n\n1. The VM is receiving packets through bonding + bridge + netback +\n   netfront.\n2. For some unknown reason at least one packet remains in the rx queue\n   and is not delivered to the domU immediately by netback.\n3. The VM finishes shutting down.\n4. The shared ring between dom0 and domU is freed.\n5. then xen-netback continues processing the pending requests and tries\n   to put the packet into the now already released shared ring.\n\n> XXXlan0: port 9(vif26.0) entered disabled state\n> BUG: unable to handle kernel paging request at ffffc900108641d8\n> IP: [<ffffffffa04147dc>] xen_netbk_rx_action+0x18b/0x6f0 [xen_netback]\n> PGD 57e20067 PUD 57e21067 PMD 571a7067 PTE 0\n> Oops: 0000 [#1] SMP\n> ...\n> CPU: 0 PID: 12587 Comm: netback/0 Not tainted 3.10.0-ucs58-amd64 #1 Debian 3.10.11-1.58.201405060908\n> Hardware name: FUJITSU PRIMERGY BX620 S6/D3051, BIOS 080015 Rev.3C78.3051 07/22/2011\n> task: ffff880004b067c0 ti: ffff8800561ec000 task.ti: ffff8800561ec000\n> RIP: e030:[<ffffffffa04147dc>]  [<ffffffffa04147dc>] xen_netbk_rx_action+0x18b/0x6f0 [xen_netback]\n> RSP: e02b:ffff8800561edce8  EFLAGS: 00010202\n> RAX: ffffc900104adac0 RBX: ffff8800541e95c0 RCX: ffffc90010864000\n> RDX: 000000000000003b RSI: 0000000000000000 RDI: ffff880040014380\n> RBP: ffff8800570e6800 R08: 0000000000000000 R09: ffff880004799800\n> R10: ffffffff813ca115 R11: ffff88005e4fdb08 R12: ffff880054e6f800\n> R13: ffff8800561edd58 R14: ffffc900104a1000 R15: 0000000000000000\n> FS:  00007f19a54a8700(0000) GS:ffff88005da00000(0000) knlGS:0000000000000000\n> CS:  e033 DS: 0000 ES: 0000 CR0: 000000008005003b\n> CR2: ffffc900108641d8 CR3: 0000000054cb3000 CR4: 0000000000002660\n> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n> DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n> Stack:\n>  ffff880004b06ba0 0000000000000000 ffff88005da13ec0 ffff88005da13ec0\n>  0000000004b067c0 ffffc900104a8ac0 ffffc900104a1020 000000005da13ec0\n>  0000000000000000 0000000000000001 ffffc900104a8ac0 ffffc900104adac0\n> Call Trace:\n>  [<ffffffff813ca32d>] ? _raw_spin_lock_irqsave+0x11/0x2f\n>  [<ffffffffa0416033>] ? xen_netbk_kthread+0x174/0x841 [xen_netback]\n>  [<ffffffff8105d373>] ? wake_up_bit+0x20/0x20\n>  [<ffffffffa0415ebf>] ? xen_netbk_tx_build_gops+0xce8/0xce8 [xen_netback]\n>  [<ffffffff8105cd73>] ? kthread_freezable_should_stop+0x56/0x56\n>  [<ffffffffa0415ebf>] ? xen_netbk_tx_build_gops+0xce8/0xce8 [xen_netback]\n>  [<ffffffff8105ce1e>] ? kthread+0xab/0xb3\n>  [<ffffffff81003638>] ? xen_end_context_switch+0xe/0x1c\n>  [<ffffffff8105cd73>] ? kthread_freezable_should_stop+0x56/0x56\n>  [<ffffffff813cfbfc>] ? ret_from_fork+0x7c/0xb0\n>  [<ffffffff8105cd73>] ? kthread_freezable_should_stop+0x56/0x56\n> Code: 8b b3 d0 00 00 00 48 8b bb d8 00 00 00 0f b7 74 37 02 89 70 08 eb 07 c7 40 08 00 00 00 00 89 d2 c7 40 04 00 00 00 00 48 83 c2 08 <0f> b7 34 d1 89 30 c7 44 24 60 00 00 00 00 8b 44 d1 04 89 44 24\n> RIP  [<ffffffffa04147dc>] xen_netbk_rx_action+0x18b/0x6f0 [xen_netback]\n>  RSP <ffff8800561edce8>\n> CR2: ffffc900108641d8\n\nTrack the shared ring buffer being unmapped and drop those packets.\n\nRef-count the rings as followed:\n  map         -> set to 1\n   start_xmit -> inc when queueing SKB to internal queue\n   rx_action  -> dec after finishing processing a SKB\n  unmap       -> dec and wait to be 0\n\nNote that this is different from ref counting the vif structure itself.\nCurrently only guest Rx path is taken care of because that's where the\nbug surfaced.\n\nThis bug doesn't exist in kernel >=3.12 as multi-queue support was added\nthere.\n\nLink: <https://lists.xenproject.org/archives/html/xen-devel/2014-06/msg00818.html>\nSigned-off-by: Wei Liu <wei.liu2@citrix.com>\nSigned-off-by: Philipp Hahn <hahn@univention.de>\nCc: David Vrabel <david.vrabel@citrix.com>\nTested-by: Philipp Hahn <hahn@univention.de>\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/4cebb475eb0f713547dcbdd8c11be535930b1660"},{"sha":"9691eac5593ff1e2f82391ad327f21d90322aec1","author":{"name":"Linus Torvalds","email":"ead7104581934751970e9decb2db5deb20a9e407@linux-foundation.org"},"message":"mm: remove gup_flags FOLL_WRITE games from __get_user_pages()\n\ncommit 19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619 upstream.\n\nThis is an ancient bug that was actually attempted to be fixed once\n(badly) by me eleven years ago in commit 4ceb5db9757a (\"Fix\nget_user_pages() race for write access\") but that was then undone due to\nproblems on s390 by commit f33ea7f404e5 (\"fix get_user_pages bug\").\n\nIn the meantime, the s390 situation has long been fixed, and we can now\nfix it by checking the pte_dirty() bit properly (and do it better).  The\ns390 dirty bit was implemented in abf09bed3cce (\"s390/mm: implement\nsoftware dirty bits\") which made it into v3.9.  Earlier kernels will\nhave to look at the page state itself.\n\nAlso, the VM has become more scalable, and what used a purely\ntheoretical race back then has become easier to trigger.\n\nTo fix it, we introduce a new internal FOLL_COW flag to mark the \"yes,\nwe already did a COW\" rather than play racy games with FOLL_WRITE that\nis very fundamental, and then use the pte dirty flag to validate that\nthe FOLL_COW flag is still valid.\n\nReported-and-tested-by: Phil \"not Paul\" Oester <kernel@linuxace.com>\nAcked-by: Hugh Dickins <hughd@google.com>\nReviewed-by: Michal Hocko <mhocko@suse.com>\nCc: Andy Lutomirski <luto@kernel.org>\nCc: Kees Cook <keescook@chromium.org>\nCc: Oleg Nesterov <oleg@redhat.com>\nCc: Willy Tarreau <w@1wt.eu>\nCc: Nick Piggin <npiggin@gmail.com>\nCc: Greg Thelen <gthelen@google.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n[wt: s/gup.c/memory.c; s/follow_page_pte/follow_page_mask;\n     s/faultin_page/__get_user_page]\nSigned-off-by: Willy Tarreau <w@1wt.eu>","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/9691eac5593ff1e2f82391ad327f21d90322aec1"},{"sha":"7828a9658951301a3fd83daa4ed0a607d370399e","author":{"name":"Willy Tarreau","email":"660f093d7e527fcd150800cea013d3ef87632346@1wt.eu"},"message":"Linux 3.10.104","distinct":true,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm/commits/7828a9658951301a3fd83daa4ed0a607d370399e"}]}
{"actor":{"display_login":"mifl"}}