{"push_id":927871634,"size":17,"distinct_size":17,"ref":"refs/heads/mm","head":"750425a11f0434f17272a914641d303f84382f48","before":"6253b3e8411f7d697b222e45dc005123db7b2b95","commits":[{"sha":"83c6de48acbc4484d828bb02f27f7c62b9e41488","author":{"email":"e4b32643abc22f0015f12596bd9b0c46cec422aa@google.com","name":"Greg Hackmann"},"message":"[PATCH] ANDROID: android: base-cfg: disable CONFIG_SYSVIPC\n\nAndroid SELinux policies block SysV IPC.  New kernels should not be\nbuilt with it.\n\nBug: 22300191\n\nChange-Id: Ia4bcb179ff71825cab19eed603d4064a8d061a93\nSigned-off-by: Greg Hackmann <ghackmann@google.com>\nd","distinct":true,"url":"https://api.github.com/repos/TeamHorizon/android_kernel_lge_gee/commits/83c6de48acbc4484d828bb02f27f7c62b9e41488"},{"sha":"1b55392bc4a83533530cc806524f3d6342bd61d7","author":{"email":"1dd89e5367785ba89076cd264daac0464fdf0d7b@cellrox.com","name":"Amir Goldstein"},"message":"sysrq: Emergency Remount R/O in reverse order\nThis change fixes a problem where reboot on Android panics the kernel\nalmost every time when file systems are mounted over loop devices.\n\nAndroid reboot command does:\n- sync\n- echo u > /proc/sysrq-trigger\n- syscall_reboot\n\nThe problem is with sysrq emergency remount R/O trying to remount-ro\nin wrong order.\nsince /data is re-mounted ro before loop devices, loop device\nremount-ro fails to flush the journal and panics the kernel:\n\n  EXT4-fs (loop0): Remounting filesystem read-only\n  EXT4-fs (loop0): previous I/O error to superblock detected\n  loop: Write error at byte offset 0, length 4096.\n  Buffer I/O error on device loop0, logical block 0\n  lost page write due to I/O error on loop0\n  Kernel panic - not syncing: EXT4-fs panic from previous error\n\nThe fix is quite simple. In do_emergency_remount(), use\nlist_for_each_entry_reverse() on sb list instead of list_for_each_entry().\nIt makes a lot of sense to umount the file systems in reverse order in\nwhich they were added to sb list.\n\nChange-Id: I4370e39b5873bd16ade5d5f9ddb2704beb02a2bb\nSigned-off-by: Amir Goldstein <amir@cellrox.com>\nAcked-by: Oren Laadan <orenl@cellrox.com>","distinct":true,"url":"https://api.github.com/repos/TeamHorizon/android_kernel_lge_gee/commits/1b55392bc4a83533530cc806524f3d6342bd61d7"},{"sha":"22ca7652b59601001c0dec1f13ee7d9e495a3d13","author":{"email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org","name":"Linus Torvalds"},"message":"Fix gcc-4.9.0 miscompilation of load_balance() in scheduler\n\ncommit 2062afb4f804afef61cbe62a30cac9a46e58e067 upstream.\n\nMichel Dänzer and a couple of other people reported inexplicable random\noopses in the scheduler, and the cause turns out to be gcc mis-compiling\nthe load_balance() function when debugging is enabled.  The gcc bug\napparently goes back to gcc-4.5, but slight optimization changes means\nthat it now showed up as a problem in 4.9.0 and 4.9.1.\n\nThe instruction scheduling problem causes gcc to schedule a spill\noperation to before the stack frame has been created, which in turn can\ncorrupt the spilled value if an interrupt comes in.  There may be other\neffects of this bug too, but that's the code generation problem seen in\nMichel's case.\n\nThis is fixed in current gcc HEAD, but the workaround as suggested by\nMarkus Trippelsdorf is pretty simple: use -fno-var-tracking-assignments\nwhen compiling the kernel, which disables the gcc code that causes the\nproblem.  This can result in slightly worse debug information for\nvariable accesses, but that is infinitely preferable to actual code\ngeneration problems.\n\nDoing this unconditionally (not just for CONFIG_DEBUG_INFO) also allows\nnon-debug builds to verify that the debug build would be identical: we\ncan do\n\n    export GCC_COMPARE_DEBUG=1\n\nto make gcc internally verify that the result of the build is\nindependent of the \"-g\" flag (it will make the compiler build everything\ntwice, toggling the debug flag, and compare the results).\n\nWithout the \"-fno-var-tracking-assignments\" option, the build would fail\n(even with 4.8.3 that didn't show the actual stack frame bug) with a gcc\ncompare failure.\n\nSee also gcc bugzilla:\n\nhttps://gcc.gnu.org/bugzilla/show_bug.cgi?id=61801\n\nChange-Id: Ibaea1acf4dc83bd73eb82442d9fecc90d55f31b7\nReported-by: Michel Dänzer <michel@daenzer.net>\nSuggested-by: Markus Trippelsdorf <markus@trippelsdorf.de>\nCc: Jakub Jelinek <jakub@redhat.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/TeamHorizon/android_kernel_lge_gee/commits/22ca7652b59601001c0dec1f13ee7d9e495a3d13"},{"sha":"b560821d76bb3b9a07125f6d53b632e6d41f27db","author":{"email":"11e4191b1ae5cae13d3da02c22f40620ad984fdf@android.com","name":"Riley Andrews"},"message":"android: drivers: workaround debugfs race in binder\n\nIf a /d/binder/proc/[pid] entry is kept open after linux has\ntorn down the associated process, binder_proc_show can deference\nan invalid binder_proc that has been stashed in the debugfs\ninode.  Validate that the binder_proc ptr passed into binder_proc_show\nhas not been freed by looking for it within the global process list\nwhilst the global lock is held. If the ptr is not valid, print nothing.\n\nBug 19587483\nChange-Id: I4abc6443d96cca6500608976cded5ff3d1697d33\nSigned-off-by: Riley Andrews <riandrews@android.com>","distinct":true,"url":"https://api.github.com/repos/TeamHorizon/android_kernel_lge_gee/commits/b560821d76bb3b9a07125f6d53b632e6d41f27db"},{"sha":"36fc27643491d64107e1ab4ca2ec2b814673dd05","author":{"email":"0bb6b04afdf3f0678200de9e922c93cd5ca45bb6@mail.ru","name":"xyyx"},"message":"geehrc: disable android_logger","distinct":true,"url":"https://api.github.com/repos/TeamHorizon/android_kernel_lge_gee/commits/36fc27643491d64107e1ab4ca2ec2b814673dd05"},{"sha":"e1076eb5d3d1d373925f1b523ac23ffd4570a451","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"udp: fix behavior of wrong checksums\n\nWe have two problems in UDP stack related to bogus checksums :\n\n1) We return -EAGAIN to application even if receive queue is not empty.\n   This breaks applications using edge trigger epoll()\n\n2) Under UDP flood, we can loop forever without yielding to other\n   processes, potentially hanging the host, especially on non SMP.\n\nThis patch is an attempt to make things better.\n\nWe might in the future add extra support for rt applications\nwanting to better control time spent doing a recv() in a hostile\nenvironment. For example we could validate checksums before queuing\npackets in socket receive queue.\n\nChange-Id: I9355321ac7ee564d56c342fa7738b918052bf308\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Willem de Bruijn <willemb@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/TeamHorizon/android_kernel_lge_gee/commits/e1076eb5d3d1d373925f1b523ac23ffd4570a451"},{"sha":"6bea29436834f2acc64f83392655f47056f074f2","author":{"email":"e642b69ed2fc111e09ffdc37feb733a52253340d@oracle.com","name":"Sasha Levin"},"message":"net: llc: use correct size for sysctl timeout entries\n\nThe timeout entries are sizeof(int) rather than sizeof(long), which\nmeans that when they were getting read we'd also leak kernel memory\nto userspace along with the timeout values.\n\nChange-Id: I328d1186720a6f70f555eeeb62c83ee69814868d\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/TeamHorizon/android_kernel_lge_gee/commits/6bea29436834f2acc64f83392655f47056f074f2"},{"sha":"c86c6a9f5ebbef2abbbbd39df672e3974db20c53","author":{"email":"74c05afa918858348d6db8037d82fa8124870113@openvz.org","name":"Andrey Vagin"},"message":"netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len\n\n\"len\" contains sizeof(nf_ct_ext) and size of extensions. In a worst\ncase it can contain all extensions. Bellow you can find sizes for all\ntypes of extensions. Their sum is definitely bigger than 256.\n\nnf_ct_ext_types[0]->len = 24\nnf_ct_ext_types[1]->len = 32\nnf_ct_ext_types[2]->len = 24\nnf_ct_ext_types[3]->len = 32\nnf_ct_ext_types[4]->len = 152\nnf_ct_ext_types[5]->len = 2\nnf_ct_ext_types[6]->len = 16\nnf_ct_ext_types[7]->len = 8\n\nI have seen \"len\" up to 280 and my host has crashes w/o this patch.\n\nThe right way to fix this problem is reducing the size of the ecache\nextension (4) and Florian is going to do this, but these changes will\nbe quite large to be appropriate for a stable tree.\n\nChange-Id: If9efaf2b103cf304bbfa583e354cfad3faa77ac2\nFixes: 5b423f6a40a0 (netfilter: nf_conntrack: fix racy timer handling with reliable)\nCc: Pablo Neira Ayuso <pablo@netfilter.org>\nCc: Patrick McHardy <kaber@trash.net>\nCc: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>\nCc: \"David S. Miller\" <davem@davemloft.net>\nSigned-off-by: Andrey Vagin <avagin@openvz.org>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":true,"url":"https://api.github.com/repos/TeamHorizon/android_kernel_lge_gee/commits/c86c6a9f5ebbef2abbbbd39df672e3974db20c53"},{"sha":"5ef80d64b585bfd946847aa66f3f6f953873200d","author":{"email":"257d7d5bef225e0a56b3375b0c1e95c6bb0ab871@modio.se","name":"D.S. Ljungmark"},"message":"ipv6: Don't reduce hop limit for an interface\n\nA local route may have a lower hop_limit set than global routes do.\n\nRFC 3756, Section 4.2.7, \"Parameter Spoofing\"\n\n>   1.  The attacker includes a Current Hop Limit of one or another small\n>       number which the attacker knows will cause legitimate packets to\n>       be dropped before they reach their destination.\n\n>   As an example, one possible approach to mitigate this threat is to\n>   ignore very small hop limits.  The nodes could implement a\n>   configurable minimum hop limit, and ignore attempts to set it below\n>   said limit.\n\nChange-Id: I51ee1778e3d2d5fa1aefbdf1ad8869e4e8dc28b2\nSigned-off-by: D.S. Ljungmark <ljungmark@modio.se>\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/TeamHorizon/android_kernel_lge_gee/commits/5ef80d64b585bfd946847aa66f3f6f953873200d"},{"sha":"39acb156a8844b8a85271b81e43d9576a27979d3","author":{"email":"eec72676ad9a62f2727dfed6d270d98c0d02adec@linux.intel.com","name":"Kirill A. Shutemov"},"message":"mm: Fix NULL pointer dereference in madvise(MADV_WILLNEED) support\n\nSasha Levin found a NULL pointer dereference that is due to a missing\npage table lock, which in turn is due to the pmd entry in question being\na transparent huge-table entry.\n\nThe code - introduced in commit 1998cc048901 (\"mm: make\nmadvise(MADV_WILLNEED) support swap file prefetch\") - correctly checks\nfor this situation using pmd_none_or_trans_huge_or_clear_bad(), but it\nturns out that that function doesn't work correctly.\n\npmd_none_or_trans_huge_or_clear_bad() expected that pmd_bad() would\ntrigger if the transparent hugepage bit was set, but it doesn't do that\nif pmd_numa() is also set. Note that the NUMA bit only gets set on real\nNUMA machines, so people trying to reproduce this on most normal\ndevelopment systems would never actually trigger this.\n\nFix it by removing the very subtle (and subtly incorrect) expectation,\nand instead just checking pmd_trans_huge() explicitly.\n\nReported-by: Sasha Levin <sasha.levin@oracle.com>\nAcked-by: Andrea Arcangeli <aarcange@redhat.com>\n[ Additionally remove the now stale test for pmd_trans_huge() inside the\n  pmd_bad() case - Linus ]\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n\nChange-Id: I3f3763f236ef102de735297cd175cf514d40d28f","distinct":true,"url":"https://api.github.com/repos/TeamHorizon/android_kernel_lge_gee/commits/39acb156a8844b8a85271b81e43d9576a27979d3"},{"sha":"0d9792a5862afc1ac99ca3203e37bda09ffa5df3","author":{"email":"e642b69ed2fc111e09ffdc37feb733a52253340d@oracle.com","name":"Sasha Levin"},"message":"vfs: read file_handle only once in handle_to_path\n\nWe used to read file_handle twice. Once to get the amount of extra bytes, and\nonce to fetch the entire structure.\n\nThis may be problematic since we do size verifications only after the first\nread, so if the number of extra bytes changes in userspace between the first\nand second calls, we'll have an incoherent view of file_handle.\n\nInstead, read the constant size once, and copy that over to the final\nstructure without having to re-read it again.\n\nChange-Id: Ib05e5129629e27d5a05953098c5bc470fae40d2a\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/TeamHorizon/android_kernel_lge_gee/commits/0d9792a5862afc1ac99ca3203e37bda09ffa5df3"},{"sha":"3c3a16f99c5b27e287930dd95013c867a0193757","author":{"email":"9ff04a02a69f376b2b9aeec27187017cbf3cf5f9@redhat.com","name":"Daniel Borkmann"},"message":"netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages\n\nSome occurences in the netfilter tree use skb_header_pointer() in\nthe following way ...\n\n  struct dccp_hdr _dh, *dh;\n  ...\n  skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);\n\n... where dh itself is a pointer that is being passed as the copy\nbuffer. Instead, we need to use &_dh as the forth argument so that\nwe're copying the data into an actual buffer that sits on the stack.\n\nCurrently, we probably could overwrite memory on the stack (e.g.\nwith a possibly mal-formed DCCP packet), but unintentionally, as\nwe only want the buffer to be placed into _dh variable.\n\nChange-Id: Ief6a82b5a58e1dd88d43313eb8356c52cf89b214\nFixes: 2bc780499aa3 (\"[NETFILTER]: nf_conntrack: add DCCP protocol support\")\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":true,"url":"https://api.github.com/repos/TeamHorizon/android_kernel_lge_gee/commits/3c3a16f99c5b27e287930dd95013c867a0193757"},{"sha":"70d5cdc13f4f4d326526e2dffdeeac9573471bef","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"net: guard tcp_set_keepalive() to tcp sockets\n\nIts possible to use RAW sockets to get a crash in\ntcp_set_keepalive() / sk_reset_timer()\n\nFix is to make sure socket is a SOCK_STREAM one.\n\nReported-by: Dave Jones <davej@redhat.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nChange-Id: Ieeb498a3e623cfcb54e1c865a3c0229e4acf1e87","distinct":true,"url":"https://api.github.com/repos/TeamHorizon/android_kernel_lge_gee/commits/70d5cdc13f4f4d326526e2dffdeeac9573471bef"},{"sha":"5c222da25047bb63182e6a4909d6dd5512bdfbfe","author":{"email":"d4fa18192c5a479e564d29c2300c2e15afd1d8d7@do-not-panic.com","name":"Luis R. Rodriguez"},"message":"cfg80211: fix possible circular lock on reg_regdb_search()\n\nWhen call_crda() is called we kick off a witch hunt search\nfor the same regulatory domain on our internal regulatory\ndatabase and that work gets kicked off on a workqueue, this\nis done while the cfg80211_mutex is held. If that workqueue\nkicks off it will first lock reg_regdb_search_mutex and\nlater cfg80211_mutex but to ensure two CPUs will not contend\nagainst cfg80211_mutex the right thing to do is to have the\nreg_regdb_search() wait until the cfg80211_mutex is let go.\n\nChange-Id: Ibb44a5325876d77f1549d3938d56d8fbd051b9ba\nCRs-Fixed: 655287\nSigned-off-by: Santhosh Kumar Padma <skpadma@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TeamHorizon/android_kernel_lge_gee/commits/5c222da25047bb63182e6a4909d6dd5512bdfbfe"},{"sha":"085d26d9338b866dd5d91335aa5045bbc8971fde","author":{"email":"6439d4d9ffdf8e13b6026617ba51aa18f8d15ddd@codeaurora.org","name":"Mahesh A Saptasagar"},"message":"WLAN subsystem: Sysctl support for key TCP/IP parameters\n\nIt has been observed that default values for some of key tcp/ip\nparameters are affecting the tput/performance of the system. Hence\nextending configuration capabilities to TCP/Ip stack through\nsysctl interface.\n\nChange-Id: I0c99d5b50cbe0d6496e40d391eacc12b0c62dbed\nCRs-Fixed: 507581\nSigned-off-by: Mahesh A Saptasagar <msapta@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/TeamHorizon/android_kernel_lge_gee/commits/085d26d9338b866dd5d91335aa5045bbc8971fde"},{"sha":"2ccb505bcb06d0d4a9afe01ca73b43d3752e3704","author":{"email":"10a8c465cefc9bdd6c925e26964d23c90f1141cc@google.com","name":"Dmitry Torokhov"},"message":"net: fix iterating over hashtable in tcp_nuke_addr()\n\nThe actual size of the tcp hashinfo table is tcp_hashinfo.ehash_mask + 1\nso we need to adjust the loop accordingly to get the sockets hashed into\nthe last bucket.\n\nChange-Id: I796b3c7b4a1a7fa35fba9e5192a4a403eb6e17de\nSigned-off-by: Dmitry Torokhov <dtor@google.com>","distinct":true,"url":"https://api.github.com/repos/TeamHorizon/android_kernel_lge_gee/commits/2ccb505bcb06d0d4a9afe01ca73b43d3752e3704"},{"sha":"750425a11f0434f17272a914641d303f84382f48","author":{"email":"00bf0f20509cb3bd3255c624dba0f295e3c4128e@linaro.org","name":"Dave Martin"},"message":"ARM: 7583/1: decompressor: Enable unaligned memory access for v6 and above\n\nModern GCC can generate code which makes use of the CPU's native\nunaligned memory access capabilities.  This is useful for the C\ndecompressor implementations used for unpacking compressed kernels.\n\nThis patch disables alignment faults and enables the v6 unaligned\naccess model on CPUs which support these features (i.e., v6 and\nlater), allowing full unaligned access support for C code in the\ndecompressor.\n\nThe decompressor C code must not be built to assume that unaligned\naccess works if support for v5 or older platforms is included in\nthe kernel.\n\nFor correct code generation, C decompressor code must always use\nthe get_unaligned and put_unaligned accessors when dealing with\nunaligned pointers, regardless of this patch.\n\nChange-Id: I4a342040be3cc2a1b7bc42ad4e579fdbb908583a\nSigned-off-by: Dave Martin <dave.martin@linaro.org>\nAcked-by: Nicolas Pitre <nico@linaro.org>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>","distinct":true,"url":"https://api.github.com/repos/TeamHorizon/android_kernel_lge_gee/commits/750425a11f0434f17272a914641d303f84382f48"}]}