{"push_id":1278777815,"size":166,"distinct_size":0,"ref":"refs/heads/caf/3.10/caf/korg/linux-4.1.y","head":"99f614a3bb23603a947be2e95b78507112c484e5","before":"c3ed55b836cff718dd0d654b6daf7c96be2a5ac2","commits":[{"sha":"2686f12b26e217befd88357cf84e78d0ab3c86a1","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"netfilter: x_tables: speed up jump target validation\n\n[ Upstream commit f4dc77713f8016d2e8a3295e1c9c53a21f296def ]\n\nThe dummy ruleset I used to test the original validation change was broken,\nmost rules were unreachable and were not tested by mark_source_chains().\n\nIn some cases rulesets that used to load in a few seconds now require\nseveral minutes.\n\nsample ruleset that shows the behaviour:\n\necho \"*filter\"\nfor i in $(seq 0 100000);do\n        printf \":chain_%06x - [0:0]\\n\" $i\ndone\nfor i in $(seq 0 100000);do\n   printf -- \"-A INPUT -j chain_%06x\\n\" $i\n   printf -- \"-A INPUT -j chain_%06x\\n\" $i\n   printf -- \"-A INPUT -j chain_%06x\\n\" $i\ndone\necho COMMIT\n\n[ pipe result into iptables-restore ]\n\nThis ruleset will be about 74mbyte in size, with ~500k searches\nthough all 500k[1] rule entries. iptables-restore will take forever\n(gave up after 10 minutes)\n\nInstead of always searching the entire blob for a match, fill an\narray with the start offsets of every single ipt_entry struct,\nthen do a binary search to check if the jump target is present or not.\n\nAfter this change ruleset restore times get again close to what one\ngets when reverting 36472341017529e (~3 seconds on my workstation).\n\n[1] every user-defined rule gets an implicit RETURN, so we get\n300k jumps + 100k userchains + 100k returns -> 500k rule entries\n\nFixes: 36472341017529e (\"netfilter: x_tables: validate targets of jumps\")\nReported-by: Jeff Wu <wujiafu@gmail.com>\nTested-by: Jeff Wu <wujiafu@gmail.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/2686f12b26e217befd88357cf84e78d0ab3c86a1"},{"sha":"70aaf49b1e719d3d25b9480a151133d00da00f49","author":{"name":"Thomas Petazzoni","email":"8184181a894e706105679bbf6797daaadfd8a66a@free-electrons.com"},"message":"ARM: mvebu: fix HW I/O coherency related deadlocks\n\n[ Upstream commit c5379ba8fccd99d5f99632c789f0393d84a57805 ]\n\nUntil now, our understanding for HW I/O coherency to work on the\nCortex-A9 based Marvell SoC was that only the PCIe regions should be\nmapped strongly-ordered. However, we were still encountering some\ndeadlocks, especially when testing the CESA crypto engine. After\nchecking with the HW designers, it was concluded that all the MMIO\nregisters should be mapped as strongly ordered for the HW I/O coherency\nmechanism to work properly.\n\nThis fixes some easy to reproduce deadlocks with the CESA crypto engine\ndriver (dmcrypt on a sufficiently large disk partition).\n\nTested-by: Terry Stockert <stockert@inkblotadmirer.me>\nTested-by: Romain Perier <romain.perier@free-electrons.com>\nCc: Terry Stockert <stockert@inkblotadmirer.me>\nCc: Romain Perier <romain.perier@free-electrons.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>\nSigned-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/70aaf49b1e719d3d25b9480a151133d00da00f49"},{"sha":"07761df8a174a27d498d87f0000409603627bb3c","author":{"name":"Cameron Gutman","email":"dae64e07afda5ec299f6c7de821d7927f9ed1853@gmail.com"},"message":"Input: xpad - validate USB endpoint count during probe\n\n[ Upstream commit caca925fca4fb30c67be88cacbe908eec6721e43 ]\n\nThis prevents a malicious USB device from causing an oops.\n\nSigned-off-by: Cameron Gutman <aicommander@gmail.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/07761df8a174a27d498d87f0000409603627bb3c"},{"sha":"97f28872a3148fb589125507e757163fef6a0b9b","author":{"name":"Sinclair Yeh","email":"49213a28ab42547222759a2b23ec5ce54f443d89@vmware.com"},"message":"drm/ttm: Make ttm_bo_mem_compat available\n\n[ Upstream commit 94477bff390aa4612d2332c8abafaae0a13d6923 ]\n\nThere are cases where it is desired to see if a proposed placement\nis compatible with a buffer object before calling ttm_bo_validate().\n\nSigned-off-by: Sinclair Yeh <syeh@vmware.com>\nReviewed-by: Thomas Hellstrom <thellstrom@vmware.com>\nCc: <stable@vger.kernel.org>\n---\nThis is the first of a 3-patch series to fix a black screen\nissue observed on Ubuntu 16.04 server.\n\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/97f28872a3148fb589125507e757163fef6a0b9b"},{"sha":"cb75f65fe798bcac694f6bde299c52d31bdc8e96","author":{"name":"Miklos Szeredi","email":"c27ee2952768e22f4d3ab9aec0e78ac5f4ddea98@redhat.com"},"message":"ovl: handle ATTR_KILL*\n\n[ Upstream commit 51234eac5dd8b5feda9a3a8fa766f5398ecf91e3 ]\n\ncommit b99c2d913810e56682a538c9f2394d76fca808f8 upstream.\n\nBefore 4bacc9c9234c (\"overlayfs: Make f_path...\") file->f_path pointed to\nthe underlying file, hence suid/sgid removal on write worked fine.\n\nAfter that patch file->f_path pointed to the overlay file, and the file\nmode bits weren't copied to overlay_inode->i_mode.  So the suid/sgid\nremoval simply stopped working.\n\nThe fix is to copy the mode bits, but then ovl_setattr() needs to clear\nATTR_MODE to avoid the BUG() in notify_change().  So do this first, then in\nthe next patch copy the mode.\n\nReported-by: Eryu Guan <eguan@redhat.com>\nSigned-off-by: Miklos Szeredi <mszeredi@redhat.com>\nFixes: 4bacc9c9234c (\"overlayfs: Make f_path always point to the overlay and f_inode to the underlay\")\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/cb75f65fe798bcac694f6bde299c52d31bdc8e96"},{"sha":"31534f8fead7e0dff7ba68bd5dfcf6a9dfe908bc","author":{"name":"Vivek Goyal","email":"6391e95e691e142b04089fc8c5919bb65a4d1a63@redhat.com"},"message":"ovl: Copy up underlying inode's ->i_mode to overlay inode\n\n[ Upstream commit 07a2daab49c549a37b5b744cbebb6e3f445f12bc ]\n\nRight now when a new overlay inode is created, we initialize overlay\ninode's ->i_mode from underlying inode ->i_mode but we retain only\nfile type bits (S_IFMT) and discard permission bits.\n\nThis patch changes it and retains permission bits too. This should allow\noverlay to do permission checks on overlay inode itself in task context.\n\n[SzM] It also fixes clearing suid/sgid bits on write.\n\nSigned-off-by: Vivek Goyal <vgoyal@redhat.com>\nReported-by: Eryu Guan <eguan@redhat.com>\nSigned-off-by: Miklos Szeredi <mszeredi@redhat.com>\nFixes: 4bacc9c9234c (\"overlayfs: Make f_path always point to the overlay and f_inode to the underlay\")\nCc: <stable@vger.kernel.org>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/31534f8fead7e0dff7ba68bd5dfcf6a9dfe908bc"},{"sha":"fb1048540ec927d95acee9e08e96b064c08427e3","author":{"name":"Hui Wang","email":"9d5fe9a97fbb9544eef3d32c5cf8dcaba19b36f5@canonical.com"},"message":"ALSA: hda/realtek - add new pin definition in alc225 pin quirk table\n\n[ Upstream commit 8a132099f080d7384bb6ab4cc168f76cb4b47d08 ]\n\nWe have some Dell laptops which can't detect headset mic, the machines\nuse the codec ALC225, they have some new pin configuration values,\nafter adding them in the alc225 pin quirk table, they work well.\n\nCc: <stable@vger.kernel.org>\nSigned-off-by: Hui Wang <hui.wang@canonical.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/fb1048540ec927d95acee9e08e96b064c08427e3"},{"sha":"6b9d5616a24c26bd4a1c8e1a942241d03b102f76","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: ctl: Stop notification after disconnection\n\n[ Upstream commit f388cdcdd160687c6650833f286b9c89c50960ff ]\n\nsnd_ctl_remove() has a notification for the removal event.  It's\nsuperfluous when done during the device got disconnected.  Although\nthe notification itself is mostly harmless, it may potentially be\nharmful, and should be suppressed.  Actually some components PCM may\nfree ctl elements during the disconnect or free callbacks, thus it's\nno theoretical issue.\n\nThis patch adds the check of card->shutdown flag for avoiding\nunnecessary notifications after (or during) the disconnect.\n\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/6b9d5616a24c26bd4a1c8e1a942241d03b102f76"},{"sha":"43506e749d3f8d7e012a1bc4cb57b18a03ecfee6","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: pcm: Free chmap at PCM free callback, too\n\n[ Upstream commit a8ff48cb70835f48de5703052760312019afea55 ]\n\nThe chmap ctls assigned to PCM streams are freed in the PCM disconnect\ncallback.  However, since the disconnect callback isn't called when\nthe card gets freed before registering, the chmap ctls may still be\nleft assigned.  They are eventually freed together with other ctls,\nbut it may cause an Oops at pcm_chmap_ctl_private_free(), as the\nfunction refers to the assigned PCM stream, while the PCM objects have\nbeen already freed beforehand.\n\nThe fix is to free the chmap ctls also at PCM free callback, not only\nat PCM disconnect.\n\nReported-by: Laxminath Kasam <b_lkasam@codeaurora.org>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/43506e749d3f8d7e012a1bc4cb57b18a03ecfee6"},{"sha":"25334066b50e2bd08aaec68701a10be3544e0e02","author":{"name":"Dmitri Epshtein","email":"9296bb6270d7c3f997a1fb3eaffd20279ae8cd29@marvell.com"},"message":"net: mvneta: set real interrupt per packet for tx_done\n\n[ Upstream commit 06708f81528725148473c0869d6af5f809c6824b ]\n\nCommit aebea2ba0f74 (\"net: mvneta: fix Tx interrupt delay\") intended to\nset coalescing threshold to a value guaranteeing interrupt generation\nper each sent packet, so that buffers can be released with no delay.\n\nIn fact setting threshold to '1' was wrong, because it causes interrupt\nevery two packets. According to the documentation a reason behind it is\nfollowing - interrupt occurs once sent buffers counter reaches a value,\nwhich is higher than one specified in MVNETA_TXQ_SIZE_REG(q). This\nbehavior was confirmed during tests. Also when testing the SoC working\nas a NAS device, better performance was observed with int-per-packet,\nas it strongly depends on the fact that all transmitted packets are\nreleased immediately.\n\nThis commit enables NETA controller work in interrupt per sent packet mode\nby setting coalescing threshold to 0.\n\nSigned-off-by: Dmitri Epshtein <dima@marvell.com>\nSigned-off-by: Marcin Wojtas <mw@semihalf.com>\nCc: <stable@vger.kernel.org> # v3.10+\nFixes aebea2ba0f74 (\"net: mvneta: fix Tx interrupt delay\")\nAcked-by: Willy Tarreau <w@1wt.eu>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/25334066b50e2bd08aaec68701a10be3544e0e02"},{"sha":"47eec480c93227ddde8c4ee5c46cbb1d038c3b4d","author":{"name":"Lukas Wunner","email":"7725246d78edfda814c85745e312e58ff7befafc@wunner.de"},"message":"x86/quirks: Add early quirk to reset Apple AirPort card\n\n[ Upstream commit abb2bafd295fe962bbadc329dbfb2146457283ac ]\n\nThe EFI firmware on Macs contains a full-fledged network stack for\ndownloading OS X images from osrecovery.apple.com. Unfortunately\non Macs introduced 2011 and 2012, EFI brings up the Broadcom 4331\nwireless card on every boot and leaves it enabled even after\nExitBootServices has been called. The card continues to assert its IRQ\nline, causing spurious interrupts if the IRQ is shared. It also corrupts\nmemory by DMAing received packets, allowing for remote code execution\nover the air. This only stops when a driver is loaded for the wireless\ncard, which may be never if the driver is not installed or blacklisted.\n\nThe issue seems to be constrained to the Broadcom 4331. Chris Milsted\nhas verified that the newer Broadcom 4360 built into the MacBookPro11,3\n(2013/2014) does not exhibit this behaviour. The chances that Apple will\never supply a firmware fix for the older machines appear to be zero.\n\nThe solution is to reset the card on boot by writing to a reset bit in\nits mmio space. This must be done as an early quirk and not as a plain\nvanilla PCI quirk to successfully combat memory corruption by DMAed\npackets: Matthew Garrett found out in 2012 that the packets are written\nto EfiBootServicesData memory (http://mjg59.dreamwidth.org/11235.html).\nThis type of memory is made available to the page allocator by\nefi_free_boot_services(). Plain vanilla PCI quirks run much later, in\nsubsys initcall level. In-between a time window would be open for memory\ncorruption. Random crashes occurring in this time window and attributed\nto DMAed packets have indeed been observed in the wild by Chris\nBainbridge.\n\nWhen Matthew Garrett analyzed the memory corruption issue in 2012, he\nsought to fix it with a grub quirk which transitions the card to D3hot:\nhttp://git.savannah.gnu.org/cgit/grub.git/commit/?id=9d34bb85da56\n\nThis approach does not help users with other bootloaders and while it\nmay prevent DMAed packets, it does not cure the spurious interrupts\nemanating from the card. Unfortunately the card's mmio space is\ninaccessible in D3hot, so to reset it, we have to undo the effect of\nMatthew's grub patch and transition the card back to D0.\n\nNote that the quirk takes a few shortcuts to reduce the amount of code:\nThe size of BAR 0 and the location of the PM capability is identical\non all affected machines and therefore hardcoded. Only the address of\nBAR 0 differs between models. Also, it is assumed that the BCMA core\ncurrently mapped is the 802.11 core. The EFI driver seems to always take\ncare of this.\n\nMichael Büsch, Bjorn Helgaas and Matt Fleming contributed feedback\ntowards finding the best solution to this problem.\n\nThe following should be a comprehensive list of affected models:\n    iMac13,1        2012  21.5\"       [Root Port 00:1c.3 = 8086:1e16]\n    iMac13,2        2012  27\"         [Root Port 00:1c.3 = 8086:1e16]\n    Macmini5,1      2011  i5 2.3 GHz  [Root Port 00:1c.1 = 8086:1c12]\n    Macmini5,2      2011  i5 2.5 GHz  [Root Port 00:1c.1 = 8086:1c12]\n    Macmini5,3      2011  i7 2.0 GHz  [Root Port 00:1c.1 = 8086:1c12]\n    Macmini6,1      2012  i5 2.5 GHz  [Root Port 00:1c.1 = 8086:1e12]\n    Macmini6,2      2012  i7 2.3 GHz  [Root Port 00:1c.1 = 8086:1e12]\n    MacBookPro8,1   2011  13\"         [Root Port 00:1c.1 = 8086:1c12]\n    MacBookPro8,2   2011  15\"         [Root Port 00:1c.1 = 8086:1c12]\n    MacBookPro8,3   2011  17\"         [Root Port 00:1c.1 = 8086:1c12]\n    MacBookPro9,1   2012  15\"         [Root Port 00:1c.1 = 8086:1e12]\n    MacBookPro9,2   2012  13\"         [Root Port 00:1c.1 = 8086:1e12]\n    MacBookPro10,1  2012  15\"         [Root Port 00:1c.1 = 8086:1e12]\n    MacBookPro10,2  2012  13\"         [Root Port 00:1c.1 = 8086:1e12]\n\nFor posterity, spurious interrupts caused by the Broadcom 4331 wireless\ncard resulted in splats like this (stacktrace omitted):\n\n    irq 17: nobody cared (try booting with the \"irqpoll\" option)\n    handlers:\n    [<ffffffff81374370>] pcie_isr\n    [<ffffffffc0704550>] sdhci_irq [sdhci] threaded [<ffffffffc07013c0>] sdhci_thread_irq [sdhci]\n    [<ffffffffc0a0b960>] azx_interrupt [snd_hda_codec]\n    Disabling IRQ #17\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=79301\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=111781\nBugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=728916\nBugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=895951#c16\nBugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1009819\nBugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1098621\nBugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1149632#c5\nBugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1279130\nBugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1332732\nTested-by: Konstantin Simanov <k.simanov@stlk.ru>        # [MacBookPro8,1]\nTested-by: Lukas Wunner <lukas@wunner.de>                # [MacBookPro9,1]\nTested-by: Bryan Paradis <bryan.paradis@gmail.com>       # [MacBookPro9,2]\nTested-by: Andrew Worsley <amworsley@gmail.com>          # [MacBookPro10,1]\nTested-by: Chris Bainbridge <chris.bainbridge@gmail.com> # [MacBookPro10,2]\nSigned-off-by: Lukas Wunner <lukas@wunner.de>\nAcked-by: Rafał Miłecki <zajec5@gmail.com>\nAcked-by: Matt Fleming <matt@codeblueprint.co.uk>\nCc: Andy Lutomirski <luto@kernel.org>\nCc: Bjorn Helgaas <bhelgaas@google.com>\nCc: Borislav Petkov <bp@alien8.de>\nCc: Brian Gerst <brgerst@gmail.com>\nCc: Chris Milsted <cmilsted@redhat.com>\nCc: Denys Vlasenko <dvlasenk@redhat.com>\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: Josh Poimboeuf <jpoimboe@redhat.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Matthew Garrett <mjg59@srcf.ucam.org>\nCc: Michael Buesch <m@bues.ch>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Yinghai Lu <yinghai@kernel.org>\nCc: b43-dev@lists.infradead.org\nCc: linux-pci@vger.kernel.org\nCc: linux-wireless@vger.kernel.org\nCc: stable@vger.kernel.org\nCc: stable@vger.kernel.org # 123456789abc: x86/quirks: Apply nvidia_bugs quirk only on root bus\nCc: stable@vger.kernel.org # 123456789abc: x86/quirks: Reintroduce scanning of secondary buses\nLink: http://lkml.kernel.org/r/48d0972ac82a53d460e5fce77a07b2560db95203.1465690253.git.lukas@wunner.de\n[ Did minor readability edits. ]\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\n\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/47eec480c93227ddde8c4ee5c46cbb1d038c3b4d"},{"sha":"f8e307805ad3e4cd26d9d9ed7995ec36d82e4324","author":{"name":"Alexey Dobriyan","email":"86f616aba1e46edde05b0e7cdea2ac05850664d2@gmail.com"},"message":"posix_cpu_timer: Exit early when process has been reaped\n\n[ Upstream commit 2c13ce8f6b2f6fd9ba2f9261b1939fc0f62d1307 ]\n\nVariable \"now\" seems to be genuinely used unintialized\nif branch\n\n\tif (CPUCLOCK_PERTHREAD(timer->it_clock)) {\n\nis not taken and branch\n\n\tif (unlikely(sighand == NULL)) {\n\nis taken. In this case the process has been reaped and the timer is marked as\ndisarmed anyway. So none of the postprocessing of the sample is\nrequired. Return right away.\n\nSigned-off-by: Alexey Dobriyan <adobriyan@gmail.com>\nCc: stable@vger.kernel.org\nLink: http://lkml.kernel.org/r/20160707223911.GA26483@p183.telecom.by\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/f8e307805ad3e4cd26d9d9ed7995ec36d82e4324"},{"sha":"282f757159a1b0ba666acc8d511a32c92e9d321e","author":{"name":"Sasha Levin","email":"21b3700b83417709f72331cfb49b49e6145a3cad@verizon.com"},"message":"ALSA: hda - fix use-after-free after module unload\n\n[ Upstream commit ab58d8cc870ef3f0771c197700441936898d1f1d ]\n\nregister_vga_switcheroo() sets the PM ops from the hda structure which\nis freed later in azx_free. Make sure that these ops are cleared.\n\nCaught by KASAN, initially noticed due to a general protection fault.\n\nFixes: 246efa4a072f (\"snd/hda: add runtime suspend/resume on optimus support (v4)\")\nSigned-off-by: Peter Wu <peter@lekensteyn.nl>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/282f757159a1b0ba666acc8d511a32c92e9d321e"},{"sha":"627ec70f1de0227307f1a41ff58dd5ee0f2777d3","author":{"name":"Awais Belal","email":"c5b1d6a0d9be0faab304a4c6e9a4c798478c61b2@mentor.com"},"message":"ALSA: hda: add AMD Stoney PCI ID with proper driver caps\n\n[ Upstream commit d716fb03f76411fc7e138692e33b749cada5c094 ]\n\nThis allows the device to correctly show up as ATI HDMI\nrather than a generic one and allows the driver to use\nthe available caps.\n\nSigned-off-by: Awais Belal <awais_belal@mentor.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/627ec70f1de0227307f1a41ff58dd5ee0f2777d3"},{"sha":"1602957c537ea8e5dd79fb393ab1055a71e13ac8","author":{"name":"Chris Wilson","email":"4181b934c2715a2bba60cdb3cc1b35b2777d1c23@chris-wilson.co.uk"},"message":"drm/i915: Update ifdeffery for mutex->owner\n\n[ Upstream commit b19240062722c39fa92c99f04cbfd93034625123 ]\n\nIn commit 7608a43d8f2e (\"locking/mutexes: Use MUTEX_SPIN_ON_OWNER when\nappropriate\") the owner field in the mutex was updated from being\ndependent upon CONFIG_SMP to using optimistic spin. Update our peek\nfunction to suite.\n\nFixes:7608a43d8f2e (\"locking/mutexes: Use MUTEX_SPIN_ON_OWNER...\")\nReported-by: Hong Liu <hong.liu@intel.com>\nSigned-off-by: Chris Wilson <chris@chris-wilson.co.uk>\nLink: http://patchwork.freedesktop.org/patch/msgid/1468244777-4888-1-git-send-email-chris@chris-wilson.co.uk\nReviewed-by: Matthew Auld <matthew.auld@intel.com>\n(cherry picked from commit 4f074a5393431a7d2cc0de7fcfe2f61d24854628)\nCc: stable@vger.kernel.org\nSigned-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/1602957c537ea8e5dd79fb393ab1055a71e13ac8"},{"sha":"ca0d868322c49b0d6ee4dfaae94a28e12969552c","author":{"name":"Vlastimil Babka","email":"920c003c51ff5a11a6ee976b813fb82ea89684e4@suse.cz"},"message":"mm, compaction: simplify handling restart position in free pages scanner\n\n[ Upstream commit f5f61a320bf6275f37fcabf6645b4ac8e683c007 ]\n\nHandling the position where compaction free scanner should restart\n(stored in cc->free_pfn) got more complex with commit e14c720efdd7 (\"mm,\ncompaction: remember position within pageblock in free pages scanner\").\nCurrently the position is updated in each loop iteration of\nisolate_freepages(), although it should be enough to update it only when\nbreaking from the loop.  There's also an extra check outside the loop\nupdates the position in case we have met the migration scanner.\n\nThis can be simplified if we move the test for having isolated enough\nfrom the for-loop header next to the test for contention, and\ndetermining the restart position only in these cases.  We can reuse the\nisolate_start_pfn variable for this instead of setting cc->free_pfn\ndirectly.  Outside the loop, we can simply set cc->free_pfn to current\nvalue of isolate_start_pfn without any extra check.\n\nAlso add a VM_BUG_ON to catch possible mistake in the future, in case we\nlater add a new condition that terminates isolate_freepages_block()\nprematurely without also considering the condition in\nisolate_freepages().\n\nSigned-off-by: Vlastimil Babka <vbabka@suse.cz>\nCc: Minchan Kim <minchan@kernel.org>\nAcked-by: Mel Gorman <mgorman@suse.de>\nAcked-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>\nCc: Michal Nazarewicz <mina86@mina86.com>\nCc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>\nCc: Christoph Lameter <cl@linux.com>\nCc: Rik van Riel <riel@redhat.com>\nCc: David Rientjes <rientjes@google.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/ca0d868322c49b0d6ee4dfaae94a28e12969552c"},{"sha":"fe071fb0d4e9fd40fe7c46c6a9f8f23d5f27e92f","author":{"name":"David Rientjes","email":"f66fbc5bc952713981aafccdae5a05caf2d2e776@google.com"},"message":"mm, compaction: prevent VM_BUG_ON when terminating freeing scanner\n\n[ Upstream commit a46cbf3bc53b6a93fb84a5ffb288c354fa807954 ]\n\nIt's possible to isolate some freepages in a pageblock and then fail\nsplit_free_page() due to the low watermark check.  In this case, we hit\nVM_BUG_ON() because the freeing scanner terminated early without a\ncontended lock or enough freepages.\n\nThis should never have been a VM_BUG_ON() since it's not a fatal\ncondition.  It should have been a VM_WARN_ON() at best, or even handled\ngracefully.\n\nRegardless, we need to terminate anytime the full pageblock scan was not\ndone.  The logic belongs in isolate_freepages_block(), so handle its\nstate gracefully by terminating the pageblock loop and making a note to\nrestart at the same pageblock next time since it was not possible to\ncomplete the scan this time.\n\n[rientjes@google.com: don't rescan pages in a pageblock]\n  Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1607111244150.83138@chino.kir.corp.google.com\nLink: http://lkml.kernel.org/r/alpine.DEB.2.10.1606291436300.145590@chino.kir.corp.google.com\nSigned-off-by: David Rientjes <rientjes@google.com>\nReported-by: Minchan Kim <minchan@kernel.org>\nTested-by: Minchan Kim <minchan@kernel.org>\nCc: Joonsoo Kim <iamjoonsoo.kim@lge.com>\nCc: Hugh Dickins <hughd@google.com>\nCc: Mel Gorman <mgorman@techsingularity.net>\nCc: Vlastimil Babka <vbabka@suse.cz>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/fe071fb0d4e9fd40fe7c46c6a9f8f23d5f27e92f"},{"sha":"371ac20be9fcc8acca7add6d43d77e6d53192f92","author":{"name":"Dmitry Vyukov","email":"b57e2f029877ea15ce154a1e552a90c512dd912a@google.com"},"message":"vmlinux.lds: account for destructor sections\n\n[ Upstream commit e41f501d391265ff568f3e49d6128cc30856a36f ]\n\nIf CONFIG_KASAN is enabled and gcc is configured with\n--disable-initfini-array and/or gold linker is used, gcc emits\n.ctors/.dtors and .text.startup/.text.exit sections instead of\n.init_array/.fini_array.  .dtors section is not explicitly accounted in\nthe linker script and messes vvar/percpu layout.\n\nWe want:\n  ffffffff822bfd80 D _edata\n  ffffffff822c0000 D __vvar_beginning_hack\n  ffffffff822c0000 A __vvar_page\n  ffffffff822c0080 0000000000000098 D vsyscall_gtod_data\n  ffffffff822c1000 A __init_begin\n  ffffffff822c1000 D init_per_cpu__irq_stack_union\n  ffffffff822c1000 A __per_cpu_load\n  ffffffff822d3000 D init_per_cpu__gdt_page\n\nWe got:\n  ffffffff8279a600 D _edata\n  ffffffff8279b000 A __vvar_page\n  ffffffff8279c000 A __init_begin\n  ffffffff8279c000 D init_per_cpu__irq_stack_union\n  ffffffff8279c000 A __per_cpu_load\n  ffffffff8279e000 D __vvar_beginning_hack\n  ffffffff8279e080 0000000000000098 D vsyscall_gtod_data\n  ffffffff827ae000 D init_per_cpu__gdt_page\n\nThis happens because __vvar_page and .vvar get different addresses in\narch/x86/kernel/vmlinux.lds.S:\n\n\t. = ALIGN(PAGE_SIZE);\n\t__vvar_page = .;\n\n\t.vvar : AT(ADDR(.vvar) - LOAD_OFFSET) {\n\t\t/* work around gold bug 13023 */\n\t\t__vvar_beginning_hack = .;\n\nDiscard .dtors/.fini_array/.text.exit, since we don't call dtors.\nMerge .text.startup into init text.\n\nLink: http://lkml.kernel.org/r/1467386363-120030-1-git-send-email-dvyukov@google.com\nSigned-off-by: Dmitry Vyukov <dvyukov@google.com>\nReviewed-by: Andrey Ryabinin <aryabinin@virtuozzo.com>\nCc: <stable@vger.kernel.org>\t[4.0+]\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/371ac20be9fcc8acca7add6d43d77e6d53192f92"},{"sha":"ce05d315cec02835c77fa3f4b5119960e1654913","author":{"name":"James Patrick-Evans","email":"01cfcc75cc77e42d1369b51ffa1aaa70069d0f46@jmp-e.com"},"message":"media: fix airspy usb probe error path\n\n[ Upstream commit aa93d1fee85c890a34f2510a310e55ee76a27848 ]\n\nFix a memory leak on probe error of the airspy usb device driver.\n\nThe problem is triggered when more than 64 usb devices register with\nv4l2 of type VFL_TYPE_SDR or VFL_TYPE_SUBDEV.\n\nThe memory leak is caused by the probe function of the airspy driver\nmishandeling errors and not freeing the corresponding control structures\nwhen an error occours registering the device to v4l2 core.\n\nA badusb device can emulate 64 of these devices, and then through\ncontinual emulated connect/disconnect of the 65th device, cause the\nkernel to run out of RAM and crash the kernel, thus causing a local DOS\nvulnerability.\n\nFixes CVE-2016-5400\n\nSigned-off-by: James Patrick-Evans <james@jmp-e.com>\nReviewed-by: Kees Cook <keescook@chromium.org>\nCc: stable@vger.kernel.org # 3.17+\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/ce05d315cec02835c77fa3f4b5119960e1654913"},{"sha":"c30e87bae9b4bfa7918e30a18b8522eea08ae61f","author":{"name":"Taras Kondratiuk","email":"eb145d331727929df47f6b5f95e256b7d6fbd80e@cisco.com"},"message":"mmc: block: fix packed command header endianness\n\n[ Upstream commit f68381a70bb2b26c31b13fdaf67c778f92fd32b4 ]\n\nThe code that fills packed command header assumes that CPU runs in\nlittle-endian mode. Hence the header is malformed in big-endian mode\nand causes MMC data transfer errors:\n\n[  563.200828] mmcblk0: error -110 transferring data, sector 2048, nr 8, cmd response 0x900, card status 0xc40\n[  563.219647] mmcblk0: packed cmd failed, nr 2, sectors 16, failure index: -1\n\nConvert header data to LE.\n\nSigned-off-by: Taras Kondratiuk <takondra@cisco.com>\nFixes: ce39f9d17c14 (\"mmc: support packed write command for eMMC4.5 devices\")\nCc: <stable@vger.kernel.org>\nSigned-off-by: Ulf Hansson <ulf.hansson@linaro.org>\nSigned-off-by: Sasha Levin <alexander.levin@verizon.com>","distinct":false,"url":"https://api.github.com/repos/Rashed97/caf-kernel-msm-3.18/commits/c30e87bae9b4bfa7918e30a18b8522eea08ae61f"}]}
{"actor":{"display_login":"Rashed97"}}