{"push_id":1011284402,"size":68,"distinct_size":68,"ref":"refs/heads/linux-3.2.y","head":"5aa9ed40ec3a7827acf06c43de1cbc33bd22a61a","before":"8ad5c667c3ad728ef764b31c0a61371e4076747d","commits":[{"sha":"94bca3f746b5a8c236bbbb0bdff713d021cbf273","author":{"email":"69d3ebcf5ee4e7f05a50dc23cd96655b730804b4@redhat.com","name":"Paolo Bonzini"},"message":"KVM: vmx: fix MPX detection\n\ncommit 920c837785699bcc48f4a729ba9ee3492f620b95 upstream.\n\nkvm_x86_ops is still NULL at this point.  Since kvm_init_msr_list\ncannot fail, it is safe to initialize it before the call.\n\nFixes: 93c4adc7afedf9b0ec190066d45b6d67db5270da\nReported-by: Fengguang Wu <fengguang.wu@intel.com>\nTested-by: Jet Chen <jet.chen@intel.com>\nCc: kvm@vger.kernel.org\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nCc: Brad Spengler <spender@grsecurity.net>\n[bwh: Dependency of \"KVM: x86: expose MSR_TSC_AUX to userspace\",\n applied in 3.2.77]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/94bca3f746b5a8c236bbbb0bdff713d021cbf273"},{"sha":"e7989996ab9554b314dd8425c5f1d64a5b8a0a9b","author":{"email":"00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de","name":"Thomas Gleixner"},"message":"hrtimer: Handle remaining time proper for TIME_LOW_RES\n\ncommit 203cbf77de59fc8f13502dcfd11350c6d4a5c95f upstream.\n\nIf CONFIG_TIME_LOW_RES is enabled we add a jiffie to the relative timeout to\nprevent short sleeps, but we do not account for that in interfaces which\nretrieve the remaining time.\n\nHelge observed that timerfd can return a remaining time larger than the\nrelative timeout. That's not expected and breaks userland test programs.\n\nStore the information that the timer was armed relative and provide functions\nto adjust the remaining time. To avoid bloating the hrtimer struct make state\na u8, which as a bonus results in better code on x86 at least.\n\nReported-and-tested-by: Helge Deller <deller@gmx.de>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: John Stultz <john.stultz@linaro.org>\nCc: linux-m68k@lists.linux-m68k.org\nCc: dhowells@redhat.com\nLink: http://lkml.kernel.org/r/20160114164159.273328486@linutronix.de\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\n[bwh: Backported to 3.2:\n - Use #ifdef instead of IS_ENABLED() as that doesn't work for config\n   symbols that don't exist on the current architecture\n - Use KTIME_LOW_RES directly instead of hrtimer_resolution\n - Use ktime_sub() instead of modifying ktime::tv64 directly\n - Adjust filename, context]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/e7989996ab9554b314dd8425c5f1d64a5b8a0a9b"},{"sha":"a8e186eb50cb58896853169088c4cf24c014791b","author":{"email":"00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de","name":"Thomas Gleixner"},"message":"timerfd: Handle relative timers with CONFIG_TIME_LOW_RES proper\n\ncommit b62526ed11a1fe3861ab98d40b7fdab8981d788a upstream.\n\nHelge reported that a relative timer can return a remaining time larger than\nthe programmed relative time on parisc and other architectures which have\nCONFIG_TIME_LOW_RES set. This happens because we add a jiffie to the resulting\nexpiry time to prevent short timeouts.\n\nUse the new function hrtimer_expires_remaining_adjusted() to calculate the\nremaining time. It takes that extra added time into account for relative\ntimers.\n\nReported-and-tested-by: Helge Deller <deller@gmx.de>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: John Stultz <john.stultz@linaro.org>\nCc: linux-m68k@lists.linux-m68k.org\nCc: dhowells@redhat.com\nLink: http://lkml.kernel.org/r/20160114164159.354500742@linutronix.de\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\n[bwh: Backported to 3.2: adjust context]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/a8e186eb50cb58896853169088c4cf24c014791b"},{"sha":"c7f98587dd2eea27cdfe2ba3b60983c9e9e92de9","author":{"email":"00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de","name":"Thomas Gleixner"},"message":"posix-timers: Handle relative timers with CONFIG_TIME_LOW_RES proper\n\ncommit 572c39172684c3711e4a03c9a7380067e2b0661c upstream.\n\nAs Helge reported for timerfd we have the same issue in posix timers. We\nreturn remaining time larger than the programmed relative time to user space\nin case of CONFIG_TIME_LOW_RES=y. Use the proper function to adjust the extra\ntime added in hrtimer_start_range_ns().\n\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Helge Deller <deller@gmx.de>\nCc: John Stultz <john.stultz@linaro.org>\nCc: linux-m68k@lists.linux-m68k.org\nCc: dhowells@redhat.com\nLink: http://lkml.kernel.org/r/20160114164159.450510905@linutronix.de\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\n[bwh: Backported to 3.2: adjust filename]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/c7f98587dd2eea27cdfe2ba3b60983c9e9e92de9"},{"sha":"6841a66225c4857ed74b1b1d227c1e2ac5434321","author":{"email":"00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de","name":"Thomas Gleixner"},"message":"itimers: Handle relative timers with CONFIG_TIME_LOW_RES proper\n\ncommit 51cbb5242a41700a3f250ecfb48dcfb7e4375ea4 upstream.\n\nAs Helge reported for timerfd we have the same issue in itimers. We return\nremaining time larger than the programmed relative time to user space in case\nof CONFIG_TIME_LOW_RES=y. Use the proper function to adjust the extra time\nadded in hrtimer_start_range_ns().\n\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Helge Deller <deller@gmx.de>\nCc: John Stultz <john.stultz@linaro.org>\nCc: linux-m68k@lists.linux-m68k.org\nCc: dhowells@redhat.com\nLink: http://lkml.kernel.org/r/20160114164159.528222587@linutronix.de\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\n[bwh: Backported to 3.2: adjust filename]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/6841a66225c4857ed74b1b1d227c1e2ac5434321"},{"sha":"341fa49fa04aa8afb464c3c102755a56c4d6c2e8","author":{"email":"0e8503a5d55e00d5d2190cff62ef5fd449aa2247@linux.intel.com","name":"Lu Baolu"},"message":"usb: cdc-acm: send zero packet for intel 7260 modem\n\ncommit ffdb1e369a73b380fce95b05f8498d92c43842b4 upstream.\n\nFor Intel 7260 modem, it is needed for host side to send zero\npacket if the BULK OUT size is equal to USB endpoint max packet\nlength. Otherwise, modem side may still wait for more data and\ncannot give response to host side.\n\nSigned-off-by: Konrad Leszczynski <konrad.leszczynski@intel.com>\nSigned-off-by: Lu Baolu <baolu.lu@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/341fa49fa04aa8afb464c3c102755a56c4d6c2e8"},{"sha":"b67534c3cd56238e3adfbcd79407e8b4d3c11734","author":{"email":"bfee72d94d376f4e00f72b756466867d7f9eb24e@suse.com","name":"Oliver Neukum"},"message":"cdc-acm:exclude Samsung phone 04e8:685d\n\ncommit e912e685f372ab62a2405a1acd923597f524e94a upstream.\n\nThis phone needs to be handled by a specialised firmware tool\nand is reported to crash irrevocably if cdc-acm takes it.\n\nSigned-off-by: Oliver Neukum <oneukum@suse.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/b67534c3cd56238e3adfbcd79407e8b4d3c11734"},{"sha":"60bfb26f95813ca8c779fbc16ade031dc85f5394","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"af_unix: fix struct pid memory leak\n\ncommit fa0dc04df259ba2df3ce1920e9690c7842f8fa4b upstream.\n\nDmitry reported a struct pid leak detected by a syzkaller program.\n\nBug happens in unix_stream_recvmsg() when we break the loop when a\nsignal is pending, without properly releasing scm.\n\nFixes: b3ca9b02b007 (\"net: fix multithreaded signal handling in unix recv routines\")\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Rainer Weikusat <rweikusat@mobileactivedefense.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n[bwh: Backported to 3.2: cookie is *sicob->scm, not scm]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/60bfb26f95813ca8c779fbc16ade031dc85f5394"},{"sha":"b37593c406b332aec4154e0e5e9572c24c6bcd7e","author":{"email":"331be22c6b63ca3e0a03d408c2d906b1b02cd5f2@stressinduktion.org","name":"Hannes Frederic Sowa"},"message":"pptp: fix illegal memory access caused by multiple bind()s\n\ncommit 9a368aff9cb370298fa02feeffa861f2db497c18 upstream.\n\nSeveral times already this has been reported as kasan reports caused by\nsyzkaller and trinity and people always looked at RCU races, but it is\nmuch more simple. :)\n\nIn case we bind a pptp socket multiple times, we simply add it to\nthe callid_sock list but don't remove the old binding. Thus the old\nsocket stays in the bucket with unused call_id indexes and doesn't get\ncleaned up. This causes various forms of kasan reports which were hard\nto pinpoint.\n\nSimply don't allow multiple binds and correct error handling in\npptp_bind. Also keep sk_state bits in place in pptp_connect.\n\nFixes: 00959ade36acad (\"PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)\")\nCc: Dmitry Kozlov <xeb@mail.ru>\nCc: Sasha Levin <sasha.levin@oracle.com>\nCc: Dmitry Vyukov <dvyukov@google.com>\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nCc: Dave Jones <davej@codemonkey.org.uk>\nReported-by: Dave Jones <davej@codemonkey.org.uk>\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/b37593c406b332aec4154e0e5e9572c24c6bcd7e"},{"sha":"b3efe4725b6d87ef5f1a3e4ba08bbfa20d069e2c","author":{"email":"7fc7fc98bf391a9b9f95a773bac29e7d60cc65b5@gmail.com","name":"Marcelo Ricardo Leitner"},"message":"sctp: allow setting SCTP_SACK_IMMEDIATELY by the application\n\ncommit 27f7ed2b11d42ab6d796e96533c2076ec220affc upstream.\n\nThis patch extends commit b93d6471748d (\"sctp: implement the sender side\nfor SACK-IMMEDIATELY extension\") as it didn't white list\nSCTP_SACK_IMMEDIATELY on sctp_msghdr_parse(), causing it to be\nunderstood as an invalid flag and returning -EINVAL to the application.\n\nNote that the actual handling of the flag is already there in\nsctp_datamsg_from_user().\n\nhttps://tools.ietf.org/html/rfc7053#section-7\n\nFixes: b93d6471748d (\"sctp: implement the sender side for SACK-IMMEDIATELY extension\")\nSigned-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>\nAcked-by: Vlad Yasevich <vyasevich@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n[bwh: Backported to 3.2: drop the second hunk as we don't have SCTP_SNDINFO\n cmsg support]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/b3efe4725b6d87ef5f1a3e4ba08bbfa20d069e2c"},{"sha":"85c75f50cb410d34459c3df17651c0f092f808aa","author":{"email":"ba95b65eb4973a9855035349dc315afb347dca58@hotmail.com","name":"Peter Dedecker"},"message":"USB: cp210x: add ID for IAI USB to RS485 adaptor\n\ncommit f487c54ddd544e1c9172cd510954f697b77b76e3 upstream.\n\nAdded the USB serial console device ID for IAI Corp. RCB-CV-USB\nUSB to RS485 adaptor.\n\nSigned-off-by: Peter Dedecker <peter.dedecker@hotmail.com>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/85c75f50cb410d34459c3df17651c0f092f808aa"},{"sha":"eff70986a653dbf87ede52a1293dc499b6eb829e","author":{"email":"759412786bc533369b22377bf83fb9056c5b25b2@kernel.org","name":"Johan Hovold"},"message":"USB: visor: fix null-deref at probe\n\ncommit cac9b50b0d75a1d50d6c056ff65c005f3224c8e0 upstream.\n\nFix null-pointer dereference at probe should a (malicious) Treo device\nlack the expected endpoints.\n\nSpecifically, the Treo port-setup hack was dereferencing the bulk-in and\ninterrupt-in urbs without first making sure they had been allocated by\ncore.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/eff70986a653dbf87ede52a1293dc499b6eb829e"},{"sha":"8bc91d462570df465937a516c721ff0f4ae0e0ed","author":{"email":"f82da8db93e4ada738df910dc39037dfa2de78b0@redhat.com","name":"Vladis Dronov"},"message":"USB: serial: visor: fix crash on detecting device without write_urbs\n\ncommit cb3232138e37129e88240a98a1d2aba2187ff57c upstream.\n\nThe visor driver crashes in clie_5_attach() when a specially crafted USB\ndevice without bulk-out endpoint is detected. This fix adds a check that\nthe device has proper configuration expected by the driver.\n\nReported-by: Ralf Spenneberg <ralf@spenneberg.net>\nSigned-off-by: Vladis Dronov <vdronov@redhat.com>\nFixes: cfb8da8f69b8 (\"USB: visor: fix initialisation of UX50/TH55 devices\")\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/8bc91d462570df465937a516c721ff0f4ae0e0ed"},{"sha":"e1938811e5ceba564c995f44fc4bb68f1140280e","author":{"email":"c212f6c5eed30fada5e618fe1393e6ce361c7c24@gmail.com","name":"Daniele Palmas"},"message":"USB: serial: option: Adding support for Telit LE922\n\ncommit ff4e2494dc17b173468e1713fdf6237fd8578bc7 upstream.\n\nThis patch adds support for two PIDs of LE922.\n\nSigned-off-by: Daniele Palmas <dnlplm@gmail.com>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/e1938811e5ceba564c995f44fc4bb68f1140280e"},{"sha":"fd691a7b0dac25caf6a9ec69934c5b662735ab54","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup()\n\ncommit 599151336638d57b98d92338aa59c048e3a3e97d upstream.\n\nALSA sequencer OSS emulation code has a sanity check for currently\nopened devices, but there is a thinko there, eventually it spews\nwarnings and skips the operation wrongly like:\n  WARNING: CPU: 1 PID: 7573 at sound/core/seq/oss/seq_oss_synth.c:311\n\nFix this off-by-one error.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/fd691a7b0dac25caf6a9ec69934c5b662735ab54"},{"sha":"83470155397c2a31ba4c5d9bd401c902f40503a3","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ALSA: seq: Degrade the error message for too many opens\n\ncommit da10816e3d923565b470fec78a674baba794ed33 upstream.\n\nALSA OSS sequencer spews a kernel error message (\"ALSA: seq_oss: too\nmany applications\") when user-space tries to open more than the\nlimit.  This means that it can easily fill the log buffer.\n\nSince it's merely a normal error, it's safe to suppress it via\npr_debug() instead.\n\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\n[bwh: Backported to 3.2: this was still using snd_printk()]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/83470155397c2a31ba4c5d9bd401c902f40503a3"},{"sha":"8c0726c844369f81f56c10ba72e6fc1bd638f530","author":{"email":"4645f7897fd33786a2ee1264d590b3c400559d85@linuxfoundation.org","name":"Greg Kroah-Hartman"},"message":"USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable\n\ncommit e03cdf22a2727c60307be6a729233edab3bfda9c upstream.\n\nHarald Linden reports that the ftdi_sio driver works properly for the\nYaesu SCU-18 cable if the device ids are added to the driver.  So let's\nadd them.\n\nReported-by: Harald Linden <harald.linden@7183.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/8c0726c844369f81f56c10ba72e6fc1bd638f530"},{"sha":"94d2d14172d0334d5fa53c9c20a1aef295c8fbcc","author":{"email":"265264fed90bdf8e813a354375ec16f47ebdb1c5@linutronix.de","name":"Sebastian Andrzej Siewior"},"message":"PCI/AER: Flush workqueue on device remove to avoid use-after-free\n\ncommit 4ae2182b1e3407de369f8c5d799543b7db74221b upstream.\n\nA Root Port's AER structure (rpc) contains a queue of events.  aer_irq()\nenqueues AER status information and schedules aer_isr() to dequeue and\nprocess it.  When we remove a device, aer_remove() waits for the queue to\nbe empty, then frees the rpc struct.\n\nBut aer_isr() references the rpc struct after dequeueing and possibly\nemptying the queue, which can cause a use-after-free error as in the\nfollowing scenario with two threads, aer_isr() on the left and a\nconcurrent aer_remove() on the right:\n\n  Thread A                      Thread B\n  --------                      --------\n  aer_irq():\n    rpc->prod_idx++\n                                aer_remove():\n                                  wait_event(rpc->prod_idx == rpc->cons_idx)\n                                  # now blocked until queue becomes empty\n  aer_isr():                      # ...\n    rpc->cons_idx++               # unblocked because queue is now empty\n    ...                           kfree(rpc)\n    mutex_unlock(&rpc->rpc_mutex)\n\nTo prevent this problem, use flush_work() to wait until the last scheduled\ninstance of aer_isr() has completed before freeing the rpc struct in\naer_remove().\n\nI reproduced this use-after-free by flashing a device FPGA and\nre-enumerating the bus to find the new device.  With SLUB debug, this\ncrashes with 0x6b bytes (POISON_FREE, the use-after-free magic number) in\nGPR25:\n\n  pcieport 0000:00:00.0: AER: Multiple Corrected error received: id=0000\n  Unable to handle kernel paging request for data at address 0x27ef9e3e\n  Workqueue: events aer_isr\n  GPR24: dd6aa000 6b6b6b6b 605f8378 605f8360 d99b12c0 604fc674 606b1704 d99b12c0\n  NIP [602f5328] pci_walk_bus+0xd4/0x104\n\n[bhelgaas: changelog, stable tag]\nSigned-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>\nSigned-off-by: Bjorn Helgaas <bhelgaas@google.com>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/94d2d14172d0334d5fa53c9c20a1aef295c8fbcc"},{"sha":"70f16b6417a5725a7f4edfaade28e62694f9d784","author":{"email":"546b05909706652891a87f7bfe385ae147f61f91@kernel.org","name":"Tejun Heo"},"message":"libata: disable forced PORTS_IMPL for >= AHCI 1.3\n\ncommit 566d1827df2ef0cbe921d3d6946ac3007b1a6938 upstream.\n\nSome early controllers incorrectly reported zero ports in PORTS_IMPL\nregister and the ahci driver fabricates PORTS_IMPL from the number of\nports in those cases.  This hasn't mattered but with the new nvme\ncontrollers there are cases where zero PORTS_IMPL is valid and should\nbe honored.\n\nDisable the workaround for >= AHCI 1.3.\n\nSigned-off-by: Tejun Heo <tj@kernel.org>\nReported-by: Andy Lutomirski <luto@amacapital.net>\nLink: http://lkml.kernel.org/g/CALCETrU7yMvXEDhjAUShoHEhDwifJGapdw--BKxsP0jmjKGmRw@mail.gmail.com\nCc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/70f16b6417a5725a7f4edfaade28e62694f9d784"},{"sha":"407d1634d56b841279e1478253c212ea27bb7ea0","author":{"email":"255103e50249e3d658441816e0597170ebfc16ef@redhat.com","name":"Michael S. Tsirkin"},"message":"virtio_pci: fix use after free on release\n\ncommit 2989be09a8a9d62a785137586ad941f916e08f83 upstream.\n\nKASan detected a use-after-free error in virtio-pci remove code. In\nvirtio_pci_remove(), vp_dev is still used after being freed in\nunregister_virtio_device() (in virtio_pci_release_dev() more\nprecisely).\n\nTo fix, keep a reference until cleanup is done.\n\nFixes: 63bd62a08ca4 (\"virtio_pci: defer kfree until release callback\")\nReported-by: Jerome Marchand <jmarchan@redhat.com>\nCc: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: Michael S. Tsirkin <mst@redhat.com>\nTested-by: Jerome Marchand <jmarchan@redhat.com>\n[bwh: Backported to 3.2: adjust filename]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/407d1634d56b841279e1478253c212ea27bb7ea0"}]}