{"push_id":3073519528,"size":83,"distinct_size":0,"ref":"refs/heads/korg/stable/linux-4.9.y","head":"7a4dc3f8399780455a16a167068a03f317e1204d","before":"5552683784c9e2641e8c74827565476a45827126","commits":[{"sha":"9bed31c93660e7af9caeebe8558d170e6f00e200","author":{"name":"Sam Bobroff","email":"5005bd85686edd02bd9a1854bd2a0bebf4ce34dd@linux.ibm.com"},"message":"powerpc/eeh: Fix possible null deref in eeh_dump_dev_log()\n\n[ Upstream commit f9bc28aedfb5bbd572d2d365f3095c1becd7209b ]\n\nIf an error occurs during an unplug operation, it's possible for\neeh_dump_dev_log() to be called when edev->pdn is null, which\ncurrently leads to dereferencing a null pointer.\n\nHandle this by skipping the error log for those devices.\n\nSigned-off-by: Sam Bobroff <sbobroff@linux.ibm.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Sasha Levin <sashal@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/9bed31c93660e7af9caeebe8558d170e6f00e200"},{"sha":"9206016ce4079b492ad91b7898941fdbf1c8d7fe","author":{"name":"Miles Chen","email":"b187a429f4445a58d0c83c03f2ee85d69c8b3f0f@mediatek.com"},"message":"tty: check name length in tty_find_polling_driver()\n\n[ Upstream commit 33a1a7be198657c8ca26ad406c4d2a89b7162bcc ]\n\nThe issue is found by a fuzzing test.\nIf tty_find_polling_driver() recevies an incorrect input such as\n',,' or '0b', the len becomes 0 and strncmp() always return 0.\nIn this case, a null p->ops->poll_init() is called and it causes a kernel\npanic.\n\nFix this by checking name length against zero in tty_find_polling_driver().\n\n$echo ,, > /sys/module/kgdboc/parameters/kgdboc\n[   20.804451] WARNING: CPU: 1 PID: 104 at drivers/tty/serial/serial_core.c:457\nuart_get_baud_rate+0xe8/0x190\n[   20.804917] Modules linked in:\n[   20.805317] CPU: 1 PID: 104 Comm: sh Not tainted 4.19.0-rc7ajb #8\n[   20.805469] Hardware name: linux,dummy-virt (DT)\n[   20.805732] pstate: 20000005 (nzCv daif -PAN -UAO)\n[   20.805895] pc : uart_get_baud_rate+0xe8/0x190\n[   20.806042] lr : uart_get_baud_rate+0xc0/0x190\n[   20.806476] sp : ffffffc06acff940\n[   20.806676] x29: ffffffc06acff940 x28: 0000000000002580\n[   20.806977] x27: 0000000000009600 x26: 0000000000009600\n[   20.807231] x25: ffffffc06acffad0 x24: 00000000ffffeff0\n[   20.807576] x23: 0000000000000001 x22: 0000000000000000\n[   20.807807] x21: 0000000000000001 x20: 0000000000000000\n[   20.808049] x19: ffffffc06acffac8 x18: 0000000000000000\n[   20.808277] x17: 0000000000000000 x16: 0000000000000000\n[   20.808520] x15: ffffffffffffffff x14: ffffffff00000000\n[   20.808757] x13: ffffffffffffffff x12: 0000000000000001\n[   20.809011] x11: 0101010101010101 x10: ffffff880d59ff5f\n[   20.809292] x9 : ffffff880d59ff5e x8 : ffffffc06acffaf3\n[   20.809549] x7 : 0000000000000000 x6 : ffffff880d59ff5f\n[   20.809803] x5 : 0000000080008001 x4 : 0000000000000003\n[   20.810056] x3 : ffffff900853e6b4 x2 : dfffff9000000000\n[   20.810693] x1 : ffffffc06acffad0 x0 : 0000000000000cb0\n[   20.811005] Call trace:\n[   20.811214]  uart_get_baud_rate+0xe8/0x190\n[   20.811479]  serial8250_do_set_termios+0xe0/0x6f4\n[   20.811719]  serial8250_set_termios+0x48/0x54\n[   20.811928]  uart_set_options+0x138/0x1bc\n[   20.812129]  uart_poll_init+0x114/0x16c\n[   20.812330]  tty_find_polling_driver+0x158/0x200\n[   20.812545]  configure_kgdboc+0xbc/0x1bc\n[   20.812745]  param_set_kgdboc_var+0xb8/0x150\n[   20.812960]  param_attr_store+0xbc/0x150\n[   20.813160]  module_attr_store+0x40/0x58\n[   20.813364]  sysfs_kf_write+0x8c/0xa8\n[   20.813563]  kernfs_fop_write+0x154/0x290\n[   20.813764]  vfs_write+0xf0/0x278\n[   20.813951]  __arm64_sys_write+0x84/0xf4\n[   20.814400]  el0_svc_common+0xf4/0x1dc\n[   20.814616]  el0_svc_handler+0x98/0xbc\n[   20.814804]  el0_svc+0x8/0xc\n[   20.822005] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[   20.826913] Mem abort info:\n[   20.827103]   ESR = 0x84000006\n[   20.827352]   Exception class = IABT (current EL), IL = 16 bits\n[   20.827655]   SET = 0, FnV = 0\n[   20.827855]   EA = 0, S1PTW = 0\n[   20.828135] user pgtable: 4k pages, 39-bit VAs, pgdp = (____ptrval____)\n[   20.828484] [0000000000000000] pgd=00000000aadee003, pud=00000000aadee003, pmd=0000000000000000\n[   20.829195] Internal error: Oops: 84000006 [#1] SMP\n[   20.829564] Modules linked in:\n[   20.829890] CPU: 1 PID: 104 Comm: sh Tainted: G        W         4.19.0-rc7ajb #8\n[   20.830545] Hardware name: linux,dummy-virt (DT)\n[   20.830829] pstate: 60000085 (nZCv daIf -PAN -UAO)\n[   20.831174] pc :           (null)\n[   20.831457] lr : serial8250_do_set_termios+0x358/0x6f4\n[   20.831727] sp : ffffffc06acff9b0\n[   20.831936] x29: ffffffc06acff9b0 x28: ffffff9008d7c000\n[   20.832267] x27: ffffff900969e16f x26: 0000000000000000\n[   20.832589] x25: ffffff900969dfb0 x24: 0000000000000000\n[   20.832906] x23: ffffffc06acffad0 x22: ffffff900969e160\n[   20.833232] x21: 0000000000000000 x20: ffffffc06acffac8\n[   20.833559] x19: ffffff900969df90 x18: 0000000000000000\n[   20.833878] x17: 0000000000000000 x16: 0000000000000000\n[   20.834491] x15: ffffffffffffffff x14: ffffffff00000000\n[   20.834821] x13: ffffffffffffffff x12: 0000000000000001\n[   20.835143] x11: 0101010101010101 x10: ffffff880d59ff5f\n[   20.835467] x9 : ffffff880d59ff5e x8 : ffffffc06acffaf3\n[   20.835790] x7 : 0000000000000000 x6 : ffffff880d59ff5f\n[   20.836111] x5 : c06419717c314100 x4 : 0000000000000007\n[   20.836419] x3 : 0000000000000000 x2 : 0000000000000000\n[   20.836732] x1 : 0000000000000001 x0 : ffffff900969df90\n[   20.837100] Process sh (pid: 104, stack limit = 0x(____ptrval____))\n[   20.837396] Call trace:\n[   20.837566]            (null)\n[   20.837816]  serial8250_set_termios+0x48/0x54\n[   20.838089]  uart_set_options+0x138/0x1bc\n[   20.838570]  uart_poll_init+0x114/0x16c\n[   20.838834]  tty_find_polling_driver+0x158/0x200\n[   20.839119]  configure_kgdboc+0xbc/0x1bc\n[   20.839380]  param_set_kgdboc_var+0xb8/0x150\n[   20.839658]  param_attr_store+0xbc/0x150\n[   20.839920]  module_attr_store+0x40/0x58\n[   20.840183]  sysfs_kf_write+0x8c/0xa8\n[   20.840183]  sysfs_kf_write+0x8c/0xa8\n[   20.840440]  kernfs_fop_write+0x154/0x290\n[   20.840702]  vfs_write+0xf0/0x278\n[   20.840942]  __arm64_sys_write+0x84/0xf4\n[   20.841209]  el0_svc_common+0xf4/0x1dc\n[   20.841471]  el0_svc_handler+0x98/0xbc\n[   20.841713]  el0_svc+0x8/0xc\n[   20.842057] Code: bad PC value\n[   20.842764] ---[ end trace a8835d7de79aaadf ]---\n[   20.843134] Kernel panic - not syncing: Fatal exception\n[   20.843515] SMP: stopping secondary CPUs\n[   20.844289] Kernel Offset: disabled\n[   20.844634] CPU features: 0x0,21806002\n[   20.844857] Memory Limit: none\n[   20.845172] ---[ end Kernel panic - not syncing: Fatal exception ]---\n\nSigned-off-by: Miles Chen <miles.chen@mediatek.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/9206016ce4079b492ad91b7898941fdbf1c8d7fe"},{"sha":"427ccff8aabbbd3ace40edf1a22c0e72809a806a","author":{"name":"Fabio Estevam","email":"679188261afeb60eb822cd934fd7b46a48ddd743@nxp.com"},"message":"ARM: imx_v6_v7_defconfig: Select CONFIG_TMPFS_POSIX_ACL\n\n[ Upstream commit 35d3cbe84544da74e39e1cec01374092467e3119 ]\n\nAndreas Müller reports:\n\n\"Fixes:\n\n| Sep 04 09:05:10 imx6qdl-variscite-som systemd-udevd[220]: Failed to apply ACL on /dev/v4l-subdev0: Operation not supported\n| Sep 04 09:05:10 imx6qdl-variscite-som systemd-udevd[224]: Failed to apply ACL on /dev/v4l-subdev1: Operation not supported\n| Sep 04 09:05:10 imx6qdl-variscite-som systemd-udevd[215]: Failed to apply ACL on /dev/v4l-subdev10: Operation not supported\n| Sep 04 09:05:10 imx6qdl-variscite-som systemd-udevd[228]: Failed to apply ACL on /dev/v4l-subdev2: Operation not supported\n| Sep 04 09:05:10 imx6qdl-variscite-som systemd-udevd[232]: Failed to apply ACL on /dev/v4l-subdev5: Operation not supported\n| Sep 04 09:05:10 imx6qdl-variscite-som systemd-udevd[217]: Failed to apply ACL on /dev/v4l-subdev11: Operation not supported\n| Sep 04 09:05:10 imx6qdl-variscite-som systemd-udevd[214]: Failed to apply ACL on /dev/dri/card1: Operation not supported\n| Sep 04 09:05:10 imx6qdl-variscite-som systemd-udevd[216]: Failed to apply ACL on /dev/v4l-subdev8: Operation not supported\n| Sep 04 09:05:10 imx6qdl-variscite-som systemd-udevd[226]: Failed to apply ACL on /dev/v4l-subdev9: Operation not supported\n\nand nasty follow-ups: Starting weston from sddm as unpriviledged user fails\nwith some hints on missing access rights.\"\n\nSelect the CONFIG_TMPFS_POSIX_ACL option to fix these issues.\n\nReported-by: Andreas Müller <schnitzeltony@gmail.com>\nSigned-off-by: Fabio Estevam <fabio.estevam@nxp.com>\nAcked-by: Otavio Salvador <otavio@ossystems.com.br>\nSigned-off-by: Shawn Guo <shawnguo@kernel.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/427ccff8aabbbd3ace40edf1a22c0e72809a806a"},{"sha":"0e4dde1a6e300ba40d9bdf5dc21bae7cf92a6564","author":{"name":"Daniel Axtens","email":"cf1af486034ab0119a20f38a060e40da25f4cea3@axtens.net"},"message":"powerpc/nohash: fix undefined behaviour when testing page size support\n\n[ Upstream commit f5e284803a7206d43e26f9ffcae5de9626d95e37 ]\n\nWhen enumerating page size definitions to check hardware support,\nwe construct a constant which is (1U << (def->shift - 10)).\n\nHowever, the array of page size definitions is only initalised for\nvarious MMU_PAGE_* constants, so it contains a number of 0-initialised\nelements with def->shift == 0. This means we end up shifting by a\nvery large number, which gives the following UBSan splat:\n\n================================================================================\nUBSAN: Undefined behaviour in /home/dja/dev/linux/linux/arch/powerpc/mm/tlb_nohash.c:506:21\nshift exponent 4294967286 is too large for 32-bit type 'unsigned int'\nCPU: 0 PID: 0 Comm: swapper Not tainted 4.19.0-rc3-00045-ga604f927b012-dirty #6\nCall Trace:\n[c00000000101bc20] [c000000000a13d54] .dump_stack+0xa8/0xec (unreliable)\n[c00000000101bcb0] [c0000000004f20a8] .ubsan_epilogue+0x18/0x64\n[c00000000101bd30] [c0000000004f2b10] .__ubsan_handle_shift_out_of_bounds+0x110/0x1a4\n[c00000000101be20] [c000000000d21760] .early_init_mmu+0x1b4/0x5a0\n[c00000000101bf10] [c000000000d1ba28] .early_setup+0x100/0x130\n[c00000000101bf90] [c000000000000528] start_here_multiplatform+0x68/0x80\n================================================================================\n\nFix this by first checking if the element exists (shift != 0) before\nconstructing the constant.\n\nSigned-off-by: Daniel Axtens <dja@axtens.net>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Sasha Levin <sashal@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/0e4dde1a6e300ba40d9bdf5dc21bae7cf92a6564"},{"sha":"4bdf5ec12d3c655e5dbead42dd194c094bb6d7b5","author":{"name":"Tomi Valkeinen","email":"e1ca4dbb8be1acaf20734fecd2da10ed1d46a9bb@ti.com"},"message":"drm/omap: fix memory barrier bug in DMM driver\n\n[ Upstream commit 538f66ba204944470a653a4cccc5f8befdf97c22 ]\n\nA DMM timeout \"timed out waiting for done\" has been observed on DRA7\ndevices. The timeout happens rarely, and only when the system is under\nheavy load.\n\nDebugging showed that the timeout can be made to happen much more\nfrequently by optimizing the DMM driver, so that there's almost no code\nbetween writing the last DMM descriptors to RAM, and writing to DMM\nregister which starts the DMM transaction.\n\nThe current theory is that a wmb() does not properly ensure that the\ndata written to RAM is observable by all the components in the system.\n\nThis DMM timeout has caused interesting (and rare) bugs as the error\nhandling was not functioning properly (the error handling has been fixed\nin previous commits):\n\n * If a DMM timeout happened when a GEM buffer was being pinned for\n   display on the screen, a timeout error would be shown, but the driver\n   would continue programming DSS HW with broken buffer, leading to\n   SYNCLOST floods and possible crashes.\n\n * If a DMM timeout happened when other user (say, video decoder) was\n   pinning a GEM buffer, a timeout would be shown but if the user\n   handled the error properly, no other issues followed.\n\n * If a DMM timeout happened when a GEM buffer was being released, the\n   driver does not even notice the error, leading to crashes or hang\n   later.\n\nThis patch adds wmb() and readl() calls after the last bit is written to\nRAM, which should ensure that the execution proceeds only after the data\nis actually in RAM, and thus observable by DMM.\n\nThe read-back should not be needed. Further study is required to understand\nif DMM is somehow special case and read-back is ok, or if DRA7's memory\nbarriers do not work correctly.\n\nSigned-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>\nSigned-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>\nSigned-off-by: Sasha Levin <sashal@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/4bdf5ec12d3c655e5dbead42dd194c094bb6d7b5"},{"sha":"2a55f0985d484c0f993021923aa5337404d845cd","author":{"name":"Nicholas Mc Guire","email":"1f1947151fff46847c7ab253c8b8ee2fc7e63b14@osadl.org"},"message":"media: pci: cx23885: handle adding to list failure\n\n[ Upstream commit c5d59528e24ad22500347b199d52b9368e686a42 ]\n\naltera_hw_filt_init() which calls append_internal() assumes\nthat the node was successfully linked in while in fact it can\nsilently fail. So the call-site needs to set return to -ENOMEM\non append_internal() returning NULL and exit through the err path.\n\nFixes: 349bcf02e361 (\"[media] Altera FPGA based CI driver module\")\n\nSigned-off-by: Nicholas Mc Guire <hofrat@osadl.org>\nSigned-off-by: Hans Verkuil <hans.verkuil@cisco.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/2a55f0985d484c0f993021923aa5337404d845cd"},{"sha":"12b49fd34b8ca433c19dedf719faada112c692c4","author":{"name":"Dengcheng Zhu","email":"f1dc036443bd76c254ad3c59d629999f4170bb66@wavecomp.com"},"message":"MIPS: kexec: Mark CPU offline before disabling local IRQ\n\n[ Upstream commit dc57aaf95a516f70e2d527d8287a0332c481a226 ]\n\nAfter changing CPU online status, it will not be sent any IPIs such as in\n__flush_cache_all() on software coherency systems. Do this before disabling\nlocal IRQ.\n\nSigned-off-by: Dengcheng Zhu <dzhu@wavecomp.com>\nSigned-off-by: Paul Burton <paul.burton@mips.com>\nPatchwork: https://patchwork.linux-mips.org/patch/20571/\nCc: pburton@wavecomp.com\nCc: ralf@linux-mips.org\nCc: linux-mips@linux-mips.org\nCc: rachel.mozes@intel.com\nSigned-off-by: Sasha Levin <sashal@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/12b49fd34b8ca433c19dedf719faada112c692c4"},{"sha":"76c386b3a826112c0ac7c83a8c442c3a2c339379","author":{"name":"Joel Stanley","email":"4816dabf8db1bc6cac35b3a24cab2ff844b5b0c7@jms.id.au"},"message":"powerpc/boot: Ensure _zimage_start is a weak symbol\n\n[ Upstream commit ee9d21b3b3583712029a0db65a4b7c081d08d3b3 ]\n\nWhen building with clang crt0's _zimage_start is not marked weak, which\nbreaks the build when linking the kernel image:\n\n $ objdump -t arch/powerpc/boot/crt0.o |grep _zimage_start$\n 0000000000000058 g       .text  0000000000000000 _zimage_start\n\n ld: arch/powerpc/boot/wrapper.a(crt0.o): in function '_zimage_start':\n (.text+0x58): multiple definition of '_zimage_start';\n arch/powerpc/boot/pseries-head.o:(.text+0x0): first defined here\n\nClang requires the .weak directive to appear after the symbol is\ndeclared. The binutils manual says:\n\n This directive sets the weak attribute on the comma separated list of\n symbol names. If the symbols do not already exist, they will be\n created.\n\nSo it appears this is different with clang. The only reference I could\nsee for this was an OpenBSD mailing list post[1].\n\nChanging it to be after the declaration fixes building with Clang, and\nstill works with GCC.\n\n $ objdump -t arch/powerpc/boot/crt0.o |grep _zimage_start$\n 0000000000000058  w      .text\t0000000000000000 _zimage_start\n\nReported to clang as https://bugs.llvm.org/show_bug.cgi?id=38921\n\n[1] https://groups.google.com/forum/#!topic/fa.openbsd.tech/PAgKKen2YCY\n\nSigned-off-by: Joel Stanley <joel@jms.id.au>\nReviewed-by: Nick Desaulniers <ndesaulniers@google.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Sasha Levin <sashal@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/76c386b3a826112c0ac7c83a8c442c3a2c339379"},{"sha":"ff37c427fb4f9cb64c6a765d35560c6a76ac6561","author":{"name":"Huacai Chen","email":"bddc6ef64099649954804bf58f2e4dee9b3b798f@lemote.com"},"message":"MIPS/PCI: Call pcie_bus_configure_settings() to set MPS/MRRS\n\n[ Upstream commit 2794f688b2c336e0da85e9f91fed33febbd9f54a ]\n\nCall pcie_bus_configure_settings() on MIPS, like for other platforms.\nThe function pcie_bus_configure_settings() makes sure the MPS (Max\nPayload Size) across the bus is uniform and provides the ability to\ntune the MRSS (Max Read Request Size) and MPS (Max Payload Size) to\nhigher performance values. Some devices will not operate properly if\nthese aren't set correctly because the firmware doesn't always do it.\n\nSigned-off-by: Huacai Chen <chenhc@lemote.com>\nSigned-off-by: Paul Burton <paul.burton@mips.com>\nPatchwork: https://patchwork.linux-mips.org/patch/20649/\nCc: Ralf Baechle <ralf@linux-mips.org>\nCc: James Hogan <jhogan@kernel.org>\nCc: linux-mips@linux-mips.org\nCc: Fuxin Zhang <zhangfx@lemote.com>\nCc: Zhangjin Wu <wuzhangjin@gmail.com>\nCc: Huacai Chen <chenhuacai@gmail.com>\nSigned-off-by: Sasha Levin <sashal@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/ff37c427fb4f9cb64c6a765d35560c6a76ac6561"},{"sha":"64a5369b7e7fdbf5d6dd861e38a8ac9537f4ef89","author":{"name":"Phil Elwell","email":"e888d2bd6f13f82caa51a37c03d034c76f661ba3@raspberrypi.org"},"message":"sc16is7xx: Fix for multi-channel stall\n\n[ Upstream commit 8344498721059754e09d30fe255a12dab8fb03ef ]\n\nThe SC16IS752 is a dual-channel device. The two channels are largely\nindependent, but the IRQ signals are wired together as an open-drain,\nactive low signal which will be driven low while either of the\nchannels requires attention, which can be for significant periods of\ntime until operations complete and the interrupt can be acknowledged.\nIn that respect it is should be treated as a true level-sensitive IRQ.\n\nThe kernel, however, needs to be able to exit interrupt context in\norder to use I2C or SPI to access the device registers (which may\ninvolve sleeping).  Therefore the interrupt needs to be masked out or\npaused in some way.\n\nThe usual way to manage sleeping from within an interrupt handler\nis to use a threaded interrupt handler - a regular interrupt routine\ndoes the minimum amount of work needed to triage the interrupt before\nwaking the interrupt service thread. If the threaded IRQ is marked as\nIRQF_ONESHOT the kernel will automatically mask out the interrupt\nuntil the thread runs to completion. The sc16is7xx driver used to\nuse a threaded IRQ, but a patch switched to using a kthread_worker\nin order to set realtime priorities on the handler thread and for\nother optimisations. The end result is non-threaded IRQ that\nschedules some work then returns IRQ_HANDLED, making the kernel\nthink that all IRQ processing has completed.\n\nThe work-around to prevent a constant stream of interrupts is to\nmark the interrupt as edge-sensitive rather than level-sensitive,\nbut interpreting an active-low source as a falling-edge source\nrequires care to prevent a total cessation of interrupts. Whereas\nan edge-triggering source will generate a new edge for every interrupt\ncondition a level-triggering source will keep the signal at the\ninterrupting level until it no longer requires attention; in other\nwords, the host won't see another edge until all interrupt conditions\nare cleared. It is therefore vital that the interrupt handler does not\nexit with an outstanding interrupt condition, otherwise the kernel\nwill not receive another interrupt unless some other operation causes\nthe interrupt state on the device to be cleared.\n\nThe existing sc16is7xx driver has a very simple interrupt \"thread\"\n(kthread_work job) that processes interrupts on each channel in turn\nuntil there are no more. If both channels are active and the first\nchannel starts interrupting while the handler for the second channel\nis running then it will not be detected and an IRQ stall ensues. This\ncould be handled easily if there was a shared IRQ status register, or\na convenient way to determine if the IRQ had been deasserted for any\nlength of time, but both appear to be lacking.\n\nAvoid this problem (or at least make it much less likely to happen)\nby reducing the granularity of per-channel interrupt processing\nto one condition per iteration, only exiting the overall loop when\nboth channels are no longer interrupting.\n\nSigned-off-by: Phil Elwell <phil@raspberrypi.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/64a5369b7e7fdbf5d6dd861e38a8ac9537f4ef89"},{"sha":"c19136a6cd2ef80e12c1bac21be752c34b71c632","author":{"name":"Marco Felsch","email":"43df7b5eee4ab13b86a82edbc58b423fb2a490b3@pengutronix.de"},"message":"media: tvp5150: fix width alignment during set_selection()\n\n[ Upstream commit bd24db04101f45a9c1d874fe21b0c7eab7bcadec ]\n\nThe driver ignored the width alignment which exists due to the UYVY\ncolorspace format. Fix the width alignment and make use of the the\nprovided v4l2 helper function to set the width, height and all\nalignments in one.\n\nFixes: 963ddc63e20d (\"[media] media: tvp5150: Add cropping support\")\n\nSigned-off-by: Marco Felsch <m.felsch@pengutronix.de>\nSigned-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>\nSigned-off-by: Sasha Levin <sashal@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/c19136a6cd2ef80e12c1bac21be752c34b71c632"},{"sha":"abefbf42e4655a4d237748756c35711c857a7a39","author":{"name":"Breno Leitao","email":"a10246ea2c3600c1725f8dc718f81b30cd4d07c5@debian.org"},"message":"powerpc/selftests: Wait all threads to join\n\n[ Upstream commit 693b31b2fc1636f0aa7af53136d3b49f6ad9ff39 ]\n\nTest tm-tmspr might exit before all threads stop executing, because it just\nwaits for the very last thread to join before proceeding/exiting.\n\nThis patch makes sure that all threads that were created will join before\nproceeding/exiting.\n\nThis patch also guarantees that the amount of threads being created is equal\nto thread_num.\n\nSigned-off-by: Breno Leitao <leitao@debian.org>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Sasha Levin <sashal@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/abefbf42e4655a4d237748756c35711c857a7a39"},{"sha":"9e79094da01fecd4a1fb533e6f495c2a0e8bea75","author":{"name":"Dominique Martinet","email":"9c69231df81d8a56bd8fc6741579751b95573585@cea.fr"},"message":"9p locks: fix glock.client_id leak in do_lock\n\n[ Upstream commit b4dc44b3cac9e8327e0655f530ed0c46f2e6214c ]\n\nthe 9p client code overwrites our glock.client_id pointing to a static\nbuffer by an allocated string holding the network provided value which\nwe do not care about; free and reset the value as appropriate.\n\nThis is almost identical to the leak in v9fs_file_getlock() fixed by\nAl Viro in commit ce85dd58ad5a6 (\"9p: we are leaking glock.client_id\nin v9fs_file_getlock()\"), which was returned as an error by a coverity\nfalse positive -- while we are here attempt to make the code slightly\nmore robust to future change of the net/9p/client code and hopefully\nmore clear to coverity that there is no problem.\n\nLink: http://lkml.kernel.org/r/1536339057-21974-5-git-send-email-asmadeus@codewreck.org\nSigned-off-by: Dominique Martinet <dominique.martinet@cea.fr>\nSigned-off-by: Sasha Levin <sashal@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/9e79094da01fecd4a1fb533e6f495c2a0e8bea75"},{"sha":"0cf4fa79920cfdff86e2ebef7aadd5a6e3b09b92","author":{"name":"Dominique Martinet","email":"9c69231df81d8a56bd8fc6741579751b95573585@cea.fr"},"message":"9p: clear dangling pointers in p9stat_free\n\n[ Upstream commit 62e3941776fea8678bb8120607039410b1b61a65 ]\n\np9stat_free is more of a cleanup function than a 'free' function as it\nonly frees the content of the struct; there are chances of use-after-free\nif it is improperly used (e.g. p9stat_free called twice as it used to be\npossible to)\n\nClearing dangling pointers makes the function idempotent and safer to use.\n\nLink: http://lkml.kernel.org/r/1535410108-20650-2-git-send-email-asmadeus@codewreck.org\nSigned-off-by: Dominique Martinet <dominique.martinet@cea.fr>\nReported-by: syzbot+d4252148d198410b864f@syzkaller.appspotmail.com\nSigned-off-by: Sasha Levin <sashal@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/0cf4fa79920cfdff86e2ebef7aadd5a6e3b09b92"},{"sha":"8dd745a8799ee01fc67b64fd33cdb44d04eb7e4c","author":{"name":"Young_X","email":"d24485de505f2d0a108ffa5a732dca497f03a064@hotmail.com"},"message":"cdrom: fix improper type cast, which can leat to information leak.\n\ncommit e4f3aa2e1e67bb48dfbaaf1cad59013d5a5bc276 upstream.\n\nThere is another cast from unsigned long to int which causes\na bounds check to fail with specially crafted input. The value is\nthen used as an index in the slot array in cdrom_slot_status().\n\nThis issue is similar to CVE-2018-16658 and CVE-2018-10940.\n\nSigned-off-by: Young_X <YangX92@hotmail.com>\nSigned-off-by: Jens Axboe <axboe@kernel.dk>\nCc: Ben Hutchings <ben.hutchings@codethink.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/8dd745a8799ee01fc67b64fd33cdb44d04eb7e4c"},{"sha":"0b6393523e59d1abcee494daaa350ef1ed6ed0c0","author":{"name":"Himanshu Madhani","email":"a1599b7f51f3890722b2125e7c07879c181c9399@cavium.com"},"message":"scsi: qla2xxx: Fix incorrect port speed being set for FC adapters\n\ncommit 4c1458df9635c7e3ced155f594d2e7dfd7254e21 upstream.\n\nFixes: 6246b8a1d26c7c (\"[SCSI] qla2xxx: Enhancements to support ISP83xx.\")\nFixes: 1bb395485160d2 (\"qla2xxx: Correct iiDMA-update calling conventions.\")\nCc: <stable@vger.kernel.org>\nSigned-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/0b6393523e59d1abcee494daaa350ef1ed6ed0c0"},{"sha":"0dd45a4df3eb901668cafeefb667bf781a527eb3","author":{"name":"Quinn Tran","email":"a02f5c47ee09ecfb205631316fdc727ed52eb140@cavium.com"},"message":"scsi: qla2xxx: shutdown chip if reset fail\n\ncommit 1e4ac5d6fe0a4af17e4b6251b884485832bf75a3 upstream.\n\nIf chip unable to fully initialize, use full shutdown sequence to clear out\nany stale FW state.\n\nFixes: e315cd28b9ef (\"[SCSI] qla2xxx: Code changes for qla data structure refactoring\")\nCc: stable@vger.kernel.org  #4.10\nSigned-off-by: Quinn Tran <quinn.tran@cavium.com>\nSigned-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/0dd45a4df3eb901668cafeefb667bf781a527eb3"},{"sha":"7996b1c0eaefc5745c982301ca483f99555842e4","author":{"name":"Kirill Tkhai","email":"e5b39230c99b4d3ebd6aa54f6d823f95134bc39d@virtuozzo.com"},"message":"fuse: Fix use-after-free in fuse_dev_do_read()\n\ncommit bc78abbd55dd28e2287ec6d6502b842321a17c87 upstream.\n\nWe may pick freed req in this way:\n\n[cpu0]                                  [cpu1]\nfuse_dev_do_read()                      fuse_dev_do_write()\n   list_move_tail(&req->list, ...);     ...\n   spin_unlock(&fpq->lock);             ...\n   ...                                  request_end(fc, req);\n   ...                                    fuse_put_request(fc, req);\n   if (test_bit(FR_INTERRUPTED, ...))\n         queue_interrupt(fiq, req);\n\nFix that by keeping req alive until we finish all manipulations.\n\nReported-by: syzbot+4e975615ca01f2277bdd@syzkaller.appspotmail.com\nSigned-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>\nSigned-off-by: Miklos Szeredi <mszeredi@redhat.com>\nFixes: 46c34a348b0a (\"fuse: no fc->lock for pqueue parts\")\nCc: <stable@vger.kernel.org> # v4.2\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/7996b1c0eaefc5745c982301ca483f99555842e4"},{"sha":"0799a93d30588e85eb15775bea286997e796e174","author":{"name":"Kirill Tkhai","email":"e5b39230c99b4d3ebd6aa54f6d823f95134bc39d@virtuozzo.com"},"message":"fuse: Fix use-after-free in fuse_dev_do_write()\n\ncommit d2d2d4fb1f54eff0f3faa9762d84f6446a4bc5d0 upstream.\n\nAfter we found req in request_find() and released the lock,\neverything may happen with the req in parallel:\n\ncpu0                              cpu1\nfuse_dev_do_write()               fuse_dev_do_write()\n  req = request_find(fpq, ...)    ...\n  spin_unlock(&fpq->lock)         ...\n  ...                             req = request_find(fpq, oh.unique)\n  ...                             spin_unlock(&fpq->lock)\n  queue_interrupt(&fc->iq, req);   ...\n  ...                              ...\n  ...                              ...\n  request_end(fc, req);\n    fuse_put_request(fc, req);\n  ...                              queue_interrupt(&fc->iq, req);\n\n\nSigned-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>\nSigned-off-by: Miklos Szeredi <mszeredi@redhat.com>\nFixes: 46c34a348b0a (\"fuse: no fc->lock for pqueue parts\")\nCc: <stable@vger.kernel.org> # v4.2\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/0799a93d30588e85eb15775bea286997e796e174"},{"sha":"7238fcbd68147fd76a927bfd10cb377d032374bf","author":{"name":"Miklos Szeredi","email":"84cd5483a2f9acd1c37251cba7c2908448f221b8@redhat.com"},"message":"fuse: fix blocked_waitq wakeup\n\ncommit 908a572b80f6e9577b45e81b3dfe2e22111286b8 upstream.\n\nUsing waitqueue_active() is racy.  Make sure we issue a wake_up()\nunconditionally after storing into fc->blocked.  After that it's okay to\noptimize with waitqueue_active() since the first wake up provides the\nnecessary barrier for all waiters, not the just the woken one.\n\nSigned-off-by: Miklos Szeredi <mszeredi@redhat.com>\nFixes: 3c18ef8117f0 (\"fuse: optimize wake_up\")\nCc: <stable@vger.kernel.org> # v3.10\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel-msm-4.4/commits/7238fcbd68147fd76a927bfd10cb377d032374bf"}]}
{"actor":{"display_login":"blissgerrit"}}