{"push_id":2865047955,"size":31,"distinct_size":31,"ref":"refs/heads/o8x-caf","head":"3d6632cd48be58e3651eedbbf2216fa04fde6628","before":"dde5971d325edd93b90883a1443c18dbbdca32ea","commits":[{"sha":"fec7d721a09b917f6fa8b923a28fbac97c1217ba","author":{"name":"Bartosz Golaszewski","email":"e5d45fddd9040473413b909b802f629a971ad04c@baylibre.com"},"message":"spi: davinci: fix a NULL pointer dereference\n\ncommit 563a53f3906a6b43692498e5b3ae891fac93a4af upstream.\n\nOn non-OF systems spi->controlled_data may be NULL. This causes a NULL\npointer derefence on dm365-evm.\n\nSigned-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/fec7d721a09b917f6fa8b923a28fbac97c1217ba"},{"sha":"b3f3454eb475f6e7f53bf5029cde593ca267c3a0","author":{"name":"Hari Bathini","email":"8c08e0cbfdd898a4d11cb688ad22c29e30def136@linux.ibm.com"},"message":"powerpc/fadump: handle crash memory ranges array index overflow\n\ncommit 1bd6a1c4b80a28d975287630644e6b47d0f977a5 upstream.\n\nCrash memory ranges is an array of memory ranges of the crashing kernel\nto be exported as a dump via /proc/vmcore file. The size of the array\nis set based on INIT_MEMBLOCK_REGIONS, which works alright in most cases\nwhere memblock memory regions count is less than INIT_MEMBLOCK_REGIONS\nvalue. But this count can grow beyond INIT_MEMBLOCK_REGIONS value since\ncommit 142b45a72e22 (\"memblock: Add array resizing support\").\n\nOn large memory systems with a few DLPAR operations, the memblock memory\nregions count could be larger than INIT_MEMBLOCK_REGIONS value. On such\nsystems, registering fadump results in crash or other system failures\nlike below:\n\n  task: c00007f39a290010 ti: c00000000b738000 task.ti: c00000000b738000\n  NIP: c000000000047df4 LR: c0000000000f9e58 CTR: c00000000010f180\n  REGS: c00000000b73b570 TRAP: 0300   Tainted: G          L   X  (4.4.140+)\n  MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE>  CR: 22004484  XER: 20000000\n  CFAR: c000000000008500 DAR: 000007a450000000 DSISR: 40000000 SOFTE: 0\n  ...\n  NIP [c000000000047df4] smp_send_reschedule+0x24/0x80\n  LR [c0000000000f9e58] resched_curr+0x138/0x160\n  Call Trace:\n    resched_curr+0x138/0x160 (unreliable)\n    check_preempt_curr+0xc8/0xf0\n    ttwu_do_wakeup+0x38/0x150\n    try_to_wake_up+0x224/0x4d0\n    __wake_up_common+0x94/0x100\n    ep_poll_callback+0xac/0x1c0\n    __wake_up_common+0x94/0x100\n    __wake_up_sync_key+0x70/0xa0\n    sock_def_readable+0x58/0xa0\n    unix_stream_sendmsg+0x2dc/0x4c0\n    sock_sendmsg+0x68/0xa0\n    ___sys_sendmsg+0x2cc/0x2e0\n    __sys_sendmsg+0x5c/0xc0\n    SyS_socketcall+0x36c/0x3f0\n    system_call+0x3c/0x100\n\nas array index overflow is not checked for while setting up crash memory\nranges causing memory corruption. To resolve this issue, dynamically\nallocate memory for crash memory ranges and resize it incrementally,\nin units of pagesize, on hitting array size limit.\n\nFixes: 2df173d9e85d (\"fadump: Initialize elfcore header and add PT_LOAD program headers.\")\nCc: stable@vger.kernel.org # v3.4+\nSigned-off-by: Hari Bathini <hbathini@linux.ibm.com>\nReviewed-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>\n[mpe: Just use PAGE_SIZE directly, fixup variable placement]\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/b3f3454eb475f6e7f53bf5029cde593ca267c3a0"},{"sha":"43a2089a1353159c24eaad3f8925c4710b9e7c16","author":{"name":"Mahesh Salgaonkar","email":"6a890e1065a1d4e8df9dcf1d9a2c9c740bbcf8aa@linux.vnet.ibm.com"},"message":"powerpc/pseries: Fix endianness while restoring of r3 in MCE handler.\n\ncommit cd813e1cd7122f2c261dce5b54d1e0c97f80e1a5 upstream.\n\nDuring Machine Check interrupt on pseries platform, register r3 points\nRTAS extended event log passed by hypervisor. Since hypervisor uses r3\nto pass pointer to rtas log, it stores the original r3 value at the\nstart of the memory (first 8 bytes) pointed by r3. Since hypervisor\nstores this info and rtas log is in BE format, linux should make\nsure to restore r3 value in correct endian format.\n\nWithout this patch when MCE handler, after recovery, returns to code that\nthat caused the MCE may end up with Data SLB access interrupt for invalid\naddress followed by kernel panic or hang.\n\n  Severe Machine check interrupt [Recovered]\n    NIP [d00000000ca301b8]: init_module+0x1b8/0x338 [bork_kernel]\n    Initiator: CPU\n    Error type: SLB [Multihit]\n      Effective address: d00000000ca70000\n  cpu 0xa: Vector: 380 (Data SLB Access) at [c0000000fc7775b0]\n      pc: c0000000009694c0: vsnprintf+0x80/0x480\n      lr: c0000000009698e0: vscnprintf+0x20/0x60\n      sp: c0000000fc777830\n     msr: 8000000002009033\n     dar: a803a30c000000d0\n    current = 0xc00000000bc9ef00\n    paca    = 0xc00000001eca5c00\t softe: 3\t irq_happened: 0x01\n      pid   = 8860, comm = insmod\n  vscnprintf+0x20/0x60\n  vprintk_emit+0xb4/0x4b0\n  vprintk_func+0x5c/0xd0\n  printk+0x38/0x4c\n  init_module+0x1c0/0x338 [bork_kernel]\n  do_one_initcall+0x54/0x230\n  do_init_module+0x8c/0x248\n  load_module+0x12b8/0x15b0\n  sys_finit_module+0xa8/0x110\n  system_call+0x58/0x6c\n  --- Exception: c00 (System Call) at 00007fff8bda0644\n  SP (7fffdfbfe980) is in userspace\n\nThis patch fixes this issue.\n\nFixes: a08a53ea4c97 (\"powerpc/le: Enable RTAS events support\")\nCc: stable@vger.kernel.org # v3.15+\nReviewed-by: Nicholas Piggin <npiggin@gmail.com>\nSigned-off-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/43a2089a1353159c24eaad3f8925c4710b9e7c16"},{"sha":"fd38cf65a88ec9dc2be3ebac91d08cc137bdf8bd","author":{"name":"jiangyiwen","email":"77747b30a93bb24732f772508362a5ea2dd0e579@huawei.com"},"message":"9p/virtio: fix off-by-one error in sg list bounds check\n\ncommit 23cba9cbde0bba05d772b335fe5f66aa82b9ad19 upstream.\n\nBecause the value of limit is VIRTQUEUE_NUM, if index is equal to\nlimit, it will cause sg array out of bounds, so correct the judgement\nof BUG_ON.\n\nLink: http://lkml.kernel.org/r/5B63D5F6.6080109@huawei.com\nSigned-off-by: Yiwen Jiang <jiangyiwen@huawei.com>\nReported-By: Dan Carpenter <dan.carpenter@oracle.com>\nAcked-by: Jun Piao <piaojun@huawei.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Dominique Martinet <dominique.martinet@cea.fr>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/fd38cf65a88ec9dc2be3ebac91d08cc137bdf8bd"},{"sha":"7bba0ec33b0b17d1b1609f992825f5b162304738","author":{"name":"Tomas Bortoli","email":"f7ea0a06b71d335820a2500be13a9844562b2d5a@gmail.com"},"message":"net/9p/client.c: version pointer uninitialized\n\ncommit 7913690dcc5e18e235769fd87c34143072f5dbea upstream.\n\nThe p9_client_version() does not initialize the version pointer. If the\ncall to p9pdu_readf() returns an error and version has not been allocated\nin p9pdu_readf(), then the program will jump to the \"error\" label and will\ntry to free the version pointer. If version is not initialized, free()\nwill be called with uninitialized, garbage data and will provoke a crash.\n\nLink: http://lkml.kernel.org/r/20180709222943.19503-1-tomasbortoli@gmail.com\nSigned-off-by: Tomas Bortoli <tomasbortoli@gmail.com>\nReported-by: syzbot+65c6b72f284a39d416b4@syzkaller.appspotmail.com\nReviewed-by: Jun Piao <piaojun@huawei.com>\nReviewed-by: Yiwen Jiang <jiangyiwen@huawei.com>\nCc: Eric Van Hensbergen <ericvh@gmail.com>\nCc: Ron Minnich <rminnich@sandia.gov>\nCc: Latchesar Ionkov <lucho@ionkov.net>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Dominique Martinet <dominique.martinet@cea.fr>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/7bba0ec33b0b17d1b1609f992825f5b162304738"},{"sha":"d90fb2996470afa3d416f7dbafc6482177e2a11e","author":{"name":"Tomas Bortoli","email":"f7ea0a06b71d335820a2500be13a9844562b2d5a@gmail.com"},"message":"net/9p/trans_fd.c: fix race-condition by flushing workqueue before the kfree()\n\ncommit 430ac66eb4c5b5c4eb846b78ebf65747510b30f1 upstream.\n\nThe patch adds the flush in p9_mux_poll_stop() as it the function used by\np9_conn_destroy(), in turn called by p9_fd_close() to stop the async\npolling associated with the data regarding the connection.\n\nLink: http://lkml.kernel.org/r/20180720092730.27104-1-tomasbortoli@gmail.com\nSigned-off-by: Tomas Bortoli <tomasbortoli@gmail.com>\nReported-by: syzbot+39749ed7d9ef6dfb23f6@syzkaller.appspotmail.com\nTo: Eric Van Hensbergen <ericvh@gmail.com>\nTo: Ron Minnich <rminnich@sandia.gov>\nTo: Latchesar Ionkov <lucho@ionkov.net>\nCc: Yiwen Jiang <jiangyiwen@huwei.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Dominique Martinet <dominique.martinet@cea.fr>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/d90fb2996470afa3d416f7dbafc6482177e2a11e"},{"sha":"ceef7b21cdfb9c3ba31f2945643f918dadab6382","author":{"name":"Mike Snitzer","email":"85e533f2e78486213c4d69f71462342ec0c62734@redhat.com"},"message":"dm cache metadata: save in-core policy_hint_size to on-disk superblock\n\ncommit fd2fa95416188a767a63979296fa3e169a9ef5ec upstream.\n\npolicy_hint_size starts as 0 during __write_initial_superblock().  It\nisn't until the policy is loaded that policy_hint_size is set in-core\n(cmd->policy_hint_size).  But it never got recorded in the on-disk\nsuperblock because __commit_transaction() didn't deal with transfering\nthe in-core cmd->policy_hint_size to the on-disk superblock.\n\nThe in-core cmd->policy_hint_size gets initialized by metadata_open()'s\n__begin_transaction_flags() which re-reads all superblock fields.\nBecause the superblock's policy_hint_size was never properly stored, when\nthe cache was created, hints_array_available() would always return false\nwhen re-activating a previously created cache.  This means\n__load_mappings() always considered the hints invalid and never made use\nof the hints (these hints served to optimize).\n\nAnother detremental side-effect of this oversight is the cache_check\nutility would fail with: \"invalid hint width: 0\"\n\nCc: stable@vger.kernel.org\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/ceef7b21cdfb9c3ba31f2945643f918dadab6382"},{"sha":"a3442d68f5af35117f20f595c530ca6c26992f22","author":{"name":"Lars-Peter Clausen","email":"3318dc5ce3e4fb7c28a0b841b6801c884e1d0896@metafoo.de"},"message":"iio: ad9523: Fix displayed phase\n\ncommit 5a4e33c1c53ae7d4425f7d94e60e4458a37b349e upstream.\n\nFix the displayed phase for the ad9523 driver. Currently the most\nsignificant decimal place is dropped and all other digits are shifted one\nto the left. This is due to a multiplication by 10, which is not necessary,\nso remove it.\n\nSigned-off-by: Lars-Peter Clausen <lars@metafoo.de>\nSigned-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>\nFixes: cd1678f9632 (\"iio: frequency: New driver for AD9523 SPI Low Jitter Clock Generator\")\nCc: <Stable@vger.kernel.org>\nSigned-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/a3442d68f5af35117f20f595c530ca6c26992f22"},{"sha":"76eb62bdb1119b400668b0e63cce3edc1678dea6","author":{"name":"Lars-Peter Clausen","email":"3318dc5ce3e4fb7c28a0b841b6801c884e1d0896@metafoo.de"},"message":"iio: ad9523: Fix return value for ad952x_store()\n\ncommit 9a5094ca29ea9b1da301b31fd377c0c0c4c23034 upstream.\n\nA sysfs write callback function needs to either return the number of\nconsumed characters or an error.\n\nThe ad952x_store() function currently returns 0 if the input value was \"0\",\nthis will signal that no characters have been consumed and the function\nwill be called repeatedly in a loop indefinitely. Fix this by returning\nnumber of supplied characters to indicate that the whole input string has\nbeen consumed.\n\nSigned-off-by: Lars-Peter Clausen <lars@metafoo.de>\nSigned-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>\nFixes: cd1678f96329 (\"iio: frequency: New driver for AD9523 SPI Low Jitter Clock Generator\")\nCc: <Stable@vger.kernel.org>\nSigned-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/76eb62bdb1119b400668b0e63cce3edc1678dea6"},{"sha":"38a39e3dd4494902e1ad8aa8e0d71c9268e73de3","author":{"name":"Steven Rostedt (VMware)","email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org"},"message":"tracing: Do not call start/stop() functions when tracing_on does not change\n\ncommit f143641bfef9a4a60c57af30de26c63057e7e695 upstream.\n\nCurrently, when one echo's in 1 into tracing_on, the current tracer's\n\"start()\" function is executed, even if tracing_on was already one. This can\nlead to strange side effects. One being that if the hwlat tracer is enabled,\nand someone does \"echo 1 > tracing_on\" into tracing_on, the hwlat tracer's\nstart() function is called again which will recreate another kernel thread,\nand make it unable to remove the old one.\n\nLink: http://lkml.kernel.org/r/1533120354-22923-1-git-send-email-erica.bugden@linutronix.de\n\nCc: stable@vger.kernel.org\nFixes: 2df8f8a6a897e (\"tracing: Fix regression with irqsoff tracer and tracing_on file\")\nReported-by: Erica Bugden <erica.bugden@linutronix.de>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/38a39e3dd4494902e1ad8aa8e0d71c9268e73de3"},{"sha":"a5a4dfa99f195c1dde1f6c77e43238c35c363092","author":{"name":"Steven Rostedt (VMware)","email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org"},"message":"tracing/blktrace: Fix to allow setting same value\n\ncommit 757d9140072054528b13bbe291583d9823cde195 upstream.\n\nMasami Hiramatsu reported:\n\n  Current trace-enable attribute in sysfs returns an error\n  if user writes the same setting value as current one,\n  e.g.\n\n    # cat /sys/block/sda/trace/enable\n    0\n    # echo 0 > /sys/block/sda/trace/enable\n    bash: echo: write error: Invalid argument\n    # echo 1 > /sys/block/sda/trace/enable\n    # echo 1 > /sys/block/sda/trace/enable\n    bash: echo: write error: Device or resource busy\n\n  But this is not a preferred behavior, it should ignore\n  if new setting is same as current one. This fixes the\n  problem as below.\n\n    # cat /sys/block/sda/trace/enable\n    0\n    # echo 0 > /sys/block/sda/trace/enable\n    # echo 1 > /sys/block/sda/trace/enable\n    # echo 1 > /sys/block/sda/trace/enable\n\nLink: http://lkml.kernel.org/r/20180816103802.08678002@gandalf.local.home\n\nCc: Ingo Molnar <mingo@redhat.com>\nCc: Jens Axboe <axboe@kernel.dk>\nCc: linux-block@vger.kernel.org\nCc: stable@vger.kernel.org\nFixes: cd649b8bb830d (\"blktrace: remove sysfs_blk_trace_enable_show/store()\")\nReported-by: Masami Hiramatsu <mhiramat@kernel.org>\nTested-by: Masami Hiramatsu <mhiramat@kernel.org>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Jens Axboe <axboe@kernel.dk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/a5a4dfa99f195c1dde1f6c77e43238c35c363092"},{"sha":"73b5c3dc570d96e671f3ce5537ebda70237b4181","author":{"name":"Snild Dolkow","email":"35d9cb31f6646600b9569c86dc506985112ac81c@sony.com"},"message":"kthread, tracing: Don't expose half-written comm when creating kthreads\n\ncommit 3e536e222f2930534c252c1cc7ae799c725c5ff9 upstream.\n\nThere is a window for racing when printing directly to task->comm,\nallowing other threads to see a non-terminated string. The vsnprintf\nfunction fills the buffer, counts the truncated chars, then finally\nwrites the \\0 at the end.\n\n\tcreator                     other\n\tvsnprintf:\n\t  fill (not terminated)\n\t  count the rest            trace_sched_waking(p):\n\t  ...                         memcpy(comm, p->comm, TASK_COMM_LEN)\n\t  write \\0\n\nThe consequences depend on how 'other' uses the string. In our case,\nit was copied into the tracing system's saved cmdlines, a buffer of\nadjacent TASK_COMM_LEN-byte buffers (note the 'n' where 0 should be):\n\n\tcrash-arm64> x/1024s savedcmd->saved_cmdlines | grep 'evenk'\n\t0xffffffd5b3818640:     \"irq/497-pwr_evenkworker/u16:12\"\n\n...and a strcpy out of there would cause stack corruption:\n\n\t[224761.522292] Kernel panic - not syncing: stack-protector:\n\t    Kernel stack is corrupted in: ffffff9bf9783c78\n\n\tcrash-arm64> kbt | grep 'comm\\|trace_print_context'\n\t#6  0xffffff9bf9783c78 in trace_print_context+0x18c(+396)\n\t      comm (char [16]) =  \"irq/497-pwr_even\"\n\n\tcrash-arm64> rd 0xffffffd4d0e17d14 8\n\tffffffd4d0e17d14:  2f71726900000000 5f7277702d373934   ....irq/497-pwr_\n\tffffffd4d0e17d24:  726f776b6e657665 3a3631752f72656b   evenkworker/u16:\n\tffffffd4d0e17d34:  f9780248ff003231 cede60e0ffffff9b   12..H.x......`..\n\tffffffd4d0e17d44:  cede60c8ffffffd4 00000fffffffffd4   .....`..........\n\nThe workaround in e09e28671 (use strlcpy in __trace_find_cmdline) was\nlikely needed because of this same bug.\n\nSolved by vsnprintf:ing to a local buffer, then using set_task_comm().\nThis way, there won't be a window where comm is not terminated.\n\nLink: http://lkml.kernel.org/r/20180726071539.188015-1-snild@sony.com\n\nCc: stable@vger.kernel.org\nFixes: bc0c38d139ec7 (\"ftrace: latency tracer infrastructure\")\nReviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Snild Dolkow <snild@sony.com>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\n[backported to 3.18 / 4.4 by Snild]\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/73b5c3dc570d96e671f3ce5537ebda70237b4181"},{"sha":"eb67901b5d617eeca2939699a3aa5e06c3ea4fe2","author":{"name":"Steven Rostedt (VMware)","email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org"},"message":"uprobes: Use synchronize_rcu() not synchronize_sched()\n\ncommit 016f8ffc48cb01d1e7701649c728c5d2e737d295 upstream.\n\nWhile debugging another bug, I was looking at all the synchronize*()\nfunctions being used in kernel/trace, and noticed that trace_uprobes was\nusing synchronize_sched(), with a comment to synchronize with\n{u,ret}_probe_trace_func(). When looking at those functions, the data is\nprotected with \"rcu_read_lock()\" and not with \"rcu_read_lock_sched()\". This\nis using the wrong synchronize_*() function.\n\nLink: http://lkml.kernel.org/r/20180809160553.469e1e32@gandalf.local.home\n\nCc: stable@vger.kernel.org\nFixes: 70ed91c6ec7f8 (\"tracing/uprobes: Support ftrace_event_file base multibuffer\")\nAcked-by: Oleg Nesterov <oleg@redhat.com>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/eb67901b5d617eeca2939699a3aa5e06c3ea4fe2"},{"sha":"02de522ac047a34433b9718173a77bd0cc806485","author":{"name":"Tomas Bortoli","email":"f7ea0a06b71d335820a2500be13a9844562b2d5a@gmail.com"},"message":"9p: fix multiple NULL-pointer-dereferences\n\ncommit 10aa14527f458e9867cf3d2cc6b8cb0f6704448b upstream.\n\nAdded checks to prevent GPFs from raising.\n\nLink: http://lkml.kernel.org/r/20180727110558.5479-1-tomasbortoli@gmail.com\nSigned-off-by: Tomas Bortoli <tomasbortoli@gmail.com>\nReported-by: syzbot+1a262da37d3bead15c39@syzkaller.appspotmail.com\nCc: stable@vger.kernel.org\nSigned-off-by: Dominique Martinet <dominique.martinet@cea.fr>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/02de522ac047a34433b9718173a77bd0cc806485"},{"sha":"86e40c0ccb044d265fdc54c5865b4adaea8d3841","author":{"name":"Dan Carpenter","email":"ff341aa343d564f9e53e9dcb6996be8c04859a66@oracle.com"},"message":"pnfs/blocklayout: off by one in bl_map_stripe()\n\ncommit 0914bb965e38a055e9245637aed117efbe976e91 upstream.\n\n\"dev->nr_children\" is the number of children which were parsed\nsuccessfully in bl_parse_stripe().  It could be all of them and then, in\nthat case, it is equal to v->stripe.volumes_count.  Either way, the >\nshould be >= so that we don't go beyond the end of what we're supposed\nto.\n\nFixes: 5c83746a0cf2 (\"pnfs/blocklayout: in-kernel GETDEVICEINFO XDR parsing\")\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nReviewed-by: Christoph Hellwig <hch@lst.de>\nCc: stable@vger.kernel.org # 3.17+\nSigned-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/86e40c0ccb044d265fdc54c5865b4adaea8d3841"},{"sha":"8c6a5c96a60dcdb209e4b6e8373fb6207a9fb69c","author":{"name":"Jon Hunter","email":"cbbc2a491dd609dc667a5c30620606c73351583d@nvidia.com"},"message":"ARM: tegra: Fix Tegra30 Cardhu PCA954x reset\n\ncommit 6e1811900b6fe6f2b4665dba6bd6ed32c6b98575 upstream.\n\nOn all versions of Tegra30 Cardhu, the reset signal to the NXP PCA9546\nI2C mux is connected to the Tegra GPIO BB0. Currently, this pin on the\nTegra is not configured as a GPIO but as a special-function IO (SFIO)\nthat is multiplexing the pin to an I2S controller. On exiting system\nsuspend, I2C commands sent to the PCA9546 are failing because there is\nno ACK. Although it is not possible to see exactly what is happening\nto the reset during suspend, by ensuring it is configured as a GPIO\nand driven high, to de-assert the reset, the failures are no longer\nseen.\n\nPlease note that this GPIO is also used to drive the reset signal\ngoing to the camera connector on the board. However, given that there\nis no camera support currently for Cardhu, this should not have any\nimpact.\n\nFixes: 40431d16ff11 (\"ARM: tegra: enable PCA9546 on Cardhu\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jon Hunter <jonathanh@nvidia.com>\nSigned-off-by: Thierry Reding <treding@nvidia.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/8c6a5c96a60dcdb209e4b6e8373fb6207a9fb69c"},{"sha":"76b5c9f1a9b0ca8ccfb704eb21cab0e304bb3876","author":{"name":"Peter Zijlstra","email":"3fddac958924aef220f202ca567388ddab3f14a8@infradead.org"},"message":"mm/tlb: Remove tlb_remove_table() non-concurrent condition\n\ncommit a6f572084fbee8b30f91465f4a085d7a90901c57 upstream.\n\nWill noted that only checking mm_users is incorrect; we should also\ncheck mm_count in order to cover CPUs that have a lazy reference to\nthis mm (and could do speculative TLB operations).\n\nIf removing this turns out to be a performance issue, we can\nre-instate a more complete check, but in tlb_table_flush() eliding the\ncall_rcu_sched().\n\nFixes: 267239116987 (\"mm, powerpc: move the RCU page-table freeing into generic code\")\nReported-by: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nAcked-by: Rik van Riel <riel@surriel.com>\nAcked-by: Will Deacon <will.deacon@arm.com>\nCc: Nicholas Piggin <npiggin@gmail.com>\nCc: David Miller <davem@davemloft.net>\nCc: Martin Schwidefsky <schwidefsky@de.ibm.com>\nCc: Michael Ellerman <mpe@ellerman.id.au>\nCc: stable@kernel.org\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/76b5c9f1a9b0ca8ccfb704eb21cab0e304bb3876"},{"sha":"3680c7ecdc05e35d6ed1d7d269ecc8a03dae0748","author":{"name":"Al Viro","email":"de609eb4d5d70b1d38ec6642adbfc33a2781f63c@zeniv.linux.org.uk"},"message":"osf_getdomainname(): use copy_to_user()\n\ncommit 9ba3eb5103cf56f0daaf07de4507df76e7813ed7 upstream.\n\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/3680c7ecdc05e35d6ed1d7d269ecc8a03dae0748"},{"sha":"a1ca395b1796c1e998e4ebf237c2d559b326d36c","author":{"name":"Jann Horn","email":"0fcb39c6619aeb747ed6898bfde644ba26b24452@google.com"},"message":"sys: don't hold uts_sem while accessing userspace memory\n\ncommit 42a0cc3478584d4d63f68f2f5af021ddbea771fa upstream.\n\nHolding uts_sem as a writer while accessing userspace memory allows a\nnamespace admin to stall all processes that attempt to take uts_sem.\nInstead, move data through stack buffers and don't access userspace memory\nwhile uts_sem is held.\n\nCc: stable@vger.kernel.org\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Jann Horn <jannh@google.com>\nSigned-off-by: Eric W. Biederman <ebiederm@xmission.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/a1ca395b1796c1e998e4ebf237c2d559b326d36c"},{"sha":"8a749f3ef97796d702b2da4106459d46c5bb1adb","author":{"name":"Eric W. Biederman","email":"8a741aa8cbd77ebc4a56ddb528ce9fd15d42f034@xmission.com"},"message":"userns; Correct the comment in map_write\n\ncommit 36476beac4f8ca9dc7722790b2e8ef0e8e51034e upstream.\n\nIt is important that all maps are less than PAGE_SIZE\nor else setting the last byte of the buffer to '0'\ncould write off the end of the allocated storage.\n\nCorrect the misleading comment.\n\nSigned-off-by: \"Eric W. Biederman\" <ebiederm@xmission.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/syrkles/android_kernel_moto_msm8953/commits/8a749f3ef97796d702b2da4106459d46c5bb1adb"}]}
{"actor":{"display_login":"syrkles"}}