{"push_id":2489467889,"size":219,"distinct_size":0,"ref":"refs/heads/korg/linux-3.18.y","head":"78db2bbfa06cc39707054093fbbc5e573a643d3e","before":"9764536dc592144beee43c987fef45d2e91ca55c","commits":[{"sha":"02dd9876ab94bc045c115c14177088ae3bdfb152","author":{"name":"Kirill Marinushkin","email":"694511f3e2dc665e69e51d5d5bcf50ad07bbd5a2@gmail.com"},"message":"ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit\n\ncommit a6618f4aedb2b60932d766bd82ae7ce866e842aa upstream.\n\nCurrently, the offsets in the UAC2 processing unit descriptor are\ncalculated incorrectly. It causes an issue when connecting the device which\nprovides such a feature:\n\n~~~~\n[84126.724420] usb 1-1.3.1: invalid Processing Unit descriptor (id 18)\n~~~~\n\nAfter this patch is applied, the UAC2 processing unit inits w/o this error.\n\nFixes: 23caaf19b11e (\"ALSA: usb-mixer: Add support for Audio Class v2.0\")\nSigned-off-by: Kirill Marinushkin <k.marinushkin@gmail.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/02dd9876ab94bc045c115c14177088ae3bdfb152"},{"sha":"e88d13e367f26bd2623ff428fcfbf5d3d15e3ad6","author":{"name":"Takashi Iwai","email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de"},"message":"ALSA: aloop: Sync stale timer before release\n\ncommit 67a01afaf3d34893cf7d2ea19b34555d6abb7cb0 upstream.\n\nThe aloop driver tries to stop the pending timer via timer_del() in\nthe trigger callback and in the close callback.  The former is\ncorrect, as it's an atomic operation, while the latter expects that\nthe timer gets really removed and proceeds the resource releases after\nthat.  But timer_del() doesn't synchronize, hence the running timer\nmay still access the released resources.\n\nA similar situation can be also seen in the prepare callback after\ntrigger(STOP) where the prepare tries to re-initialize the things\nwhile a timer is still running.\n\nThe problems like the above are seen indirectly in some syzkaller\nreports (although it's not 100% clear whether this is the only cause,\nas the race condition is quite narrow and not always easy to\ntrigger).\n\nFor addressing these issues, this patch adds the explicit alls of\ntimer_del_sync() in some places, so that the pending timer is properly\nkilled / synced.\n\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/e88d13e367f26bd2623ff428fcfbf5d3d15e3ad6"},{"sha":"d850931005ff6e5dde77b1375ff8ce0a332cb24d","author":{"name":"Takashi Iwai","email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de"},"message":"ALSA: aloop: Fix access to not-yet-ready substream via cable\n\ncommit 8e6b1a72a75bb5067ccb6b56d8ca4aa3a300a64e upstream.\n\nIn loopback_open() and loopback_close(), we assign and release the\nsubstream object to the corresponding cable in a racy way.  It's\nneither locked nor done in the right position.  The open callback\nassigns the substream before its preparation finishes, hence the other\nside of the cable may pick it up, which may lead to the invalid memory\naccess.\n\nThis patch addresses these: move the assignment to the end of the open\ncallback, and wrap with cable->lock for avoiding concurrent accesses.\n\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/d850931005ff6e5dde77b1375ff8ce0a332cb24d"},{"sha":"72e377fb1b0b42016abe1f923e7a6ccbdc81cc60","author":{"name":"Eric Biggers","email":"6f6115196800bbe9712b3f04c7e40093bb382fc5@google.com"},"message":"libata: fix length validation of ATAPI-relayed SCSI commands\n\ncommit 058f58e235cbe03e923b30ea7c49995a46a8725f upstream.\n\nsyzkaller reported a crash in ata_bmdma_fill_sg() when writing to\n/dev/sg1.  The immediate cause was that the ATA command's scatterlist\nwas not DMA-mapped, which causes 'pi - 1' to underflow, resulting in a\nwrite to 'qc->ap->bmdma_prd[0xffffffff]'.\n\nStrangely though, the flag ATA_QCFLAG_DMAMAP was set in qc->flags.  The\nroot cause is that when __ata_scsi_queuecmd() is preparing to relay a\nSCSI command to an ATAPI device, it doesn't correctly validate the CDB\nlength before copying it into the 16-byte buffer 'cdb' in 'struct\nata_queued_cmd'.  Namely, it validates the fixed CDB length expected\nbased on the SCSI opcode but not the actual CDB length, which can be\nlarger due to the use of the SG_NEXT_CMD_LEN ioctl.  Since 'flags' is\nthe next member in ata_queued_cmd, a buffer overflow corrupts it.\n\nFix it by requiring that the actual CDB length be <= 16 (ATAPI_CDB_LEN).\n\n[Really it seems the length should be required to be <= dev->cdb_len,\nbut the current behavior seems to have been intentionally introduced by\ncommit 607126c2a21c (\"libata-scsi: be tolerant of 12-byte ATAPI commands\nin 16-byte CDBs\") to work around a userspace bug in mplayer.  Probably\nthe workaround is no longer needed (mplayer was fixed in 2007), but\ncontinuing to allow lengths to up 16 appears harmless for now.]\n\nHere's a reproducer that works in QEMU when /dev/sg1 refers to the\nCD-ROM drive that qemu-system-x86_64 creates by default:\n\n    #include <fcntl.h>\n    #include <sys/ioctl.h>\n    #include <unistd.h>\n\n    #define SG_NEXT_CMD_LEN 0x2283\n\n    int main()\n    {\n\t    char buf[53] = { [36] = 0x7e, [52] = 0x02 };\n\t    int fd = open(\"/dev/sg1\", O_RDWR);\n\t    ioctl(fd, SG_NEXT_CMD_LEN, &(int){ 17 });\n\t    write(fd, buf, sizeof(buf));\n    }\n\nThe crash was:\n\n    BUG: unable to handle kernel paging request at ffff8cb97db37ffc\n    IP: ata_bmdma_fill_sg drivers/ata/libata-sff.c:2623 [inline]\n    IP: ata_bmdma_qc_prep+0xa4/0xc0 drivers/ata/libata-sff.c:2727\n    PGD fb6c067 P4D fb6c067 PUD 0\n    Oops: 0002 [#1] SMP\n    CPU: 1 PID: 150 Comm: syz_ata_bmdma_q Not tainted 4.15.0-next-20180202 #99\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014\n    [...]\n    Call Trace:\n     ata_qc_issue+0x100/0x1d0 drivers/ata/libata-core.c:5421\n     ata_scsi_translate+0xc9/0x1a0 drivers/ata/libata-scsi.c:2024\n     __ata_scsi_queuecmd drivers/ata/libata-scsi.c:4326 [inline]\n     ata_scsi_queuecmd+0x8c/0x210 drivers/ata/libata-scsi.c:4375\n     scsi_dispatch_cmd+0xa2/0xe0 drivers/scsi/scsi_lib.c:1727\n     scsi_request_fn+0x24c/0x530 drivers/scsi/scsi_lib.c:1865\n     __blk_run_queue_uncond block/blk-core.c:412 [inline]\n     __blk_run_queue+0x3a/0x60 block/blk-core.c:432\n     blk_execute_rq_nowait+0x93/0xc0 block/blk-exec.c:78\n     sg_common_write.isra.7+0x272/0x5a0 drivers/scsi/sg.c:806\n     sg_write+0x1ef/0x340 drivers/scsi/sg.c:677\n     __vfs_write+0x31/0x160 fs/read_write.c:480\n     vfs_write+0xa7/0x160 fs/read_write.c:544\n     SYSC_write fs/read_write.c:589 [inline]\n     SyS_write+0x4d/0xc0 fs/read_write.c:581\n     do_syscall_64+0x5e/0x110 arch/x86/entry/common.c:287\n     entry_SYSCALL_64_after_hwframe+0x21/0x86\n\nFixes: 607126c2a21c (\"libata-scsi: be tolerant of 12-byte ATAPI commands in 16-byte CDBs\")\nReported-by: syzbot+1ff6f9fcc3c35f1c72a95e26528c8e7e3276e4da@syzkaller.appspotmail.com\nCc: <stable@vger.kernel.org> # v2.6.24+\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/72e377fb1b0b42016abe1f923e7a6ccbdc81cc60"},{"sha":"83c164363b8a891cc8d3a3abdfce79ba3956059e","author":{"name":"Eric Biggers","email":"6f6115196800bbe9712b3f04c7e40093bb382fc5@google.com"},"message":"libata: remove WARN() for DMA or PIO command without data\n\ncommit 9173e5e80729c8434b8d27531527c5245f4a5594 upstream.\n\nsyzkaller hit a WARN() in ata_qc_issue() when writing to /dev/sg0.  This\nhappened because it issued a READ_6 command with no data buffer.\n\nJust remove the WARN(), as it doesn't appear indicate a kernel bug.  The\nexpected behavior is to fail the command, which the code does.\n\nHere's a reproducer that works in QEMU when /dev/sg0 refers to a disk of\nthe default type (\"82371SB PIIX3 IDE\"):\n\n    #include <fcntl.h>\n    #include <unistd.h>\n\n    int main()\n    {\n            char buf[42] = { [36] = 0x8 /* READ_6 */ };\n\n            write(open(\"/dev/sg0\", O_RDWR), buf, sizeof(buf));\n    }\n\nFixes: f92a26365a72 (\"libata: change ATA_QCFLAG_DMAMAP semantics\")\nReported-by: syzbot+f7b556d1766502a69d85071d2ff08bd87be53d0f@syzkaller.appspotmail.com\nCc: <stable@vger.kernel.org> # v2.6.25+\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/83c164363b8a891cc8d3a3abdfce79ba3956059e"},{"sha":"ec5a70a81cd28bf3428611f16e004633291c4dce","author":{"name":"Hans de Goede","email":"9fa1be1a5b5729e4c6b404f34c9ce49ff4882fd8@redhat.com"},"message":"libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs\n\ncommit 9c7be59fc519af9081c46c48f06f2b8fadf55ad8 upstream.\n\nVarious people have reported the Crucial MX100 512GB model not working\nwith LPM set to min_power. I've now received a report that it also does\nnot work with the new med_power_with_dipm level.\n\nIt does work with medium_power, but that has no measurable power-savings\nand given the amount of people being bitten by the other levels not\nworking, this commit just disables LPM altogether.\n\nNote all reporters of this have either the 512GB model (max capacity), or\nare not specifying their SSD's size. So for now this quirk assumes this is\na problem with the 512GB model only.\n\nBuglink: https://bugzilla.kernel.org/show_bug.cgi?id=89261\nBuglink: https://github.com/linrunner/TLP/issues/84\nCc: stable@vger.kernel.org\nSigned-off-by: Hans de Goede <hdegoede@redhat.com>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/ec5a70a81cd28bf3428611f16e004633291c4dce"},{"sha":"3fcf9215889144f5b89164b62ad286ec4d353704","author":{"name":"Kai-Heng Feng","email":"06af28c154da900e58fef391e9e9415561e1d8ae@canonical.com"},"message":"libata: disable LPM for Crucial BX100 SSD 500GB drive\n\ncommit b17e5729a630d8326a48ec34ef02e6b4464a6aef upstream.\n\nAfter Laptop Mode Tools starts to use min_power for LPM, a user found\nout Crucial BX100 SSD can't get mounted.\n\nCrucial BX100 SSD 500GB drive don't work well with min_power. This also\nhappens to med_power_with_dipm.\n\nSo let's disable LPM for Crucial BX100 SSD 500GB drive.\n\nBugLink: https://bugs.launchpad.net/bugs/1726930\nSigned-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/3fcf9215889144f5b89164b62ad286ec4d353704"},{"sha":"d829e3ad277a9fa8f1aede7d1619b3a0b00ef81f","author":{"name":"Ju Hyung Park","email":"7662eda885d44e77a928581610e3a6d22accb87e@gmail.com"},"message":"libata: Enable queued TRIM for Samsung SSD 860\n\ncommit ca6bfcb2f6d9deab3924bf901e73622a94900473 upstream.\n\nSamsung explicitly states that queued TRIM is supported for Linux with\n860 PRO and 860 EVO.\n\nMake the previous blacklist to cover only 840 and 850 series.\n\nSigned-off-by: Park Ju Hyung <qkrwngud825@gmail.com>\nReviewed-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/d829e3ad277a9fa8f1aede7d1619b3a0b00ef81f"},{"sha":"34b98861806eba4d20694a72ceee084794c7146b","author":{"name":"Hans de Goede","email":"9fa1be1a5b5729e4c6b404f34c9ce49ff4882fd8@redhat.com"},"message":"libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs\n\ncommit 62ac3f7305470e3f52f159de448bc1a771717e88 upstream.\n\nThere have been reports of the Crucial M500 480GB model not working\nwith LPM set to min_power / med_power_with_dipm level.\n\nIt has not been tested with medium_power, but that typically has no\nmeasurable power-savings.\n\nNote the reporters Crucial_CT480M500SSD3 has a firmware version of MU03\nand there is a MU05 update available, but that update does not mention any\nLPM fixes in its changelog, so the quirk matches all firmware versions.\n\nIn my experience the LPM problems with (older) Crucial SSDs seem to be\nlimited to higher capacity versions of the SSDs (different firmware?),\nso this commit adds a NOLPM quirk for the 480 and 960GB versions of the\nM500, to avoid LPM causing issues with these SSDs.\n\nCc: stable@vger.kernel.org\nReported-and-tested-by: Martin Steigerwald <martin@lichtvoll.de>\nSigned-off-by: Hans de Goede <hdegoede@redhat.com>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/34b98861806eba4d20694a72ceee084794c7146b"},{"sha":"c77c783b532daf469b45a7cf1d0684d9031db3e1","author":{"name":"Hans de Goede","email":"9fa1be1a5b5729e4c6b404f34c9ce49ff4882fd8@redhat.com"},"message":"libata: Make Crucial BX100 500GB LPM quirk apply to all firmware versions\n\ncommit 3bf7b5d6d017c27e0d3b160aafb35a8e7cfeda1f upstream.\n\nCommit b17e5729a630 (\"libata: disable LPM for Crucial BX100 SSD 500GB\ndrive\"), introduced a ATA_HORKAGE_NOLPM quirk for Crucial BX100 500GB SSDs\nbut limited this to the MU02 firmware version, according to:\nhttp://www.crucial.com/usa/en/support-ssd-firmware\n\nMU02 is the last version, so there are no newer possibly fixed versions\nand if the MU02 version has broken LPM then the MU01 almost certainly\nalso has broken LPM, so this commit changes the quirk to apply to all\nfirmware versions.\n\nFixes: b17e5729a630 (\"libata: disable LPM for Crucial BX100 SSD 500GB...\")\nCc: stable@vger.kernel.org\nCc: Kai-Heng Feng <kai.heng.feng@canonical.com>\nSigned-off-by: Hans de Goede <hdegoede@redhat.com>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/c77c783b532daf469b45a7cf1d0684d9031db3e1"},{"sha":"897e06d03877c2f330111be98b59a6c8b3b693dc","author":{"name":"Hans de Goede","email":"9fa1be1a5b5729e4c6b404f34c9ce49ff4882fd8@redhat.com"},"message":"libata: Modify quirks for MX100 to limit NCQ_TRIM quirk to MU01 version\n\ncommit d418ff56b8f2d2b296daafa8da151fe27689b757 upstream.\n\nWhen commit 9c7be59fc519af (\"libata: Apply NOLPM quirk to Crucial MX100\n512GB SSDs\") was added it inherited the ATA_HORKAGE_NO_NCQ_TRIM quirk\nfrom the existing \"Crucial_CT*MX100*\" entry, but that entry sets model_rev\nto \"MU01\", where as the entry adding the NOLPM quirk sets it to NULL.\n\nThis means that after this commit we no apply the NO_NCQ_TRIM quirk to\nall \"Crucial_CT512MX100*\" SSDs even if they have the fixed \"MU02\"\nfirmware. This commit splits the \"Crucial_CT512MX100*\" quirk into 2\nquirks, one for the \"MU01\" firmware and one for all other firmware\nversions, so that we once again only apply the NO_NCQ_TRIM quirk to the\n\"MU01\" firmware version.\n\nFixes: 9c7be59fc519af (\"libata: Apply NOLPM quirk to ... MX100 512GB SSDs\")\nCc: stable@vger.kernel.org\nSigned-off-by: Hans de Goede <hdegoede@redhat.com>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/897e06d03877c2f330111be98b59a6c8b3b693dc"},{"sha":"6949153ccb2fde17fb76e1ebcfdb8f5727dc58d1","author":{"name":"Greg Kroah-Hartman","email":"4645f7897fd33786a2ee1264d590b3c400559d85@linuxfoundation.org"},"message":"drm: udl: Properly check framebuffer mmap offsets\n\ncommit 3b82a4db8eaccce735dffd50b4d4e1578099b8e8 upstream.\n\nThe memmap options sent to the udl framebuffer driver were not being\nchecked for all sets of possible crazy values.  Fix this up by properly\nbounding the allowed values.\n\nReported-by: Eyal Itkin <eyalit@checkpoint.com>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>\nLink: https://patchwork.freedesktop.org/patch/msgid/20180321154553.GA18454@kroah.com\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/6949153ccb2fde17fb76e1ebcfdb8f5727dc58d1"},{"sha":"33a155b5e0f89cdc7105fbaa4667ffbf22bb37fe","author":{"name":"Arend Van Spriel","email":"a0aa8d56e4733e1f148eaed044b3a5ceb8fafe4b@broadcom.com"},"message":"brcmfmac: fix P2P_DEVICE ethernet address generation\n\ncommit 455f3e76cfc0d893585a5f358b9ddbe9c1e1e53b upstream.\n\nThe firmware has a requirement that the P2P_DEVICE address should\nbe different from the address of the primary interface. When not\nspecified by user-space, the driver generates the MAC address for\nthe P2P_DEVICE interface using the MAC address of the primary\ninterface and setting the locally administered bit. However, the MAC\naddress of the primary interface may already have that bit set causing\nthe creation of the P2P_DEVICE interface to fail with -EBUSY. Fix this\nby using a random address instead to determine the P2P_DEVICE address.\n\nCc: stable@vger.kernel.org # 3.10.y\nReported-by: Hans de Goede <hdegoede@redhat.com>\nReviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>\nReviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>\nReviewed-by: Franky Lin <franky.lin@broadcom.com>\nSigned-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/33a155b5e0f89cdc7105fbaa4667ffbf22bb37fe"},{"sha":"23c8c15439f66ed7453e6490acf7c8b86ca21557","author":{"name":"Masami Hiramatsu","email":"308c3db2ad395e67f502db11a9ceb1603d4442e0@kernel.org"},"message":"tracing: probeevent: Fix to support minus offset from symbol\n\ncommit c5d343b6b7badd1f5fe0873eff2e8d63a193e732 upstream.\n\nIn Documentation/trace/kprobetrace.txt, it says\n\n @SYM[+|-offs] : Fetch memory at SYM +|- offs (SYM should be a data symbol)\n\nHowever, the parser doesn't parse minus offset correctly, since\ncommit 2fba0c8867af (\"tracing/kprobes: Fix probe offset to be\nunsigned\") drops minus (\"-\") offset support for kprobe probe\naddress usage.\n\nThis fixes the traceprobe_split_symbol_offset() to parse minus\noffset again with checking the offset range, and add a minus\noffset check in kprobe probe address usage.\n\nLink: http://lkml.kernel.org/r/152129028983.31874.13419301530285775521.stgit@devbox\n\nCc: Ingo Molnar <mingo@redhat.com>\nCc: Tom Zanussi <tom.zanussi@linux.intel.com>\nCc: Arnaldo Carvalho de Melo <acme@kernel.org>\nCc: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>\nCc: stable@vger.kernel.org\nFixes: 2fba0c8867af (\"tracing/kprobes: Fix probe offset to be unsigned\")\nAcked-by: Namhyung Kim <namhyung@kernel.org>\nSigned-off-by: Masami Hiramatsu <mhiramat@kernel.org>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/23c8c15439f66ed7453e6490acf7c8b86ca21557"},{"sha":"43f8ff29c37bf96b918a8fa1a9a2c13d28603044","author":{"name":"Dan Carpenter","email":"ff341aa343d564f9e53e9dcb6996be8c04859a66@oracle.com"},"message":"staging: ncpfs: memory corruption in ncp_read_kernel()\n\ncommit 4c41aa24baa4ed338241d05494f2c595c885af8f upstream.\n\nIf the server is malicious then *bytes_read could be larger than the\nsize of the \"target\" buffer.  It would lead to memory corruption when we\ndo the memcpy().\n\nReported-by: Dr Silvio Cesare of InfoSect <Silvio Cesare <silvio.cesare@gmail.com>\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/43f8ff29c37bf96b918a8fa1a9a2c13d28603044"},{"sha":"bcddd27ebfd3cb68ed306e67ed2f33d6d6175d9a","author":{"name":"Andri Yngvason","email":"6f4362479d9b334e0971d655cf8d1bfccf301e95@marel.com"},"message":"can: cc770: Fix stalls on rt-linux, remove redundant IRQ ack\n\ncommit f4353daf4905c0099fd25fa742e2ffd4a4bab26a upstream.\n\nThis has been reported to cause stalls on rt-linux.\n\nSuggested-by: Richard Weinberger <richard@nod.at>\nTested-by: Richard Weinberger <richard@nod.at>\nSigned-off-by: Andri Yngvason <andri.yngvason@marel.com>\nCc: linux-stable <stable@vger.kernel.org>\nSigned-off-by: Marc Kleine-Budde <mkl@pengutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/bcddd27ebfd3cb68ed306e67ed2f33d6d6175d9a"},{"sha":"be889c45a879e08f1624c7fd81facf9fcb172c72","author":{"name":"Andri Yngvason","email":"6f4362479d9b334e0971d655cf8d1bfccf301e95@marel.com"},"message":"can: cc770: Fix queue stall & dropped RTR reply\n\ncommit 746201235b3f876792099079f4c6fea941d76183 upstream.\n\nWhile waiting for the TX object to send an RTR, an external message with a\nmatching id can overwrite the TX data. In this case we must call the rx\nroutine and then try transmitting the message that was overwritten again.\n\nThe queue was being stalled because the RX event did not generate an\ninterrupt to wake up the queue again and the TX event did not happen\nbecause the TXRQST flag is reset by the chip when new data is received.\n\nAccording to the CC770 datasheet the id of a message object should not be\nchanged while the MSGVAL bit is set. This has been fixed by resetting the\nMSGVAL bit before modifying the object in the transmit function and setting\nit after. It is not enough to set & reset CPUUPD.\n\nIt is important to keep the MSGVAL bit reset while the message object is\nbeing modified. Otherwise, during RTR transmission, a frame with matching\nid could trigger an rx-interrupt, which would cause a race condition\nbetween the interrupt routine and the transmit function.\n\nSigned-off-by: Andri Yngvason <andri.yngvason@marel.com>\nTested-by: Richard Weinberger <richard@nod.at>\nCc: linux-stable <stable@vger.kernel.org>\nSigned-off-by: Marc Kleine-Budde <mkl@pengutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/be889c45a879e08f1624c7fd81facf9fcb172c72"},{"sha":"49636e34157a189e9c7f0673fe641152be6b3aa8","author":{"name":"Andri Yngvason","email":"6f4362479d9b334e0971d655cf8d1bfccf301e95@marel.com"},"message":"can: cc770: Fix use after free in cc770_tx_interrupt()\n\ncommit 9ffd7503944ec7c0ef41c3245d1306c221aef2be upstream.\n\nThis fixes use after free introduced by the last cc770 patch.\n\nSigned-off-by: Andri Yngvason <andri.yngvason@marel.com>\nFixes: 746201235b3f (\"can: cc770: Fix queue stall & dropped RTR reply\")\nCc: linux-stable <stable@vger.kernel.org>\nSigned-off-by: Marc Kleine-Budde <mkl@pengutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/49636e34157a189e9c7f0673fe641152be6b3aa8"},{"sha":"b1da147c2749874c348f6afdf67ce404a47cfe7c","author":{"name":"Linus Torvalds","email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org"},"message":"tty: vt: fix up tabstops properly\n\ncommit f1869a890cdedb92a3fab969db5d0fd982850273 upstream.\n\nTabs on a console with long lines do not wrap properly, so correctly\naccount for the line length when computing the tab placement location.\n\nReported-by: James Holderness <j4_james@hotmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/b1da147c2749874c348f6afdf67ce404a47cfe7c"},{"sha":"e7dc809e8042cf3d2c48ffa616941a8b11d3beba","author":{"name":"Linus Torvalds","email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org"},"message":"kvm/x86: fix icebp instruction handling\n\ncommit 32d43cd391bacb5f0814c2624399a5dad3501d09 upstream.\n\nThe undocumented 'icebp' instruction (aka 'int1') works pretty much like\n'int3' in the absense of in-circuit probing equipment (except,\nobviously, that it raises #DB instead of raising #BP), and is used by\nsome validation test-suites as such.\n\nBut Andy Lutomirski noticed that his test suite acted differently in kvm\nthan on bare hardware.\n\nThe reason is that kvm used an inexact test for the icebp instruction:\nit just assumed that an all-zero VM exit qualification value meant that\nthe VM exit was due to icebp.\n\nThat is not unlike the guess that do_debug() does for the actual\nexception handling case, but it's purely a heuristic, not an absolute\nrule.  do_debug() does it because it wants to ascribe _some_ reasons to\nthe #DB that happened, and an empty %dr6 value means that 'icebp' is the\nmost likely casue and we have no better information.\n\nBut kvm can just do it right, because unlike the do_debug() case, kvm\nactually sees the real reason for the #DB in the VM-exit interruption\ninformation field.\n\nSo instead of relying on an inexact heuristic, just use the actual VM\nexit information that says \"it was 'icebp'\".\n\nRight now the 'icebp' instruction isn't technically documented by Intel,\nbut that will hopefully change.  The special \"privileged software\nexception\" information _is_ actually mentioned in the Intel SDM, even\nthough the cause of it isn't enumerated.\n\nReported-by: Andy Lutomirski <luto@kernel.org>\nTested-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/e7dc809e8042cf3d2c48ffa616941a8b11d3beba"}]}
{"actor":{"display_login":"Jackeagle"}}