{"push_id":2712580314,"size":49,"distinct_size":0,"ref":"refs/heads/aosp/android-4.4-n","head":"ad816001b8605e6372128734810c700d965cb6ab","before":"3f44bf60ea4c421f00093a13fa1f5ba5de5470e0","commits":[{"sha":"6f8b3fd2a4726648c9a57f49df8358573414774d","author":{"name":"Houston Yaroschoff","email":"063b3e861b40af0a1085d8366a5204e0536c4f5b@4ever3.net"},"message":"usb: cdc_acm: Add quirk for Uniden UBC125 scanner\n\ncommit 4a762569a2722b8a48066c7bacf0e1dc67d17fa1 upstream.\n\nUniden UBC125 radio scanner has USB interface which fails to work\nwith cdc_acm driver:\n  usb 1-1.5: new full-speed USB device number 4 using xhci_hcd\n  cdc_acm 1-1.5:1.0: Zero length descriptor references\n  cdc_acm: probe of 1-1.5:1.0 failed with error -22\n\nAdding the NO_UNION_NORMAL quirk for the device fixes the issue:\n  usb 1-4: new full-speed USB device number 15 using xhci_hcd\n  usb 1-4: New USB device found, idVendor=1965, idProduct=0018\n  usb 1-4: New USB device strings: Mfr=1, Product=2, SerialNumber=3\n  usb 1-4: Product: UBC125XLT\n  usb 1-4: Manufacturer: Uniden Corp.\n  usb 1-4: SerialNumber: 0001\n  cdc_acm 1-4:1.0: ttyACM0: USB ACM device\n\n`lsusb -v` of the device:\n\n  Bus 001 Device 015: ID 1965:0018 Uniden Corporation\n  Device Descriptor:\n    bLength                18\n    bDescriptorType         1\n    bcdUSB               2.00\n    bDeviceClass            2 Communications\n    bDeviceSubClass         0\n    bDeviceProtocol         0\n    bMaxPacketSize0        64\n    idVendor           0x1965 Uniden Corporation\n    idProduct          0x0018\n    bcdDevice            0.01\n    iManufacturer           1 Uniden Corp.\n    iProduct                2 UBC125XLT\n    iSerial                 3 0001\n    bNumConfigurations      1\n    Configuration Descriptor:\n      bLength                 9\n      bDescriptorType         2\n      wTotalLength           48\n      bNumInterfaces          2\n      bConfigurationValue     1\n      iConfiguration          0\n      bmAttributes         0x80\n        (Bus Powered)\n      MaxPower              500mA\n      Interface Descriptor:\n        bLength                 9\n        bDescriptorType         4\n        bInterfaceNumber        0\n        bAlternateSetting       0\n        bNumEndpoints           1\n        bInterfaceClass         2 Communications\n        bInterfaceSubClass      2 Abstract (modem)\n        bInterfaceProtocol      0 None\n        iInterface              0\n        Endpoint Descriptor:\n          bLength                 7\n          bDescriptorType         5\n          bEndpointAddress     0x87  EP 7 IN\n          bmAttributes            3\n            Transfer Type            Interrupt\n            Synch Type               None\n            Usage Type               Data\n          wMaxPacketSize     0x0008  1x 8 bytes\n          bInterval              10\n      Interface Descriptor:\n        bLength                 9\n        bDescriptorType         4\n        bInterfaceNumber        1\n        bAlternateSetting       0\n        bNumEndpoints           2\n        bInterfaceClass        10 CDC Data\n        bInterfaceSubClass      0 Unused\n        bInterfaceProtocol      0\n        iInterface              0\n        Endpoint Descriptor:\n          bLength                 7\n          bDescriptorType         5\n          bEndpointAddress     0x81  EP 1 IN\n          bmAttributes            2\n            Transfer Type            Bulk\n            Synch Type               None\n            Usage Type               Data\n          wMaxPacketSize     0x0040  1x 64 bytes\n          bInterval               0\n        Endpoint Descriptor:\n          bLength                 7\n          bDescriptorType         5\n          bEndpointAddress     0x02  EP 2 OUT\n          bmAttributes            2\n            Transfer Type            Bulk\n            Synch Type               None\n            Usage Type               Data\n          wMaxPacketSize     0x0040  1x 64 bytes\n          bInterval               0\n  Device Status:     0x0000\n    (Bus Powered)\n\nSigned-off-by: Houston Yaroschoff <hstn@4ever3.net>\nCc: stable <stable@vger.kernel.org>\nAcked-by: Oliver Neukum <oneukum@suse.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/6f8b3fd2a4726648c9a57f49df8358573414774d"},{"sha":"3357fbc733cd84523c09c35c1924daad7e389dbf","author":{"name":"Johan Hovold","email":"759412786bc533369b22377bf83fb9056c5b25b2@kernel.org"},"message":"USB: serial: cp210x: add CESINEL device ids\n\ncommit 24160628a34af962ac99f2f58e547ac3c4cbd26f upstream.\n\nAdd device ids for CESINEL products.\n\nReported-by: Carlos Barcala Lara <cabl@cesinel.com>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/3357fbc733cd84523c09c35c1924daad7e389dbf"},{"sha":"216c5fab831e394d4a15e31c20fb5fa46ba24cd8","author":{"name":"Karoly Pados","email":"2937b74e78d9346e291674136bafe837515a2916@pados.hu"},"message":"USB: serial: cp210x: add Silicon Labs IDs for Windows Update\n\ncommit 2f839823382748664b643daa73f41ee0cc01ced6 upstream.\n\nSilicon Labs defines alternative VID/PID pairs for some chips that when\nused will automatically install drivers for Windows users without manual\nintervention. Unfortunately, these IDs are not recognized by the Linux\nmodule, so using these IDs improves user experience on one platform but\ndegrades it on Linux. This patch addresses this problem.\n\nSigned-off-by: Karoly Pados <pados@pados.hu>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/216c5fab831e394d4a15e31c20fb5fa46ba24cd8"},{"sha":"a1f75c3f3a79147441649ea96d3a0b58e13ded31","author":{"name":"Tetsuo Handa","email":"3d00b54ad717112934d0b63b7ac2975b44022a61@I-love.SAKURA.ne.jp"},"message":"n_tty: Fix stall at n_tty_receive_char_special().\n\ncommit 3d63b7e4ae0dc5e02d28ddd2fa1f945defc68d81 upstream.\n\nsyzbot is reporting stalls at n_tty_receive_char_special() [1]. This is\nbecause comparison is not working as expected since ldata->read_head can\nchange at any moment. Mitigate this by explicitly masking with buffer size\nwhen checking condition for \"while\" loops.\n\n[1] https://syzkaller.appspot.com/bug?id=3d7481a346958d9469bebbeb0537d5f056bdd6e8\n\nSigned-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>\nReported-by: syzbot <syzbot+18df353d7540aa6b5467@syzkaller.appspotmail.com>\nFixes: bc5a5e3f45d04784 (\"n_tty: Don't wrap input buffer indices at buffer size\")\nCc: stable <stable@vger.kernel.org>\nCc: Peter Hurley <peter@hurleysoftware.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/a1f75c3f3a79147441649ea96d3a0b58e13ded31"},{"sha":"58fcaeb30e27df934c3cd5f13733292d2b455fa0","author":{"name":"Laura Abbott","email":"b8f3952ea9a7ddc193d05c7cc03f120086c69f1e@redhat.com"},"message":"staging: android: ion: Return an ERR_PTR in ion_map_kernel\n\ncommit 0a2bc00341dcfcc793c0dbf4f8d43adf60458b05 upstream.\n\nThe expected return value from ion_map_kernel is an ERR_PTR. The error\npath for a vmalloc failure currently just returns NULL, triggering\na warning in ion_buffer_kmap_get. Encode the vmalloc failure as an ERR_PTR.\n\nReported-by: syzbot+55b1d9f811650de944c6@syzkaller.appspotmail.com\nSigned-off-by: Laura Abbott <labbott@redhat.com>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/58fcaeb30e27df934c3cd5f13733292d2b455fa0"},{"sha":"80fbfb1ce6fdfdb265d4ab3b0b87a7c3cf8f6aff","author":{"name":"Tetsuo Handa","email":"3d00b54ad717112934d0b63b7ac2975b44022a61@I-love.SAKURA.ne.jp"},"message":"n_tty: Access echo_* variables carefully.\n\ncommit ebec3f8f5271139df618ebdf8427e24ba102ba94 upstream.\n\nsyzbot is reporting stalls at __process_echoes() [1]. This is because\nsince ldata->echo_commit < ldata->echo_tail becomes true for some reason,\nthe discard loop is serving as almost infinite loop. This patch tries to\navoid falling into ldata->echo_commit < ldata->echo_tail situation by\nmaking access to echo_* variables more carefully.\n\nSince reset_buffer_flags() is called without output_lock held, it should\nnot touch echo_* variables. And omit a call to reset_buffer_flags() from\nn_tty_open() by using vzalloc().\n\nSince add_echo_byte() is called without output_lock held, it needs memory\nbarrier between storing into echo_buf[] and incrementing echo_head counter.\necho_buf() needs corresponding memory barrier before reading echo_buf[].\nLack of handling the possibility of not-yet-stored multi-byte operation\nmight be the reason of falling into ldata->echo_commit < ldata->echo_tail\nsituation, for if I do WARN_ON(ldata->echo_commit == tail + 1) prior to\necho_buf(ldata, tail + 1), the WARN_ON() fires.\n\nAlso, explicitly masking with buffer for the former \"while\" loop, and\nuse ldata->echo_commit > tail for the latter \"while\" loop.\n\n[1] https://syzkaller.appspot.com/bug?id=17f23b094cd80df750e5b0f8982c521ee6bcbf40\n\nSigned-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>\nReported-by: syzbot <syzbot+108696293d7a21ab688f@syzkaller.appspotmail.com>\nCc: Peter Hurley <peter@hurleysoftware.com>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/80fbfb1ce6fdfdb265d4ab3b0b87a7c3cf8f6aff"},{"sha":"99580265784e108e0f294564db80f689039b2e07","author":{"name":"Dave Hansen","email":"71bcd3d88361b22cd828f9a350d19d8775f56d4e@linux.intel.com"},"message":"x86/boot: Fix early command-line parsing when matching at end\n\ncommit 02afeaae9843733a39cd9b11053748b2d1dc5ae7 upstream.\n\nThe x86 early command line parsing in cmdline_find_option_bool() is\nbuggy. If it matches a specified 'option' all the way to the end of the\ncommand-line, it will consider it a match.\n\nFor instance,\n\n  cmdline = \"foo\";\n  cmdline_find_option_bool(cmdline, \"fool\");\n\nwill return 1. This is particularly annoying since we have actual FPU\noptions like \"noxsave\" and \"noxsaves\" So, command-line \"foo bar noxsave\"\nwill match *BOTH* a \"noxsave\" and \"noxsaves\". (This turns out not to be\nan actual problem because \"noxsave\" implies \"noxsaves\", but it's still\nconfusing.)\n\nTo fix this, we simplify the code and stop tracking 'len'. 'len'\nwas trying to indicate either the NULL terminator *OR* the end of a\nnon-NULL-terminated command line at 'COMMAND_LINE_SIZE'. But, each of the\nthree states is *already* checking 'cmdline' for a NULL terminator.\n\nWe _only_ need to check if we have overrun 'COMMAND_LINE_SIZE', and that\nwe can do without keeping 'len' around.\n\nAlso add some commends to clarify what is going on.\n\nSigned-off-by: Dave Hansen <dave.hansen@linux.intel.com>\nSigned-off-by: Borislav Petkov <bp@suse.de>\nCc: Andy Lutomirski <luto@amacapital.net>\nCc: Borislav Petkov <bp@alien8.de>\nCc: Brian Gerst <brgerst@gmail.com>\nCc: Denys Vlasenko <dvlasenk@redhat.com>\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: fenghua.yu@intel.com\nCc: yu-cheng.yu@intel.com\nLink: http://lkml.kernel.org/r/20151222225238.9AEB560C@viggo.jf.intel.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nCc: Ben Hutchings <ben.hutchings@codethink.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/99580265784e108e0f294564db80f689039b2e07"},{"sha":"8d33a08bd4c623fbf0e1be97725c59c8fa868ddb","author":{"name":"Vasanthakumar Thiagarajan","email":"fad83ef5273ec3c13c39984b66e16f59e1c4a510@qti.qualcomm.com"},"message":"ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode\n\ncommit 2f38c3c01de945234d23dd163e3528ccb413066d upstream.\n\nChipset from QCA99X0 onwards (QCA99X0, QCA9984, QCA4019 & future)\nrx_hdr_status is not padded to align in 4-byte boundary. Define a\nnew hw_params field to handle different alignment behaviour between\ndifferent hw. This patch fixes improper retrieval of rfc1042 header\nwith QCA4019. This patch along with \"ath10k: Properly remove padding\nfrom the start of rx payload\" will fix traffic failure in ethernet\ndecap mode for QCA4019.\n\nSigned-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>\nSigned-off-by: Kalle Valo <kvalo@qca.qualcomm.com>\n[bwh: This just adds the part that was left out of the previous backport,\n commit b88fb9ea475a.]\nSigned-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/8d33a08bd4c623fbf0e1be97725c59c8fa868ddb"},{"sha":"2aa465dbe267a09311560fcf4592db7689270f90","author":{"name":"Wolfram Sang","email":"66ab244bc42248f12645ba300439b5263f6a6fca@sang-engineering.com"},"message":"i2c: rcar: fix resume by always initializing registers before transfer\n\ncommit ae481cc139658e89eb3ea671dd00b67bd87f01a3 upstream.\n\nResume failed because of uninitialized registers. Instead of adding a\nresume callback, we simply initialize registers before every transfer.\nThis lightweight change is more robust and will keep us safe if we ever\nneed support for power domains or dynamic frequency changes.\n\nSigned-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>\nAcked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>\nSigned-off-by: Wolfram Sang <wsa@the-dreams.de>\nCc: Ben Hutchings <ben.hutchings@codethink.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/2aa465dbe267a09311560fcf4592db7689270f90"},{"sha":"21e9341ed96024aaead1a12c77e9869ad81f8b96","author":{"name":"Ben Hutchings","email":"a9aff6bdb06df0f1e86a184e2c263c6782eaee6c@codethink.co.uk"},"message":"ipv4: Fix error return value in fib_convert_metrics()\n\nThe validation code modified by commit 5b5e7a0de2bb (\"net: metrics:\nadd proper netlink validation\") is organised differently in older\nkernel versions.  The fib_convert_metrics() function that is modified\nin the backports to 4.4 and 4.9 needs to returns an error code, not a\nsuccess flag.\n\nSigned-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/21e9341ed96024aaead1a12c77e9869ad81f8b96"},{"sha":"5ac07564b47fdffbc293f9b129eb5af394b3d31f","author":{"name":"Masami Hiramatsu","email":"308c3db2ad395e67f502db11a9ceb1603d4442e0@kernel.org"},"message":"kprobes/x86: Do not modify singlestep buffer while resuming\n\ncommit 804dec5bda9b4fcdab5f67fe61db4a0498af5221 upstream.\n\nDo not modify singlestep execution buffer (kprobe.ainsn.insn)\nwhile resuming from single-stepping, instead, modifies\nthe buffer to add a jump back instruction at preparing\nbuffer.\n\nSigned-off-by: Masami Hiramatsu <mhiramat@kernel.org>\nCc: Ananth N Mavinakayanahalli <ananth@linux.vnet.ibm.com>\nCc: Andrey Ryabinin <aryabinin@virtuozzo.com>\nCc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>\nCc: Borislav Petkov <bp@alien8.de>\nCc: Brian Gerst <brgerst@gmail.com>\nCc: David S . Miller <davem@davemloft.net>\nCc: Denys Vlasenko <dvlasenk@redhat.com>\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: Josh Poimboeuf <jpoimboe@redhat.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Ye Xiaolong <xiaolong.ye@intel.com>\nLink: http://lkml.kernel.org/r/149076361560.22469.1610155860343077495.stgit@devbox\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nReviewed-by: \"Steven Rostedt (VMware)\" <rostedt@goodmis.org>\nSigned-off-by: Alexey Makhalov <amakhalov@vmware.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/5ac07564b47fdffbc293f9b129eb5af394b3d31f"},{"sha":"1e40d09a5575f6a2db841473baf329dc17bbe3ff","author":{"name":"Keith Busch","email":"695e2a2c1e39535baaa147c5eb4e5da14054d59f@intel.com"},"message":"nvme-pci: initialize queue memory before interrupts\n\ncommit 161b8be2bd6abad250d4b3f674bdd5480f15beeb upstream.\n\nA spurious interrupt before the nvme driver has initialized the completion\nqueue may inadvertently cause the driver to believe it has a completion\nto process. This may result in a NULL dereference since the nvmeq's tags\nare not set at this point.\n\nThe patch initializes the host's CQ memory so that a spurious interrupt\nisn't mistaken for a real completion.\n\nSigned-off-by: Keith Busch <keith.busch@intel.com>\nReviewed-by: Johannes Thumshirn <jthumshirn@suse.de>\nSigned-off-by: Christoph Hellwig <hch@lst.de>\nSigned-off-by: Jens Axboe <axboe@kernel.dk>\n[bwh: Backported to 4.4: adjust context]\nCc: Ben Hutchings <ben.hutchings@codethink.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/1e40d09a5575f6a2db841473baf329dc17bbe3ff"},{"sha":"753465123663c7c96b515befe4a199a2104582d3","author":{"name":"Taehee Yoo","email":"6de65b15142147918004ed846c7e65326f9b9238@gmail.com"},"message":"netfilter: nf_tables: use WARN_ON_ONCE instead of BUG_ON in nft_do_chain()\n\ncommit adc972c5b88829d38ede08b1069718661c7330ae upstream.\n\nWhen depth of chain is bigger than NFT_JUMP_STACK_SIZE, the nft_do_chain\ncrashes. But there is no need to crash hard here.\n\nSuggested-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Taehee Yoo <ap420073@gmail.com>\nAcked-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/753465123663c7c96b515befe4a199a2104582d3"},{"sha":"45f47e3a14933afa5261110dbeb580fbf6f6df1d","author":{"name":"Sean Nyekjaer","email":"f3d9424b5a4f30ffa2137b981e89ac7f33ab5a19@prevas.dk"},"message":"ARM: dts: imx6q: Use correct SDMA script for SPI5 core\n\ncommit df07101e1c4a29e820df02f9989a066988b160e6 upstream.\n\nAccording to the reference manual the shp_2_mcu / mcu_2_shp\nscripts must be used for devices connected through the SPBA.\n\nThis fixes an issue we saw with DMA transfers.\nSometimes the SPI controller RX FIFO was not empty after a DMA\ntransfer and the driver got stuck in the next PIO transfer when\nit read one word more than expected.\n\ncommit dd4b487b32a35 (\"ARM: dts: imx6: Use correct SDMA script\nfor SPI cores\") is fixing the same issue but only for SPI1 - 4.\n\nFixes: 677940258dd8e (\"ARM: dts: imx6q: enable dma for ecspi5\")\nSigned-off-by: Sean Nyekjaer <sean.nyekjaer@prevas.dk>\nReviewed-by: Fabio Estevam <fabio.estevam@nxp.com>\nSigned-off-by: Shawn Guo <shawnguo@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/45f47e3a14933afa5261110dbeb580fbf6f6df1d"},{"sha":"69a044d59c37221f97ae0308995573960b646252","author":{"name":"Richard Weinberger","email":"320bca71fc381a4a025636043ca86e734e31cf8b@nod.at"},"message":"ubi: fastmap: Correctly handle interrupted erasures in EBA\n\ncommit 781932375ffc6411713ee0926ccae8596ed0261c upstream.\n\nFastmap cannot track the LEB unmap operation, therefore it can\nhappen that after an interrupted erasure the mapping still looks\ngood from Fastmap's point of view, while reading from the PEB will\ncause an ECC error and confuses the upper layer.\n\nInstead of teaching users of UBI how to deal with that, we read back\nthe VID header and check for errors. If the PEB is empty or shows ECC\nerrors we fixup the mapping and schedule the PEB for erasure.\n\nFixes: dbb7d2a88d2a (\"UBI: Add fastmap core\")\nCc: <stable@vger.kernel.org>\nReported-by: martin bayern <Martinbayern@outlook.com>\nSigned-off-by: Richard Weinberger <richard@nod.at>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/69a044d59c37221f97ae0308995573960b646252"},{"sha":"9d45ae0158172943ba789cf39babaefaa67eaba2","author":{"name":"Cannon Matthews","email":"9e37d729ae0b5d033e8f396276f76b8b914aa3e1@google.com"},"message":"mm: hugetlb: yield when prepping struct pages\n\ncommit 520495fe96d74e05db585fc748351e0504d8f40d upstream.\n\nWhen booting with very large numbers of gigantic (i.e.  1G) pages, the\noperations in the loop of gather_bootmem_prealloc, and specifically\nprep_compound_gigantic_page, takes a very long time, and can cause a\nsoftlockup if enough pages are requested at boot.\n\nFor example booting with 3844 1G pages requires prepping\n(set_compound_head, init the count) over 1 billion 4K tail pages, which\ntakes considerable time.\n\nAdd a cond_resched() to the outer loop in gather_bootmem_prealloc() to\nprevent this lockup.\n\nTested: Booted with softlockup_panic=1 hugepagesz=1G hugepages=3844 and\nno softlockup is reported, and the hugepages are reported as\nsuccessfully setup.\n\nLink: http://lkml.kernel.org/r/20180627214447.260804-1-cannonmatthews@google.com\nSigned-off-by: Cannon Matthews <cannonmatthews@google.com>\nReviewed-by: Andrew Morton <akpm@linux-foundation.org>\nReviewed-by: Mike Kravetz <mike.kravetz@oracle.com>\nAcked-by: Michal Hocko <mhocko@suse.com>\nCc: Andres Lagar-Cavilla <andreslc@google.com>\nCc: Peter Feiner <pfeiner@google.com>\nCc: Greg Thelen <gthelen@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/9d45ae0158172943ba789cf39babaefaa67eaba2"},{"sha":"02a8a256f5bea9fc7156cea4d3c7f10958c0355d","author":{"name":"Changbin Du","email":"cdcef747db330b5520897b70efe55c0a15209511@intel.com"},"message":"tracing: Fix missing return symbol in function_graph output\n\ncommit 1fe4293f4b8de75824935f8d8e9a99c7fc6873da upstream.\n\nThe function_graph tracer does not show the interrupt return marker for the\nleaf entry. On leaf entries, we see an unbalanced interrupt marker (the\ninterrupt was entered, but nevern left).\n\nBefore:\n 1)               |  SyS_write() {\n 1)               |    __fdget_pos() {\n 1)   0.061 us    |      __fget_light();\n 1)   0.289 us    |    }\n 1)               |    vfs_write() {\n 1)   0.049 us    |      rw_verify_area();\n 1) + 15.424 us   |      __vfs_write();\n 1)   ==========> |\n 1)   6.003 us    |      smp_apic_timer_interrupt();\n 1)   0.055 us    |      __fsnotify_parent();\n 1)   0.073 us    |      fsnotify();\n 1) + 23.665 us   |    }\n 1) + 24.501 us   |  }\n\nAfter:\n 0)               |  SyS_write() {\n 0)               |    __fdget_pos() {\n 0)   0.052 us    |      __fget_light();\n 0)   0.328 us    |    }\n 0)               |    vfs_write() {\n 0)   0.057 us    |      rw_verify_area();\n 0)               |      __vfs_write() {\n 0)   ==========> |\n 0)   8.548 us    |      smp_apic_timer_interrupt();\n 0)   <========== |\n 0) + 36.507 us   |      } /* __vfs_write */\n 0)   0.049 us    |      __fsnotify_parent();\n 0)   0.066 us    |      fsnotify();\n 0) + 50.064 us   |    }\n 0) + 50.952 us   |  }\n\nLink: http://lkml.kernel.org/r/1517413729-20411-1-git-send-email-changbin.du@intel.com\n\nCc: stable@vger.kernel.org\nFixes: f8b755ac8e0cc (\"tracing/function-graph-tracer: Output arrows signal on hardirq call/return\")\nSigned-off-by: Changbin Du <changbin.du@intel.com>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/02a8a256f5bea9fc7156cea4d3c7f10958c0355d"},{"sha":"9a737329c7c4a341009b7398164db8fa8e5358f0","author":{"name":"Jann Horn","email":"0fcb39c6619aeb747ed6898bfde644ba26b24452@google.com"},"message":"scsi: sg: mitigate read/write abuse\n\ncommit 26b5b874aff5659a7e26e5b1997e3df2c41fa7fd upstream.\n\nAs Al Viro noted in commit 128394eff343 (\"sg_write()/bsg_write() is not fit\nto be called under KERNEL_DS\"), sg improperly accesses userspace memory\noutside the provided buffer, permitting kernel memory corruption via\nsplice().  But it doesn't just do it on ->write(), also on ->read().\n\nAs a band-aid, make sure that the ->read() and ->write() handlers can not\nbe called in weird contexts (kernel context or credentials different from\nfile opener), like for ib_safe_file_access().\n\nIf someone needs to use these interfaces from different security contexts,\na new interface should be written that goes through the ->ioctl() handler.\n\nI've mostly copypasted ib_safe_file_access() over as sg_safe_file_access()\nbecause I couldn't find a good common header - please tell me if you know a\nbetter way.\n\n[mkp: s/_safe_/_check_/]\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCc: <stable@vger.kernel.org>\nSigned-off-by: Jann Horn <jannh@google.com>\nAcked-by: Douglas Gilbert <dgilbert@interlog.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/9a737329c7c4a341009b7398164db8fa8e5358f0"},{"sha":"8e0817deeb968cfd0e176ed204754b712af7ecd2","author":{"name":"Christian Borntraeger","email":"49712f635b03c16d7f4c43df70e49ec8c565813d@de.ibm.com"},"message":"s390: Correct register corruption in critical section cleanup\n\ncommit 891f6a726cacbb87e5b06076693ffab53bd378d7 upstream.\n\nIn the critical section cleanup we must not mess with r1.  For march=z9\nor older, larl + ex (instead of exrl) are used with r1 as a temporary\nregister. This can clobber r1 in several interrupt handlers. Fix this by\nusing r11 as a temp register.  r11 is being saved by all callers of\ncleanup_critical.\n\nFixes: 6dd85fbb87 (\"s390: move expoline assembler macros to a header\")\nCc: stable@vger.kernel.org #v4.16\nReported-by: Oliver Kurz <okurz@suse.com>\nReported-by: Petr Tesařík <ptesarik@suse.com>\nSigned-off-by: Christian Borntraeger <borntraeger@de.ibm.com>\nReviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/8e0817deeb968cfd0e176ed204754b712af7ecd2"},{"sha":"df0fe72e2e1f18da3d045f0211b2c833d22578ff","author":{"name":"Lars Ellenberg","email":"31df9cacdc65c624cc60c2dcd22bbf92dc230e16@linbit.com"},"message":"drbd: fix access after free\n\ncommit 64dafbc9530c10300acffc57fae3269d95fa8f93 upstream.\n\nWe have\n  struct drbd_requests { ... struct bio *private_bio;  ... }\nto hold a bio clone for local submission.\n\nOn local IO completion, we put that bio, and in case we want to use the\nresult later, we overload that member to hold the ERR_PTR() of the\ncompletion result,\n\nWhich, before v4.3, used to be the passed in \"int error\",\nso we could first bio_put(), then assign.\n\nv4.3-rc1~100^2~21 4246a0b63bd8 block: add a bi_error field to struct bio\nchanged that:\n  \tbio_put(req->private_bio);\n -\treq->private_bio = ERR_PTR(error);\n +\treq->private_bio = ERR_PTR(bio->bi_error);\n\nWhich introduces an access after free,\nbecause it was non obvious that req->private_bio == bio.\n\nImpact of that was mostly unnoticable, because we only use that value\nin a multiple-failure case, and even then map any \"unexpected\" error\ncode to EIO, so worst case we could potentially mask a more specific\nerror with EIO in a multiple failure case.\n\nUnless the pointed to memory region was unmapped, as is the case with\nCONFIG_DEBUG_PAGEALLOC, in which case this results in\n\n  BUG: unable to handle kernel paging request\n\nv4.13-rc1~70^2~75 4e4cbee93d56 block: switch bios to blk_status_t\nchanges it further to\n  \tbio_put(req->private_bio);\n  \treq->private_bio = ERR_PTR(blk_status_to_errno(bio->bi_status));\n\nAnd blk_status_to_errno() now contains a WARN_ON_ONCE() for unexpected\nvalues, which catches this \"sometimes\", if the memory has been reused\nquickly enough for other things.\n\nShould also go into stable since 4.3, with the trivial change around 4.13.\n\nCc: stable@vger.kernel.org\nFixes: 4246a0b63bd8 block: add a bi_error field to struct bio\nReported-by: Sarah Newman <srn@prgmr.com>\nSigned-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>\nSigned-off-by: Jens Axboe <axboe@kernel.dk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/df0fe72e2e1f18da3d045f0211b2c833d22578ff"}]}
{"actor":{"display_login":"Jackeagle"}}