{"push_id":2522090407,"size":55,"distinct_size":55,"ref":"refs/heads/treble","head":"6f3f61cdc392ddd12b3b1feae571fc01681838b8","before":"26380d04809ab98115d51f13249c7b9c5f67eb6e","commits":[{"sha":"0647dbf68b6d7b9e0a19bcb96dace7c9d3bd5393","author":{"name":"Mauro Carvalho Chehab","email":"ad86ba2154032c9f55743a190faa2459a9d61d42@s-opensource.com"},"message":"media: v4l2-compat-ioctl32: don't oops on overlay\n\ncommit 85ea29f19eab56ec16ec6b92bc67305998706afa upstream.\n\nAt put_v4l2_window32(), it tries to access kp->clips. However,\nkp points to an userspace pointer. So, it should be obtained\nvia get_user(), otherwise it can OOPS:\n\n vivid-000: ==================  END STATUS  ==================\n BUG: unable to handle kernel paging request at 00000000fffb18e0\n IP: [<ffffffffc05468d9>] __put_v4l2_format32+0x169/0x220 [videodev]\n PGD 3f5776067 PUD 3f576f067 PMD 3f5769067 PTE 800000042548f067\n Oops: 0001 [#1] SMP\n Modules linked in: vivid videobuf2_vmalloc videobuf2_memops v4l2_dv_timings videobuf2_core v4l2_common videodev media xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables bluetooth rfkill binfmt_misc snd_hda_codec_hdmi i915 snd_hda_intel snd_hda_controller snd_hda_codec intel_rapl x86_pkg_temp_thermal snd_hwdep intel_powerclamp snd_pcm coretemp snd_seq_midi kvm_intel kvm snd_seq_midi_event snd_rawmidi i2c_algo_bit drm_kms_helper snd_seq drm crct10dif_pclmul e1000e snd_seq_device crc32_pclmul snd_timer ghash_clmulni_intel snd mei_me mei ptp pps_core soundcore lpc_ich video crc32c_intel [last unloaded: media]\n CPU: 2 PID: 28332 Comm: v4l2-compliance Not tainted 3.18.102+ #107\n Hardware name:                  /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017\n task: ffff8804293f8000 ti: ffff8803f5640000 task.ti: ffff8803f5640000\n RIP: 0010:[<ffffffffc05468d9>]  [<ffffffffc05468d9>] __put_v4l2_format32+0x169/0x220 [videodev]\n RSP: 0018:ffff8803f5643e28  EFLAGS: 00010246\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000fffb1ab4\n RDX: 00000000fffb1a68 RSI: 00000000fffb18d8 RDI: 00000000fffb1aa8\n RBP: ffff8803f5643e48 R08: 0000000000000001 R09: ffff8803f54b0378\n R10: 0000000000000000 R11: 0000000000000168 R12: 00000000fffb18c0\n R13: 00000000fffb1a94 R14: 00000000fffb18c8 R15: 0000000000000000\n FS:  0000000000000000(0000) GS:ffff880456d00000(0063) knlGS:00000000f7100980\n CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033\n CR2: 00000000fffb18e0 CR3: 00000003f552b000 CR4: 00000000003407e0\n Stack:\n  00000000fffb1a94 00000000c0cc5640 0000000000000056 ffff8804274f3600\n  ffff8803f5643ed0 ffffffffc0547e16 0000000000000003 ffff8803f5643eb0\n  ffffffff81301460 ffff88009db44b01 ffff880441942520 ffff8800c0d05640\n Call Trace:\n  [<ffffffffc0547e16>] v4l2_compat_ioctl32+0x12d6/0x1b1d [videodev]\n  [<ffffffff81301460>] ? file_has_perm+0x70/0xc0\n  [<ffffffff81252a2c>] compat_SyS_ioctl+0xec/0x1200\n  [<ffffffff8173241a>] sysenter_dispatch+0x7/0x21\n Code: 00 00 48 8b 80 48 c0 ff ff 48 83 e8 38 49 39 c6 0f 87 2b ff ff ff 49 8d 45 1c e8 a3 ce e3 c0 85 c0 0f 85 1a ff ff ff 41 8d 40 ff <4d> 8b 64 24 20 41 89 d5 48 8d 44 40 03 4d 8d 34 c4 eb 15 0f 1f\n RIP  [<ffffffffc05468d9>] __put_v4l2_format32+0x169/0x220 [videodev]\n RSP <ffff8803f5643e28>\n CR2: 00000000fffb18e0\n\nTested with vivid driver on Kernel v3.18.102.\n\nSame bug happens upstream too:\n\n BUG: KASAN: user-memory-access in __put_v4l2_format32+0x98/0x4d0 [videodev]\n Read of size 8 at addr 00000000ffe48400 by task v4l2-compliance/8713\n\n CPU: 0 PID: 8713 Comm: v4l2-compliance Not tainted 4.16.0-rc4+ #108\n Hardware name:  /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017\n Call Trace:\n  dump_stack+0x5c/0x7c\n  kasan_report+0x164/0x380\n  ? __put_v4l2_format32+0x98/0x4d0 [videodev]\n  __put_v4l2_format32+0x98/0x4d0 [videodev]\n  v4l2_compat_ioctl32+0x1aec/0x27a0 [videodev]\n  ? __fsnotify_inode_delete+0x20/0x20\n  ? __put_v4l2_format32+0x4d0/0x4d0 [videodev]\n  compat_SyS_ioctl+0x646/0x14d0\n  ? do_ioctl+0x30/0x30\n  do_fast_syscall_32+0x191/0x3f4\n  entry_SYSENTER_compat+0x6b/0x7a\n ==================================================================\n Disabling lock debugging due to kernel taint\n BUG: unable to handle kernel paging request at 00000000ffe48400\n IP: __put_v4l2_format32+0x98/0x4d0 [videodev]\n PGD 3a22fb067 P4D 3a22fb067 PUD 39b6f0067 PMD 39b6f1067 PTE 80000003256af067\n Oops: 0001 [#1] SMP KASAN\n Modules linked in: vivid videobuf2_vmalloc videobuf2_dma_contig videobuf2_memops v4l2_tpg v4l2_dv_timings videobuf2_v4l2 videobuf2_common v4l2_common videodev xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack libcrc32c tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables bluetooth rfkill ecdh_generic binfmt_misc snd_hda_codec_hdmi intel_rapl x86_pkg_temp_thermal intel_powerclamp i915 coretemp snd_hda_intel snd_hda_codec kvm_intel snd_hwdep snd_hda_core kvm snd_pcm irqbypass crct10dif_pclmul crc32_pclmul snd_seq_midi ghash_clmulni_intel snd_seq_midi_event i2c_algo_bit intel_cstate snd_rawmidi intel_uncore snd_seq drm_kms_helper e1000e snd_seq_device snd_timer intel_rapl_perf\n  drm ptp snd mei_me mei lpc_ich pps_core soundcore video crc32c_intel\n CPU: 0 PID: 8713 Comm: v4l2-compliance Tainted: G    B            4.16.0-rc4+ #108\n Hardware name:  /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017\n RIP: 0010:__put_v4l2_format32+0x98/0x4d0 [videodev]\n RSP: 0018:ffff8803b9be7d30 EFLAGS: 00010282\n RAX: 0000000000000000 RBX: ffff8803ac983e80 RCX: ffffffff8cd929f2\n RDX: 1ffffffff1d0a149 RSI: 0000000000000297 RDI: 0000000000000297\n RBP: 00000000ffe485c0 R08: fffffbfff1cf5123 R09: ffffffff8e7a8948\n R10: 0000000000000001 R11: fffffbfff1cf5122 R12: 00000000ffe483e0\n R13: 00000000ffe485c4 R14: ffff8803ac985918 R15: 00000000ffe483e8\n FS:  0000000000000000(0000) GS:ffff880407400000(0063) knlGS:00000000f7a46980\n CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033\n CR2: 00000000ffe48400 CR3: 00000003a83f2003 CR4: 00000000003606f0\n Call Trace:\n  v4l2_compat_ioctl32+0x1aec/0x27a0 [videodev]\n  ? __fsnotify_inode_delete+0x20/0x20\n  ? __put_v4l2_format32+0x4d0/0x4d0 [videodev]\n  compat_SyS_ioctl+0x646/0x14d0\n  ? do_ioctl+0x30/0x30\n  do_fast_syscall_32+0x191/0x3f4\n  entry_SYSENTER_compat+0x6b/0x7a\n Code: 4c 89 f7 4d 8d 7c 24 08 e8 e6 a4 69 cb 48 8b 83 98 1a 00 00 48 83 e8 10 49 39 c7 0f 87 9d 01 00 00 49 8d 7c 24 20 e8 c8 a4 69 cb <4d> 8b 74 24 20 4c 89 ef 4c 89 fe ba 10 00 00 00 e8 23 d9 08 cc\n RIP: __put_v4l2_format32+0x98/0x4d0 [videodev] RSP: ffff8803b9be7d30\n CR2: 00000000ffe48400\n\ncc: stable@vger.kernel.org\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>\nReviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>\nReviewed-by: Hans Verkuil <hans.verkuil@cisco.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/0647dbf68b6d7b9e0a19bcb96dace7c9d3bd5393"},{"sha":"f8a1c5b50ff9e0351ca5b739c5327c623a27ad7b","author":{"name":"Helge Deller","email":"5b1e7895819cf7d6bc77091b09bbfd6d330a4e74@gmx.de"},"message":"parisc: Fix out of array access in match_pci_device()\n\ncommit 615b2665fd20c327b631ff1e79426775de748094 upstream.\n\nAs found by the ubsan checker, the value of the 'index' variable can be\nout of range for the bc[] array:\n\nUBSAN: Undefined behaviour in arch/parisc/kernel/drivers.c:655:21\nindex 6 is out of range for type 'char [6]'\nBacktrace:\n [<104fa850>] __ubsan_handle_out_of_bounds+0x68/0x80\n [<1019d83c>] check_parent+0xc0/0x170\n [<1019d91c>] descend_children+0x30/0x6c\n [<1059e164>] device_for_each_child+0x60/0x98\n [<1019cd54>] parse_tree_node+0x40/0x54\n [<1019d86c>] check_parent+0xf0/0x170\n [<1019d91c>] descend_children+0x30/0x6c\n [<1059e164>] device_for_each_child+0x60/0x98\n [<1019d938>] descend_children+0x4c/0x6c\n [<1059e164>] device_for_each_child+0x60/0x98\n [<1019cd54>] parse_tree_node+0x40/0x54\n [<1019cffc>] hwpath_to_device+0xa4/0xc4\n\nSigned-off-by: Helge Deller <deller@gmx.de>\nCc: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/f8a1c5b50ff9e0351ca5b739c5327c623a27ad7b"},{"sha":"b9f07828597e4162a8055c52e263146ae68b22af","author":{"name":"Julian Wiedmann","email":"a70165cc435925071a1d5d2715fcc7eb04666fa4@linux.vnet.ibm.com"},"message":"s390/qdio: don't retry EQBS after CCQ 96\n\ncommit dae55b6fef58530c13df074bcc182c096609339e upstream.\n\nImmediate retry of EQBS after CCQ 96 means that we potentially misreport\nthe state of buffers inspected during the first EQBS call.\n\nThis occurs when\n1. the first EQBS finds all inspected buffers still in the initial state\n   set by the driver (ie INPUT EMPTY or OUTPUT PRIMED),\n2. the EQBS terminates early with CCQ 96, and\n3. by the time that the second EQBS comes around, the state of those\n   previously inspected buffers has changed.\n\nIf the state reported by the second EQBS is 'driver-owned', all we know\nis that the previous buffers are driver-owned now as well. But we can't\ntell if they all have the same state. So for instance\n- the second EQBS reports OUTPUT EMPTY, but any number of the previous\n  buffers could be OUTPUT ERROR by now,\n- the second EQBS reports OUTPUT ERROR, but any number of the previous\n  buffers could be OUTPUT EMPTY by now.\n\nEffectively, this can result in both over- and underreporting of errors.\n\nIf the state reported by the second EQBS is 'HW-owned', that doesn't\nguarantee that the previous buffers have not been switched to\ndriver-owned in the mean time. So for instance\n- the second EQBS reports INPUT EMPTY, but any number of the previous\n  buffers could be INPUT PRIMED (or INPUT ERROR) by now.\n\nThis would result in failure to process pending work on the queue. If\nit's the final check before yielding initiative, this can cause\na (temporary) queue stall due to IRQ avoidance.\n\nFixes: 25f269f17316 (\"[S390] qdio: EQBS retry after CCQ 96\")\nCc: <stable@vger.kernel.org> #v3.2+\nSigned-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>\nReviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com>\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/b9f07828597e4162a8055c52e263146ae68b22af"},{"sha":"c205d6bffcae48fe1d325e82b80400f31ba352ab","author":{"name":"Julian Wiedmann","email":"a70165cc435925071a1d5d2715fcc7eb04666fa4@linux.vnet.ibm.com"},"message":"s390/qdio: don't merge ERROR output buffers\n\ncommit 0cf1e05157b9e5530dcc3ca9fec9bf617fc93375 upstream.\n\nOn an Output queue, both EMPTY and PENDING buffer states imply that the\nbuffer is ready for completion-processing by the upper-layer drivers.\n\nSo for a non-QEBSM Output queue, get_buf_states() merges mixed\nbatches of PENDING and EMPTY buffers into one large batch of EMPTY\nbuffers. The upper-layer driver (ie. qeth) later distuingishes PENDING\nfrom EMPTY by inspecting the slsb_state for\nQDIO_OUTBUF_STATE_FLAG_PENDING.\n\nBut the merge logic in get_buf_states() contains a bug that causes us to\nerronously also merge ERROR buffers into such a batch of EMPTY buffers\n(ERROR is 0xaf, EMPTY is 0xa1; so ERROR & EMPTY == EMPTY).\nEffectively, most outbound ERROR buffers are currently discarded\nsilently and processed as if they had succeeded.\n\nNote that this affects _all_ non-QEBSM device types, not just IQD with CQ.\n\nFix it by explicitly spelling out the exact conditions for merging.\n\nFor extracting the \"get initial state\" part out of the loop, this relies\non the fact that get_buf_states() is never called with a count of 0. The\nQEBSM path already strictly requires this, and the two callers with\nvariable 'count' make sure of it.\n\nFixes: 104ea556ee7f (\"qdio: support asynchronous delivery of storage blocks\")\nCc: <stable@vger.kernel.org> #v3.2+\nSigned-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>\nReviewed-by: Ursula Braun <ubraun@linux.vnet.ibm.com>\nReviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com>\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/c205d6bffcae48fe1d325e82b80400f31ba352ab"},{"sha":"5e859bf5a8b5bded23c8d35e7b25468ec3ccc32b","author":{"name":"Vasily Gorbik","email":"fd6608149f5f589003abf198bcd5ef1b94afa26b@linux.ibm.com"},"message":"s390/ipl: ensure loadparm valid flag is set\n\ncommit 15deb080a6087b73089139569558965750e69d67 upstream.\n\nWhen loadparm is set in reipl parm block, the kernel should also set\nDIAG308_FLAGS_LP_VALID flag.\n\nThis fixes loadparm ignoring during z/VM fcp -> ccw reipl and kvm direct\nboot -> ccw reipl.\n\nCc: <stable@vger.kernel.org>\nReviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>\nSigned-off-by: Vasily Gorbik <gor@linux.ibm.com>\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/5e859bf5a8b5bded23c8d35e7b25468ec3ccc32b"},{"sha":"51509ce03e0bfbb7f03ed0b5fdce45708a437af6","author":{"name":"Tejaswi Tanikella","email":"0d55a4cac72a7b8a148e6791455119f3a4a94e2f@codeaurora.org"},"message":"slip: Check if rstate is initialized before uncompressing\n\n\n[ Upstream commit 3f01ddb962dc506916c243f9524e8bef97119b77 ]\n\nOn receiving a packet the state index points to the rstate which must be\nused to fill up IP and TCP headers. But if the state index points to a\nrstate which is unitialized, i.e. filled with zeros, it gets stuck in an\ninfinite loop inside ip_fast_csum trying to compute the ip checsum of a\nheader with zero length.\n\n89.666953:   <2> [<ffffff9dd3e94d38>] slhc_uncompress+0x464/0x468\n89.666965:   <2> [<ffffff9dd3e87d88>] ppp_receive_nonmp_frame+0x3b4/0x65c\n89.666978:   <2> [<ffffff9dd3e89dd4>] ppp_receive_frame+0x64/0x7e0\n89.666991:   <2> [<ffffff9dd3e8a708>] ppp_input+0x104/0x198\n89.667005:   <2> [<ffffff9dd3e93868>] pppopns_recv_core+0x238/0x370\n89.667027:   <2> [<ffffff9dd4428fc8>] __sk_receive_skb+0xdc/0x250\n89.667040:   <2> [<ffffff9dd3e939e4>] pppopns_recv+0x44/0x60\n89.667053:   <2> [<ffffff9dd4426848>] __sock_queue_rcv_skb+0x16c/0x24c\n89.667065:   <2> [<ffffff9dd4426954>] sock_queue_rcv_skb+0x2c/0x38\n89.667085:   <2> [<ffffff9dd44f7358>] raw_rcv+0x124/0x154\n89.667098:   <2> [<ffffff9dd44f7568>] raw_local_deliver+0x1e0/0x22c\n89.667117:   <2> [<ffffff9dd44c8ba0>] ip_local_deliver_finish+0x70/0x24c\n89.667131:   <2> [<ffffff9dd44c92f4>] ip_local_deliver+0x100/0x10c\n\n./scripts/faddr2line vmlinux slhc_uncompress+0x464/0x468 output:\n ip_fast_csum at arch/arm64/include/asm/checksum.h:40\n (inlined by) slhc_uncompress at drivers/net/slip/slhc.c:615\n\nAdding a variable to indicate if the current rstate is initialized. If\nsuch a packet arrives, move to toss state.\n\nSigned-off-by: Tejaswi Tanikella <tejaswit@codeaurora.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/51509ce03e0bfbb7f03ed0b5fdce45708a437af6"},{"sha":"aee5ff83967e9925c966e595bd3c13d3dff2c515","author":{"name":"Richard Weinberger","email":"320bca71fc381a4a025636043ca86e734e31cf8b@nod.at"},"message":"ubifs: Check ubifs_wbuf_sync() return code\n\ncommit aac17948a7ce01fb60b9ee6cf902967a47b3ce26 upstream.\n\nIf ubifs_wbuf_sync() fails we must not write a master node with the\ndirty marker cleared.\nOtherwise it is possible that in case of an IO error while syncing we\nmark the filesystem as clean and UBIFS refuses to recover upon next\nmount.\n\nCc: <stable@vger.kernel.org>\nFixes: 1e51764a3c2a (\"UBIFS: add new flash file system\")\nSigned-off-by: Richard Weinberger <richard@nod.at>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/aee5ff83967e9925c966e595bd3c13d3dff2c515"},{"sha":"1c9fcf71e31092eff1d2e28ce0e96e918fbab573","author":{"name":"Romain Izard","email":"de9dde47add484df57256d50e11e0f04f158376a@gmail.com"},"message":"ubi: Fix error for write access\n\ncommit 78a8dfbabbece22bee58ac4cb26cab10e7a19c5d upstream.\n\nWhen opening a device with write access, ubiblock_open returns an error\ncode. Currently, this error code is -EPERM, but this is not the right\nvalue.\n\nThe open function for other block devices returns -EROFS when opening\nread-only devices with FMODE_WRITE set. When used with dm-verity, the\nveritysetup userspace tool is expecting EROFS, and refuses to use the\nubiblock device.\n\nUse -EROFS for ubiblock as well. As a result, veritysetup accepts the\nubiblock device as valid.\n\nCc: stable@vger.kernel.org\nFixes: 9d54c8a33eec (UBI: R/O block driver on top of UBI volumes)\nSigned-off-by: Romain Izard <romain.izard.pro@gmail.com>\nSigned-off-by: Richard Weinberger <richard@nod.at>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/1c9fcf71e31092eff1d2e28ce0e96e918fbab573"},{"sha":"5aae810c2c40b7d590e9b4467f01a2dbf14897f2","author":{"name":"Richard Weinberger","email":"320bca71fc381a4a025636043ca86e734e31cf8b@nod.at"},"message":"ubi: Reject MLC NAND\n\ncommit b5094b7f135be34630e3ea8a98fa215715d0f29d upstream.\n\nWhile UBI and UBIFS seem to work at first sight with MLC NAND, you will\nmost likely lose all your data upon a power-cut or due to read/write\ndisturb.\nIn order to protect users from bad surprises, refuse to attach to MLC\nNAND.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Richard Weinberger <richard@nod.at>\nAcked-by: Boris Brezillon <boris.brezillon@bootlin.com>\nAcked-by: Artem Bityutskiy <dedekind1@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/5aae810c2c40b7d590e9b4467f01a2dbf14897f2"},{"sha":"8b85ff3d8074943482dd54f295cda4f1e31077c1","author":{"name":"Andrew Morton","email":"5c1e68b099950c134891f0b6e179498a8ebe9cf9@linux-foundation.org"},"message":"fs/reiserfs/journal.c: add missing resierfs_warning() arg\n\ncommit 9ad553abe66f8be3f4755e9fa0a6ba137ce76341 upstream.\n\nOne use of the reiserfs_warning() macro in journal_init_dev() is missing\na parameter, causing the following warning:\n\n  REISERFS warning (device loop0): journal_init_dev: Cannot open '%s': %i journal_init_dev:\n\nThis also causes a WARN_ONCE() warning in the vsprintf code, and then a\npanic if panic_on_warn is set.\n\n  Please remove unsupported %/ in format string\n  WARNING: CPU: 1 PID: 4480 at lib/vsprintf.c:2138 format_decode+0x77f/0x830 lib/vsprintf.c:2138\n  Kernel panic - not syncing: panic_on_warn set ...\n\nJust add another string argument to the macro invocation.\n\nAddresses https://syzkaller.appspot.com/bug?id=0627d4551fdc39bf1ef5d82cd9eef587047f7718\n\nLink: http://lkml.kernel.org/r/d678ebe1-6f54-8090-df4c-b9affad62293@infradead.org\nSigned-off-by: Randy Dunlap <rdunlap@infradead.org>\nReported-by: <syzbot+6bd77b88c1977c03f584@syzkaller.appspotmail.com>\nTested-by: Randy Dunlap <rdunlap@infradead.org>\nAcked-by: Jeff Mahoney <jeffm@suse.com>\nCc: Alexander Viro <viro@zeniv.linux.org.uk>\nCc: Jan Kara <jack@suse.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/8b85ff3d8074943482dd54f295cda4f1e31077c1"},{"sha":"b586f698448ed73502bacec5cb9189144024c8b5","author":{"name":"Takashi Iwai","email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de"},"message":"resource: fix integer overflow at reallocation\n\ncommit 60bb83b81169820c691fbfa33a6a4aef32aa4b0b upstream.\n\nWe've got a bug report indicating a kernel panic at booting on an x86-32\nsystem, and it turned out to be the invalid PCI resource assigned after\nreallocation.  __find_resource() first aligns the resource start address\nand resets the end address with start+size-1 accordingly, then checks\nwhether it's contained.  Here the end address may overflow the integer,\nalthough resource_contains() still returns true because the function\nvalidates only start and end address.  So this ends up with returning an\ninvalid resource (start > end).\n\nThere was already an attempt to cover such a problem in the commit\n47ea91b4052d (\"Resource: fix wrong resource window calculation\"), but\nthis case is an overseen one.\n\nThis patch adds the validity check of the newly calculated resource for\navoiding the integer overflow problem.\n\nBugzilla: http://bugzilla.opensuse.org/show_bug.cgi?id=1086739\nLink: http://lkml.kernel.org/r/s5hpo37d5l8.wl-tiwai@suse.de\nFixes: 23c570a67448 (\"resource: ability to resize an allocated resource\")\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nReported-by: Michael Henders <hendersm@shaw.ca>\nTested-by: Michael Henders <hendersm@shaw.ca>\nReviewed-by: Andrew Morton <akpm@linux-foundation.org>\nCc: Ram Pai <linuxram@us.ibm.com>\nCc: Bjorn Helgaas <bhelgaas@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/b586f698448ed73502bacec5cb9189144024c8b5"},{"sha":"1daf93b8c0b776b486efe72606b1ba5e1cef6c7e","author":{"name":"Heinrich Schuchardt","email":"2cd7bb605d542f55cc27b85da62ad2c96ce31039@gmx.de"},"message":"usb: musb: gadget: misplaced out of bounds check\n\ncommit af6f8529098aeb0e56a68671b450cf74e7a64fcd upstream.\n\nmusb->endpoints[] has array size MUSB_C_NUM_EPS.\nWe must check array bounds before accessing the array and not afterwards.\n\nSigned-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>\nSigned-off-by: Bin Liu <b-liu@ti.com>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/1daf93b8c0b776b486efe72606b1ba5e1cef6c7e"},{"sha":"e0e3def03b68b68147834bfe83677ff6c558bd5a","author":{"name":"Nicolas Ferre","email":"45b517be0e5ec6dc3a39715767c1d18e090d39b4@microchip.com"},"message":"ARM: dts: at91: at91sam9g25: fix mux-mask pinctrl property\n\ncommit e8fd0adf105e132fd84545997bbef3d5edc2c9c1 upstream.\n\nThere are only 19 PIOB pins having primary names PB0-PB18. Not all of them\nhave a 'C' function. So the pinctrl property mask ends up being the same as the\nother SoC of the at91sam9x5 series.\n\nReported-by: Marek Sieranski <marek.sieranski@microchip.com>\nSigned-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>\nCc: <stable@vger.kernel.org> # v3.8+\nSigned-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/e0e3def03b68b68147834bfe83677ff6c558bd5a"},{"sha":"456374e60fd3d6a26db78693be82e40648940b3e","author":{"name":"Jason Andryuk","email":"8558cf2f125c210e58f86c566cb85d5e97963455@gmail.com"},"message":"xen-netfront: Fix hang on device removal\n\ncommit c2d2e6738a209f0f9dffa2dc8e7292fc45360d61 upstream.\n\nA toolstack may delete the vif frontend and backend xenstore entries\nwhile xen-netfront is in the removal code path.  In that case, the\nchecks for xenbus_read_driver_state would return XenbusStateUnknown, and\nxennet_remove would hang indefinitely.  This hang prevents system\nshutdown.\n\nxennet_remove must be able to handle XenbusStateUnknown, and\nnetback_changed must also wake up the wake_queue for that state as well.\n\nFixes: 5b5971df3bc2 (\"xen-netfront: remove warning when unloading module\")\n\nSigned-off-by: Jason Andryuk <jandryuk@gmail.com>\nCc: Eduardo Otubo <otubo@redhat.com>\nReviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nSigned-off-by: Juergen Gross <jgross@suse.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/456374e60fd3d6a26db78693be82e40648940b3e"},{"sha":"d97424ac65f22e68ac834c2f89a089a6ea367488","author":{"name":"Mika Westerberg","email":"afb75201fb002d7fdd2b0b231e006999e00db8a9@linux.intel.com"},"message":"ACPI / hotplug / PCI: Check presence of slot itself in get_slot_status()\n\ncommit 13d3047c81505cc0fb9bdae7810676e70523c8bf upstream.\n\nMike Lothian reported that plugging in a USB-C device does not work\nproperly in his Dell Alienware system.  This system has an Intel Alpine\nRidge Thunderbolt controller providing USB-C functionality.  In these\nsystems the USB controller (xHCI) is hotplugged whenever a device is\nconnected to the port using ACPI-based hotplug.\n\nThe ACPI description of the root port in question is as follows:\n\n  Device (RP01)\n  {\n      Name (_ADR, 0x001C0000)\n\n      Device (PXSX)\n      {\n          Name (_ADR, 0x02)\n\n          Method (_RMV, 0, NotSerialized)\n          {\n              // ...\n          }\n      }\n\nHere _ADR 0x02 means device 0, function 2 on the bus under root port (RP01)\nbut that seems to be incorrect because device 0 is the upstream port of the\nAlpine Ridge PCIe switch and it has no functions other than 0 (the bridge\nitself).  When we get ACPI Notify() to the root port resulting from\nconnecting a USB-C device, Linux tries to read PCI_VENDOR_ID from device 0,\nfunction 2 which of course always returns 0xffffffff because there is no\nsuch function and we never find the device.\n\nIn Windows this works fine.\n\nNow, since we get ACPI Notify() to the root port and not to the PXSX device\nwe should actually start our scan from there as well and not from the\nnon-existent PXSX device.  Fix this by checking presence of the slot itself\n(function 0) if we fail to do that otherwise.\n\nWhile there use pci_bus_read_dev_vendor_id() in get_slot_status(), which is\nthe recommended way to read Device and Vendor IDs of devices on PCI buses.\n\nLink: https://bugzilla.kernel.org/show_bug.cgi?id=198557\nReported-by: Mike Lothian <mike@fireburn.co.uk>\nSigned-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>\nSigned-off-by: Bjorn Helgaas <bhelgaas@google.com>\nReviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>\nCc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/d97424ac65f22e68ac834c2f89a089a6ea367488"},{"sha":"eb62f3d235e39a3a2513d5d372066e88abfffd90","author":{"name":"Zhengjun Xing","email":"e93ad64aa28e0f5b0e0d92d320a7d0f379095717@linux.intel.com"},"message":"USB:fix USB3 devices behind USB3 hubs not resuming at hibernate thaw\n\ncommit 64627388b50158fd24d6ad88132525b95a5ef573 upstream.\n\nUSB3 hubs don't support global suspend.\n\nUSB3 specification 10.10, Enhanced SuperSpeed hubs only support selective\nsuspend and resume, they do not support global suspend/resume where the\nhub downstream facing ports states are not affected.\n\nWhen system enters hibernation it first enters freeze process where only\nthe root hub enters suspend, usb_port_suspend() is not called for other\ndevices, and suspend status flags are not set for them. Other devices are\nexpected to suspend globally. Some external USB3 hubs will suspend the\ndownstream facing port at global suspend. These devices won't be resumed\nat thaw as the suspend status flag is not set.\n\nA USB3 removable hard disk connected through a USB3 hub that won't resume\nat thaw will fail to synchronize SCSI cache, return “cmd cmplt err -71”\nerror, and needs a 60 seconds timeout which causing system hang for 60s\nbefore the USB host reset the port for the USB3 removable hard disk to\nrecover.\n\nFix this by always calling usb_port_suspend() during freeze for USB3\ndevices.\n\nSigned-off-by: Zhengjun Xing <zhengjun.xing@linux.intel.com>\nCc: stable <stable@vger.kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/eb62f3d235e39a3a2513d5d372066e88abfffd90"},{"sha":"d0e3d32b59780725de33b6e96a3d17e0859523c3","author":{"name":"Thinh Nguyen","email":"8e436f42a8d87f445466a3edb7bd598ad284eedd@synopsys.com"},"message":"usb: dwc3: pci: Properly cleanup resource\n\ncommit cabdf83dadfb3d83eec31e0f0638a92dbd716435 upstream.\n\nPlatform device is allocated before adding resources. Make sure to\nproperly cleanup on error case.\n\nCc: <stable@vger.kernel.org>\nFixes: f1c7e7108109 (\"usb: dwc3: convert to pcim_enable_device()\")\nSigned-off-by: Thinh Nguyen <thinhn@synopsys.com>\nSigned-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/d0e3d32b59780725de33b6e96a3d17e0859523c3"},{"sha":"46f9006e246074f7c2fdda61f7e9826484006fb2","author":{"name":"Aaron Ma","email":"6d75ab49fa4401d16749457e532362eb5fdb78e3@canonical.com"},"message":"HID: i2c-hid: fix size check and type usage\n\ncommit ac75a041048b8c1f7418e27621ca5efda8571043 upstream.\n\nWhen convert char array with signed int, if the inbuf[x] is negative then\nupper bits will be set to 1. Fix this by using u8 instead of char.\n\nret_size has to be at least 3, hid_input_report use it after minus 2 bytes.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Aaron Ma <aaron.ma@canonical.com>\nSigned-off-by: Jiri Kosina <jkosina@suse.cz>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/46f9006e246074f7c2fdda61f7e9826484006fb2"},{"sha":"515bf6232da6c86143d8eda8b945573075f44b78","author":{"name":"Nicholas Piggin","email":"24829078df5003d9dd1dd871ca2aeb0b1cf95ef4@gmail.com"},"message":"powerpc/powernv: Handle unknown OPAL errors in opal_nvram_write()\n\ncommit 741de617661794246f84a21a02fc5e327bffc9ad upstream.\n\nopal_nvram_write currently just assumes success if it encounters an\nerror other than OPAL_BUSY or OPAL_BUSY_EVENT. Have it return -EIO\non other errors instead.\n\nFixes: 628daa8d5abf (\"powerpc/powernv: Add RTC and NVRAM support plus RTAS fallbacks\")\nCc: stable@vger.kernel.org # v3.2+\nSigned-off-by: Nicholas Piggin <npiggin@gmail.com>\nReviewed-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>\nAcked-by: Stewart Smith <stewart@linux.ibm.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/515bf6232da6c86143d8eda8b945573075f44b78"},{"sha":"f46c991587015b788acc6eeed374c04ffad869a0","author":{"name":"Nicholas Piggin","email":"24829078df5003d9dd1dd871ca2aeb0b1cf95ef4@gmail.com"},"message":"powerpc/64: Fix smp_wmb barrier definition use use lwsync consistently\n\ncommit 0bfdf598900fd62869659f360d3387ed80eb71cf upstream.\n\nasm/barrier.h is not always included after asm/synch.h, which meant\nit was missing __SUBARCH_HAS_LWSYNC, so in some files smp_wmb() would\nbe eieio when it should be lwsync. kernel/time/hrtimer.c is one case.\n\n__SUBARCH_HAS_LWSYNC is only used in one place, so just fold it in\nto where it's used. Previously with my small simulator config, 377\ninstances of eieio in the tree. After this patch there are 55.\n\nFixes: 46d075be585e (\"powerpc: Optimise smp_wmb\")\nCc: stable@vger.kernel.org # v2.6.29+\nSigned-off-by: Nicholas Piggin <npiggin@gmail.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/ManoloRey/kernel_xiaomi_msm8953/commits/f46c991587015b788acc6eeed374c04ffad869a0"}]}
{"actor":{"display_login":"ManoloRey"}}