{"push_id":2865238683,"size":91,"distinct_size":0,"ref":"refs/heads/aosp/upstream-linux-4.14.y","head":"7fe7a0f4c5cf9e7f5b7cb67c1341cdbf62ed4c30","before":"ee13f7edca5838436feefde90ed1b2ebb07c4184","commits":[{"sha":"54c0fa829d45f9ad40e40a47d7a899d47dc23569","author":{"name":"Alexander Aring","email":"ba808db1f0229249f457f37e430afe76c4cd3e95@mojatatu.com"},"message":"net: 6lowpan: fix reserved space for single frames\n\ncommit ac74f87c789af40936a80131c4759f3e72579c3a upstream.\n\nThis patch fixes patch add handling to take care tail and headroom for\nsingle 6lowpan frames. We need to be sure we have a skb with the right\nhead and tailroom for single frames. This patch do it by using\nskb_copy_expand() if head and tailroom is not enough allocated by upper\nlayer.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195059\nReported-by: David Palma <david.palma@ntnu.no>\nReported-by: Rabi Narayan Sahoo <rabinarayans0828@gmail.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Alexander Aring <aring@mojatatu.com>\nSigned-off-by: Stefan Schmidt <stefan@datenfreihafen.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/54c0fa829d45f9ad40e40a47d7a899d47dc23569"},{"sha":"4a2262972b5dab51e1e09dee8992d29b4946c1ab","author":{"name":"Alexander Aring","email":"ba808db1f0229249f457f37e430afe76c4cd3e95@mojatatu.com"},"message":"net: mac802154: tx: expand tailroom if necessary\n\ncommit f9c52831133050c6b82aa8b6831c92da2bbf2a0b upstream.\n\nThis patch is necessary if case of AF_PACKET or other socket interface\nwhich I am aware of it and didn't allocated the necessary room.\n\nReported-by: David Palma <david.palma@ntnu.no>\nReported-by: Rabi Narayan Sahoo <rabinarayans0828@gmail.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Alexander Aring <aring@mojatatu.com>\nSigned-off-by: Stefan Schmidt <stefan@datenfreihafen.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/4a2262972b5dab51e1e09dee8992d29b4946c1ab"},{"sha":"4d3016e56c3d2fdbd5b1a984c4316da3cfbf63a9","author":{"name":"Chirantan Ekbote","email":"35787c0e27de5c48735e07f8324823b765e8bcbc@chromium.org"},"message":"9p/net: Fix zero-copy path in the 9p virtio transport\n\ncommit d28c756caee6e414d9ba367d0b92da24145af2a8 upstream.\n\nThe zero-copy optimization when reading or writing large chunks of data\nis quite useful.  However, the 9p messages created through the zero-copy\nwrite path have an incorrect message size: it should be the size of the\nheader + size of the data being written but instead it's just the size\nof the header.\n\nThis only works if the server ignores the size field of the message and\notherwise breaks the framing of the protocol. Fix this by re-writing the\nmessage size field with the correct value.\n\nTested by running `dd if=/dev/zero of=out bs=4k count=1` inside a\nvirtio-9p mount.\n\nLink: http://lkml.kernel.org/r/20180717003529.114368-1-chirantan@chromium.org\nSigned-off-by: Chirantan Ekbote <chirantan@chromium.org>\nReviewed-by: Greg Kurz <groug@kaod.org>\nTested-by: Greg Kurz <groug@kaod.org>\nCc: Dylan Reid <dgreid@chromium.org>\nCc: Guenter Roeck <groeck@chromium.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Dominique Martinet <dominique.martinet@cea.fr>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/4d3016e56c3d2fdbd5b1a984c4316da3cfbf63a9"},{"sha":"aa1d05c504832dbb17855dd4bd858b1cb263ca7b","author":{"name":"Bartosz Golaszewski","email":"e5d45fddd9040473413b909b802f629a971ad04c@baylibre.com"},"message":"spi: davinci: fix a NULL pointer dereference\n\ncommit 563a53f3906a6b43692498e5b3ae891fac93a4af upstream.\n\nOn non-OF systems spi->controlled_data may be NULL. This causes a NULL\npointer derefence on dm365-evm.\n\nSigned-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/aa1d05c504832dbb17855dd4bd858b1cb263ca7b"},{"sha":"23554cab1ebdd2bb1c1cde5bbb3d3064a85bb131","author":{"name":"Mika Westerberg","email":"afb75201fb002d7fdd2b0b231e006999e00db8a9@linux.intel.com"},"message":"spi: pxa2xx: Add support for Intel Ice Lake\n\ncommit 22d71a5097ec7059b6cbbee678a4f88484695941 upstream.\n\nIntel Ice Lake SPI host controller follows the Intel Cannon Lake but the\nPCI IDs are different. Add the new PCI IDs to the driver supported\ndevices list.\n\nSigned-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>\nSigned-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/23554cab1ebdd2bb1c1cde5bbb3d3064a85bb131"},{"sha":"dc9a7dd57f63e56dcba88565c57cde7b55efb329","author":{"name":"Krzysztof Kozlowski","email":"207922aea7c6c304bf821a3c657354765d4ec2a5@kernel.org"},"message":"spi: spi-fsl-dspi: Fix imprecise abort on VF500 during probe\n\ncommit d8ffee2f551a627ffb7b216e2da322cb9a037f77 upstream.\n\nRegisters of DSPI should not be accessed before enabling its clock.  On\nToradex Colibri VF50 on Iris carrier board this could be seen during\nbootup as imprecise abort:\n\n    Unhandled fault: imprecise external abort (0x1c06) at 0x00000000\n    Internal error: : 1c06 [#1] ARM\n    Modules linked in:\n    CPU: 0 PID: 1 Comm: swapper Not tainted 4.14.39-dirty #97\n    Hardware name: Freescale Vybrid VF5xx/VF6xx (Device Tree)\n    Backtrace:\n    [<804166a8>] (regmap_write) from [<80466b5c>] (dspi_probe+0x1f0/0x8dc)\n    [<8046696c>] (dspi_probe) from [<8040107c>] (platform_drv_probe+0x54/0xb8)\n    [<80401028>] (platform_drv_probe) from [<803ff53c>] (driver_probe_device+0x280/0x2f8)\n    [<803ff2bc>] (driver_probe_device) from [<803ff674>] (__driver_attach+0xc0/0xc4)\n    [<803ff5b4>] (__driver_attach) from [<803fd818>] (bus_for_each_dev+0x70/0xa4)\n    [<803fd7a8>] (bus_for_each_dev) from [<803fee74>] (driver_attach+0x24/0x28)\n    [<803fee50>] (driver_attach) from [<803fe980>] (bus_add_driver+0x1a0/0x218)\n    [<803fe7e0>] (bus_add_driver) from [<803fffe8>] (driver_register+0x80/0x100)\n    [<803fff68>] (driver_register) from [<80400fdc>] (__platform_driver_register+0x48/0x50)\n    [<80400f94>] (__platform_driver_register) from [<8091cf7c>] (fsl_dspi_driver_init+0x1c/0x20)\n    [<8091cf60>] (fsl_dspi_driver_init) from [<8010195c>] (do_one_initcall+0x4c/0x174)\n    [<80101910>] (do_one_initcall) from [<80900e8c>] (kernel_init_freeable+0x144/0x1d8)\n    [<80900d48>] (kernel_init_freeable) from [<805ff6a8>] (kernel_init+0x10/0x114)\n    [<805ff698>] (kernel_init) from [<80107be8>] (ret_from_fork+0x14/0x2c)\n\nCc: <stable@vger.kernel.org>\nFixes: 5ee67b587a2b (\"spi: dspi: clear SPI_SR before enable interrupt\")\nSigned-off-by: Krzysztof Kozlowski <krzk@kernel.org>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/dc9a7dd57f63e56dcba88565c57cde7b55efb329"},{"sha":"e7b6b3699b97a1e6b1ad31cd7c611dd92685c399","author":{"name":"Janek Kotas","email":"8d505c59f2d5b2bc973acee1119d9c600b12afd1@cadence.com"},"message":"spi: cadence: Change usleep_range() to udelay(), for atomic context\n\ncommit 931c4e9a72ae91d59c5332ffb6812911a749da8e upstream.\n\nThe path \"spi: cadence: Add usleep_range() for\ncdns_spi_fill_tx_fifo()\" added a usleep_range() function call,\nwhich cannot be used in atomic context.\nHowever the cdns_spi_fill_tx_fifo() function can be called during\nan interrupt which may result in a kernel panic:\n\nBUG: scheduling while atomic: grep/561/0x00010002\nModules linked in:\nPreemption disabled at:\n[<ffffff800858ea28>] wait_for_common+0x48/0x178\nCPU: 0 PID: 561 Comm: grep Not tainted 4.17.0 #1\nHardware name: Cadence CSP (DT)\nCall trace:\n dump_backtrace+0x0/0x198\n show_stack+0x14/0x20\n dump_stack+0x8c/0xac\n __schedule_bug+0x6c/0xb8\n __schedule+0x570/0x5d8\n schedule+0x34/0x98\n schedule_hrtimeout_range_clock+0x98/0x110\n schedule_hrtimeout_range+0x10/0x18\n usleep_range+0x64/0x98\n cdns_spi_fill_tx_fifo+0x70/0xb0\n cdns_spi_irq+0xd0/0xe0\n __handle_irq_event_percpu+0x9c/0x128\n handle_irq_event_percpu+0x34/0x88\n handle_irq_event+0x48/0x78\n handle_fasteoi_irq+0xbc/0x1b0\n generic_handle_irq+0x24/0x38\n __handle_domain_irq+0x84/0xf8\n gic_handle_irq+0xc4/0x180\n\nThis patch replaces the function call with udelay() which can be\nused in an atomic context, like an interrupt.\n\nSigned-off-by: Jan Kotas <jank@cadence.com>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/e7b6b3699b97a1e6b1ad31cd7c611dd92685c399"},{"sha":"8513c01ae15f5ec456dda387e44317752c8da544","author":{"name":"Sergei Shtylyov","email":"d8c69075be49b0738b690ec4af0e9025b8c97c9e@cogentembedded.com"},"message":"mmc: renesas_sdhi_internal_dmac: fix #define RST_RESERVED_BITS\n\ncommit 9faf870e559a710c44e747ba20383ea82d8ac5d2 upstream.\n\nThe DM_CM_RST register actually has bits 0-31 defaulting to 1s and bits\n32-63 defaulting to 0s -- fix off-by-one in #define RST_RESERVED_BITS.\n\nSigned-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>\nReviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>\nFixes: 2a68ea7896e3 (\"mmc: renesas-sdhi: add support for R-Car Gen3 SDHI DMAC\")\nCc: stable@vger.kernel.org # v4.14+\nSigned-off-by: Ulf Hansson <ulf.hansson@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/8513c01ae15f5ec456dda387e44317752c8da544"},{"sha":"cf12d0f9c0dc9129f08490390d14ee4d9dbf6ebb","author":{"name":"Markus Stockhausen","email":"d8f99c7deebb24dffaf2a07d60cc7b250d71e320@collogia.de"},"message":"readahead: stricter check for bdi io_pages\n\ncommit dc30b96ab6d569060741572cf30517d3179429a8 upstream.\n\nondemand_readahead() checks bdi->io_pages to cap the maximum pages\nthat need to be processed. This works until the readit section. If\nwe would do an async only readahead (async size = sync size) and\ntarget is at beginning of window we expand the pages by another\nget_next_ra_size() pages. Btrace for large reads shows that kernel\nalways issues a doubled size read at the beginning of processing.\nAdd an additional check for io_pages in the lower part of the func.\nThe fix helps devices that hard limit bio pages and rely on proper\nhandling of max_hw_read_sectors (e.g. older FusionIO cards). For\nthat reason it could qualify for stable.\n\nFixes: 9491ae4a (\"mm: don't cap request size based on read-ahead setting\")\nCc: stable@vger.kernel.org\nSigned-off-by: Markus Stockhausen stockhausen@collogia.de\nSigned-off-by: Jens Axboe <axboe@kernel.dk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/cf12d0f9c0dc9129f08490390d14ee4d9dbf6ebb"},{"sha":"0affbaece6d0b7c75c5166732d0481ae9a28be60","author":{"name":"xiao jin","email":"48a198def0f21664e558e5b3d0e0635a55586a3b@intel.com"},"message":"block: blk_init_allocated_queue() set q->fq as NULL in the fail case\n\ncommit 54648cf1ec2d7f4b6a71767799c45676a138ca24 upstream.\n\nWe find the memory use-after-free issue in __blk_drain_queue()\non the kernel 4.14. After read the latest kernel 4.18-rc6 we\nthink it has the same problem.\n\nMemory is allocated for q->fq in the blk_init_allocated_queue().\nIf the elevator init function called with error return, it will\nrun into the fail case to free the q->fq.\n\nThen the __blk_drain_queue() uses the same memory after the free\nof the q->fq, it will lead to the unpredictable event.\n\nThe patch is to set q->fq as NULL in the fail case of\nblk_init_allocated_queue().\n\nFixes: commit 7c94e1c157a2 (\"block: introduce blk_flush_queue to drive flush machinery\")\nCc: <stable@vger.kernel.org>\nReviewed-by: Ming Lei <ming.lei@redhat.com>\nReviewed-by: Bart Van Assche <bart.vanassche@wdc.com>\nSigned-off-by: xiao jin <jin.xiao@intel.com>\nSigned-off-by: Jens Axboe <axboe@kernel.dk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/0affbaece6d0b7c75c5166732d0481ae9a28be60"},{"sha":"1e2698976822852b67c2dc11b2ebc2febc25955c","author":{"name":"Ming Lei","email":"8d0fc11caeb4659419f0ba3104eb4a9d30848d42@redhat.com"},"message":"block: really disable runtime-pm for blk-mq\n\ncommit b233f127042dba991229e3882c6217c80492f6ef upstream.\n\nRuntime PM isn't ready for blk-mq yet, and commit 765e40b675a9 (\"block:\ndisable runtime-pm for blk-mq\") tried to disable it. Unfortunately,\nit can't take effect in that way since user space still can switch\nit on via 'echo auto > /sys/block/sdN/device/power/control'.\n\nThis patch disables runtime-pm for blk-mq really by pm_runtime_disable()\nand fixes all kinds of PM related kernel crash.\n\nCc: Tomas Janousek <tomi@nomi.cz>\nCc: Przemek Socha <soprwa@gmail.com>\nCc: Alan Stern <stern@rowland.harvard.edu>\nCc: <stable@vger.kernel.org>\nReviewed-by: Bart Van Assche <bart.vanassche@wdc.com>\nReviewed-by: Christoph Hellwig <hch@lst.de>\nTested-by: Patrick Steinhardt <ps@pks.im>\nSigned-off-by: Ming Lei <ming.lei@redhat.com>\nSigned-off-by: Jens Axboe <axboe@kernel.dk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/1e2698976822852b67c2dc11b2ebc2febc25955c"},{"sha":"7188f7416438a34412a6702f548f81be9e2cf56c","author":{"name":"Matthew Auld","email":"71362f95c6482d276b11892231b77396859a8c9e@intel.com"},"message":"drm/i915/userptr: reject zero user_size\n\ncommit c11c7bfd213495784b22ef82a69b6489f8d0092f upstream.\n\nOperating on a zero sized GEM userptr object will lead to explosions.\n\nFixes: 5cc9ed4b9a7a (\"drm/i915: Introduce mapping of user pages into video memory (userptr) ioctl\")\nTestcase: igt/gem_userptr_blits/input-checking\nSigned-off-by: Matthew Auld <matthew.auld@intel.com>\nCc: Chris Wilson <chris@chris-wilson.co.uk>\nReviewed-by: Chris Wilson <chris@chris-wilson.co.uk>\nSigned-off-by: Chris Wilson <chris@chris-wilson.co.uk>\nLink: https://patchwork.freedesktop.org/patch/msgid/20180502195021.30900-1-matthew.auld@intel.com\nCc: Loic <hackurx@opensec.fr>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/7188f7416438a34412a6702f548f81be9e2cf56c"},{"sha":"fba6b7f4bbe24c45c62172d8f1a450cbe4ec8dc6","author":{"name":"Daniel Mack","email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@zonque.org"},"message":"libertas: fix suspend and resume for SDIO connected cards\n\ncommit 7444a8092906ed44c09459780c56ba57043e39b1 upstream.\n\nPrior to commit 573185cc7e64 (\"mmc: core: Invoke sdio func driver's PM\ncallbacks from the sdio bus\"), the MMC core used to call into the power\nmanagement functions of SDIO clients itself and removed the card if the\nreturn code was non-zero. IOW, the mmc handled errors gracefully and didn't\nupchain them to the pm core.\n\nSince this change, the mmc core relies on generic power management\nfunctions which treat all errors as a reason to cancel the suspend\nimmediately. This causes suspend attempts to fail when the libertas\ndriver is loaded.\n\nTo fix this, power down the card explicitly in if_sdio_suspend() when we\nknow we're about to lose power and return success. Also set a flag in these\ncases, and power up the card again in if_sdio_resume().\n\nFixes: 573185cc7e64 (\"mmc: core: Invoke sdio func driver's PM callbacks from the sdio bus\")\nCc: <stable@vger.kernel.org>\nSigned-off-by: Daniel Mack <daniel@zonque.org>\nReviewed-by: Chris Ball <chris@printf.net>\nReviewed-by: Ulf Hansson <ulf.hansson@linaro.org>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/fba6b7f4bbe24c45c62172d8f1a450cbe4ec8dc6"},{"sha":"c160382ab064ae53c4a939aa6a8989bf553f77f7","author":{"name":"Javier Martinez Canillas","email":"8fdf2abf85d34ea8f3f979ef25dc1f25d94aca29@redhat.com"},"message":"media: Revert \"[media] tvp5150: fix pad format frame height\"\n\ncommit 1831af092308aa5a59ae61e47494e441c8be6b93 upstream.\n\nThis reverts commit 0866df8dffd514185bfab0d205db76e4c02cf1e4.\n\nThe v4l uAPI documentation [0] makes clear that in the case of interlaced\nvideo (i.e: field is V4L2_FIELD_ALTERNATE) the height refers to the number\nof lines in the field and not the number of lines in the full frame (which\nis twice the field height for interlaced formats).\n\nSo the original height calculation was correct, and it shouldn't had been\nchanged by the mentioned commit.\n\n[0]:https://linuxtv.org/downloads/v4l-dvb-apis/uapi/v4l/subdev-formats.html\n\nFixes: 0866df8dffd5 (\"[media] tvp5150: fix pad format frame height\")\n\nSigned-off-by: Javier Martinez Canillas <javierm@redhat.com>\nCc: <stable@vger.kernel.org>      # for v4.12 and up\nSigned-off-by: Hans Verkuil <hans.verkuil@cisco.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/c160382ab064ae53c4a939aa6a8989bf553f77f7"},{"sha":"9cbb32610233e3531ec74e17b44d702c1ca353f0","author":{"name":"Gustavo A. R. Silva","email":"beac5f8171fcde5e2ec734cc5d25d03e7362e8de@embeddedor.com"},"message":"mailbox: xgene-slimpro: Fix potential NULL pointer dereference\n\ncommit 3512a18cbd8d09e22a790540cb9624c3c49827ba upstream.\n\nThere is a potential execution path in which function\nplatform_get_resource() returns NULL. If this happens,\nwe will end up having a NULL pointer dereference.\n\nFix this by replacing devm_ioremap with devm_ioremap_resource,\nwhich has the NULL check and the memory region request.\n\nThis code was detected with the help of Coccinelle.\n\nCc: stable@vger.kernel.org\nFixes: f700e84f417b (\"mailbox: Add support for APM X-Gene platform mailbox driver\")\nSigned-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>\nSigned-off-by: Jassi Brar <jaswinder.singh@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/9cbb32610233e3531ec74e17b44d702c1ca353f0"},{"sha":"f70805bef73eda436ad664deab818b3291cc8407","author":{"name":"Yannik Sembritzki","email":"d043d3f3e5fe8ed8612f4161b09da9ebfdf9a97c@sembritzki.me"},"message":"Replace magic for trusting the secondary keyring with #define\n\ncommit 817aef260037f33ee0f44c17fe341323d3aebd6d upstream.\n\nReplace the use of a magic number that indicates that verify_*_signature()\nshould use the secondary keyring with a symbol.\n\nSigned-off-by: Yannik Sembritzki <yannik@sembritzki.me>\nSigned-off-by: David Howells <dhowells@redhat.com>\nCc: keyrings@vger.kernel.org\nCc: linux-security-module@vger.kernel.org\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/f70805bef73eda436ad664deab818b3291cc8407"},{"sha":"259c5122f3a80036a2e9774260a5bfecbeac7f76","author":{"name":"Yannik Sembritzki","email":"d043d3f3e5fe8ed8612f4161b09da9ebfdf9a97c@sembritzki.me"},"message":"Fix kexec forbidding kernels signed with keys in the secondary keyring to boot\n\ncommit ea93102f32244e3f45c8b26260be77ed0cc1d16c upstream.\n\nThe split of .system_keyring into .builtin_trusted_keys and\n.secondary_trusted_keys broke kexec, thereby preventing kernels signed by\nkeys which are now in the secondary keyring from being kexec'd.\n\nFix this by passing VERIFY_USE_SECONDARY_KEYRING to\nverify_pefile_signature().\n\nFixes: d3bfe84129f6 (\"certs: Add a secondary system keyring that can be added to dynamically\")\nSigned-off-by: Yannik Sembritzki <yannik@sembritzki.me>\nSigned-off-by: David Howells <dhowells@redhat.com>\nCc: kexec@lists.infradead.org\nCc: keyrings@vger.kernel.org\nCc: linux-security-module@vger.kernel.org\nCc: stable@kernel.org\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/259c5122f3a80036a2e9774260a5bfecbeac7f76"},{"sha":"ed53c0ecc959c0f3941324b03231c07e1e4afa64","author":{"name":"Hari Bathini","email":"8c08e0cbfdd898a4d11cb688ad22c29e30def136@linux.ibm.com"},"message":"powerpc/fadump: handle crash memory ranges array index overflow\n\ncommit 1bd6a1c4b80a28d975287630644e6b47d0f977a5 upstream.\n\nCrash memory ranges is an array of memory ranges of the crashing kernel\nto be exported as a dump via /proc/vmcore file. The size of the array\nis set based on INIT_MEMBLOCK_REGIONS, which works alright in most cases\nwhere memblock memory regions count is less than INIT_MEMBLOCK_REGIONS\nvalue. But this count can grow beyond INIT_MEMBLOCK_REGIONS value since\ncommit 142b45a72e22 (\"memblock: Add array resizing support\").\n\nOn large memory systems with a few DLPAR operations, the memblock memory\nregions count could be larger than INIT_MEMBLOCK_REGIONS value. On such\nsystems, registering fadump results in crash or other system failures\nlike below:\n\n  task: c00007f39a290010 ti: c00000000b738000 task.ti: c00000000b738000\n  NIP: c000000000047df4 LR: c0000000000f9e58 CTR: c00000000010f180\n  REGS: c00000000b73b570 TRAP: 0300   Tainted: G          L   X  (4.4.140+)\n  MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE>  CR: 22004484  XER: 20000000\n  CFAR: c000000000008500 DAR: 000007a450000000 DSISR: 40000000 SOFTE: 0\n  ...\n  NIP [c000000000047df4] smp_send_reschedule+0x24/0x80\n  LR [c0000000000f9e58] resched_curr+0x138/0x160\n  Call Trace:\n    resched_curr+0x138/0x160 (unreliable)\n    check_preempt_curr+0xc8/0xf0\n    ttwu_do_wakeup+0x38/0x150\n    try_to_wake_up+0x224/0x4d0\n    __wake_up_common+0x94/0x100\n    ep_poll_callback+0xac/0x1c0\n    __wake_up_common+0x94/0x100\n    __wake_up_sync_key+0x70/0xa0\n    sock_def_readable+0x58/0xa0\n    unix_stream_sendmsg+0x2dc/0x4c0\n    sock_sendmsg+0x68/0xa0\n    ___sys_sendmsg+0x2cc/0x2e0\n    __sys_sendmsg+0x5c/0xc0\n    SyS_socketcall+0x36c/0x3f0\n    system_call+0x3c/0x100\n\nas array index overflow is not checked for while setting up crash memory\nranges causing memory corruption. To resolve this issue, dynamically\nallocate memory for crash memory ranges and resize it incrementally,\nin units of pagesize, on hitting array size limit.\n\nFixes: 2df173d9e85d (\"fadump: Initialize elfcore header and add PT_LOAD program headers.\")\nCc: stable@vger.kernel.org # v3.4+\nSigned-off-by: Hari Bathini <hbathini@linux.ibm.com>\nReviewed-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>\n[mpe: Just use PAGE_SIZE directly, fixup variable placement]\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/ed53c0ecc959c0f3941324b03231c07e1e4afa64"},{"sha":"4bfd910e8fb3b86660243ac0cf1b31df842b54b2","author":{"name":"Mahesh Salgaonkar","email":"6a890e1065a1d4e8df9dcf1d9a2c9c740bbcf8aa@linux.vnet.ibm.com"},"message":"powerpc/pseries: Fix endianness while restoring of r3 in MCE handler.\n\ncommit cd813e1cd7122f2c261dce5b54d1e0c97f80e1a5 upstream.\n\nDuring Machine Check interrupt on pseries platform, register r3 points\nRTAS extended event log passed by hypervisor. Since hypervisor uses r3\nto pass pointer to rtas log, it stores the original r3 value at the\nstart of the memory (first 8 bytes) pointed by r3. Since hypervisor\nstores this info and rtas log is in BE format, linux should make\nsure to restore r3 value in correct endian format.\n\nWithout this patch when MCE handler, after recovery, returns to code that\nthat caused the MCE may end up with Data SLB access interrupt for invalid\naddress followed by kernel panic or hang.\n\n  Severe Machine check interrupt [Recovered]\n    NIP [d00000000ca301b8]: init_module+0x1b8/0x338 [bork_kernel]\n    Initiator: CPU\n    Error type: SLB [Multihit]\n      Effective address: d00000000ca70000\n  cpu 0xa: Vector: 380 (Data SLB Access) at [c0000000fc7775b0]\n      pc: c0000000009694c0: vsnprintf+0x80/0x480\n      lr: c0000000009698e0: vscnprintf+0x20/0x60\n      sp: c0000000fc777830\n     msr: 8000000002009033\n     dar: a803a30c000000d0\n    current = 0xc00000000bc9ef00\n    paca    = 0xc00000001eca5c00\t softe: 3\t irq_happened: 0x01\n      pid   = 8860, comm = insmod\n  vscnprintf+0x20/0x60\n  vprintk_emit+0xb4/0x4b0\n  vprintk_func+0x5c/0xd0\n  printk+0x38/0x4c\n  init_module+0x1c0/0x338 [bork_kernel]\n  do_one_initcall+0x54/0x230\n  do_init_module+0x8c/0x248\n  load_module+0x12b8/0x15b0\n  sys_finit_module+0xa8/0x110\n  system_call+0x58/0x6c\n  --- Exception: c00 (System Call) at 00007fff8bda0644\n  SP (7fffdfbfe980) is in userspace\n\nThis patch fixes this issue.\n\nFixes: a08a53ea4c97 (\"powerpc/le: Enable RTAS events support\")\nCc: stable@vger.kernel.org # v3.15+\nReviewed-by: Nicholas Piggin <npiggin@gmail.com>\nSigned-off-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/4bfd910e8fb3b86660243ac0cf1b31df842b54b2"},{"sha":"15677df25afc6e4d27731c9c47888807588f7ffc","author":{"name":"Frederick Lawler","email":"31017a722665e4afce586950f42944a6d331dabf@fredlawl.com"},"message":"PCI: Add wrappers for dev_printk()\n\ncommit 7506dc7989933235e6fc23f3d0516bdbf0f7d1a8 upstream.\n\nAdd PCI-specific dev_printk() wrappers and use them to simplify the code\nslightly.  No functional change intended.\n\nSigned-off-by: Frederick Lawler <fred@fredlawl.com>\n[bhelgaas: squash into one patch]\nSigned-off-by: Bjorn Helgaas <bhelgaas@google.com>\n[only take the pci.h portion of this patch, to make backporting stuff\neasier over time - gregkh]\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/15677df25afc6e4d27731c9c47888807588f7ffc"}]}
{"actor":{"display_login":"blissgerrit"}}