{"push_id":2779807214,"size":124,"distinct_size":1,"ref":"refs/heads/aosp-common/android-4.4-o","head":"9c23e9b14b3568de635456cf55d035c915051e3f","before":"bb8e9d98a7b4cc474bce2f7ab696c0a65c93ddbd","commits":[{"sha":"97e066123dc69bd3bca36794a0f75989e97a04fe","author":{"name":"Paul Burton","email":"85f1bffadddedccfafc0ae065a06aa636075387f@mips.com"},"message":"MIPS: Fix off-by-one in pci_resource_to_user()\n\ncommit 38c0a74fe06da3be133cae3fb7bde6a9438e698b upstream.\n\nThe MIPS implementation of pci_resource_to_user() introduced in v3.12 by\ncommit 4c2924b725fb (\"MIPS: PCI: Use pci_resource_to_user to map pci\nmemory space properly\") incorrectly sets *end to the address of the\nbyte after the resource, rather than the last byte of the resource.\n\nThis results in userland seeing resources as a byte larger than they\nactually are, for example a 32 byte BAR will be reported by a tool such\nas lspci as being 33 bytes in size:\n\n    Region 2: I/O ports at 1000 [disabled] [size=33]\n\nCorrect this by subtracting one from the calculated end address,\nreporting the correct address to userland.\n\nSigned-off-by: Paul Burton <paul.burton@mips.com>\nReported-by: Rui Wang <rui.wang@windriver.com>\nFixes: 4c2924b725fb (\"MIPS: PCI: Use pci_resource_to_user to map pci memory space properly\")\nCc: James Hogan <jhogan@kernel.org>\nCc: Ralf Baechle <ralf@linux-mips.org>\nCc: Wolfgang Grandegger <wg@grandegger.com>\nCc: linux-mips@linux-mips.org\nCc: stable@vger.kernel.org # v3.12+\nPatchwork: https://patchwork.linux-mips.org/patch/19829/\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/97e066123dc69bd3bca36794a0f75989e97a04fe"},{"sha":"1e2e0c65b5fcb13328fa4387663148040ae28d5a","author":{"name":"Donald Shanty III","email":"877571fd6e38c5a1556fe09ae84afca790c5339c@protonmail.com"},"message":"Input: elan_i2c - add ACPI ID for lenovo ideapad 330\n\ncommit 938f45008d8bc391593c97508bc798cc95a52b9b upstream.\n\nThis allows Elan driver to bind to the touchpad found in Lenovo Ideapad 330\nseries laptops.\n\nSigned-off-by: Donald Shanty III <dshanty@protonmail.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/1e2e0c65b5fcb13328fa4387663148040ae28d5a"},{"sha":"8fe1c0b7af711ff6b2e5ed17edb3128b5b66d924","author":{"name":"Chen-Yu Tsai","email":"11e8bbde1bc9e0af703df23be02afe58864a4a18@csie.org"},"message":"Input: i8042 - add Lenovo LaVie Z to the i8042 reset list\n\ncommit 384cf4285b34e08917e3e66603382f2b0c4f6e1b upstream.\n\nThe Lenovo LaVie Z laptop requires i8042 to be reset in order to\nconsistently detect its Elantech touchpad. The nomux and kbdreset\nquirks are not sufficient.\n\nIt's possible the other LaVie Z models from NEC require this as well.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Chen-Yu Tsai <wens@csie.org>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/8fe1c0b7af711ff6b2e5ed17edb3128b5b66d924"},{"sha":"0179b1b364243aca8001ef1fbd51a1d4349547c5","author":{"name":"KT Liao","email":"8cbe3708fba0ad3ba0de70fc8acb4885a3f33fba@emc.com.tw"},"message":"Input: elan_i2c - add another ACPI ID for Lenovo Ideapad 330-15AST\n\ncommit 6f88a6439da5d94de334a341503bc2c7f4a7ea7f upstream.\n\nAdd ELAN0622 to ACPI mapping table to support Elan touchpad found in\nIdeapad 330-15AST.\n\nSigned-off-by: KT Liao <kt.liao@emc.com.tw>\nReported-by: Anant Shende <anantshende@gmail.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/0179b1b364243aca8001ef1fbd51a1d4349547c5"},{"sha":"b80091b0113c931894c87b034048f8677a53fe9f","author":{"name":"Steven Rostedt (VMware)","email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org"},"message":"tracing: Fix double free of event_trigger_data\n\ncommit 1863c387259b629e4ebfb255495f67cd06aa229b upstream.\n\nRunning the following:\n\n # cd /sys/kernel/debug/tracing\n # echo 500000 > buffer_size_kb\n[ Or some other number that takes up most of memory ]\n # echo snapshot > events/sched/sched_switch/trigger\n\nTriggers the following bug:\n\n ------------[ cut here ]------------\n kernel BUG at mm/slub.c:296!\n invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI\n CPU: 6 PID: 6878 Comm: bash Not tainted 4.18.0-rc6-test+ #1066\n Hardware name: Hewlett-Packard HP Compaq Pro 6300 SFF/339A, BIOS K01 v03.03 07/14/2016\n RIP: 0010:kfree+0x16c/0x180\n Code: 05 41 0f b6 72 51 5b 5d 41 5c 4c 89 d7 e9 ac b3 f8 ff 48 89 d9 48 89 da 41 b8 01 00 00 00 5b 5d 41 5c 4c 89 d6 e9 f4 f3 ff ff <0f> 0b 0f 0b 48 8b 3d d9 d8 f9 00 e9 c1 fe ff ff 0f 1f 40 00 0f 1f\n RSP: 0018:ffffb654436d3d88 EFLAGS: 00010246\n RAX: ffff91a9d50f3d80 RBX: ffff91a9d50f3d80 RCX: ffff91a9d50f3d80\n RDX: 00000000000006a4 RSI: ffff91a9de5a60e0 RDI: ffff91a9d9803500\n RBP: ffffffff8d267c80 R08: 00000000000260e0 R09: ffffffff8c1a56be\n R10: fffff0d404543cc0 R11: 0000000000000389 R12: ffffffff8c1a56be\n R13: ffff91a9d9930e18 R14: ffff91a98c0c2890 R15: ffffffff8d267d00\n FS:  00007f363ea64700(0000) GS:ffff91a9de580000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 000055c1cacc8e10 CR3: 00000000d9b46003 CR4: 00000000001606e0\n Call Trace:\n  event_trigger_callback+0xee/0x1d0\n  event_trigger_write+0xfc/0x1a0\n  __vfs_write+0x33/0x190\n  ? handle_mm_fault+0x115/0x230\n  ? _cond_resched+0x16/0x40\n  vfs_write+0xb0/0x190\n  ksys_write+0x52/0xc0\n  do_syscall_64+0x5a/0x160\n  entry_SYSCALL_64_after_hwframe+0x49/0xbe\n RIP: 0033:0x7f363e16ab50\n Code: 73 01 c3 48 8b 0d 38 83 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 79 db 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 1e e3 01 00 48 89 04 24\n RSP: 002b:00007fff9a4c6378 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f363e16ab50\n RDX: 0000000000000009 RSI: 000055c1cacc8e10 RDI: 0000000000000001\n RBP: 000055c1cacc8e10 R08: 00007f363e435740 R09: 00007f363ea64700\n R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000009\n R13: 0000000000000001 R14: 00007f363e4345e0 R15: 00007f363e4303c0\n Modules linked in: ip6table_filter ip6_tables snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_seq snd_seq_device i915 snd_pcm snd_timer i2c_i801 snd soundcore i2c_algo_bit drm_kms_helper\n86_pkg_temp_thermal video kvm_intel kvm irqbypass wmi e1000e\n ---[ end trace d301afa879ddfa25 ]---\n\nThe cause is because the register_snapshot_trigger() call failed to\nallocate the snapshot buffer, and then called unregister_trigger()\nwhich freed the data that was passed to it. Then on return to the\nfunction that called register_snapshot_trigger(), as it sees it\nfailed to register, it frees the trigger_data again and causes\na double free.\n\nBy calling event_trigger_init() on the trigger_data (which only ups\nthe reference counter for it), and then event_trigger_free() afterward,\nthe trigger_data would not get freed by the registering trigger function\nas it would only up and lower the ref count for it. If the register\ntrigger function fails, then the event_trigger_free() called after it\nwill free the trigger data normally.\n\nLink: http://lkml.kernel.org/r/20180724191331.738eb819@gandalf.local.home\n\nCc: stable@vger.kerne.org\nFixes: 93e31ffbf417 (\"tracing: Add 'snapshot' event trigger command\")\nReported-by: Masami Hiramatsu <mhiramat@kernel.org>\nReviewed-by: Masami Hiramatsu <mhiramat@kernel.org>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/b80091b0113c931894c87b034048f8677a53fe9f"},{"sha":"1a7f63b2a0911df09b4939995e3fe5daeb9753ef","author":{"name":"Steven Rostedt (VMware)","email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org"},"message":"tracing: Fix possible double free in event_enable_trigger_func()\n\ncommit 15cc78644d0075e76d59476a4467e7143860f660 upstream.\n\nThere was a case that triggered a double free in event_trigger_callback()\ndue to the called reg() function freeing the trigger_data and then it\ngetting freed again by the error return by the caller. The solution there\nwas to up the trigger_data ref count.\n\nCode inspection found that event_enable_trigger_func() has the same issue,\nbut is not as easy to trigger (requires harder to trigger failures). It\nneeds to be solved slightly different as it needs more to clean up when the\nreg() function fails.\n\nLink: http://lkml.kernel.org/r/20180725124008.7008e586@gandalf.local.home\n\nCc: stable@vger.kernel.org\nFixes: 7862ad1846e99 (\"tracing: Add 'enable_event' and 'disable_event' event trigger commands\")\nReivewed-by: Masami Hiramatsu <mhiramat@kernel.org>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/1a7f63b2a0911df09b4939995e3fe5daeb9753ef"},{"sha":"d9bbd8076836b1c3e648132afe73185f945b89a7","author":{"name":"Artem Savkov","email":"d63d291a587345cfb191d99b4bf48847a127ac18@redhat.com"},"message":"tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure\n\ncommit 57ea2a34adf40f3a6e88409aafcf803b8945619a upstream.\n\nIf enable_trace_kprobe fails to enable the probe in enable_k(ret)probe\nit returns an error, but does not unset the tp flags it set previously.\nThis results in a probe being considered enabled and failures like being\nunable to remove the probe through kprobe_events file since probes_open()\nexpects every probe to be disabled.\n\nLink: http://lkml.kernel.org/r/20180725102826.8300-1-asavkov@redhat.com\nLink: http://lkml.kernel.org/r/20180725142038.4765-1-asavkov@redhat.com\n\nCc: Ingo Molnar <mingo@redhat.com>\nCc: stable@vger.kernel.org\nFixes: 41a7dd420c57 (\"tracing/kprobes: Support ftrace_event_file base multibuffer\")\nAcked-by: Masami Hiramatsu <mhiramat@kernel.org>\nReviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>\nSigned-off-by: Artem Savkov <asavkov@redhat.com>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/d9bbd8076836b1c3e648132afe73185f945b89a7"},{"sha":"dab04fda26530ee686b14b02aa2c5e716cef153c","author":{"name":"Steven Rostedt (VMware)","email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org"},"message":"tracing: Quiet gcc warning about maybe unused link variable\n\ncommit 2519c1bbe38d7acacc9aacba303ca6f97482ed53 upstream.\n\nCommit 57ea2a34adf4 (\"tracing/kprobes: Fix trace_probe flags on\nenable_trace_kprobe() failure\") added an if statement that depends on another\nif statement that gcc doesn't see will initialize the \"link\" variable and\ngives the warning:\n\n \"warning: 'link' may be used uninitialized in this function\"\n\nIt is really a false positive, but to quiet the warning, and also to make\nsure that it never actually is used uninitialized, initialize the \"link\"\nvariable to NULL and add an if (!WARN_ON_ONCE(!link)) where the compiler\nthinks it could be used uninitialized.\n\nCc: stable@vger.kernel.org\nFixes: 57ea2a34adf4 (\"tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure\")\nReported-by: kbuild test robot <lkp@intel.com>\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/dab04fda26530ee686b14b02aa2c5e716cef153c"},{"sha":"2670ecf4711430d9ee263cad666b6ea2034952d5","author":{"name":"Juergen Gross","email":"29bbaec13092d36559e3abc6f27f7d09c395819f@suse.com"},"message":"xen/netfront: raise max number of slots in xennet_get_responses()\n\n[ Upstream commit 57f230ab04d2910a06d17d988f1c4d7586a59113 ]\n\nThe max number of slots used in xennet_get_responses() is set to\nMAX_SKB_FRAGS + (rx->status <= RX_COPY_THRESHOLD).\n\nIn old kernel-xen MAX_SKB_FRAGS was 18, while nowadays it is 17. This\ndifference is resulting in frequent messages \"too many slots\" and a\nreduced network throughput for some workloads (factor 10 below that of\na kernel-xen based guest).\n\nReplacing MAX_SKB_FRAGS by XEN_NETIF_NR_SLOTS_MIN for calculation of\nthe max number of slots to use solves that problem (tests showed no\nmore messages \"too many slots\" and throughput was as high as with the\nkernel-xen based guest system).\n\nReplace MAX_SKB_FRAGS-2 by XEN_NETIF_NR_SLOTS_MIN-1 in\nnetfront_tx_slot_available() for making it clearer what is really being\ntested without actually modifying the tested value.\n\nSigned-off-by: Juergen Gross <jgross@suse.com>\nReviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/2670ecf4711430d9ee263cad666b6ea2034952d5"},{"sha":"55e526aa96db8a70b69524cbdbb8168a20e4ea38","author":{"name":"Zhouyang Jia","email":"d59eb9a63201f2e21a4695c818c91cfdb09bd961@gmail.com"},"message":"ALSA: emu10k1: add error handling for snd_ctl_add\n\n[ Upstream commit 6d531e7b972cb62ded011c2dfcc2d9f72ea6c421 ]\n\nWhen snd_ctl_add fails, the lack of error-handling code may\ncause unexpected results.\n\nThis patch adds error-handling code after calling snd_ctl_add.\n\nSigned-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/55e526aa96db8a70b69524cbdbb8168a20e4ea38"},{"sha":"8edf67eda05a8aa9d1e1f0d8c3c9f98cd1cb93f7","author":{"name":"Zhouyang Jia","email":"d59eb9a63201f2e21a4695c818c91cfdb09bd961@gmail.com"},"message":"ALSA: fm801: add error handling for snd_ctl_add\n\n[ Upstream commit ef1ffbe7889e99f5b5cccb41c89e5c94f50f3218 ]\n\nWhen snd_ctl_add fails, the lack of error-handling code may\ncause unexpected results.\n\nThis patch adds error-handling code after calling snd_ctl_add.\n\nSigned-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>\nAcked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/8edf67eda05a8aa9d1e1f0d8c3c9f98cd1cb93f7"},{"sha":"e6960af9566e9aeee3db07ac2d6a4f70f5731948","author":{"name":"Scott Mayhew","email":"129700617821125d23e4a9ae8bf609ed655da086@redhat.com"},"message":"nfsd: fix potential use-after-free in nfsd4_decode_getdeviceinfo\n\n[ Upstream commit 3171822fdcdd6e6d536047c425af6dc7a92dc585 ]\n\nWhen running a fuzz tester against a KASAN-enabled kernel, the following\nsplat periodically occurs.\n\nThe problem occurs when the test sends a GETDEVICEINFO request with a\nmalformed xdr array (size but no data) for gdia_notify_types and the\narray size is > 0x3fffffff, which results in an overflow in the value of\nnbytes which is passed to read_buf().\n\nIf the array size is 0x40000000, 0x80000000, or 0xc0000000, then after\nthe overflow occurs, the value of nbytes 0, and when that happens the\npointer returned by read_buf() points to the end of the xdr data (i.e.\nargp->end) when really it should be returning NULL.\n\nFix this by returning NFS4ERR_BAD_XDR if the array size is > 1000 (this\nvalue is arbitrary, but it's the same threshold used by\nnfsd4_decode_bitmap()... in could really be any value >= 1 since it's\nexpected to get at most a single bitmap in gdia_notify_types).\n\n[  119.256854] ==================================================================\n[  119.257611] BUG: KASAN: use-after-free in nfsd4_decode_getdeviceinfo+0x5a4/0x5b0 [nfsd]\n[  119.258422] Read of size 4 at addr ffff880113ada000 by task nfsd/538\n\n[  119.259146] CPU: 0 PID: 538 Comm: nfsd Not tainted 4.17.0+ #1\n[  119.259662] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-1.fc25 04/01/2014\n[  119.261202] Call Trace:\n[  119.262265]  dump_stack+0x71/0xab\n[  119.263371]  print_address_description+0x6a/0x270\n[  119.264609]  kasan_report+0x258/0x380\n[  119.265854]  ? nfsd4_decode_getdeviceinfo+0x5a4/0x5b0 [nfsd]\n[  119.267291]  nfsd4_decode_getdeviceinfo+0x5a4/0x5b0 [nfsd]\n[  119.268549]  ? nfs4svc_decode_compoundargs+0xa5b/0x13c0 [nfsd]\n[  119.269873]  ? nfsd4_decode_sequence+0x490/0x490 [nfsd]\n[  119.271095]  nfs4svc_decode_compoundargs+0xa5b/0x13c0 [nfsd]\n[  119.272393]  ? nfsd4_release_compoundargs+0x1b0/0x1b0 [nfsd]\n[  119.273658]  nfsd_dispatch+0x183/0x850 [nfsd]\n[  119.274918]  svc_process+0x161c/0x31a0 [sunrpc]\n[  119.276172]  ? svc_printk+0x190/0x190 [sunrpc]\n[  119.277386]  ? svc_xprt_release+0x451/0x680 [sunrpc]\n[  119.278622]  nfsd+0x2b9/0x430 [nfsd]\n[  119.279771]  ? nfsd_destroy+0x1c0/0x1c0 [nfsd]\n[  119.281157]  kthread+0x2db/0x390\n[  119.282347]  ? kthread_create_worker_on_cpu+0xc0/0xc0\n[  119.283756]  ret_from_fork+0x35/0x40\n\n[  119.286041] Allocated by task 436:\n[  119.287525]  kasan_kmalloc+0xa0/0xd0\n[  119.288685]  kmem_cache_alloc+0xe9/0x1f0\n[  119.289900]  get_empty_filp+0x7b/0x410\n[  119.291037]  path_openat+0xca/0x4220\n[  119.292242]  do_filp_open+0x182/0x280\n[  119.293411]  do_sys_open+0x216/0x360\n[  119.294555]  do_syscall_64+0xa0/0x2f0\n[  119.295721]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\n[  119.298068] Freed by task 436:\n[  119.299271]  __kasan_slab_free+0x130/0x180\n[  119.300557]  kmem_cache_free+0x78/0x210\n[  119.301823]  rcu_process_callbacks+0x35b/0xbd0\n[  119.303162]  __do_softirq+0x192/0x5ea\n\n[  119.305443] The buggy address belongs to the object at ffff880113ada000\n                which belongs to the cache filp of size 256\n[  119.308556] The buggy address is located 0 bytes inside of\n                256-byte region [ffff880113ada000, ffff880113ada100)\n[  119.311376] The buggy address belongs to the page:\n[  119.312728] page:ffffea00044eb680 count:1 mapcount:0 mapping:0000000000000000 index:0xffff880113ada780\n[  119.314428] flags: 0x17ffe000000100(slab)\n[  119.315740] raw: 0017ffe000000100 0000000000000000 ffff880113ada780 00000001000c0001\n[  119.317379] raw: ffffea0004553c60 ffffea00045c11e0 ffff88011b167e00 0000000000000000\n[  119.319050] page dumped because: kasan: bad access detected\n\n[  119.321652] Memory state around the buggy address:\n[  119.322993]  ffff880113ad9f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[  119.324515]  ffff880113ad9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[  119.326087] >ffff880113ada000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n[  119.327547]                    ^\n[  119.328730]  ffff880113ada080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n[  119.330218]  ffff880113ada100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb\n[  119.331740] ==================================================================\n\nSigned-off-by: Scott Mayhew <smayhew@redhat.com>\nSigned-off-by: J. Bruce Fields <bfields@redhat.com>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/e6960af9566e9aeee3db07ac2d6a4f70f5731948"},{"sha":"b752dfd91a3e9712aa68468b63725c927adcfaa4","author":{"name":"Chintan Pandya","email":"f8ab2c5e1dd93cba379c44b5945c0110170970c1@codeaurora.org"},"message":"mm: vmalloc: avoid racy handling of debugobjects in vunmap\n\n[ Upstream commit f3c01d2f3ade6790db67f80fef60df84424f8964 ]\n\nCurrently, __vunmap flow is,\n 1) Release the VM area\n 2) Free the debug objects corresponding to that vm area.\n\nThis leave some race window open.\n 1) Release the VM area\n 1.5) Some other client gets the same vm area\n 1.6) This client allocates new debug objects on the same\n      vm area\n 2) Free the debug objects corresponding to this vm area.\n\nHere, we actually free 'other' client's debug objects.\n\nFix this by freeing the debug objects first and then releasing the VM\narea.\n\nLink: http://lkml.kernel.org/r/1523961828-9485-2-git-send-email-cpandya@codeaurora.org\nSigned-off-by: Chintan Pandya <cpandya@codeaurora.org>\nReviewed-by: Andrew Morton <akpm@linux-foundation.org>\nCc: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nCc: Byungchul Park <byungchul.park@lge.com>\nCc: Catalin Marinas <catalin.marinas@arm.com>\nCc: Florian Fainelli <f.fainelli@gmail.com>\nCc: Johannes Weiner <hannes@cmpxchg.org>\nCc: Laura Abbott <labbott@redhat.com>\nCc: Vlastimil Babka <vbabka@suse.cz>\nCc: Wei Yang <richard.weiyang@gmail.com>\nCc: Yisheng Xie <xieyisheng1@huawei.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/b752dfd91a3e9712aa68468b63725c927adcfaa4"},{"sha":"3231613224c076ed1f0984e382cbd2df0d64c260","author":{"name":"Mathieu Malaterre","email":"4c3884f3d1d87411d98f0c382fe7d7c73faff4d0@debian.org"},"message":"mm/slub.c: add __printf verification to slab_err()\n\n[ Upstream commit a38965bf941b7c2af50de09c96bc5f03e136caef ]\n\n__printf is useful to verify format and arguments.  Remove the following\nwarning (with W=1):\n\n  mm/slub.c:721:2: warning: function might be possible candidate for `gnu_printf' format attribute [-Wsuggest-attribute=format]\n\nLink: http://lkml.kernel.org/r/20180505200706.19986-1-malat@debian.org\nSigned-off-by: Mathieu Malaterre <malat@debian.org>\nReviewed-by: Andrew Morton <akpm@linux-foundation.org>\nCc: Christoph Lameter <cl@linux.com>\nCc: Pekka Enberg <penberg@kernel.org>\nCc: David Rientjes <rientjes@google.com>\nCc: Joonsoo Kim <iamjoonsoo.kim@lge.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/3231613224c076ed1f0984e382cbd2df0d64c260"},{"sha":"af1ecd4b5f740c30f7ed72bb8af0d7f74cc1b88d","author":{"name":"Alexandre Belloni","email":"a7228e626ecf0022ac91fc1cd8db88e71d0e5e0e@bootlin.com"},"message":"rtc: ensure rtc_set_alarm fails when alarms are not supported\n\n[ Upstream commit abfdff44bc38e9e2ef7929f633fb8462632299d4 ]\n\nWhen using RTC_ALM_SET or RTC_WKALM_SET with rtc_wkalrm.enabled not set,\nrtc_timer_enqueue() is not called and rtc_set_alarm() may succeed but the\nsubsequent RTC_AIE_ON ioctl will fail. RTC_ALM_READ would also fail in that\ncase.\n\nEnsure rtc_set_alarm() fails when alarms are not supported to avoid letting\nprograms think the alarms are working for a particular RTC when they are\nnot.\n\nSigned-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/af1ecd4b5f740c30f7ed72bb8af0d7f74cc1b88d"},{"sha":"d77ff3576f734e5cc457679b8a5e21f413dbb68b","author":{"name":"Jozsef Kadlecsik","email":"5a7b97a838c5f3992292d1fd9e7ad830cc55ada6@blackhole.kfki.hu"},"message":"netfilter: ipset: List timing out entries with \"timeout 1\" instead of zero\n\n[ Upstream commit bd975e691486ba52790ba23cc9b4fecab7bc0d31 ]\n\nWhen listing sets with timeout support, there's a probability that\njust timing out entries with \"0\" timeout value is listed/saved.\nHowever when restoring the saved list, the zero timeout value means\npermanent elelements.\n\nThe new behaviour is that timing out entries are listed with \"timeout 1\"\ninstead of zero.\n\nFixes netfilter bugzilla #1258.\n\nSigned-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/d77ff3576f734e5cc457679b8a5e21f413dbb68b"},{"sha":"52175c849bd4c01dd14038b4401d5044d99a6b0a","author":{"name":"Cong Wang","email":"0f114804888b88d50037b04b42e57b858d851b87@gmail.com"},"message":"infiniband: fix a possible use-after-free bug\n\n[ Upstream commit cb2595c1393b4a5211534e6f0a0fbad369e21ad8 ]\n\nucma_process_join() will free the new allocated \"mc\" struct,\nif there is any error after that, especially the copy_to_user().\n\nBut in parallel, ucma_leave_multicast() could find this \"mc\"\nthrough idr_find() before ucma_process_join() frees it, since it\nis already published.\n\nSo \"mc\" could be used in ucma_leave_multicast() after it is been\nallocated and freed in ucma_process_join(), since we don't refcnt\nit.\n\nFix this by separating \"publish\" from ID allocation, so that we\ncan get an ID first and publish it later after copy_to_user().\n\nFixes: c8f6a362bf3e (\"RDMA/cma: Add multicast communication support\")\nReported-by: Noam Rathaus <noamr@beyondsecurity.com>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: Jason Gunthorpe <jgg@mellanox.com>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/52175c849bd4c01dd14038b4401d5044d99a6b0a"},{"sha":"c48557366d5244b7736b218633c5ef7a55c18f53","author":{"name":"Stewart Smith","email":"ec31ab75ddf977353c8f660f92ea8b23f64aef25@linux.ibm.com"},"message":"hvc_opal: don't set tb_ticks_per_usec in udbg_init_opal_common()\n\n[ Upstream commit 447808bf500a7cc92173266a59f8a494e132b122 ]\n\ntime_init() will set up tb_ticks_per_usec based on reality.\ntime_init() is called *after* udbg_init_opal_common() during boot.\n\nfrom arch/powerpc/kernel/time.c:\n  unsigned long tb_ticks_per_usec = 100; /* sane default */\n\nCurrently, all powernv systems have a timebase frequency of 512mhz\n(512000000/1000000 == 0x200) - although there's nothing written\ndown anywhere that I can find saying that we couldn't make that\ndifferent based on the requirements in the ISA.\n\nSo, we've been (accidentally) thwacking the (currently) correct\n(for powernv at least) value for tb_ticks_per_usec earlier than\nwe otherwise would have.\n\nThe \"sane default\" seems to be adequate for our purposes between\nudbg_init_opal_common() and time_init() being called, and if it isn't,\nthen we should probably be setting it somewhere that isn't hvc_opal.c!\n\nSigned-off-by: Stewart Smith <stewart@linux.ibm.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/c48557366d5244b7736b218633c5ef7a55c18f53"},{"sha":"b5145f8b3506ad25b4c31970057fabca1543b325","author":{"name":"Nicholas Piggin","email":"24829078df5003d9dd1dd871ca2aeb0b1cf95ef4@gmail.com"},"message":"powerpc/64s: Fix compiler store ordering to SLB shadow area\n\n[ Upstream commit 926bc2f100c24d4842b3064b5af44ae964c1d81c ]\n\nThe stores to update the SLB shadow area must be made as they appear\nin the C code, so that the hypervisor does not see an entry with\nmismatched vsid and esid. Use WRITE_ONCE for this.\n\nGCC has been observed to elide the first store to esid in the update,\nwhich means that if the hypervisor interrupts the guest after storing\nto vsid, it could see an entry with old esid and new vsid, which may\npossibly result in memory corruption.\n\nSigned-off-by: Nicholas Piggin <npiggin@gmail.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/b5145f8b3506ad25b4c31970057fabca1543b325"},{"sha":"ded30c95e8588ccdd9f281f36c0d37d7d030ef9d","author":{"name":"Leon Romanovsky","email":"3a465310c772508bcc75a45f7a1a5f22c8be234b@mellanox.com"},"message":"RDMA/mad: Convert BUG_ONs to error flows\n\n[ Upstream commit 2468b82d69e3a53d024f28d79ba0fdb8bf43dfbf ]\n\nLet's perform checks in-place instead of BUG_ONs.\n\nSigned-off-by: Leon Romanovsky <leonro@mellanox.com>\nSigned-off-by: Doug Ledford <dledford@redhat.com>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/ded30c95e8588ccdd9f281f36c0d37d7d030ef9d"}]}
{"actor":{"display_login":"Jackeagle"}}