{"push_id":2664640808,"size":34,"distinct_size":34,"ref":"refs/heads/master-UPSTREAM","head":"10dd432e0dd84312a6c2a99c254093247b53f9b3","before":"b7618ba86fc3cfa9bf4df76f324fd32d98f31f48","commits":[{"sha":"a514ef127b20575022931f575a911f417b418c76","author":{"name":"Zhao Hongjiang","email":"53c9776423caefc096fa111ffb2cce5359356df6@huawei.com"},"message":"aio: fix possible invalid memory access when DEBUG is enabled\n\ncommit 91d80a84bbc8f28375cca7e65ec666577b4209ad upstream.\n\ndprintk() shouldn't access @ring after it's unmapped.\n\nSigned-off-by: Zhao Hongjiang <zhaohongjiang@huawei.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/a514ef127b20575022931f575a911f417b418c76"},{"sha":"4c296b091a577bdc8d6f3b829b5c0babacbb3fb1","author":{"name":"Jiri Slaby","email":"dfbf39eb5bf303a3db5454d815cb8c8888cbadf9@suse.cz"},"message":"TTY: do not update atime/mtime on read/write\n\ncommit b0de59b5733d18b0d1974a060860a8b5c1b36a2e upstream.\n\nOn http://vladz.devzero.fr/013_ptmx-timing.php, we can see how to find\nout length of a password using timestamps of /dev/ptmx. It is\ndocumented in \"Timing Analysis of Keystrokes and Timing Attacks on\nSSH\". To avoid that problem, do not update time when reading\nfrom/writing to a TTY.\n\nI am afraid of regressions as this is a behavior we have since 0.97\nand apps may expect the time to be current, e.g. for monitoring\nwhether there was a change on the TTY. Now, there is no change. So\nthis would better have a lot of testing before it goes upstream.\n\nReferences: CVE-2013-0160\n\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/4c296b091a577bdc8d6f3b829b5c0babacbb3fb1"},{"sha":"2a7d4e4586c409f966c0b608e528aa5d2785ba67","author":{"name":"Jiri Slaby","email":"dfbf39eb5bf303a3db5454d815cb8c8888cbadf9@suse.cz"},"message":"TTY: fix atime/mtime regression\n\ncommit 37b7f3c76595e23257f61bd80b223de8658617ee upstream.\n\nIn commit b0de59b5733d (\"TTY: do not update atime/mtime on read/write\")\nwe removed timestamps from tty inodes to fix a security issue and waited\nif something breaks.  Well, 'w', the utility to find out logged users\nand their inactivity time broke.  It shows that users are inactive since\nthe time they logged in.\n\nTo revert to the old behaviour while still preventing attackers to\nguess the password length, we update the timestamps in one-minute\nintervals by this patch.\n\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/2a7d4e4586c409f966c0b608e528aa5d2785ba67"},{"sha":"8b13839bb10c851ab7714bce80b677eb7c4ab95e","author":{"name":"David S. Miller","email":"fe08d3c717adf2ae63592e4c9aec6e3e404d8e3e@davemloft.net"},"message":"sparc64: Fix race in TLB batch processing.\n\n[ Commits f36391d2790d04993f48da6a45810033a2cdf847 and\n  f0af97070acbad5d6a361f485828223a4faaa0ee upstream. ]\n\nAs reported by Dave Kleikamp, when we emit cross calls to do batched\nTLB flush processing we have a race because we do not synchronize on\nthe sibling cpus completing the cross call.\n\nSo meanwhile the TLB batch can be reset (tb->tlb_nr set to zero, etc.)\nand either flushes are missed or flushes will flush the wrong\naddresses.\n\nFix this by using generic infrastructure to synchonize on the\ncompletion of the cross call.\n\nThis first required getting the flush_tlb_pending() call out from\nswitch_to() which operates with locks held and interrupts disabled.\nThe problem is that smp_call_function_many() cannot be invoked with\nIRQs disabled and this is explicitly checked for with WARN_ON_ONCE().\n\nWe get the batch processing outside of locked IRQ disabled sections by\nusing some ideas from the powerpc port. Namely, we only batch inside\nof arch_{enter,leave}_lazy_mmu_mode() calls.  If we're not in such a\nregion, we flush TLBs synchronously.\n\n1) Get rid of xcall_flush_tlb_pending and per-cpu type\n   implementations.\n\n2) Do TLB batch cross calls instead via:\n\n\tsmp_call_function_many()\n\t\ttlb_pending_func()\n\t\t\t__flush_tlb_pending()\n\n3) Batch only in lazy mmu sequences:\n\n\ta) Add 'active' member to struct tlb_batch\n\tb) Define __HAVE_ARCH_ENTER_LAZY_MMU_MODE\n\tc) Set 'active' in arch_enter_lazy_mmu_mode()\n\td) Run batch and clear 'active' in arch_leave_lazy_mmu_mode()\n\te) Check 'active' in tlb_batch_add_one() and do a synchronous\n           flush if it's clear.\n\n4) Add infrastructure for synchronous TLB page flushes.\n\n\ta) Implement __flush_tlb_page and per-cpu variants, patch\n\t   as needed.\n\tb) Likewise for xcall_flush_tlb_page.\n\tc) Implement smp_flush_tlb_page() to invoke the cross-call.\n\td) Wire up global_flush_tlb_page() to the right routine based\n           upon CONFIG_SMP\n\n5) It turns out that singleton batches are very common, 2 out of every\n   3 batch flushes have only a single entry in them.\n\n   The batch flush waiting is very expensive, both because of the poll\n   on sibling cpu completeion, as well as because passing the tlb batch\n   pointer to the sibling cpus invokes a shared memory dereference.\n\n   Therefore, in flush_tlb_pending(), if there is only one entry in\n   the batch perform a completely asynchronous global_flush_tlb_page()\n   instead.\n\nReported-by: Dave Kleikamp <dave.kleikamp@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nAcked-by: Dave Kleikamp <dave.kleikamp@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/8b13839bb10c851ab7714bce80b677eb7c4ab95e"},{"sha":"26db577656043dc447f24342feaaeaf8f19ab7d3","author":{"name":"Mathias Krause","email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com"},"message":"atm: update msg_namelen in vcc_recvmsg()\n\n[ Upstream commit 9b3e617f3df53822345a8573b6d358f6b9e5ed87 ]\n\nThe current code does not fill the msg_name member in case it is set.\nIt also does not set the msg_namelen member to 0 and therefore makes\nnet/socket.c leak the local, uninitialized sockaddr_storage variable\nto userland -- 128 bytes of kernel stack memory.\n\nFix that by simply setting msg_namelen to 0 as obviously nobody cared\nabout vcc_recvmsg() not filling the msg_name in case it was set.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/26db577656043dc447f24342feaaeaf8f19ab7d3"},{"sha":"a36023ad8818a9281d5a5b7ed4229a98733e9945","author":{"name":"Mathias Krause","email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com"},"message":"ax25: fix info leak via msg_name in ax25_recvmsg()\n\n[ Upstream commit ef3313e84acbf349caecae942ab3ab731471f1a1 ]\n\nWhen msg_namelen is non-zero the sockaddr info gets filled out, as\nrequested, but the code fails to initialize the padding bytes of struct\nsockaddr_ax25 inserted by the compiler for alignment. Additionally the\nmsg_namelen value is updated to sizeof(struct full_sockaddr_ax25) but is\nnot always filled up to this size.\n\nBoth issues lead to the fact that the code will leak uninitialized\nkernel stack bytes in net/socket.c.\n\nFix both issues by initializing the memory with memset(0).\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Ralf Baechle <ralf@linux-mips.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/a36023ad8818a9281d5a5b7ed4229a98733e9945"},{"sha":"09b54949a2e56a649113f9d1e55e4beb93f1aff9","author":{"name":"Mathias Krause","email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com"},"message":"Bluetooth: fix possible info leak in bt_sock_recvmsg()\n\n[ Upstream commit 4683f42fde3977bdb4e8a09622788cc8b5313778 ]\n\nIn case the socket is already shutting down, bt_sock_recvmsg() returns\nwith 0 without updating msg_namelen leading to net/socket.c leaking the\nlocal, uninitialized sockaddr_storage variable to userland -- 128 bytes\nof kernel stack memory.\n\nFix this by moving the msg_namelen assignment in front of the shutdown\ntest.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Marcel Holtmann <marcel@holtmann.org>\nCc: Gustavo Padovan <gustavo@padovan.org>\nCc: Johan Hedberg <johan.hedberg@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/09b54949a2e56a649113f9d1e55e4beb93f1aff9"},{"sha":"92083efda53097e48f11eca7fe5f01d7b06dcff9","author":{"name":"Mathias Krause","email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com"},"message":"Bluetooth: RFCOMM - Fix missing msg_namelen update in rfcomm_sock_recvmsg()\n\n[ Upstream commit e11e0455c0d7d3d62276a0c55d9dfbc16779d691 ]\n\nIf RFCOMM_DEFER_SETUP is set in the flags, rfcomm_sock_recvmsg() returns\nearly with 0 without updating the possibly set msg_namelen member. This,\nin turn, leads to a 128 byte kernel stack leak in net/socket.c.\n\nFix this by updating msg_namelen in this case. For all other cases it\nwill be handled in bt_sock_stream_recvmsg().\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Marcel Holtmann <marcel@holtmann.org>\nCc: Gustavo Padovan <gustavo@padovan.org>\nCc: Johan Hedberg <johan.hedberg@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/92083efda53097e48f11eca7fe5f01d7b06dcff9"},{"sha":"2d08511ffbf2737db2ea5e2a9d95d2026eda079a","author":{"name":"Mathias Krause","email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com"},"message":"caif: Fix missing msg_namelen update in caif_seqpkt_recvmsg()\n\n[ Upstream commit 2d6fbfe733f35c6b355c216644e08e149c61b271 ]\n\nThe current code does not fill the msg_name member in case it is set.\nIt also does not set the msg_namelen member to 0 and therefore makes\nnet/socket.c leak the local, uninitialized sockaddr_storage variable\nto userland -- 128 bytes of kernel stack memory.\n\nFix that by simply setting msg_namelen to 0 as obviously nobody cared\nabout caif_seqpkt_recvmsg() not filling the msg_name in case it was\nset.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Sjur Braendeland <sjur.brandeland@stericsson.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/2d08511ffbf2737db2ea5e2a9d95d2026eda079a"},{"sha":"d17c1262150e2999c6e2fa10fd3a604b77be21ef","author":{"name":"Mathias Krause","email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com"},"message":"irda: Fix missing msg_namelen update in irda_recvmsg_dgram()\n\n[ Upstream commit 5ae94c0d2f0bed41d6718be743985d61b7f5c47d ]\n\nThe current code does not fill the msg_name member in case it is set.\nIt also does not set the msg_namelen member to 0 and therefore makes\nnet/socket.c leak the local, uninitialized sockaddr_storage variable\nto userland -- 128 bytes of kernel stack memory.\n\nFix that by simply setting msg_namelen to 0 as obviously nobody cared\nabout irda_recvmsg_dgram() not filling the msg_name in case it was\nset.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Samuel Ortiz <samuel@sortiz.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/d17c1262150e2999c6e2fa10fd3a604b77be21ef"},{"sha":"8f2ba4aad35d9d56e23d257a0388300240e8c1db","author":{"name":"Mathias Krause","email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com"},"message":"iucv: Fix missing msg_namelen update in iucv_sock_recvmsg()\n\n[ Upstream commit a5598bd9c087dc0efc250a5221e5d0e6f584ee88 ]\n\nThe current code does not fill the msg_name member in case it is set.\nIt also does not set the msg_namelen member to 0 and therefore makes\nnet/socket.c leak the local, uninitialized sockaddr_storage variable\nto userland -- 128 bytes of kernel stack memory.\n\nFix that by simply setting msg_namelen to 0 as obviously nobody cared\nabout iucv_sock_recvmsg() not filling the msg_name in case it was set.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Ursula Braun <ursula.braun@de.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/8f2ba4aad35d9d56e23d257a0388300240e8c1db"},{"sha":"3dcf49208efff4db69fe3639a4272de8c9ad96a6","author":{"name":"Mathias Krause","email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com"},"message":"llc: Fix missing msg_namelen update in llc_ui_recvmsg()\n\n[ Upstream commit c77a4b9cffb6215a15196ec499490d116dfad181 ]\n\nFor stream sockets the code misses to update the msg_namelen member\nto 0 and therefore makes net/socket.c leak the local, uninitialized\nsockaddr_storage variable to userland -- 128 bytes of kernel stack\nmemory. The msg_namelen update is also missing for datagram sockets\nin case the socket is shutting down during receive.\n\nFix both issues by setting msg_namelen to 0 early. It will be\nupdated later if we're going to fill the msg_name member.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/3dcf49208efff4db69fe3639a4272de8c9ad96a6"},{"sha":"6c77cf5a38b8c2411f6b392eebafefbd377d251b","author":{"name":"Mathias Krause","email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com"},"message":"netrom: fix info leak via msg_name in nr_recvmsg()\n\n[ Upstream commits 3ce5efad47b62c57a4f5c54248347085a750ce0e and\n  c802d759623acbd6e1ee9fbdabae89159a513913 ]\n\nIn case msg_name is set the sockaddr info gets filled out, as\nrequested, but the code fails to initialize the padding bytes of\nstruct sockaddr_ax25 inserted by the compiler for alignment. Also\nthe sax25_ndigis member does not get assigned, leaking four more\nbytes.\n\nBoth issues lead to the fact that the code will leak uninitialized\nkernel stack bytes in net/socket.c.\n\nFix both issues by initializing the memory with memset(0).\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Ralf Baechle <ralf@linux-mips.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/6c77cf5a38b8c2411f6b392eebafefbd377d251b"},{"sha":"0bd1b565eefcc1f308e643121ab57284dd0ac039","author":{"name":"Mathias Krause","email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com"},"message":"NFC: llcp: fix info leaks via msg_name in llcp_sock_recvmsg()\n\n[ Upstream commit d26d6504f23e803824e8ebd14e52d4fc0a0b09cb ]\n\nThe code in llcp_sock_recvmsg() does not initialize all the members of\nstruct sockaddr_nfc_llcp when filling the sockaddr info. Nor does it\ninitialize the padding bytes of the structure inserted by the compiler\nfor alignment.\n\nAlso, if the socket is in state LLCP_CLOSED or is shutting down during\nreceive the msg_namelen member is not updated to 0 while otherwise\nreturning with 0, i.e. \"success\". The msg_namelen update is also\nmissing for stream and seqpacket sockets which don't fill the sockaddr\ninfo.\n\nBoth issues lead to the fact that the code will leak uninitialized\nkernel stack bytes in net/socket.c.\n\nFix the first issue by initializing the memory used for sockaddr info\nwith memset(0). Fix the second one by setting msg_namelen to 0 early.\nIt will be updated later if we're going to fill the msg_name member.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Lauro Ramos Venancio <lauro.venancio@openbossa.org>\nCc: Aloisio Almeida Jr <aloisio.almeida@openbossa.org>\nCc: Samuel Ortiz <sameo@linux.intel.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/0bd1b565eefcc1f308e643121ab57284dd0ac039"},{"sha":"2d61edbd751d2e6e27025a5f458a9b2e23cdf243","author":{"name":"Mathias Krause","email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com"},"message":"rose: fix info leak via msg_name in rose_recvmsg()\n\n[ Upstream commit 4a184233f21645cf0b719366210ed445d1024d72 ]\n\nThe code in rose_recvmsg() does not initialize all of the members of\nstruct sockaddr_rose/full_sockaddr_rose when filling the sockaddr info.\nNor does it initialize the padding bytes of the structure inserted by\nthe compiler for alignment. This will lead to leaking uninitialized\nkernel stack bytes in net/socket.c.\n\nFix the issue by initializing the memory used for sockaddr info with\nmemset(0).\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Ralf Baechle <ralf@linux-mips.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/2d61edbd751d2e6e27025a5f458a9b2e23cdf243"},{"sha":"63a4d8156daa5a896d8de3d106290116d1539376","author":{"name":"Mathias Krause","email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com"},"message":"tipc: fix info leaks via msg_name in recv_msg/recv_stream\n\n[ Upstream commit 60085c3d009b0df252547adb336d1ccca5ce52ec ]\n\nThe code in set_orig_addr() does not initialize all of the members of\nstruct sockaddr_tipc when filling the sockaddr info -- namely the union\nis only partly filled. This will make recv_msg() and recv_stream() --\nthe only users of this function -- leak kernel stack memory as the\nmsg_name member is a local variable in net/socket.c.\n\nAdditionally to that both recv_msg() and recv_stream() fail to update\nthe msg_namelen member to 0 while otherwise returning with 0, i.e.\n\"success\". This is the case for, e.g., non-blocking sockets. This will\nlead to a 128 byte kernel stack leak in net/socket.c.\n\nFix the first issue by initializing the memory of the union with\nmemset(0). Fix the second one by setting msg_namelen to 0 early as it\nwill be updated later if we're going to fill the msg_name member.\n\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Jon Maloy <jon.maloy@ericsson.com>\nCc: Allan Stephens <allan.stephens@windriver.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/63a4d8156daa5a896d8de3d106290116d1539376"},{"sha":"a519986278ea6f8b1fb2aeb8640ec279669bcd49","author":{"name":"Wei Yongjun","email":"b8f9cab8be13de37b9588aedad10a20fc3a68783@trendmicro.com.cn"},"message":"netrom: fix invalid use of sizeof in nr_recvmsg()\n\n[ Upstream commit c802d759623acbd6e1ee9fbdabae89159a513913 ]\n\nsizeof() when applied to a pointer typed expression gives the size of the\npointer, not that of the pointed data.\nIntroduced by commit 3ce5ef(netrom: fix info leak via msg_name in nr_recvmsg)\n\nSigned-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/a519986278ea6f8b1fb2aeb8640ec279669bcd49"},{"sha":"4e12576af590c0bb8a2c3c2bd15326d85dc5549c","author":{"name":"Vasily Averin","email":"92a5505f10e70d6be04c6ea75cda66fdd7decf37@parallels.com"},"message":"cbq: incorrect processing of high limits\n\n[ Upstream commit f0f6ee1f70c4eaab9d52cf7d255df4bd89f8d1c2 ]\n\ncurrently cbq works incorrectly for limits > 10% real link bandwidth,\nand practically does not work for limits > 50% real link bandwidth.\nBelow are results of experiments taken on 1 Gbit link\n\n In shaper | Actual Result\n-----------+---------------\n  100M     | 108 Mbps\n  200M     | 244 Mbps\n  300M     | 412 Mbps\n  500M     | 893 Mbps\n\nThis happen because of q->now changes incorrectly in cbq_dequeue():\nwhen it is called before real end of packet transmitting,\nL2T is greater than real time delay, q_now gets an extra boost\nbut never compensate it.\n\nTo fix this problem we prevent change of q->now until its synchronization\nwith real time.\n\nSigned-off-by: Vasily Averin <vvs@openvz.org>\nReviewed-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/4e12576af590c0bb8a2c3c2bd15326d85dc5549c"},{"sha":"2e71f22d502de58114f23b589405a7a76be42879","author":{"name":"Balakumaran Kannan","email":"84a446a47e8a48993491189e32d514c570865578@gmail.com"},"message":"net IPv6 : Fix broken IPv6 routing table after loopback down-up\n\n[ Upstream commit 25fb6ca4ed9cad72f14f61629b68dc03c0d9713f ]\n\nIPv6 Routing table becomes broken once we do ifdown, ifup of the loopback(lo)\ninterface. After down-up, routes of other interface's IPv6 addresses through\n'lo' are lost.\n\nIPv6 addresses assigned to all interfaces are routed through 'lo' for internal\ncommunication. Once 'lo' is down, those routing entries are removed from routing\ntable. But those removed entries are not being re-created properly when 'lo' is\nbrought up. So IPv6 addresses of other interfaces becomes unreachable from the\nsame machine. Also this breaks communication with other machines because of\nNDISC packet processing failure.\n\nThis patch fixes this issue by reading all interface's IPv6 addresses and adding\nthem to IPv6 routing table while bringing up 'lo'.\n\n==Testing==\nBefore applying the patch:\n$ route -A inet6\nKernel IPv6 routing table\nDestination                    Next Hop                   Flag Met Ref Use If\n2000::20/128                   ::                         U    256 0     0 eth0\nfe80::/64                      ::                         U    256 0     0 eth0\n::/0                           ::                         !n   -1  1     1 lo\n::1/128                        ::                         Un   0   1     0 lo\n2000::20/128                   ::                         Un   0   1     0 lo\nfe80::xxxx:xxxx:xxxx:xxxx/128  ::                         Un   0   1     0 lo\nff00::/8                       ::                         U    256 0     0 eth0\n::/0                           ::                         !n   -1  1     1 lo\n$ sudo ifdown lo\n$ sudo ifup lo\n$ route -A inet6\nKernel IPv6 routing table\nDestination                    Next Hop                   Flag Met Ref Use If\n2000::20/128                   ::                         U    256 0     0 eth0\nfe80::/64                      ::                         U    256 0     0 eth0\n::/0                           ::                         !n   -1  1     1 lo\n::1/128                        ::                         Un   0   1     0 lo\nff00::/8                       ::                         U    256 0     0 eth0\n::/0                           ::                         !n   -1  1     1 lo\n$\n\nAfter applying the patch:\n$ route -A inet6\nKernel IPv6 routing\ntable\nDestination                    Next Hop                   Flag Met Ref Use If\n2000::20/128                   ::                         U    256 0     0 eth0\nfe80::/64                      ::                         U    256 0     0 eth0\n::/0                           ::                         !n   -1  1     1 lo\n::1/128                        ::                         Un   0   1     0 lo\n2000::20/128                   ::                         Un   0   1     0 lo\nfe80::xxxx:xxxx:xxxx:xxxx/128  ::                         Un   0   1     0 lo\nff00::/8                       ::                         U    256 0     0 eth0\n::/0                           ::                         !n   -1  1     1 lo\n$ sudo ifdown lo\n$ sudo ifup lo\n$ route -A inet6\nKernel IPv6 routing table\nDestination                    Next Hop                   Flag Met Ref Use If\n2000::20/128                   ::                         U    256 0     0 eth0\nfe80::/64                      ::                         U    256 0     0 eth0\n::/0                           ::                         !n   -1  1     1 lo\n::1/128                        ::                         Un   0   1     0 lo\n2000::20/128                   ::                         Un   0   1     0 lo\nfe80::xxxx:xxxx:xxxx:xxxx/128  ::                         Un   0   1     0 lo\nff00::/8                       ::                         U    256 0     0 eth0\n::/0                           ::                         !n   -1  1     1 lo\n$\n\nSigned-off-by: Balakumaran Kannan <Balakumaran.Kannan@ap.sony.com>\nSigned-off-by: Maruthi Thotad <Maruthi.Thotad@ap.sony.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/2e71f22d502de58114f23b589405a7a76be42879"},{"sha":"69211249daebda738db19832ef3492ad81808789","author":{"name":"Vlad Yasevich","email":"cbd80080413a7dff621bc5de2d3d61903bde20a2@redhat.com"},"message":"net: count hw_addr syncs so that unsync works properly.\n\n[ Upstream commit 4543fbefe6e06a9e40d9f2b28d688393a299f079 ]\n\nA few drivers use dev_uc_sync/unsync to synchronize the\naddress lists from master down to slave/lower devices.  In\nsome cases (bond/team) a single address list is synched down\nto multiple devices.  At the time of unsync, we have a leak\nin these lower devices, because \"synced\" is treated as a\nboolean and the address will not be unsynced for anything after\nthe first device/call.\n\nTreat \"synced\" as a count (same as refcount) and allow all\nunsync calls to work.\n\nSigned-off-by: Vlad Yasevich <vyasevic@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/shinobizero/android_kernel_lge_hammerhead/commits/69211249daebda738db19832ef3492ad81808789"}]}
{"actor":{"display_login":"shinobizero"}}