{"push_id":1946875630,"size":1000,"distinct_size":2289,"ref":"refs/heads/n","head":"fe9224e767f7525dd66540657780a9007b534342","before":"fd1c11722aa3b8a53aaf02f4aeb88a5c6b20fc56","commits":[{"sha":"701dc8ede3d276f35016c3d79894a1db5eb9199b","author":{"name":"Johan Hovold","email":"c5aaa0c362db47011b825595d6a432662259e2f1@kernel.org"},"message":"USB: serial: mct_u232: fix modem-status error handling\n\ncommit 36356a669eddb32917fc4b5c2b9b8bf80ede69de upstream.\n\nMake sure to detect short control-message transfers so that errors are\nlogged when reading the modem status at open.\n\nNote that while this also avoids initialising the modem status using\nuninitialised heap data, these bits could not leak to user space as they\nare currently not used.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/701dc8ede3d276f35016c3d79894a1db5eb9199b"},{"sha":"56a31a230fb20ece535dfaec563aea57e4fd22bc","author":{"name":"Johan Hovold","email":"c5aaa0c362db47011b825595d6a432662259e2f1@kernel.org"},"message":"USB: serial: io_edgeport: fix descriptor error handling\n\ncommit 3c0e25d883d06a1fbd1ad35257e8abaa57befb37 upstream.\n\nMake sure to detect short control-message transfers and log an error\nwhen reading incomplete manufacturer and boot descriptors.\n\nNote that the default all-zero descriptors will now be used after a\nshort transfer is detected instead of partially initialised ones.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/56a31a230fb20ece535dfaec563aea57e4fd22bc"},{"sha":"0c5ff8b10391d443994d129a574e3fe937def212","author":{"name":"James Hughes","email":"95b9f28333d4c74fdec10c0e20b6222bb3683402@raspberrypi.org"},"message":"brcmfmac: Ensure pointer correctly set if skb data location changes\n\ncommit 455a1eb4654c24560eb9dfc634f29cba3d87601e upstream.\n\nThe incoming skb header may be resized if header space is\ninsufficient, which might change the data adddress in the skb.\nEnsure that a cached pointer to that data is correctly set by\nmoving assignment to after any possible changes.\n\nSigned-off-by: James Hughes <james.hughes@raspberrypi.org>\nAcked-by: Arend van Spriel <arend.vanspriel@broadcom.com>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>\nSigned-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/0c5ff8b10391d443994d129a574e3fe937def212"},{"sha":"3ccf1f97df08df22239381f08ac3976f84983fb4","author":{"name":"James Hughes","email":"95b9f28333d4c74fdec10c0e20b6222bb3683402@raspberrypi.org"},"message":"brcmfmac: Make skb header writable before use\n\ncommit 9cc4b7cb86cbcc6330a3faa8cd65268cd2d3c227 upstream.\n\nThe driver was making changes to the skb_header without\nensuring it was writable (i.e. uncloned).\nThis patch also removes some boiler plate header size\nchecking/adjustment code as that is also handled by the\nskb_cow_header function used to make header writable.\n\nSigned-off-by: James Hughes <james.hughes@raspberrypi.org>\nAcked-by: Arend van Spriel <arend.vanspriel@broadcom.com>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>\nSigned-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/3ccf1f97df08df22239381f08ac3976f84983fb4"},{"sha":"aad5b31dbbc24ab26d10eb2e59fdc2de1a17dbe6","author":{"name":"Arnd Bergmann","email":"72a0f6d3b182607e6d5c44b93e1abb7b23ee18f3@arndb.de"},"message":"staging: emxx_udc: remove incorrect __init annotations\n\ncommit 4f3445067d5f78fb8d1970b02610f85c2f377ea4 upstream.\n\nThe probe function is not marked __init, but some other functions\nare. This leads to a warning on older compilers (e.g. gcc-4.3),\nand can cause executing freed memory when built with those\ncompilers:\n\nWARNING: drivers/staging/emxx_udc/emxx_udc.o(.text+0x2d78): Section mismatch in reference from the function nbu2ss_drv_probe() to the function .init.text:nbu2ss_drv_contest_init()\n\nThis removes the annotations.\n\nFixes: 33aa8d45a4fe (\"staging: emxx_udc: Add Emma Mobile USB Gadget driver\")\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/aad5b31dbbc24ab26d10eb2e59fdc2de1a17dbe6"},{"sha":"38a9c97edbf1374542b400524b9aba02eb740d2b","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"tcp: do not underestimate skb->truesize in tcp_trim_head()\n\n[ Upstream commit 7162fb242cb8322beb558828fd26b33c3e9fc805 ]\n\nAndrey found a way to trigger the WARN_ON_ONCE(delta < len) in\nskb_try_coalesce() using syzkaller and a filter attached to a TCP\nsocket over loopback interface.\n\nI believe one issue with looped skbs is that tcp_trim_head() can end up\nproducing skb with under estimated truesize.\n\nIt hardly matters for normal conditions, since packets sent over\nloopback are never truncated.\n\nBytes trimmed from skb->head should not change skb truesize, since\nskb->head is not reallocated.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/38a9c97edbf1374542b400524b9aba02eb740d2b"},{"sha":"4ed5433b98a8578f875bbb5c6eaf2b83dce1e9af","author":{"name":"Alexander Potapenko","email":"8a652d6e37d449a8e8c8989569d8839dd1bfdb29@google.com"},"message":"ipv4, ipv6: ensure raw socket message is big enough to hold an IP header\n\n[ Upstream commit 86f4c90a1c5c1493f07f2d12c1079f5bf01936f2 ]\n\nraw_send_hdrinc() and rawv6_send_hdrinc() expect that the buffer copied\nfrom the userspace contains the IPv4/IPv6 header, so if too few bytes are\ncopied, parts of the header may remain uninitialized.\n\nThis bug has been detected with KMSAN.\n\nFor the record, the KMSAN report:\n\n==================================================================\nBUG: KMSAN: use of unitialized memory in nf_ct_frag6_gather+0xf5a/0x44a0\ninter: 0\nCPU: 0 PID: 1036 Comm: probe Not tainted 4.11.0-rc5+ #2455\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:16\n dump_stack+0x143/0x1b0 lib/dump_stack.c:52\n kmsan_report+0x16b/0x1e0 mm/kmsan/kmsan.c:1078\n __kmsan_warning_32+0x5c/0xa0 mm/kmsan/kmsan_instr.c:510\n nf_ct_frag6_gather+0xf5a/0x44a0 net/ipv6/netfilter/nf_conntrack_reasm.c:577\n ipv6_defrag+0x1d9/0x280 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:68\n nf_hook_entry_hookfn ./include/linux/netfilter.h:102\n nf_hook_slow+0x13f/0x3c0 net/netfilter/core.c:310\n nf_hook ./include/linux/netfilter.h:212\n NF_HOOK ./include/linux/netfilter.h:255\n rawv6_send_hdrinc net/ipv6/raw.c:673\n rawv6_sendmsg+0x2fcb/0x41a0 net/ipv6/raw.c:919\n inet_sendmsg+0x3f8/0x6d0 net/ipv4/af_inet.c:762\n sock_sendmsg_nosec net/socket.c:633\n sock_sendmsg net/socket.c:643\n SYSC_sendto+0x6a5/0x7c0 net/socket.c:1696\n SyS_sendto+0xbc/0xe0 net/socket.c:1664\n do_syscall_64+0x72/0xa0 arch/x86/entry/common.c:285\n entry_SYSCALL64_slow_path+0x25/0x25 arch/x86/entry/entry_64.S:246\nRIP: 0033:0x436e03\nRSP: 002b:00007ffce48baf38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 00000000004002b0 RCX: 0000000000436e03\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003\nRBP: 00007ffce48baf90 R08: 00007ffce48baf50 R09: 000000000000001c\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000401790 R14: 0000000000401820 R15: 0000000000000000\norigin: 00000000d9400053\n save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59\n kmsan_save_stack_with_flags mm/kmsan/kmsan.c:362\n kmsan_internal_poison_shadow+0xb1/0x1a0 mm/kmsan/kmsan.c:257\n kmsan_poison_shadow+0x6d/0xc0 mm/kmsan/kmsan.c:270\n slab_alloc_node mm/slub.c:2735\n __kmalloc_node_track_caller+0x1f4/0x390 mm/slub.c:4341\n __kmalloc_reserve net/core/skbuff.c:138\n __alloc_skb+0x2cd/0x740 net/core/skbuff.c:231\n alloc_skb ./include/linux/skbuff.h:933\n alloc_skb_with_frags+0x209/0xbc0 net/core/skbuff.c:4678\n sock_alloc_send_pskb+0x9ff/0xe00 net/core/sock.c:1903\n sock_alloc_send_skb+0xe4/0x100 net/core/sock.c:1920\n rawv6_send_hdrinc net/ipv6/raw.c:638\n rawv6_sendmsg+0x2918/0x41a0 net/ipv6/raw.c:919\n inet_sendmsg+0x3f8/0x6d0 net/ipv4/af_inet.c:762\n sock_sendmsg_nosec net/socket.c:633\n sock_sendmsg net/socket.c:643\n SYSC_sendto+0x6a5/0x7c0 net/socket.c:1696\n SyS_sendto+0xbc/0xe0 net/socket.c:1664\n do_syscall_64+0x72/0xa0 arch/x86/entry/common.c:285\n return_from_SYSCALL_64+0x0/0x6a arch/x86/entry/entry_64.S:246\n==================================================================\n\n, triggered by the following syscalls:\n  socket(PF_INET6, SOCK_RAW, IPPROTO_RAW) = 3\n  sendto(3, NULL, 0, 0, {sa_family=AF_INET6, sin6_port=htons(0), inet_pton(AF_INET6, \"ff00::\", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = -1 EPERM\n\nA similar report is triggered in net/ipv4/raw.c if we use a PF_INET socket\ninstead of a PF_INET6 one.\n\nSigned-off-by: Alexander Potapenko <glider@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/4ed5433b98a8578f875bbb5c6eaf2b83dce1e9af"},{"sha":"d71c3d0c95d7f368b3b27f08b9d7fb919542c9cd","author":{"name":"WANG Cong","email":"3f5d79d28d6d48052800caba9df0b30e06fefe41@gmail.com"},"message":"ipv6: initialize route null entry in addrconf_init()\n\n[ Upstream commit 2f460933f58eee3393aba64f0f6d14acb08d1724 ]\n\nAndrey reported a crash on init_net.ipv6.ip6_null_entry->rt6i_idev\nsince it is always NULL.\n\nThis is clearly wrong, we have code to initialize it to loopback_dev,\nunfortunately the order is still not correct.\n\nloopback_dev is registered very early during boot, we lose a chance\nto re-initialize it in notifier. addrconf_init() is called after\nip6_route_init(), which means we have no chance to correct it.\n\nFix it by moving this initialization explicitly after\nipv6_add_dev(init_net.loopback_dev) in addrconf_init().\n\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/d71c3d0c95d7f368b3b27f08b9d7fb919542c9cd"},{"sha":"e811b2c40f62e9de914ed9f584fc11f16d5bf941","author":{"name":"WANG Cong","email":"3f5d79d28d6d48052800caba9df0b30e06fefe41@gmail.com"},"message":"ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf\n\n[ Upstream commit 242d3a49a2a1a71d8eb9f953db1bcaa9d698ce00 ]\n\nFor each netns (except init_net), we initialize its null entry\nin 3 places:\n\n1) The template itself, as we use kmemdup()\n2) Code around dst_init_metrics() in ip6_route_net_init()\n3) ip6_route_dev_notify(), which is supposed to initialize it after\n   loopback registers\n\nUnfortunately the last one still happens in a wrong order because\nwe expect to initialize net->ipv6.ip6_null_entry->rt6i_idev to\nnet->loopback_dev's idev, thus we have to do that after we add\nidev to loopback. However, this notifier has priority == 0 same as\nipv6_dev_notf, and ipv6_dev_notf is registered after\nip6_route_dev_notifier so it is called actually after\nip6_route_dev_notifier. This is similar to commit 2f460933f58e\n(\"ipv6: initialize route null entry in addrconf_init()\") which\nfixes init_net.\n\nFix it by picking a smaller priority for ip6_route_dev_notifier.\nAlso, we have to release the refcnt accordingly when unregistering\nloopback_dev because device exit functions are called before subsys\nexit functions.\n\nAcked-by: David Ahern <dsahern@gmail.com>\nTested-by: David Ahern <dsahern@gmail.com>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/e811b2c40f62e9de914ed9f584fc11f16d5bf941"},{"sha":"57967db6f224f98f5e40961649023b4b89468575","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"tcp: fix wraparound issue in tcp_lp\n\n[ Upstream commit a9f11f963a546fea9144f6a6d1a307e814a387e7 ]\n\nBe careful when comparing tcp_time_stamp to some u32 quantity,\notherwise result can be surprising.\n\nFixes: 7c106d7e782b (\"[TCP]: TCP Low Priority congestion control\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/57967db6f224f98f5e40961649023b4b89468575"},{"sha":"0ee1292f4e18be4bdd7b28f31ad69d8ee69656af","author":{"name":"Nicolai Hähnle","email":"65a7b68532fd3624e2d02dfbc0d9c9b74b9cf96f@amd.com"},"message":"drm/ttm: fix use-after-free races in vm fault handling\n\ncommit 3089c1df10e2931b1d72d2ffa7d86431084c86b3 upstream.\n\nThe vm fault handler relies on the fact that the VMA owns a reference\nto the BO. However, once mmap_sem is released, other tasks are free to\ndestroy the VMA, which can lead to the BO being freed. Fix two code\npaths where that can happen, both related to vm fault retries.\n\nFound via a lock debugging warning which flagged &bo->wu_mutex as\nlocked while being destroyed.\n\nFixes: cbe12e74ee4e (\"drm/ttm: Allow vm fault retries\")\nSigned-off-by: Nicolai Hähnle <nicolai.haehnle@amd.com>\nReviewed-by: Christian König <christian.koenig@amd.com>\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/0ee1292f4e18be4bdd7b28f31ad69d8ee69656af"},{"sha":"43ce551142592aa8fafdb28a2509bf94f4f7aa96","author":{"name":"Ard Biesheuvel","email":"80b89d4a5c0c8f00cebbb9c7d8a672c776f22af1@linaro.org"},"message":"ARM: 8452/3: PJ4: make coprocessor access sequences buildable in Thumb2 mode\n\ncommit 5008efc83bf85b647aa1cbc44718b1675bbb7444 upstream.\n\nThe PJ4 inline asm sequence to write to cp15 cannot be built in Thumb-2\nmode, due to the way it performs arithmetic on the program counter, so it\nis built in ARM mode instead. However, building C files in ARM mode under\nCONFIG_THUMB2_KERNEL is problematic, since the instrumentation performed\nby subsystems like ftrace does not expect having to deal with interworking\nbranches.\n\nSince the sequence in question is simply a poor man's ISB instruction,\nlet's use a straight 'isb' instead when building in Thumb2 mode. Thumb2\nimplies V7, so 'isb' should always be supported in that case.\n\nAcked-by: Arnd Bergmann <arnd@arndb.de>\nAcked-by: Nicolas Pitre <nico@linaro.org>\nSigned-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/43ce551142592aa8fafdb28a2509bf94f4f7aa96"},{"sha":"d5a569ec75d5f442695e1b984c9217a2e96f2aa1","author":{"name":"Greg Kroah-Hartman","email":"4931344b09d7a7d3573e8b1ebec918e229ead9bf@linuxfoundation.org"},"message":"Linux 3.18.53","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/d5a569ec75d5f442695e1b984c9217a2e96f2aa1"},{"sha":"c82fb4c9650c2e950afde96b317338d09d598ff6","author":{"name":"Bart Van Assche","email":"b8a13ad2fc8473e67a34a68acf4216fb1fa3477b@sandisk.com"},"message":"target/fileio: Fix zero-length READ and WRITE handling\n\ncommit 59ac9c078141b8fd0186c0b18660a1b2c24e724e upstream.\n\nThis patch fixes zero-length READ and WRITE handling in target/FILEIO,\nwhich was broken a long time back by:\n\nSince:\n\n  commit d81cb44726f050d7cf1be4afd9cb45d153b52066\n  Author: Paolo Bonzini <pbonzini@redhat.com>\n  Date:   Mon Sep 17 16:36:11 2012 -0700\n\n      target: go through normal processing for all zero-length commands\n\nwhich moved zero-length READ and WRITE completion out of target-core,\nto doing submission into backend driver code.\n\nTo address this, go ahead and invoke target_complete_cmd() for any\nnon negative return value in fd_do_rw().\n\nSigned-off-by: Bart Van Assche <bart.vanassche@sandisk.com>\nReviewed-by: Hannes Reinecke <hare@suse.com>\nReviewed-by: Christoph Hellwig <hch@lst.de>\nCc: Andy Grover <agrover@redhat.com>\nCc: David Disseldorp <ddiss@suse.de>\nSigned-off-by: Nicholas Bellinger <nab@linux-iscsi.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/c82fb4c9650c2e950afde96b317338d09d598ff6"},{"sha":"141363dddb835f6db4a0f89ca95d92a8f01d8f1b","author":{"name":"Peter Chen","email":"1bd50f75c460ec6fb073f71822628b73bde58ca9@nxp.com"},"message":"usb: host: xhci: print correct command ring address\n\ncommit 6fc091fb0459ade939a795bfdcaf645385b951d4 upstream.\n\nPrint correct command ring address using 'val_64'.\n\nSigned-off-by: Peter Chen <peter.chen@nxp.com>\nSigned-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/141363dddb835f6db4a0f89ca95d92a8f01d8f1b"},{"sha":"9e1c6e6b8ddb9b3e019b6c0623503cad1e735a32","author":{"name":"Marek Vasut","email":"467844f9788017470d85adaf2186777024d3d5ee@denx.de"},"message":"USB: serial: ftdi_sio: add device ID for Microsemi/Arrow SF2PLUS Dev Kit\n\ncommit 31c5d1922b90ddc1da6a6ddecef7cd31f17aa32b upstream.\n\nThis development kit has an FT4232 on it with a custom USB VID/PID.\nThe FT4232 provides four UARTs, but only two are used. The UART 0\nis used by the FlashPro5 programmer and UART 2 is connected to the\nSmartFusion2 CortexM3 SoC UART port.\n\nNote that the USB VID is registered to Actel according to Linux USB\nVID database, but that was acquired by Microsemi.\n\nSigned-off-by: Marek Vasut <marex@denx.de>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/9e1c6e6b8ddb9b3e019b6c0623503cad1e735a32"},{"sha":"cf8d1e0ed93191ce87f0cf282800ebe580d1df37","author":{"name":"Ajay Kaher","email":"de325e9da90f1dcd337007eea4e9d8918a65ef40@samsung.com"},"message":"USB: Proper handling of Race Condition when two USB class drivers try to call init_usb_class simultaneously\n\ncommit 2f86a96be0ccb1302b7eee7855dbee5ce4dc5dfb upstream.\n\nThere is race condition when two USB class drivers try to call\ninit_usb_class at the same time and leads to crash.\ncode path: probe->usb_register_dev->init_usb_class\n\nTo solve this, mutex locking has been added in init_usb_class() and\ndestroy_usb_class().\n\nAs pointed by Alan, removed \"if (usb_class)\" test from destroy_usb_class()\nbecause usb_class can never be NULL there.\n\nSigned-off-by: Ajay Kaher <ajay.kaher@samsung.com>\nAcked-by: Alan Stern <stern@rowland.harvard.edu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/cf8d1e0ed93191ce87f0cf282800ebe580d1df37"},{"sha":"fb7672ff72f45179221f5b261455408ab829d6af","author":{"name":"Malcolm Priestley","email":"e187a437af0ab791fc51b0acfa7691f617a012f3@gmail.com"},"message":"staging: vt6656: use off stack for in buffer USB transfers.\n\ncommit 05c0cf88bec588a7cb34de569acd871ceef26760 upstream.\n\nSince 4.9 mandated USB buffers to be heap allocated. This causes\nthe driver to fail.\n\nCreate buffer for USB transfers.\n\nSigned-off-by: Malcolm Priestley <tvboxspy@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/fb7672ff72f45179221f5b261455408ab829d6af"},{"sha":"bc8ae940d2090aa7a59382941c4d0ff3e8af143b","author":{"name":"Malcolm Priestley","email":"e187a437af0ab791fc51b0acfa7691f617a012f3@gmail.com"},"message":"staging: vt6656: use off stack for out buffer USB transfers.\n\ncommit 12ecd24ef93277e4e5feaf27b0b18f2d3828bc5e upstream.\n\nSince 4.9 mandated USB buffers be heap allocated this causes the driver\nto fail.\n\nSince there is a wide range of buffer sizes use kmemdup to create\nallocated buffer.\n\nSigned-off-by: Malcolm Priestley <tvboxspy@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/bc8ae940d2090aa7a59382941c4d0ff3e8af143b"},{"sha":"6646a8256a0b20b35af29f0552425290a6cd2aad","author":{"name":"Johan Hovold","email":"c5aaa0c362db47011b825595d6a432662259e2f1@kernel.org"},"message":"staging: gdm724x: gdm_mux: fix use-after-free on module unload\n\ncommit b58f45c8fc301fe83ee28cad3e64686c19e78f1c upstream.\n\nMake sure to deregister the USB driver before releasing the tty driver\nto avoid use-after-free in the USB disconnect callback where the tty\ndevices are deregistered.\n\nFixes: 61e121047645 (\"staging: gdm7240: adding LTE USB driver\")\nCc: Won Kang <wkang77@gmail.com>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/acuicultor/Radioactive_kernel_msm8996_LOS/commits/6646a8256a0b20b35af29f0552425290a6cd2aad"}]}
{"actor":{"display_login":"acuicultor"}}