{"push_id":2184555746,"size":76,"distinct_size":0,"ref":"refs/heads/caf/3.10/caf/aosp-common/upstream-linux-4.4.y","head":"69b0bf95a51eb4b0890b3979531aed932cf51d7f","before":"08c15ad2e6278a5fe1b209e8fcdbd2d235c48f34","commits":[{"sha":"27248d2fa77f028f639f2cbac621447cc94dbbb5","author":{"name":"Tom Herbert","email":"55bc7b18e460d0d077310393ffbc002e6fe4eaec@herbertland.com"},"message":"netlink: add a start callback for starting a netlink dump\n\ncommit fc9e50f5a5a4e1fa9ba2756f745a13e693cf6a06 upstream.\n\nThe start callback allows the caller to set up a context for the\ndump callbacks. Presumably, the context can then be destroyed in\nthe done callback.\n\nSigned-off-by: Tom Herbert <tom@herbertland.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nCc: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/27248d2fa77f028f639f2cbac621447cc94dbbb5"},{"sha":"b377c453b3631531679cbe594b7d28c5ecd82cea","author":{"name":"Herbert Xu","email":"b06c1e85ee1d40a691f7eaf317640579555a220e@gondor.apana.org.au"},"message":"ipsec: Fix aborted xfrm policy dump crash\n\ncommit 1137b5e2529a8f5ca8ee709288ecba3e68044df2 upstream.\n\nAn independent security researcher, Mohamed Ghannam, has reported\nthis vulnerability to Beyond Security's SecuriTeam Secure Disclosure\nprogram.\n\nThe xfrm_dump_policy_done function expects xfrm_dump_policy to\nhave been called at least once or it will crash.  This can be\ntriggered if a dump fails because the target socket's receive\nbuffer is full.\n\nThis patch fixes it by using the cb->start mechanism to ensure that\nthe initialisation is always done regardless of the buffer situation.\n\nFixes: 12a169e7d8f4 (\"ipsec: Put dumpers on the dump list\")\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>\nCc: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/b377c453b3631531679cbe594b7d28c5ecd82cea"},{"sha":"87e2bd898d3a79a8c609f183180adac47879a2a4","author":{"name":"Matt Fleming","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@codeblueprint.co.uk"},"message":"x86/mm/pat: Ensure cpa->pfn only contains page frame numbers\n\ncommit edc3b9129cecd0f0857112136f5b8b1bc1d45918 upstream.\n\nThe x86 pageattr code is confused about the data that is stored\nin cpa->pfn, sometimes it's treated as a page frame number,\nsometimes it's treated as an unshifted physical address, and in\none place it's treated as a pte.\n\nThe result of this is that the mapping functions do not map the\nintended physical address.\n\nThis isn't a problem in practice because most of the addresses\nwe're mapping in the EFI code paths are already mapped in\n'trampoline_pgd' and so the pageattr mapping functions don't\nactually do anything in this case. But when we move to using a\nseparate page table for the EFI runtime this will be an issue.\n\nSigned-off-by: Matt Fleming <matt@codeblueprint.co.uk>\nReviewed-by: Borislav Petkov <bp@suse.de>\nAcked-by: Borislav Petkov <bp@suse.de>\nCc: Andy Lutomirski <luto@amacapital.net>\nCc: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nCc: Borislav Petkov <bp@alien8.de>\nCc: Brian Gerst <brgerst@gmail.com>\nCc: Dave Hansen <dave.hansen@intel.com>\nCc: Denys Vlasenko <dvlasenk@redhat.com>\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Toshi Kani <toshi.kani@hp.com>\nCc: linux-efi@vger.kernel.org\nLink: http://lkml.kernel.org/r/1448658575-17029-3-git-send-email-matt@codeblueprint.co.uk\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nCc: \"Ghannam, Yazen\" <Yazen.Ghannam@amd.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/87e2bd898d3a79a8c609f183180adac47879a2a4"},{"sha":"b73adb60852034d84092d123b323196ca42529cd","author":{"name":"Matt Fleming","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@codeblueprint.co.uk"},"message":"x86/efi: Hoist page table switching code into efi_call_virt()\n\ncommit c9f2a9a65e4855b74d92cdad688f6ee4a1a323ff upstream.\n\nThis change is a prerequisite for pending patches that switch to\na dedicated EFI page table, instead of using 'trampoline_pgd'\nwhich shares PGD entries with 'swapper_pg_dir'. The pending\npatches make it impossible to dereference the runtime service\nfunction pointer without first switching %cr3.\n\nIt's true that we now have duplicated switching code in\nefi_call_virt() and efi_call_phys_{prolog,epilog}() but we are\nsacrificing code duplication for a little more clarity and the\nease of writing the page table switching code in C instead of\nasm.\n\nSigned-off-by: Matt Fleming <matt@codeblueprint.co.uk>\nReviewed-by: Borislav Petkov <bp@suse.de>\nAcked-by: Borislav Petkov <bp@suse.de>\nCc: Andrew Morton <akpm@linux-foundation.org>\nCc: Andy Lutomirski <luto@amacapital.net>\nCc: Andy Lutomirski <luto@kernel.org>\nCc: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nCc: Borislav Petkov <bp@alien8.de>\nCc: Brian Gerst <brgerst@gmail.com>\nCc: Dave Jones <davej@codemonkey.org.uk>\nCc: Denys Vlasenko <dvlasenk@redhat.com>\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>\nCc: Stephen Smalley <sds@tycho.nsa.gov>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Toshi Kani <toshi.kani@hp.com>\nCc: linux-efi@vger.kernel.org\nLink: http://lkml.kernel.org/r/1448658575-17029-5-git-send-email-matt@codeblueprint.co.uk\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nCc: \"Ghannam, Yazen\" <Yazen.Ghannam@amd.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/b73adb60852034d84092d123b323196ca42529cd"},{"sha":"36e0f05afd4e1d09fd47936761a502aedbc50649","author":{"name":"Matt Fleming","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@codeblueprint.co.uk"},"message":"x86/efi: Build our own page table structures\n\ncommit 67a9108ed4313b85a9c53406d80dc1ae3f8c3e36 upstream.\n\nWith commit e1a58320a38d (\"x86/mm: Warn on W^X mappings\") all\nusers booting on 64-bit UEFI machines see the following warning,\n\n  ------------[ cut here ]------------\n  WARNING: CPU: 7 PID: 1 at arch/x86/mm/dump_pagetables.c:225 note_page+0x5dc/0x780()\n  x86/mm: Found insecure W+X mapping at address ffff88000005f000/0xffff88000005f000\n  ...\n  x86/mm: Checked W+X mappings: FAILED, 165660 W+X pages found.\n  ...\n\nThis is caused by mapping EFI regions with RWX permissions.\nThere isn't much we can do to restrict the permissions for these\nregions due to the way the firmware toolchains mix code and\ndata, but we can at least isolate these mappings so that they do\nnot appear in the regular kernel page tables.\n\nIn commit d2f7cbe7b26a (\"x86/efi: Runtime services virtual\nmapping\") we started using 'trampoline_pgd' to map the EFI\nregions because there was an existing identity mapping there\nwhich we use during the SetVirtualAddressMap() call and for\nbroken firmware that accesses those addresses.\n\nBut 'trampoline_pgd' shares some PGD entries with\n'swapper_pg_dir' and does not provide the isolation we require.\nNotably the virtual address for __START_KERNEL_map and\nMODULES_START are mapped by the same PGD entry so we need to be\nmore careful when copying changes over in\nefi_sync_low_kernel_mappings().\n\nThis patch doesn't go the full mile, we still want to share some\nPGD entries with 'swapper_pg_dir'. Having completely separate\npage tables brings its own issues such as synchronising new\nmappings after memory hotplug and module loading. Sharing also\nkeeps memory usage down.\n\nSigned-off-by: Matt Fleming <matt@codeblueprint.co.uk>\nReviewed-by: Borislav Petkov <bp@suse.de>\nAcked-by: Borislav Petkov <bp@suse.de>\nCc: Andrew Morton <akpm@linux-foundation.org>\nCc: Andy Lutomirski <luto@amacapital.net>\nCc: Andy Lutomirski <luto@kernel.org>\nCc: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nCc: Borislav Petkov <bp@alien8.de>\nCc: Brian Gerst <brgerst@gmail.com>\nCc: Dave Jones <davej@codemonkey.org.uk>\nCc: Denys Vlasenko <dvlasenk@redhat.com>\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>\nCc: Stephen Smalley <sds@tycho.nsa.gov>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Toshi Kani <toshi.kani@hp.com>\nCc: linux-efi@vger.kernel.org\nLink: http://lkml.kernel.org/r/1448658575-17029-6-git-send-email-matt@codeblueprint.co.uk\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nCc: \"Ghannam, Yazen\" <Yazen.Ghannam@amd.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/36e0f05afd4e1d09fd47936761a502aedbc50649"},{"sha":"44ff3af83ee1ebca7b1fc35c8471880628d31dbb","author":{"name":"Adam Ford","email":"aa72dba4e50831b0735b720704811f4d71d38f4f@gmail.com"},"message":"ARM: dts: omap3: logicpd-torpedo-37xx-devkit: Fix MMC1 cd-gpio\n\ncommit b7ace5ed8867ca54503727988adec6b20af54eeb upstream.\n\nFixes commit 687c27676151 (\"ARM: dts: Add minimal support for LogicPD\nTorpedo DM3730 devkit\")\n\nThis patch corrects an issue where the cd-gpios was improperly setup\nusing IRQ_TYPE_LEVEL_LOW instead of GPIO_ACTIVE_LOW.\n\nSigned-off-by: Adam Ford <aford173@gmail.com>\nSigned-off-by: Tony Lindgren <tony@atomide.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/44ff3af83ee1ebca7b1fc35c8471880628d31dbb"},{"sha":"e85c6907b2b46b516950a801ea0648fec8f59ba9","author":{"name":"Sai Praneeth","email":"369f9bdd01ac45526747967bbd1354a1934c0e36@intel.com"},"message":"x86/efi-bgrt: Fix kernel panic when mapping BGRT data\n\ncommit 50a0cb565246f20d59cdb161778531e4b19d35ac upstream.\n\nStarting with this commit 35eb8b81edd4 (\"x86/efi: Build our own page\ntable structures\") efi regions have a separate page directory called\n\"efi_pgd\". In order to access any efi region we have to first shift %cr3\nto this page table. In the bgrt code we are trying to copy bgrt_header\nand image, but these regions fall under \"EFI_BOOT_SERVICES_DATA\"\nand to access these regions we have to shift %cr3 to efi_pgd and not\ndoing so will cause page fault as shown below.\n\n[    0.251599] Last level dTLB entries: 4KB 64, 2MB 0, 4MB 0, 1GB 4\n[    0.259126] Freeing SMP alternatives memory: 32K (ffffffff8230e000 - ffffffff82316000)\n[    0.271803] BUG: unable to handle kernel paging request at fffffffefce35002\n[    0.279740] IP: [<ffffffff821bca49>] efi_bgrt_init+0x144/0x1fd\n[    0.286383] PGD 300f067 PUD 0\n[    0.289879] Oops: 0000 [#1] SMP\n[    0.293566] Modules linked in:\n[    0.297039] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.0-rc1-eywa-eywa-built-in-47041+ #2\n[    0.306619] Hardware name: Intel Corporation Skylake Client platform/Skylake Y LPDDR3 RVP3, BIOS SKLSE2R1.R00.B104.B01.1511110114 11/11/2015\n[    0.320925] task: ffffffff820134c0 ti: ffffffff82000000 task.ti: ffffffff82000000\n[    0.329420] RIP: 0010:[<ffffffff821bca49>]  [<ffffffff821bca49>] efi_bgrt_init+0x144/0x1fd\n[    0.338821] RSP: 0000:ffffffff82003f18  EFLAGS: 00010246\n[    0.344852] RAX: fffffffefce35000 RBX: fffffffefce35000 RCX: fffffffefce2b000\n[    0.352952] RDX: 000000008a82b000 RSI: ffffffff8235bb80 RDI: 000000008a835000\n[    0.361050] RBP: ffffffff82003f30 R08: 000000008a865000 R09: ffffffffff202850\n[    0.369149] R10: ffffffff811ad62f R11: 0000000000000000 R12: 0000000000000000\n[    0.377248] R13: ffff88016dbaea40 R14: ffffffff822622c0 R15: ffffffff82003fb0\n[    0.385348] FS:  0000000000000000(0000) GS:ffff88016d800000(0000) knlGS:0000000000000000\n[    0.394533] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    0.401054] CR2: fffffffefce35002 CR3: 000000000300c000 CR4: 00000000003406f0\n[    0.409153] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[    0.417252] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[    0.425350] Stack:\n[    0.427638]  ffffffffffffffff ffffffff82256900 ffff88016dbaea40 ffffffff82003f40\n[    0.436086]  ffffffff821bbce0 ffffffff82003f88 ffffffff8219c0c2 0000000000000000\n[    0.444533]  ffffffff8219ba4a ffffffff822622c0 0000000000083000 00000000ffffffff\n[    0.452978] Call Trace:\n[    0.455763]  [<ffffffff821bbce0>] efi_late_init+0x9/0xb\n[    0.461697]  [<ffffffff8219c0c2>] start_kernel+0x463/0x47f\n[    0.467928]  [<ffffffff8219ba4a>] ? set_init_arg+0x55/0x55\n[    0.474159]  [<ffffffff8219b120>] ? early_idt_handler_array+0x120/0x120\n[    0.481669]  [<ffffffff8219b5ee>] x86_64_start_reservations+0x2a/0x2c\n[    0.488982]  [<ffffffff8219b72d>] x86_64_start_kernel+0x13d/0x14c\n[    0.495897] Code: 00 41 b4 01 48 8b 78 28 e8 09 36 01 00 48 85 c0 48 89 c3 75 13 48 c7 c7 f8 ac d3 81 31 c0 e8 d7 3b fb fe e9 b5 00 00 00 45 84 e4 <44> 8b 6b 02 74 0d be 06 00 00 00 48 89 df e8 ae 34 0$\n[    0.518151] RIP  [<ffffffff821bca49>] efi_bgrt_init+0x144/0x1fd\n[    0.524888]  RSP <ffffffff82003f18>\n[    0.528851] CR2: fffffffefce35002\n[    0.532615] ---[ end trace 7b06521e6ebf2aea ]---\n[    0.537852] Kernel panic - not syncing: Attempted to kill the idle task!\n\nAs said above one way to fix this bug is to shift %cr3 to efi_pgd but we\nare not doing that way because it leaks inner details of how we switch\nto EFI page tables into a new call site and it also adds duplicate code.\nInstead, we remove the call to efi_lookup_mapped_addr() and always\nperform early_mem*() instead of early_io*() because we want to remap RAM\nregions and not I/O regions. We also delete efi_lookup_mapped_addr()\nbecause we are no longer using it.\n\nSigned-off-by: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>\nReported-by: Wendy Wang <wendy.wang@intel.com>\nCc: Borislav Petkov <bp@suse.de>\nCc: Josh Triplett <josh@joshtriplett.org>\nCc: Ricardo Neri <ricardo.neri@intel.com>\nCc: Ravi Shankar <ravi.v.shankar@intel.com>\nSigned-off-by: Matt Fleming <matt@codeblueprint.co.uk>\nCc: \"Ghannam, Yazen\" <Yazen.Ghannam@amd.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/e85c6907b2b46b516950a801ea0648fec8f59ba9"},{"sha":"f97fc9ab1ce23a8666cfe460264a6a45b7e0b335","author":{"name":"Matt Fleming","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@codeblueprint.co.uk"},"message":"x86/efi-bgrt: Replace early_memremap() with memremap()\n\ncommit e2c90dd7e11e3025b46719a79fb4bb1e7a5cef9f upstream.\n\nMôshe reported the following warning triggered on his machine since\ncommit 50a0cb565246 (\"x86/efi-bgrt: Fix kernel panic when mapping BGRT\ndata\"),\n\n  [    0.026936] ------------[ cut here ]------------\n  [    0.026941] WARNING: CPU: 0 PID: 0 at mm/early_ioremap.c:137 __early_ioremap+0x102/0x1bb()\n  [    0.026941] Modules linked in:\n  [    0.026944] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.0-rc1 #2\n  [    0.026945] Hardware name: Dell Inc. XPS 13 9343/09K8G1, BIOS A05 07/14/2015\n  [    0.026946]  0000000000000000 900f03d5a116524d ffffffff81c03e60 ffffffff813a3fff\n  [    0.026948]  0000000000000000 ffffffff81c03e98 ffffffff810a0852 00000000d7b76000\n  [    0.026949]  0000000000000000 0000000000000001 0000000000000001 000000000000017c\n  [    0.026951] Call Trace:\n  [    0.026955]  [<ffffffff813a3fff>] dump_stack+0x44/0x55\n  [    0.026958]  [<ffffffff810a0852>] warn_slowpath_common+0x82/0xc0\n  [    0.026959]  [<ffffffff810a099a>] warn_slowpath_null+0x1a/0x20\n  [    0.026961]  [<ffffffff81d8c395>] __early_ioremap+0x102/0x1bb\n  [    0.026962]  [<ffffffff81d8c602>] early_memremap+0x13/0x15\n  [    0.026964]  [<ffffffff81d78361>] efi_bgrt_init+0x162/0x1ad\n  [    0.026966]  [<ffffffff81d778ec>] efi_late_init+0x9/0xb\n  [    0.026968]  [<ffffffff81d58ff5>] start_kernel+0x46f/0x49f\n  [    0.026970]  [<ffffffff81d58120>] ? early_idt_handler_array+0x120/0x120\n  [    0.026972]  [<ffffffff81d58339>] x86_64_start_reservations+0x2a/0x2c\n  [    0.026974]  [<ffffffff81d58485>] x86_64_start_kernel+0x14a/0x16d\n  [    0.026977] ---[ end trace f9b3812eb8e24c58 ]---\n  [    0.026978] efi_bgrt: Ignoring BGRT: failed to map image memory\n\nearly_memremap() has an upper limit on the size of mapping it can\nhandle which is ~200KB. Clearly the BGRT image on Môshe's machine is\nmuch larger than that.\n\nThere's actually no reason to restrict ourselves to using the early_*\nversion of memremap() - the ACPI BGRT driver is invoked late enough in\nboot that we can use the standard version, with the benefit that the\nlate version allows mappings of arbitrary size.\n\nReported-by: Môshe van der Sterre <me@moshe.nl>\nTested-by: Môshe van der Sterre <me@moshe.nl>\nSigned-off-by: Matt Fleming <matt@codeblueprint.co.uk>\nCc: Josh Triplett <josh@joshtriplett.org>\nCc: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>\nCc: Borislav Petkov <bp@suse.de>\nLink: http://lkml.kernel.org/r/1450707172-12561-1-git-send-email-matt@codeblueprint.co.uk\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: \"Ghannam, Yazen\" <Yazen.Ghannam@amd.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/f97fc9ab1ce23a8666cfe460264a6a45b7e0b335"},{"sha":"2b7ef6bdd28610f2907cd766362cf95d0d023801","author":{"name":"Kirill A. Shutemov","email":"e4d0c2966af3c70025b28e24a0f33104c6291010@linux.intel.com"},"message":"mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d()\n\ncommit a8f97366452ed491d13cf1e44241bc0b5740b1f0 upstream.\n\nCurrently, we unconditionally make page table dirty in touch_pmd().\nIt may result in false-positive can_follow_write_pmd().\n\nWe may avoid the situation, if we would only make the page table entry\ndirty if caller asks for write access -- FOLL_WRITE.\n\nThe patch also changes touch_pud() in the same way.\n\nSigned-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>\nCc: Michal Hocko <mhocko@suse.com>\nCc: Hugh Dickins <hughd@google.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n[Salvatore Bonaccorso: backport for 3.16:\n - Adjust context\n - Drop specific part for PUD-sized transparent hugepages. Support\n   for PUD-sized transparent hugepages was added in v4.11-rc1\n]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/2b7ef6bdd28610f2907cd766362cf95d0d023801"},{"sha":"0d05a5593f6309cb0df0df474a807a3220855703","author":{"name":"chenjie","email":"3398216b620c829e509da125cb196494693092bc@huawei.com"},"message":"mm/madvise.c: fix madvise() infinite loop under special circumstances\n\ncommit 6ea8d958a2c95a1d514015d4e29ba21a8c0a1a91 upstream.\n\nMADVISE_WILLNEED has always been a noop for DAX (formerly XIP) mappings.\nUnfortunately madvise_willneed() doesn't communicate this information\nproperly to the generic madvise syscall implementation.  The calling\nconvention is quite subtle there.  madvise_vma() is supposed to either\nreturn an error or update &prev otherwise the main loop will never\nadvance to the next vma and it will keep looping for ever without a way\nto get out of the kernel.\n\nIt seems this has been broken since introduction.  Nobody has noticed\nbecause nobody seems to be using MADVISE_WILLNEED on these DAX mappings.\n\n[mhocko@suse.com: rewrite changelog]\nLink: http://lkml.kernel.org/r/20171127115318.911-1-guoxuenan@huawei.com\nFixes: fe77ba6f4f97 (\"[PATCH] xip: madvice/fadvice: execute in place\")\nSigned-off-by: chenjie <chenjie6@huawei.com>\nSigned-off-by: guoxuenan <guoxuenan@huawei.com>\nAcked-by: Michal Hocko <mhocko@suse.com>\nCc: Minchan Kim <minchan@kernel.org>\nCc: zhangyi (F) <yi.zhang@huawei.com>\nCc: Miao Xie <miaoxie@huawei.com>\nCc: Mike Rapoport <rppt@linux.vnet.ibm.com>\nCc: Shaohua Li <shli@fb.com>\nCc: Andrea Arcangeli <aarcange@redhat.com>\nCc: Mel Gorman <mgorman@techsingularity.net>\nCc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>\nCc: David Rientjes <rientjes@google.com>\nCc: Anshuman Khandual <khandual@linux.vnet.ibm.com>\nCc: Rik van Riel <riel@redhat.com>\nCc: Carsten Otte <cotte@de.ibm.com>\nCc: Dan Williams <dan.j.williams@intel.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/0d05a5593f6309cb0df0df474a807a3220855703"},{"sha":"591ddc92d756b49a95060b0203fe329a31f18c3e","author":{"name":"Josef Bacik","email":"e73a1f413bb520945916d1984a953e4fa12e3d96@fb.com"},"message":"btrfs: clear space cache inode generation always\n\ncommit 8e138e0d92c6c9d3d481674fb14e3439b495be37 upstream.\n\nWe discovered a box that had double allocations, and suspected the space\ncache may be to blame.  While auditing the write out path I noticed that\nif we've already setup the space cache we will just carry on.  This\nmeans that any error we hit after cache_save_setup before we go to\nactually write the cache out we won't reset the inode generation, so\nwhatever was already written will be considered correct, except it'll be\nstale.  Fix this by _always_ resetting the generation on the block group\ninode, this way we only ever have valid or invalid cache.\n\nWith this patch I was no longer able to reproduce cache corruption with\ndm-log-writes and my bpf error injection tool.\n\nSigned-off-by: Josef Bacik <jbacik@fb.com>\nSigned-off-by: David Sterba <dsterba@suse.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/591ddc92d756b49a95060b0203fe329a31f18c3e"},{"sha":"ab29b6b818aa1cc8c36fc510464c732d392f5df2","author":{"name":"Liran Alon","email":"320dfc33cec916618067f6f0bf08ce07a01db6f3@oracle.com"},"message":"KVM: x86: pvclock: Handle first-time write to pvclock-page contains random junk\n\ncommit 51c4b8bba674cfd2260d173602c4dac08e4c3a99 upstream.\n\nWhen guest passes KVM it's pvclock-page GPA via WRMSR to\nMSR_KVM_SYSTEM_TIME / MSR_KVM_SYSTEM_TIME_NEW, KVM don't initialize\npvclock-page to some start-values. It just requests a clock-update which\nwill happen before entering to guest.\n\nThe clock-update logic will call kvm_setup_pvclock_page() to update the\npvclock-page with info. However, kvm_setup_pvclock_page() *wrongly*\nassumes that the version-field is initialized to an even number. This is\nwrong because at first-time write, field could be any-value.\n\nFix simply makes sure that if first-time version-field is odd, increment\nit once more to make it even and only then start standard logic.\nThis follows same logic as done in other pvclock shared-pages (See\nkvm_write_wall_clock() and record_steal_time()).\n\nSigned-off-by: Liran Alon <liran.alon@oracle.com>\nReviewed-by: Nikita Leshenko <nikita.leshchenko@oracle.com>\nReviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nSigned-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nReviewed-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Radim Krčmář <rkrcmar@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/ab29b6b818aa1cc8c36fc510464c732d392f5df2"},{"sha":"1e9e6bdccb80d9dca2a9dfd6cf2d34ce8f226d47","author":{"name":"Liran Alon","email":"320dfc33cec916618067f6f0bf08ce07a01db6f3@oracle.com"},"message":"KVM: x86: Exit to user-mode on #UD intercept when emulator requires\n\ncommit 61cb57c9ed631c95b54f8e9090c89d18b3695b3c upstream.\n\nInstruction emulation after trapping a #UD exception can result in an\nMMIO access, for example when emulating a MOVBE on a processor that\ndoesn't support the instruction.  In this case, the #UD vmexit handler\nmust exit to user mode, but there wasn't any code to do so.  Add it for\nboth VMX and SVM.\n\nSigned-off-by: Liran Alon <liran.alon@oracle.com>\nReviewed-by: Nikita Leshenko <nikita.leshchenko@oracle.com>\nReviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nSigned-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nReviewed-by: Wanpeng Li <wanpeng.li@hotmail.com>\nReviewed-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Radim Krčmář <rkrcmar@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/1e9e6bdccb80d9dca2a9dfd6cf2d34ce8f226d47"},{"sha":"a6493ad6fc893431705637d7efa3035235d9e135","author":{"name":"Paolo Bonzini","email":"7438500e0207b21c4e5dfca8d2a7898734cd7706@redhat.com"},"message":"KVM: x86: inject exceptions produced by x86_decode_insn\n\ncommit 6ea6e84309ca7e0e850b3083e6b09344ee15c290 upstream.\n\nSometimes, a processor might execute an instruction while another\nprocessor is updating the page tables for that instruction's code page,\nbut before the TLB shootdown completes.  The interesting case happens\nif the page is in the TLB.\n\nIn general, the processor will succeed in executing the instruction and\nnothing bad happens.  However, what if the instruction is an MMIO access?\nIf *that* happens, KVM invokes the emulator, and the emulator gets the\nupdated page tables.  If the update side had marked the code page as non\npresent, the page table walk then will fail and so will x86_decode_insn.\n\nUnfortunately, even though kvm_fetch_guest_virt is correctly returning\nX86EMUL_PROPAGATE_FAULT, x86_decode_insn's caller treats the failure as\na fatal error if the instruction cannot simply be reexecuted (as is the\ncase for MMIO).  And this in fact happened sometimes when rebooting\nWindows 2012r2 guests.  Just checking ctxt->have_exception and injecting\nthe exception if true is enough to fix the case.\n\nThanks to Eduardo Habkost for helping in the debugging of this issue.\n\nReported-by: Yanan Fu <yfu@redhat.com>\nCc: Eduardo Habkost <ehabkost@redhat.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Radim Krčmář <rkrcmar@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/a6493ad6fc893431705637d7efa3035235d9e135"},{"sha":"5c65b739389fbc353fb42d379e9b7379cfe6d3f6","author":{"name":"Adrian Hunter","email":"daa46418375a26a999430d83f18360fac0856a49@intel.com"},"message":"mmc: core: Do not leave the block driver in a suspended state\n\ncommit ebe7dd45cf49e3b49cacbaace17f9f878f21fbea upstream.\n\nThe block driver must be resumed if the mmc bus fails to suspend the card.\n\nSigned-off-by: Adrian Hunter <adrian.hunter@intel.com>\nReviewed-by: Linus Walleij <linus.walleij@linaro.org>\nSigned-off-by: Ulf Hansson <ulf.hansson@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/5c65b739389fbc353fb42d379e9b7379cfe6d3f6"},{"sha":"6b4901e0e3495f1ffc846f55f704bd19049579e2","author":{"name":"Heiner Kallweit","email":"9b74e2f58bb345ea6f44fd21e92b6c0731959004@gmail.com"},"message":"eeprom: at24: check at24_read/write arguments\n\ncommit d9bcd462daf34aebb8de9ad7f76de0198bb5a0f0 upstream.\n\nSo far we completely rely on the caller to provide valid arguments.\nTo be on the safe side perform an own sanity check.\n\nSigned-off-by: Heiner Kallweit <hkallweit1@gmail.com>\nSigned-off-by: Bartosz Golaszewski <brgl@bgdev.pl>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/6b4901e0e3495f1ffc846f55f704bd19049579e2"},{"sha":"5a7391b6d8983a2d36b0df15349caef10624e241","author":{"name":"Huacai Chen","email":"9d0d2ac0186c70d2f0f61b72cb4fe11060be1605@lemote.com"},"message":"bcache: Fix building error on MIPS\n\ncommit cf33c1ee5254c6a430bc1538232b49c3ea13e613 upstream.\n\nThis patch try to fix the building error on MIPS. The reason is MIPS\nhas already defined the PTR macro, which conflicts with the PTR macro\nin include/uapi/linux/bcache.h.\n\n[fixed by mlyle: corrected a line-length issue]\n\nSigned-off-by: Huacai Chen <chenhc@lemote.com>\nReviewed-by: Michael Lyle <mlyle@lyle.org>\nSigned-off-by: Michael Lyle <mlyle@lyle.org>\nSigned-off-by: Jens Axboe <axboe@kernel.dk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/5a7391b6d8983a2d36b0df15349caef10624e241"},{"sha":"4d027a8bcc7febabe908d4ca6049a8af21a8fd7c","author":{"name":"Alex Deucher","email":"a78d72677105f78f4b18925c366b6f577763ca59@amd.com"},"message":"Revert \"drm/radeon: dont switch vt on suspend\"\n\ncommit 18c437caa5b18a235dd65cec224eab54bebcee65 upstream.\n\nFixes distorted colors on some cards on resume from suspend.\n\nThis reverts commit b9729b17a414f99c61f4db9ac9f9ed987fa0cbfe.\n\nBug: https://bugs.freedesktop.org/show_bug.cgi?id=98832\nBug: https://bugs.freedesktop.org/show_bug.cgi?id=99163\nBug: https://bugzilla.kernel.org/show_bug.cgi?id=107001\nReviewed-by: Michel Dänzer <michel.daenzer@amd.com>\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/4d027a8bcc7febabe908d4ca6049a8af21a8fd7c"},{"sha":"c7716f65721a851cd925ee911f791e1ae92b398d","author":{"name":"Roman Kapl","email":"6aab4e5210d14d2e52b0b4175344291da28276fe@sysgo.com"},"message":"drm/radeon: fix atombios on big endian\n\ncommit 4f626a4ac8f57ddabf06d03870adab91e463217f upstream.\n\nThe function for byteswapping the data send to/from atombios was buggy for\nnum_bytes not divisible by four. The function must be aware of the fact\nthat after byte-swapping the u32 units, valid bytes might end up after the\nnum_bytes boundary.\n\nThis patch was tested on kernel 3.12 and allowed us to sucesfully use\nDisplayPort on and Radeon SI card. Namely it fixed the link training and\nEDID readout.\n\nThe function is patched both in radeon and amd drivers, since the functions\nand the fixes are identical.\n\nSigned-off-by: Roman Kapl <rka@sysgo.com>\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/c7716f65721a851cd925ee911f791e1ae92b398d"},{"sha":"a155a9568d9abf50fe4913c4bf7b46a8281d3dc3","author":{"name":"Jonathan Liu","email":"d04d1ae8ebec56a707746436b42403589e6f88d2@gmail.com"},"message":"drm/panel: simple: Add missing panel_simple_unprepare() calls\n\ncommit f3621a8eb59a913612c8e6e37d81f16b649f8b6c upstream.\n\nDuring panel removal or system shutdown panel_simple_disable() is called\nwhich disables the panel backlight but the panel is still powered due to\nmissing calls to panel_simple_unprepare().\n\nFixes: d02fd93e2cd8 (\"drm/panel: simple - Disable panel on shutdown\")\nSigned-off-by: Jonathan Liu <net147@gmail.com>\nSigned-off-by: Thierry Reding <treding@nvidia.com>\nLink: https://patchwork.freedesktop.org/patch/msgid/20170807115545.27747-1-net147@gmail.com\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/a155a9568d9abf50fe4913c4bf7b46a8281d3dc3"}]}
{"actor":{"display_login":"mifl"}}