{"push_id":1804538325,"size":46,"distinct_size":0,"ref":"refs/heads/korg/stable/linux-3.18.y","head":"8366868460f8784e30302f441546a9d72ffe1236","before":"88ff45d07559d2ba05ef7adf0028055454dc548b","commits":[{"sha":"697d4230cfd6f0b8384fde9e0ffddf74443d871e","author":{"name":"Mintz, Yuval","email":"e7ff2cbe0352d468438315672d3ce2e0ac5acd78@cavium.com"},"message":"bnx2x: Fix Multi-Cos\n\n\n[ Upstream commit 3968d38917eb9bd0cd391265f6c9c538d9b33ffa ]\n\nApparently multi-cos isn't working for bnx2x quite some time -\ndriver implements ndo_select_queue() to allow queue-selection\nfor FCoE, but the regular L2 flow would cause it to modulo the\nfallback's result by the number of queues.\nThe fallback would return a queue matching the needed tc\n[via __skb_tx_hash()], but since the modulo is by the number of TSS\nqueues where number of TCs is not accounted, transmission would always\nbe done by a queue configured into using TC0.\n\nFixes: ada7c19e6d27 (\"bnx2x: use XPS if possible for bnx2x_select_queue instead of pure hash\")\nSigned-off-by: Yuval Mintz <Yuval.Mintz@cavium.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/697d4230cfd6f0b8384fde9e0ffddf74443d871e"},{"sha":"45039be5f52226bcd268caf924efadd53cdfa5b4","author":{"name":"Ben Hutchings","email":"9c85637c38b80821c7bd8a03bde7b59da81ab77d@decadent.org.uk"},"message":"ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt()\n\n\n[ Upstream commit 6e80ac5cc992ab6256c3dae87f7e57db15e1a58c ]\n\nxfrm6_find_1stfragopt() may now return an error code and we must\nnot treat it as a length.\n\nFixes: 2423496af35d (\"ipv6: Prevent overrun when parsing v6 header options\")\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nAcked-by: Craig Gallek <kraig@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/45039be5f52226bcd268caf924efadd53cdfa5b4"},{"sha":"8c66bf2f245e32cdcfa8652894732a5a4f2100d9","author":{"name":"Ganesh Goudar","email":"ff9295da3efab614774f90df169865d2fa93c83f@chelsio.com"},"message":"cxgb4: avoid enabling napi twice to the same queue\n\n\n[ Upstream commit e7519f9926f1d0d11c776eb0475eb098c7760f68 ]\n\nTake uld mutex to avoid race between cxgb_up() and\ncxgb4_register_uld() to enable napi for the same uld\nqueue.\n\nSigned-off-by: Ganesh Goudar <ganeshgr@chelsio.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/8c66bf2f245e32cdcfa8652894732a5a4f2100d9"},{"sha":"bca288c7932253f0f12c8facc65406e1ff43ae8b","author":{"name":"Yuchung Cheng","email":"e9603dd2756952b85012eef69eadebbcaf13f45b@google.com"},"message":"tcp: disallow cwnd undo when switching congestion control\n\n\n[ Upstream commit 44abafc4cc094214a99f860f778c48ecb23422fc ]\n\nWhen the sender switches its congestion control during loss\nrecovery, if the recovery is spurious then it may incorrectly\nrevert cwnd and ssthresh to the older values set by a previous\ncongestion control. Consider a congestion control (like BBR)\nthat does not use ssthresh and keeps it infinite: the connection\nmay incorrectly revert cwnd to an infinite value when switching\nfrom BBR to another congestion control.\n\nThis patch fixes it by disallowing such cwnd undo operation\nupon switching congestion control.  Note that undo_marker\nis not reset s.t. the packets that were incorrectly marked\nlost would be corrected. We only avoid undoing the cwnd in\ntcp_undo_cwnd_reduction().\n\nSigned-off-by: Yuchung Cheng <ycheng@google.com>\nSigned-off-by: Soheil Hassas Yeganeh <soheil@google.com>\nSigned-off-by: Neal Cardwell <ncardwell@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/bca288c7932253f0f12c8facc65406e1ff43ae8b"},{"sha":"22315daf2f6f19bdfd804450ac35f9ba925d2472","author":{"name":"David S. Miller","email":"79caf591e37e1438a2d55ae59670d5cd0d717764@davemloft.net"},"message":"ipv6: Fix leak in ipv6_gso_segment().\n\n\n[ Upstream commit e3e86b5119f81e5e2499bea7ea1ebe8ac6aab789 ]\n\nIf ip6_find_1stfragopt() fails and we return an error we have to free\nup 'segs' because nobody else is going to.\n\nFixes: 2423496af35d (\"ipv6: Prevent overrun when parsing v6 header options\")\nReported-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/22315daf2f6f19bdfd804450ac35f9ba925d2472"},{"sha":"7c7c21ee8b7ac6699ab9d6b7a260f3c11e31ad28","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"net: ping: do not abuse udp_poll()\n\n\n[ Upstream commit 77d4b1d36926a9b8387c6b53eeba42bcaaffcea3 ]\n\nAlexander reported various KASAN messages triggered in recent kernels\n\nThe problem is that ping sockets should not use udp_poll() in the first\nplace, and recent changes in UDP stack finally exposed this old bug.\n\nFixes: c319b4d76b9e (\"net: ipv4: add IPPROTO_ICMP socket kind\")\nFixes: 6d0bfe226116 (\"net: ipv6: Add IPv6 support to the ping socket.\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Sasha Levin <alexander.levin@verizon.com>\nCc: Solar Designer <solar@openwall.com>\nCc: Vasiliy Kulikov <segoon@openwall.com>\nCc: Lorenzo Colitti <lorenzo@google.com>\nAcked-By: Lorenzo Colitti <lorenzo@google.com>\nTested-By: Lorenzo Colitti <lorenzo@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/7c7c21ee8b7ac6699ab9d6b7a260f3c11e31ad28"},{"sha":"665fe924d6c01d300c96f6250a57328f95b55fdf","author":{"name":"Max Filippov","email":"d74404602d9677d809facc4c4eac9231fee6b605@gmail.com"},"message":"net: ethoc: enable NAPI before poll may be scheduled\n\n\n[ Upstream commit d220b942a4b6a0640aee78841608f4aa5e8e185e ]\n\nethoc_reset enables device interrupts, ethoc_interrupt may schedule a\nNAPI poll before NAPI is enabled in the ethoc_open, which results in\ndevice being unable to send or receive anything until it's closed and\nreopened. In case the device is flooded with ingress packets it may be\nunable to recover at all.\nMove napi_enable above ethoc_reset in the ethoc_open to fix that.\n\nFixes: a1702857724f (\"net: Add support for the OpenCores 10/100 Mbps Ethernet MAC.\")\nSigned-off-by: Max Filippov <jcmvbkbc@gmail.com>\nReviewed-by: Tobias Klauser <tklauser@distanz.ch>\nReviewed-by: Florian Fainelli <f.fainelli@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/665fe924d6c01d300c96f6250a57328f95b55fdf"},{"sha":"ff1a321f9acda32dbb47b22638ddcadfc9f7773c","author":{"name":"Johan Hovold","email":"c5aaa0c362db47011b825595d6a432662259e2f1@kernel.org"},"message":"serial: ifx6x60: fix use-after-free on module unload\n\ncommit 1e948479b3d63e3ac0ecca13cbf4921c7d17c168 upstream.\n\nMake sure to deregister the SPI driver before releasing the tty driver\nto avoid use-after-free in the SPI remove callback where the tty\ndevices are deregistered.\n\nFixes: 72d4724ea54c (\"serial: ifx6x60: Add modem power off function in the platform reboot process\")\nCc: Jun Chen <jun.d.chen@intel.com>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/ff1a321f9acda32dbb47b22638ddcadfc9f7773c"},{"sha":"8206e0a25785c58e88a444fed1d4646da60b14a4","author":{"name":"Eric Biggers","email":"0106d512ed1cb672be29d4b167a07ead51709fba@google.com"},"message":"KEYS: fix dereferencing NULL payload with nonzero length\n\ncommit 5649645d725c73df4302428ee4e02c869248b4c5 upstream.\n\nsys_add_key() and the KEYCTL_UPDATE operation of sys_keyctl() allowed a\nNULL payload with nonzero length to be passed to the key type's\n->preparse(), ->instantiate(), and/or ->update() methods.  Various key\ntypes including asymmetric, cifs.idmap, cifs.spnego, and pkcs7_test did\nnot handle this case, allowing an unprivileged user to trivially cause a\nNULL pointer dereference (kernel oops) if one of these key types was\npresent.  Fix it by doing the copy_from_user() when 'plen' is nonzero\nrather than when '_payload' is non-NULL, causing the syscall to fail\nwith EFAULT as expected when an invalid buffer is specified.\n\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: James Morris <james.l.morris@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/8206e0a25785c58e88a444fed1d4646da60b14a4"},{"sha":"45771cd795ec2feed01917cb25c0bb141d9c748b","author":{"name":"Eric Biggers","email":"0106d512ed1cb672be29d4b167a07ead51709fba@google.com"},"message":"KEYS: fix freeing uninitialized memory in key_update()\n\ncommit 63a0b0509e700717a59f049ec6e4e04e903c7fe2 upstream.\n\nkey_update() freed the key_preparsed_payload even if it was not\ninitialized first.  This would cause a crash if userspace called\nkeyctl_update() on a key with type like \"asymmetric\" that has a\n->preparse() method but not an ->update() method.  Possibly it could\neven be triggered for other key types by racing with keyctl_setperm() to\nmake the KEY_NEED_WRITE check fail (the permission was already checked,\nso normally it wouldn't fail there).\n\nReproducer with key type \"asymmetric\", given a valid cert.der:\n\nkeyctl new_session\nkeyid=$(keyctl padd asymmetric desc @s < cert.der)\nkeyctl setperm $keyid 0x3f000000\nkeyctl update $keyid data\n\n[  150.686666] BUG: unable to handle kernel NULL pointer dereference at 0000000000000001\n[  150.687601] IP: asymmetric_key_free_kids+0x12/0x30\n[  150.688139] PGD 38a3d067\n[  150.688141] PUD 3b3de067\n[  150.688447] PMD 0\n[  150.688745]\n[  150.689160] Oops: 0000 [#1] SMP\n[  150.689455] Modules linked in:\n[  150.689769] CPU: 1 PID: 2478 Comm: keyctl Not tainted 4.11.0-rc4-xfstests-00187-ga9f6b6b8cd2f #742\n[  150.690916] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-20170228_101828-anatol 04/01/2014\n[  150.692199] task: ffff88003b30c480 task.stack: ffffc90000350000\n[  150.692952] RIP: 0010:asymmetric_key_free_kids+0x12/0x30\n[  150.693556] RSP: 0018:ffffc90000353e58 EFLAGS: 00010202\n[  150.694142] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000004\n[  150.694845] RDX: ffffffff81ee3920 RSI: ffff88003d4b0700 RDI: 0000000000000001\n[  150.697569] RBP: ffffc90000353e60 R08: ffff88003d5d2140 R09: 0000000000000000\n[  150.702483] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001\n[  150.707393] R13: 0000000000000004 R14: ffff880038a4d2d8 R15: 000000000040411f\n[  150.709720] FS:  00007fcbcee35700(0000) GS:ffff88003fd00000(0000) knlGS:0000000000000000\n[  150.711504] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  150.712733] CR2: 0000000000000001 CR3: 0000000039eab000 CR4: 00000000003406e0\n[  150.714487] Call Trace:\n[  150.714975]  asymmetric_key_free_preparse+0x2f/0x40\n[  150.715907]  key_update+0xf7/0x140\n[  150.716560]  ? key_default_cmp+0x20/0x20\n[  150.717319]  keyctl_update_key+0xb0/0xe0\n[  150.718066]  SyS_keyctl+0x109/0x130\n[  150.718663]  entry_SYSCALL_64_fastpath+0x1f/0xc2\n[  150.719440] RIP: 0033:0x7fcbce75ff19\n[  150.719926] RSP: 002b:00007ffd5d167088 EFLAGS: 00000206 ORIG_RAX: 00000000000000fa\n[  150.720918] RAX: ffffffffffffffda RBX: 0000000000404d80 RCX: 00007fcbce75ff19\n[  150.721874] RDX: 00007ffd5d16785e RSI: 000000002866cd36 RDI: 0000000000000002\n[  150.722827] RBP: 0000000000000006 R08: 000000002866cd36 R09: 00007ffd5d16785e\n[  150.723781] R10: 0000000000000004 R11: 0000000000000206 R12: 0000000000404d80\n[  150.724650] R13: 00007ffd5d16784d R14: 00007ffd5d167238 R15: 000000000040411f\n[  150.725447] Code: 83 c4 08 31 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 85 ff 74 23 55 48 89 e5 53 48 89 fb <48> 8b 3f e8 06 21 c5 ff 48 8b 7b 08 e8 fd 20 c5 ff 48 89 df e8\n[  150.727489] RIP: asymmetric_key_free_kids+0x12/0x30 RSP: ffffc90000353e58\n[  150.728117] CR2: 0000000000000001\n[  150.728430] ---[ end trace f7f8fe1da2d5ae8d ]---\n\nFixes: 4d8c0250b841 (\"KEYS: Call ->free_preparse() even after ->preparse() returns an error\")\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: James Morris <james.l.morris@oracle.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/45771cd795ec2feed01917cb25c0bb141d9c748b"},{"sha":"0640eeea056edb63ce212fa35545ac0f7e409e9c","author":{"name":"Gilad Ben-Yossef","email":"8263ac36f7bab4448512273eb226472fb862c5fb@benyossef.com"},"message":"crypto: gcm - wait for crypto op not signal safe\n\ncommit f3ad587070d6bd961ab942b3fd7a85d00dfc934b upstream.\n\ncrypto_gcm_setkey() was using wait_for_completion_interruptible() to\nwait for completion of async crypto op but if a signal occurs it\nmay return before DMA ops of HW crypto provider finish, thus\ncorrupting the data buffer that is kfree'ed in this case.\n\nResolve this by using wait_for_completion() instead.\n\nReported-by: Eric Biggers <ebiggers3@gmail.com>\nSigned-off-by: Gilad Ben-Yossef <gilad@benyossef.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/0640eeea056edb63ce212fa35545ac0f7e409e9c"},{"sha":"b324fbe2dc79856152a5403547d8fbbb16b23076","author":{"name":"J. Bruce Fields","email":"51704cedabd58a1ac59e719bc6120546fc37be9f@redhat.com"},"message":"nfsd4: fix null dereference on replay\n\ncommit 9a307403d374b993061f5992a6e260c944920d0b upstream.\n\nif we receive a compound such that:\n\n\t- the sessionid, slot, and sequence number in the SEQUENCE op\n\t  match a cached succesful reply with N ops, and\n\t- the Nth operation of the compound is a PUTFH, PUTPUBFH,\n\t  PUTROOTFH, or RESTOREFH,\n\nthen nfsd4_sequence will return 0 and set cstate->status to\nnfserr_replay_cache.  The current filehandle will not be set.  This will\ncause us to call check_nfsd_access with first argument NULL.\n\nTo nfsd4_compound it looks like we just succesfully executed an\noperation that set a filehandle, but the current filehandle is not set.\n\nFix this by moving the nfserr_replay_cache earlier.  There was never any\nreason to have it after the encode_op label, since the only case where\nhe hit that is when opdesc->op_func sets it.\n\nNote that there are two ways we could hit this case:\n\n\t- a client is resending a previously sent compound that ended\n\t  with one of the four PUTFH-like operations, or\n\t- a client is sending a *new* compound that (incorrectly) shares\n\t  sessionid, slot, and sequence number with a previously sent\n\t  compound, and the length of the previously sent compound\n\t  happens to match the position of a PUTFH-like operation in the\n\t  new compound.\n\nThe second is obviously incorrect client behavior.  The first is also\nvery strange--the only purpose of a PUTFH-like operation is to set the\ncurrent filehandle to be used by the following operation, so there's no\npoint in having it as the last in a compound.\n\nSo it's likely this requires a buggy or malicious client to reproduce.\n\nReported-by: Scott Mayhew <smayhew@redhat.com>\nSigned-off-by: J. Bruce Fields <bfields@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/b324fbe2dc79856152a5403547d8fbbb16b23076"},{"sha":"1173e90e46e4421c6b8d74d9d0fc6ac0f00a68f8","author":{"name":"Paolo Bonzini","email":"7438500e0207b21c4e5dfca8d2a7898734cd7706@redhat.com"},"message":"kvm: async_pf: fix rcu_irq_enter() with irqs enabled\n\ncommit bbaf0e2b1c1b4f88abd6ef49576f0efb1734eae5 upstream.\n\nnative_safe_halt enables interrupts, and you just shouldn't\ncall rcu_irq_enter() with interrupts enabled.  Reorder the\ncall with the following local_irq_disable() to respect the\ninvariant.\n\nReported-by: Ross Zwisler <ross.zwisler@linux.intel.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nAcked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>\nTested-by: Wanpeng Li <wanpeng.li@hotmail.com>\nSigned-off-by: Radim Krčmář <rkrcmar@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/1173e90e46e4421c6b8d74d9d0fc6ac0f00a68f8"},{"sha":"9cdc5d2e13226b733563a67a028224523902cfa3","author":{"name":"Wanpeng Li","email":"db00080a98d9e8b5f6dcf3e2f980859dd811d4ad@hotmail.com"},"message":"KVM: cpuid: Fix read/write out-of-bounds vulnerability in cpuid emulation\n\ncommit a3641631d14571242eec0d30c9faa786cbf52d44 upstream.\n\nIf \"i\" is the last element in the vcpu->arch.cpuid_entries[] array, it\npotentially can be exploited the vulnerability. this will out-of-bounds\nread and write.  Luckily, the effect is small:\n\n\t/* when no next entry is found, the current entry[i] is reselected */\n\tfor (j = i + 1; ; j = (j + 1) % nent) {\n\t\tstruct kvm_cpuid_entry2 *ej = &vcpu->arch.cpuid_entries[j];\n\t\tif (ej->function == e->function) {\n\nIt reads ej->maxphyaddr, which is user controlled.  However...\n\n\t\t\tej->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT;\n\nAfter cpuid_entries there is\n\n\tint maxphyaddr;\n\tstruct x86_emulate_ctxt emulate_ctxt;  /* 16-byte aligned */\n\nSo we have:\n\n- cpuid_entries at offset 1B50 (6992)\n- maxphyaddr at offset 27D0 (6992 + 3200 = 10192)\n- padding at 27D4...27DF\n- emulate_ctxt at 27E0\n\nAnd it writes in the padding.  Pfew, writing the ops field of emulate_ctxt\nwould have been much worse.\n\nThis patch fixes it by modding the index to avoid the out-of-bounds\naccess. Worst case, i == j and ej->function == e->function,\nthe loop can bail out.\n\nReported-by: Moguofang <moguofang@huawei.com>\nCc: Paolo Bonzini <pbonzini@redhat.com>\nCc: Radim Krčmář <rkrcmar@redhat.com>\nCc: Guofang Mo <moguofang@huawei.com>\nSigned-off-by: Wanpeng Li <wanpeng.li@hotmail.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/9cdc5d2e13226b733563a67a028224523902cfa3"},{"sha":"84b4744447629e3ac4d63582a1b196e49a1d1854","author":{"name":"Marc Zyngier","email":"3404add73d8af5dc5183acdd46985971473febc7@arm.com"},"message":"arm: KVM: Allow unaligned accesses at HYP\n\ncommit 33b5c38852b29736f3b472dd095c9a18ec22746f upstream.\n\nWe currently have the HSCTLR.A bit set, trapping unaligned accesses\nat HYP, but we're not really prepared to deal with it.\n\nSince the rest of the kernel is pretty happy about that, let's follow\nits example and set HSCTLR.A to zero. Modern CPUs don't really care.\n\nSigned-off-by: Marc Zyngier <marc.zyngier@arm.com>\nSigned-off-by: Christoffer Dall <cdall@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/84b4744447629e3ac4d63582a1b196e49a1d1854"},{"sha":"b6c8d5688bd6f0850cb7cb768fc29b889588880f","author":{"name":"Alexander Sverdlin","email":"7177340881550226aa9a46669fa100a5d921e43f@gmail.com"},"message":"dmaengine: ep93xx: Always start from BASE0\n\ncommit 0037ae47812b1f431cc602100d1d51f37d77b61e upstream.\n\nThe current buffer is being reset to zero on device_free_chan_resources()\nbut not on device_terminate_all(). It could happen that HW is restarted and\nexpects BASE0 to be used, but the driver is not synchronized and will start\nfrom BASE1. One solution is to reset the buffer explicitly in\nm2p_hw_setup().\n\nSigned-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>\nSigned-off-by: Vinod Koul <vinod.koul@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/b6c8d5688bd6f0850cb7cb768fc29b889588880f"},{"sha":"07e47097fb7ddf31ecff18e435d3ac3d996cf60d","author":{"name":"Jan Kara","email":"7bb7087018cc5fef3c041f6f038f586664845dbf@suse.cz"},"message":"ext4: fix SEEK_HOLE\n\ncommit 7d95eddf313c88b24f99d4ca9c2411a4b82fef33 upstream.\n\nCurrently, SEEK_HOLE implementation in ext4 may both return that there's\na hole at some offset although that offset already has data and skip\nsome holes during a search for the next hole. The first problem is\ndemostrated by:\n\nxfs_io -c \"falloc 0 256k\" -c \"pwrite 0 56k\" -c \"seek -h 0\" file\nwrote 57344/57344 bytes at offset 0\n56 KiB, 14 ops; 0.0000 sec (2.054 GiB/sec and 538461.5385 ops/sec)\nWhence\tResult\nHOLE\t0\n\nWhere we can see that SEEK_HOLE wrongly returned offset 0 as containing\na hole although we have written data there. The second problem can be\ndemonstrated by:\n\nxfs_io -c \"falloc 0 256k\" -c \"pwrite 0 56k\" -c \"pwrite 128k 8k\"\n       -c \"seek -h 0\" file\n\nwrote 57344/57344 bytes at offset 0\n56 KiB, 14 ops; 0.0000 sec (1.978 GiB/sec and 518518.5185 ops/sec)\nwrote 8192/8192 bytes at offset 131072\n8 KiB, 2 ops; 0.0000 sec (2 GiB/sec and 500000.0000 ops/sec)\nWhence\tResult\nHOLE\t139264\n\nWhere we can see that hole at offsets 56k..128k has been ignored by the\nSEEK_HOLE call.\n\nThe underlying problem is in the ext4_find_unwritten_pgoff() which is\njust buggy. In some cases it fails to update returned offset when it\nfinds a hole (when no pages are found or when the first found page has\nhigher index than expected), in some cases conditions for detecting hole\nare just missing (we fail to detect a situation where indices of\nreturned pages are not contiguous).\n\nFix ext4_find_unwritten_pgoff() to properly detect non-contiguous page\nindices and also handle all cases where we got less pages then expected\nin one place and handle it properly there.\n\nFixes: c8c0df241cc2719b1262e627f999638411934f60\nCC: Zheng Liu <wenqing.lz@taobao.com>\nSigned-off-by: Jan Kara <jack@suse.cz>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/07e47097fb7ddf31ecff18e435d3ac3d996cf60d"},{"sha":"99362b9cf1fc5a179c3a975b32f98b0453e56815","author":{"name":"Konstantin Khlebnikov","email":"33f393458f79f8bd43067082d72780d307e418ab@yandex-team.ru"},"message":"ext4: keep existing extra fields when inode expands\n\ncommit 887a9730614727c4fff7cb756711b190593fc1df upstream.\n\next4_expand_extra_isize() should clear only space between old and new\nsize.\n\nFixes: 6dd4ee7cab7e # v2.6.23\nSigned-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>\nSigned-off-by: Theodore Ts'o <tytso@mit.edu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/99362b9cf1fc5a179c3a975b32f98b0453e56815"},{"sha":"52d2cabeb614c5abe1dec45de2d4c9aa3a7cf6a1","author":{"name":"Thinh Nguyen","email":"2826d61ffd89baed1553e5fa7d62c0799c586a70@synopsys.com"},"message":"usb: gadget: f_mass_storage: Serialize wake and sleep execution\n\ncommit dc9217b69dd6089dcfeb86ed4b3c671504326087 upstream.\n\nf_mass_storage has a memorry barrier issue with the sleep and wake\nfunctions that can cause a deadlock. This results in intermittent hangs\nduring MSC file transfer. The host will reset the device after receiving\nno response to resume the transfer. This issue is seen when dwc3 is\nprocessing 2 transfer-in-progress events at the same time, invoking\ncompletion handlers for CSW and CBW. Also this issue occurs depending on\nthe system timing and latency.\n\nTo increase the chance to hit this issue, you can force dwc3 driver to\nwait and process those 2 events at once by adding a small delay (~100us)\nin dwc3_check_event_buf() whenever the request is for CSW and read the\nevent count again. Avoid debugging with printk and ftrace as extra\ndelays and memory barrier will mask this issue.\n\nScenario which can lead to failure:\n-----------------------------------\n1) The main thread sleeps and waits for the next command in\n   get_next_command().\n2) bulk_in_complete() wakes up main thread for CSW.\n3) bulk_out_complete() tries to wake up the running main thread for CBW.\n4) thread_wakeup_needed is not loaded with correct value in\n   sleep_thread().\n5) Main thread goes to sleep again.\n\nThe pattern is shown below. Note the 2 critical variables.\n * common->thread_wakeup_needed\n * bh->state\n\n\tCPU 0 (sleep_thread)\t\tCPU 1 (wakeup_thread)\n\t==============================  ===============================\n\n\t\t\t\t\tbh->state = BH_STATE_FULL;\n\t\t\t\t\tsmp_wmb();\n\tthread_wakeup_needed = 0;\tthread_wakeup_needed = 1;\n\tsmp_rmb();\n\tif (bh->state != BH_STATE_FULL)\n\t\tsleep again ...\n\nAs pointed out by Alan Stern, this is an R-pattern issue. The issue can\nbe seen when there are two wakeups in quick succession. The\nthread_wakeup_needed can be overwritten in sleep_thread, and the read of\nthe bh->state maybe reordered before the write to thread_wakeup_needed.\n\nThis patch applies full memory barrier smp_mb() in both sleep_thread()\nand wakeup_thread() to ensure the order which the thread_wakeup_needed\nand bh->state are written and loaded.\n\nHowever, a better solution in the future would be to use wait_queue\nmethod that takes care of managing memory barrier between waker and\nwaiter.\n\nAcked-by: Alan Stern <stern@rowland.harvard.edu>\nSigned-off-by: Thinh Nguyen <thinhn@synopsys.com>\nSigned-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/52d2cabeb614c5abe1dec45de2d4c9aa3a7cf6a1"},{"sha":"900b4568b39c7d93604ab6ebdca95f520eb71da7","author":{"name":"Jisheng Zhang","email":"341f2a38da9a97f1065bf2abf1ac84c149ee21c4@marvell.com"},"message":"usb: chipidea: udc: fix NULL pointer dereference if udc_start failed\n\ncommit aa1f058d7d9244423b8c5a75b9484b1115df7f02 upstream.\n\nFix below NULL pointer dereference. we set ci->roles[CI_ROLE_GADGET]\ntoo early in ci_hdrc_gadget_init(), if udc_start() fails due to some\nreason, the ci->roles[CI_ROLE_GADGET] check in  ci_hdrc_gadget_destroy\ncan't protect us.\n\nWe fix this issue by only setting ci->roles[CI_ROLE_GADGET] if\nudc_start() succeed.\n\n[    1.398550] Unable to handle kernel NULL pointer dereference at\nvirtual address 00000000\n...\n[    1.448600] PC is at dma_pool_free+0xb8/0xf0\n[    1.453012] LR is at dma_pool_free+0x28/0xf0\n[    2.113369] [<ffffff80081817d8>] dma_pool_free+0xb8/0xf0\n[    2.118857] [<ffffff800841209c>] destroy_eps+0x4c/0x68\n[    2.124165] [<ffffff8008413770>] ci_hdrc_gadget_destroy+0x28/0x50\n[    2.130461] [<ffffff800840fa30>] ci_hdrc_probe+0x588/0x7e8\n[    2.136129] [<ffffff8008380fb8>] platform_drv_probe+0x50/0xb8\n[    2.142066] [<ffffff800837f494>] driver_probe_device+0x1fc/0x2a8\n[    2.148270] [<ffffff800837f68c>] __device_attach_driver+0x9c/0xf8\n[    2.154563] [<ffffff800837d570>] bus_for_each_drv+0x58/0x98\n[    2.160317] [<ffffff800837f174>] __device_attach+0xc4/0x138\n[    2.166072] [<ffffff800837f738>] device_initial_probe+0x10/0x18\n[    2.172185] [<ffffff800837e58c>] bus_probe_device+0x94/0xa0\n[    2.177940] [<ffffff800837c560>] device_add+0x3f0/0x560\n[    2.183337] [<ffffff8008380d20>] platform_device_add+0x180/0x240\n[    2.189541] [<ffffff800840f0e8>] ci_hdrc_add_device+0x440/0x4f8\n[    2.195654] [<ffffff8008414194>] ci_hdrc_usb2_probe+0x13c/0x2d8\n[    2.201769] [<ffffff8008380fb8>] platform_drv_probe+0x50/0xb8\n[    2.207705] [<ffffff800837f494>] driver_probe_device+0x1fc/0x2a8\n[    2.213910] [<ffffff800837f5ec>] __driver_attach+0xac/0xb0\n[    2.219575] [<ffffff800837d4b0>] bus_for_each_dev+0x60/0xa0\n[    2.225329] [<ffffff800837ec80>] driver_attach+0x20/0x28\n[    2.230816] [<ffffff800837e880>] bus_add_driver+0x1d0/0x238\n[    2.236571] [<ffffff800837fdb0>] driver_register+0x60/0xf8\n[    2.242237] [<ffffff8008380ef4>] __platform_driver_register+0x44/0x50\n[    2.248891] [<ffffff80086fd440>] ci_hdrc_usb2_driver_init+0x18/0x20\n[    2.255365] [<ffffff8008082950>] do_one_initcall+0x38/0x128\n[    2.261121] [<ffffff80086e0d00>] kernel_init_freeable+0x1ac/0x250\n[    2.267414] [<ffffff800852f0b8>] kernel_init+0x10/0x100\n[    2.272810] [<ffffff8008082680>] ret_from_fork+0x10/0x50\n\nFixes: 3f124d233e97 (\"usb: chipidea: add role init and destroy APIs\")\nSigned-off-by: Jisheng Zhang <jszhang@marvell.com>\nSigned-off-by: Peter Chen <peter.chen@nxp.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/mifl/android_kernel_qcom_msm-3.18/commits/900b4568b39c7d93604ab6ebdca95f520eb71da7"}]}
{"actor":{"display_login":"mifl"}}