{"push_id":2112907835,"size":334,"distinct_size":334,"ref":"refs/heads/test","head":"2cc4c8dbab4984a37c230cdac9e86b48f8c95a51","before":"dea6dcc23bb875894b377b9053e3e210151f8edc","commits":[{"sha":"5e6a2b1719181f33f86ec3afa6ae03f3932b5df7","author":{"name":"kpliakas","email":"e944d43488a3adf6d34b2378c36741b7d73e88d7@gmail.com"},"message":"Revert \"Bluetooth: Fix encryption key size for peripheral role\"\n\nThis reverts commit fab2c167a4c731ded0e27e94f0fafd08e9fa9b2e.","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/5e6a2b1719181f33f86ec3afa6ae03f3932b5df7"},{"sha":"e16b6618c4a801412d1278fa255789bb4e74575f","author":{"name":"Linus Torvalds","email":"ead7104581934751970e9decb2db5deb20a9e407@linux-foundation.org"},"message":"vfs,proc: guarantee unique inodes in /proc\n\ncommit 51f0885e5415b4cc6535e9cdcc5145bfbc134353 upstream.\n\nDave Jones found another /proc issue with his Trinity tool: thanks to\nthe namespace model, we can have multiple /proc dentries that point to\nthe same inode, aliasing directories in /proc/<pid>/net/ for example.\n\nThis ends up being a total disaster, because it acts like hardlinked\ndirectories, and causes locking problems.  We rely on the topological\nsort of the inodes pointed to by dentries, and if we have aliased\ndirectories, that odering becomes unreliable.\n\nIn short: don't do this.  Multiple dentries with the same (directory)\ninode is just a bad idea, and the namespace code should never have\nexposed things this way.  But we're kind of stuck with it.\n\nThis solves things by just always allocating a new inode during /proc\ndentry lookup, instead of using \"iget_locked()\" to look up existing\ninodes by superblock and number.  That actually simplies the code a bit,\nat the cost of potentially doing more inode [de]allocations.\n\nThat said, the inode lookup wasn't free either (and did a lot of locking\nof inodes), so it is probably not that noticeable.  We could easily keep\nthe old lookup model for non-directory entries, but rather than try to\nbe excessively clever this just implements the minimal and simplest\nworkaround for the problem.\n\nReported-and-tested-by: Dave Jones <davej@redhat.com>\nAnalyzed-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n[bwh: Backported to 3.2:\n - Adjust context\n - Never drop the pde reference in proc_get_inode(), as callers only\n   expect this when we return an existing inode, and we never do that now]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nCc: Rui Xiang <rui.xiang@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/e16b6618c4a801412d1278fa255789bb4e74575f"},{"sha":"265ab86837975a1874592fcc331bc36f2d9ddcb7","author":{"name":"Jeff Layton","email":"0a799ee4f46e914219e7741adcc5e93178d519ec@redhat.com"},"message":"nfs: don't allow nfs_find_actor to match inodes of the wrong type\n\ncommit f6488c9ba51d65410e2dbc4345413c0d9120971e upstream.\n\nBenny Halevy reported the following oops when testing RHEL6:\n\n<7>nfs_update_inode: inode 892950 mode changed, 0040755 to 0100644\n<1>BUG: unable to handle kernel NULL pointer dereference at (null)\n<1>IP: [<ffffffffa02a52c5>] nfs_closedir+0x15/0x30 [nfs]\n<4>PGD 81448a067 PUD 831632067 PMD 0\n<4>Oops: 0000 [#1] SMP\n<4>last sysfs file: /sys/kernel/mm/redhat_transparent_hugepage/enabled\n<4>CPU 6\n<4>Modules linked in: fuse bonding 8021q garp ebtable_nat ebtables be2iscsi iscsi_boot_sysfs bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi cxgb3 mdio ib_iser rdma_cm ib_cm iw_cm ib_sa ib_mad ib_core ib_addr iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi softdog bridge stp llc xt_physdev ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 xt_multiport iptable_filter ip_tables ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 dm_round_robin dm_multipath objlayoutdriver2(U) nfs(U) lockd fscache auth_rpcgss nfs_acl sunrpc vhost_net macvtap macvlan tun kvm_intel kvm be2net igb dca ptp pps_core microcode serio_raw sg iTCO_wdt iTCO_vendor_support i7core_edac edac_core shpchp ext4 mbcache jbd2 sd_mod crc_t10dif ahci dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]\n<4>\n<4>Pid: 6332, comm: dd Not tainted 2.6.32-358.el6.x86_64 #1 HP ProLiant DL170e G6  /ProLiant DL170e G6\n<4>RIP: 0010:[<ffffffffa02a52c5>]  [<ffffffffa02a52c5>] nfs_closedir+0x15/0x30 [nfs]\n<4>RSP: 0018:ffff88081458bb98  EFLAGS: 00010292\n<4>RAX: ffffffffa02a52b0 RBX: 0000000000000000 RCX: 0000000000000003\n<4>RDX: ffffffffa02e45a0 RSI: ffff88081440b300 RDI: ffff88082d5f5760\n<4>RBP: ffff88081458bba8 R08: 0000000000000000 R09: 0000000000000000\n<4>R10: 0000000000000772 R11: 0000000000400004 R12: 0000000040000008\n<4>R13: ffff88082d5f5760 R14: ffff88082d6e8800 R15: ffff88082f12d780\n<4>FS:  00007f728f37e700(0000) GS:ffff8800456c0000(0000) knlGS:0000000000000000\n<4>CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n<4>CR2: 0000000000000000 CR3: 0000000831279000 CR4: 00000000000007e0\n<4>DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n<4>DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n<4>Process dd (pid: 6332, threadinfo ffff88081458a000, task ffff88082fa0e040)\n<4>Stack:\n<4> 0000000040000008 ffff88081440b300 ffff88081458bbf8 ffffffff81182745\n<4><d> ffff88082d5f5760 ffff88082d6e8800 ffff88081458bbf8 ffffffffffffffea\n<4><d> ffff88082f12d780 ffff88082d6e8800 ffffffffa02a50a0 ffff88082d5f5760\n<4>Call Trace:\n<4> [<ffffffff81182745>] __fput+0xf5/0x210\n<4> [<ffffffffa02a50a0>] ? do_open+0x0/0x20 [nfs]\n<4> [<ffffffff81182885>] fput+0x25/0x30\n<4> [<ffffffff8117e23e>] __dentry_open+0x27e/0x360\n<4> [<ffffffff811c397a>] ? inotify_d_instantiate+0x2a/0x60\n<4> [<ffffffff8117e4b9>] lookup_instantiate_filp+0x69/0x90\n<4> [<ffffffffa02a6679>] nfs_intent_set_file+0x59/0x90 [nfs]\n<4> [<ffffffffa02a686b>] nfs_atomic_lookup+0x1bb/0x310 [nfs]\n<4> [<ffffffff8118e0c2>] __lookup_hash+0x102/0x160\n<4> [<ffffffff81225052>] ? selinux_inode_permission+0x72/0xb0\n<4> [<ffffffff8118e76a>] lookup_hash+0x3a/0x50\n<4> [<ffffffff81192a4b>] do_filp_open+0x2eb/0xdd0\n<4> [<ffffffff8104757c>] ? __do_page_fault+0x1ec/0x480\n<4> [<ffffffff8119f562>] ? alloc_fd+0x92/0x160\n<4> [<ffffffff8117de79>] do_sys_open+0x69/0x140\n<4> [<ffffffff811811f6>] ? sys_lseek+0x66/0x80\n<4> [<ffffffff8117df90>] sys_open+0x20/0x30\n<4> [<ffffffff8100b072>] system_call_fastpath+0x16/0x1b\n<4>Code: 65 48 8b 04 25 c8 cb 00 00 83 a8 44 e0 ff ff 01 5b 41 5c c9 c3 90 55 48 89 e5 53 48 83 ec 08 0f 1f 44 00 00 48 8b 9e a0 00 00 00 <48> 8b 3b e8 13 0c f7 ff 48 89 df e8 ab 3d ec e0 48 83 c4 08 31\n<1>RIP  [<ffffffffa02a52c5>] nfs_closedir+0x15/0x30 [nfs]\n<4> RSP <ffff88081458bb98>\n<4>CR2: 0000000000000000\n\nI think this is ultimately due to a bug on the server. The client had\npreviously found a directory dentry. It then later tried to do an atomic\nopen on a new (regular file) dentry. The attributes it got back had the\nsame filehandle as the previously found directory inode. It then tried\nto put the filp because it failed the aops tests for O_DIRECT opens, and\noopsed here because the ctx was still NULL.\n\nObviously the root cause here is a server issue, but we can take steps\nto mitigate this on the client. When nfs_fhget is called, we always know\nwhat type of inode it is. In the event that there's a broken or\nmalicious server on the other end of the wire, the client can end up\ncrashing because the wrong ops are set on it.\n\nHave nfs_find_actor check that the inode type is correct after checking\nthe fileid. The fileid check should rarely ever match, so it should only\nrarely ever get to this check. In the case where we have a broken\nserver, we may see two different inodes with the same i_ino, but the\nclient should be able to cope with them without crashing.\n\nThis should fix the oops reported here:\n\n    https://bugzilla.redhat.com/show_bug.cgi?id=913660\n\nReported-by: Benny Halevy <bhalevy@tonian.com>\nSigned-off-by: Jeff Layton <jlayton@redhat.com>\nSigned-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>\nCc: Rui Xiang <rui.xiang@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/265ab86837975a1874592fcc331bc36f2d9ddcb7"},{"sha":"39ab2a39ef543df1868b2f46b4ee31392ef8d4e2","author":{"name":"Dan Carpenter","email":"60b2bf2bc0bec4ca4a4b046ca7ef9255248abff8@oracle.com"},"message":"libertas: potential oops in debugfs\n\ncommit a497e47d4aec37aaf8f13509f3ef3d1f6a717d88 upstream.\n\nIf we do a zero size allocation then it will oops.  Also we can't be\nsure the user passes us a NUL terminated string so I've added a\nterminator.\n\nThis code can only be triggered by root.\n\nReported-by: Nico Golde <nico@ngolde.de>\nReported-by: Fabian Yamaguchi <fabs@goesec.de>\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nAcked-by: Dan Williams <dcbw@redhat.com>\nSigned-off-by: John W. Linville <linville@tuxdriver.com>\nCc: Kees Cook <keescook@chromium.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/39ab2a39ef543df1868b2f46b4ee31392ef8d4e2"},{"sha":"718f0a0223362883482cd22b743ca7356f493f2a","author":{"name":"Mahesh Rajashekhara","email":"4ec9f99321b92c1d87abb47d4deeec7f7e3fa567@pmcs.com"},"message":"aacraid: prevent invalid pointer dereference\n\ncommit b4789b8e6be3151a955ade74872822f30e8cd914 upstream.\n\nIt appears that driver runs into a problem here if fibsize is too small\nbecause we allocate user_srbcmd with fibsize size only but later we\naccess it until user_srbcmd->sg.count to copy it over to srbcmd.\n\nIt is not correct to test (fibsize < sizeof(*user_srbcmd)) because this\nstructure already includes one sg element and this is not needed for\ncommands without data.  So, we would recommend to add the following\n(instead of test for fibsize == 0).\n\nSigned-off-by: Mahesh Rajashekhara <Mahesh.Rajashekhara@pmcs.com>\nReported-by: Nico Golde <nico@ngolde.de>\nReported-by: Fabian Yamaguchi <fabs@goesec.de>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Kees Cook <keescook@chromium.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/718f0a0223362883482cd22b743ca7356f493f2a"},{"sha":"80371d9cf0e637cf5ef49e54b4363d52a00a2adc","author":{"name":"Bob Moore","email":"501acddd9011c8588884986035dc215c5dbc831d@intel.com"},"message":"ACPICA: Interpreter: Fix Store() when implicit conversion is not possible.\n\ncommit 3f654bad3257427bea7ba1c4d43a23d99a03622b upstream.\n\nFor the cases such as a store of a string to an existing package\nobject, implement the store as a CopyObject().\nThis is a small departure from the ACPI specification which states\nthat the control method should be aborted in this case. However,\nASLTS suite depends on this behavior.\n\nSigned-off-by: Bob Moore <robert.moore@intel.com>\nSigned-off-by: Lv Zheng <lv.zheng@intel.com>\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/80371d9cf0e637cf5ef49e54b4363d52a00a2adc"},{"sha":"2380d22541c39f71fa187100ca8d0778219350b6","author":{"name":"Bob Moore","email":"501acddd9011c8588884986035dc215c5dbc831d@intel.com"},"message":"ACPICA: DeRefOf operator: Update to fully resolve FieldUnit and BufferField refs.\n\ncommit 63660e05ec719613b518547b40a1c501c10f0bc4 upstream.\n\nPreviously, references to these objects were resolved only to the actual\nFieldUnit or BufferField object. The correct behavior is to resolve these\nreferences to an actual value.\nThe problem is that DerefOf did not resolve these objects to actual\nvalues.  An \"Integer\" object is simple, return the value.  But a field in\nan operation region will require a read operation.  For a BufferField, the\nappropriate data must be extracted from the parent buffer.\n\nNOTE: It appears that this issues is present in Windows7 but not\nWindows8.\n\nSigned-off-by: Bob Moore <robert.moore@intel.com>\nSigned-off-by: Lv Zheng <lv.zheng@intel.com>\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/2380d22541c39f71fa187100ca8d0778219350b6"},{"sha":"464fd9fbde281b330ad2397df4f76d1e889aeeb0","author":{"name":"Bob Moore","email":"501acddd9011c8588884986035dc215c5dbc831d@intel.com"},"message":"ACPICA: Return error if DerefOf resolves to a null package element.\n\ncommit a50abf4842dd7d603a2ad6dcc7f1467fd2a66f03 upstream.\n\nDisallow the dereference of a reference (via index) to an uninitialized\npackage element. Provides compatibility with other ACPI\nimplementations. ACPICA BZ 1003.\n\nReferences: https://bugs.acpica.org/show_bug.cgi?id=431\nSigned-off-by: Bob Moore <robert.moore@intel.com>\nSigned-off-by: Lv Zheng <lv.zheng@intel.com>\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/464fd9fbde281b330ad2397df4f76d1e889aeeb0"},{"sha":"10a15ff17c53ea752dae825e631f95d5db0a1410","author":{"name":"Bob Moore","email":"501acddd9011c8588884986035dc215c5dbc831d@intel.com"},"message":"ACPICA: Fix for a Store->ArgX when ArgX contains a reference to a field.\n\ncommit 4be4be8fee2ee99a52f94f90d03d2f287ee1db86 upstream.\n\nThis change fixes a problem where a Store operation to an ArgX object\nthat contained a reference to a field object did not complete the\nautomatic dereference and then write to the actual field object.\nInstead, the object type of the field object was inadvertently changed\nto match the type of the source operand. The new behavior will actually\nwrite to the field object (buffer field or field unit), thus matching\nthe correct ACPI-defined behavior.\n\nSigned-off-by: Bob Moore <robert.moore@intel.com>\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>\nSigned-off-by: Lv Zheng <lv.zheng@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/10a15ff17c53ea752dae825e631f95d5db0a1410"},{"sha":"4f86ccb1f4911f0ed1415e91e02717d9b7f935de","author":{"name":"Johan Hovold","email":"e24eba2db0921c1ca6876dba30cc34401c101b1d@gmail.com"},"message":"USB: mos7840: fix tiocmget error handling\n\ncommit a91ccd26e75235d86248d018fe3779732bcafd8d upstream.\n\nMake sure to return errors from tiocmget rather than rely on\nuninitialised stack data.\n\nSigned-off-by: Johan Hovold <jhovold@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/4f86ccb1f4911f0ed1415e91e02717d9b7f935de"},{"sha":"d61c42ea0e2228e4beb9b5f61c2fba5d49e5b455","author":{"name":"Neil Horman","email":"490c3644041cdec787fa30a5cd5c4dcfde13be34@tuxdriver.com"},"message":"crypto: ansi_cprng - Fix off by one error in non-block size request\n\ncommit 714b33d15130cbb5ab426456d4e3de842d6c5b8a upstream.\n\nStephan Mueller reported to me recently a error in random number generation in\nthe ansi cprng. If several small requests are made that are less than the\ninstances block size, the remainder for loop code doesn't increment\nrand_data_valid in the last iteration, meaning that the last bytes in the\nrand_data buffer gets reused on the subsequent smaller-than-a-block request for\nrandom data.\n\nThe fix is pretty easy, just re-code the for loop to make sure that\nrand_data_valid gets incremented appropriately\n\nSigned-off-by: Neil Horman <nhorman@tuxdriver.com>\nReported-by: Stephan Mueller <stephan.mueller@atsec.com>\nCC: Stephan Mueller <stephan.mueller@atsec.com>\nCC: Petr Matousek <pmatouse@redhat.com>\nCC: Herbert Xu <herbert@gondor.apana.org.au>\nCC: \"David S. Miller\" <davem@davemloft.net>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nCc: Luis Henriques <luis.henriques@canonical.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/d61c42ea0e2228e4beb9b5f61c2fba5d49e5b455"},{"sha":"013ef6d2c42446432f321e7d6ceb6ed9a1f9a316","author":{"name":"Markus Pargmann","email":"76e150d52825a9c75741b1338bf1c6599fe9cb48@pengutronix.de"},"message":"can: c_can: Fix RX message handling, handle lost message before EOB\n\ncommit 5d0f801a2ccec3b1fdabc3392c8d99ed0413d216 upstream.\n\nIf we handle end of block messages with higher priority than a lost message,\nwe can run into an endless interrupt loop.\n\nThis is reproducable with a am335x processor and \"cansequence -r\" at 1Mbit.\nAs soon as we loose a packet we can't escape from an interrupt loop.\n\nThis patch fixes the problem by handling lost packets before EOB packets.\n\nSigned-off-by: Markus Pargmann <mpa@pengutronix.de>\nSigned-off-by: Marc Kleine-Budde <mkl@pengutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/013ef6d2c42446432f321e7d6ceb6ed9a1f9a316"},{"sha":"057bd6455d9ec0c4d99646cf5ec24d1745daa23c","author":{"name":"David Woodhouse","email":"a5ad9bf052dbae801fcfa8f4e7bfeea66ef33716@infradead.org"},"message":"8139cp: re-enable interrupts after tx timeout\n\ncommit 01ffc0a7f1c1801a2354719dedbc32aff45b987d upstream.\n\nRecovery doesn't work too well if we leave interrupts disabled...\n\nSigned-off-by: David Woodhouse <David.Woodhouse@intel.com>\nAcked-by: Francois Romieu <romieu@fr.zoreil.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nCc: Luis Henriques <luis.henriques@canonical.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/057bd6455d9ec0c4d99646cf5ec24d1745daa23c"},{"sha":"f0e21f1be5168ce40af851e775584e708b35e307","author":{"name":"Andy Adamson","email":"8aa00390f4b80fc6c2deec31a2f83be96e124004@netapp.com"},"message":"SUNRPC handle EKEYEXPIRED in call_refreshresult\n\ncommit eb96d5c97b0825d542e9c4ba5e0a22b519355166 upstream.\n\nCurrently, when an RPCSEC_GSS context has expired or is non-existent\nand the users (Kerberos) credentials have also expired or are non-existent,\nthe client receives the -EKEYEXPIRED error and tries to refresh the context\nforever.  If an application is performing I/O, or other work against the share,\nthe application hangs, and the user is not prompted to refresh/establish their\ncredentials. This can result in a denial of service for other users.\n\nUsers are expected to manage their Kerberos credential lifetimes to mitigate\nthis issue.\n\nMove the -EKEYEXPIRED handling into the RPC layer. Try tk_cred_retry number\nof times to refresh the gss_context, and then return -EACCES to the application.\n\nSigned-off-by: Andy Adamson <andros@netapp.com>\nSigned-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>\n[bwh: Backported to 3.2:\n - Adjust context\n - Drop change to nfs4_handle_reclaim_lease_error()]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/f0e21f1be5168ce40af851e775584e708b35e307"},{"sha":"63086be13ddfb17fca0dbb9ff77230657587939a","author":{"name":"Andy Adamson","email":"8aa00390f4b80fc6c2deec31a2f83be96e124004@netapp.com"},"message":"SUNRPC: don't map EKEYEXPIRED to EACCES in call_refreshresult\n\ncommit f1ff0c27fd9987c59d707cd1a6b6c1fc3ae0a250 upstream.\n\nThe NFS layer needs to know when a key has expired.\nThis change also returns -EKEYEXPIRED to the application, and the informative\n\"Key has expired\" error message is displayed. The user then knows that\ncredential renewal is required.\n\nSigned-off-by: Andy Adamson <andros@netapp.com>\nSigned-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/63086be13ddfb17fca0dbb9ff77230657587939a"},{"sha":"3c13d67b8e200576dfb0ac72f52bce4a26c8c46e","author":{"name":"Al Viro","email":"2a537e97523ffee458777df5f34a2f8c9964f945@zeniv.linux.org.uk"},"message":"Nest rename_lock inside vfsmount_lock\n\ncommit 7ea600b5314529f9d1b9d6d3c41cb26fce6a7a4a upstream.\n\n... lest we get livelocks between path_is_under() and d_path() and friends.\n\nThe thing is, wrt fairness lglocks are more similar to rwsems than to rwlocks;\nit is possible to have thread B spin on attempt to take lock shared while thread\nA is already holding it shared, if B is on lower-numbered CPU than A and there's\na thread C spinning on attempt to take the same lock exclusive.\n\nAs the result, we need consistent ordering between vfsmount_lock (lglock) and\nrename_lock (seq_lock), even though everything that takes both is going to take\nvfsmount_lock only shared.\n\nSpotted-by: Brad Spengler <spender@grsecurity.net>\nCc: stable@vger.kernel.org\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\n[ zhj: backport to 3.4:\n  - Adjust context\n  - s/&vfsmount_lock/vfsmount_lock/]\nSigned-off-by: Zhao Hongjiang <zhaohongjiang@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/3c13d67b8e200576dfb0ac72f52bce4a26c8c46e"},{"sha":"9c962936b1948704d9de164044ed6c56a4f18551","author":{"name":"Oleg Nesterov","email":"66df68a59e3b21ba65b9e7f3fee04bb7abd7ddc2@redhat.com"},"message":"exec: do not abuse ->cred_guard_mutex in threadgroup_lock()\n\ncommit e56fb2874015370e3b7f8d85051f6dce26051df9 upstream.\n\nthreadgroup_lock() takes signal->cred_guard_mutex to ensure that\nthread_group_leader() is stable.  This doesn't look nice, the scope of\nthis lock in do_execve() is huge.\n\nAnd as Dave pointed out this can lead to deadlock, we have the\nfollowing dependencies:\n\n\tdo_execve:\t\tcred_guard_mutex -> i_mutex\n\tcgroup_mount:\t\ti_mutex -> cgroup_mutex\n\tattach_task_by_pid:\tcgroup_mutex -> cred_guard_mutex\n\nChange de_thread() to take threadgroup_change_begin() around the\nswitch-the-leader code and change threadgroup_lock() to avoid\n->cred_guard_mutex.\n\nNote that de_thread() can't sleep with ->group_rwsem held, this can\nobviously deadlock with the exiting leader if the writer is active, so it\ndoes threadgroup_change_end() before schedule().\n\nReported-by: Dave Jones <davej@redhat.com>\nAcked-by: Tejun Heo <tj@kernel.org>\nAcked-by: Li Zefan <lizefan@huawei.com>\nSigned-off-by: Oleg Nesterov <oleg@redhat.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n[ zhj: adjust context ]\nSigned-off-by: Zhao Hongjiang <zhaohongjiang@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/9c962936b1948704d9de164044ed6c56a4f18551"},{"sha":"116943fc88a3ac8538a6977f7132112ea7fed8e2","author":{"name":"Fan Du","email":"c6a867ce6c1a3b651ff7f4f6c8e5bcc58318e902@windriver.com"},"message":"include/linux/fs.h: disable preempt when acquire i_size_seqcount write lock\n\ncommit 74e3d1e17b2e11d175970b85acd44f5927000ba2 upstream.\n\nTwo rt tasks bind to one CPU core.\n\nThe higher priority rt task A preempts a lower priority rt task B which\nhas already taken the write seq lock, and then the higher priority rt\ntask A try to acquire read seq lock, it's doomed to lockup.\n\nrt task A with lower priority: call write\ni_size_write                                        rt task B with higher priority: call sync, and preempt task A\n  write_seqcount_begin(&inode->i_size_seqcount);    i_size_read\n  inode->i_size = i_size;                             read_seqcount_begin <-- lockup here...\n\nSo disable preempt when acquiring every i_size_seqcount *write* lock will\ncure the problem.\n\nSigned-off-by: Fan Du <fan.du@windriver.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Zhao Hongjiang <zhaohongjiang@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/116943fc88a3ac8538a6977f7132112ea7fed8e2"},{"sha":"f068d8dbf2bc4e4a6e95eef7afc9ef637480f818","author":{"name":"Steven Rostedt","email":"9f626a07de58780741a9085807c77fd646ef3459@goodmis.org"},"message":"perf/ftrace: Fix paranoid level for enabling function tracer\n\ncommit 12ae030d54ef250706da5642fc7697cc60ad0df7 upstream.\n\nThe current default perf paranoid level is \"1\" which has\n\"perf_paranoid_kernel()\" return false, and giving any operations that\nuse it, access to normal users. Unfortunately, this includes function\ntracing and normal users should not be allowed to enable function\ntracing by default.\n\nThe proper level is defined at \"-1\" (full perf access), which\n\"perf_paranoid_tracepoint_raw()\" will only give access to. Use that\ncheck instead for enabling function tracing.\n\nReported-by: Dave Jones <davej@redhat.com>\nReported-by: Vince Weaver <vincent.weaver@maine.edu>\nTested-by: Vince Weaver <vincent.weaver@maine.edu>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Ingo Molnar <mingo@kernel.org>\nCc: Jiri Olsa <jolsa@redhat.com>\nCc: Frederic Weisbecker <fweisbec@gmail.com>\nCVE: CVE-2013-2930\nFixes: ced39002f5ea (\"ftrace, perf: Add support to use function tracepoint in perf\")\nSigned-off-by: Steven Rostedt <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/f068d8dbf2bc4e4a6e95eef7afc9ef637480f818"},{"sha":"7a1299f83c14bd92fd38a77d71b6b5df0cf1cdd3","author":{"name":"Stanislaw Gruszka","email":"2bd66680262a09bc6156ef14d6e4cdcb1066cd78@wp.pl"},"message":"rt2x00: check if device is still available on rt2x00mac_flush()\n\ncommit 5671ab05cf2a579218985ef56595387932d78ee4 upstream.\n\nFix random kernel panic with below messages when remove dongle.\n\n[ 2212.355447] BUG: unable to handle kernel NULL pointer dereference at 0000000000000250\n[ 2212.355527] IP: [<ffffffffa02667f2>] rt2x00usb_kick_tx_entry+0x12/0x160 [rt2x00usb]\n[ 2212.355599] PGD 0\n[ 2212.355626] Oops: 0000 [#1] SMP\n[ 2212.355664] Modules linked in: rt2800usb rt2x00usb rt2800lib crc_ccitt rt2x00lib mac80211 cfg80211 tun arc4 fuse rfcomm bnep snd_hda_codec_realtek snd_hda_intel snd_hda_codec btusb uvcvideo bluetooth snd_hwdep x86_pkg_temp_thermal snd_seq coretemp aesni_intel aes_x86_64 snd_seq_device glue_helper snd_pcm ablk_helper videobuf2_vmalloc sdhci_pci videobuf2_memops videobuf2_core sdhci videodev mmc_core serio_raw snd_page_alloc microcode i2c_i801 snd_timer hid_multitouch thinkpad_acpi lpc_ich mfd_core snd tpm_tis wmi tpm tpm_bios soundcore acpi_cpufreq i915 i2c_algo_bit drm_kms_helper drm i2c_core video [last unloaded: cfg80211]\n[ 2212.356224] CPU: 0 PID: 34 Comm: khubd Not tainted 3.12.0-rc3-wl+ #3\n[ 2212.356268] Hardware name: LENOVO 3444CUU/3444CUU, BIOS G6ET93WW (2.53 ) 02/04/2013\n[ 2212.356319] task: ffff880212f687c0 ti: ffff880212f66000 task.ti: ffff880212f66000\n[ 2212.356392] RIP: 0010:[<ffffffffa02667f2>]  [<ffffffffa02667f2>] rt2x00usb_kick_tx_entry+0x12/0x160 [rt2x00usb]\n[ 2212.356481] RSP: 0018:ffff880212f67750  EFLAGS: 00010202\n[ 2212.356519] RAX: 000000000000000c RBX: 000000000000000c RCX: 0000000000000293\n[ 2212.356568] RDX: ffff8801f4dc219a RSI: 0000000000000000 RDI: 0000000000000240\n[ 2212.356617] RBP: ffff880212f67778 R08: ffffffffa02667e0 R09: 0000000000000002\n[ 2212.356665] R10: 0001f95254ab4b40 R11: ffff880212f675be R12: ffff8801f4dc2150\n[ 2212.356712] R13: 0000000000000000 R14: ffffffffa02667e0 R15: 000000000000000d\n[ 2212.356761] FS:  0000000000000000(0000) GS:ffff88021e200000(0000) knlGS:0000000000000000\n[ 2212.356813] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 2212.356852] CR2: 0000000000000250 CR3: 0000000001a0c000 CR4: 00000000001407f0\n[ 2212.356899] Stack:\n[ 2212.356917]  000000000000000c ffff8801f4dc2150 0000000000000000 ffffffffa02667e0\n[ 2212.356980]  000000000000000d ffff880212f677b8 ffffffffa03a31ad ffff8801f4dc219a\n[ 2212.357038]  ffff8801f4dc2150 0000000000000000 ffff8800b93217a0 ffff8801f49bc800\n[ 2212.357099] Call Trace:\n[ 2212.357122]  [<ffffffffa02667e0>] ? rt2x00usb_interrupt_txdone+0x90/0x90 [rt2x00usb]\n[ 2212.357174]  [<ffffffffa03a31ad>] rt2x00queue_for_each_entry+0xed/0x170 [rt2x00lib]\n[ 2212.357244]  [<ffffffffa026701c>] rt2x00usb_kick_queue+0x5c/0x60 [rt2x00usb]\n[ 2212.357314]  [<ffffffffa03a3682>] rt2x00queue_flush_queue+0x62/0xa0 [rt2x00lib]\n[ 2212.357386]  [<ffffffffa03a2930>] rt2x00mac_flush+0x30/0x70 [rt2x00lib]\n[ 2212.357470]  [<ffffffffa04edded>] ieee80211_flush_queues+0xbd/0x140 [mac80211]\n[ 2212.357555]  [<ffffffffa0502e52>] ieee80211_set_disassoc+0x2d2/0x3d0 [mac80211]\n[ 2212.357645]  [<ffffffffa0506da3>] ieee80211_mgd_deauth+0x1d3/0x240 [mac80211]\n[ 2212.357718]  [<ffffffff8108b17c>] ? try_to_wake_up+0xec/0x290\n[ 2212.357788]  [<ffffffffa04dbd18>] ieee80211_deauth+0x18/0x20 [mac80211]\n[ 2212.357872]  [<ffffffffa0418ddc>] cfg80211_mlme_deauth+0x9c/0x140 [cfg80211]\n[ 2212.357913]  [<ffffffffa041907c>] cfg80211_mlme_down+0x5c/0x60 [cfg80211]\n[ 2212.357962]  [<ffffffffa041cd18>] cfg80211_disconnect+0x188/0x1a0 [cfg80211]\n[ 2212.358014]  [<ffffffffa04013bc>] ? __cfg80211_stop_sched_scan+0x1c/0x130 [cfg80211]\n[ 2212.358067]  [<ffffffffa03f8954>] cfg80211_leave+0xc4/0xe0 [cfg80211]\n[ 2212.358124]  [<ffffffffa03f8d1b>] cfg80211_netdev_notifier_call+0x3ab/0x5e0 [cfg80211]\n[ 2212.358177]  [<ffffffff815140f8>] ? inetdev_event+0x38/0x510\n[ 2212.358217]  [<ffffffff81085a94>] ? __wake_up+0x44/0x50\n[ 2212.358254]  [<ffffffff8155995c>] notifier_call_chain+0x4c/0x70\n[ 2212.358293]  [<ffffffff81081156>] raw_notifier_call_chain+0x16/0x20\n[ 2212.358361]  [<ffffffff814b6dd5>] call_netdevice_notifiers_info+0x35/0x60\n[ 2212.358429]  [<ffffffff814b6ec9>] __dev_close_many+0x49/0xd0\n[ 2212.358487]  [<ffffffff814b7028>] dev_close_many+0x88/0x100\n[ 2212.358546]  [<ffffffff814b8150>] rollback_registered_many+0xb0/0x220\n[ 2212.358612]  [<ffffffff814b8319>] unregister_netdevice_many+0x19/0x60\n[ 2212.358694]  [<ffffffffa04d8eb2>] ieee80211_remove_interfaces+0x112/0x190 [mac80211]\n[ 2212.358791]  [<ffffffffa04c585f>] ieee80211_unregister_hw+0x4f/0x100 [mac80211]\n[ 2212.361994]  [<ffffffffa03a1221>] rt2x00lib_remove_dev+0x161/0x1a0 [rt2x00lib]\n[ 2212.365240]  [<ffffffffa0266e2e>] rt2x00usb_disconnect+0x2e/0x70 [rt2x00usb]\n[ 2212.368470]  [<ffffffff81419ce4>] usb_unbind_interface+0x64/0x1c0\n[ 2212.371734]  [<ffffffff813b446f>] __device_release_driver+0x7f/0xf0\n[ 2212.374999]  [<ffffffff813b4503>] device_release_driver+0x23/0x30\n[ 2212.378131]  [<ffffffff813b3c98>] bus_remove_device+0x108/0x180\n[ 2212.381358]  [<ffffffff813b0565>] device_del+0x135/0x1d0\n[ 2212.384454]  [<ffffffff81417760>] usb_disable_device+0xb0/0x270\n[ 2212.387451]  [<ffffffff8140d9cd>] usb_disconnect+0xad/0x1d0\n[ 2212.390294]  [<ffffffff8140f6cd>] hub_thread+0x63d/0x1660\n[ 2212.393034]  [<ffffffff8107c860>] ? wake_up_atomic_t+0x30/0x30\n[ 2212.395728]  [<ffffffff8140f090>] ? hub_port_debounce+0x130/0x130\n[ 2212.398412]  [<ffffffff8107baa0>] kthread+0xc0/0xd0\n[ 2212.401058]  [<ffffffff8107b9e0>] ? insert_kthread_work+0x40/0x40\n[ 2212.403639]  [<ffffffff8155de3c>] ret_from_fork+0x7c/0xb0\n[ 2212.406193]  [<ffffffff8107b9e0>] ? insert_kthread_work+0x40/0x40\n[ 2212.408732] Code: 24 58 08 00 00 bf 80 00 00 00 e8 3a c3 e0 e0 5b 41 5c 5d c3 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 <48> 8b 47 10 48 89 fb 4c 8b 6f 28 4c 8b 20 49 8b 04 24 4c 8b 30\n[ 2212.414671] RIP  [<ffffffffa02667f2>] rt2x00usb_kick_tx_entry+0x12/0x160 [rt2x00usb]\n[ 2212.417646]  RSP <ffff880212f67750>\n[ 2212.420547] CR2: 0000000000000250\n[ 2212.441024] ---[ end trace 5442918f33832bce ]---\n\nSigned-off-by: Stanislaw Gruszka <stf_xl@wp.pl>\nAcked-by: Helmut Schaa <helmut.schaa@googlemail.com>\nSigned-off-by: John W. Linville <linville@tuxdriver.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kj77/android_kernel_sony_msm8226/commits/7a1299f83c14bd92fd38a77d71b6b5df0cf1cdd3"}]}
{"actor":{"display_login":"kj77"}}