{"push_id":1845319198,"size":49,"distinct_size":49,"ref":"refs/heads/n-mr2","head":"75f707f9a25ea6799a57c8018dda34a0f8977681","before":"c81344876e7700204911bb51ac7fdb7371e0c2cb","commits":[{"sha":"44c037827f0aeddbbbb323930fa3d09a7b4fffca","author":{"name":"David Howells","email":"358fdf7bce8223edb2a0d846104bf62a286894d5@redhat.com"},"message":"KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings\n\ncommit ee8f844e3c5a73b999edf733df1c529d6503ec2f upstream.\n\nThis fixes CVE-2016-9604.\n\nKeyrings whose name begin with a '.' are special internal keyrings and so\nuserspace isn't allowed to create keyrings by this name to prevent\nshadowing.  However, the patch that added the guard didn't fix\nKEYCTL_JOIN_SESSION_KEYRING.  Not only can that create dot-named keyrings,\nit can also subscribe to them as a session keyring if they grant SEARCH\npermission to the user.\n\nThis, for example, allows a root process to set .builtin_trusted_keys as\nits session keyring, at which point it has full access because now the\npossessor permissions are added.  This permits root to add extra public\nkeys, thereby bypassing module verification.\n\nThis also affects kexec and IMA.\n\nThis can be tested by (as root):\n\n\tkeyctl session .builtin_trusted_keys\n\tkeyctl add user a a @s\n\tkeyctl list @s\n\nwhich on my test box gives me:\n\n\t2 keys in keyring:\n\t180010936: ---lswrv     0     0 asymmetric: Build time autogenerated kernel key: ae3d4a31b82daa8e1a75b49dc2bba949fd992a05\n\t801382539: --alswrv     0     0 user: a\n\n\nFix this by rejecting names beginning with a '.' in the keyctl.\n\nSigned-off-by: David Howells <dhowells@redhat.com>\nAcked-by: Mimi Zohar <zohar@linux.vnet.ibm.com>\ncc: linux-ima-devel@lists.sourceforge.net\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/44c037827f0aeddbbbb323930fa3d09a7b4fffca"},{"sha":"44d6e10f77095133e3882529a16b686b2305e6b0","author":{"name":"David Howells","email":"358fdf7bce8223edb2a0d846104bf62a286894d5@redhat.com"},"message":"KEYS: Change the name of the dead type to \".dead\" to prevent user access\n\ncommit c1644fe041ebaf6519f6809146a77c3ead9193af upstream.\n\nThis fixes CVE-2017-6951.\n\nUserspace should not be able to do things with the \"dead\" key type as it\ndoesn't have some of the helper functions set upon it that the kernel\nneeds.  Attempting to use it may cause the kernel to crash.\n\nFix this by changing the name of the type to \".dead\" so that it's rejected\nup front on userspace syscalls by key_get_type_from_user().\n\nThough this doesn't seem to affect recent kernels, it does affect older\nones, certainly those prior to:\n\n\tcommit c06cfb08b88dfbe13be44a69ae2fdc3a7c902d81\n\tAuthor: David Howells <dhowells@redhat.com>\n\tDate:   Tue Sep 16 17:36:06 2014 +0100\n\tKEYS: Remove key_type::match in favour of overriding default by match_preparse\n\nwhich went in before 3.18-rc1.\n\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/44d6e10f77095133e3882529a16b686b2305e6b0"},{"sha":"6efda2501976288f10895834ba2782d0df093441","author":{"name":"Eric Biggers","email":"0106d512ed1cb672be29d4b167a07ead51709fba@google.com"},"message":"KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings\n\ncommit c9f838d104fed6f2f61d68164712e3204bf5271b upstream.\n\nThis fixes CVE-2017-7472.\n\nRunning the following program as an unprivileged user exhausts kernel\nmemory by leaking thread keyrings:\n\n\t#include <keyutils.h>\n\n\tint main()\n\t{\n\t\tfor (;;)\n\t\t\tkeyctl_set_reqkey_keyring(KEY_REQKEY_DEFL_THREAD_KEYRING);\n\t}\n\nFix it by only creating a new thread keyring if there wasn't one before.\nTo make things more consistent, make install_thread_keyring_to_cred()\nand install_process_keyring_to_cred() both return 0 if the corresponding\nkeyring is already present.\n\nFixes: d84f4f992cbd (\"CRED: Inaugurate COW credentials\")\nSigned-off-by: Eric Biggers <ebiggers@google.com>\nSigned-off-by: David Howells <dhowells@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/6efda2501976288f10895834ba2782d0df093441"},{"sha":"be0ef33ed21e505cb34c727d7e56d08c7ddb62ab","author":{"name":"Steven Rostedt (VMware)","email":"9f626a07de58780741a9085807c77fd646ef3459@goodmis.org"},"message":"tracing: Allocate the snapshot buffer before enabling probe\n\ncommit df62db5be2e5f070ecd1a5ece5945b590ee112e0 upstream.\n\nCurrently the snapshot trigger enables the probe and then allocates the\nsnapshot. If the probe triggers before the allocation, it could cause the\nsnapshot to fail and turn tracing off. It's best to allocate the snapshot\nbuffer first, and then enable the trigger. If something goes wrong in the\nenabling of the trigger, the snapshot buffer is still allocated, but it can\nalso be freed by the user by writting zero into the snapshot buffer file.\n\nAlso add a check of the return status of alloc_snapshot().\n\nFixes: 77fd5c15e3 (\"tracing: Add snapshot trigger to function probes\")\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/be0ef33ed21e505cb34c727d7e56d08c7ddb62ab"},{"sha":"0b83d4b7a052ca6cede13077538862bdc75058ea","author":{"name":"Steven Rostedt (VMware)","email":"9f626a07de58780741a9085807c77fd646ef3459@goodmis.org"},"message":"ring-buffer: Have ring_buffer_iter_empty() return true when empty\n\ncommit 78f7a45dac2a2d2002f98a3a95f7979867868d73 upstream.\n\nI noticed that reading the snapshot file when it is empty no longer gives a\nstatus. It suppose to show the status of the snapshot buffer as well as how\nto allocate and use it. For example:\n\n ># cat snapshot\n # tracer: nop\n #\n #\n # * Snapshot is allocated *\n #\n # Snapshot commands:\n # echo 0 > snapshot : Clears and frees snapshot buffer\n # echo 1 > snapshot : Allocates snapshot buffer, if not already allocated.\n #                      Takes a snapshot of the main buffer.\n # echo 2 > snapshot : Clears snapshot buffer (but does not allocate or free)\n #                      (Doesn't have to be '2' works with any number that\n #                       is not a '0' or '1')\n\nBut instead it just showed an empty buffer:\n\n ># cat snapshot\n # tracer: nop\n #\n # entries-in-buffer/entries-written: 0/0   #P:4\n #\n #                              _-----=> irqs-off\n #                             / _----=> need-resched\n #                            | / _---=> hardirq/softirq\n #                            || / _--=> preempt-depth\n #                            ||| /     delay\n #           TASK-PID   CPU#  ||||    TIMESTAMP  FUNCTION\n #              | |       |   ||||       |         |\n\nWhat happened was that it was using the ring_buffer_iter_empty() function to\nsee if it was empty, and if it was, it showed the status. But that function\nwas returning false when it was empty. The reason was that the iter header\npage was on the reader page, and the reader page was empty, but so was the\nbuffer itself. The check only tested to see if the iter was on the commit\npage, but the commit page was no longer pointing to the reader page, but as\nall pages were empty, the buffer is also.\n\nFixes: 651e22f2701b (\"ring-buffer: Always reset iterator to reader page\")\nSigned-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/0b83d4b7a052ca6cede13077538862bdc75058ea"},{"sha":"af82fc7d93082d1e2404779f8bf9761ce43b6285","author":{"name":"Sachin Prabhu","email":"9a944b387d4a4a5b29491bbb03dac8f9b9adf94d@redhat.com"},"message":"cifs: Do not send echoes before Negotiate is complete\n\ncommit 62a6cfddcc0a5313e7da3e8311ba16226fe0ac10 upstream.\n\ncommit 4fcd1813e640 (\"Fix reconnect to not defer smb3 session reconnect\nlong after socket reconnect\") added support for Negotiate requests to\nbe initiated by echo calls.\n\nTo avoid delays in calling echo after a reconnect, I added the patch\nintroduced by the commit b8c600120fc8 (\"Call echo service immediately\nafter socket reconnect\").\n\nThis has however caused a regression with cifs shares which do not have\nsupport for echo calls to trigger Negotiate requests. On connections\nwhich need to call Negotiation, the echo calls trigger an error which\ntriggers a reconnect which in turn triggers another echo call. This\nresults in a loop which is only broken when an operation is performed on\nthe cifs share. For an idle share, it can DOS a server.\n\nThe patch uses the smb_operation can_echo() for cifs so that it is\ncalled only if connection has been already been setup.\n\nkernel bz: 194531\n\nSigned-off-by: Sachin Prabhu <sprabhu@redhat.com>\nTested-by: Jonathan Liu <net147@gmail.com>\nAcked-by: Pavel Shilovsky <pshilov@microsoft.com>\nSigned-off-by: Steve French <smfrench@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/af82fc7d93082d1e2404779f8bf9761ce43b6285"},{"sha":"018a5fb662bdbf94874fb7c000fec6e9f00729ab","author":{"name":"Germano Percossi","email":"e91305baea6ecceb12f5006cd51cb0ad0b3eacbe@citrix.com"},"message":"CIFS: remove bad_network_name flag\n\ncommit a0918f1ce6a43ac980b42b300ec443c154970979 upstream.\n\nSTATUS_BAD_NETWORK_NAME can be received during node failover,\ncausing the flag to be set and making the reconnect thread\nalways unsuccessful, thereafter.\n\nOnce the only place where it is set is removed, the remaining\nbits are rendered moot.\n\nRemoving it does not prevent \"mount\" from failing when a non\nexistent share is passed.\n\nWhat happens when the share really ceases to exist while the\nshare is mounted is undefined now as much as it was before.\n\nSigned-off-by: Germano Percossi <germano.percossi@citrix.com>\nReviewed-by: Pavel Shilovsky <pshilov@microsoft.com>\nSigned-off-by: Steve French <smfrench@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/018a5fb662bdbf94874fb7c000fec6e9f00729ab"},{"sha":"2ac3f8b5b877114d8324ef038d145aaaf86f37a2","author":{"name":"Christian Borntraeger","email":"fc33f3ee5609c5ec6047db37e69d0178239969f7@de.ibm.com"},"message":"s390/mm: fix CMMA vs KSM vs others\n\ncommit a8f60d1fadf7b8b54449fcc9d6b15248917478ba upstream.\n\nOn heavy paging with KSM I see guest data corruption. Turns out that\nKSM will add pages to its tree, where the mapping return true for\npte_unused (or might become as such later).  KSM will unmap such pages\nand reinstantiate with different attributes (e.g. write protected or\nspecial, e.g. in replace_page or write_protect_page)). This uncovered\na bug in our pagetable handling: We must remove the unused flag as\nsoon as an entry becomes present again.\n\nSigned-of-by: Christian Borntraeger <borntraeger@de.ibm.com>\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/2ac3f8b5b877114d8324ef038d145aaaf86f37a2"},{"sha":"3ca9c341821221cafd468134de0582d9798af82c","author":{"name":"Thorsten Leemhuis","email":"177f6c7e7d0681e1b64ab10ef561094344edf6d6@leemhuis.info"},"message":"Input: elantech - add Fujitsu Lifebook E547 to force crc_enabled\n\ncommit 704de489e0e3640a2ee2d0daf173e9f7375582ba upstream.\n\nTemporary got a Lifebook E547 into my hands and noticed the touchpad\nonly works after running:\n\n\techo \"1\" > /sys/devices/platform/i8042/serio2/crc_enabled\n\nAdd it to the list of machines that need this workaround.\n\nSigned-off-by: Thorsten Leemhuis <linux@leemhuis.info>\nReviewed-by: Ulrik De Bie <ulrik.debie-os@e2big.org>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/3ca9c341821221cafd468134de0582d9798af82c"},{"sha":"53d2524d3cc8ccf7d8119bf4e643846c3c4f4562","author":{"name":"Arnd Bergmann","email":"72a0f6d3b182607e6d5c44b93e1abb7b23ee18f3@arndb.de"},"message":"ACPI / power: Avoid maybe-uninitialized warning\n\ncommit fe8c470ab87d90e4b5115902dd94eced7e3305c3 upstream.\n\ngcc -O2 cannot always prove that the loop in acpi_power_get_inferred_state()\nis enterered at least once, so it assumes that cur_state might not get\ninitialized:\n\ndrivers/acpi/power.c: In function 'acpi_power_get_inferred_state':\ndrivers/acpi/power.c:222:9: error: 'cur_state' may be used uninitialized in this function [-Werror=maybe-uninitialized]\n\nThis sets the variable to zero at the start of the loop, to ensure that\nthere is well-defined behavior even for an empty list. This gets rid of\nthe warning.\n\nThe warning first showed up when the -Os flag got removed in a bug fix\npatch in linux-4.11-rc5.\n\nI would suggest merging this addon patch on top of that bug fix to avoid\nintroducing a new warning in the stable kernels.\n\nFixes: 61b79e16c68d (ACPI: Fix incompatibility with mcount-based function graph tracing)\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/53d2524d3cc8ccf7d8119bf4e643846c3c4f4562"},{"sha":"df5024c30a27fd1f6ddde9915e773e4fcad48377","author":{"name":"Haibo Chen","email":"f3d60692cc41c2832ca99a7adf6c7d33a1612bb1@nxp.com"},"message":"mmc: sdhci-esdhc-imx: increase the pad I/O drive strength for DDR50 card\n\ncommit 9f327845358d3dd0d8a5a7a5436b0aa5c432e757 upstream.\n\nCurrently for DDR50 card, it need tuning in default. We meet tuning fail\nissue for DDR50 card and some data CRC error when DDR50 sd card works.\n\nThis is because the default pad I/O drive strength can't make sure DDR50\ncard work stable. So increase the pad I/O drive strength for DDR50 card,\nand use pins_100mhz.\n\nThis fixes DDR50 card support for IMX since DDR50 tuning was enabled from\ncommit 9faac7b95ea4 (\"mmc: sdhci: enable tuning for DDR50\")\n\nTested-and-reported-by: Tim Harvey <tharvey@gateworks.com>\nSigned-off-by: Haibo Chen <haibo.chen@nxp.com>\nAcked-by: Dong Aisheng <aisheng.dong@nxp.com>\nAcked-by: Adrian Hunter <adrian.hunter@intel.com>\nSigned-off-by: Ulf Hansson <ulf.hansson@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/df5024c30a27fd1f6ddde9915e773e4fcad48377"},{"sha":"ea1eeb936e38bc76704a6106e3443fb75cab5836","author":{"name":"Sebastian Siewior","email":"995b3fbc38a4ce5fd89792210752e6a9ba719593@linutronix.de"},"message":"ubi/upd: Always flush after prepared for an update\n\ncommit 9cd9a21ce070be8a918ffd3381468315a7a76ba6 upstream.\n\nIn commit 6afaf8a484cb (\"UBI: flush wl before clearing update marker\") I\nmanaged to trigger and fix a similar bug. Now here is another version of\nwhich I assumed it wouldn't matter back then but it turns out UBI has a\ncheck for it and will error out like this:\n\n|ubi0 warning: validate_vid_hdr: inconsistent used_ebs\n|ubi0 error: validate_vid_hdr: inconsistent VID header at PEB 592\n\nAll you need to trigger this is? \"ubiupdatevol /dev/ubi0_0 file\" + a\npowercut in the middle of the operation.\nubi_start_update() sets the update-marker and puts all EBs on the erase\nlist. After that userland can proceed to write new data while the old EB\naren't erased completely. A powercut at this point is usually not that\nmuch of a tragedy. UBI won't give read access to the static volume\nbecause it has the update marker. It will most likely set the corrupted\nflag because it misses some EBs.\nSo we are all good. Unless the size of the image that has been written\ndiffers from the old image in the magnitude of at least one EB. In that\ncase UBI will find two different values for `used_ebs' and refuse to\nattach the image with the error message mentioned above.\n\nSo in order not to get in the situation, the patch will ensure that we\nwait until everything is removed before it tries to write any data.\nThe alternative would be to detect such a case and remove all EBs at the\nattached time after we processed the volume-table and see the\nupdate-marker set. The patch looks bigger and I doubt it is worth it\nsince usually the write() will wait from time to time for a new EB since\nusually there not that many spare EB that can be used.\n\nSigned-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>\nSigned-off-by: Richard Weinberger <richard@nod.at>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/ea1eeb936e38bc76704a6106e3443fb75cab5836"},{"sha":"d2221b78d1d87050d96e6fbecf616de3220d07a7","author":{"name":"Ravi Bangoria","email":"8bf882eaa418adc30e4aa19df84c433553a93960@linux.vnet.ibm.com"},"message":"powerpc/kprobe: Fix oops when kprobed on 'stdu' instruction\n\ncommit 9e1ba4f27f018742a1aa95d11e35106feba08ec1 upstream.\n\nIf we set a kprobe on a 'stdu' instruction on powerpc64, we see a kernel\nOOPS:\n\n  Bad kernel stack pointer cd93c840 at c000000000009868\n  Oops: Bad kernel stack pointer, sig: 6 [#1]\n  ...\n  GPR00: c000001fcd93cb30 00000000cd93c840 c0000000015c5e00 00000000cd93c840\n  ...\n  NIP [c000000000009868] resume_kernel+0x2c/0x58\n  LR [c000000000006208] program_check_common+0x108/0x180\n\nOn a 64-bit system when the user probes on a 'stdu' instruction, the kernel does\nnot emulate actual store in emulate_step() because it may corrupt the exception\nframe. So the kernel does the actual store operation in exception return code\ni.e. resume_kernel().\n\nresume_kernel() loads the saved stack pointer from memory using lwz, which only\nloads the low 32-bits of the address, causing the kernel crash.\n\nFix this by loading the 64-bit value instead.\n\nFixes: be96f63375a1 (\"powerpc: Split out instruction analysis part of emulate_step()\")\nSigned-off-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>\nReviewed-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>\nReviewed-by: Ananth N Mavinakayanahalli <ananth@linux.vnet.ibm.com>\n[mpe: Change log massage, add stable tag]\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/d2221b78d1d87050d96e6fbecf616de3220d07a7"},{"sha":"0420e5585687bc1713dbaea4f4a2348c4bb43b60","author":{"name":"Yazen Ghannam","email":"c714a4b735c614a72d90d8d038b75c204413ca2a@amd.com"},"message":"x86/mce/AMD: Give a name to MCA bank 3 when accessed with legacy MSRs\n\ncommit 29f72ce3e4d18066ec75c79c857bee0618a3504b upstream.\n\nMCA bank 3 is reserved on systems pre-Fam17h, so it didn't have a name.\nHowever, MCA bank 3 is defined on Fam17h systems and can be accessed\nusing legacy MSRs. Without a name we get a stack trace on Fam17h systems\nwhen trying to register sysfs files for bank 3 on kernels that don't\nrecognize Scalable MCA.\n\nCall MCA bank 3 \"decode_unit\" since this is what it represents on\nFam17h. This will allow kernels without SMCA support to see this bank on\nFam17h+ and prevent the stack trace. This will not affect older systems\nsince this bank is reserved on them, i.e. it'll be ignored.\n\nTested on AMD Fam15h and Fam17h systems.\n\n  WARNING: CPU: 26 PID: 1 at lib/kobject.c:210 kobject_add_internal\n  kobject: (ffff88085bb256c0): attempted to be registered with empty name!\n  ...\n  Call Trace:\n   kobject_add_internal\n   kobject_add\n   kobject_create_and_add\n   threshold_create_device\n   threshold_init_device\n\nSigned-off-by: Yazen Ghannam <yazen.ghannam@amd.com>\nSigned-off-by: Borislav Petkov <bp@suse.de>\nLink: http://lkml.kernel.org/r/1490102285-3659-1-git-send-email-Yazen.Ghannam@amd.com\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/0420e5585687bc1713dbaea4f4a2348c4bb43b60"},{"sha":"2f68b351358a77e992279cdb698bdc2f45f08f11","author":{"name":"Suzuki K Poulose","email":"239e6ad0fed873c6240fa61c5ed99f611cd6b279@arm.com"},"message":"kvm: arm/arm64: Fix locking for kvm_free_stage2_pgd\n\ncommit 8b3405e345b5a098101b0c31b264c812bba045d9 upstream.\n\nIn kvm_free_stage2_pgd() we don't hold the kvm->mmu_lock while calling\nunmap_stage2_range() on the entire memory range for the guest. This could\ncause problems with other callers (e.g, munmap on a memslot) trying to\nunmap a range. And since we have to unmap the entire Guest memory range\nholding a spinlock, make sure we yield the lock if necessary, after we\nunmap each PUD range.\n\nFixes: commit d5d8184d35c9 (\"KVM: ARM: Memory virtualization setup\")\nCc: Paolo Bonzini <pbonzin@redhat.com>\nCc: Marc Zyngier <marc.zyngier@arm.com>\nCc: Christoffer Dall <christoffer.dall@linaro.org>\nCc: Mark Rutland <mark.rutland@arm.com>\nSigned-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>\n[ Avoid vCPU starvation and lockup detector warnings ]\nSigned-off-by: Marc Zyngier <marc.zyngier@arm.com>\nSigned-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>\nSigned-off-by: Christoffer Dall <cdall@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/2f68b351358a77e992279cdb698bdc2f45f08f11"},{"sha":"21ffe52cc23f29b9fddb2bb063340d1cda9cc57e","author":{"name":"Mark Rutland","email":"7bbc68f29a82fb2eb4daac9d4df0c3f473a4ef26@arm.com"},"message":"arm64: avoid returning from bad_mode\n\ncommit 7d9e8f71b989230bc613d121ca38507d34ada849 upstream.\n\nGenerally, taking an unexpected exception should be a fatal event, and\nbad_mode is intended to cater for this. However, it should be possible\nto contain unexpected synchronous exceptions from EL0 without bringing\nthe kernel down, by sending a SIGILL to the task.\n\nWe tried to apply this approach in commit 9955ac47f4ba1c95 (\"arm64:\ndon't kill the kernel on a bad esr from el0\"), by sending a signal for\nany bad_mode call resulting from an EL0 exception.\n\nHowever, this also applies to other unexpected exceptions, such as\nSError and FIQ. The entry paths for these exceptions branch to bad_mode\nwithout configuring the link register, and have no kernel_exit. Thus, if\nwe take one of these exceptions from EL0, bad_mode will eventually\nreturn to the original user link register value.\n\nThis patch fixes this by introducing a new bad_el0_sync handler to cater\nfor the recoverable case, and restoring bad_mode to its original state,\nwhereby it calls panic() and never returns. The recoverable case\nbranches to bad_el0_sync with a bl, and returns to userspace via the\nusual ret_to_user mechanism.\n\nSigned-off-by: Mark Rutland <mark.rutland@arm.com>\nFixes: 9955ac47f4ba1c95 (\"arm64: don't kill the kernel on a bad esr from el0\")\nReported-by: Mark Salter <msalter@redhat.com>\nCc: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Catalin Marinas <catalin.marinas@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/21ffe52cc23f29b9fddb2bb063340d1cda9cc57e"},{"sha":"f2d62e629983929083fc8871381451a9479a6fc0","author":{"name":"Arnd Bergmann","email":"72a0f6d3b182607e6d5c44b93e1abb7b23ee18f3@arndb.de"},"message":"clk: at91: usb: fix determine_rate prototype again\n\nWe had an incorrect backport of\n4591243102fa (\"clk: at91: usb: propagate rate modification to the parent clk\")\nthat was fixed incorrectly in linux-3.18.y by\n76723e7ed589 (\"clk: at91: usb: fix determine_rate prototype\")\n\nas shown by this warning:\n\ndrivers/clk/at91/clk-usb.c:155:20: warning: initialization from incompatible pointer type [-Wincompatible-pointer-types]\ndrivers/clk/at91/clk-usb.c:193:20: warning: initialization from incompatible pointer type [-Wincompatible-pointer-types]\n\nThis should fix it properly.\n\nAcked-by: Boris Brezillon <boris.brezillon@free-electrons.com>\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/f2d62e629983929083fc8871381451a9479a6fc0"},{"sha":"279b8b78a229ad47aadfba6d3b46ea9f72a58512","author":{"name":"Arnd Bergmann","email":"72a0f6d3b182607e6d5c44b93e1abb7b23ee18f3@arndb.de"},"message":"gadgetfs: fix uninitialized variable in error handling\n\ngcc warns about a bug in 3.18.y:\n\ndrivers/usb/gadget/legacy/inode.c:648:10: warning: 'value' may be used\n\nThis is caused by the backport of f01d35a15fa0416 from 4.0 to 3.18:\nc81fc59be42c6e0 gadgetfs: use-after-free in ->aio_read()\n\nThe backported patch was buggy, but the mainline code was rewritten\nin a larger patch directly following this one in a way that fixed the\nbug.\n\nFor stable, we should need only a one-line change to make sure we\nreturn an proper error code. It is very unlikely that anybody ever\nran into the out-of-memory case here in practice, but the compiler\nis right in theory.\n\nFixes: c81fc59be42c (\"gadgetfs: use-after-free in ->aio_read()\")\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/279b8b78a229ad47aadfba6d3b46ea9f72a58512"},{"sha":"e9bf6fcfeb37ac9d6bce176a59b79234c9e79d2b","author":{"name":"Arnd Bergmann","email":"72a0f6d3b182607e6d5c44b93e1abb7b23ee18f3@arndb.de"},"message":"dm bufio: hide bogus warning\n\nmips-gcc-5.3 warns about correct code on linux-3.18 and earlier:\n\nIn file included from ../include/linux/blkdev.h:4:0,\n                 from ../drivers/md/dm-bufio.h:12,\n                 from ../drivers/md/dm-bufio.c:9:\n../drivers/md/dm-bufio.c: In function 'alloc_buffer':\n../include/linux/sched.h:1975:56: warning: 'noio_flag' may be used uninitialized in this function [-Wmaybe-uninitialized]\n  current->flags = (current->flags & ~PF_MEMALLOC_NOIO) | flags;\n                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~\n../drivers/md/dm-bufio.c:325:11: note: 'noio_flag' was declared here\n\nThe warning disappeared on later kernels with this commit: be0c37c985ed\n(\"MIPS: Rearrange PTE bits into fixed positions.\")  I assume this only\nhappened because it changed some inlining decisions.\n\nOn 3.18.y, we can shut up the warning by adding an extra initialization.\n\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/e9bf6fcfeb37ac9d6bce176a59b79234c9e79d2b"},{"sha":"8e0aa9da2a47b8d0379e32e9717c6df2cc3bc66b","author":{"name":"Alban Bedel","email":"e78d7949ae3509f5c9f89a5ad52816b29eba2d12@free.fr"},"message":"MIPS: Fix the build on jz4740 after removing the custom gpio.h\n\ncommit 5b235dc2647e4977b17b5c41d959d0f455831c3f upstream.\n\nSomehow the wrong version of the patch to remove the use of custom\ngpio.h on mips has been merged. This patch add the missing fixes for a\nbuild error on jz4740 because linux/gpio.h doesn't provide any machine\nspecfics definitions anymore.\n\nSigned-off-by: Alban Bedel <albeu@free.fr>\nCc: Paul Burton <paul.burton@imgtec.com>\nCc: Lars-Peter Clausen <lars@metafoo.de>\nCc: Brian Norris <computersforpeace@gmail.com>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Linus Walleij <linus.walleij@linaro.org>\nCc: linux-mips@linux-mips.org\nCc: linux-kernel@vger.kernel.org\nPatchwork: https://patchwork.linux-mips.org/patch/11089/\nSigned-off-by: Ralf Baechle <ralf@linux-mips.org>\nCc: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nathanchance/android_kernel_google_marlin/commits/8e0aa9da2a47b8d0379e32e9717c6df2cc3bc66b"}]}
{"actor":{"display_login":"nathanchance"}}