)]}' { "log": [ { "commit": "dd741a44330bc17ad3160537f370f91f79e93291", "tree": "06a8dafbdeaf42825bc061465fc663025917e18f", "parents": [ "f5217c8358e4c840fe4b0153d4b0887a8765ce81" ], "author": { "name": "Calvin Owens", "email": "calvinowens@fb.com", "time": "Fri Oct 30 16:57:00 2015 -0700" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Wed Nov 23 06:58:51 2016 -0800" }, "message": "sg: Fix double-free when drives detach during SG_IO\n\nIn sg_common_write(), we free the block request and return -ENODEV if\nthe device is detached in the middle of the SG_IO ioctl().\n\nUnfortunately, sg_finish_rem_req() also tries to free srp-\u003erq, so we\nend up freeing rq-\u003ecmd in the already free rq object, and then free\nthe object itself out from under the current user.\n\nThis ends up corrupting random memory via the list_head on the rq\nobject. The most common crash trace I saw is this:\n\n ------------[ cut here ]------------\n kernel BUG at block/blk-core.c:1420!\n Call Trace:\n [\u003cffffffff81281eab\u003e] blk_put_request+0x5b/0x80\n [\u003cffffffffa0069e5b\u003e] sg_finish_rem_req+0x6b/0x120 [sg]\n [\u003cffffffffa006bcb9\u003e] sg_common_write.isra.14+0x459/0x5a0 [sg]\n [\u003cffffffff8125b328\u003e] ? selinux_file_alloc_security+0x48/0x70\n [\u003cffffffffa006bf95\u003e] sg_new_write.isra.17+0x195/0x2d0 [sg]\n [\u003cffffffffa006cef4\u003e] sg_ioctl+0x644/0xdb0 [sg]\n [\u003cffffffff81170f80\u003e] do_vfs_ioctl+0x90/0x520\n [\u003cffffffff81258967\u003e] ? file_has_perm+0x97/0xb0\n [\u003cffffffff811714a1\u003e] SyS_ioctl+0x91/0xb0\n [\u003cffffffff81602afb\u003e] tracesys+0xdd/0xe2\n RIP [\u003cffffffff81281e04\u003e] __blk_put_request+0x154/0x1a0\n\nThe solution is straightforward: just set srp-\u003erq to NULL in the\nfailure branch so that sg_finish_rem_req() doesn\u0027t attempt to re-free\nit.\n\nAdditionally, since sg_rq_end_io() will never be called on the object\nwhen this happens, we need to free memory backing -\u003ecmd if it isn\u0027t\nembedded in the object itself.\n\nKASAN was extremely helpful in finding the root cause of this bug.\n\nChange-Id: I8c2389a4e2e1b5f753a47f8af60502a761b891b5\nSigned-off-by: Calvin Owens \u003ccalvinowens@fb.com\u003e\nAcked-by: Douglas Gilbert \u003cdgilbert@interlog.com\u003e\nSigned-off-by: Martin K. Petersen \u003cmartin.petersen@oracle.com\u003e\n(cherry picked from commit 9533658b7cd20b3991ecb7952e17fa9c70e0184c)\n" }, { "commit": "e4b3255618617cd65a52789c17996eb55cf29d12", "tree": "2083f1b3accd318351d8d73b08f0087761db90df", "parents": [ "e5b4e125b72bf1ca8c7a8dc5e8f0cf9a9455156f" ], "author": { "name": "Nick Desaulniers", "email": "ndesaulniers@google.com", "time": "Wed Aug 17 16:00:08 2016 -0700" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sun Oct 16 21:28:41 2016 -0500" }, "message": "binder: prevent kptr leak by using %pK format specifier\n\nWorks in conjunction with kptr_restrict.\nBug: 30143283\n\nChange-Id: I2b3ce22f4e206e74614d51453a1d59b7080ab05a\n" }, { "commit": "1557034a2af0b8ba5f9e3ef5228ff2f9750d0e83", "tree": "f11022f5383639d0d8e9397e5c92ff1556ac24e2", "parents": [ "28f4a88d1aaf9513d259d6ad6d2f60fc3624a06b" ], "author": { "name": "Anand Kumar", "email": "anandkumar@codeaurora.org", "time": "Tue Jun 21 17:36:05 2016 +0530" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Thu Sep 29 17:00:53 2016 -0500" }, "message": "wcnss: Avoid user buffer overloading for write cal data\n\ncompare size of allocated cal data buffer from heap\nand count bytes provided to write by user to avoid\nheap overflow for write cal data.\n\nChange-Id: Id70c3230f761385489e5e94c613f4519239dfb1f\nCRs-Fixed: 1032174\nSigned-off-by: Anand Kumar \u003canandkumar@codeaurora.org\u003e\n" }, { "commit": "b99355c6fe72634cfb7633b1c6e1129ea83926ac", "tree": "7e5d5f1fd3dbf14c692bb07145003a43d0fdd73f", "parents": [ "f7d1be34de5e6c6f1d913a671ff48faf3b0a21f8" ], "author": { "name": "Sunil Khatri", "email": "sunilkh@codeaurora.org", "time": "Mon Jun 13 15:49:37 2016 -0700" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Wed Aug 17 21:58:52 2016 -0700" }, "message": "msm: kgsl: Defer adding the mem entry to a process\n\nIf we add the mem entry pointer in the process idr and rb tree\ntoo early, other threads can do operations on the entry by\nguessing the ID or GPU address before the object gets returned\nby the creating operation.\n\nAllocate an ID for the object but don\u0027t assign the pointer until\nright before the creating function returns ensuring that another\noperation can\u0027t access it until it is ready.\n\nBug: 28026365\nCRs-Fixed: 1002974\nChange-Id: Ic0dedbadc0dd2125bd2a7bcc152972c0555e07f8\nSigned-off-by: Jordan Crouse \u003cjcrouse@codeaurora.org\u003e\nSigned-off-by: Sunil Khatri \u003csunilkh@codeaurora.org\u003e\nSigned-off-by: Santhosh Punugu \u003cspunug@codeaurora.org\u003e\n" }, { "commit": "7c8fc387017b20023f65ebc49cf08eccddb2c531", "tree": "281e572c50fe013162cf97f849e8b726c78f5041", "parents": [ "5302008a43dc5b1797d9db81c8274c3726037289" ], "author": { "name": "Sunil Khatri", "email": "sunilkh@codeaurora.org", "time": "Wed Jun 22 14:45:31 2016 +0530" }, "committer": { "name": "Adrian DC", "email": "radian.dc@gmail.com", "time": "Tue Aug 09 17:06:30 2016 +0200" }, "message": "ashmem: Validate ashmem memory with fops pointer\n\nValidate the ashmem memory entry against f_op pointer\nrather then comparing its name with path of the dentry.\n\nThis is to avoid any invalid access to ashmem area in cases\nwhere some one deliberately set the dentry name to /ashmem.\n\nChange-Id: I74e50cd244f68cb13009cf2355e528485f4de34b\nSigned-off-by: Sunil Khatri \u003csunilkh@codeaurora.org\u003e\n" }, { "commit": "5302008a43dc5b1797d9db81c8274c3726037289", "tree": "bd27262a353a50bea764c89b25f9e4742acdfeed", "parents": [ "e0eef5f9e6aa2ab2aeebb3b3487b1cab83fdc32e" ], "author": { "name": "Sandeep Panda", "email": "spanda@codeaurora.org", "time": "Tue Oct 22 13:34:52 2013 +0530" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Mon Jul 25 01:03:59 2016 -0500" }, "message": "msm_fb:hdmi:Fix for audio not routed to HDMI issue\n\nDue to recent security fixes, in HDMI VSD block\nparsing is failing which is causing driver to\nconsider the HDTV connected as DVI and hence no\naudio is routed to TV. So removing the incorrect\nlength check in hdmi_edid_extract_ieee_reg_id function\n\nChange-Id: Iea4a0969710ee1f4411b14973e7d1678f81183cc\nSigned-off-by: Sandeep Panda \u003cspanda@codeaurora.org\u003e\n" }, { "commit": "e0eef5f9e6aa2ab2aeebb3b3487b1cab83fdc32e", "tree": "9a38b53bc5c41de2b5f1003bc2757b4ce0823797", "parents": [ "5a027fba1216ffe700e66b09995c24388b78c7f0" ], "author": { "name": "Sandeep Panda", "email": "spanda@codeaurora.org", "time": "Thu Oct 03 17:47:55 2013 +0530" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Mon Jul 25 01:03:59 2016 -0500" }, "message": "msm_fb:hdmi:Fix for sysfs Entry Information Leaks\n\nThese sysfs entries leak logical and physical addresses\nwithin the kernel and may be read by any user.\nThe read permissions for the sysfs entries changed\nto S_IRUSR from S_IRUGO.\n\nChange-Id: Idfc58c3b639ea4dfa105ff146467a1c4f01edb6e\nSigned-off-by: Sandeep Panda \u003cspanda@codeaurora.org\u003e\n" }, { "commit": "5a027fba1216ffe700e66b09995c24388b78c7f0", "tree": "c98f9832282591cf5c1e7bee413f877f55ae6467", "parents": [ "78fce95b7f144dc2b4b119d5a83e1385d70e5604" ], "author": { "name": "Sandeep Panda", "email": "spanda@codeaurora.org", "time": "Wed Aug 21 23:51:28 2013 +0530" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Mon Jul 25 01:03:58 2016 -0500" }, "message": "msm_fb:hdmi:Security checks for EDID block read.\n\nEnsure data is read from within limits of buffer\nfor data block collection/video data block in EDID.\nThis prevents EDID data from being read past the end\nof data block collection offset.\nEnsure the 3D formats are only read from the proper\nbuffer region for vendor specific data block. This\nprevents illegal data being read from the EDID data.\n\nChange-Id: Id411f7e93aaf9293341a87cb4ca5431005e2bb18\nSigned-off-by: Sandeep Panda \u003cspanda@codeaurora.org\u003e\n" }, { "commit": "78fce95b7f144dc2b4b119d5a83e1385d70e5604", "tree": "f02e8f71fa3fae6c73abbecd67191fcf712f9d62", "parents": [ "26675978acc033f0ab33d6d6cab5ace9c0953386" ], "author": { "name": "Sandeep Panda", "email": "spanda@codeaurora.org", "time": "Mon Jul 08 16:01:55 2013 +0530" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Mon Jul 25 01:03:58 2016 -0500" }, "message": "msm_fb:hdmi:Video playback failure issue\n\nOEM reported Video playback failure\n(before Video, Audio fails actually) issue,\nbecause hdmi_msm_power_off() skips\nSWITCH_SET_HDMI_AUDIO, hdmi_msm_audio_off()\n\nChange-Id: I4db61a62217bc49741571f23703361d273648fee\nSigned-off-by: Nirmal Abraham \u003cnabrah@codeaurora.org\u003e\n" }, { "commit": "26675978acc033f0ab33d6d6cab5ace9c0953386", "tree": "8d2b4124ce22ba5c1e17730020be001f50387816", "parents": [ "611a01d45bdd493283d1d5208d34dcbd4732c0df" ], "author": { "name": "Ajay Singh Parmar", "email": "aparmar@codeaurora.org", "time": "Fri Apr 19 13:28:04 2013 +0530" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Mon Jul 25 01:03:58 2016 -0500" }, "message": "msm_fb: hdmi: Return proper clock get error code\n\nThis change returns the proper error code while in probe and trying\nto get the required clock and fails. This is required for probe deferral\nsupport.\n\nChange-Id: Ief91b1f634c06d3679157313506b56e5948aa79c\nSigned-off-by: Ajay Singh Parmar \u003caparmar@codeaurora.org\u003e\nSigned-off-by: Padmanabhan Komanduru \u003cpkomandu@codeaurora.org\u003e\n" }, { "commit": "611a01d45bdd493283d1d5208d34dcbd4732c0df", "tree": "94c2f6123112823908c8ff7a674b84f42f4cb869", "parents": [ "dba91aa833795491973183a6c04723818770dbcc" ], "author": { "name": "Ajay Singh Parmar", "email": "aparmar@codeaurora.org", "time": "Fri May 10 13:07:49 2013 +0530" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Mon Jul 25 01:03:58 2016 -0500" }, "message": "msm_fb: hdmi: Check for stale HDCP variables\n\nCheck for stale HDCP variables like An from previous authentication\nfailure. In case of stale data, wait for some time to make sure HDCP\nhas has fresh data.\n\nChange-Id: I37685a0246f3b60c383e3bf8d024c2b13fb3e5f6\nSigned-off-by: Ajay Singh Parmar \u003caparmar@codeaurora.org\u003e\nSigned-off-by: Sridhar Gujje \u003csgujje@codeaurora.org\u003e\n" }, { "commit": "dba91aa833795491973183a6c04723818770dbcc", "tree": "83bb06705ed1cc7d0c317d8a3b9a0b1a3507e3a3", "parents": [ "72fe74f6ac2ff839fdc83602bfcb95fc2522846c" ], "author": { "name": "Ajay Singh Parmar", "email": "aparmar@codeaurora.org", "time": "Sun Mar 24 15:04:16 2013 +0530" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Mon Jul 25 01:03:58 2016 -0500" }, "message": "msm_fb: hdmi: Proper HPD state update\n\nOn switching off the HPD, we need to update the HPD state\nafter the polarity has been done to set the HPD state in\nhardware properly.\n\nCRs-Fixed: 465476\nChange-Id: Ic0ba7fac72b8188c86a034ba9a45107689809028\nSigned-off-by: Ajay Singh Parmar \u003caparmar@codeaurora.org\u003e\n" }, { "commit": "72fe74f6ac2ff839fdc83602bfcb95fc2522846c", "tree": "79b0ba53e8cfd5b382628511ceacd65d8c1cabaa", "parents": [ "c618032ce2b03f1a04c221b5b9f42930791837b7" ], "author": { "name": "Ajay Singh Parmar", "email": "aparmar@codeaurora.org", "time": "Thu Mar 07 17:27:26 2013 +0530" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Mon Jul 25 01:03:57 2016 -0500" }, "message": "msm_fb: hdmi: proper vic for 576p\n\nCorrected the AVI info data with right VIC for 576p@50 16:9\n\nCRs-Fixed: 457252\nChange-Id: I8536c141823e9d8436bdd8df0038d3e203ec0c4b\nSigned-off-by: Ajay Singh Parmar \u003caparmar@codeaurora.org\u003e\n" }, { "commit": "c618032ce2b03f1a04c221b5b9f42930791837b7", "tree": "d8071e832350dd8b294d776b9fe653ff9225654f", "parents": [ "6a3a1626dd63f9aac364b93515e1b4d5d9eb9ce7" ], "author": { "name": "Ajay Singh Parmar", "email": "aparmar@codeaurora.org", "time": "Sun Feb 03 01:45:16 2013 +0530" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Mon Jul 25 01:03:57 2016 -0500" }, "message": "msm_fb: hdmi: HDMI resume delay\n\nRemove the delay in HDMI resume sequence by not waiting for HPD\nto be switched on. HDMI panel will not be turned on by default\nwhen the device resumes and would instead be turned on by HPD\nsense if it is still connected.\n\nCRs-Fixed: 440559\nChange-Id: Id276dddbcebf9226e9688aa1b5dad4b281545b21\nSigned-off-by: Ajay Singh Parmar \u003caparmar@codeaurora.org\u003e\n" }, { "commit": "6a3a1626dd63f9aac364b93515e1b4d5d9eb9ce7", "tree": "e8730eece656d58baab4adf6c328217fd407cb83", "parents": [ "2d8836511577d9e1de954d6054e71991890fb487" ], "author": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sat Jul 23 00:30:01 2016 -0500" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Mon Jul 25 01:03:57 2016 -0500" }, "message": "msm_fb: hdmi: Update from HTC m7gpe\n\n* Package version m7gpe-gd08e956-6.04.1700.16\n* Comments that were missing from hdmi_msm.c were referenced from\n caf kernel_msm LA.AF.1.1_rb1.18\n\nChange-Id: I630ac9b946bc630a950c75c66b9a9b142d27155f\n" }, { "commit": "2d8836511577d9e1de954d6054e71991890fb487", "tree": "a21350b0ce8ed09cbe55312497e7e90b03b9930b", "parents": [ "55d9c11b79893e9b7ecf50989332fd156c8f1c65" ], "author": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Fri Jul 22 23:50:29 2016 -0500" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Mon Jul 25 01:03:50 2016 -0500" }, "message": "sii9234: Update from HTC m7gpe\n\n* Package version m7gpe-gd08e956-6.04.1700.16\n* Omit connection test debugging\n* Perform a bit of whitespace cleanup\n\nChange-Id: I52f6f1f7460ad754dc557a3df892691554bb4d01\n" }, { "commit": "55d9c11b79893e9b7ecf50989332fd156c8f1c65", "tree": "1b41d20041fbbeadd33f445486c759d153533e7c", "parents": [ "3fa78f8767884624d961a986b19f4e4da6c7e72d" ], "author": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sat Jul 23 00:23:24 2016 -0500" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sat Jul 23 00:24:02 2016 -0500" }, "message": "Revert \"mmc: Support HTC high capacity erase flag\"\n\nThis reverts commit 2bf1389ce001d7e771e64c00156c74a0ef13cdf3.\n\nChange-Id: Ibce6ae62fbc9bcd7b878631764c85434c1874248\n" }, { "commit": "a748fe610805ca3205532a5335f90cd02d538551", "tree": "728dd207444d2b7bdd789213e816505bd0f6f528", "parents": [ "c36d16480cc125525faffd015cdc07fd3e873c8e" ], "author": { "name": "Naseer Ahmed", "email": "naseer@codeaurora.org", "time": "Wed Sep 26 23:56:59 2012 -0400" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Fri Jul 22 16:03:15 2016 -0500" }, "message": "msm_fb: hdmi: Add support for HDMI Audio caps\n\nAdd sysfs nodes to export the data contained in the\naudio data block and the speaker allocation data block\nfrom the EDID of a connected HDMI sink.\n\nChange-Id: Ie558e930cc5790965d46eb2c30156a23643fa1f7\nSigned-off-by: Ajay Singh Parmar \u003caparmar@codeaurora.org\u003e\nSigned-off-by: Aravind Venkateswaran \u003caravindh@codeaurora.org\u003e\nSigned-off-by: Naseer Ahmed \u003cnaseer@codeaurora.org\u003e\n" }, { "commit": "c36d16480cc125525faffd015cdc07fd3e873c8e", "tree": "71ba721242e1480cc7b55c43538d8a1fdb8af5c4", "parents": [ "ad137a7f9ce22fd865bfc8606ea4b96971b00639" ], "author": { "name": "Naseer Ahmed", "email": "naseer@codeaurora.org", "time": "Wed Sep 26 23:56:24 2012 -0400" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Fri Jul 22 16:03:15 2016 -0500" }, "message": "msm_fb: hdmi: Fix parsing of audio capabilities\n\nFix bugs in the parsing of the Audio Data Blocks and the\nSpeaker Allocation Data Blocks in the EDID data.\n\nChange-Id: I666cf82d149c8ebb02d3bca3a053e494890870c0\nSigned-off-by: Ajay Singh Parmar \u003caparmar@codeaurora.org\u003e\nSigned-off-by: Aravind Venkateswaran \u003caravindh@codeaurora.org\u003e\nSigned-off-by: Naseer Ahmed \u003cnaseer@codeaurora.org\u003e\n" }, { "commit": "ad137a7f9ce22fd865bfc8606ea4b96971b00639", "tree": "369723af93e1b9c503c8c9974f120c159164fe72", "parents": [ "1c14849b1b6f186de14194b04d32b75327c98215" ], "author": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Thu Jul 21 09:05:43 2016 -0500" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Thu Jul 21 21:10:15 2016 -0700" }, "message": "msm_fb: hdmi: Properly set hdmi frame_rate\n\nChange-Id: I0278ebd0423bb4d1f14e6f28de090324320adcb8\n" }, { "commit": "1c14849b1b6f186de14194b04d32b75327c98215", "tree": "10695db9bf733a732622cf1f2bc000357233e9eb", "parents": [ "de13977a9eaf1d55e527b78064acfe84422ad131" ], "author": { "name": "eleekimk", "email": "eleekimk@codeaurora.org", "time": "Wed Aug 19 11:44:09 2015 -0400" }, "committer": { "name": "Adrian DC", "email": "radian.dc@gmail.com", "time": "Wed Jul 20 23:20:17 2016 +0200" }, "message": "gpu: ion: Adding NULL pointer and NULL function checks\n\nCheck for failed allocations and return error code if allocation\nfailed. Also checking for NULL function pointer before calling\nthe function pointer.\n\nChange-Id: I264f81ca43c731dd4abdb0036b3c6bf0b4b11167\nSigned-off-by: Edward Lee \u003celeekimk@codeaurora.org\u003e\n" }, { "commit": "de13977a9eaf1d55e527b78064acfe84422ad131", "tree": "c93c7a8e81db0219ad5c17e76c581783bc346528", "parents": [ "5685cea6d008972f21b1d8de844043b2fcff19da" ], "author": { "name": "Huaibin Yang", "email": "huaibiny@codeaurora.org", "time": "Fri Jan 25 15:32:59 2013 -0800" }, "committer": { "name": "Adrian DC", "email": "radian.dc@gmail.com", "time": "Wed Jul 20 23:11:12 2016 +0200" }, "message": "gpu: ion: add pointer null checks in map and unmap\n\nClients may pass incorrect arguments to ION causing crashes.\nAdd checks to validate input for ION APIs.\n\nChange-Id: Idafa4535b3ef71184ca11fb2c0c4ab073a52ac2f\nSigned-off-by: Huaibin Yang \u003chuaibiny@codeaurora.org\u003e\nSigned-off-by: Olav Haugan \u003cohaugan@codeaurora.org\u003e\n" }, { "commit": "5685cea6d008972f21b1d8de844043b2fcff19da", "tree": "94772b2540bbf3ffc8fb87cb74363c486e0acd5a", "parents": [ "2bf1389ce001d7e771e64c00156c74a0ef13cdf3" ], "author": { "name": "Vinu Deokaran", "email": "vinud@codeaurora.org", "time": "Tue Feb 02 14:58:34 2016 -0500" }, "committer": { "name": "Adrian DC", "email": "radian.dc@gmail.com", "time": "Wed Jul 20 23:09:04 2016 +0200" }, "message": "gpu: ion: return error code when iommu map fails\n\nReturn correct error code to caller when __ion_iommu_map fails.\n\nChange-Id: If18480769fc7d3567017bad586d38e1eb9e0e05f\nSigned-off-by: Vinu Deokaran \u003cvinud@codeaurora.org\u003e\n" }, { "commit": "2bf1389ce001d7e771e64c00156c74a0ef13cdf3", "tree": "e53579fb8523b9064b7509c2ed9854a15d534232", "parents": [ "cb01ec1ef9d10fec471890eee3e0d03bf0ef9f9a" ], "author": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Thu Jun 30 18:35:20 2016 -0500" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Tue Jul 19 11:38:41 2016 -0700" }, "message": "mmc: Support HTC high capacity erase flag\n\nChange-Id: Ifed6a3c96c6516632473b4113dfed4b415c2234e\n" }, { "commit": "cb01ec1ef9d10fec471890eee3e0d03bf0ef9f9a", "tree": "17da5128a3703038119f610407a67f2dfbe35d3c", "parents": [ "a02aca14a7e3238b7628873f576bd2e3021cc4e7" ], "author": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Mon Jul 18 22:09:59 2016 -0500" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Tue Jul 19 11:37:30 2016 -0700" }, "message": "msm_fb: hdmi: Add frame rate to panel info\n\nThis change was part of \u0027msm_fb: display: Update video format on fps\nchange\u0027, but was wiped out when HTC\u0027s hdmi drivers were imported.\n\nChange-Id: I67357a5c41ca8b3663fa2e4724ff117d031a5822\n" }, { "commit": "7c103334af104bc3775b5e46c8ac30da07db814c", "tree": "80c0cae7ac65926832e920610b7e17dfb593c557", "parents": [ "0f090f78066bcd36fff479d73f7353f0693c792b" ], "author": { "name": "Scott Bauer", "email": "sbauer@plzdonthack.me", "time": "Thu Jun 23 08:59:47 2016 -0600" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sun Jul 03 14:16:35 2016 -0700" }, "message": "HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands\n\nThis patch validates the num_values parameter from userland during the\nHIDIOCGUSAGES and HIDIOCSUSAGES commands. Previously, if the report id was set\nto HID_REPORT_ID_UNKNOWN, we would fail to validate the num_values parameter\nleading to a heap overflow.\n\nChange-Id: Ic70137aa9fe2dc2ac67b751a9ac5f5dd852fd46f\nCc: stable@vger.kernel.org\nSigned-off-by: Scott Bauer \u003csbauer@plzdonthack.me\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.cz\u003e\n" }, { "commit": "42343d5c2679ce1e0abb2ef8b3b8152287e4ee8d", "tree": "d7b0c5c0ad97828973b782d58cd2e0c382d502eb", "parents": [ "1aad6bd353451973c3682368f2abba7ee11ee41f" ], "author": { "name": "Jerry Lee", "email": "jerrylee@broadcom.com", "time": "Fri Apr 15 12:57:05 2016 -0700" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Thu Jun 23 23:14:57 2016 -0500" }, "message": "net: wireless: bcmdhd: check privilege on priv cmd\n\n check net admin capability for ioctl calls\n\nBUG\u003d26425765\n\nChange-Id: Idae75c9fc530add3ead3508d25e994bbfec9a6de\n" }, { "commit": "1aad6bd353451973c3682368f2abba7ee11ee41f", "tree": "08a6c6c58f40b812e124321589881e14935a54ae", "parents": [ "e7696131bf2076639fe78409c9902b8009df263c" ], "author": { "name": "Rajesh Kemisetti", "email": "rajeshk@codeaurora.org", "time": "Tue Apr 12 23:17:10 2016 -0700" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Thu Jun 23 23:11:17 2016 -0500" }, "message": "msm: kgsl: Add missing checks for alloc size and sglen\n\nIn _kgsl_sharedmem_page_alloc():\n\n- Make len of type size_t to be in line with size.\n - Check for boundary limits of requested alloc size before honoring.\n - Make sure sglen is greater than zero before marking it as end\n of sg list.\n\nBUG\u003d27475454\n\nChange-Id: I8e18aad2118f58ce677050ff4c4a4b0823c4b4b3\n" }, { "commit": "e7696131bf2076639fe78409c9902b8009df263c", "tree": "a2cfca5e148018903681b3faff314475298839d3", "parents": [ "f9e895dae4261eb5e3ebb412c2e9586927c6786a" ], "author": { "name": "Kangjie Lu", "email": "kangjielu@gmail.com", "time": "Tue May 03 16:32:16 2016 -0400" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Thu Jun 23 23:02:51 2016 -0500" }, "message": "USB: usbfs: fix potential infoleak in devio\n\nThe stack object “ci” has a total size of 8 bytes. Its last 3 bytes\nare padding bytes which are not initialized and leaked to userland\nvia “copy_to_user”.\n\nChange-Id: Icd49231ee1862682739a871ae78a5602ee104731\nSigned-off-by: Kangjie Lu \u003ckjlu@gatech.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b23297ea412da06e84002f441f209cc5df45d0d1", "tree": "b3cd9c342e3b5c6cebaedd9f7368204752ad7a5d", "parents": [ "f44333438e3af7f5e8aaa7e9e3a38fb4b5df20e9" ], "author": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sun May 29 23:03:35 2016 -0500" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sun May 29 23:13:28 2016 -0500" }, "message": "msm: HTC: Remove unused voltage storage from reboot handler\n\nNothing reads these values anymore.\n\nChange-Id: I618a8ea88c629e5f9b776eb934ebc92f1e2d31fc\n" }, { "commit": "f44333438e3af7f5e8aaa7e9e3a38fb4b5df20e9", "tree": "93732b6c799da494ca85481e9831722cfc607952", "parents": [ "d19551f7bde90daa5949ee49dfc54c556f444bcf" ], "author": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sat May 28 01:17:41 2016 -0500" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sun May 29 18:18:22 2016 -0700" }, "message": "power: pm8921-bms-htc: Remove usage of read_backup_cc_uv()\n\nDo not rely on HTC\u0027s restart handler to store reliable voltages for use\nsubsequent restarts. We\u0027ve see this fail on a ville device. So, remove\nusage of read_backup_cc_uv(). This change matches that introduced by\nm7gpe 6.04.1700.6.\n\nCYAN-7738\n\nChange-Id: I6089441dceac8d3f2d1d2782773957dd846ea66d\n(cherry picked from commit 1e1d8964bd5e361ebd7841e8d0cce8a2c7846f17)\n" }, { "commit": "d19551f7bde90daa5949ee49dfc54c556f444bcf", "tree": "8b63be50a760907cb8d2133310ad76be408eae49", "parents": [ "b07d017a0e48ac49e7dd32a6df38e0ec2691771f" ], "author": { "name": "Guillaume Nault", "email": "g.nault@alphalink.fr", "time": "Wed Mar 23 16:38:55 2016 +0100" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Mon May 23 23:10:04 2016 -0500" }, "message": "ppp: take reference on channels netns\n\nLet channels hold a reference on their network namespace.\nSome channel types, like ppp_async and ppp_synctty, can have their\nuserspace controller running in a different namespace. Therefore they\ncan\u0027t rely on them to preclude their netns from being removed from\nunder them.\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nBUG: KASAN: use-after-free in ppp_unregister_channel+0x372/0x3a0 at\naddr ffff880064e217e0\nRead of size 8 by task syz-executor/11581\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nBUG net_namespace (Not tainted): kasan: bad access detected\n-----------------------------------------------------------------------------\n\nDisabling lock debugging due to kernel taint\nINFO: Allocated in copy_net_ns+0x6b/0x1a0 age\u003d92569 cpu\u003d3 pid\u003d6906\n[\u003c none \u003e] ___slab_alloc+0x4c7/0x500 kernel/mm/slub.c:2440\n[\u003c none \u003e] __slab_alloc+0x4c/0x90 kernel/mm/slub.c:2469\n[\u003c inline \u003e] slab_alloc_node kernel/mm/slub.c:2532\n[\u003c inline \u003e] slab_alloc kernel/mm/slub.c:2574\n[\u003c none \u003e] kmem_cache_alloc+0x23a/0x2b0 kernel/mm/slub.c:2579\n[\u003c inline \u003e] kmem_cache_zalloc kernel/include/linux/slab.h:597\n[\u003c inline \u003e] net_alloc kernel/net/core/net_namespace.c:325\n[\u003c none \u003e] copy_net_ns+0x6b/0x1a0 kernel/net/core/net_namespace.c:360\n[\u003c none \u003e] create_new_namespaces+0x2f6/0x610 kernel/kernel/nsproxy.c:95\n[\u003c none \u003e] copy_namespaces+0x297/0x320 kernel/kernel/nsproxy.c:150\n[\u003c none \u003e] copy_process.part.35+0x1bf4/0x5760 kernel/kernel/fork.c:1451\n[\u003c inline \u003e] copy_process kernel/kernel/fork.c:1274\n[\u003c none \u003e] _do_fork+0x1bc/0xcb0 kernel/kernel/fork.c:1723\n[\u003c inline \u003e] SYSC_clone kernel/kernel/fork.c:1832\n[\u003c none \u003e] SyS_clone+0x37/0x50 kernel/kernel/fork.c:1826\n[\u003c none \u003e] entry_SYSCALL_64_fastpath+0x16/0x7a kernel/arch/x86/entry/entry_64.S:185\n\nINFO: Freed in net_drop_ns+0x67/0x80 age\u003d575 cpu\u003d2 pid\u003d2631\n[\u003c none \u003e] __slab_free+0x1fc/0x320 kernel/mm/slub.c:2650\n[\u003c inline \u003e] slab_free kernel/mm/slub.c:2805\n[\u003c none \u003e] kmem_cache_free+0x2a0/0x330 kernel/mm/slub.c:2814\n[\u003c inline \u003e] net_free kernel/net/core/net_namespace.c:341\n[\u003c none \u003e] net_drop_ns+0x67/0x80 kernel/net/core/net_namespace.c:348\n[\u003c none \u003e] cleanup_net+0x4e5/0x600 kernel/net/core/net_namespace.c:448\n[\u003c none \u003e] process_one_work+0x794/0x1440 kernel/kernel/workqueue.c:2036\n[\u003c none \u003e] worker_thread+0xdb/0xfc0 kernel/kernel/workqueue.c:2170\n[\u003c none \u003e] kthread+0x23f/0x2d0 kernel/drivers/block/aoe/aoecmd.c:1303\n[\u003c none \u003e] ret_from_fork+0x3f/0x70 kernel/arch/x86/entry/entry_64.S:468\nINFO: Slab 0xffffea0001938800 objects\u003d3 used\u003d0 fp\u003d0xffff880064e20000\nflags\u003d0x5fffc0000004080\nINFO: Object 0xffff880064e20000 @offset\u003d0 fp\u003d0xffff880064e24200\n\nCPU: 1 PID: 11581 Comm: syz-executor Tainted: G B 4.4.0+\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nrel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014\n 00000000ffffffff ffff8800662c7790 ffffffff8292049d ffff88003e36a300\n ffff880064e20000 ffff880064e20000 ffff8800662c77c0 ffffffff816f2054\n ffff88003e36a300 ffffea0001938800 ffff880064e20000 0000000000000000\nCall Trace:\n [\u003c inline \u003e] __dump_stack kernel/lib/dump_stack.c:15\n [\u003cffffffff8292049d\u003e] dump_stack+0x6f/0xa2 kernel/lib/dump_stack.c:50\n [\u003cffffffff816f2054\u003e] print_trailer+0xf4/0x150 kernel/mm/slub.c:654\n [\u003cffffffff816f875f\u003e] object_err+0x2f/0x40 kernel/mm/slub.c:661\n [\u003c inline \u003e] print_address_description kernel/mm/kasan/report.c:138\n [\u003cffffffff816fb0c5\u003e] kasan_report_error+0x215/0x530 kernel/mm/kasan/report.c:236\n [\u003c inline \u003e] kasan_report kernel/mm/kasan/report.c:259\n [\u003cffffffff816fb4de\u003e] __asan_report_load8_noabort+0x3e/0x40 kernel/mm/kasan/report.c:280\n [\u003c inline \u003e] ? ppp_pernet kernel/include/linux/compiler.h:218\n [\u003cffffffff83ad71b2\u003e] ? ppp_unregister_channel+0x372/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392\n [\u003c inline \u003e] ppp_pernet kernel/include/linux/compiler.h:218\n [\u003cffffffff83ad71b2\u003e] ppp_unregister_channel+0x372/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392\n [\u003c inline \u003e] ? ppp_pernet kernel/drivers/net/ppp/ppp_generic.c:293\n [\u003cffffffff83ad6f26\u003e] ? ppp_unregister_channel+0xe6/0x3a0 kernel/drivers/net/ppp/ppp_generic.c:2392\n [\u003cffffffff83ae18f3\u003e] ppp_asynctty_close+0xa3/0x130 kernel/drivers/net/ppp/ppp_async.c:241\n [\u003cffffffff83ae1850\u003e] ? async_lcp_peek+0x5b0/0x5b0 kernel/drivers/net/ppp/ppp_async.c:1000\n [\u003cffffffff82c33239\u003e] tty_ldisc_close.isra.1+0x99/0xe0 kernel/drivers/tty/tty_ldisc.c:478\n [\u003cffffffff82c332c0\u003e] tty_ldisc_kill+0x40/0x170 kernel/drivers/tty/tty_ldisc.c:744\n [\u003cffffffff82c34943\u003e] tty_ldisc_release+0x1b3/0x260 kernel/drivers/tty/tty_ldisc.c:772\n [\u003cffffffff82c1ef21\u003e] tty_release+0xac1/0x13e0 kernel/drivers/tty/tty_io.c:1901\n [\u003cffffffff82c1e460\u003e] ? release_tty+0x320/0x320 kernel/drivers/tty/tty_io.c:1688\n [\u003cffffffff8174de36\u003e] __fput+0x236/0x780 kernel/fs/file_table.c:208\n [\u003cffffffff8174e405\u003e] ____fput+0x15/0x20 kernel/fs/file_table.c:244\n [\u003cffffffff813595ab\u003e] task_work_run+0x16b/0x200 kernel/kernel/task_work.c:115\n [\u003c inline \u003e] exit_task_work kernel/include/linux/task_work.h:21\n [\u003cffffffff81307105\u003e] do_exit+0x8b5/0x2c60 kernel/kernel/exit.c:750\n [\u003cffffffff813fdd20\u003e] ? debug_check_no_locks_freed+0x290/0x290 kernel/kernel/locking/lockdep.c:4123\n [\u003cffffffff81306850\u003e] ? mm_update_next_owner+0x6f0/0x6f0 kernel/kernel/exit.c:357\n [\u003cffffffff813215e6\u003e] ? __dequeue_signal+0x136/0x470 kernel/kernel/signal.c:550\n [\u003cffffffff8132067b\u003e] ? recalc_sigpending_tsk+0x13b/0x180 kernel/kernel/signal.c:145\n [\u003cffffffff81309628\u003e] do_group_exit+0x108/0x330 kernel/kernel/exit.c:880\n [\u003cffffffff8132b9d4\u003e] get_signal+0x5e4/0x14f0 kernel/kernel/signal.c:2307\n [\u003c inline \u003e] ? kretprobe_table_lock kernel/kernel/kprobes.c:1113\n [\u003cffffffff8151d355\u003e] ? kprobe_flush_task+0xb5/0x450 kernel/kernel/kprobes.c:1158\n [\u003cffffffff8115f7d3\u003e] do_signal+0x83/0x1c90 kernel/arch/x86/kernel/signal.c:712\n [\u003cffffffff8151d2a0\u003e] ? recycle_rp_inst+0x310/0x310 kernel/include/linux/list.h:655\n [\u003cffffffff8115f750\u003e] ? setup_sigcontext+0x780/0x780 kernel/arch/x86/kernel/signal.c:165\n [\u003cffffffff81380864\u003e] ? finish_task_switch+0x424/0x5f0 kernel/kernel/sched/core.c:2692\n [\u003c inline \u003e] ? finish_lock_switch kernel/kernel/sched/sched.h:1099\n [\u003cffffffff81380560\u003e] ? finish_task_switch+0x120/0x5f0 kernel/kernel/sched/core.c:2678\n [\u003c inline \u003e] ? context_switch kernel/kernel/sched/core.c:2807\n [\u003cffffffff85d794e9\u003e] ? __schedule+0x919/0x1bd0 kernel/kernel/sched/core.c:3283\n [\u003cffffffff81003901\u003e] exit_to_usermode_loop+0xf1/0x1a0 kernel/arch/x86/entry/common.c:247\n [\u003c inline \u003e] prepare_exit_to_usermode kernel/arch/x86/entry/common.c:282\n [\u003cffffffff810062ef\u003e] syscall_return_slowpath+0x19f/0x210 kernel/arch/x86/entry/common.c:344\n [\u003cffffffff85d88022\u003e] int_ret_from_sys_call+0x25/0x9f kernel/arch/x86/entry/entry_64.S:281\nMemory state around the buggy address:\n ffff880064e21680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff880064e21700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003effff880064e21780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ^\n ffff880064e21800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff880064e21880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nChange-Id: I591b30eafa1b57bd2e211e1f33c39128702ff0b0\nFixes: 273ec51dd7ce (\"net: ppp_generic - introduce net-namespace functionality v2\")\nReported-by: Baozeng Ding \u003csploving1@gmail.com\u003e\nSigned-off-by: Guillaume Nault \u003cg.nault@alphalink.fr\u003e\nReviewed-by: Cyrill Gorcunov \u003cgorcunov@openvz.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "43888bb6d07eab673aa859e55bf111c208c51ab3", "tree": "92abc1a6c9db7ad304bb2b6508324c62ad290481", "parents": [ "1a3b171cdf0820fc93f649635b74fc49e63db077" ], "author": { "name": "Oliver Neukum", "email": "oneukum@suse.com", "time": "Tue Mar 15 10:14:04 2016 +0100" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Mon May 23 21:13:50 2016 -0500" }, "message": "USB: cdc-acm: more sanity checking\n\nAn attack has become available which pretends to be a quirky\ndevice circumventing normal sanity checks and crashes the kernel\nby an insufficient number of interfaces. This patch adds a check\nto the code path for quirky devices.\n\nChange-Id: Ie96a95d833e4ca9c3c3c3557679115ffb7069b5b\nSigned-off-by: Oliver Neukum \u003cONeukum@suse.com\u003e\nCC: stable@vger.kernel.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1a3b171cdf0820fc93f649635b74fc49e63db077", "tree": "222c3ada58dcfd5f4ba95d94d987f60d1627774c", "parents": [ "aae431f6c1950b037f8bc858eeecb0ad3e42f139" ], "author": { "name": "Oliver Neukum", "email": "oneukum@suse.com", "time": "Mon Mar 07 11:31:10 2016 +0100" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Mon May 23 21:13:35 2016 -0500" }, "message": "usbnet: cleanup after bind() in probe()\n\nIn case bind() works, but a later error forces bailing\nin probe() in error cases work and a timer may be scheduled.\nThey must be killed. This fixes an error case related to\nthe double free reported in\nhttp://www.spinics.net/lists/netdev/msg367669.html\nand needs to go on top of Linus\u0027 fix to cdc-ncm.\n\nChange-Id: I43b1673bc31b3af05789e461b39c55062735cc56\nSigned-off-by: Oliver Neukum \u003cONeukum@suse.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "332797a68d7a269225c47de2bb4e581eea5bcb47", "tree": "1e97083baf1dff063a3f497233a40089f7ae2e50", "parents": [ "9f4d6d14ddc0f4734612512faa5b60743ad85dad" ], "author": { "name": "Jose Adolfo Galdamez", "email": "josegalre@pac-rom.com", "time": "Fri May 13 00:02:28 2016 -0600" }, "committer": { "name": "Jose Adolfo Galdamez", "email": "josegalre@pac-rom.com", "time": "Fri May 13 00:03:36 2016 -0600" }, "message": "input: evdev: use bma250 sensor for evita, fighter and jet\n\nChange-Id: If35b77c77c894ddce9c4b225bdacc52ca32f1f49\n" }, { "commit": "9f4d6d14ddc0f4734612512faa5b60743ad85dad", "tree": "dda311d51a7adf11025e3d25048d94a5c96cedc6", "parents": [ "f397b41562c8eb20a6ee610a48c6302065c91a2a" ], "author": { "name": "Dimitri Unrau", "email": "dimon@gmx.net", "time": "Thu Apr 21 03:23:06 2016 +0200" }, "committer": { "name": "Gerrit Code Review", "email": "gerrit@cyanogenmod.org", "time": "Sun May 01 13:56:11 2016 -0700" }, "message": "input: evdev: use boottime for sensors\n\nThis makes android-m happy since it requires CLOCK_BOOTTIME\nfor it\u0027s event timestamps.\nSee /proc/bus/input/devices for the naming of input devices.\n\nChange-Id: I84b7da35f434105d6ff14042a2de9b3cefeecef7\n" }, { "commit": "f397b41562c8eb20a6ee610a48c6302065c91a2a", "tree": "d57299441b55a164daa250deb4943b6b70b77f5a", "parents": [ "3c85050e5437728302f4d5c2c583024bbfc1f2e1" ], "author": { "name": "Aniroop Mathur", "email": "aniroop.mathur@gmail.com", "time": "Wed Dec 17 15:33:06 2014 -0800" }, "committer": { "name": "Gerrit Code Review", "email": "gerrit@cyanogenmod.org", "time": "Sun May 01 13:56:10 2016 -0700" }, "message": "Input: evdev - add CLOCK_BOOTTIME support\n\nThis patch adds support for CLOCK_BOOTTIME for input event timestamp.\nCLOCK_BOOTTIME includes suspend time, so it would allow aplications\nto get correct time difference between two events even when system\nresumes from suspend state.\n\nChange-Id: I0f9bdf6bf5143ebbc6ef36757e62b866d3bd3539\n" }, { "commit": "e4142a227865e39c5e94087cd04ac3b485a38aaa", "tree": "c656bbc17a1004b4944cab782822a41d4761911f", "parents": [ "5eb7bff670ea84ad5fdae94fe3b89e42f3af5eb6" ], "author": { "name": "Flemmard", "email": "flemmard@gmail.com", "time": "Tue Dec 24 10:38:37 2013 +0100" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sun Apr 17 23:19:50 2016 -0500" }, "message": "staging: prima: setup wcnss before prima loads\n\n* Prima needs wcnss to be set up when it loads.\n Therefore use a platform_driver to notify prima that wcnss is ready.\n\nThis commit is largely based on \"staging: prima: Allow prima_wlan to be\nbuilt inside kernel\" (I6c403f705e9dffa524a2aab54453e50775b45264), but\nchanges to wcnss are already included in this kernel. Also, this commit\nincludes a couple more modname changes. Reference the original commit\nfor a better understanding of how this is implemented.\n\nChange-Id: I1d20cec90b446c9318b8a13143ac21ff33d2acec\n" }, { "commit": "5eb7bff670ea84ad5fdae94fe3b89e42f3af5eb6", "tree": "80830beeb1bf0db19f5706ac516168691b3ea416", "parents": [ "cd633ecf49f668b6fb9ed29dbf291ed2ec4cfeae" ], "author": { "name": "Steve Kondik", "email": "shade@chemlab.org", "time": "Mon Aug 18 06:53:01 2014 -0500" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sat Apr 16 21:17:11 2016 -0500" }, "message": "staging: prima: Get MAC address from WCNSS platform device\n\n* Tools can set the value easily from userspace.\n\nChange-Id: Ied4e4f1a4da0c58aa9bc07ee38aebed637eaeda3\n" }, { "commit": "cd633ecf49f668b6fb9ed29dbf291ed2ec4cfeae", "tree": "ce28b2f4c1149f0b510fea8bfcd820735ca460bc", "parents": [ "a16bc2bf9fd1e88e8b6c6d3be8626e2528b058d1" ], "author": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Fri Apr 15 10:57:52 2016 -0500" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sat Apr 16 21:17:11 2016 -0500" }, "message": "staging: prima: Update paths and config names\n\nUnderscore names are no longer needed to differentiate drivers.\n\nChange-Id: I20677da69047053b4d23158dcfd0e5c07815b794\n" }, { "commit": "a16bc2bf9fd1e88e8b6c6d3be8626e2528b058d1", "tree": "0a5fa63613d63342291b5607f7cd6921e60bc85c", "parents": [ "abd7a6fdf5c96e661e4520ec1cf718b9378f1342" ], "author": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Fri Apr 15 10:52:31 2016 -0500" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sat Apr 16 21:16:51 2016 -0500" }, "message": "staging: prima: Replace prima with prima_jb3.2\n\nBegin migration from two prima drivers to one.\n\nChange-Id: I78455b363d3ec2efc364ea398073c0b38dc992e0\n" }, { "commit": "abd7a6fdf5c96e661e4520ec1cf718b9378f1342", "tree": "196b1c60ccc0499fe92e3a531576e6c6c18198c0", "parents": [ "86f24e99598f298b78759616dfa9e8fcca0d3688", "3389604d77540abf738b486d650c1745b2d663ca" ], "author": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Mon Apr 11 13:09:16 2016 -0700" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Mon Apr 11 13:39:17 2016 -0700" }, "message": "Merge tag \u0027v3.4.111\u0027 into cm-13.0\n\nThis is the 3.4.111 stable release\n\nConflicts:\n fs/file_table.c\n include/net/sock.h\n\nChange-Id: Ic65a8a4450b508018d5c092b420ebb23df0daef6\n" }, { "commit": "24fa51bde52b3671afa476c96d63bcf8a4e8a307", "tree": "2acc8e5418f67ee480294a983397eaea5a485160", "parents": [ "f43d490b4ce93037cb7cb8524abfc9a6accbbb29" ], "author": { "name": "Joe Thornber", "email": "ejt@redhat.com", "time": "Wed Oct 21 18:36:49 2015 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:58 2016 +0800" }, "message": "dm btree remove: fix a bug when rebalancing nodes after removal\n\ncommit 2871c69e025e8bc507651d5a9cf81a8a7da9d24b upstream.\n\nCommit 4c7e309340ff (\"dm btree remove: fix bug in redistribute3\") wasn\u0027t\na complete fix for redistribute3().\n\nThe redistribute3 function takes 3 btree nodes and shares out the entries\nevenly between them. If the three nodes in total contained\n(MAX_ENTRIES * 3) - 1 entries between them then this was erroneously getting\nrebalanced as (MAX_ENTRIES - 1) on the left and right, and (MAX_ENTRIES + 1) in\nthe center.\n\nFix this issue by being more careful about calculating the target number\nof entries for the left and right nodes.\n\nUnit tested in userspace using this program:\nhttps://github.com/jthornber/redistribute3-test/blob/master/redistribute3_t.c\n\nSigned-off-by: Joe Thornber \u003cejt@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "f43d490b4ce93037cb7cb8524abfc9a6accbbb29", "tree": "7c5173f77023fe97302f7ec160c61a1ddf8e6a58", "parents": [ "d359d1d221bc77b3a45719c8f010b604f39c58c4" ], "author": { "name": "John Youn", "email": "John.Youn@synopsys.com", "time": "Tue Feb 16 20:10:53 2016 -0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:58 2016 +0800" }, "message": "usb: dwc3: Fix assignment of EP transfer resources\n\ncommit c450960187f45d4260db87c7dd4fc0bceb5565d8 upstream.\n\nThe assignement of EP transfer resources was not handled properly in the\ndwc3 driver. Commit aebda6187181 (\"usb: dwc3: Reset the transfer\nresource index on SET_INTERFACE\") previously fixed one aspect of this\nwhere resources may be exhausted with multiple calls to SET_INTERFACE.\nHowever, it introduced an issue where composite devices with multiple\ninterfaces can be assigned the same transfer resources for different\nendpoints. This patch solves both issues.\n\nThe assignment of transfer resources cannot perfectly follow the data\nbook due to the fact that the controller driver does not have all\nknowledge of the configuration in advance. It is given this information\npiecemeal by the composite gadget framework after every\nSET_CONFIGURATION and SET_INTERFACE. Trying to follow the databook\nprogramming model in this scenario can cause errors. For two reasons:\n\n1) The databook says to do DEPSTARTCFG for every SET_CONFIGURATION and\nSET_INTERFACE (8.1.5). This is incorrect in the scenario of multiple\ninterfaces.\n\n2) The databook does not mention doing more DEPXFERCFG for new endpoint\non alt setting (8.1.6).\n\nThe following simplified method is used instead:\n\nAll hardware endpoints can be assigned a transfer resource and this\nsetting will stay persistent until either a core reset or hibernation.\nSo whenever we do a DEPSTARTCFG(0) we can go ahead and do DEPXFERCFG for\nevery hardware endpoint as well. We are guaranteed that there are as\nmany transfer resources as endpoints.\n\nThis patch triggers off of the calling dwc3_gadget_start_config() for\nEP0-out, which always happens first, and which should only happen in one\nof the above conditions.\n\nFixes: aebda6187181 (\"usb: dwc3: Reset the transfer resource index on SET_INTERFACE\")\nReported-by: Ravi Babu \u003cravibabu@ti.com\u003e\nSigned-off-by: John Youn \u003cjohnyoun@synopsys.com\u003e\nSigned-off-by: Felipe Balbi \u003cbalbi@kernel.org\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "04d6387f6f3f1727abd3e8f77686efd125c5f691", "tree": "66ac598e604a12efb3a6f48b7f8b7febb21fe047", "parents": [ "a1c3860d3c5fc62bd35f089bcb03f18a37242de9" ], "author": { "name": "Johan Hovold", "email": "johan@kernel.org", "time": "Wed Sep 23 11:41:42 2015 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:54 2016 +0800" }, "message": "USB: whiteheat: fix potential null-deref at probe\n\ncommit cbb4be652d374f64661137756b8f357a1827d6a4 upstream.\n\nFix potential null-pointer dereference at probe by making sure that the\nrequired endpoints are present.\n\nThe whiteheat driver assumes there are at least five pairs of bulk\nendpoints, of which the final pair is used for the \"command port\". An\nattempt to bind to an interface with fewer bulk endpoints would\ncurrently lead to an oops.\n\nFixes CVE-2015-5257.\n\nReported-by: Moein Ghasemzadeh \u003cmoein@istuary.com\u003e\nSigned-off-by: Johan Hovold \u003cjohan@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a1c3860d3c5fc62bd35f089bcb03f18a37242de9", "tree": "61292a4b27700928869eb1509f4bb58e5cc03e85", "parents": [ "76e4831f5faf482ce5c11acb1b09cee3c88f34e1" ], "author": { "name": "Ben Hutchings", "email": "ben@decadent.org.uk", "time": "Sun Nov 01 16:22:53 2015 +0000" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:54 2016 +0800" }, "message": "ppp, slip: Validate VJ compression slot parameters completely\n\ncommit 4ab42d78e37a294ac7bc56901d563c642e03c4ae upstream.\n\nCurrently slhc_init() treats out-of-range values of rslots and tslots\nas equivalent to 0, except that if tslots is too large it will\ndereference a null pointer (CVE-2015-7799).\n\nAdd a range-check at the top of the function and make it return an\nERR_PTR() on error instead of NULL. Change the callers accordingly.\n\nCompile-tested only.\n\nReported-by: 郭永刚 \u003cguoyonggang@360.cn\u003e\nReferences: http://article.gmane.org/gmane.comp.security.oss.general/17908\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "76e4831f5faf482ce5c11acb1b09cee3c88f34e1", "tree": "b46d87788fd787cb0bec1e5067beb0c9341a1b56", "parents": [ "35464982a0fb1dcaf540c4dd5564de3f90f7a1a5" ], "author": { "name": "Ben Hutchings", "email": "ben@decadent.org.uk", "time": "Sun Nov 01 16:21:24 2015 +0000" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:54 2016 +0800" }, "message": "isdn_ppp: Add checks for allocation failure in isdn_ppp_open()\n\ncommit 0baa57d8dc32db78369d8b5176ef56c5e2e18ab3 upstream.\n\nCompile-tested only.\n\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "35464982a0fb1dcaf540c4dd5564de3f90f7a1a5", "tree": "cee4edc96eb92368b6f898d1a4163003c8ab8ea4", "parents": [ "26aa430b96d8ccc619616c0a5e60a654be4931eb" ], "author": { "name": "Jason Wang", "email": "jasowang@redhat.com", "time": "Wed Aug 05 10:34:04 2015 +0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:54 2016 +0800" }, "message": "virtio-net: drop NETIF_F_FRAGLIST\n\ncommit 48900cb6af4282fa0fb6ff4d72a81aa3dadb5c39 upstream.\n\nvirtio declares support for NETIF_F_FRAGLIST, but assumes\nthat there are at most MAX_SKB_FRAGS + 2 fragments which isn\u0027t\nalways true with a fraglist.\n\nA longer fraglist in the skb will make the call to skb_to_sgvec overflow\nthe sg array, leading to memory corruption.\n\nDrop NETIF_F_FRAGLIST so we only get what we can handle.\n\nCc: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: Jason Wang \u003cjasowang@redhat.com\u003e\nAcked-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "26aa430b96d8ccc619616c0a5e60a654be4931eb", "tree": "9b2016b211f4d459fac59aa81c6c240494d52f93", "parents": [ "4ee85dafc1710f14f0c498076505add6aae52742" ], "author": { "name": "Al Viro", "email": "viro@zeniv.linux.org.uk", "time": "Sat Mar 21 20:08:18 2015 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:54 2016 +0800" }, "message": "sg_start_req(): make sure that there\u0027s not too many elements in iovec\n\ncommit 451a2886b6bf90e2fb378f7c46c655450fb96e81 upstream.\n\nunfortunately, allowing an arbitrary 16bit value means a possibility of\noverflow in the calculation of total number of pages in bio_map_user_iov() -\nwe rely on there being no more than PAGE_SIZE members of sum in the\nfirst loop there. If that sum wraps around, we end up allocating\ntoo small array of pointers to pages and it\u0027s easy to overflow it in\nthe second loop.\n\nX-Coverup: TINC (and there\u0027s no lumber cartel either)\nSigned-off-by: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\n[lizf: Backported to 3.4: s/MAX_UIOVEC/UIO_MAXIOV]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "0cf0ae366ff94870075cbe0a8f3a16a2107ae853", "tree": "65e8583b5a681d89ac18c234c2557fef6be9892b", "parents": [ "ec54d5ae9d298abf01c273233de9f2bc25d80475" ], "author": { "name": "WANG Cong", "email": "xiyou.wangcong@gmail.com", "time": "Mon Dec 14 13:48:36 2015 -0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:53 2016 +0800" }, "message": "pptp: verify sockaddr_len in pptp_bind() and pptp_connect()\n\ncommit 09ccfd238e5a0e670d8178cf50180ea81ae09ae1 upstream.\n\nReported-by: Dmitry Vyukov \u003cdvyukov@gmail.com\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "44b2ffc5ed1e7c6b96f103bdbbfda23fed07b18d", "tree": "3365b680487fd9b6026b975db0cb8a7c13a928f6", "parents": [ "1f2a65a223b690c8b71f22d0c9bc6851324e6073" ], "author": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Thu Mar 03 15:44:47 2016 +0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:53 2016 +0800" }, "message": "Revert \"usb: dwc3: Reset the transfer resource index on SET_INTERFACE\"\n\nIt was applied to the wrong function.\n\nThis reverts commit 15488de7b72b6ab8254dda07053faa4be6b9ec66.\n" }, { "commit": "1d275d96b1b3f8672c3c6cba73d9b140599ecac2", "tree": "1eea8d46c5a343e98488de61977e24e65014ca13", "parents": [ "334b3bbf4b90d12c25b9b632855f1b710af16d7e" ], "author": { "name": "Michael Walle", "email": "michael@walle.cc", "time": "Tue Jul 21 11:00:53 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:52 2016 +0800" }, "message": "EDAC, ppc4xx: Access mci-\u003ecsrows array elements properly\n\ncommit 5c16179b550b9fd8114637a56b153c9768ea06a5 upstream.\n\nThe commit\n\n de3910eb79ac (\"edac: change the mem allocation scheme to\n\t\t make Documentation/kobject.txt happy\")\n\nchanged the memory allocation for the csrows member. But ppc4xx_edac was\nforgotten in the patch. Fix it.\n\nSigned-off-by: Michael Walle \u003cmichael@walle.cc\u003e\nCc: linux-edac \u003clinux-edac@vger.kernel.org\u003e\nCc: Mauro Carvalho Chehab \u003cmchehab@osg.samsung.com\u003e\nLink: http://lkml.kernel.org/r/1437469253-8611-1-git-send-email-michael@walle.cc\nSigned-off-by: Borislav Petkov \u003cbp@suse.de\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "334b3bbf4b90d12c25b9b632855f1b710af16d7e", "tree": "b25fb23c2d44eb516bf06f2c9ca5722653e9c7ac", "parents": [ "0adcec66bce9b7e84847da09ae3f8bc36e753312" ], "author": { "name": "Bart Van Assche", "email": "bart.vanassche@sandisk.com", "time": "Fri Jun 05 14:20:51 2015 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:52 2016 +0800" }, "message": "libfc: Fix fc_fcp_cleanup_each_cmd()\n\ncommit 8f2777f53e3d5ad8ef2a176a4463a5c8e1a16431 upstream.\n\nSince fc_fcp_cleanup_cmd() can sleep this function must not\nbe called while holding a spinlock. This patch avoids that\nfc_fcp_cleanup_each_cmd() triggers the following bug:\n\nBUG: scheduling while atomic: sg_reset/1512/0x00000202\n1 lock held by sg_reset/1512:\n #0: (\u0026(\u0026fsp-\u003escsi_pkt_lock)-\u003erlock){+.-...}, at: [\u003cffffffffc0225cd5\u003e] fc_fcp_cleanup_each_cmd.isra.21+0xa5/0x150 [libfc]\nPreemption disabled at:[\u003cffffffffc0225cd5\u003e] fc_fcp_cleanup_each_cmd.isra.21+0xa5/0x150 [libfc]\nCall Trace:\n [\u003cffffffff816c612c\u003e] dump_stack+0x4f/0x7b\n [\u003cffffffff810828bc\u003e] __schedule_bug+0x6c/0xd0\n [\u003cffffffff816c87aa\u003e] __schedule+0x71a/0xa10\n [\u003cffffffff816c8ad2\u003e] schedule+0x32/0x80\n [\u003cffffffffc0217eac\u003e] fc_seq_set_resp+0xac/0x100 [libfc]\n [\u003cffffffffc0218b11\u003e] fc_exch_done+0x41/0x60 [libfc]\n [\u003cffffffffc0225cff\u003e] fc_fcp_cleanup_each_cmd.isra.21+0xcf/0x150 [libfc]\n [\u003cffffffffc0225f43\u003e] fc_eh_device_reset+0x1c3/0x270 [libfc]\n [\u003cffffffff814a2cc9\u003e] scsi_try_bus_device_reset+0x29/0x60\n [\u003cffffffff814a3908\u003e] scsi_ioctl_reset+0x258/0x2d0\n [\u003cffffffff814a2650\u003e] scsi_ioctl+0x150/0x440\n [\u003cffffffff814b3a9d\u003e] sd_ioctl+0xad/0x120\n [\u003cffffffff8132f266\u003e] blkdev_ioctl+0x1b6/0x810\n [\u003cffffffff811da608\u003e] block_ioctl+0x38/0x40\n [\u003cffffffff811b4e08\u003e] do_vfs_ioctl+0x2f8/0x530\n [\u003cffffffff811b50c1\u003e] SyS_ioctl+0x81/0xa0\n [\u003cffffffff816cf8b2\u003e] system_call_fastpath+0x16/0x7a\n\nSigned-off-by: Bart Van Assche \u003cbart.vanassche@sandisk.com\u003e\nSigned-off-by: Vasu Dev \u003cvasu.dev@intel.com\u003e\nSigned-off-by: James Bottomley \u003cJBottomley@Odin.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "0adcec66bce9b7e84847da09ae3f8bc36e753312", "tree": "72243bdf2687f88fb5955dfa11b008493e719faf", "parents": [ "f738306b913dc247b96c403d7fe735d09b13157b" ], "author": { "name": "John Soni Jose", "email": "sony.john@avagotech.com", "time": "Wed Jun 24 06:41:58 2015 +0530" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:52 2016 +0800" }, "message": "libiscsi: Fix host busy blocking during connection teardown\n\ncommit 660d0831d1494a6837b2f810d08b5be092c1f31d upstream.\n\nIn case of hw iscsi offload, an host can have N-number of active\nconnections. There can be IO\u0027s running on some connections which\nmake host-\u003ehost_busy always TRUE. Now if logout from a connection\nis tried then the code gets into an infinite loop as host-\u003ehost_busy\nis always TRUE.\n\n iscsi_conn_teardown(....)\n {\n .........\n /*\n * Block until all in-progress commands for this connection\n * time out or fail.\n */\n for (;;) {\n spin_lock_irqsave(session-\u003ehost-\u003ehost_lock, flags);\n if (!atomic_read(\u0026session-\u003ehost-\u003ehost_busy)) { /* OK for ERL \u003d\u003d 0 */\n\t spin_unlock_irqrestore(session-\u003ehost-\u003ehost_lock, flags);\n break;\n }\n spin_unlock_irqrestore(session-\u003ehost-\u003ehost_lock, flags);\n msleep_interruptible(500);\n iscsi_conn_printk(KERN_INFO, conn, \"iscsi conn_destroy(): \"\n \"host_busy %d host_failed %d\\n\",\n\t atomic_read(\u0026session-\u003ehost-\u003ehost_busy),\n\t session-\u003ehost-\u003ehost_failed);\n\n\t................\n\t...............\n }\n }\n\nThis is not an issue with software-iscsi/iser as each cxn is a separate\nhost.\n\nFix:\nAcquiring eh_mutex in iscsi_conn_teardown() before setting\nsession-\u003estate \u003d ISCSI_STATE_TERMINATE.\n\nSigned-off-by: John Soni Jose \u003csony.john@avagotech.com\u003e\nReviewed-by: Mike Christie \u003cmichaelc@cs.wisc.edu\u003e\nReviewed-by: Chris Leech \u003ccleech@redhat.com\u003e\nSigned-off-by: James Bottomley \u003cJBottomley@Odin.com\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-of-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "f738306b913dc247b96c403d7fe735d09b13157b", "tree": "bee7d113df15f36824bbecf7073b5c05078ce3b0", "parents": [ "bd1bdbece98984626f1f9432447ed7e6493d15d5" ], "author": { "name": "Joe Thornber", "email": "ejt@redhat.com", "time": "Wed Aug 12 15:12:09 2015 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:52 2016 +0800" }, "message": "dm btree: add ref counting ops for the leaves of top level btrees\n\ncommit b0dc3c8bc157c60b1d470163882be8c13e1950af upstream.\n\nWhen using nested btrees, the top leaves of the top levels contain\nblock addresses for the root of the next tree down. If we shadow a\nshared leaf node the leaf values (sub tree roots) should be incremented\naccordingly.\n\nThis is only an issue if there is metadata sharing in the top levels.\nWhich only occurs if metadata snapshots are being used (as is possible\nwith dm-thinp). And could result in a block from the thinp metadata\nsnap being reused early, thus corrupting the thinp metadata snap.\n\nSigned-off-by: Joe Thornber \u003cejt@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\n[lizf: Backported to 3.4:\n - drop const\n - drop changes to remove_one()]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "24e5a859b45ac6b810c518187dd0b4cde3d54f45", "tree": "cba52b339c16fa24ccff35dfaef5d31ab8d24171", "parents": [ "b9917d0225d81004225c568d07003f4a428f444b" ], "author": { "name": "Mathias Nyman", "email": "mathias.nyman@linux.intel.com", "time": "Mon Aug 03 16:07:48 2015 +0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:50 2016 +0800" }, "message": "xhci: fix off by one error in TRB DMA address boundary check\n\ncommit 7895086afde2a05fa24a0e410d8e6b75ca7c8fdd upstream.\n\nWe need to check that a TRB is part of the current segment\nbefore calculating its DMA address.\n\nPreviously a ring segment didn\u0027t use a full memory page, and every\nnew ring segment got a new memory page, so the off by one\nerror in checking the upper bound was never seen.\n\nNow that we use a full memory page, 256 TRBs (4096 bytes), the off by one\ndidn\u0027t catch the case when a TRB was the first element of the next segment.\n\nThis is triggered if the virtual memory pages for a ring segment are\nnext to each in increasing order where the ring buffer wraps around and\ncauses errors like:\n\n[ 106.398223] xhci_hcd 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 0 comp_code 1\n[ 106.398230] xhci_hcd 0000:00:14.0: Looking for event-dma fffd3000 trb-start fffd4fd0 trb-end fffd5000 seg-start fffd4000 seg-end fffd4ff0\n\nThe trb-end address is one outside the end-seg address.\n\nTested-by: Arkadiusz Miśkiewicz \u003carekm@maven.pl\u003e\nSigned-off-by: Mathias Nyman \u003cmathias.nyman@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "2411ca5d7a8f95646ba50962d20e06d9aa07a408", "tree": "566b5e03a2f7c57f1a5d861d493c48b1c2a9ceef", "parents": [ "0444d9dfacb4fa42005ca3afefe56b16f07c5192" ], "author": { "name": "NeilBrown", "email": "neilb@suse.com", "time": "Mon Jul 27 11:48:52 2015 +1000" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:50 2016 +0800" }, "message": "md/raid1: extend spinlock to protect raid1_end_read_request against inconsistencies\n\ncommit 423f04d63cf421ea436bcc5be02543d549ce4b28 upstream.\n\nraid1_end_read_request() assumes that the In_sync bits are consistent\nwith the -\u003edegaded count.\nraid1_spare_active updates the In_sync bit before the -\u003edegraded count\nand so exposes an inconsistency, as does error()\nSo extend the spinlock in raid1_spare_active() and error() to hide those\ninconsistencies.\n\nThis should probably be part of\n Commit: 34cab6f42003 (\"md/raid1: fix test for \u0027was read error from\n last working device\u0027.\")\nas it addresses the same issue. It fixes the same bug and should go\nto -stable for same reasons.\n\nFixes: 76073054c95b (\"md/raid1: clean up read_balance.\")\nSigned-off-by: NeilBrown \u003cneilb@suse.com\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "874fc85921926885d1984c0cc6e99f569b5a450e", "tree": "4a5bac16d2931f06d447c14af127911ca389f4bd", "parents": [ "3c1a25d2c4dad2a72dfed29513f2931665560050" ], "author": { "name": "Alexei Potashnik", "email": "alexei@purestorage.com", "time": "Tue Jul 21 15:07:56 2015 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:49 2016 +0800" }, "message": "target/iscsi: Fix double free of a TUR followed by a solicited NOPOUT\n\ncommit 9547308bda296b6f69876c840a0291fcfbeddbb8 upstream.\n\nMake sure all non-READ SCSI commands get targ_xfer_tag initialized\nto 0xffffffff, not just WRITEs.\n\nDouble-free of a TUR cmd object occurs under the following scenario:\n\n1. TUR received (targ_xfer_tag is uninitialized and left at 0)\n2. TUR status sent\n3. First unsolicited NOPIN is sent to initiator (gets targ_xfer_tag of 0)\n4. NOPOUT for NOPIN (with TTT\u003d0) arrives\n - its ExpStatSN acks TUR status, TUR is queued for removal\n - LIO tries to find NOPIN with TTT\u003d0, but finds the same TUR instead,\n TUR is queued for removal for the 2nd time\n\n(Drop unbalanced conditional bracket usage - nab)\n\nSigned-off-by: Alexei Potashnik \u003calexei@purestorage.com\u003e\nSigned-off-by: Spencer Baugh \u003csbaugh@catern.com\u003e\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\n[lizf: Backported to 3.4:\n - adjust context\n - leave the braces as it is]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "3c1a25d2c4dad2a72dfed29513f2931665560050", "tree": "f10e3abe8893e6dc3aa79d118ea253368078a806", "parents": [ "6535910e20f1b85394bcee7127c84309a445299b" ], "author": { "name": "Alex Deucher", "email": "alexander.deucher@amd.com", "time": "Mon Jul 27 19:24:31 2015 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:49 2016 +0800" }, "message": "drm/radeon/combios: add some validation of lvds values\n\ncommit 0a90a0cff9f429f886f423967ae053150dce9259 upstream.\n\nFixes a broken hsync start value uncovered by:\nabc0b1447d4974963548777a5ba4a4457c82c426\n(drm: Perform basic sanity checks on probed modes)\n\nThe driver handled the bad hsync start elsewhere, but\nthe above commit prevented it from getting added.\n\nbug:\nhttps://bugs.freedesktop.org/show_bug.cgi?id\u003d91401\n\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "fcfabc249c15d3f50fb5960a9652d8f410a143ae", "tree": "24d6952ae579c97cd0868d28644ab34cc9f8102a", "parents": [ "2d0e7eb8941a1d613ec06a989708d07ec8aff8d1" ], "author": { "name": "Dirk Behme", "email": "dirk.behme@de.bosch.com", "time": "Mon Jul 27 08:56:05 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:49 2016 +0800" }, "message": "USB: sierra: add 1199:68AB device ID\n\ncommit 74472233233f577eaa0ca6d6e17d9017b6e53150 upstream.\n\nAdd support for the Sierra Wireless AR8550 device with\nUSB descriptor 0x1199, 0x68AB.\n\nIt is common with MC879x modules 1199:683c/683d which\nalso are composite devices with 7 interfaces (0..6)\nand also MDM62xx based as the AR8550.\n\nThe major difference are only the interface attributes\n02/02/01 on interfaces 3 and 4 on the AR8550. They are\nvendor specific ff/ff/ff on MC879x modules.\n\nlsusb reports:\n\nBus 001 Device 004: ID 1199:68ab Sierra Wireless, Inc.\nDevice Descriptor:\n bLength 18\n bDescriptorType 1\n bcdUSB 2.00\n bDeviceClass 0 (Defined at Interface level)\n bDeviceSubClass 0\n bDeviceProtocol 0\n bMaxPacketSize0 64\n idVendor 0x1199 Sierra Wireless, Inc.\n idProduct 0x68ab\n bcdDevice 0.06\n iManufacturer 3 Sierra Wireless, Incorporated\n iProduct 2 AR8550\n iSerial 0\n bNumConfigurations 1\n Configuration Descriptor:\n bLength 9\n bDescriptorType 2\n wTotalLength 198\n bNumInterfaces 7\n bConfigurationValue 1\n iConfiguration 1 Sierra Configuration\n bmAttributes 0xe0\n Self Powered\n Remote Wakeup\n MaxPower 0mA\n Interface Descriptor:\n bLength 9\n bDescriptorType 4\n bInterfaceNumber 0\n bAlternateSetting 0\n bNumEndpoints 2\n bInterfaceClass 255 Vendor Specific Class\n bInterfaceSubClass 255 Vendor Specific Subclass\n bInterfaceProtocol 255 Vendor Specific Protocol\n iInterface 0\n Endpoint Descriptor:\n bLength 7\n bDescriptorType 5\n bEndpointAddress 0x81 EP 1 IN\n bmAttributes 2\n Transfer Type Bulk\n Synch Type None\n Usage Type Data\n wMaxPacketSize 0x0200 1x 512 bytes\n bInterval 32\n Endpoint Descriptor:\n bLength 7\n bDescriptorType 5\n bEndpointAddress 0x01 EP 1 OUT\n bmAttributes 2\n Transfer Type Bulk\n Synch Type None\n Usage Type Data\n wMaxPacketSize 0x0200 1x 512 bytes\n bInterval 32\n Interface Descriptor:\n bLength 9\n bDescriptorType 4\n bInterfaceNumber 1\n bAlternateSetting 0\n bNumEndpoints 2\n bInterfaceClass 255 Vendor Specific Class\n bInterfaceSubClass 255 Vendor Specific Subclass\n bInterfaceProtocol 255 Vendor Specific Protocol\n iInterface 0\n Endpoint Descriptor:\n bLength 7\n bDescriptorType 5\n bEndpointAddress 0x82 EP 2 IN\n bmAttributes 2\n Transfer Type Bulk\n Synch Type None\n Usage Type Data\n wMaxPacketSize 0x0200 1x 512 bytes\n bInterval 32\n Endpoint Descriptor:\n bLength 7\n bDescriptorType 5\n bEndpointAddress 0x02 EP 2 OUT\n bmAttributes 2\n Transfer Type Bulk\n Synch Type None\n Usage Type Data\n wMaxPacketSize 0x0200 1x 512 bytes\n bInterval 32\n Interface Descriptor:\n bLength 9\n bDescriptorType 4\n bInterfaceNumber 2\n bAlternateSetting 0\n bNumEndpoints 2\n bInterfaceClass 255 Vendor Specific Class\n bInterfaceSubClass 255 Vendor Specific Subclass\n bInterfaceProtocol 255 Vendor Specific Protocol\n iInterface 0\n Endpoint Descriptor:\n bLength 7\n bDescriptorType 5\n bEndpointAddress 0x83 EP 3 IN\n bmAttributes 2\n Transfer Type Bulk\n Synch Type None\n Usage Type Data\n wMaxPacketSize 0x0200 1x 512 bytes\n bInterval 32\n Endpoint Descriptor:\n bLength 7\n bDescriptorType 5\n bEndpointAddress 0x03 EP 3 OUT\n bmAttributes 2\n Transfer Type Bulk\n Synch Type None\n Usage Type Data\n wMaxPacketSize 0x0200 1x 512 bytes\n bInterval 32\n Interface Descriptor:\n bLength 9\n bDescriptorType 4\n bInterfaceNumber 3\n bAlternateSetting 0\n bNumEndpoints 3\n bInterfaceClass 2 Communications\n bInterfaceSubClass 2 Abstract (modem)\n bInterfaceProtocol 1 AT-commands (v.25ter)\n iInterface 0\n Endpoint Descriptor:\n bLength 7\n bDescriptorType 5\n bEndpointAddress 0x84 EP 4 IN\n bmAttributes 3\n Transfer Type Interrupt\n Synch Type None\n Usage Type Data\n wMaxPacketSize 0x0040 1x 64 bytes\n bInterval 5\n Endpoint Descriptor:\n bLength 7\n bDescriptorType 5\n bEndpointAddress 0x85 EP 5 IN\n bmAttributes 2\n Transfer Type Bulk\n Synch Type None\n Usage Type Data\n wMaxPacketSize 0x0200 1x 512 bytes\n bInterval 32\n Endpoint Descriptor:\n bLength 7\n bDescriptorType 5\n bEndpointAddress 0x04 EP 4 OUT\n bmAttributes 2\n Transfer Type Bulk\n Synch Type None\n Usage Type Data\n wMaxPacketSize 0x0200 1x 512 bytes\n bInterval 32\n Interface Descriptor:\n bLength 9\n bDescriptorType 4\n bInterfaceNumber 4\n bAlternateSetting 0\n bNumEndpoints 3\n bInterfaceClass 2 Communications\n bInterfaceSubClass 2 Abstract (modem)\n bInterfaceProtocol 1 AT-commands (v.25ter)\n iInterface 0\n Endpoint Descriptor:\n bLength 7\n bDescriptorType 5\n bEndpointAddress 0x86 EP 6 IN\n bmAttributes 3\n Transfer Type Interrupt\n Synch Type None\n Usage Type Data\n wMaxPacketSize 0x0040 1x 64 bytes\n bInterval 5\n Endpoint Descriptor:\n bLength 7\n bDescriptorType 5\n bEndpointAddress 0x87 EP 7 IN\n bmAttributes 2\n Transfer Type Bulk\n Synch Type None\n Usage Type Data\n wMaxPacketSize 0x0200 1x 512 bytes\n bInterval 32\n Endpoint Descriptor:\n bLength 7\n bDescriptorType 5\n bEndpointAddress 0x05 EP 5 OUT\n bmAttributes 2\n Transfer Type Bulk\n Synch Type None\n Usage Type Data\n wMaxPacketSize 0x0200 1x 512 bytes\n bInterval 32\n Interface Descriptor:\n bLength 9\n bDescriptorType 4\n bInterfaceNumber 5\n bAlternateSetting 0\n bNumEndpoints 3\n bInterfaceClass 255 Vendor Specific Class\n bInterfaceSubClass 255 Vendor Specific Subclass\n bInterfaceProtocol 255 Vendor Specific Protocol\n iInterface 0\n Endpoint Descriptor:\n bLength 7\n bDescriptorType 5\n bEndpointAddress 0x88 EP 8 IN\n bmAttributes 3\n Transfer Type Interrupt\n Synch Type None\n Usage Type Data\n wMaxPacketSize 0x0040 1x 64 bytes\n bInterval 5\n Endpoint Descriptor:\n bLength 7\n bDescriptorType 5\n bEndpointAddress 0x89 EP 9 IN\n bmAttributes 2\n Transfer Type Bulk\n Synch Type None\n Usage Type Data\n wMaxPacketSize 0x0200 1x 512 bytes\n bInterval 32\n Endpoint Descriptor:\n bLength 7\n bDescriptorType 5\n bEndpointAddress 0x06 EP 6 OUT\n bmAttributes 2\n Transfer Type Bulk\n Synch Type None\n Usage Type Data\n wMaxPacketSize 0x0200 1x 512 bytes\n bInterval 32\n Interface Descriptor:\n bLength 9\n bDescriptorType 4\n bInterfaceNumber 6\n bAlternateSetting 0\n bNumEndpoints 3\n bInterfaceClass 255 Vendor Specific Class\n bInterfaceSubClass 255 Vendor Specific Subclass\n bInterfaceProtocol 255 Vendor Specific Protocol\n iInterface 0\n Endpoint Descriptor:\n bLength 7\n bDescriptorType 5\n bEndpointAddress 0x8a EP 10 IN\n bmAttributes 3\n Transfer Type Interrupt\n Synch Type None\n Usage Type Data\n wMaxPacketSize 0x0040 1x 64 bytes\n bInterval 5\n Endpoint Descriptor:\n bLength 7\n bDescriptorType 5\n bEndpointAddress 0x8b EP 11 IN\n bmAttributes 2\n Transfer Type Bulk\n Synch Type None\n Usage Type Data\n wMaxPacketSize 0x0200 1x 512 bytes\n bInterval 32\n Endpoint Descriptor:\n bLength 7\n bDescriptorType 5\n bEndpointAddress 0x07 EP 7 OUT\n bmAttributes 2\n Transfer Type Bulk\n Synch Type None\n Usage Type Data\n wMaxPacketSize 0x0200 1x 512 bytes\n bInterval 32\nDevice Qualifier (for other device speed):\n bLength 10\n bDescriptorType 6\n bcdUSB 2.00\n bDeviceClass 0 (Defined at Interface level)\n bDeviceSubClass 0\n bDeviceProtocol 0\n bMaxPacketSize0 64\n bNumConfigurations 1\nDevice Status: 0x0001\n Self Powered\n\nSigned-off-by: Dirk Behme \u003cdirk.behme@de.bosch.com\u003e\nCc: Lars Melin \u003clarsm17@gmail.com\u003e\nSigned-off-by: Johan Hovold \u003cjohan@kernel.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "2d0e7eb8941a1d613ec06a989708d07ec8aff8d1", "tree": "43301957967042875045848ef8fc49f4703e67a0", "parents": [ "50f46c9771c42d5d21979d93155ec8bb9f4ea69a" ], "author": { "name": "Marc-André Lureau", "email": "marcandre.lureau@redhat.com", "time": "Fri Jul 17 15:32:03 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:49 2016 +0800" }, "message": "vhost: actually track log eventfd file\n\ncommit 7932c0bd7740f4cd2aa168d3ce0199e7af7d72d5 upstream.\n\nWhile reviewing vhost log code, I found out that log_file is never\nset. Note: I haven\u0027t tested the change (QEMU doesn\u0027t use LOG_FD yet).\n\nSigned-off-by: Marc-André Lureau \u003cmarcandre.lureau@redhat.com\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "50f46c9771c42d5d21979d93155ec8bb9f4ea69a", "tree": "77dd6941d757d2e5b8ce276ee19d0d3e0dbcfb68", "parents": [ "cdaad7c1e1260a7fc83806ce0895a98dab0703a7" ], "author": { "name": "Jiri Pirko", "email": "jiri@resnulli.us", "time": "Thu Jul 23 12:20:37 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:48 2016 +0800" }, "message": "niu: don\u0027t count tx error twice in case of headroom realloc fails\n\ncommit 42288830494cd51873ca745a7a229023df061226 upstream.\n\nFixes: a3138df9 (\"[NIU]: Add Sun Neptune ethernet driver.\")\nSigned-off-by: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "cdaad7c1e1260a7fc83806ce0895a98dab0703a7", "tree": "1afe45ddd5118b3374d28f56bd597f32437b50db", "parents": [ "db30e3004d3e9f5ade5b531f6df3e5ee5b841b43" ], "author": { "name": "Nicholas Bellinger", "email": "nab@linux-iscsi.org", "time": "Wed Jul 22 00:24:09 2015 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:48 2016 +0800" }, "message": "iscsi-target: Fix use-after-free during TPG session shutdown\n\ncommit 417c20a9bdd1e876384127cf096d8ae8b559066c upstream.\n\nThis patch fixes a use-after-free bug in iscsit_release_sessions_for_tpg()\nwhere se_portal_group-\u003esession_lock was incorrectly released/re-acquired\nwhile walking the active se_portal_group-\u003etpg_sess_list.\n\nThe can result in a NULL pointer dereference when iscsit_close_session()\nshutdown happens in the normal path asynchronously to this code, causing\na bogus dereference of an already freed list entry to occur.\n\nTo address this bug, walk the session list checking for the same state\nas before, but move entries to a local list to avoid dropping the lock\nwhile walking the active list.\n\nAs before, signal using iscsi_session-\u003esession_restatement\u003d1 for those\nlist entries to be released locally by iscsit_free_session() code.\n\nReported-by: Sunilkumar Nadumuttlu \u003csjn@datera.io\u003e\nCc: Sunilkumar Nadumuttlu \u003csjn@datera.io\u003e\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "db30e3004d3e9f5ade5b531f6df3e5ee5b841b43", "tree": "6ec13a530308dd30ecc8191b777af5825146d210", "parents": [ "2908d41798415ec9561186c0fd667d6bf282ae31" ], "author": { "name": "Herbert Xu", "email": "herbert@gondor.apana.org.au", "time": "Wed Jul 22 18:05:35 2015 +0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:48 2016 +0800" }, "message": "crypto: ixp4xx - Remove bogus BUG_ON on scattered dst buffer\n\ncommit f898c522f0e9ac9f3177d0762b76e2ab2d2cf9c0 upstream.\n\nThis patch removes a bogus BUG_ON in the ablkcipher path that\ntriggers when the destination buffer is different from the source\nbuffer and is scattered.\n\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "f48b7031214db56ba92de547a77ee7c0b1b72f36", "tree": "4c4a7bddb70991832cb830f923ec0e95312da323", "parents": [ "4adbd632ea76c890371a76557e7912afdc586e1b" ], "author": { "name": "Tomas Winkler", "email": "tomas.winkler@intel.com", "time": "Thu Jul 16 15:50:45 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:48 2016 +0800" }, "message": "mmc: block: Add missing mmc_blk_put() in power_ro_lock_show()\n\ncommit 9098f84cced870f54d8c410dd2444cfa61467fa0 upstream.\n\nEnclosing mmc_blk_put() is missing in power_ro_lock_show() sysfs handler,\nlet\u0027s add it.\n\nFixes: add710eaa886 (\"mmc: boot partition ro lock support\")\nSigned-off-by: Tomas Winkler \u003ctomas.winkler@intel.com\u003e\nSigned-off-by: Ulf Hansson \u003culf.hansson@linaro.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "4adbd632ea76c890371a76557e7912afdc586e1b", "tree": "3acb66589f5abc3603d119b12d876534879f57f2", "parents": [ "18bf23709e0c9054b58c61818faeb5503c7257c1" ], "author": { "name": "NeilBrown", "email": "neilb@suse.com", "time": "Fri Jul 24 09:22:16 2015 +1000" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:47 2016 +0800" }, "message": "md/raid1: fix test for \u0027was read error from last working device\u0027.\n\ncommit 34cab6f42003cb06f48f86a86652984dec338ae9 upstream.\n\nWhen we get a read error from the last working device, we don\u0027t\ntry to repair it, and don\u0027t fail the device. We simple report a\nread error to the caller.\n\nHowever the current test for \u0027is this the last working device\u0027 is\nwrong.\nWhen there is only one fully working device, it assumes that a\nnon-faulty device is that device. However a spare which is rebuilding\nwould be non-faulty but so not the only working device.\n\nSo change the test from \"!Faulty\" to \"In_sync\". If -\u003edegraded says\nthere is only one fully working device and this device is in_sync,\nthis must be the one.\n\nThis bug has existed since we allowed read_balance to read from\na recovering spare in v3.0\n\nReported-and-tested-by: Alexander Lyakas \u003calex.bolshoy@gmail.com\u003e\nFixes: 76073054c95b (\"md/raid1: clean up read_balance.\")\nSigned-off-by: NeilBrown \u003cneilb@suse.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "18bf23709e0c9054b58c61818faeb5503c7257c1", "tree": "d771d662aaa0b0edf65bed7744570709061cb2bb", "parents": [ "6baad56095ca1d3acd9b574e45f95b636b1f62ed" ], "author": { "name": "Bernhard Bender", "email": "bernhard.bender@bytecmed.com", "time": "Thu Jul 23 13:58:08 2015 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:47 2016 +0800" }, "message": "Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen\n\ncommit 968491709e5b1aaf429428814fff3d932fa90b60 upstream.\n\nThis patch fixes a problem in the usbtouchscreen driver for DMC TSC-30\ntouch screen. Due to a missing delay between the RESET and SET_RATE\ncommands, the touch screen may become unresponsive during system startup or\ndriver loading.\n\nAccording to the DMC documentation, a delay is needed after the RESET\ncommand to allow the chip to complete its internal initialization. As this\ndelay is not guaranteed, we had a system where the touch screen\noccasionally did not send any touch data. There was no other indication of\nthe problem.\n\nThe patch fixes the problem by adding a 150ms delay between the RESET and\nSET_RATE commands.\n\nSuggested-by: Jakob Mustafa \u003cjakob.mustafa@bytecmed.com\u003e\nSigned-off-by: Bernhard Bender \u003cbernhard.bender@bytecmed.com\u003e\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "c5b2efe0f0548f76365a8e7f0f3b23be7bc4cc72", "tree": "ecc9c78b263571c146c9270788a296cf3eb83830", "parents": [ "c8362712a9f5fd9cf835835f8fe38745f2e3ca8a" ], "author": { "name": "Oliver Neukum", "email": "oneukum@suse.com", "time": "Mon Jul 06 13:12:32 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:47 2016 +0800" }, "message": "usb-storage: ignore ZTE MF 823 card reader in mode 0x1225\n\ncommit 5fb2c782f451a4fb9c19c076e2c442839faf0f76 upstream.\n\nThis device automatically switches itself to another mode (0x1405)\nunless the specific access pattern of Windows is followed in its\ninitial mode. That makes a dirty unmount of the internal storage\ndevices inevitable if they are mounted. So the card reader of\nsuch a device should be ignored, lest an unclean removal become\ninevitable.\n\nThis replaces an earlier patch that ignored all LUNs of this device.\nThat patch was overly broad.\n\nSigned-off-by: Oliver Neukum \u003coneukum@suse.com\u003e\nReviewed-by: Lars Melin \u003clarsm17@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "c8362712a9f5fd9cf835835f8fe38745f2e3ca8a", "tree": "289a6a3cd4110b87e57d6b355d4c4973a856eace", "parents": [ "3cbe655ac1b583bfc27ab39a2c230d4c67319742" ], "author": { "name": "Zhuang Jin Can", "email": "jin.can.zhuang@intel.com", "time": "Tue Jul 21 17:20:30 2015 +0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:47 2016 +0800" }, "message": "xhci: prevent bus_suspend if SS port resuming in phase 1\n\ncommit fac4271d1126c45ceaceb7f4a336317b771eb121 upstream.\n\nWhen the link is just waken, it\u0027s in Resume state, and driver sets PLS to\nU0. This refers to Phase 1. Phase 2 refers to when the link has completed\nthe transition from Resume state to U0.\n\nWith the fix of xhci: report U3 when link is in resume state, it also\nexposes an issue that usb3 roothub and controller can suspend right\nafter phase 1, and this causes a hard hang in controller.\n\nTo fix the issue, we need to prevent usb3 bus suspend if any port is\nresuming in phase 1.\n\n[merge separate USB2 and USB3 port resume checking to one -Mathias]\nSigned-off-by: Zhuang Jin Can \u003cjin.can.zhuang@intel.com\u003e\nSigned-off-by: Mathias Nyman \u003cmathias.nyman@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "3cbe655ac1b583bfc27ab39a2c230d4c67319742", "tree": "57dede43b145f4c1a75c9fea0ef6ffe0bae411f5", "parents": [ "e083b9ff2605c094f10328d3ae488c1f66f90bd1" ], "author": { "name": "Zhuang Jin Can", "email": "jin.can.zhuang@intel.com", "time": "Tue Jul 21 17:20:29 2015 +0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:47 2016 +0800" }, "message": "xhci: report U3 when link is in resume state\n\ncommit 243292a2ad3dc365849b820a64868927168894ac upstream.\n\nxhci_hub_report_usb3_link_state() returns pls as U0 when the link\nis in resume state, and this causes usb core to think the link is in\nU0 while actually it\u0027s in resume state. When usb core transfers\ncontrol request on the link, it fails with TRB error as the link\nis not ready for transfer.\n\nTo fix the issue, report U3 when the link is in resume state, thus\nusb core knows the link it\u0027s not ready for transfer.\n\nSigned-off-by: Zhuang Jin Can \u003cjin.can.zhuang@intel.com\u003e\nSigned-off-by: Mathias Nyman \u003cmathias.nyman@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "e083b9ff2605c094f10328d3ae488c1f66f90bd1", "tree": "2e48cd3d0d96054f815aa715f7c93393c11d897d", "parents": [ "f30647cf09e0d1dc363811c483aec3dc2dfc1416" ], "author": { "name": "Brian Campbell", "email": "bacam@z273.org.uk", "time": "Tue Jul 21 17:20:28 2015 +0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:46 2016 +0800" }, "message": "xhci: Calculate old endpoints correctly on device reset\n\ncommit 326124a027abc9a7f43f72dc94f6f0f7a55b02b3 upstream.\n\nWhen resetting a device the number of active TTs may need to be\ncorrected by xhci_update_tt_active_eps, but the number of old active\nendpoints supplied to it was always zero, so the number of TTs and the\nbandwidth reserved for them was not updated, and could rise\nunnecessarily.\n\nThis affected systems using Intel\u0027s Patherpoint chipset, which rely on\nsoftware bandwidth checking. For example, a Lenovo X230 would lose the\nability to use ports on the docking station after enough suspend/resume\ncycles because the bandwidth calculated would rise with every cycle when\na suitable device is attached.\n\nThe correct number of active endpoints is calculated in the same way as\nin xhci_reserve_bandwidth.\n\nSigned-off-by: Brian Campbell \u003cbacam@z273.org.uk\u003e\nSigned-off-by: Mathias Nyman \u003cmathias.nyman@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "f30647cf09e0d1dc363811c483aec3dc2dfc1416", "tree": "f3813f8c69a9f9f95fe76b93120af5c6164909a7", "parents": [ "0552a3c9481c54b46bd0a6c20318c153512e150f" ], "author": { "name": "AMAN DEEP", "email": "aman.deep@samsung.com", "time": "Tue Jul 21 17:20:27 2015 +0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:46 2016 +0800" }, "message": "usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function\n\ncommit 3496810663922617d4b706ef2780c279252ddd6a upstream.\n\nvirt_dev-\u003enum_cached_rings counts on freed ring and is not updated\ncorrectly. In xhci_free_or_cache_endpoint_ring() function, the free ring\nis added into cache and then num_rings_cache is incremented as below:\n\t\tvirt_dev-\u003ering_cache[rings_cached] \u003d\n\t\t\tvirt_dev-\u003eeps[ep_index].ring;\n\t\tvirt_dev-\u003enum_rings_cached++;\nhere, free ring pointer is added to a current index and then\nindex is incremented.\nSo current index always points to empty location in the ring cache.\nFor getting available free ring, current index should be decremented\nfirst and then corresponding ring buffer value should be taken from ring\ncache.\n\nBut In function xhci_endpoint_init(), the num_rings_cached index is\naccessed before decrement.\n\t\tvirt_dev-\u003eeps[ep_index].new_ring \u003d\n\t\t\tvirt_dev-\u003ering_cache[virt_dev-\u003enum_rings_cached];\n\t\tvirt_dev-\u003ering_cache[virt_dev-\u003enum_rings_cached] \u003d NULL;\n\t\tvirt_dev-\u003enum_rings_cached--;\nThis is bug in manipulating the index of ring cache.\nAnd it should be as below:\n\t\tvirt_dev-\u003enum_rings_cached--;\n\t\tvirt_dev-\u003eeps[ep_index].new_ring \u003d\n\t\t\tvirt_dev-\u003ering_cache[virt_dev-\u003enum_rings_cached];\n\t\tvirt_dev-\u003ering_cache[virt_dev-\u003enum_rings_cached] \u003d NULL;\n\nSigned-off-by: Aman Deep \u003caman.deep@samsung.com\u003e\nSigned-off-by: Mathias Nyman \u003cmathias.nyman@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "0552a3c9481c54b46bd0a6c20318c153512e150f", "tree": "c487cf15b00a8da6ce5ac4102ea6853ac56239d3", "parents": [ "bf09aabeedb4fcd57b504e247c264b4bfbc99622" ], "author": { "name": "John Youn", "email": "John.Youn@synopsys.com", "time": "Mon Sep 17 00:00:00 2001 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:46 2016 +0800" }, "message": "usb: dwc3: Reset the transfer resource index on SET_INTERFACE\n\ncommit aebda618718157a69c0dc0adb978d69bc2b8723c upstream.\n\nThis fixes an issue introduced in commit b23c843992b6 (usb: dwc3:\ngadget: fix DEPSTARTCFG for non-EP0 EPs) that made sure we would\nonly use DEPSTARTCFG once per SetConfig.\n\nThe trick is that we should use one DEPSTARTCFG per SetConfig *OR*\nSetInterface. SetInterface was completely missed from the original\npatch.\n\nThis problem became aparent after commit 76e838c9f776 (usb: dwc3:\ngadget: return error if command sent to DEPCMD register fails)\nadded checking of the return status of device endpoint commands.\n\n\u0027Set Endpoint Transfer Resource\u0027 command was caught failing\noccasionally. This is because the Transfer Resource\nIndex was not getting reset during a SET_INTERFACE request.\n\nFinally, to fix the issue, was we have to do is make sure that\nour start_config_issued flag gets reset whenever we receive a\nSetInterface request.\n\nTo verify the problem (and its fix), all we have to do is run\ntest 9 from testusb with \u0027testusb -t 9 -s 2048 -a -c 5000\u0027.\n\nTested-by: Huang Rui \u003cray.huang@amd.com\u003e\nTested-by: Subbaraya Sundeep Bhatta \u003csubbaraya.sundeep.bhatta@xilinx.com\u003e\nFixes: b23c843992b6 (usb: dwc3: gadget: fix DEPSTARTCFG for non-EP0 EPs)\nSigned-off-by: John Youn \u003cjohnyoun@synopsys.com\u003e\nSigned-off-by: Felipe Balbi \u003cbalbi@ti.com\u003e\n[lizf: Backported to 3.4: use dev_vdbg() instead of dwc3_trace()]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "bf09aabeedb4fcd57b504e247c264b4bfbc99622", "tree": "9e635349b1cd04c948d3811c98062bc00638d301", "parents": [ "bafc9ad5564a7a3cfc43d8e98b5b4df54bddfb89" ], "author": { "name": "NeilBrown", "email": "neilb@suse.com", "time": "Wed Jul 22 10:20:07 2015 +1000" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:46 2016 +0800" }, "message": "md: flush -\u003eevent_work before stopping array.\n\ncommit ee5d004fd0591536a061451eba2b187092e9127c upstream.\n\nThe \u0027event_work\u0027 worker used by dm-raid may still be running\nwhen the array is stopped. This can result in an oops.\n\nSo flush the workqueue on which it is run after detaching\nand before destroying the device.\n\nReported-by: Heinz Mauelshagen \u003cheinzm@redhat.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.com\u003e\nFixes: 9d09e663d550 (\"dm: raid456 basic support\")\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "bafc9ad5564a7a3cfc43d8e98b5b4df54bddfb89", "tree": "f81091674cb370bc29221497e0b1be1f2acf4768", "parents": [ "7730b2f9e50b7015ab360675ece743000dd612d3" ], "author": { "name": "NeilBrown", "email": "neilb@suse.de", "time": "Mon Nov 19 10:47:48 2012 +1100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:46 2016 +0800" }, "message": "md: make sure everything is freed when dm-raid stops an array.\n\ncommit 5eff3c439d3478ba9e8ba5f8c0aaf6e6fadb6e58 upstream.\n\nmd_stop() would stop an array, but not free various attached\ndata structures.\nFor internal arrays, these are freed later in do_md_stop() or\nmddev_put(), but they don\u0027t apply for dm-raid arrays.\nSo get md_stop() to free them, and only all it from dm-raid.\nFor internal arrays we now call __md_stop.\n\nReported-by: majianpeng \u003cmajianpeng@gmail.com\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.de\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "45ceb60e13119ead510fb76882e5744a5802c5e1", "tree": "8d485c06a8a266479a2b6e0f523ee2b88aa79174", "parents": [ "f10f13cb5cad9d878a7cdc8d47bc621abb1e8229" ], "author": { "name": "Stefan Agner", "email": "stefan@agner.ch", "time": "Mon May 18 18:33:27 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:45 2016 +0800" }, "message": "can: mcp251x: fix resume when device is down\n\ncommit 25b401c1816ae64bcc5dcb1d39ab41812522a0ce upstream.\n\nIf a valid power regulator or a dummy regulator is used (which\nhappens to be the case when no regulator is specified), restart_work\nis queued no matter whether the device was running or not at suspend\ntime. Since work queues get initialized in the ndo_open callback,\nresuming leads to a NULL pointer exception.\n\nReverse exactly the steps executed at suspend time:\n- Enable the power regulator in any case\n- Enable the transceiver regulator if the device was running, even in\n case we have a power regulator\n- Queue restart_work only in case the device was running\n\nFixes: bf66f3736a94 (\"can: mcp251x: Move to threaded interrupts instead of workqueues.\")\nSigned-off-by: Stefan Agner \u003cstefan@agner.ch\u003e\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n[lizf: Backported to 3.4:\n - adjust filename\n - adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "8c12b3bad2b37b79541f4557e9946ea69019d8be", "tree": "87020f863353093e6080af08e1ba67e4ad44d1f5", "parents": [ "8210f1587a2854853e5f050d63391c07783e930b" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Wed Jul 08 13:06:12 2015 -0400" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:45 2016 +0800" }, "message": "libata: increase the timeout when setting transfer mode\n\ncommit d531be2ca2f27cca5f041b6a140504999144a617 upstream.\n\nI have a ST4000DM000 disk. If Linux is booted while the disk is spun down,\nthe command that sets transfer mode causes the disk to spin up. The\nspin-up takes longer than the default 5s timeout, so the command fails and\ntimeout is reported.\n\nFix this by increasing the timeout to 15s, which is enough for the disk to\nspin up.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "8210f1587a2854853e5f050d63391c07783e930b", "tree": "a7498e13a6c5e8c1e9c0f60b7d5537e6c81e0e27", "parents": [ "3330d7bdad8141a862d7d9f19423453fbd92b76a" ], "author": { "name": "Arne Fitzenreiter", "email": "arne_f@ipfire.org", "time": "Wed Jul 15 13:54:37 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:45 2016 +0800" }, "message": "libata: force disable trim for SuperSSpeed S238\n\ncommit cda57b1b05cf7b8b99ab4b732bea0b05b6c015cc upstream.\n\nThis device loses blocks, often the partition table area, on trim.\nDisable TRIM.\nhttp://pcengines.ch/msata16a.htm\n\nSigned-off-by: Arne Fitzenreiter \u003carne_f@ipfire.org\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "3330d7bdad8141a862d7d9f19423453fbd92b76a", "tree": "5b192b64a5586b4bbfa5662d6634f7d9babdb4b6", "parents": [ "460baab8b45e6f2a92a5e583d5e1bd9dd15b0f3a" ], "author": { "name": "Arne Fitzenreiter", "email": "arne_f@ipfire.org", "time": "Wed Jul 15 13:54:36 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:45 2016 +0800" }, "message": "libata: add ATA_HORKAGE_NOTRIM\n\ncommit 71d126fd28de2d4d9b7b2088dbccd7ca62fad6e0 upstream.\n\nSome devices lose data on TRIM whether queued or not. This patch adds\na horkage to disable TRIM.\n\ntj: Collapsed unnecessary if() nesting.\n\nSigned-off-by: Arne Fitzenreiter \u003carne_f@ipfire.org\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n[lizf: Backported to 3.4:\n - adjust context\n - drop changes to show_ata_dev_trim()]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "460baab8b45e6f2a92a5e583d5e1bd9dd15b0f3a", "tree": "f4cecae00c707eb8a32c4b4ed5fc74986bb9afed", "parents": [ "a98e6aa66c250f67104cf46d2a768648dc815698" ], "author": { "name": "Aleksei Mamlin", "email": "mamlinav@gmail.com", "time": "Wed Jul 01 13:48:30 2015 +0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:44 2016 +0800" }, "message": "libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for HP 250GB SATA disk VB0250EAVER\n\ncommit 08c85d2a599d967ede38a847f5594447b6100642 upstream.\n\nEnabling AA on HP 250GB SATA disk VB0250EAVER causes errors:\n\n[ 3.788362] ata3.00: failed to enable AA (error_mask\u003d0x1)\n[ 3.789243] ata3.00: failed to enable AA (error_mask\u003d0x1)\n\nAdd the ATA_HORKAGE_BROKEN_FPDMA_AA for this specific harddisk.\n\ntj: Collected FPDMA_AA entries and updated comment.\n\nSigned-off-by: Aleksei Mamlin \u003cmamlinav@gmail.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a98e6aa66c250f67104cf46d2a768648dc815698", "tree": "2ccef5842b70083d1694d6f40db091bbb74b2a88", "parents": [ "404d90efb0467cf536d35052abf335fe1b29aa00" ], "author": { "name": "Lior Amsalem", "email": "alior@marvell.com", "time": "Tue Jun 30 16:09:49 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:44 2016 +0800" }, "message": "ata: pmp: add quirk for Marvell 4140 SATA PMP\n\ncommit 945b47441d83d2392ac9f984e0267ad521f24268 upstream.\n\nThis commit adds the necessary quirk to make the Marvell 4140 SATA PMP\nwork properly. This PMP doesn\u0027t like SRST on port number 4 (the host\nport) so this commit marks this port as not supporting SRST.\n\nSigned-off-by: Lior Amsalem \u003calior@marvell.com\u003e\nReviewed-by: Nadav Haklai \u003cnadavh@marvell.com\u003e\nSigned-off-by: Thomas Petazzoni \u003cthomas.petazzoni@free-electrons.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "404d90efb0467cf536d35052abf335fe1b29aa00", "tree": "626412bcc2b35f1f973a8c4c45d4b25999444a30", "parents": [ "64b036e0f40df43c26bc61edf4fc4b07b451b9c5" ], "author": { "name": "Seymour, Shane M", "email": "shane.seymour@hp.com", "time": "Thu Jul 02 12:01:10 2015 +0000" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:44 2016 +0800" }, "message": "st: null pointer dereference panic caused by use after kref_put by st_open\n\ncommit e7ac6c6666bec0a354758a1298d3231e4a635362 upstream.\n\nTwo SLES11 SP3 servers encountered similar crashes simultaneously\nfollowing some kind of SAN/tape target issue:\n\n...\nqla2xxx [0000:81:00.0]-801c:3: Abort command issued nexus\u003d3:0:2 -- 1 2002.\nqla2xxx [0000:81:00.0]-801c:3: Abort command issued nexus\u003d3:0:2 -- 1 2002.\nqla2xxx [0000:81:00.0]-8009:3: DEVICE RESET ISSUED nexus\u003d3:0:2 cmd\u003dffff882f89c2c7c0.\nqla2xxx [0000:81:00.0]-800c:3: do_reset failed for cmd\u003dffff882f89c2c7c0.\nqla2xxx [0000:81:00.0]-800f:3: DEVICE RESET FAILED: Task management failed nexus\u003d3:0:2 cmd\u003dffff882f89c2c7c0.\nqla2xxx [0000:81:00.0]-8009:3: TARGET RESET ISSUED nexus\u003d3:0:2 cmd\u003dffff882f89c2c7c0.\nqla2xxx [0000:81:00.0]-800c:3: do_reset failed for cmd\u003dffff882f89c2c7c0.\nqla2xxx [0000:81:00.0]-800f:3: TARGET RESET FAILED: Task management failed nexus\u003d3:0:2 cmd\u003dffff882f89c2c7c0.\nqla2xxx [0000:81:00.0]-8012:3: BUS RESET ISSUED nexus\u003d3:0:2.\nqla2xxx [0000:81:00.0]-802b:3: BUS RESET SUCCEEDED nexus\u003d3:0:2.\nqla2xxx [0000:81:00.0]-505f:3: Link is operational (8 Gbps).\nqla2xxx [0000:81:00.0]-8018:3: ADAPTER RESET ISSUED nexus\u003d3:0:2.\nqla2xxx [0000:81:00.0]-00af:3: Performing ISP error recovery - ha\u003dffff88bf04d18000.\n rport-3:0-0: blocked FC remote port time out: removing target and saving binding\nqla2xxx [0000:81:00.0]-505f:3: Link is operational (8 Gbps).\nqla2xxx [0000:81:00.0]-8017:3: ADAPTER RESET SUCCEEDED nexus\u003d3:0:2.\n rport-2:0-0: blocked FC remote port time out: removing target and saving binding\nsg_rq_end_io: device detached\nBUG: unable to handle kernel NULL pointer dereference at 00000000000002a8\nIP: [\u003cffffffff8133b268\u003e] __pm_runtime_idle+0x28/0x90\nPGD 7e6586f067 PUD 7e5af06067 PMD 0 [1739975.390354] Oops: 0002 [#1] SMP\nCPU 0\n...\nSupported: No, Proprietary modules are loaded [1739975.390463]\nPid: 27965, comm: ABCD Tainted: PF X 3.0.101-0.29-default #1 HP ProLiant DL580 Gen8\nRIP: 0010:[\u003cffffffff8133b268\u003e] [\u003cffffffff8133b268\u003e] __pm_runtime_idle+0x28/0x90\nRSP: 0018:ffff8839dc1e7c68 EFLAGS: 00010202\nRAX: 0000000000000000 RBX: ffff883f0592fc00 RCX: 0000000000000090\nRDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000138\nRBP: 0000000000000138 R08: 0000000000000010 R09: ffffffff81bd39d0\nR10: 00000000000009c0 R11: ffffffff81025790 R12: 0000000000000001\nR13: ffff883022212b80 R14: 0000000000000004 R15: ffff883022212b80\nFS: 00007f8e54560720(0000) GS:ffff88407f800000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b\nCR2: 00000000000002a8 CR3: 0000007e6ced6000 CR4: 00000000001407f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\nProcess ABCD (pid: 27965, threadinfo ffff8839dc1e6000, task ffff883592e0c640)\nStack:\n ffff883f0592fc00 00000000fffffffa 0000000000000001 ffff883022212b80\n ffff883eff772400 ffffffffa03fa309 0000000000000000 0000000000000000\n ffffffffa04003a0 ffff883f063196c0 ffff887f0379a930 ffffffff8115ea1e\nCall Trace:\n [\u003cffffffffa03fa309\u003e] st_open+0x129/0x240 [st]\n [\u003cffffffff8115ea1e\u003e] chrdev_open+0x13e/0x200\n [\u003cffffffff811588a8\u003e] __dentry_open+0x198/0x310\n [\u003cffffffff81167d74\u003e] do_last+0x1f4/0x800\n [\u003cffffffff81168fe9\u003e] path_openat+0xd9/0x420\n [\u003cffffffff8116946c\u003e] do_filp_open+0x4c/0xc0\n [\u003cffffffff8115a00f\u003e] do_sys_open+0x17f/0x250\n [\u003cffffffff81468d92\u003e] system_call_fastpath+0x16/0x1b\n [\u003c00007f8e4f617fd0\u003e] 0x7f8e4f617fcf\nCode: eb d3 90 48 83 ec 28 40 f6 c6 04 48 89 6c 24 08 4c 89 74 24 20 48 89 fd 48 89 1c 24 4c 89 64 24 10 41 89 f6 4c 89 6c 24 18 74 11 \u003cf0\u003e ff 8f 70 01 00 00 0f 94 c0 45 31 ed 84 c0 74 2b 4c 8d a5 a0\nRIP [\u003cffffffff8133b268\u003e] __pm_runtime_idle+0x28/0x90\n RSP \u003cffff8839dc1e7c68\u003e\nCR2: 00000000000002a8\n\nAnalysis reveals the cause of the crash to be due to STp-\u003edevice\nbeing NULL. The pointer was NULLed via scsi_tape_put(STp) when it\ncalls scsi_tape_release(). In st_open() we jump to err_out after\nscsi_block_when_processing_errors() completes and returns the\ndevice as offline (sdev_state was SDEV_DEL):\n\n1180 /* Open the device. Needs to take the BKL only because of incrementing the SCSI host\n1181 module count. */\n1182 static int st_open(struct inode *inode, struct file *filp)\n1183 {\n1184 int i, retval \u003d (-EIO);\n1185 int resumed \u003d 0;\n1186 struct scsi_tape *STp;\n1187 struct st_partstat *STps;\n1188 int dev \u003d TAPE_NR(inode);\n1189 char *name;\n...\n1217 if (scsi_autopm_get_device(STp-\u003edevice) \u003c 0) {\n1218 retval \u003d -EIO;\n1219 goto err_out;\n1220 }\n1221 resumed \u003d 1;\n1222 if (!scsi_block_when_processing_errors(STp-\u003edevice)) {\n1223 retval \u003d (-ENXIO);\n1224 goto err_out;\n1225 }\n...\n1264 err_out:\n1265 normalize_buffer(STp-\u003ebuffer);\n1266 spin_lock(\u0026st_use_lock);\n1267 STp-\u003ein_use \u003d 0;\n1268 spin_unlock(\u0026st_use_lock);\n1269 scsi_tape_put(STp); \u003c-- STp-\u003edevice \u003d 0 after this\n1270 if (resumed)\n1271 scsi_autopm_put_device(STp-\u003edevice);\n1272 return retval;\n\nThe ref count for the struct scsi_tape had already been reduced\nto 1 when the .remove method of the st module had been called.\nThe kref_put() in scsi_tape_put() caused scsi_tape_release()\nto be called:\n\n0266 static void scsi_tape_put(struct scsi_tape *STp)\n0267 {\n0268 struct scsi_device *sdev \u003d STp-\u003edevice;\n0269\n0270 mutex_lock(\u0026st_ref_mutex);\n0271 kref_put(\u0026STp-\u003ekref, scsi_tape_release); \u003c-- calls this\n0272 scsi_device_put(sdev);\n0273 mutex_unlock(\u0026st_ref_mutex);\n0274 }\n\nIn scsi_tape_release() the struct scsi_device in the struct\nscsi_tape gets set to NULL:\n\n4273 static void scsi_tape_release(struct kref *kref)\n4274 {\n4275 struct scsi_tape *tpnt \u003d to_scsi_tape(kref);\n4276 struct gendisk *disk \u003d tpnt-\u003edisk;\n4277\n4278 tpnt-\u003edevice \u003d NULL; \u003c\u003c\u003c---- where the dev is nulled\n4279\n4280 if (tpnt-\u003ebuffer) {\n4281 normalize_buffer(tpnt-\u003ebuffer);\n4282 kfree(tpnt-\u003ebuffer-\u003ereserved_pages);\n4283 kfree(tpnt-\u003ebuffer);\n4284 }\n4285\n4286 disk-\u003eprivate_data \u003d NULL;\n4287 put_disk(disk);\n4288 kfree(tpnt);\n4289 return;\n4290 }\n\nAlthough the problem was reported on SLES11.3 the problem appears\nin linux-next as well.\n\nThe crash is fixed by reordering the code so we no longer access\nthe struct scsi_tape after the kref_put() is done on it in st_open().\n\nSigned-off-by: Shane Seymour \u003cshane.seymour@hp.com\u003e\nSigned-off-by: Darren Lavender \u003cdarren.lavender@hp.com\u003e\nReviewed-by: Johannes Thumshirn \u003cjthumshirn@suse.com\u003e\nAcked-by: Kai Mäkisara \u003ckai.makisara@kolumbus.fi\u003e\nSigned-off-by: James Bottomley \u003cJBottomley@Odin.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "2025b59cece86f926035a9f7de0c7213f9c1b8b2", "tree": "bbdae8db65d870c7ae667c9fee3678d6188c6dfb", "parents": [ "f9795a1460148fbf417b5875eea0719fa1e53624" ], "author": { "name": "Zhao Junwang", "email": "zhjwpku@gmail.com", "time": "Tue Jul 07 17:08:35 2015 +0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:43 2016 +0800" }, "message": "drm: add a check for x/y in drm_mode_setcrtc\n\ncommit 01447e9f04ba1c49a9534ae6a5a6f26c2bb05226 upstream.\n\nlegacy setcrtc ioctl does take a 32 bit value which might indeed\noverflow\n\nthe checks of crtc_req-\u003ex \u003e INT_MAX and crtc_req-\u003ey \u003e INT_MAX aren\u0027t\nneeded any more with this\n\nv2: -polish the annotation according to Daniel\u0027s comment\n\nCc: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nSigned-off-by: Zhao Junwang \u003czhjwpku@gmail.com\u003e\nSigned-off-by: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "51e94a2005223f61191870166559912b761092e1", "tree": "4eb2af7f982736bfa0da4449e2c4d7da945541f9", "parents": [ "c087472c611b6b277bcd4184c740a33f3c80f98a" ], "author": { "name": "Joe Thornber", "email": "ejt@redhat.com", "time": "Fri Jul 03 14:51:32 2015 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:42 2016 +0800" }, "message": "dm btree: silence lockdep lock inversion in dm_btree_del()\n\ncommit 1c7518794a3647eb345d59ee52844e8a40405198 upstream.\n\nAllocate memory using GFP_NOIO when deleting a btree. dm_btree_del()\ncan be called via an ioctl and we don\u0027t want to recurse into the FS or\nblock layer.\n\nSigned-off-by: Joe Thornber \u003cejt@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "c087472c611b6b277bcd4184c740a33f3c80f98a", "tree": "cf769c9c4eb42d1cc691536d636daceb9310ce53", "parents": [ "fed13a083c6d2d3859518fc07ac9728047deebb9" ], "author": { "name": "Peter Sanford", "email": "peter@sanford.io", "time": "Thu Jun 25 17:40:05 2015 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:42 2016 +0800" }, "message": "USB: cp210x: add ID for Aruba Networks controllers\n\ncommit f98a7aa81eeeadcad25665c3501c236d531d4382 upstream.\n\nAdd the USB serial console device ID for Aruba Networks 7xxx series\ncontrollers which have a USB port for their serial console.\n\nSigned-off-by: Peter Sanford \u003cpeter@sanford.io\u003e\nSigned-off-by: Johan Hovold \u003cjohan@kernel.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "fed13a083c6d2d3859518fc07ac9728047deebb9", "tree": "eb1a3954f2b3e866da6796f58b9a3a1dfbcbf8d9", "parents": [ "ac1adeabeaa094672b95b341fbaeb17fef3809ce" ], "author": { "name": "Claudio Cappelli", "email": "claudio.cappelli.linux@gmail.com", "time": "Wed Jun 10 20:38:30 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:42 2016 +0800" }, "message": "USB: option: add 2020:4000 ID\n\ncommit f6d7fb37f92622479ef6da604f27561f5045ba1e upstream.\n\nAdd device Olivetti Olicard 300 (Network Connect: MT6225) - IDs 2020:4000.\n\nT: Bus\u003d01 Lev\u003d02 Prnt\u003d04 Port\u003d00 Cnt\u003d01 Dev#\u003d 10 Spd\u003d480 MxCh\u003d 0\nD: Ver\u003d 2.00 Cls\u003def(misc ) Sub\u003d02 Prot\u003d01 MxPS\u003d64 #Cfgs\u003d 1\nP: Vendor\u003d2020 ProdID\u003d4000 Rev\u003d03.00\nS: Manufacturer\u003dNetwork Connect\nS: Product\u003dMT6225\nC: #Ifs\u003d 7 Cfg#\u003d 1 Atr\u003da0 MxPwr\u003d500mA\nI: If#\u003d 0 Alt\u003d 0 #EPs\u003d 1 Cls\u003d02(commc) Sub\u003d0e Prot\u003d00 Driver\u003dcdc_mbim\nI: If#\u003d 1 Alt\u003d 1 #EPs\u003d 2 Cls\u003d0a(data ) Sub\u003d00 Prot\u003d02 Driver\u003dcdc_mbim\nI: If#\u003d 2 Alt\u003d 0 #EPs\u003d 3 Cls\u003dff(vend.) Sub\u003d02 Prot\u003d01 Driver\u003doption\nI: If#\u003d 3 Alt\u003d 0 #EPs\u003d 2 Cls\u003dff(vend.) Sub\u003d00 Prot\u003d00 Driver\u003doption\nI: If#\u003d 4 Alt\u003d 0 #EPs\u003d 2 Cls\u003dff(vend.) Sub\u003d00 Prot\u003d00 Driver\u003doption\nI: If#\u003d 5 Alt\u003d 0 #EPs\u003d 2 Cls\u003dff(vend.) Sub\u003d00 Prot\u003d00 Driver\u003doption\nI: If#\u003d 6 Alt\u003d 0 #EPs\u003d 2 Cls\u003d08(stor.) Sub\u003d06 Prot\u003d50 Driver\u003dusb-storage\n\nSigned-off-by: Claudio Cappelli \u003cclaudio.cappelli.linux@gmail.com\u003e\nSuggested-by: Lars Melin \u003clarsm17@gmail.com\u003e\n[johan: amend commit message with devices info ]\nSigned-off-by: Johan Hovold \u003cjohan@kernel.org\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "ac1adeabeaa094672b95b341fbaeb17fef3809ce", "tree": "56d875fad73d3064e1d974cbb91f76b829fa2897", "parents": [ "9b733904f33edc0245486e64e76fe3540ddc9342" ], "author": { "name": "Joe Thornber", "email": "ejt@redhat.com", "time": "Fri Jul 03 10:22:42 2015 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:41 2016 +0800" }, "message": "dm thin: allocate the cell_sort_array dynamically\n\ncommit a822c83e47d97cdef38c4352e1ef62d9f46cfe98 upstream.\n\nGiven the pool\u0027s cell_sort_array holds 8192 pointers it triggers an\norder 5 allocation via kmalloc. This order 5 allocation is prone to\nfailure as system memory gets more fragmented over time.\n\nFix this by allocating the cell_sort_array using vmalloc.\n\nSigned-off-by: Joe Thornber \u003cejt@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\n[lizf: Backported 3.4: it\u0027s prinson_{create,destroy}() that need fixing]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "9b733904f33edc0245486e64e76fe3540ddc9342", "tree": "38a69a26cb3730fb55dc8c30b72421719f36f12e", "parents": [ "0fa41525bd0b893f48117457759a6f575c041044" ], "author": { "name": "Dennis Yang", "email": "shinrairis@gmail.com", "time": "Fri Jun 26 15:25:48 2015 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Mon Mar 21 09:17:41 2016 +0800" }, "message": "dm btree remove: fix bug in redistribute3\n\ncommit 4c7e309340ff85072e96f529582d159002c36734 upstream.\n\nredistribute3() shares entries out across 3 nodes. Some entries were\nbeing moved the wrong way, breaking the ordering. This manifested as a\nBUG() in dm-btree-remove.c:shift() when entries were removed from the\nbtree.\n\nFor additional context see:\nhttps://www.redhat.com/archives/dm-devel/2015-May/msg00113.html\n\nSigned-off-by: Dennis Yang \u003cshinrairis@gmail.com\u003e\nSigned-off-by: Joe Thornber \u003cejt@redhat.com\u003e\nSigned-off-by: Mike Snitzer \u003csnitzer@redhat.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "9935340b80c4d3316268ab03ae1d3a1b0228cacc", "tree": "a70a3bec0908e7d3c0d3244c650e300aa6d2c1ce", "parents": [ "1b4c14a071f0d2d95a0efa01be715ace819aa53a" ], "author": { "name": "Peter Hurley", "email": "peter@hurleysoftware.com", "time": "Sun Jan 10 22:40:55 2016 -0800" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Sun Mar 13 23:18:45 2016 -0500" }, "message": "tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)\n\nioctl(TIOCGETD) retrieves the line discipline id directly from the\nldisc because the line discipline id (c_line) in termios is untrustworthy;\nuserspace may have set termios via ioctl(TCSETS*) without actually\nchanging the line discipline via ioctl(TIOCSETD).\n\nHowever, directly accessing the current ldisc via tty-\u003eldisc is\nunsafe; the ldisc ptr dereferenced may be stale if the line discipline\nis changing via ioctl(TIOCSETD) or hangup.\n\nWait for the line discipline reference (just like read() or write())\nto retrieve the \"current\" line discipline id.\n\nChange-Id: I7dae813721d4631d84a7d48b7b908e3bc40617cb\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Peter Hurley \u003cpeter@hurleysoftware.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ad31516703a7c1210078f690ea94a8efe4d01e91", "tree": "ab4494f3a60980909ac339ea58ec920c363dbf18", "parents": [ "e8a835b9a482c3ab97c08847361900f7ed8ab1a6", "3edd6224c2a677bb59efe0b083a51fc2b3b5c64d" ], "author": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Mon Feb 22 00:00:29 2016 -0500" }, "committer": { "name": "David Hays", "email": "dhays90@gmail.com", "time": "Mon Feb 22 17:33:37 2016 -0500" }, "message": "Merge tag v3.4.110 into cm-13.0\n\nConflicts:\n\tdrivers/bluetooth/btusb.c\n\tdrivers/cpufreq/cpufreq.c\n\tdrivers/md/dm-crypt.c\n\tdrivers/mmc/core/core.c\n\tfs/namespace.c\n\tinclude/linux/usb/quirks.h\n\tnet/bluetooth/l2cap_core.c\n\tnet/bluetooth/smp.c\n\tnet/netfilter/xt_socket.c\n\tsecurity/keys/gc.c\n\tsecurity/selinux/nlmsgtab.c\n\nChange-Id: I336fc28268bf70846a49e8f1db4899a10a4e5edb\n" }, { "commit": "f192bd55edc1a5f639c0ac9828dba91f356fb41a", "tree": "c8a7d223438eb961f0de6b25f55e5d666cb1cc9a", "parents": [ "ff028063a496f2a1748cdbe437dfcf5ba9970c75" ], "author": { "name": "Shiju Mathew", "email": "shijum@codeaurora.org", "time": "Fri Nov 13 15:51:34 2015 -0500" }, "committer": { "name": "Ethan Chen", "email": "intervigil@gmail.com", "time": "Tue Dec 22 10:16:52 2015 -0800" }, "message": "msm: vidc: Add support for Picture Order Count Type\n\nThis patch adds POC type support for video core that\nenables low-latency encoding.\n\nChange-Id: I1fe8ea38c7ed8d203a3ef99febb4001165a856fe\nSigned-off-by: Shiju Mathew \u003cshijum@codeaurora.org\u003e\n" }, { "commit": "ef38a934af4bf247d0db5045aa44feea7de91e11", "tree": "a8d7f21f22ee79d9fd8ba61d75bb2637ecec9637", "parents": [ "5c3c41cfb9f790356cc0175f4ee1b6bd29ec64df" ], "author": { "name": "Benjamin Randazzo", "email": "benjamin@randazzo.fr", "time": "Sat Jul 25 16:36:50 2015 +0200" }, "committer": { "name": "Gerrit Code Review", "email": "gerrit@cyanogenmod.org", "time": "Wed Dec 16 10:33:42 2015 -0800" }, "message": "md: use kzalloc() when bitmap is disabled\n\ncommit b6878d9e03043695dbf3fa1caa6dfc09db225b16 upstream.\n\nIn drivers/md/md.c get_bitmap_file() uses kmalloc() for creating a\nmdu_bitmap_file_t called \"file\".\n\n5769 file \u003d kmalloc(sizeof(*file), GFP_NOIO);\n5770 if (!file)\n5771 return -ENOMEM;\n\nThis structure is copied to user space at the end of the function.\n\n5786 if (err \u003d\u003d 0 \u0026\u0026\n5787 copy_to_user(arg, file, sizeof(*file)))\n5788 err \u003d -EFAULT\n\nBut if bitmap is disabled only the first byte of \"file\" is initialized\nwith zero, so it\u0027s possible to read some bytes (up to 4095) of kernel\nspace memory from user space. This is an information leak.\n\n5775 /* bitmap disabled, zero the first byte and copy out */\n5776 if (!mddev-\u003ebitmap_info.file)\n5777 file-\u003epathname[0] \u003d \u0027\\0\u0027;\n\nChange-Id: I7cd2a3c7fad2e2cb9edb8b4eff2af8a3a8f40149\nSigned-off-by: Benjamin Randazzo \u003cbenjamin@randazzo.fr\u003e\nSigned-off-by: NeilBrown \u003cneilb@suse.com\u003e\n[lizf: Backported to 3.4: fix both branches]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "c742cd3a567c2d713b48f4cfed1b519dde1f321a", "tree": "b96e8b4d0344f1795957c0f106550a1032730361", "parents": [ "5d1694ec31f22ab352bb41ecaee86f947605a3e5" ], "author": { "name": "Mahesh A Saptasagar", "email": "c_msapta@qti.qualcomm.com", "time": "Tue Oct 27 15:40:18 2015 +0530" }, "committer": { "name": "Matt Mower", "email": "mowerm@gmail.com", "time": "Tue Nov 10 15:39:53 2015 -0600" }, "message": "wlan: Address buffer overflow due to invalid length\n\nCheck for valid length before copying the packet filter data from\nuserspace buffer to kernel space buffer to avoid buffer overflow\nissue.\n\nChange-Id: I9548727543b903b5eaafa25c6184615d511ca99d\nCRs-Fixed: 930533\n" }, { "commit": "7a403328c381da57af51f57428f55d1388d233b2", "tree": "0860d0a5f025833c599029e9235c7da696eac728", "parents": [ "e1ae22abf3a99e98cc109253400662b7f00403e1" ], "author": { "name": "Mike Marciniszyn", "email": "mike.marciniszyn@intel.com", "time": "Fri Oct 09 01:12:28 2015 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Thu Oct 22 09:20:08 2015 +0800" }, "message": "IB/qib: Change lkey table allocation to support more MRs\n\ncommit d6f1c17e162b2a11e708f28fa93f2f79c164b442 upstream.\n\nThe lkey table is allocated with with a get_user_pages() with an\norder based on a number of index bits from a module parameter.\n\nThe underlying kernel code cannot allocate that many contiguous pages.\n\nThere is no reason the underlying memory needs to be physically\ncontiguous.\n\nThis patch:\n- switches the allocation/deallocation to vmalloc/vfree\n- caps the number of bits to 23 to insure at least 1 generation bit\n o this matches the module parameter description\n\nReviewed-by: Vinit Agnihotri \u003cvinit.abhay.agnihotri@intel.com\u003e\nSigned-off-by: Mike Marciniszyn \u003cmike.marciniszyn@intel.com\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\n[bwh: Backported to 3.2:\n - Adjust context\n - Add definition of qib_dev_warn(), added upstream by commit ddb887658970\n (\"IB/qib: Convert opcode counters to per-context\")]\nSigned-off-by: Ben Hutchings \u003cben@decadent.org.uk\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "15488de7b72b6ab8254dda07053faa4be6b9ec66", "tree": "a78a65243595560eef2cd904bc6c1e2334a09b85", "parents": [ "0ca709ad358a1cb9be5f594a6eca77cbb3b7d7a1" ], "author": { "name": "John Youn", "email": "John.Youn@synopsys.com", "time": "Mon Sep 17 00:00:00 2001 -0700" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Thu Oct 22 09:20:08 2015 +0800" }, "message": "usb: dwc3: Reset the transfer resource index on SET_INTERFACE\n\ncommit aebda618718157a69c0dc0adb978d69bc2b8723c upstream.\n\nThis fixes an issue introduced in commit b23c843992b6 (usb: dwc3:\ngadget: fix DEPSTARTCFG for non-EP0 EPs) that made sure we would\nonly use DEPSTARTCFG once per SetConfig.\n\nThe trick is that we should use one DEPSTARTCFG per SetConfig *OR*\nSetInterface. SetInterface was completely missed from the original\npatch.\n\nThis problem became aparent after commit 76e838c9f776 (usb: dwc3:\ngadget: return error if command sent to DEPCMD register fails)\nadded checking of the return status of device endpoint commands.\n\n\u0027Set Endpoint Transfer Resource\u0027 command was caught failing\noccasionally. This is because the Transfer Resource\nIndex was not getting reset during a SET_INTERFACE request.\n\nFinally, to fix the issue, was we have to do is make sure that\nour start_config_issued flag gets reset whenever we receive a\nSetInterface request.\n\nTo verify the problem (and its fix), all we have to do is run\ntest 9 from testusb with \u0027testusb -t 9 -s 2048 -a -c 5000\u0027.\n\nTested-by: Huang Rui \u003cray.huang@amd.com\u003e\nTested-by: Subbaraya Sundeep Bhatta \u003csubbaraya.sundeep.bhatta@xilinx.com\u003e\nFixes: b23c843992b6 (usb: dwc3: gadget: fix DEPSTARTCFG for non-EP0 EPs)\nSigned-off-by: John Youn \u003cjohnyoun@synopsys.com\u003e\nSigned-off-by: Felipe Balbi \u003cbalbi@ti.com\u003e\n[lizf: Backported to 3.4: use dev_vdbg() instead of dwc3_trace()]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "12fb133f36f0690ee49260ca95c4f56f94f41853", "tree": "3bf5027eeacd588bdf39c8af2a59d46e6c843415", "parents": [ "bdb211672fec45cbf48de2b1acddae8fb1924ef1" ], "author": { "name": "Christian König", "email": "christian.koenig@amd.com", "time": "Thu May 28 15:51:59 2015 +0200" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Thu Oct 22 09:20:08 2015 +0800" }, "message": "drm/radeon: partially revert \"fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling\"\n\ncommit 7c0411d2fabc2e2702c9871ffb603e251158b317 upstream.\n\nWe have that bug for years and some users report side effects when fixing it on older hardware.\n\nSo revert it for VM_CONTEXT0_PAGE_TABLE_END_ADDR, but keep it for VM 1-15.\n\nSigned-off-by: Christian König \u003cchristian.koenig@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\n[lizf: Backported to 3.4: drop the change to clk.c]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "bdb211672fec45cbf48de2b1acddae8fb1924ef1", "tree": "58586fb5bd50e435e8e24b64dbfb8cee5c4bd2ef", "parents": [ "a0b13721e2df7d316080520fb870464ed0a3ce14" ], "author": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Sun Oct 11 16:03:09 2015 +0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Thu Oct 22 09:20:07 2015 +0800" }, "message": "Revert \"drm/radeon: Use drm_calloc_ab for CS relocs\"\n\nThis reverts commit 961bd13539b9e7ca5d2e667668141496b7a1d6bc.\n\nBoth Satoshi-san and Cal reported a kernel crash due to this commit.\n\nReported-by: Satoshi Iwamoto \u003csatoshi.iwamoto@nifty.ne.jp\u003e\nReported-by: Cal Peake \u003ccp@absolutedigital.net\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "a0b13721e2df7d316080520fb870464ed0a3ce14", "tree": "309a9629804d8e62c04fddacbf3c63d90f809333", "parents": [ "22b1c30792cfd5da151f0ba47d2e66d3ea760b96" ], "author": { "name": "Jani Nikula", "email": "jani.nikula@intel.com", "time": "Mon Jun 15 12:59:37 2015 +0300" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Thu Oct 22 09:20:07 2015 +0800" }, "message": "Revert \"drm/i915: Don\u0027t skip request retirement if the active list is empty\"\n\ncommit 245ec9d85696c3e539b23e210f248698b478379c upstream.\n\nThis reverts commit 0aedb1626566efd72b369c01992ee7413c82a0c5.\n\nI messed things up while applying [1] to drm-intel-fixes. Rectify.\n\n[1] http://mid.gmane.org/1432827156-9605-1-git-send-email-ville.syrjala@linux.intel.com\n\nFixes: 0aedb1626566 (\"drm/i915: Don\u0027t skip request retirement if the active list is empty\")\nAcked-by: Ville Syrjälä \u003cville.syrjala@linux.intel.com\u003e\nSigned-off-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "d4ee09b224ce7d0a815aa8a70a9a01b032358393", "tree": "3f43ff148cd23e2810141fbb84d28d2e251b7d20", "parents": [ "61b8a506b6e3d3d391121c7b3c1c1cf29472d8e1" ], "author": { "name": "Lv Zheng", "email": "lv.zheng@intel.com", "time": "Wed Jul 01 14:43:26 2015 +0800" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Thu Oct 22 09:20:07 2015 +0800" }, "message": "ACPICA: Tables: Fix an issue that FACS initialization is performed twice\n\ncommit c04be18448355441a0c424362df65b6422e27bda upstream.\n\nACPICA commit 90f5332a15e9d9ba83831ca700b2b9f708274658\n\nThis patch adds a new FACS initialization flag for acpi_tb_initialize().\nacpi_enable_subsystem() might be invoked several times in OS bootup process,\nand we don\u0027t want FACS initialization to be invoked twice. Lv Zheng.\n\nLink: https://github.com/acpica/acpica/commit/90f5332a\nSigned-off-by: Lv Zheng \u003clv.zheng@intel.com\u003e\nSigned-off-by: Bob Moore \u003crobert.moore@intel.com\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\n[lizf: Backported to 3.4: adjust filename]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" }, { "commit": "d6a9245c6082d243e77fa997d2cfe612ad9fde96", "tree": "15962428846910589327f9ffb5a8042378eef010", "parents": [ "2d0186edeb74f4a0b11e2d7f53085684fa12d273" ], "author": { "name": "Chris Wilson", "email": "chris@chris-wilson.co.uk", "time": "Sun Jun 28 14:18:16 2015 +0100" }, "committer": { "name": "Zefan Li", "email": "lizefan@huawei.com", "time": "Thu Oct 22 09:20:06 2015 +0800" }, "message": "agp/intel: Fix typo in needs_ilk_vtd_wa()\n\ncommit 8b572a4200828b4e75cc22ed2f494b58d5372d65 upstream.\n\nIn needs_ilk_vtd_wa(), we pass in the GPU device but compared it against\nthe ids for the mobile GPU and the mobile host bridge. That latter is\nimpossible and so likely was just a typo for the desktop GPU device id\n(which is also buggy).\n\nFixes commit da88a5f7f7d434e2cde1b3e19d952e6d84533662\nAuthor: Chris Wilson \u003cchris@chris-wilson.co.uk\u003e\nDate: Wed Feb 13 09:31:53 2013 +0000\n\n drm/i915: Disable WC PTE updates to w/a buggy IOMMU on ILK\n\nReported-by: Ting-Wei Lan \u003clantw44@gmail.com\u003e\nBugzilla: https://bugs.freedesktop.org/show_bug.cgi?id\u003d91127\nReferences: https://bugzilla.freedesktop.org/show_bug.cgi?id\u003d60391\nSigned-off-by: Chris Wilson \u003cchris@chris-wilson.co.uk\u003e\nCc: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nReviewed-by: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nSigned-off-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n" } ], "next": "800e58ae21796a472f39cd6d0601c87b297409af" }