GitHub PushEvent at 2014-09-26 06:41:47
Repository: android_kernel_htc_msm8960
Actor: dastin1015
Payload: {"shas":[["b402b721ef70eb296aa63ec54181167525b67a5a","5a8000dbbab0aa4e7384c4decaec220a2d788ba2@canonical.com","stable_kernel_rules: Add pointer to netdev-FAQ for network patches\n\ncommit b76fc285337b6b256e9ba20a40cfd043f70c27af upstream.\n\nStable_kernel_rules should point submitters of network stable patches to the\nnetdev_FAQ.txt as requests for stable network patches should go to netdev\nfirst.\n\nSigned-off-by: Dave Chiluk <chiluk@canonical.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","Dave Chiluk",true],["c27d3b507ecfb78ce9d3ce9a02c0297a32001548","70806a71956ed8873ecff8522779dae1401a1b4a@gmail.com","ASoC: pxa-ssp: drop SNDRV_PCM_FMTBIT_S24_LE\n\ncommit 9301503af016eb537ccce76adec0c1bb5c84871e upstream.\n\nThis mode is unsupported, as the DMA controller can't do zero-padding\nof samples.\n\nSigned-off-by: Daniel Mack <zonque@gmail.com>\nReported-by: Johannes Stezenbach <js@sig21.net>\nSigned-off-by: Mark Brown <broonie@linaro.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","Daniel Mack",true],["9220628427bc4e3fae475a150648b758f06ddfae","14deb5e5e417133e888bf47bb6a3555c9bb7d81c@samba.org","ibmveth: Fix endian issues with rx_no_buffer statistic\n\ncommit cbd5228199d8be45d895d9d0cc2b8ce53835fc21 upstream.\n\nHidden away in the last 8 bytes of the buffer_list page is a solitary\nstatistic. It needs to be byte swapped or else ethtool -S will\nproduce numbers that terrify the user.\n\nSince we do this in multiple places, create a helper function with a\ncomment explaining what is going on.\n\nSigned-off-by: Anton Blanchard <anton@samba.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","Anton Blanchard",true],["dab2f9be0ad69d2fa2716c84a45e9baf31ec62bd","ed58f755cc8caaf10c3e8c731a8b86fb8f13d6cb@suse.cz","HID: fix a couple of off-by-ones\n\ncommit 4ab25786c87eb20857bbb715c3ae34ec8fd6a214 upstream.\n\nThere are a few very theoretical off-by-one bugs in report descriptor size\nchecking when performing a pre-parsing fixup. Fix those.\n\nReported-by: Ben Hawkes <hawkes@google.com>\nReviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>\nSigned-off-by: Jiri Kosina <jkosina@suse.cz>\n[lizf: Backported to 3.4: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>","Jiri Kosina",true],["c945ed6b7e5812cfba4d292c3c54fc750bb9f65b","ed58f755cc8caaf10c3e8c731a8b86fb8f13d6cb@suse.cz","HID: logitech: perform bounds checking on device_id early enough\n\ncommit ad3e14d7c5268c2e24477c6ef54bbdf88add5d36 upstream.\n\ndevice_index is a char type and the size of paired_dj_deivces is 7\nelements, therefore proper bounds checking has to be applied to\ndevice_index before it is used.\n\nWe are currently performing the bounds checking in\nlogi_dj_recv_add_djhid_device(), which is too late, as malicious device\ncould send REPORT_TYPE_NOTIF_DEVICE_UNPAIRED early enough and trigger the\nproblem in one of the report forwarding functions called from\nlogi_dj_raw_event().\n\nFix this by performing the check at the earliest possible ocasion in\nlogi_dj_raw_event().\n\nReported-by: Ben Hawkes <hawkes@google.com>\nReviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>\nSigned-off-by: Jiri Kosina <jkosina@suse.cz>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","Jiri Kosina",true],["5ccd3e2a9ec54a2e9a9b0a7d9256f2433304fa24","596727c8a0ea4db3ba2ceceedccbacd3d7b371b8@suse.cz","isofs: Fix unbounded recursion when processing relocated directories\n\ncommit 410dd3cf4c9b36f27ed4542ee18b1af5e68645a4 upstream.\n\nWe did not check relocated directory in any way when processing Rock\nRidge 'CL' tag. Thus a corrupted isofs image can possibly have a CL\nentry pointing to another CL entry leading to possibly unbounded\nrecursion in kernel code and thus stack overflow or deadlocks (if there\nis a loop created from CL entries).\n\nFix the problem by not allowing CL entry to point to a directory entry\nwith CL entry (such use makes no good sense anyway) and by checking\nwhether CL entry doesn't point to itself.\n\nReported-by: Chris Evans <cevans@google.com>\nSigned-off-by: Jan Kara <jack@suse.cz>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","Jan Kara",true],["33df36f48f2877f37037e185b6f11b077de27e5b","13423a3f3006b5859cfceae66d59451f5eb4e205@nsn.com","MIPS: OCTEON: make get_system_type() thread-safe\n\ncommit 608308682addfdc7b8e2aee88f0e028331d88e4d upstream.\n\nget_system_type() is not thread-safe on OCTEON. It uses static data,\nalso more dangerous issue is that it's calling cvmx_fuse_read_byte()\nevery time without any synchronization. Currently it's possible to get\nprocesses stuck looping forever in kernel simply by launching multiple\nreaders of /proc/cpuinfo:\n\n\t(while true; do cat /proc/cpuinfo > /dev/null; done) &\n\t(while true; do cat /proc/cpuinfo > /dev/null; done) &\n\t...\n\nFix by initializing the system type string only once during the early\nboot.\n\nSigned-off-by: Aaro Koskinen <aaro.koskinen@nsn.com>\nReviewed-by: Markos Chandras <markos.chandras@imgtec.com>\nPatchwork: http://patchwork.linux-mips.org/patch/7437/\nSigned-off-by: James Hogan <james.hogan@imgtec.com>\n[lizf: Backport to 3.x: adjust context]\nSigned-off-by: Zefan Li <lizefan@huawei.com>","Aaro Koskinen",true],["f0634a3e2f4eea6ff149bf62aa97269fb8d65107","255103e50249e3d658441816e0597170ebfc16ef@redhat.com","kvm: iommu: fix the third parameter of kvm_iommu_put_pages (CVE-2014-3601)\n\ncommit 350b8bdd689cd2ab2c67c8a86a0be86cfa0751a7 upstream.\n\nThe third parameter of kvm_iommu_put_pages is wrong,\nIt should be 'gfn - slot->base_gfn'.\n\nBy making gfn very large, malicious guest or userspace can cause kvm to\ngo to this error path, and subsequently to pass a huge value as size.\nAlternatively if gfn is small, then pages would be pinned but never\nunpinned, causing host memory leak and local DOS.\n\nPassing a reasonable but large value could be the most dangerous case,\nbecause it would unpin a page that should have stayed pinned, and thus\nallow the device to DMA into arbitrary memory.  However, this cannot\nhappen because of the condition that can trigger the error:\n\n- out of memory (where you can't allocate even a single page)\n  should not be possible for the attacker to trigger\n\n- when exceeding the iommu's address space, guest pages after gfn\n  will also exceed the iommu's address space, and inside\n  kvm_iommu_put_pages() the iommu_iova_to_phys() will fail.  The\n  page thus would not be unpinned at all.\n\nReported-by: Jack Morgenstein <jackm@mellanox.com>\nSigned-off-by: Michael S. Tsirkin <mst@redhat.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","Michael S. Tsirkin",true],["db83744afb3a43a21722d3bb17c8e1e8da5a9cf7","7b808d12fc3a073c7a7c0d57bb3dff4996ef61c0@gmail.com","pata_scc: propagate return value of scc_wait_after_reset\n\ncommit 4dc7c76cd500fa78c64adfda4b070b870a2b993c upstream.\n\nscc_bus_softreset not necessarily should return zero.\nPropagate the error code.\n\nSigned-off-by: Arjun Sreedharan <arjun024@gmail.com>\nSigned-off-by: Tejun Heo <tj@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","Arjun Sreedharan",true],["77e5657567adc61ab425a070c5a9ec13b20913e8","61aff96566804ea1da8a65de5bcc892ce07caceb@suse.de","iommu/amd: Fix cleanup_domain for mass device removal\n\ncommit 9b29d3c6510407d91786c1cf9183ff4debb3473a upstream.\n\nWhen multiple devices are detached in __detach_device, they\nare also removed from the domains dev_list. This makes it\nunsafe to use list_for_each_entry_safe, as the next pointer\nmight also not be in the list anymore after __detach_device\nreturns. So just repeatedly remove the first element of the\nlist until it is empty.\n\nTested-by: Marti Raudsepp <marti@juffo.org>\nSigned-off-by: Joerg Roedel <jroedel@suse.de>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","Joerg Roedel",true],["a0e5b9d2c3cdaf1f980409ec1a84db22abfd6958","1c00aa603bb92d594c03cff60ecf8e63b2a5bcb1@suse.de","md/raid6: avoid data corruption during recovery of double-degraded RAID6\n\ncommit 9c4bdf697c39805078392d5ddbbba5ae5680e0dd upstream.\n\nDuring recovery of a double-degraded RAID6 it is possible for\nsome blocks not to be recovered properly, leading to corruption.\n\nIf a write happens to one block in a stripe that would be written to a\nmissing device, and at the same time that stripe is recovering data\nto the other missing device, then that recovered data may not be written.\n\nThis patch skips, in the double-degraded case, an optimisation that is\nonly safe for single-degraded arrays.\n\nBug was introduced in 2.6.32 and fix is suitable for any kernel since\nthen.  In an older kernel with separate handle_stripe5() and\nhandle_stripe6() functions the patch must change handle_stripe6().\n\nFixes: 6c0069c0ae9659e3a91b68eaed06a5c6c37f45c8\nCc: Yuri Tikhonov <yur@emcraft.com>\nCc: Dan Williams <dan.j.williams@intel.com>\nReported-by: \"Manibalan P\" <pmanibalan@amiindia.co.in>\nTested-by: \"Manibalan P\" <pmanibalan@amiindia.co.in>\nResolves: https://bugzilla.redhat.com/show_bug.cgi?id=1090423\nSigned-off-by: NeilBrown <neilb@suse.de>\nAcked-by: Dan Williams <dan.j.williams@intel.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","NeilBrown",true],["d06e4b08aa764b2999b6a67f1cf2b7794ae5b0e1","2df99ca89f9c8ed215655495d7ee4ffaa8e47d30@samba.org","CIFS: Fix wrong directory attributes after rename\n\ncommit b46799a8f28c43c5264ac8d8ffa28b311b557e03 upstream.\n\nWhen we requests rename we also need to update attributes\nof both source and target parent directories. Not doing it\ncauses generic/309 xfstest to fail on SMB2 mounts. Fix this\nby marking these directories for force revalidating.\n\nSigned-off-by: Pavel Shilovsky <pshilovsky@samba.org>\nSigned-off-by: Steve French <smfrench@gmail.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","Pavel Shilovsky",true],["483320c2bc1981d960750b02ced9ae4d11fc0e1c","4596b3305151c7ee743192a95d394341e3d3b644@suse.de","ALSA: hda/realtek - Avoid setting wrong COEF on ALC269 & co\n\ncommit f3ee07d8b6e061bf34a7167c3f564e8da4360a99 upstream.\n\nALC269 & co have many vendor-specific setups with COEF verbs.\nHowever, some verbs seem specific to some codec versions and they\nresult in the codec stalling.  Typically, such a case can be avoided\nby checking the return value from reading a COEF.  If the return value\nis -1, it implies that the COEF is invalid, thus it shouldn't be\nwritten.\n\nThis patch adds the invalid COEF checks in appropriate places\naccessing ALC269 and its variants.  The patch actually fixes the\nresume problem on Acer AO725 laptop.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=52181\nTested-by: Francesco Muzio <muziofg@gmail.com>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","Takashi Iwai",true],["2297927578135dd7abf9306b08628c12ae8eeaa0","8c5ea195856807f4f02a6e0749c87ea6b7375f38@gmail.com","xtensa: replace IOCTL code definitions with constants\n\ncommit f61bf8e7d19e0a3456a7a9ed97c399e4353698dc upstream.\n\nThis fixes userspace code that builds on other architectures but fails\non xtensa due to references to structures that other architectures don't\nrefer to. E.g. this fixes the following issue with python-2.7.8:\n\n  python-2.7.8/Modules/termios.c:861:25: error: invalid application\n     of 'sizeof' to incomplete type 'struct serial_multiport_struct'\n     {\"TIOCSERGETMULTI\", TIOCSERGETMULTI},\n  python-2.7.8/Modules/termios.c:870:25: error: invalid application\n     of 'sizeof' to incomplete type 'struct serial_multiport_struct'\n     {\"TIOCSERSETMULTI\", TIOCSERSETMULTI},\n  python-2.7.8/Modules/termios.c:900:24: error: invalid application\n     of 'sizeof' to incomplete type 'struct tty_struct'\n     {\"TIOCTTYGSTRUCT\", TIOCTTYGSTRUCT},\n\nSigned-off-by: Max Filippov <jcmvbkbc@gmail.com>\n[lizf: Backported to 3.4: adjust filename]\nSigned-off-by: Zefan Li <lizefan@huawei.com>","Max Filippov",true],["fb2ae73e3a0ae4abdae30bfc086e52944713520b","ba9be7c186a6dc3c9cf95dd0d4e5b8907e964550@cadence.com","xtensa: fix address checks in dma_{alloc,free}_coherent\n\ncommit 1ca49463c44c970b1ab1d71b0f268bfdf8427a7e upstream.\n\nVirtual address is translated to the XCHAL_KSEG_CACHED region in the\ndma_free_coherent, but is checked to be in the 0...XCHAL_KSEG_SIZE\nrange.\n\nChange check for end of the range from 'addr >= X' to 'addr > X - 1' to\nhandle the case of X == 0.\n\nReplace 'if (C) BUG();' construct with 'BUG_ON(C);'.\n\nSigned-off-by: Alan Douglas <adouglas@cadence.com>\nSigned-off-by: Max Filippov <jcmvbkbc@gmail.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","Alan Douglas",true],["bcf20fd278687960f794b46aa1e06bc0dd99eecf","8c5ea195856807f4f02a6e0749c87ea6b7375f38@gmail.com","xtensa: fix TLBTEMP_BASE_2 region handling in fast_second_level_miss\n\ncommit 7128039fe2dd3d59da9e4ffa036f3aaa3ba87b9f upstream.\n\nCurrent definition of TLBTEMP_BASE_2 is always 32K above the\nTLBTEMP_BASE_1, whereas fast_second_level_miss handler for the TLBTEMP\nregion analyzes virtual address bit (PAGE_SHIFT + DCACHE_ALIAS_ORDER)\nto determine TLBTEMP region where the fault happened. The size of the\nTLBTEMP region is also checked incorrectly: not 64K, but twice data\ncache way size (whicht may as well be less than the instruction cache\nway size).\n\nFix TLBTEMP_BASE_2 to be TLBTEMP_BASE_1 + data cache way size.\nProvide TLBTEMP_SIZE that is a greater of doubled data cache way size or\nthe instruction cache way size, and use it to determine if the second\nlevel TLB miss occured in the TLBTEMP region.\n\nPractical occurence of page faults in the TLBTEMP area is extremely\nrare, this code can be tested by deletion of all w[di]tlb instructions\nin the tlbtemp_mapping region.\n\nSigned-off-by: Max Filippov <jcmvbkbc@gmail.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","Max Filippov",true],["f40751b1c75f30a3d4029f6f1419e2f79bb995c3","8c5ea195856807f4f02a6e0749c87ea6b7375f38@gmail.com","xtensa: fix a6 and a7 handling in fast_syscall_xtensa\n\ncommit d1b6ba82a50cecf94be540a3a153aa89d97511a0 upstream.\n\nRemove restoring a6 on some return paths and instead modify and restore\nit in a single place, using symbolic name.\nCorrectly restore a7 from PT_AREG7 in case of illegal a6 value.\n\nSigned-off-by: Max Filippov <jcmvbkbc@gmail.com>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","Max Filippov",true],["c2aa9b7965a33be8995e9482175381186316bea5","78d8af80769b0cbc00e314928418dc93597f13ae@gmail.com","staging: et131x: Fix errors caused by phydev->addr accesses before initialisation\n\ncommit ec0a38bf8b28b036202070cf3ef271e343d9eafc upstream.\n\nFix two reported bugs, caused by et131x_adapter->phydev->addr being accessed\nbefore it is initialised, by:\n\n- letting et131x_mii_write() take a phydev address, instead of using the one\n  stored in adapter by default. This is so et131x_mdio_write() can use it's own\n  addr value.\n- removing implementation of et131x_mdio_reset(), as it's not needed.\n- moving a call to et131x_disable_phy_coma() in et131x_pci_setup(), which uses\n  phydev->addr, until after the mdiobus has been registered.\n\nLink: https://bugzilla.kernel.org/show_bug.cgi?id=80751\nLink: https://bugzilla.kernel.org/show_bug.cgi?id=77121\nSigned-off-by: Mark Einon <mark.einon@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n[lizf: Backported to 3.4:\n- adjust context\n- update more update more et131x_mii_write() calls in \n  et1310_phy_access_mii_bit() and et131x_xcvr_init()]\nSigned-off-by: Zefan Li <lizefan@huawei.com>","Mark Einon",true],["78aea3aa321b67d478b5d8e9626364c4739cdf28","3c2365aa085787349a5327558db844b55eabde30@brennanashton.com","USB: option: add VIA Telecom CDS7 chipset device id\n\ncommit d77302739d900bbca5e901a3b7ac48c907ee6c93 upstream.\n\nThis VIA Telecom baseband processor is used is used by by u-blox in both the\nFW2770 and FW2760 products and may be used in others as well.\n\nThis patch has been tested on both of these modem versions.\n\nSigned-off-by: Brennan Ashton <bashton@brennanashton.com>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","Brennan Ashton",true],["262548e748b233113c4798336c88b9cd52d5a6e2","759412786bc533369b22377bf83fb9056c5b25b2@kernel.org","USB: ftdi_sio: add Basic Micro ATOM Nano USB2Serial PID\n\ncommit 6552cc7f09261db2aeaae389aa2c05a74b3a93b4 upstream.\n\nAdd device id for Basic Micro ATOM Nano USB2Serial adapters.\n\nReported-by: Nicolas Alt <n.alt@mytum.de>\nTested-by: Nicolas Alt <n.alt@mytum.de>\nSigned-off-by: Johan Hovold <johan@kernel.org>\nSigned-off-by: Zefan Li <lizefan@huawei.com>","Johan Hovold",true]],"size":47,"ref":"refs/heads/cm-11.0","head":"d180794abf4d070beff89db0dfdd24c7ff4e04fb"}