{"push_id":715578291,"size":35,"distinct_size":35,"ref":"refs/heads/linux-3.14.y","head":"a0768244828d0da096ce957616150220da607be1","before":"762167f98c6aa8d47c801f8b6ac20bf30d786a4b","commits":[{"sha":"22ff38e850b7fc87bdcccbebe92c3e7764ffe389","author":{"email":"2a0259761cc3e88db42be5300c1579a67c77e65e@samsung.com","name":"Marek Szyprowski"},"message":"arm64: dma-mapping: always clear allocated buffers\n\ncommit 6829e274a623187c24f7cfc0e3d35f25d087fcc5 upstream.\n\nBuffers allocated by dma_alloc_coherent() are always zeroed on Alpha,\nARM (32bit), MIPS, PowerPC, x86/x86_64 and probably other architectures.\nIt turned out that some drivers rely on this 'feature'. Allocated buffer\nmight be also exposed to userspace with dma_mmap() call, so clearing it\nis desired from security point of view to avoid exposing random memory\nto userspace. This patch unifies dma_alloc_coherent() behavior on ARM64\narchitecture with other implementations by unconditionally zeroing\nallocated buffer.\n\nSigned-off-by: Marek Szyprowski <m.szyprowski@samsung.com>\n[will: ported to 3.14.y]\nSigned-off-by: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/22ff38e850b7fc87bdcccbebe92c3e7764ffe389"},{"sha":"f3fb38ae7386eeff5913251950e285efa86a3b24","author":{"email":"34b4aa64e889ad0f038e03f54f9e4007ea592ecf@rosalab.ru","name":"Eugene Shatokhin"},"message":"kprobes/x86: Return correct length in __copy_instruction()\n\ncommit c80e5c0c23ce2282476fdc64c4b5e3d3a40723fd upstream.\n\nOn x86-64, __copy_instruction() always returns 0 (error) if the\ninstruction uses %rip-relative addressing. This is because\nkernel_insn_init() is called the second time for 'insn' instance\nin such cases and sets all its fields to 0.\n\nBecause of this, trying to place a kprobe on such instruction\nwill fail, register_kprobe() will return -EINVAL.\n\nThis patch fixes the problem.\n\nSigned-off-by: Eugene Shatokhin <eugene.shatokhin@rosalab.ru>\nSigned-off-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>\nLink: http://lkml.kernel.org/r/20150317100918.28349.94654.stgit@localhost.localdomain\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/f3fb38ae7386eeff5913251950e285efa86a3b24"},{"sha":"d5d37cb10aa6a098aab22ac7ae4e0a96d5ac89f4","author":{"email":"da3a51b335cef0eb0e2c329c5ef6bcd6acef687a@oracle.com","name":"Konrad Rzeszutek Wilk"},"message":"config: Enable NEED_DMA_MAP_STATE by default when SWIOTLB is selected\n\ncommit a6dfa128ce5c414ab46b1d690f7a1b8decb8526d upstream.\n\nA huge amount of NIC drivers use the DMA API, however if\ncompiled under 32-bit an very important part of the DMA API can\nbe ommitted leading to the drivers not working at all\n(especially if used with 'swiotlb=force iommu=soft').\n\nAs Prashant Sreedharan explains it: \"the driver [tg3] uses\nDEFINE_DMA_UNMAP_ADDR(), dma_unmap_addr_set() to keep a copy of\nthe dma \"mapping\" and dma_unmap_addr() to get the \"mapping\"\nvalue. On most of the platforms this is a no-op, but ... with\n\"iommu=soft and swiotlb=force\" this house keeping is required,\n... otherwise we pass 0 while calling pci_unmap_/pci_dma_sync_\ninstead of the DMA address.\"\n\nAs such enable this even when using 32-bit kernels.\n\nReported-by: Ian Jackson <Ian.Jackson@eu.citrix.com>\nSigned-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\nAcked-by: David S. Miller <davem@davemloft.net>\nAcked-by: Prashant Sreedharan <prashant@broadcom.com>\nCc: Borislav Petkov <bp@alien8.de>\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Michael Chan <mchan@broadcom.com>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: boris.ostrovsky@oracle.com\nCc: cascardo@linux.vnet.ibm.com\nCc: david.vrabel@citrix.com\nCc: sanjeevb@broadcom.com\nCc: siva.kallam@broadcom.com\nCc: vyasevich@gmail.com\nCc: xen-devel@lists.xensource.com\nLink: http://lkml.kernel.org/r/20150417190448.GA9462@l.oracle.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nCc: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/d5d37cb10aa6a098aab22ac7ae4e0a96d5ac89f4"},{"sha":"d21c3b33bba6b263e67c65cc8854e6b6e940ff1d","author":{"email":"080e0242401949f8c1dfb399e414be816846daae@gmail.com","name":"Chen Gang"},"message":"netfilter: nfnetlink_cthelper: Remove 'const' and '&' to avoid warnings\n\ncommit b18c5d15e8714336365d9d51782d5b53afa0443c upstream.\n\nThe related code can be simplified, and also can avoid related warnings\n(with allmodconfig under parisc):\n\n    CC [M]  net/netfilter/nfnetlink_cthelper.o\n  net/netfilter/nfnetlink_cthelper.c: In function ‘nfnl_cthelper_from_nlattr’:\n  net/netfilter/nfnetlink_cthelper.c:97:9: warning: passing argument 1 o ‘memcpy’ discards ‘const’ qualifier from pointer target type [-Wdiscarded-array-qualifiers]\n    memcpy(&help->data, nla_data(attr), help->helper->data_len);\n           ^\n  In file included from include/linux/string.h:17:0,\n                   from include/uapi/linux/uuid.h:25,\n                   from include/linux/uuid.h:23,\n                   from include/linux/mod_devicetable.h:12,\n                   from ./arch/parisc/include/asm/hardware.h:4,\n                   from ./arch/parisc/include/asm/processor.h:15,\n                   from ./arch/parisc/include/asm/spinlock.h:6,\n                   from ./arch/parisc/include/asm/atomic.h:21,\n                   from include/linux/atomic.h:4,\n                   from ./arch/parisc/include/asm/bitops.h:12,\n                   from include/linux/bitops.h:36,\n                   from include/linux/kernel.h:10,\n                   from include/linux/list.h:8,\n                   from include/linux/module.h:9,\n                   from net/netfilter/nfnetlink_cthelper.c:11:\n  ./arch/parisc/include/asm/string.h:8:8: note: expected ‘void *’ but argument is of type ‘const char (*)[]’\n   void * memcpy(void * dest,const void *src,size_t count);\n          ^\n\nSigned-off-by: Chen Gang <gang.chen.5i5j@gmail.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@soleta.eu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/d21c3b33bba6b263e67c65cc8854e6b6e940ff1d"},{"sha":"ece9210859abb2cc0126f8adbfbbdee668d4906a","author":{"email":"00744440e1e09c84994b7bdeef3bf4278fe0a8df@intel.com","name":"Jim Snow"},"message":"sb_edac: Fix erroneous bytes->gigabytes conversion\n\ncommit 8c009100295597f23978c224aec5751a365bc965 upstream.\n\nSigned-off-by: Jim Snow <jim.snow@intel.com>\nSigned-off-by: Lukasz Anaczkowski <lukasz.anaczkowski@intel.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>\n[ vlee: Backported to 3.14. Adjusted context. ]\nSigned-off-by: Vinson Lee <vlee@twitter.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/ece9210859abb2cc0126f8adbfbbdee668d4906a"},{"sha":"c8371574991021825d76ce7e1cc996078c60f41b","author":{"email":"ed03cdd404c1c501a81ee6cc756c3c81b1d33f83@redhat.com","name":"Tomas Henzl"},"message":"hpsa: refine the pci enable/disable handling\n\ncommit 132aa220b45d60e9b20def1e9d8be9422eed9616 upstream.\n\nWhen a second(kdump) kernel starts and the hard reset method is used\nthe driver calls pci_disable_device without previously enabling it,\nso the kernel shows a warning -\n[   16.876248] WARNING: at drivers/pci/pci.c:1431 pci_disable_device+0x84/0x90()\n[   16.882686] Device hpsa\ndisabling already-disabled device\n...\nThis patch fixes it, in addition to this I tried to balance also some other pairs\nof enable/disable device in the driver.\nUnfortunately I wasn't able to verify the functionality for the case of a sw reset,\nbecause of a lack of proper hw.\n\nSigned-off-by: Tomas Henzl <thenzl@redhat.com>\nReviewed-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>\nSigned-off-by: Christoph Hellwig <hch@lst.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/c8371574991021825d76ce7e1cc996078c60f41b"},{"sha":"b2e7c364e03f9aa8b11c3b1f30d83e7ed255fe9a","author":{"email":"76934fd5be7c60b6ae5266fe76d9dd126996f3a3@brocade.com","name":"Ian Wilson"},"message":"netfilter: Zero the tuple in nfnl_cthelper_parse_tuple()\n\ncommit 78146572b9cd20452da47951812f35b1ad4906be upstream.\n\nnfnl_cthelper_parse_tuple() is called from nfnl_cthelper_new(),\nnfnl_cthelper_get() and nfnl_cthelper_del().  In each case they pass\na pointer to an nf_conntrack_tuple data structure local variable:\n\n    struct nf_conntrack_tuple tuple;\n    ...\n    ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]);\n\nThe problem is that this local variable is not initialized, and\nnfnl_cthelper_parse_tuple() only initializes two fields: src.l3num and\ndst.protonum.  This leaves all other fields with undefined values\nbased on whatever is on the stack:\n\n    tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM]));\n    tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]);\n\nThe symptom observed was that when the rpc and tns helpers were added\nthen traffic to port 1536 was being sent to user-space.\n\nSigned-off-by: Ian Wilson <iwilson@brocade.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/b2e7c364e03f9aa8b11c3b1f30d83e7ed255fe9a"},{"sha":"b89c87de3c8836ef14e643ce89684a2a2afb9bb5","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"netfilter: nft_compat: set IP6T_F_PROTO flag if protocol is set\n\ncommit 749177ccc74f9c6d0f51bd78a15c652a2134aa11 upstream.\n\nip6tables extensions check for this flag to restrict match/target to a\ngiven protocol. Without this flag set, SYNPROXY6 returns an error.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nAcked-by: Patrick McHardy <kaber@trash.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/b89c87de3c8836ef14e643ce89684a2a2afb9bb5"},{"sha":"a374854f755a53f839abceb1cf0ff95b3d563339","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"netfilter: nf_tables: allow to change chain policy without hook if it exists\n\ncommit d6b6cb1d3e6f78d55c2d4043d77d0d8def3f3b99 upstream.\n\nIf there's an existing base chain, we have to allow to change the\ndefault policy without indicating the hook information.\n\nHowever, if the chain doesn't exists, we have to enforce the presence of\nthe hook attribute.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/a374854f755a53f839abceb1cf0ff95b3d563339"},{"sha":"d68014d7b064d3d735296a6bb828c701162f1a66","author":{"email":"ed03cdd404c1c501a81ee6cc756c3c81b1d33f83@redhat.com","name":"Tomas Henzl"},"message":"hpsa: add missing pci_set_master in kdump path\n\ncommit 859c75aba20264d87dd026bab0d0ca3bff385955 upstream.\n\nAdd a call to pci_set_master(...)  missing in the previous\npatch \"hpsa: refine the pci enable/disable handling\".\nFound thanks to Rob Elliot.\n\nSigned-off-by: Tomas Henzl <thenzl@redhat.com>\nReviewed-by: Robert Elliott <elliott@hp.com>\nTested-by: Robert Elliott <elliott@hp.com>\nSigned-off-by: Christoph Hellwig <hch@lst.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/d68014d7b064d3d735296a6bb828c701162f1a66"},{"sha":"77544e78c388cc755c056f451b322dedba991c0a","author":{"email":"3f2200175a6bbbfba43d52ba938bedf5f63cd8af@oracle.com","name":"Quentin Casasnovas"},"message":"x86/microcode/intel: Guard against stack overflow in the loader\n\ncommit f84598bd7c851f8b0bf8cd0d7c3be0d73c432ff4 upstream.\n\nmc_saved_tmp is a static array allocated on the stack, we need to make\nsure mc_saved_count stays within its bounds, otherwise we're overflowing\nthe stack in _save_mc(). A specially crafted microcode header could lead\nto a kernel crash or potentially kernel execution.\n\nSigned-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>\nCc: \"H. Peter Anvin\" <hpa@zytor.com>\nCc: Fenghua Yu <fenghua.yu@intel.com>\nLink: http://lkml.kernel.org/r/1422964824-22056-1-git-send-email-quentin.casasnovas@oracle.com\nSigned-off-by: Borislav Petkov <bp@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/77544e78c388cc755c056f451b322dedba991c0a"},{"sha":"02590fd855d1690568b2fa439c942e933221b57a","author":{"email":"e0fcd583df77ec6c08e6d1257619cc1216ddc994@suse.com","name":"Filipe Manana"},"message":"Btrfs: make xattr replace operations atomic\n\ncommit 5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 upstream.\n\nReplacing a xattr consists of doing a lookup for its existing value, delete\nthe current value from the respective leaf, release the search path and then\nfinally insert the new value. This leaves a time window where readers (getxattr,\nlistxattrs) won't see any value for the xattr. Xattrs are used to store ACLs,\nso this has security implications.\n\nThis change also fixes 2 other existing issues which were:\n\n*) Deleting the old xattr value without verifying first if the new xattr will\n   fit in the existing leaf item (in case multiple xattrs are packed in the\n   same item due to name hash collision);\n\n*) Returning -EEXIST when the flag XATTR_CREATE is given and the xattr doesn't\n   exist but we have have an existing item that packs muliple xattrs with\n   the same name hash as the input xattr. In this case we should return ENOSPC.\n\nA test case for xfstests follows soon.\n\nThanks to Alexandre Oliva for reporting the non-atomicity of the xattr replace\nimplementation.\n\nReported-by: Alexandre Oliva <oliva@gnu.org>\nSigned-off-by: Filipe Manana <fdmanana@suse.com>\nSigned-off-by: Chris Mason <clm@fb.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/02590fd855d1690568b2fa439c942e933221b57a"},{"sha":"ac17ab9b37774017674d11fc3a9f01f815c230e9","author":{"email":"de1b678a59344538ef9f2ddb34a5f9486544e2f9@mellanox.com","name":"Or Gerlitz"},"message":"net/mlx4_en: Don't attempt to TX offload the outer UDP checksum for VXLAN\n\ncommit a4f2dacbf2a5045e34b98a35d9a3857800f25a7b upstream.\n\nFor VXLAN/NVGRE encapsulation, the current HW doesn't support offloading\nboth the outer UDP TX checksum and the inner TCP/UDP TX checksum.\n\nThe driver doesn't advertize SKB_GSO_UDP_TUNNEL_CSUM, however we are wrongly\ntelling the HW to offload the outer UDP checksum for encapsulated packets,\nfix that.\n\nFixes: 837052d0ccc5 ('net/mlx4_en: Add netdev support for TCP/IP\n\t\t     offloads of vxlan tunneling')\nSigned-off-by: Or Gerlitz <ogerlitz@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/ac17ab9b37774017674d11fc3a9f01f815c230e9"},{"sha":"b292fc7723b66d9796ae550b284223d95019ac44","author":{"email":"73675debcd8a436be48ec22211dcf44fe0df0a64@decadent.org.uk","name":"Ben Hutchings"},"message":"splice: Apply generic position and size checks to each write\n\ncommit 894c6350eaad7e613ae267504014a456e00a3e2a from the 3.2-stable branch.\n\nWe need to check the position and size of file writes against various\nlimits, using generic_write_check().  This was not being done for\nthe splice write path.  It was fixed upstream by commit 8d0207652cbe\n(\"->splice_write() via ->write_iter()\") but we can't apply that.\n\nCVE-2014-7822\n\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nCc: Vinson Lee <vlee@twopensource.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/b292fc7723b66d9796ae550b284223d95019ac44"},{"sha":"3a3ac04f0e0ef48c2d30ae6df7b8906421c2b35d","author":{"email":"df6bdf20a159eda54db82d97e15e3f2b8626ef27@armadeus.com","name":"Sebastien Szymanski"},"message":"ARM: clk-imx6q: refine sata's parent\n\ncommit da946aeaeadcd24ff0cda9984c6fb8ed2bfd462a upstream.\n\nAccording to IMX6D/Q RM, table 18-3, sata clock's parent is ahb, not ipg.\n\nSigned-off-by: Sebastien Szymanski <sebastien.szymanski@armadeus.com>\nReviewed-by: Fabio Estevam <fabio.estevam@freescale.com>\nSigned-off-by: Shawn Guo <shawn.guo@linaro.org>\n[dirk.behme: Adjust moved file]\nSigned-off-by: Dirk Behme <dirk.behme@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/3a3ac04f0e0ef48c2d30ae6df7b8906421c2b35d"},{"sha":"580201425a781e0b3fb43a089747d3aebd8b31ea","author":{"email":"48f3f89ac3fac5337b47faa8a2f93eb8b298844e@redhat.com","name":"Bandan Das"},"message":"KVM: nSVM: Check for NRIPS support before updating control field\n\ncommit f104765b4f81fd74d69e0eb161e89096deade2db upstream.\n\nIf hardware doesn't support DecodeAssist - a feature that provides\nmore information about the intercept in the VMCB, KVM decodes the\ninstruction and then updates the next_rip vmcb control field.\nHowever, NRIP support itself depends on cpuid Fn8000_000A_EDX[NRIPS].\nSince skip_emulated_instruction() doesn't verify nrip support\nbefore accepting control.next_rip as valid, avoid writing this\nfield if support isn't present.\n\nSigned-off-by: Bandan Das <bsd@redhat.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/580201425a781e0b3fb43a089747d3aebd8b31ea"},{"sha":"51a73e8859c3d38cf9cc9f5b374abc36078e5eef","author":{"email":"ed22c22dbde360207569092e60b4298397efb8da@uclinux.org","name":"Greg Ungerer"},"message":"bus: mvebu: pass the coherency availability information at init time\n\ncommit 5686a1e5aa436c49187a60052d5885fb1f541ce6 upstream.\n\nUntil now, the mvebu-mbus was guessing by itself whether hardware I/O\ncoherency was available or not by poking into the Device Tree to see\nif the coherency fabric Device Tree node was present or not.\n\nHowever, on some upcoming SoCs, the presence or absence of the\ncoherency fabric DT node isn't sufficient: in CONFIG_SMP, the\ncoherency can be enabled, but not in !CONFIG_SMP.\n\nIn order to clean this up, the mvebu_mbus_dt_init() function is\nextended to get a boolean argument telling whether coherency is\nenabled or not. Therefore, the logic to decide whether coherency is\navailable or not now belongs to the core SoC code instead of the\nmvebu-mbus driver itself, which is much better.\n\nSigned-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>\nLink: https://lkml.kernel.org/r/1397483228-25625-4-git-send-email-thomas.petazzoni@free-electrons.com\nSigned-off-by: Jason Cooper <jason@lakedaemon.net>\n\n[ Greg Ungerer: back ported to linux-3.14.y\n  Back port necessary due to large code differences in affected files.\n  This change in combination with commit e553554536 (\"ARM: mvebu: disable\n  I/O coherency on non-SMP situations on Armada 370/375/38x/XP\") is\n  critical to the hardware I/O coherency being set correctly by both the\n  mbus driver and all peripheral hardware drivers. Without this change\n  drivers will incorrectly enable I/O coherency window attributes and\n  this causes rare unreliable system behavior including oops. ]\n\nSigned-off-by: Greg Ungerer <gerg@uclinux.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/51a73e8859c3d38cf9cc9f5b374abc36078e5eef"},{"sha":"be255a24d4599e3aae60007e1cbc499f61a092fa","author":{"email":"66d3c5fdaeea7ff1f996ad04f2c45e08ab38e2f5@linaro.org","name":"Ard Biesheuvel"},"message":"ARM/arm64: KVM: fix use of WnR bit in kvm_is_write_fault()\n\ncommit a7d079cea2dffb112e26da2566dd84c0ef1fce97 upstream.\n\n[Since we don't backport commit 9804788 (arm/arm64: KVM: Support\nKVM_CAP_READONLY_MEM), ingore the changes in kvm_handle_guest_abort\nintroduced by this patch.]\n\nThe ISS encoding for an exception from a Data Abort has a WnR\nbit[6] that indicates whether the Data Abort was caused by a\nread or a write instruction. While there are several fields\nin the encoding that are only valid if the ISV bit[24] is set,\nWnR is not one of them, so we can read it unconditionally.\n\nInstead of fixing both implementations of kvm_is_write_fault()\nin place, reimplement it just once using kvm_vcpu_dabt_iswrite(),\nwhich already does the right thing with respect to the WnR bit.\nAlso fix up the callers to pass 'vcpu'\n\nAcked-by: Laszlo Ersek <lersek@redhat.com>\nAcked-by: Marc Zyngier <marc.zyngier@arm.com>\nAcked-by: Christoffer Dall <christoffer.dall@linaro.org>\nSigned-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nSigned-off-by: Marc Zyngier <marc.zyngier@arm.com>\nSigned-off-by: Shannon Zhao <shannon.zhao@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/be255a24d4599e3aae60007e1cbc499f61a092fa"},{"sha":"79f03a7665abcb4121a091a0f2008ea83c4bb0d1","author":{"email":"a16cc0c82647c52d401177f8e50567df5499e36c@arm.com","name":"Marc Zyngier"},"message":"KVM: ARM: vgic: plug irq injection race\n\ncommit 71afaba4a2e98bb7bdeba5078370ab43d46e67a1 upstream.\n\n[Since we don't backport commit 227844f (arm/arm64: KVM: Rename irq_state\nto irq_pending) for linux-3.14.y, here we still use vgic_update_irq_state\ninstead of vgic_update_irq_pending.]\n\nAs it stands, nothing prevents userspace from injecting an interrupt\nbefore the guest's GIC is actually initialized.\n\nThis goes unnoticed so far (as everything is pretty much statically\nallocated), but ends up exploding in a spectacular way once we switch\nto a more dynamic allocation (the GIC data structure isn't there yet).\n\nThe fix is to test for the \"ready\" flag in the VGIC distributor before\ntrying to inject the interrupt. Note that in order to avoid breaking\nuserspace, we have to ignore what is essentially an error.\n\nSigned-off-by: Marc Zyngier <marc.zyngier@arm.com>\nAcked-by: Christoffer Dall <christoffer.dall@linaro.org>\nSigned-off-by: Shannon Zhao <shannon.zhao@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/79f03a7665abcb4121a091a0f2008ea83c4bb0d1"},{"sha":"009ac1f72ca7cc631fae7b07333c3c8e5d7bccf6","author":{"email":"39e5ecfe2ecc327c3e39af72d8d83d1bd0709aad@linaro.org","name":"Christoffer Dall"},"message":"arm/arm64: KVM: Fix set_clear_sgi_pend_reg offset\n\ncommit 0fea6d7628ed6e25a9ee1b67edf7c859718d39e8 upstream.\n\nThe sgi values calculated in read_set_clear_sgi_pend_reg() and\nwrite_set_clear_sgi_pend_reg() were horribly incorrectly multiplied by 4\nwith catastrophic results in that subfunctions ended up overwriting\nmemory not allocated for the expected purpose.\n\nThis showed up as bugs in kfree() and the kernel complaining a lot of\nyou turn on memory debugging.\n\nThis addresses: http://marc.info/?l=kvm&m=141164910007868&w=2\n\nReported-by: Shannon Zhao <zhaoshenglong@huawei.com>\nSigned-off-by: Christoffer Dall <christoffer.dall@linaro.org>\nSigned-off-by: Shannon Zhao <shannon.zhao@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/linux-msm/commits/009ac1f72ca7cc631fae7b07333c3c8e5d7bccf6"}]}