{"push_id":629816192,"size":2,"distinct_size":2,"ref":"refs/heads/cm-12.0","head":"f6fdf6d1d8db574cea4133c050911f2037b7aa19","before":"91fd00d218e4ff013247b6be0f30d8f06956e167","commits":[{"sha":"076acbe77efd269c20e0d3728539122b9c040ddd","author":{"email":"e642b69ed2fc111e09ffdc37feb733a52253340d@oracle.com","name":"Sasha Levin"},"message":"vfs: read file_handle only once in handle_to_path\n\nWe used to read file_handle twice. Once to get the amount of extra bytes, and\nonce to fetch the entire structure.\n\nThis may be problematic since we do size verifications only after the first\nread, so if the number of extra bytes changes in userspace between the first\nand second calls, we'll have an incoherent view of file_handle.\n\nInstead, read the constant size once, and copy that over to the final\nstructure without having to re-read it again.\n\nChange-Id: Iae7b4bc4e9ca634aa394cd9b9d3def8b2aa016dc\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_bn_acclaim/commits/076acbe77efd269c20e0d3728539122b9c040ddd"},{"sha":"f6fdf6d1d8db574cea4133c050911f2037b7aa19","author":{"email":"eec72676ad9a62f2727dfed6d270d98c0d02adec@linux.intel.com","name":"Kirill A. Shutemov"},"message":"mm: Fix NULL pointer dereference in madvise(MADV_WILLNEED) support\n\nSasha Levin found a NULL pointer dereference that is due to a missing\npage table lock, which in turn is due to the pmd entry in question being\na transparent huge-table entry.\n\nThe code - introduced in commit 1998cc048901 (\"mm: make\nmadvise(MADV_WILLNEED) support swap file prefetch\") - correctly checks\nfor this situation using pmd_none_or_trans_huge_or_clear_bad(), but it\nturns out that that function doesn't work correctly.\n\npmd_none_or_trans_huge_or_clear_bad() expected that pmd_bad() would\ntrigger if the transparent hugepage bit was set, but it doesn't do that\nif pmd_numa() is also set. Note that the NUMA bit only gets set on real\nNUMA machines, so people trying to reproduce this on most normal\ndevelopment systems would never actually trigger this.\n\nFix it by removing the very subtle (and subtly incorrect) expectation,\nand instead just checking pmd_trans_huge() explicitly.\n\nReported-by: Sasha Levin <sasha.levin@oracle.com>\nAcked-by: Andrea Arcangeli <aarcange@redhat.com>\n[ Additionally remove the now stale test for pmd_trans_huge() inside the\n  pmd_bad() case - Linus ]\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n\nChange-Id: I13bef3d7965fa0b2ac73acc5585ac13299525cec","distinct":true,"url":"https://api.github.com/repos/CyanogenMod/android_kernel_bn_acclaim/commits/f6fdf6d1d8db574cea4133c050911f2037b7aa19"}]}