{"push_id":874568815,"size":9,"distinct_size":9,"ref":"refs/heads/cm-12.1","head":"d0f00c5e6587d447bb5da9c42ba55d0efc0cab91","before":"9f615bf207f766d4c6f3f80b9e40ea17aca4b7a7","commits":[{"sha":"ee2f6939d6ff5f08383938da715c9c94cce256a4","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"udp: fix behavior of wrong checksums\n\nWe have two problems in UDP stack related to bogus checksums :\n\n1) We return -EAGAIN to application even if receive queue is not empty.\n   This breaks applications using edge trigger epoll()\n\n2) Under UDP flood, we can loop forever without yielding to other\n   processes, potentially hanging the host, especially on non SMP.\n\nThis patch is an attempt to make things better.\n\nWe might in the future add extra support for rt applications\nwanting to better control time spent doing a recv() in a hostile\nenvironment. For example we could validate checksums before queuing\npackets in socket receive queue.\n\nChange-Id: Id97a6bf78f775b876a86afbd3a2442a39d63ca52\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Willem de Bruijn <willemb@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/desteam/android_kernel_huawei_msm8916/commits/ee2f6939d6ff5f08383938da715c9c94cce256a4"},{"sha":"6c6c86d5e47c64ba307006d679a82af3239f5d4a","author":{"email":"e642b69ed2fc111e09ffdc37feb733a52253340d@oracle.com","name":"Sasha Levin"},"message":"net: llc: use correct size for sysctl timeout entries\n\nThe timeout entries are sizeof(int) rather than sizeof(long), which\nmeans that when they were getting read we'd also leak kernel memory\nto userspace along with the timeout values.\n\nChange-Id: I80a001721f25ec556eded2cb5ec329f0763e817a\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/desteam/android_kernel_huawei_msm8916/commits/6c6c86d5e47c64ba307006d679a82af3239f5d4a"},{"sha":"6b47517a931038c540fe8d23a222d407042ea18a","author":{"email":"257d7d5bef225e0a56b3375b0c1e95c6bb0ab871@modio.se","name":"D.S. Ljungmark"},"message":"ipv6: Don't reduce hop limit for an interface\n\nA local route may have a lower hop_limit set than global routes do.\n\nRFC 3756, Section 4.2.7, \"Parameter Spoofing\"\n\n>   1.  The attacker includes a Current Hop Limit of one or another small\n>       number which the attacker knows will cause legitimate packets to\n>       be dropped before they reach their destination.\n\n>   As an example, one possible approach to mitigate this threat is to\n>   ignore very small hop limits.  The nodes could implement a\n>   configurable minimum hop limit, and ignore attempts to set it below\n>   said limit.\n\nChange-Id: Id7aa4da433725cb7e257b51054523963202fa9d4\nSigned-off-by: D.S. Ljungmark <ljungmark@modio.se>\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/desteam/android_kernel_huawei_msm8916/commits/6b47517a931038c540fe8d23a222d407042ea18a"},{"sha":"38766b9e532e0476746a1b1b87db3a53f561fa7d","author":{"email":"eec72676ad9a62f2727dfed6d270d98c0d02adec@linux.intel.com","name":"Kirill A. Shutemov"},"message":"mm: Fix NULL pointer dereference in madvise(MADV_WILLNEED) support\n\nSasha Levin found a NULL pointer dereference that is due to a missing\npage table lock, which in turn is due to the pmd entry in question being\na transparent huge-table entry.\n\nThe code - introduced in commit 1998cc048901 (\"mm: make\nmadvise(MADV_WILLNEED) support swap file prefetch\") - correctly checks\nfor this situation using pmd_none_or_trans_huge_or_clear_bad(), but it\nturns out that that function doesn't work correctly.\n\npmd_none_or_trans_huge_or_clear_bad() expected that pmd_bad() would\ntrigger if the transparent hugepage bit was set, but it doesn't do that\nif pmd_numa() is also set. Note that the NUMA bit only gets set on real\nNUMA machines, so people trying to reproduce this on most normal\ndevelopment systems would never actually trigger this.\n\nFix it by removing the very subtle (and subtly incorrect) expectation,\nand instead just checking pmd_trans_huge() explicitly.\n\nReported-by: Sasha Levin <sasha.levin@oracle.com>\nAcked-by: Andrea Arcangeli <aarcange@redhat.com>\n[ Additionally remove the now stale test for pmd_trans_huge() inside the\n  pmd_bad() case - Linus ]\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n\nChange-Id: I3f3763f236ef102de735297cd175cf514d40d28f","distinct":true,"url":"https://api.github.com/repos/desteam/android_kernel_huawei_msm8916/commits/38766b9e532e0476746a1b1b87db3a53f561fa7d"},{"sha":"88d430629d097bf49093b8d2b2b9bcfd2a0aadea","author":{"email":"e642b69ed2fc111e09ffdc37feb733a52253340d@oracle.com","name":"Sasha Levin"},"message":"vfs: read file_handle only once in handle_to_path\n\nWe used to read file_handle twice. Once to get the amount of extra bytes, and\nonce to fetch the entire structure.\n\nThis may be problematic since we do size verifications only after the first\nread, so if the number of extra bytes changes in userspace between the first\nand second calls, we'll have an incoherent view of file_handle.\n\nInstead, read the constant size once, and copy that over to the final\nstructure without having to re-read it again.\n\nChange-Id: Ib05e5129629e27d5a05953098c5bc470fae40d2a\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/desteam/android_kernel_huawei_msm8916/commits/88d430629d097bf49093b8d2b2b9bcfd2a0aadea"},{"sha":"1855a5a4a0aea8596a5e792a97eeaf1b0c14328e","author":{"email":"8c1011c9d06fc72acd93645d683782ab9543044d@google.com","name":"Michael Halcrow"},"message":"eCryptfs: Remove buggy and unnecessary write in file name decode routine\n\nDmitry Chernenkov used KASAN to discover that eCryptfs writes past the\nend of the allocated buffer during encrypted filename decoding. This\nfix corrects the issue by getting rid of the unnecessary 0 write when\nthe current bit offset is 2.\n\nChange-Id: Id8e04a580e550495c46cd36fec430a1ec4342940\nSigned-off-by: Michael Halcrow <mhalcrow@google.com>\nReported-by: Dmitry Chernenkov <dmitryc@google.com>\nSuggested-by: Kees Cook <keescook@chromium.org>\nCc: stable@vger.kernel.org # v2.6.29+: 51ca58d eCryptfs: Filename Encryption: Encoding and encryption functions\nSigned-off-by: Tyler Hicks <tyhicks@canonical.com>","distinct":true,"url":"https://api.github.com/repos/desteam/android_kernel_huawei_msm8916/commits/1855a5a4a0aea8596a5e792a97eeaf1b0c14328e"},{"sha":"99e6886feac9a9e4d4b88320b36038e613f009e0","author":{"email":"331be22c6b63ca3e0a03d408c2d906b1b02cd5f2@stressinduktion.org","name":"Hannes Frederic Sowa"},"message":"ipv4: try to cache dst_entries which would cause a redirect\n\nNot caching dst_entries which cause redirects could be exploited by hosts\non the same subnet, causing a severe DoS attack. This effect aggravated\nsince commit f88649721268999 (\"ipv4: fix dst race in sk_dst_get()\").\n\nLookups causing redirects will be allocated with DST_NOCACHE set which\nwill force dst_release to free them via RCU.  Unfortunately waiting for\nRCU grace period just takes too long, we can end up with >1M dst_entries\nwaiting to be released and the system will run OOM. rcuos threads cannot\ncatch up under high softirq load.\n\nAttaching the flag to emit a redirect later on to the specific skb allows\nus to cache those dst_entries thus reducing the pressure on allocation\nand deallocation.\n\nThis issue was discovered by Marcelo Leitner.\n\nCc: Julian Anastasov <ja@ssi.bg>\nSigned-off-by: Marcelo Leitner <mleitner@redhat.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: Julian Anastasov <ja@ssi.bg>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n\nConflicts:\n\tinclude/net/ip.h\n\tnet/ipv4/route.c\n\nChange-Id: I53e4b500a4db2f5fece937a42a3bd810b2640c44","distinct":true,"url":"https://api.github.com/repos/desteam/android_kernel_huawei_msm8916/commits/99e6886feac9a9e4d4b88320b36038e613f009e0"},{"sha":"8cc838902f0d21c44817941eeda59f2184862f73","author":{"email":"e642b69ed2fc111e09ffdc37feb733a52253340d@oracle.com","name":"Sasha Levin"},"message":"kernel: add support for gcc 5\n\nWe're missing include/linux/compiler-gcc5.h which is required now\nbecause gcc branched off to v5 in trunk.\n\nJust copy the relevant bits out of include/linux/compiler-gcc4.h,\nno new code is added as of now.\n\nThis fixes a build error when using gcc 5.\n\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>","distinct":true,"url":"https://api.github.com/repos/desteam/android_kernel_huawei_msm8916/commits/8cc838902f0d21c44817941eeda59f2184862f73"},{"sha":"d0f00c5e6587d447bb5da9c42ba55d0efc0cab91","author":{"email":"b41cc3a7b6244fd8b11af2c61d95b36c77d946db@sonymobile.com","name":"Courtney Cavin"},"message":"leds-qpnp: reduce WLED max brightness to 255, as dictated by led-class\n\nSigned-off-by: Courtney Cavin <courtney.cavin@sonymobile.com>\nSigned-off-by: Adam Farden <adam@farden.cz>","distinct":true,"url":"https://api.github.com/repos/desteam/android_kernel_huawei_msm8916/commits/d0f00c5e6587d447bb5da9c42ba55d0efc0cab91"}]}