{"push_id":688378182,"size":3,"distinct_size":3,"ref":"refs/heads/cm10-experimental","head":"52fbd3ad077a5c1959d440b23d22ed06da3c0ffc","before":"46e79e0bad7c954752cd86e6ddf79ab4016e6aab","commits":[{"sha":"d596fa2ee116766364af3c4052f75b9cc6d72cff","author":{"email":"73675debcd8a436be48ec22211dcf44fe0df0a64@decadent.org.uk","name":"Ben Hutchings"},"message":"staging: vt6656: Fix inconsistent structure packing\n\ncommit 1ee4c55fc9620451b2a825d793042a7e0775391b upstream.\n\nvt6656 has several headers that use the #pragma pack(1) directive to\nenable structure packing, but never disable it.  The layout of\nstructures defined in other headers can then depend on which order the\nvarious headers are included in, breaking the One Definition Rule.\n\nIn practice this resulted in crashes on x86_64 until the order of header\ninclusion was changed for some files in commit 11d404cb56ecd ('staging:\nvt6656: fix headers and add cfg80211.').  But we need a proper fix that\nwon't be affected by future changes to the order of inclusion.\n\nThis removes the #pragma pack(1) directives and adds __packed to the\nstructure definitions for which packing appears to have been intended.\n\nReported-and-tested-by: Malcolm Priestley <tvboxspy@gmail.com>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kabata1975/android_kernel_c8690/commits/d596fa2ee116766364af3c4052f75b9cc6d72cff"},{"sha":"cdfb9858671cf8cd1d8d5c52f244c0d3d95cabec","author":{"email":"5ff1e791b534cb2bff48df645f55908995b541f1@intel.com","name":"chao bi"},"message":"serial:ifx6x60:Delete SPI timer when shut down port\n\ncommit 014b9b4ce84281ccb3d723c792bed19815f3571a upstream.\n\nWhen shut down SPI port, it's possible that MRDY has been asserted and a SPI\ntimer was activated waiting for SRDY assert, in the case, it needs to delete\nthis timer.\n\nSigned-off-by: Chen Jun <jun.d.chen@intel.com>\nSigned-off-by: channing <chao.bi@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kabata1975/android_kernel_c8690/commits/cdfb9858671cf8cd1d8d5c52f244c0d3d95cabec"},{"sha":"52fbd3ad077a5c1959d440b23d22ed06da3c0ffc","author":{"email":"4d12f06cff3725783b352157673a720bc67c4afe@chromium.org","name":"Julius Werner"},"message":"xhci: fix null-pointer dereference when destroying half-built segment rings\n\ncommit 68e5254adb88bede68285f11fb442a4d34fb550c upstream.\n\nxhci_alloc_segments_for_ring() builds a list of xhci_segments and links\nthe tail to head at the end (forming a ring). When it bails out for OOM\nreasons half-way through, it tries to destroy its half-built list with\nxhci_free_segments_for_ring(), even though it is not a ring yet. This\ncauses a null-pointer dereference upon hitting the last element.\n\nFurthermore, one of its callers (xhci_ring_alloc()) mistakenly believes\nthe output parameters to be valid upon this kind of OOM failure, and\ncalls xhci_ring_free() on them. Since the (incomplete) list/ring should\nalready be destroyed in that case, this would lead to a use after free.\n\nThis patch fixes those issues by having xhci_alloc_segments_for_ring()\ndestroy its half-built, non-circular list manually and destroying the\ninvalid struct xhci_ring in xhci_ring_alloc() with a plain kfree().\n\nThis patch should be backported to kernels as old as 2.6.31, that\ncontains the commit 0ebbab37422315a5d0cb29792271085bafdf38c0 \"USB: xhci:\nRing allocation and initialization.\"\n\nA separate patch will need to be developed for kernels older than 3.4,\nsince the ring allocation code was refactored in that kernel.\n\nSigned-off-by: Julius Werner <jwerner@chromium.org>\nSigned-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>\nSigned-off-by: Julius Werner <jwerner@chromium.org>\nSigned-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>\n[bwh: Backported to 3.2:\n - Adjust context\n - Since segment allocation is done directly in xhci_ring_alloc(), walk\n   the list starting from ring->first_seg when freeing]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: CAI Qian <caiqian@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kabata1975/android_kernel_c8690/commits/52fbd3ad077a5c1959d440b23d22ed06da3c0ffc"}]}