{"push_id":620494539,"size":380,"distinct_size":3,"ref":"refs/heads/cm-12.0-upgr","head":"239c70f4fd4faa5576c526cee67d20c25011ea4d","before":"d53f5c446a2023d9d2083abe1f295625c9027067","commits":[{"sha":"4e0d105c09b8bec501ff5455b774bf3a845d017c","author":{"email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org","name":"Steven Rostedt (Red Hat)"},"message":"sched: Use CPUPRI_NR_PRIORITIES instead of MAX_RT_PRIO in cpupri check\n\ncommit 6227cb00cc120f9a43ce8313bb0475ddabcb7d01 upstream.\n\nThe check at the beginning of cpupri_find() makes sure that the task_pri\nvariable does not exceed the cp->pri_to_cpu array length. But that length\nis CPUPRI_NR_PRIORITIES not MAX_RT_PRIO, where it will miss the last two\npriorities in that array.\n\nAs task_pri is computed from convert_prio() which should never be bigger\nthan CPUPRI_NR_PRIORITIES, if the check should cause a panic if it is\nhit.\n\nReported-by: Mike Galbraith <umgwanakikbuti@gmail.com>\nSigned-off-by: Steven Rostedt <rostedt@goodmis.org>\nSigned-off-by: Peter Zijlstra <peterz@infradead.org>\nLink: http://lkml.kernel.org/r/1397015410.5212.13.camel@marge.simpson.net\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/4e0d105c09b8bec501ff5455b774bf3a845d017c"},{"sha":"0d41f6026aa0c15d60e75f8f71f1408c32fe1ba4","author":{"email":"2c6594f608aa3d41e98d48846a6328831f7084ad@redhat.com","name":"Jiri Olsa"},"message":"perf: Prevent false warning in perf_swevent_add\n\ncommit 39af6b1678afa5880dda7e375cf3f9d395087f6d upstream.\n\nThe perf cpu offline callback takes down all cpu context\nevents and releases swhash->swevent_hlist.\n\nThis could race with task context software event being just\nscheduled on this cpu via perf_swevent_add while cpu hotplug\ncode already cleaned up event's data.\n\nThe race happens in the gap between the cpu notifier code\nand the cpu being actually taken down. Note that only cpu\nctx events are terminated in the perf cpu hotplug code.\n\nIt's easily reproduced with:\n  $ perf record -e faults perf bench sched pipe\n\nwhile putting one of the cpus offline:\n  # echo 0 > /sys/devices/system/cpu/cpu1/online\n\nConsole emits following warning:\n  WARNING: CPU: 1 PID: 2845 at kernel/events/core.c:5672 perf_swevent_add+0x18d/0x1a0()\n  Modules linked in:\n  CPU: 1 PID: 2845 Comm: sched-pipe Tainted: G        W    3.14.0+ #256\n  Hardware name: Intel Corporation Montevina platform/To be filled by O.E.M., BIOS AMVACRB1.86C.0066.B00.0805070703 05/07/2008\n   0000000000000009 ffff880077233ab8 ffffffff81665a23 0000000000200005\n   0000000000000000 ffff880077233af8 ffffffff8104732c 0000000000000046\n   ffff88007467c800 0000000000000002 ffff88007a9cf2a0 0000000000000001\n  Call Trace:\n   [<ffffffff81665a23>] dump_stack+0x4f/0x7c\n   [<ffffffff8104732c>] warn_slowpath_common+0x8c/0xc0\n   [<ffffffff8104737a>] warn_slowpath_null+0x1a/0x20\n   [<ffffffff8110fb3d>] perf_swevent_add+0x18d/0x1a0\n   [<ffffffff811162ae>] event_sched_in.isra.75+0x9e/0x1f0\n   [<ffffffff8111646a>] group_sched_in+0x6a/0x1f0\n   [<ffffffff81083dd5>] ? sched_clock_local+0x25/0xa0\n   [<ffffffff811167e6>] ctx_sched_in+0x1f6/0x450\n   [<ffffffff8111757b>] perf_event_sched_in+0x6b/0xa0\n   [<ffffffff81117a4b>] perf_event_context_sched_in+0x7b/0xc0\n   [<ffffffff81117ece>] __perf_event_task_sched_in+0x43e/0x460\n   [<ffffffff81096f1e>] ? put_lock_stats.isra.18+0xe/0x30\n   [<ffffffff8107b3c8>] finish_task_switch+0xb8/0x100\n   [<ffffffff8166a7de>] __schedule+0x30e/0xad0\n   [<ffffffff81172dd2>] ? pipe_read+0x3e2/0x560\n   [<ffffffff8166b45e>] ? preempt_schedule_irq+0x3e/0x70\n   [<ffffffff8166b45e>] ? preempt_schedule_irq+0x3e/0x70\n   [<ffffffff8166b464>] preempt_schedule_irq+0x44/0x70\n   [<ffffffff816707f0>] retint_kernel+0x20/0x30\n   [<ffffffff8109e60a>] ? lockdep_sys_exit+0x1a/0x90\n   [<ffffffff812a4234>] lockdep_sys_exit_thunk+0x35/0x67\n   [<ffffffff81679321>] ? sysret_check+0x5/0x56\n\nFixing this by tracking the cpu hotplug state and displaying\nthe WARN only if current cpu is initialized properly.\n\nCc: Corey Ashford <cjashfor@linux.vnet.ibm.com>\nCc: Frederic Weisbecker <fweisbec@gmail.com>\nCc: Ingo Molnar <mingo@kernel.org>\nCc: Paul Mackerras <paulus@samba.org>\nCc: Arnaldo Carvalho de Melo <acme@redhat.com>\nReported-by: Fengguang Wu <fengguang.wu@intel.com>\nSigned-off-by: Jiri Olsa <jolsa@redhat.com>\nSigned-off-by: Peter Zijlstra <peterz@infradead.org>\nLink: http://lkml.kernel.org/r/1396861448-10097-1-git-send-email-jolsa@redhat.com\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/0d41f6026aa0c15d60e75f8f71f1408c32fe1ba4"},{"sha":"183f99ecb6a484c142ae2fc99df3ef5cdadc3985","author":{"email":"3fddac958924aef220f202ca567388ddab3f14a8@infradead.org","name":"Peter Zijlstra"},"message":"perf: Limit perf_event_attr::sample_period to 63 bits\n\ncommit 0819b2e30ccb93edf04876237b6205eef84ec8d2 upstream.\n\nVince reported that using a large sample_period (one with bit 63 set)\nresults in wreckage since while the sample_period is fundamentally\nunsigned (negative periods don't make sense) the way we implement\nthings very much rely on signed logic.\n\nSo limit sample_period to 63 bits to avoid tripping over this.\n\nReported-by: Vince Weaver <vincent.weaver@maine.edu>\nSigned-off-by: Peter Zijlstra <peterz@infradead.org>\nLink: http://lkml.kernel.org/n/tip-p25fhunibl4y3qi0zuqmyf4b@git.kernel.org\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/183f99ecb6a484c142ae2fc99df3ef5cdadc3985"},{"sha":"4b2cfc9508d9e509708f85748548e03db696dbcd","author":{"email":"3fddac958924aef220f202ca567388ddab3f14a8@infradead.org","name":"Peter Zijlstra"},"message":"perf: Fix race in removing an event\n\ncommit 46ce0fe97a6be7532ce6126bb26ce89fed81528c upstream.\n\nWhen removing a (sibling) event we do:\n\n\traw_spin_lock_irq(&ctx->lock);\n\tperf_group_detach(event);\n\traw_spin_unlock_irq(&ctx->lock);\n\n\t<hole>\n\n\tperf_remove_from_context(event);\n\t\traw_spin_lock_irq(&ctx->lock);\n\t\t...\n\t\traw_spin_unlock_irq(&ctx->lock);\n\nNow, assuming the event is a sibling, it will be 'unreachable' for\nthings like ctx_sched_out() because that iterates the\ngroups->siblings, and we just unhooked the sibling.\n\nSo, if during <hole> we get ctx_sched_out(), it will miss the event\nand not call event_sched_out() on it, leaving it programmed on the\nPMU.\n\nThe subsequent perf_remove_from_context() call will find the ctx is\ninactive and only call list_del_event() to remove the event from all\nother lists.\n\nHereafter we can proceed to free the event; while still programmed!\n\nClose this hole by moving perf_group_detach() inside the same\nctx->lock region(s) perf_remove_from_context() has.\n\nThe condition on inherited events only in __perf_event_exit_task() is\nlikely complete crap because non-inherited events are part of groups\ntoo and we're tearing down just the same. But leave that for another\npatch.\n\nMost-likely-Fixes: e03a9a55b4e (\"perf: Change close() semantics for group events\")\nReported-by: Vince Weaver <vincent.weaver@maine.edu>\nTested-by: Vince Weaver <vincent.weaver@maine.edu>\nMuch-staring-at-traces-by: Vince Weaver <vincent.weaver@maine.edu>\nMuch-staring-at-traces-by: Thomas Gleixner <tglx@linutronix.de>\nCc: Arnaldo Carvalho de Melo <acme@kernel.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Peter Zijlstra <peterz@infradead.org>\nLink: http://lkml.kernel.org/r/20140505093124.GN17778@laptop.programming.kicks-ass.net\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/4b2cfc9508d9e509708f85748548e03db696dbcd"},{"sha":"1b2a92d89ef65cba15994b3707a512ceede879b8","author":{"email":"8e7a128cd0264d3269a891fb3e87507c2985f8af@ah.jp.nec.com","name":"Naoya Horiguchi"},"message":"mm/memory-failure.c: fix memory leak by race between poison and unpoison\n\ncommit 3e030ecc0fc7de10fd0da10c1c19939872a31717 upstream.\n\nWhen a memory error happens on an in-use page or (free and in-use)\nhugepage, the victim page is isolated with its refcount set to one.\n\nWhen you try to unpoison it later, unpoison_memory() calls put_page()\nfor it twice in order to bring the page back to free page pool (buddy or\nfree hugepage list).  However, if another memory error occurs on the\npage which we are unpoisoning, memory_failure() returns without\nreleasing the refcount which was incremented in the same call at first,\nwhich results in memory leak and unconsistent num_poisoned_pages\nstatistics.  This patch fixes it.\n\nSigned-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>\nCc: Andi Kleen <andi@firstfloor.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/1b2a92d89ef65cba15994b3707a512ceede879b8"},{"sha":"ee40d72c3e6fc7e6cd5241eb84fa104b61dc8ec3","author":{"email":"d7a2c23eccda99639e3fab64d868a1b1895748fa@samsung.com","name":"Andrey Ryabinin"},"message":"ARM: 8051/1: put_user: fix possible data corruption in put_user\n\ncommit 537094b64b229bf3ad146042f83e74cf6abe59df upstream.\n\nAccording to arm procedure call standart r2 register is call-cloberred.\nSo after the result of x expression was put into r2 any following\nfunction call in p may overwrite r2. To fix this, the result of p\nexpression must be saved to the temporary variable before the\nassigment x expression to __r2.\n\nSigned-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>\nReviewed-by: Nicolas Pitre <nico@linaro.org>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/ee40d72c3e6fc7e6cd5241eb84fa104b61dc8ec3"},{"sha":"d6e81d4f7b4e8cea2817c7568e3756798cd29aae","author":{"email":"4c9eb49378914b743bdd32292c04df29b820d73e@cn.fujitsu.com","name":"Lai Jiangshan"},"message":"sched: Fix hotplug vs. set_cpus_allowed_ptr()\n\ncommit 6acbfb96976fc3350e30d964acb1dbbdf876d55e upstream.\n\nLai found that:\n\n  WARNING: CPU: 1 PID: 13 at arch/x86/kernel/smp.c:124 native_smp_send_reschedule+0x2d/0x4b()\n  ...\n  migration_cpu_stop+0x1d/0x22\n\nwas caused by set_cpus_allowed_ptr() assuming that cpu_active_mask is\nalways a sub-set of cpu_online_mask.\n\nThis isn't true since 5fbd036b552f (\"sched: Cleanup cpu_active madness\").\n\nSo set active and online at the same time to avoid this particular\nproblem.\n\nFixes: 5fbd036b552f (\"sched: Cleanup cpu_active madness\")\nSigned-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>\nSigned-off-by: Peter Zijlstra <peterz@infradead.org>\nCc: Andrew Morton <akpm@linux-foundation.org>\nCc: Gautham R. Shenoy <ego@linux.vnet.ibm.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Michael wang <wangyun@linux.vnet.ibm.com>\nCc: Paul Gortmaker <paul.gortmaker@windriver.com>\nCc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>\nCc: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>\nCc: Toshi Kani <toshi.kani@hp.com>\nLink: http://lkml.kernel.org/r/53758B12.8060609@cn.fujitsu.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/d6e81d4f7b4e8cea2817c7568e3756798cd29aae"},{"sha":"0b78a4287b8cc7c0817b7bc4894d8c9c177bb751","author":{"email":"1c00aa603bb92d594c03cff60ecf8e63b2a5bcb1@suse.de","name":"NeilBrown"},"message":"md: always set MD_RECOVERY_INTR when aborting a reshape or other \"resync\".\n\ncommit 3991b31ea072b070081ca3bfa860a077eda67de5 upstream.\n\nIf mddev->ro is set, md_to_sync will (correctly) abort.\nHowever in that case MD_RECOVERY_INTR isn't set.\n\nIf a RESHAPE had been requested, then ->finish_reshape() will be\ncalled and it will think the reshape was successful even though\nnothing happened.\n\nNormally a resync will not be requested if ->ro is set, but if an\narray is stopped while a reshape is on-going, then when the array is\nstarted, the reshape will be restarted.  If the array is also set\nread-only at this point, the reshape will instantly appear to success,\nresulting in data corruption.\n\nConsequently, this patch is suitable for any -stable kernel.\n\nSigned-off-by: NeilBrown <neilb@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/0b78a4287b8cc7c0817b7bc4894d8c9c177bb751"},{"sha":"a0a3c6603ccd5840452c7d88d7df213f573867d9","author":{"email":"2d4473c5e67eb83655334d4e9a7757f781607241@linux.intel.com","name":"Mathias Nyman"},"message":"xhci: delete endpoints from bandwidth list before freeing whole device\n\ncommit 5dc2808c4729bf080487e61b80ee04e0fdb12a37 upstream.\n\nLists of endpoints are stored for bandwidth calculation for roothub ports.\nMake sure we remove all endpoints from the list before the whole device,\ncontaining its endpoints list_head stuctures, is freed.\n\nThis used to be done in the wrong order in xhci_mem_cleanup(),\nand triggered an oops in resume from S4 (hibernate).\n\nTested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>\nSigned-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/a0a3c6603ccd5840452c7d88d7df213f573867d9"},{"sha":"718c04d410c7a442b59e5e7e372dc011b0ca3dc5","author":{"email":"73675debcd8a436be48ec22211dcf44fe0df0a64@decadent.org.uk","name":"Ben Hutchings"},"message":"Staging: speakup: Move pasting into a work item\n\ncommit d7500135802ca55b3f4e01a16544e8b34082f8c3 upstream.\n\nInput is handled in softirq context, but when pasting we may\nneed to sleep.  speakup_paste_selection() currently tries to\nbodge this by busy-waiting if in_atomic(), but that doesn't\nhelp because the ldisc may also sleep.\n\nFor bonus breakage, speakup_paste_selection() changes the\nstate of current, even though it's not running in process\ncontext.\n\nMove it into a work item and make sure to cancel it on exit.\n\nReferences: https://bugs.debian.org/735202\nReferences: https://bugs.debian.org/744015\nReported-by: Paul Gevers <elbrus@debian.org>\nReported-and-tested-by: Jarek Czekalski <jarekczek@poczta.onet.pl>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/718c04d410c7a442b59e5e7e372dc011b0ca3dc5"},{"sha":"abd03db4242413c2abd6ed87139559e4d0cb8a19","author":{"email":"68d77259d536217a1702046cad051573b7c51882@orange.fr","name":"Ronan Marquet"},"message":"ALSA: hda/realtek - Correction of fixup codes for PB V7900 laptop\n\ncommit e30cf2d2bed3aed74a651c64de323ba26e4ff7d0 upstream.\n\nCorrecion of wrong fixup entries add in commit ca8f0424 to replace\nstatic model quirk for PB V7900 laptop (will model).\n\n[note: the removal of ALC260_FIXUP_HP_PIN_0F chain is also needed as a\n part of the fix; otherwise the pin is set up wrongly as a headphone,\n and user-space (PulseAudio) may be wrongly trying to detect the jack\n state -- tiwai]\n\nFixes: ca8f04247eaa ('ALSA: hda/realtek - Add the fixup codes for ALC260 model=will')\nSigned-off-by: Ronan Marquet <ronan.marquet@orange.fr>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/abd03db4242413c2abd6ed87139559e4d0cb8a19"},{"sha":"810d7a3bef08c6ebe984a9e1dd12659ef3d37679","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ALSA: hda/realtek - Fix COEF widget NID for ALC260 replacer fixup\n\ncommit 192a98e280e560510a62aca8cfa83b4ae7c095bb upstream.\n\nThe conversion to a fixup table for Replacer model with ALC260 in\ncommit 20f7d928 took the wrong widget NID for COEF setups.  Namely,\nNID 0x1a should have been used instead of NID 0x20, which is the\ncommon node for all Realtek codecs but ALC260.\n\nFixes: 20f7d928fa6e ('ALSA: hda/realtek - Replace ALC260 model=replacer with the auto-parser')\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/810d7a3bef08c6ebe984a9e1dd12659ef3d37679"},{"sha":"939b9b9297bd427da92dd1b3d3c94a813db8eee0","author":{"email":"2dd0a47882f0f6e80e10cdc66eeecff982de281e@gmail.com","name":"George McCollister"},"message":"USB: ftdi_sio: add NovaTech OrionLXm product ID\n\ncommit d0839d757e6294921c31b1c4ca4f1dcc5df63bcd upstream.\n\nThe NovaTech OrionLXm uses an onboard FTDI serial converter for JTAG and\nconsole access.\n\nHere is the lsusb output:\nBus 004 Device 123: ID 0403:7c90 Future Technology Devices\nInternational, Ltd\n\nSigned-off-by: George McCollister <george.mccollister@gmail.com>\nSigned-off-by: Johan Hovold <jhovold@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/939b9b9297bd427da92dd1b3d3c94a813db8eee0"},{"sha":"96f169c406101ce9a90c3e534652610bfc46bf67","author":{"email":"c2a2c9b840b84e468243558a0165fb692774abf2@gmail.com","name":"Alexej Starschenko"},"message":"USB: serial: option: add support for Novatel E371 PCIe card\n\ncommit 8a61ba3a47ac39f660702aa66a172185dd605a86 upstream.\n\nAdds product ID for the Novatel E371 PCI Express Mini Card.\n\n$ lsusb\nBus 001 Device 024: ID 1410:9011 Novatel Wireless\n\n$ usb-devices\nT:  Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 24 Spd=480 MxCh= 0\nD:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1\nP:  Vendor=1410 ProdID=9011 Rev=00.03\nS:  Manufacturer=Novatel Wireless, Inc.\nS:  Product=Novatel Wireless HSPA\nS:  SerialNumber=012773002115811\nC:  #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA\nI:  If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option\nI:  If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option\nI:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option\nI:  If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option\nI:  If#= 6 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether\nI:  If#= 7 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether\n\nTested with kernel 3.2.0.\n\nSigned-off-by: Alexej Starschenko <starschenko@gmail.com>\nSigned-off-by: Johan Hovold <jhovold@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/96f169c406101ce9a90c3e534652610bfc46bf67"},{"sha":"98e74212146e2191a9e6edb673b35389fd8f6aed","author":{"email":"6a430eed381e126d51a8cce8db662f765ce314bc@gmail.com","name":"Johan Hovold"},"message":"USB: io_ti: fix firmware download on big-endian machines (part 2)\n\ncommit c03890ff5e24a4bf59059f2d179f427559b7330a upstream.\n\nA recent patch that purported to fix firmware download on big-endian\nmachines failed to add the corresponding sparse annotation to the\ni2c-header. This was reported by the kbuild test robot.\n\nAdding the appropriate annotation revealed another endianess bug related\nto the i2c-header Size-field in a code path that is exercised when the\nfirmware is actually being downloaded (and not just verified and left\nuntouched unless older than the firmware at hand).\n\nThis patch adds the required sparse annotation to the i2c-header and\nmakes sure that the Size-field is sent in little-endian byte order\nduring firmware download also on big-endian machines.\n\nNote that this patch is only compile-tested, but that there is no\nfunctional change for little-endian systems.\n\nReported-by: kbuild test robot <fengguang.wu@intel.com>\nCc: Ludovic Drolez <ldrolez@debian.org>\nSigned-off-by: Johan Hovold <jhovold@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/98e74212146e2191a9e6edb673b35389fd8f6aed"},{"sha":"7da536df5fb077e03b8882b586f274409c459861","author":{"email":"75ea6bb7bfc1186f92d26164de5f9268c9a45b59@rowland.harvard.edu","name":"Alan Stern"},"message":"USB: Avoid runtime suspend loops for HCDs that can't handle suspend/resume\n\ncommit 8ef42ddd9a53b73e6fc3934278710c27f80f324f upstream.\n\nNot all host controller drivers have bus-suspend and bus-resume\nmethods.  When one doesn't, it will cause problems if runtime PM is\nenabled in the kernel.  The PM core will attempt to suspend the\ncontroller's root hub, the suspend will fail because there is no\nbus-suspend routine, and a -EBUSY error code will be returned to the\nPM core.  This will cause the suspend attempt to be repeated shortly\nthereafter, in a never-ending loop.\n\nPart of the problem is that the original error code -ENOENT gets\nchanged to -EBUSY in usb_runtime_suspend(), on the grounds that the PM\ncore will interpret -ENOENT as meaning that the root hub has gotten\ninto a runtime-PM error state.  While this change is appropriate for\nreal USB devices, it's not such a good idea for a root hub.  In fact,\nconsidering the root hub to be in a runtime-PM error state would not\nbe far from the truth.  Therefore this patch updates\nusb_runtime_suspend() so that it adjusts error codes only for\nnon-root-hub devices.\n\nFurthermore, the patch attempts to prevent the problem from occurring\nin the first place by not enabling runtime PM by default for root hubs\nwhose host controller driver doesn't have bus_suspend and bus_resume\nmethods.\n\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-by: Will Deacon <will.deacon@arm.com>\nTested-by: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/7da536df5fb077e03b8882b586f274409c459861"},{"sha":"653b6fe704e344fe48162a23b60657db1ac84233","author":{"email":"d7a2c23eccda99639e3fab64d868a1b1895748fa@samsung.com","name":"Andrey Ryabinin"},"message":"mm: rmap: fix use-after-free in __put_anon_vma\n\ncommit 624483f3ea82598ab0f62f1bdb9177f531ab1892 upstream.\n\nWhile working address sanitizer for kernel I've discovered\nuse-after-free bug in __put_anon_vma.\n\nFor the last anon_vma, anon_vma->root freed before child anon_vma.\nLater in anon_vma_free(anon_vma) we are referencing to already freed\nanon_vma->root to check rwsem.\n\nThis fixes it by freeing the child anon_vma before freeing\nanon_vma->root.\n\nSigned-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>\nAcked-by: Peter Zijlstra <peterz@infradead.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/653b6fe704e344fe48162a23b60657db1ac84233"},{"sha":"ade988a989901a1527c6809aeea0ca3b8639af46","author":{"email":"628991c7b0a19c384f9b99c21ec330ce952bb838@intel.com","name":"Johan Hedberg"},"message":"Bluetooth: Fix missing length checks for L2CAP signalling PDUs\n\ncommit cb3b3152b2f5939d67005cff841a1ca748b19888 upstream.\n\nThere has been code in place to check that the L2CAP length header\nmatches the amount of data received, but many PDU handlers have not been\nchecking that the data received actually matches that expected by the\nspecific PDU. This patch adds passing the length header to the specific\nhandler functions and ensures that those functions fail cleanly in the\ncase of an incorrect amount of data.\n\nSigned-off-by: Johan Hedberg <johan.hedberg@intel.com>\nSigned-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>\nSigned-off-by: John W. Linville <linville@tuxdriver.com>\n[bwh: Backported to 3.2:\n - Adjust context\n - Move uses of *req below the new check in l2cap_connect_req]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\n[wujg: Backported to 3.4:\n - Adjust context\n - Adjust l2cap_create_channel_rsp()'s parameters]\nSigned-off-by: Jianguo Wu <wujianguo@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/ade988a989901a1527c6809aeea0ca3b8639af46"},{"sha":"6ec88fcb4aa2c33fe2fe2a23c576a7e2581c5c3d","author":{"email":"30332fd25d3ce7df9272a73e48e6c1da3b118d5a@samsung.com","name":"Jaganath Kanakkassery"},"message":"Bluetooth: Fix invalid length check in l2cap_information_rsp()\n\ncommit 3f6fa3d489e127ca5a5b298eabac3ff5dbe0e112 upstream.\n\nThe length check is invalid since the length varies with type of\ninfo response.\n\nThis was introduced by the commit cb3b3152b2f5939d67005cff841a1ca748b19888\n\nBecause of this, l2cap info rsp is not handled and command reject is sent.\n\n> ACL data: handle 11 flags 0x02 dlen 16\n        L2CAP(s): Info rsp: type 2 result 0\n          Extended feature mask 0x00b8\n            Enhanced Retransmission mode\n            Streaming mode\n            FCS Option\n            Fixed Channels\n< ACL data: handle 11 flags 0x00 dlen 10\n        L2CAP(s): Command rej: reason 0\n          Command not understood\n\nCc: stable@vger.kernel.org\nSigned-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>\nSigned-off-by: Chan-Yeol Park <chanyeol.park@samsung.com>\nAcked-by: Johan Hedberg <johan.hedberg@intel.com>\nSigned-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>\nCc: Jianguo Wu <wujianguo@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/6ec88fcb4aa2c33fe2fe2a23c576a7e2581c5c3d"},{"sha":"7f801fcbd4bc022d58e39a1cd7f6e84933359d19","author":{"email":"f40600653b33f5282fa4c5daf377dfc444fb4625@denx.de","name":"Marek Vasut"},"message":"Bluetooth: Support AR3011 in Acer Iconia Tab W500\n\ncommit 6eda541d12116b4772baa09d3e8d7b0389df4289 upstream.\n\nAcer used this chip connected via USB:\n\nBus 005 Device 005: ID 0cf3:3005 Atheros Communications, Inc. AR3011 Bluetooth\nDevice Descriptor:\n  bLength                18\n  bDescriptorType         1\n  bcdUSB               1.10\n  bDeviceClass          224 Wireless\n  bDeviceSubClass         1 Radio Frequency\n  bDeviceProtocol         1 Bluetooth\n  bMaxPacketSize0        64\n  idVendor           0x0cf3 Atheros Communications, Inc.\n  idProduct          0x3005 AR3011 Bluetooth\n  bcdDevice            0.01\n  iManufacturer           0\n  iProduct                0\n  iSerial                 0\n  bNumConfigurations      1\n\nSigned-off-by: Marek Vasut <marex@denx.de>\nCc: Gustavo Padovan <gustavo@padovan.org>\nCc: Johan Hedberg <johan.hedberg@gmail.com>\nCc: Marcel Holtmann <marcel@holtmann.org>\nSigned-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nCc: Jianguo Wu <wujianguo@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Alberto97/android_kernel_motorola_msm8226/commits/7f801fcbd4bc022d58e39a1cd7f6e84933359d19"}]}