{"push_id":546917293,"size":1000,"distinct_size":1088,"ref":"refs/heads/cm-11.0","head":"bd3720300fcab27c18f6cd4ebf0aff8ca08f955b","before":"ac519f2e5aee5ca6338687169126fe915b341081","commits":[{"sha":"af720fc6ae76ea10216ede42b48ee0550d65e36f","author":{"email":"643a80aaf16a8332d6a70921c14d4bb265446494@intel.com","name":"Emmanuel Grumbach"},"message":"iwlwifi: don't handle masked interrupt\n\ncommit 25a172655f837bdb032e451f95441bb4acec51bb upstream.\n\nThis can lead to a panic if the driver isn't ready to\nhandle them. Since our interrupt line is shared, we can get\nan interrupt at any time (and CONFIG_DEBUG_SHIRQ checks\nthat even when the interrupt is being freed).\n\nIf the op_mode has gone away, we musn't call it. To avoid\nthis the transport disables the interrupts when the hw is\nstopped and the op_mode is leaving.\nIf there is an event that would cause an interrupt the INTA\nregister is updated regardless of the enablement of the\ninterrupts: even if the interrupts are disabled, the INTA\nwill be changed, but the device won't issue an interrupt.\nBut the ISR can be called at any time, so we ought ignore\nthe value in the INTA otherwise we can call the op_mode\nafter it was freed.\n\nI found this bug when the op_mode_start failed, and called\niwl_trans_stop_hw(trans, true). Then I played with the\nRFKILL button, and removed the module.\nWhile removing the module, the IRQ is freed, and the ISR is\ncalled (CONFIG_DEBUG_SHIRQ enabled). Panic.\n\nSigned-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>\nReviewed-by: Gregory Greenman <gregory.greenman@intel.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\n[bwh: Backported to 3.2:\n - Adjust context\n - Pass bus(trans), not trans, to iwl_{read,write}32()]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\n[wujg: Backported to 3.4:\n - adjust context\n - Pass trans to iwl_{read,write}32()}]\nSigned-off-by: Jianguo Wu <wujianguo@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/af720fc6ae76ea10216ede42b48ee0550d65e36f"},{"sha":"f2da4cebeffec9908b92ecb131b1108c3ef43769","author":{"email":"bff32994ff0f8d048f262a8388145a71b6071bfe@intel.com","name":"Johannes Berg"},"message":"iwlwifi: handle DMA mapping failures\n\ncommit 7c34158231b2eda8dcbd297be2bb1559e69cb433 upstream.\n\nThe RX replenish code doesn't handle DMA mapping failures,\nwhich will cause issues if there actually is a failure. This\nwas reported by Shuah Khan who found a DMA mapping framework\nwarning (\"device driver failed to check map error\").\n\nReported-by: Shuah Khan <shuah.khan@hp.com>\nReviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\n[bwh: Backported to 3.2:\n - Adjust filename, context, indentation\n - Use bus(trans) instead of trans where necessary\n - Use hw_params(trans).rx_page_order instead of trans_pcie->rx_page_order]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\n[wujg: Backported to 3.4:\n - Adjust context\n - Use trans instead of bus(trans)\n - Use hw_params(trans).rx_page_order instead of trans_pcie->rx_page_order]\nSigned-off-by: Jianguo Wu <wujianguo@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/f2da4cebeffec9908b92ecb131b1108c3ef43769"},{"sha":"a41adefcefde57643b4fdf4696385e829fd265e3","author":{"email":"bff32994ff0f8d048f262a8388145a71b6071bfe@intel.com","name":"Johannes Berg"},"message":"iwlwifi: always copy first 16 bytes of commands\n\ncommit 8a964f44e01ad3bbc208c3e80d931ba91b9ea786 upstream.\n\nThe FH hardware will always write back to the scratch field\nin commands, even host commands not just TX commands, which\ncan overwrite parts of the command. This is problematic if\nthe command is re-used (with IWL_HCMD_DFL_NOCOPY) and can\ncause calibration issues.\n\nAddress this problem by always putting at least the first\n16 bytes into the buffer we also use for the command header\nand therefore make the DMA engine write back into this.\n\nFor commands that are smaller than 16 bytes also always map\nenough memory for the DMA engine to write back to.\n\nReviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\n[bwh: Backported to 3.2:\n - Adjust context\n - Drop the IWL_HCMD_DFL_DUP handling\n - Fix descriptor addresses and lengths for tracepoint, but otherwise\n   leave it unchanged]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\n[wujg: Backported to 3.4: adjust context]\nSigned-off-by: Jianguo Wu <wujianguo@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/a41adefcefde57643b4fdf4696385e829fd265e3"},{"sha":"b38b29d58fe03950b2ccd5eaa9af2acb3c1f084d","author":{"email":"bff32994ff0f8d048f262a8388145a71b6071bfe@intel.com","name":"Johannes Berg"},"message":"iwlwifi: dvm: don't send BT_CONFIG on devices w/o Bluetooth\n\ncommit 707aee401d2467baa785a697f40a6e2d9ee79ad5 upstream.\n\nThe BT_CONFIG command that is sent to the device during\nstartup will enable BT coex unless the module parameter\nturns it off, but on devices without Bluetooth this may\ncause problems, as reported in Redhat BZ 885407.\n\nFix this by sending the BT_CONFIG command only when the\ndevice has Bluetooth.\n\nReviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>\nSigned-off-by: Johannes Berg <johannes@sipsolutions.net>\n[bwh: Backported to 3.2:\n - Adjust filename\n - s/priv->lib/priv->cfg/]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\n[wujg: Backported to 3.4:\n - s/priv->cfg/priv->shrd->cfg/]\nSigned-off-by: Jianguo Wu <wujianguo@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/b38b29d58fe03950b2ccd5eaa9af2acb3c1f084d"},{"sha":"60e691100e48fea19bf35b28aa886ec12c892bab","author":{"email":"1542dc81552e668e197a396f69e655c1621c300d@redhat.com","name":"Stanislaw Gruszka"},"message":"iwlwifi: dvm: fix calling ieee80211_chswitch_done() with NULL\n\ncommit 9186a1fd9ed190739423db84bc344d258ef3e3d7 upstream.\n\nIf channel switch is pending and we remove interface we can\ncrash like showed below due to passing NULL vif to mac80211:\n\nBUG: unable to handle kernel paging request at fffffffffffff8cc\nIP: [<ffffffff8130924d>] strnlen+0xd/0x40\nCall Trace:\n [<ffffffff8130ad2e>] string.isra.3+0x3e/0xd0\n [<ffffffff8130bf99>] vsnprintf+0x219/0x640\n [<ffffffff8130c481>] vscnprintf+0x11/0x30\n [<ffffffff81061585>] vprintk_emit+0x115/0x4f0\n [<ffffffff81657bd5>] printk+0x61/0x63\n [<ffffffffa048987f>] ieee80211_chswitch_done+0xaf/0xd0 [mac80211]\n [<ffffffffa04e7b34>] iwl_chswitch_done+0x34/0x40 [iwldvm]\n [<ffffffffa04f83c3>] iwlagn_commit_rxon+0x2a3/0xdc0 [iwldvm]\n [<ffffffffa04ebc50>] ? iwlagn_set_rxon_chain+0x180/0x2c0 [iwldvm]\n [<ffffffffa04e5e76>] iwl_set_mode+0x36/0x40 [iwldvm]\n [<ffffffffa04e5f0d>] iwlagn_mac_remove_interface+0x8d/0x1b0 [iwldvm]\n [<ffffffffa0459b3d>] ieee80211_do_stop+0x29d/0x7f0 [mac80211]\n\nThis is because we nulify ctx->vif in iwlagn_mac_remove_interface()\nbefore calling some other functions that teardown interface. To fix\njust check ctx->vif on iwl_chswitch_done(). We should not call\nieee80211_chswitch_done() as channel switch works were already canceled\nby mac80211 in ieee80211_do_stop() -> ieee80211_mgd_stop().\n\nResolve:\nhttps://bugzilla.redhat.com/show_bug.cgi?id=979581\n\nReported-by: Lukasz Jagiello <jagiello.lukasz@gmail.com>\nSigned-off-by: Stanislaw Gruszka <sgruszka@redhat.com>\nReviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\n[bwh: Backported to 3.2: adjust context, filename]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\n[wujg: Backported to 3.4: - adjust context]\nSigned-off-by: Jianguo Wu <wujianguo@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/60e691100e48fea19bf35b28aa886ec12c892bab"},{"sha":"e87845b7d048925658199c863fe22b03e01e0438","author":{"email":"643a80aaf16a8332d6a70921c14d4bb265446494@intel.com","name":"Emmanuel Grumbach"},"message":"iwlwifi: pcie: add SKUs for 6000, 6005 and 6235 series\n\ncommit 08a5dd3842f2ac61c6d69661d2d96022df8ae359 upstream.\n\nAdd some new PCI IDs to the table for 6000, 6005 and 6235 series.\n\nSigned-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\n[bwh: Backported to 3.2:\n - Adjust filenames\n - Drop const from struct iwl_cfg]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\n[wujg: Backported to 3.4:\n - Adjust context\n - Do not drop const from struct iwl_cfg]\nSigned-off-by: Jianguo Wu <wujianguo@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/e87845b7d048925658199c863fe22b03e01e0438"},{"sha":"172ba81925a7f8fbec3c0f4146c28f223829e005","author":{"email":"843eb11336b6e35bd55f1d23652fb443c71c9ae4@ilande.co.uk","name":"Mark Cave-Ayland"},"message":"rtlwifi: Fix endian error in extracting packet type\n\ncommit 0c5d63f0ab6728f05ddefa25aff55e31297f95e6 upstream.\n\nAll of the rtlwifi drivers have an error in the routine that tests if\nthe data is \"special\". If it is, the subsequant transmission will be\nat the lowest rate to enhance reliability. The 16-bit quantity is\nbig-endian, but was being extracted in native CPU mode. One of the\neffects of this bug is to inhibit association under some conditions\nas the TX rate is too high.\n\nBased on suggestions by Joe Perches, the entire routine is rewritten.\n\nOne of the local headers contained duplicates of some of the ETH_P_XXX\ndefinitions. These are deleted.\n\nSigned-off-by: Larry Finger <Larry.Finger@lwfinger.net>\nCc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>\nSigned-off-by: John W. Linville <linville@tuxdriver.com>\n[wujg: Backported to 3.4:\n - adjust context\n - remove rtlpriv->enter_ps = false\n - use schedule_work(&rtlpriv->works.lps_leave_work)]\nSigned-off-by: Jianguo Wu <wujianguo@huawei.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/172ba81925a7f8fbec3c0f4146c28f223829e005"},{"sha":"20d700bc51e717c502e51c3fb857b03ba8f99f34","author":{"email":"34c6fceca75e456f25e7e99531e2425c6c1de443@lynxeye.de","name":"Lucas Stach"},"message":"net: asix: handle packets crossing URB boundaries\n\ncommit 8b5b6f5413e97c3e8bafcdd67553d508f4f698cd upstream.\n\nASIX AX88772B started to pack data even more tightly. Packets and the ASIX packet\nheader may now cross URB boundaries. To handle this we have to introduce\nsome state between individual calls to asix_rx_fixup().\n\nSigned-off-by: Lucas Stach <dev@lynxeye.de>\nSigned-off-by: David S. Miller <davem@davemloft.net>\n[ Emil: backported to 3.4: dropped changes to drivers/net/usb/ax88172a.c ]\nSigned-off-by: Emil Goode <emilgoode@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/20d700bc51e717c502e51c3fb857b03ba8f99f34"},{"sha":"176485d0f36455db28edec5ab6581842c8d17203","author":{"email":"8f82f727ceef69ddbc9c99a3e77927715fed00fe@gmail.com","name":"Emil Goode"},"message":"net: asix: add missing flag to struct driver_info\n\ncommit d43ff4cd798911736fb39025ec8004284b1b0bc2 upstream.\n\nThe struct driver_info ax88178_info is assigned the function\nasix_rx_fixup_common as it's rx_fixup callback. This means that\nFLAG_MULTI_PACKET must be set as this function is cloning the\ndata and calling usbnet_skb_return. Not setting this flag leads\nto usbnet_skb_return beeing called a second time from within\nthe rx_process function in the usbnet module.\n\nSigned-off-by: Emil Goode <emilgoode@gmail.com>\nReported-by: Bjørn Mork <bjorn@mork.no>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/176485d0f36455db28edec5ab6581842c8d17203"},{"sha":"0c4f5371eb6b0566db53eb2437af2bbfc183e566","author":{"email":"4645f7897fd33786a2ee1264d590b3c400559d85@linuxfoundation.org","name":"Greg Kroah-Hartman"},"message":"Linux 3.4.83","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/0c4f5371eb6b0566db53eb2437af2bbfc183e566"},{"sha":"e7f76c836ca734a861b57aed10eb78b30c3a71c7","author":{"email":"596727c8a0ea4db3ba2ceceedccbacd3d7b371b8@suse.cz","name":"Jan Kara"},"message":"ocfs2: fix quota file corruption\n\ncommit 15c34a760630ca2c803848fba90ca0646a9907dd upstream.\n\nGlobal quota files are accessed from different nodes.  Thus we cannot\ncache offset of quota structure in the quota file after we drop our node\nreference count to it because after that moment quota structure may be\nfreed and reallocated elsewhere by a different node resulting in\ncorruption of quota file.\n\nFix the problem by clearing dq_off when we are releasing dquot structure.\nWe also remove the DB_READ_B handling because it is useless -\nDQ_ACTIVE_B is set iff DQ_READ_B is set.\n\nSigned-off-by: Jan Kara <jack@suse.cz>\nCc: Goldwyn Rodrigues <rgoldwyn@suse.de>\nCc: Joel Becker <jlbec@evilplan.org>\nReviewed-by: Mark Fasheh <mfasheh@suse.de>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/e7f76c836ca734a861b57aed10eb78b30c3a71c7"},{"sha":"efcb9185af1155146326a850aaa6617a5bb55172","author":{"email":"de609eb4d5d70b1d38ec6642adbfc33a2781f63c@zeniv.linux.org.uk","name":"Al Viro"},"message":"ocfs2 syncs the wrong range...\n\ncommit 1b56e98990bcdbb20b9fab163654b9315bf158e8 upstream.\n\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/efcb9185af1155146326a850aaa6617a5bb55172"},{"sha":"6ba4d1d9112b3f6bf0f634870bb950b5b59fa86f","author":{"email":"2dd0a47882f0f6e80e10cdc66eeecff982de281e@gmail.com","name":"George McCollister"},"message":"sched: Fix double normalization of vruntime\n\ncommit 791c9e0292671a3bfa95286bb5c08129d8605618 upstream.\n\ndequeue_entity() is called when p->on_rq and sets se->on_rq = 0\nwhich appears to guarentee that the !se->on_rq condition is met.\nIf the task has done set_current_state(TASK_INTERRUPTIBLE) without\nschedule() the second condition will be met and vruntime will be\nincorrectly adjusted twice.\n\nIn certain cases this can result in the task's vruntime never increasing\npast the vruntime of other tasks on the CFS' run queue, starving them of\nCPU time.\n\nThis patch changes switched_from_fair() to use !p->on_rq instead of\n!se->on_rq.\n\nI'm able to cause a task with a priority of 120 to starve all other\ntasks with the same priority on an ARM platform running 3.2.51-rt72\nPREEMPT RT by writing one character at time to a serial tty (16550 UART)\nin a tight loop. I'm also able to verify making this change corrects the\nproblem on that platform and kernel version.\n\nSigned-off-by: George McCollister <george.mccollister@gmail.com>\nSigned-off-by: Peter Zijlstra <peterz@infradead.org>\nLink: http://lkml.kernel.org/r/1392767811-28916-1-git-send-email-george.mccollister@gmail.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/6ba4d1d9112b3f6bf0f634870bb950b5b59fa86f"},{"sha":"73c64222444db00a7f3b3cf933f76f2a2a866fb6","author":{"email":"808efd45667dbd241e4e026b5673172419ecb43e@redhat.com","name":"Jason Wang"},"message":"virtio-net: alloc big buffers also when guest can receive UFO\n\n[ Upstream commit 0e7ede80d929ff0f830c44a543daa1acd590c749 ]\n\nWe should alloc big buffers also when guest can receive UFO\npackets to let the big packets fit into guest rx buffer.\n\nFixes 5c5167515d80f78f6bb538492c423adcae31ad65\n(virtio-net: Allow UFO feature to be set and advertised.)\n\nCc: Rusty Russell <rusty@rustcorp.com.au>\nCc: Michael S. Tsirkin <mst@redhat.com>\nCc: Sridhar Samudrala <sri@us.ibm.com>\nSigned-off-by: Jason Wang <jasowang@redhat.com>\nAcked-by: Michael S. Tsirkin <mst@redhat.com>\nAcked-by: Rusty Russell <rusty@rustcorp.com.au>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/73c64222444db00a7f3b3cf933f76f2a2a866fb6"},{"sha":"fc8927f2d373d522e85ca497e9f6755f564b42ce","author":{"email":"6b52f9d672b6134057900fe608467612b789a84e@broadcom.com","name":"Michael Chan"},"message":"tg3: Don't check undefined error bits in RXBD\n\n[ Upstream commit d7b95315cc7f441418845a165ee56df723941487 ]\n\nRedefine the RXD_ERR_MASK to include only relevant error bits. This fixes\na customer reported issue of randomly dropping packets on the 5719.\n\nSigned-off-by: Michael Chan <mchan@broadcom.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/fc8927f2d373d522e85ca497e9f6755f564b42ce"},{"sha":"18684dfb8483c9bbd3cc4ecefc1d9784d8158608","author":{"email":"9ff04a02a69f376b2b9aeec27187017cbf3cf5f9@redhat.com","name":"Daniel Borkmann"},"message":"net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer is AUTH capable\n\n[ Upstream commit ec0223ec48a90cb605244b45f7c62de856403729 ]\n\nRFC4895 introduced AUTH chunks for SCTP; during the SCTP\nhandshake RANDOM; CHUNKS; HMAC-ALGO are negotiated (CHUNKS\nbeing optional though):\n\n  ---------- INIT[RANDOM; CHUNKS; HMAC-ALGO] ---------->\n  <------- INIT-ACK[RANDOM; CHUNKS; HMAC-ALGO] ---------\n  -------------------- COOKIE-ECHO -------------------->\n  <-------------------- COOKIE-ACK ---------------------\n\nA special case is when an endpoint requires COOKIE-ECHO\nchunks to be authenticated:\n\n  ---------- INIT[RANDOM; CHUNKS; HMAC-ALGO] ---------->\n  <------- INIT-ACK[RANDOM; CHUNKS; HMAC-ALGO] ---------\n  ------------------ AUTH; COOKIE-ECHO ---------------->\n  <-------------------- COOKIE-ACK ---------------------\n\nRFC4895, section 6.3. Receiving Authenticated Chunks says:\n\n  The receiver MUST use the HMAC algorithm indicated in\n  the HMAC Identifier field. If this algorithm was not\n  specified by the receiver in the HMAC-ALGO parameter in\n  the INIT or INIT-ACK chunk during association setup, the\n  AUTH chunk and all the chunks after it MUST be discarded\n  and an ERROR chunk SHOULD be sent with the error cause\n  defined in Section 4.1. [...] If no endpoint pair shared\n  key has been configured for that Shared Key Identifier,\n  all authenticated chunks MUST be silently discarded. [...]\n\n  When an endpoint requires COOKIE-ECHO chunks to be\n  authenticated, some special procedures have to be followed\n  because the reception of a COOKIE-ECHO chunk might result\n  in the creation of an SCTP association. If a packet arrives\n  containing an AUTH chunk as a first chunk, a COOKIE-ECHO\n  chunk as the second chunk, and possibly more chunks after\n  them, and the receiver does not have an STCB for that\n  packet, then authentication is based on the contents of\n  the COOKIE-ECHO chunk. In this situation, the receiver MUST\n  authenticate the chunks in the packet by using the RANDOM\n  parameters, CHUNKS parameters and HMAC_ALGO parameters\n  obtained from the COOKIE-ECHO chunk, and possibly a local\n  shared secret as inputs to the authentication procedure\n  specified in Section 6.3. If authentication fails, then\n  the packet is discarded. If the authentication is successful,\n  the COOKIE-ECHO and all the chunks after the COOKIE-ECHO\n  MUST be processed. If the receiver has an STCB, it MUST\n  process the AUTH chunk as described above using the STCB\n  from the existing association to authenticate the\n  COOKIE-ECHO chunk and all the chunks after it. [...]\n\nCommit bbd0d59809f9 introduced the possibility to receive\nand verification of AUTH chunk, including the edge case for\nauthenticated COOKIE-ECHO. On reception of COOKIE-ECHO,\nthe function sctp_sf_do_5_1D_ce() handles processing,\nunpacks and creates a new association if it passed sanity\nchecks and also tests for authentication chunks being\npresent. After a new association has been processed, it\ninvokes sctp_process_init() on the new association and\nwalks through the parameter list it received from the INIT\nchunk. It checks SCTP_PARAM_RANDOM, SCTP_PARAM_HMAC_ALGO\nand SCTP_PARAM_CHUNKS, and copies them into asoc->peer\nmeta data (peer_random, peer_hmacs, peer_chunks) in case\nsysctl -w net.sctp.auth_enable=1 is set. If in INIT's\nSCTP_PARAM_SUPPORTED_EXT parameter SCTP_CID_AUTH is set,\npeer_random != NULL and peer_hmacs != NULL the peer is to be\nassumed asoc->peer.auth_capable=1, in any other case\nasoc->peer.auth_capable=0.\n\nNow, if in sctp_sf_do_5_1D_ce() chunk->auth_chunk is\navailable, we set up a fake auth chunk and pass that on to\nsctp_sf_authenticate(), which at latest in\nsctp_auth_calculate_hmac() reliably dereferences a NULL pointer\nat position 0..0008 when setting up the crypto key in\ncrypto_hash_setkey() by using asoc->asoc_shared_key that is\nNULL as condition key_id == asoc->active_key_id is true if\nthe AUTH chunk was injected correctly from remote. This\nhappens no matter what net.sctp.auth_enable sysctl says.\n\nThe fix is to check for net->sctp.auth_enable and for\nasoc->peer.auth_capable before doing any operations like\nsctp_sf_authenticate() as no key is activated in\nsctp_auth_asoc_init_active_key() for each case.\n\nNow as RFC4895 section 6.3 states that if the used HMAC-ALGO\npassed from the INIT chunk was not used in the AUTH chunk, we\nSHOULD send an error; however in this case it would be better\nto just silently discard such a maliciously prepared handshake\nas we didn't even receive a parameter at all. Also, as our\nendpoint has no shared key configured, section 6.3 says that\nMUST silently discard, which we are doing from now onwards.\n\nBefore calling sctp_sf_pdiscard(), we need not only to free\nthe association, but also the chunk->auth_chunk skb, as\ncommit bbd0d59809f9 created a skb clone in that case.\n\nI have tested this locally by using netfilter's nfqueue and\nre-injecting packets into the local stack after maliciously\nmodifying the INIT chunk (removing RANDOM; HMAC-ALGO param)\nand the SCTP packet containing the COOKIE_ECHO (injecting\nAUTH chunk before COOKIE_ECHO). Fixed with this patch applied.\n\nFixes: bbd0d59809f9 (\"[SCTP]: Implement the receive and verification of AUTH chunk\")\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nCc: Vlad Yasevich <yasevich@gmail.com>\nCc: Neil Horman <nhorman@tuxdriver.com>\nAcked-by: Vlad Yasevich <vyasevich@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/18684dfb8483c9bbd3cc4ecefc1d9784d8158608"},{"sha":"46a5a5493360f995b834eb3b828eb59da4604509","author":{"email":"643a80aaf16a8332d6a70921c14d4bb265446494@intel.com","name":"Emmanuel Grumbach"},"message":"mac80211: fix AP powersave TX vs. wakeup race\n\ncommit 1d147bfa64293b2723c4fec50922168658e613ba upstream.\n\nThere is a race between the TX path and the STA wakeup: while\na station is sleeping, mac80211 buffers frames until it wakes\nup, then the frames are transmitted. However, the RX and TX\npath are concurrent, so the packet indicating wakeup can be\nprocessed while a packet is being transmitted.\n\nThis can lead to a situation where the buffered frames list\nis emptied on the one side, while a frame is being added on\nthe other side, as the station is still seen as sleeping in\nthe TX path.\n\nAs a result, the newly added frame will not be send anytime\nsoon. It might be sent much later (and out of order) when the\nstation goes to sleep and wakes up the next time.\n\nAdditionally, it can lead to the crash below.\n\nFix all this by synchronising both paths with a new lock.\nBoth path are not fastpath since they handle PS situations.\n\nIn a later patch we'll remove the extra skb queue locks to\nreduce locking overhead.\n\nBUG: unable to handle kernel\nNULL pointer dereference at 000000b0\nIP: [<ff6f1791>] ieee80211_report_used_skb+0x11/0x3e0 [mac80211]\n*pde = 00000000\nOops: 0000 [#1] SMP DEBUG_PAGEALLOC\nEIP: 0060:[<ff6f1791>] EFLAGS: 00210282 CPU: 1\nEIP is at ieee80211_report_used_skb+0x11/0x3e0 [mac80211]\nEAX: e5900da0 EBX: 00000000 ECX: 00000001 EDX: 00000000\nESI: e41d00c0 EDI: e5900da0 EBP: ebe458e4 ESP: ebe458b0\n DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068\nCR0: 8005003b CR2: 000000b0 CR3: 25a78000 CR4: 000407d0\nDR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000\nDR6: ffff0ff0 DR7: 00000400\nProcess iperf (pid: 3934, ti=ebe44000 task=e757c0b0 task.ti=ebe44000)\niwlwifi 0000:02:00.0: I iwl_pcie_enqueue_hcmd Sending command LQ_CMD (#4e), seq: 0x0903, 92 bytes at 3[3]:9\nStack:\n e403b32c ebe458c4 00200002 00200286 e403b338 ebe458cc c10960bb e5900da0\n ff76a6ec ebe458d8 00000000 e41d00c0 e5900da0 ebe458f0 ff6f1b75 e403b210\n ebe4598c ff723dc1 00000000 ff76a6ec e597c978 e403b758 00000002 00000002\nCall Trace:\n [<ff6f1b75>] ieee80211_free_txskb+0x15/0x20 [mac80211]\n [<ff723dc1>] invoke_tx_handlers+0x1661/0x1780 [mac80211]\n [<ff7248a5>] ieee80211_tx+0x75/0x100 [mac80211]\n [<ff7249bf>] ieee80211_xmit+0x8f/0xc0 [mac80211]\n [<ff72550e>] ieee80211_subif_start_xmit+0x4fe/0xe20 [mac80211]\n [<c149ef70>] dev_hard_start_xmit+0x450/0x950\n [<c14b9aa9>] sch_direct_xmit+0xa9/0x250\n [<c14b9c9b>] __qdisc_run+0x4b/0x150\n [<c149f732>] dev_queue_xmit+0x2c2/0xca0\n\nReported-by: Yaara Rozenblum <yaara.rozenblum@intel.com>\nSigned-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>\nReviewed-by: Stanislaw Gruszka <sgruszka@redhat.com>\n[reword commit log, use a separate lock]\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/46a5a5493360f995b834eb3b828eb59da4604509"},{"sha":"8509583a3094c4dfc1448e0b2fbadfb5b436378f","author":{"email":"1240f8b9a8d4f8f6d54c4d059a9fef2470495ad4@qca.qualcomm.com","name":"Sujith Manoharan"},"message":"ath9k: Fix ETSI compliance for AR9462 2.0\n\ncommit b3050248c167871ca52cfdb2ce78aa2460249346 upstream.\n\nThe minimum CCA power threshold values have to be adjusted\nfor existing cards to be in compliance with new regulations.\nNewer cards will make use of the values obtained from EEPROM,\nsupport for this was added earlier. To make sure that cards\nthat are already in use and don't have proper values in EEPROM,\ndo not violate regulations, use the initvals instead.\n\nReported-by: Jeang Daniel <dyjeong@qca.qualcomm.com>\nSigned-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>\nSigned-off-by: John W. Linville <linville@tuxdriver.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/8509583a3094c4dfc1448e0b2fbadfb5b436378f"},{"sha":"c7fc368e0c6b01aef43d00fcfd59159f0acdf0cd","author":{"email":"7343c7ffb424bf4c3ebd1cd0c94117b3c12118ff@marvell.com","name":"Amitkumar Karwar"},"message":"mwifiex: copy AP's HT capability info correctly\n\ncommit c99b1861c232e1f641f13b8645e0febb3712cc71 upstream.\n\nWhile preparing association request, intersection of device's HT\ncapability information and corresponding fields advertised by AP\nis used.\n\nThis patch fixes an error while copying this field from AP's\nbeacon.\n\nSigned-off-by: Amitkumar Karwar <akarwar@marvell.com>\nSigned-off-by: Bing Zhao <bzhao@marvell.com>\nSigned-off-by: John W. Linville <linville@tuxdriver.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/c7fc368e0c6b01aef43d00fcfd59159f0acdf0cd"},{"sha":"cf828d9fed64eda7a0b3aefd90d1eb2fada2b544","author":{"email":"cd5a0f7f4b4ca57459752912ff2c1e5688a9582a@redhat.com","name":"Rob Clark"},"message":"drm/ttm: don't oops if no invalidate_caches()\n\ncommit 9ef7506f7eff3fc42724269f62e30164c141661f upstream.\n\nA few of the simpler TTM drivers (cirrus, ast, mgag200) do not implement\nthis function.  Yet can end up somehow with an evicted bo:\n\n  BUG: unable to handle kernel NULL pointer dereference at           (null)\n  IP: [<          (null)>]           (null)\n  PGD 16e761067 PUD 16e6cf067 PMD 0\n  Oops: 0010 [#1] SMP\n  Modules linked in: bnep bluetooth rfkill fuse ip6t_rpfilter ip6t_REJECT ipt_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw iptable_filter ip_tables sg btrfs zlib_deflate raid6_pq xor dm_queue_length iTCO_wdt iTCO_vendor_support coretemp kvm dcdbas dm_service_time microcode serio_raw pcspkr lpc_ich mfd_core i7core_edac edac_core ses enclosure ipmi_si ipmi_msghandler shpchp acpi_power_meter mperf nfsd auth_rpcgss nfs_acl lockd uinput sunrpc dm_multipath xfs libcrc32c ata_generic pata_acpi sr_mod cdrom\n   sd_mod usb_storage mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit lpfc drm_kms_helper ttm crc32c_intel ata_piix bfa drm ixgbe libata i2c_core mdio crc_t10dif ptp crct10dif_common pps_core scsi_transport_fc dca scsi_tgt megaraid_sas bnx2 dm_mirror dm_region_hash dm_log dm_mod\n  CPU: 16 PID: 2572 Comm: X Not tainted 3.10.0-86.el7.x86_64 #1\n  Hardware name: Dell Inc. PowerEdge R810/0H235N, BIOS 0.3.0 11/14/2009\n  task: ffff8801799dabc0 ti: ffff88016c884000 task.ti: ffff88016c884000\n  RIP: 0010:[<0000000000000000>]  [<          (null)>]           (null)\n  RSP: 0018:ffff88016c885ad8  EFLAGS: 00010202\n  RAX: ffffffffa04e94c0 RBX: ffff880178937a20 RCX: 0000000000000000\n  RDX: 0000000000000000 RSI: 0000000000240004 RDI: ffff880178937a00\n  RBP: ffff88016c885b60 R08: 00000000000171a0 R09: ffff88007cf171a0\n  R10: ffffea0005842540 R11: ffffffff810487b9 R12: ffff880178937b30\n  R13: ffff880178937a00 R14: ffff88016c885b78 R15: ffff880179929400\n  FS:  00007f81ba2ef980(0000) GS:ffff88007cf00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000000000000000 CR3: 000000016e763000 CR4: 00000000000007e0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n  Stack:\n   ffffffffa0306fae ffff8801799295c0 0000000000260004 0000000000000001\n   ffff88016c885b60 ffffffffa0307669 00ff88007cf17738 ffff88017cf17700\n   ffff880178937a00 ffff880100000000 ffff880100000000 0000000079929400\n  Call Trace:\n   [<ffffffffa0306fae>] ? ttm_bo_handle_move_mem+0x54e/0x5b0 [ttm]\n   [<ffffffffa0307669>] ? ttm_bo_mem_space+0x169/0x340 [ttm]\n   [<ffffffffa0307bd7>] ttm_bo_move_buffer+0x117/0x130 [ttm]\n   [<ffffffff81130001>] ? perf_event_init_context+0x141/0x220\n   [<ffffffffa0307cb1>] ttm_bo_validate+0xc1/0x130 [ttm]\n   [<ffffffffa04e7377>] mgag200_bo_pin+0x87/0xc0 [mgag200]\n   [<ffffffffa04e56c4>] mga_crtc_cursor_set+0x474/0xbb0 [mgag200]\n   [<ffffffff811971d2>] ? __mem_cgroup_commit_charge+0x152/0x3b0\n   [<ffffffff815c4182>] ? mutex_lock+0x12/0x2f\n   [<ffffffffa0201433>] drm_mode_cursor_common+0x123/0x170 [drm]\n   [<ffffffffa0205231>] drm_mode_cursor_ioctl+0x41/0x50 [drm]\n   [<ffffffffa01f5ca2>] drm_ioctl+0x502/0x630 [drm]\n   [<ffffffff815cbab4>] ? __do_page_fault+0x1f4/0x510\n   [<ffffffff8101cb68>] ? __restore_xstate_sig+0x218/0x4f0\n   [<ffffffff811b4445>] do_vfs_ioctl+0x2e5/0x4d0\n   [<ffffffff8124488e>] ? file_has_perm+0x8e/0xa0\n   [<ffffffff811b46b1>] SyS_ioctl+0x81/0xa0\n   [<ffffffff815d05d9>] system_call_fastpath+0x16/0x1b\n  Code:  Bad RIP value.\n  RIP  [<          (null)>]           (null)\n   RSP <ffff88016c885ad8>\n  CR2: 0000000000000000\n\nSigned-off-by: Rob Clark <rclark@redhat.com>\nReviewed-by: Jérôme Glisse <jglisse@redhat.com>\nReviewed-by: Thomas Hellstrom <thellstrom@vmware.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/mikronac/android_kernel_htc_msm8960/commits/cf828d9fed64eda7a0b3aefd90d1eb2fada2b544"}]}