{"push_id":670484271,"size":5,"distinct_size":5,"ref":"refs/heads/nexus-4","head":"87ed0bab36c9f88868d4acb5a905dfbae7265fbb","before":"a005b2fbef7cf0ddf8692c7505d72fe96b66215c","commits":[{"sha":"270d37c1cba9e7dc59e462195765093b9bac5c67","author":{"email":"546b05909706652891a87f7bfe385ae147f61f91@kernel.org","name":"Tejun Heo"},"message":"idr: fix a subtle bug in idr_get_next()\n\ncommit 6cdae7416a1c45c2ce105a78187d9b7e8feb9e24 upstream.\n\nThe iteration logic of idr_get_next() is borrowed mostly verbatim from\nidr_for_each().  It walks down the tree looking for the slot matching\nthe current ID.  If the matching slot is not found, the ID is\nincremented by the distance of single slot at the given level and\nrepeats.\n\nThe implementation assumes that during the whole iteration id is aligned\nto the layer boundaries of the level closest to the leaf, which is true\nfor all iterations starting from zero or an existing element and thus is\nfine for idr_for_each().\n\nHowever, idr_get_next() may be given any point and if the starting id\nhits in the middle of a non-existent layer, increment to the next layer\nwill end up skipping the same offset into it.  For example, an IDR with\nIDs filled between [64, 127] would look like the following.\n\n          [  0  64 ... ]\n       /----/   |\n       |        |\n      NULL    [ 64 ... 127 ]\n\nIf idr_get_next() is called with 63 as the starting point, it will try\nto follow down the pointer from 0.  As it is NULL, it will then try to\nproceed to the next slot in the same level by adding the slot distance\nat that level which is 64 - making the next try 127.  It goes around the\nloop and finds and returns 127 skipping [64, 126].\n\nNote that this bug also triggers in idr_for_each_entry() loop which\ndeletes during iteration as deletions can make layers go away leaving\nthe iteration with unaligned ID into missing layers.\n\nFix it by ensuring proceeding to the next slot doesn't carry over the\nunaligned offset - ie.  use round_up(id + 1, slot_distance) instead of\nid += slot_distance.\n\nBug: 19665182\nBug: 18069309\nBug: 19236185\n\nChange-Id: Iddd4b6fb27c39d7607bc778fc00bafe6ec289478\nSigned-off-by: Tejun Heo <tj@kernel.org>\nReported-by: David Teigland <teigland@redhat.com>\nCc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/norbertc/nexus-kernel/commits/270d37c1cba9e7dc59e462195765093b9bac5c67"},{"sha":"558d16c28a7ecb4cfa98fe7401954180f76f56fb","author":{"email":"fa8048cf8a492157904bad3af5537885fbacf703@google.com","name":"Chad Jones"},"message":"Add build.config\n\nBug: 19661035,19715067\nChange-Id: I9efc9521df282b7866059c15d4b20b9219a32364","distinct":true,"url":"https://api.github.com/repos/norbertc/nexus-kernel/commits/558d16c28a7ecb4cfa98fe7401954180f76f56fb"},{"sha":"9b8bb37dbd9431da5899a221d583e578ba800d68","author":{"email":"d1996fe015c1f347dddf6c16199179596b8014db@codeaurora.org","name":"Naveen Ramaraj"},"message":"msm: smd_pkt: Avoid prematurely stashing driver info\n\nsmd_pkt_release() relies on checks that would pass by default\n(reference count == 0) to proceed with the release even if the\nopen was unsuccessful in the first place\n\nBug: b/18759663\nSigned-off-by: Naveen Ramaraj <nramaraj@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/norbertc/nexus-kernel/commits/9b8bb37dbd9431da5899a221d583e578ba800d68"},{"sha":"99f5b2bda28d5e91dc10a1c17043ae0074fae81f","author":{"email":"d1996fe015c1f347dddf6c16199179596b8014db@codeaurora.org","name":"Naveen Ramaraj"},"message":"smd_pkt: Add sanity check to avoid unregistering the driver twice\n\nAttempting to unregister it again will cause a panic\n\nBug: 18759663\nChange-Id: Iff2adbc79136c55141f35b872cb70584d303a689\nSigned-off-by: Naveen Ramaraj <nramaraj@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/norbertc/nexus-kernel/commits/99f5b2bda28d5e91dc10a1c17043ae0074fae81f"},{"sha":"87ed0bab36c9f88868d4acb5a905dfbae7265fbb","author":{"email":"155d786f50412e198b29a2119132344d4089836e@gmail.com","name":"Norbert Copones"},"message":"Merge branch 'android-msm-mako-3.4-lollipop-mr1' into nexus-4","distinct":true,"url":"https://api.github.com/repos/norbertc/nexus-kernel/commits/87ed0bab36c9f88868d4acb5a905dfbae7265fbb"}]}