{"push_id":659232502,"size":19,"distinct_size":19,"ref":"refs/heads/lollipop-caf","head":"f1f156822fec8da3ed9d1090fd34f3005975cc0f","before":"62e7593bcc92b08af8887407a623762f03ae74bb","commits":[{"sha":"45aa5a0778d152207f3579a6a3c8cc4991e80264","author":{"email":"ed9bd6f22d2a1e0b1507d3ddc300dc248265d19a@gmail.com","name":"lucien"},"message":"ipv6: ip6_append_data_mtu do not handle the mtu of the second fragment properly\n\n[ Upstream commit e367c2d03dba4c9bcafad24688fadb79dd95b218 ]\n\nIn ip6_append_data_mtu(), when the xfrm mode is not tunnel(such as\ntransport),the ipsec header need to be added in the first fragment, so the mtu\nwill decrease to reserve space for it, then the second fragment come, the mtu\nshould be turn back, as the commit 0c1833797a5a6ec23ea9261d979aa18078720b74\nsaid.  however, in the commit a493e60ac4bbe2e977e7129d6d8cbb0dd236be, it use\n*mtu = min(*mtu, ...) to change the mtu, which lead to the new mtu is alway\nequal with the first fragment's. and cannot turn back.\n\nwhen I test through  ping6 -c1 -s5000 $ip (mtu=1280):\n...frag (0|1232) ESP(spi=0x00002000,seq=0xb), length 1232\n...frag (1232|1216)\n...frag (2448|1216)\n...frag (3664|1216)\n...frag (4880|164)\n\nwhich should be:\n...frag (0|1232) ESP(spi=0x00001000,seq=0x1), length 1232\n...frag (1232|1232)\n...frag (2464|1232)\n...frag (3696|1232)\n...frag (4928|116)\n\nso delete the min() when change back the mtu.\n\nSigned-off-by: Xin Long <lucien.xin@gmail.com>\nFixes: 75a493e60ac4bb (\"ipv6: ip6_append_data_mtu did not care about pmtudisc and frag_size\")\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/45aa5a0778d152207f3579a6a3c8cc4991e80264"},{"sha":"c8dce6d20c7ef2ee045988acd632f1c7f120bdfa","author":{"email":"255103e50249e3d658441816e0597170ebfc16ef@redhat.com","name":"Michael S. Tsirkin"},"message":"vhost: fix total length when packets are too short\n\n[ Upstream commit d8316f3991d207fe32881a9ac20241be8fa2bad0 ]\n\nWhen mergeable buffers are disabled, and the\nincoming packet is too large for the rx buffer,\nget_rx_bufs returns success.\n\nThis was intentional in order for make recvmsg\ntruncate the packet and then handle_rx would\ndetect err != sock_len and drop it.\n\nUnfortunately we pass the original sock_len to\nrecvmsg - which means we use parts of iov not fully\nvalidated.\n\nFix this up by detecting this overrun and doing packet drop\nimmediately.\n\nCVE-2014-0077\n\nSigned-off-by: Michael S. Tsirkin <mst@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/c8dce6d20c7ef2ee045988acd632f1c7f120bdfa"},{"sha":"e06e331bc49e78932c7c3d4a02f53cdbe80f5303","author":{"email":"255103e50249e3d658441816e0597170ebfc16ef@redhat.com","name":"Michael S. Tsirkin"},"message":"vhost: validate vhost_get_vq_desc return value\n\n[ Upstream commit a39ee449f96a2cd44ce056d8a0a112211a9b1a1f ]\n\nvhost fails to validate negative error code\nfrom vhost_get_vq_desc causing\na crash: we are using -EFAULT which is 0xfffffff2\nas vector size, which exceeds the allocated size.\n\nThe code in question was introduced in commit\n8dd014adfea6f173c1ef6378f7e5e7924866c923\n    vhost-net: mergeable buffers support\n\nCVE-2014-0055\n\nSigned-off-by: Michael S. Tsirkin <mst@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/e06e331bc49e78932c7c3d4a02f53cdbe80f5303"},{"sha":"5bbd7593d2a4c84b3af2c3df9a7374c355e6e735","author":{"email":"cf3f603bfb9e239522183ce023889c661a14dc1b@citrix.com","name":"Paul Durrant"},"message":"xen-netback: remove pointless clause from if statement\n\n[ Upstream commit 0576eddf24df716d8570ef8ca11452a9f98eaab2 ]\n\nThis patch removes a test in start_new_rx_buffer() that checks whether\na copy operation is less than MAX_BUFFER_OFFSET in length, since\nMAX_BUFFER_OFFSET is defined to be PAGE_SIZE and the only caller of\nstart_new_rx_buffer() already limits copy operations to PAGE_SIZE or less.\n\nSigned-off-by: Paul Durrant <paul.durrant@citrix.com>\nCc: Ian Campbell <ian.campbell@citrix.com>\nCc: Wei Liu <wei.liu2@citrix.com>\nCc: Sander Eikelenboom <linux@eikelenboom.it>\nReported-By: Sander Eikelenboom <linux@eikelenboom.it>\nTested-By: Sander Eikelenboom <linux@eikelenboom.it>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/5bbd7593d2a4c84b3af2c3df9a7374c355e6e735"},{"sha":"f01df9416052d63fddf06f64ce540ecbace76562","author":{"email":"331be22c6b63ca3e0a03d408c2d906b1b02cd5f2@stressinduktion.org","name":"Hannes Frederic Sowa"},"message":"ipv6: some ipv6 statistic counters failed to disable bh\n\n[ Upstream commit 43a43b6040165f7b40b5b489fe61a4cb7f8c4980 ]\n\nAfter commit c15b1ccadb323ea (\"ipv6: move DAD and addrconf_verify\nprocessing to workqueue\") some counters are now updated in process context\nand thus need to disable bh before doing so, otherwise deadlocks can\nhappen on 32-bit archs. Fabio Estevam noticed this while while mounting\na NFS volume on an ARM board.\n\nAs a compensation for missing this I looked after the other *_STATS_BH\nand found three other calls which need updating:\n\n1) icmp6_send: ip6_fragment -> icmpv6_send -> icmp6_send (error handling)\n2) ip6_push_pending_frames: rawv6_sendmsg -> rawv6_push_pending_frames -> ...\n   (only in case of icmp protocol with raw sockets in error handling)\n3) ping6_v6_sendmsg (error handling)\n\nFixes: c15b1ccadb323ea (\"ipv6: move DAD and addrconf_verify processing to workqueue\")\nReported-by: Fabio Estevam <festevam@gmail.com>\nTested-by: Fabio Estevam <fabio.estevam@freescale.com>\nCc: Eric Dumazet <eric.dumazet@gmail.com>\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/f01df9416052d63fddf06f64ce540ecbace76562"},{"sha":"9341d1f0fe55c3b05051ecb95d299bcc908cf9c2","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira"},"message":"netlink: don't compare the nul-termination in nla_strcmp\n\n[ Upstream commit 8b7b932434f5eee495b91a2804f5b64ebb2bc835 ]\n\nnla_strcmp compares the string length plus one, so it's implicitly\nincluding the nul-termination in the comparison.\n\n int nla_strcmp(const struct nlattr *nla, const char *str)\n {\n        int len = strlen(str) + 1;\n        ...\n                d = memcmp(nla_data(nla), str, len);\n\nHowever, if NLA_STRING is used, userspace can send us a string without\nthe nul-termination. This is a problem since the string\ncomparison will not match as the last byte may be not the\nnul-termination.\n\nFix this by skipping the comparison of the nul-termination if the\nattribute data is nul-terminated. Suggested by Thomas Graf.\n\nCc: Florian Westphal <fw@strlen.de>\nCc: Thomas Graf <tgraf@suug.ch>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/9341d1f0fe55c3b05051ecb95d299bcc908cf9c2"},{"sha":"bcc81befee4d94bba85f8158d40190752c60e967","author":{"email":"948b80da4254122ea1e8973dd9930d46b7654cf3@linux-ipv6.org","name":"YOSHIFUJI Hideaki"},"message":"isdnloop: Validate NUL-terminated strings from user.\n\n[ Upstream commit 77bc6bed7121936bb2e019a8c336075f4c8eef62 ]\n\nReturn -EINVAL unless all of user-given strings are correctly\nNUL-terminated.\n\nSigned-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/bcc81befee4d94bba85f8158d40190752c60e967"},{"sha":"3ec5d0932066e8e13a4cc3e62bb7bfeca3d28975","author":{"email":"ff341aa343d564f9e53e9dcb6996be8c04859a66@oracle.com","name":"Dan Carpenter"},"message":"isdnloop: several buffer overflows\n\n[ Upstream commit 7563487cbf865284dcd35e9ef5a95380da046737 ]\n\nThere are three buffer overflows addressed in this patch.\n\n1) In isdnloop_fake_err() we add an 'E' to a 60 character string and\nthen copy it into a 60 character buffer.  I have made the destination\nbuffer 64 characters and I'm changed the sprintf() to a snprintf().\n\n2) In isdnloop_parse_cmd(), p points to a 6 characters into a 60\ncharacter buffer so we have 54 characters.  The ->eazlist[] is 11\ncharacters long.  I have modified the code to return if the source\nbuffer is too long.\n\n3) In isdnloop_command() the cbuf[] array was 60 characters long but the\nmax length of the string then can be up to 79 characters.  I made the\ncbuf array 80 characters long and changed the sprintf() to snprintf().\nI also removed the temporary \"dial\" buffer and changed it to use \"p\"\ndirectly.\n\nUnfortunately, we pass the \"cbuf\" string from isdnloop_command() to\nisdnloop_writecmd() which truncates anything over 60 characters to make\nit fit in card->omsg[].  (It can accept values up to 255 characters so\nlong as there is a '\\n' character every 60 characters).  For now I have\njust fixed the memory corruption bug and left the other problems in this\ndriver alone.\n\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/3ec5d0932066e8e13a4cc3e62bb7bfeca3d28975"},{"sha":"5021000d688ecbf7043721473d9f35041b4999f1","author":{"email":"e642b69ed2fc111e09ffdc37feb733a52253340d@oracle.com","name":"Sasha Levin"},"message":"rds: prevent dereference of a NULL device in rds_iw_laddr_check\n\n[ Upstream commit bf39b4247b8799935ea91d90db250ab608a58e50 ]\n\nBinding might result in a NULL device which is later dereferenced\nwithout checking.\n\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/5021000d688ecbf7043721473d9f35041b4999f1"},{"sha":"978fc18a20bc99b19bc34c8d71d9e70a84ae4d3a","author":{"email":"dd383a1b424d6bb549685937e9e45a62a8d0d5f5@gmail.com","name":"oftedal"},"message":"sparc: PCI: Fix incorrect address calculation of PCI Bridge windows on Simba-bridges\n\n[ Upstream commit 557fc5873ef178c4b3e1e36a42db547ecdc43f9b ]\n\nThe SIMBA APB Bridges lacks the 'ranges' of-property describing the\nPCI I/O and memory areas located beneath the bridge. Faking this\ninformation has been performed by reading range registers in the\nAPB bridge, and calculating the corresponding areas.\n\nIn commit 01f94c4a6ced476ce69b895426fc29bfc48c69bd\n(\"Fix sabre pci controllers with new probing scheme.\") a bug was\nintroduced into this calculation, causing the PCI memory areas\nto be calculated incorrectly: The shift size was set to be\nidentical for I/O and MEM ranges, which is incorrect.\n\nThis patch set the shift size of the MEM range back to the\nvalue used before 01f94c4a6ced476ce69b895426fc29bfc48c69bd.\n\nSigned-off-by: Kjetil Oftedal <oftedal@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/978fc18a20bc99b19bc34c8d71d9e70a84ae4d3a"},{"sha":"af20372380c566f3b232e67daa26cbb7945f44c4","author":{"email":"d1e82e2813f00e3d60e00aa92378ef41c34f031b@oracle.com","name":"Dave Kleikamp"},"message":"Revert \"sparc64: Fix __copy_{to,from}_user_inatomic defines.\"\n\n[ Upstream commit 16932237f2978a2265662f8de4af743b1f55a209 ]\n\nThis reverts commit 145e1c0023585e0e8f6df22316308ec61c5066b2.\n\nThis commit broke the behavior of __copy_from_user_inatomic when\nit is only partially successful. Instead of returning the number\nof bytes not copied, it now returns 1. This translates to the\nwrong value being returned by iov_iter_copy_from_user_atomic.\n\nxfstests generic/246 and LTP writev01 both fail on btrfs and nfs\nbecause of this.\n\nSigned-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>\nCc: Hugh Dickins <hughd@google.com>\nCc: David S. Miller <davem@davemloft.net>\nCc: sparclinux@vger.kernel.org\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/af20372380c566f3b232e67daa26cbb7945f44c4"},{"sha":"f2d2dc70f144f96490337e79cca0527de64b8766","author":{"email":"ae947f3c8df96e1dc851c5e3e5a930ce6d3f1f74@windriver.com","name":"Paul Gortmaker"},"message":"sparc32: fix build failure for arch_jump_label_transform\n\n[ Upstream commit 4f6500fff5f7644a03c46728fd7ef0f62fa6940b ]\n\nIn arch/sparc/Kernel/Makefile, we see:\n\n   obj-$(CONFIG_SPARC64)   += jump_label.o\n\nHowever, the Kconfig selects HAVE_ARCH_JUMP_LABEL unconditionally\nfor all SPARC.  This in turn leads to the following failure when\ndoing allmodconfig coverage builds:\n\nkernel/built-in.o: In function `__jump_label_update':\njump_label.c:(.text+0x8560c): undefined reference to `arch_jump_label_transform'\nkernel/built-in.o: In function `arch_jump_label_transform_static':\n(.text+0x85cf4): undefined reference to `arch_jump_label_transform'\nmake: *** [vmlinux] Error 1\n\nChange HAVE_ARCH_JUMP_LABEL to be conditional on SPARC64 so that it\nmatches the Makefile.\n\nSigned-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/f2d2dc70f144f96490337e79cca0527de64b8766"},{"sha":"1f44f545a16f54158ae51e65f6e26e37c9113b23","author":{"email":"d1e82e2813f00e3d60e00aa92378ef41c34f031b@oracle.com","name":"Dave Kleikamp"},"message":"sparc64: don't treat 64-bit syscall return codes as 32-bit\n\n[ Upstream commit 1535bd8adbdedd60a0ee62e28fd5225d66434371 ]\n\nWhen checking a system call return code for an error,\nlinux_sparc_syscall was sign-extending the lower 32-bit value and\ncomparing it to -ERESTART_RESTARTBLOCK. lseek can return valid return\ncodes whose lower 32-bits alone would indicate a failure (such as 4G-1).\nUse the whole 64-bit value to check for errors. Only the 32-bit path\nshould sign extend the lower 32-bit value.\n\nSigned-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>\nAcked-by: Bob Picco <bob.picco@oracle.com>\nAcked-by: Allen Pais <allen.pais@oracle.com>\nCc: David S. Miller <davem@davemloft.net>\nCc: sparclinux@vger.kernel.org\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/1f44f545a16f54158ae51e65f6e26e37c9113b23"},{"sha":"8b09da52f734287d86944e0dba3b3690de30a099","author":{"email":"dfbf39eb5bf303a3db5454d815cb8c8888cbadf9@suse.cz","name":"Jiri Slaby"},"message":"Char: ipmi_bt_sm, fix infinite loop\n\ncommit a94cdd1f4d30f12904ab528152731fb13a812a16 upstream.\n\nIn read_all_bytes, we do\n\n  unsigned char i;\n  ...\n  bt->read_data[0] = BMC2HOST;\n  bt->read_count = bt->read_data[0];\n  ...\n  for (i = 1; i <= bt->read_count; i++)\n    bt->read_data[i] = BMC2HOST;\n\nIf bt->read_data[0] == bt->read_count == 255, we loop infinitely in the\n'for' loop.  Make 'i' an 'int' instead of 'char' to get rid of the\noverflow and finish the loop after 255 iterations every time.\n\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>\nReported-and-debugged-by: Rui Hui Dian <rhdian@novell.com>\nCc: Tomas Cech <tcech@suse.cz>\nCc: Corey Minyard <minyard@acm.org>\nCc: <openipmi-developer@lists.sourceforge.net>\nSigned-off-by: Corey Minyard <cminyard@mvista.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/8b09da52f734287d86944e0dba3b3690de30a099"},{"sha":"478b5abc25fcb0bb9f24d4611aef32dc8b266004","author":{"email":"9c76e40525d0071d263a497e0e6d1e431143c489@broadcom.com","name":"Kamlakant Patel"},"message":"jffs2: Fix segmentation fault found in stress test\n\ncommit 3367da5610c50e6b83f86d366d72b41b350b06a2 upstream.\n\nCreating a large file on a JFFS2 partition sometimes crashes with this call\ntrace:\n\n[  306.476000] CPU 13 Unable to handle kernel paging request at virtual address c0000000dfff8002, epc == ffffffffc03a80a8, ra == ffffffffc03a8044\n[  306.488000] Oops[#1]:\n[  306.488000] Cpu 13\n[  306.492000] $ 0   : 0000000000000000 0000000000000000 0000000000008008 0000000000008007\n[  306.500000] $ 4   : c0000000dfff8002 000000000000009f c0000000e0007cde c0000000ee95fa58\n[  306.508000] $ 8   : 0000000000000001 0000000000008008 0000000000010000 ffffffffffff8002\n[  306.516000] $12   : 0000000000007fa9 000000000000ff0e 000000000000ff0f 80e55930aebb92bb\n[  306.524000] $16   : c0000000e0000000 c0000000ee95fa5c c0000000efc80000 ffffffffc09edd70\n[  306.532000] $20   : ffffffffc2b60000 c0000000ee95fa58 0000000000000000 c0000000efc80000\n[  306.540000] $24   : 0000000000000000 0000000000000004\n[  306.548000] $28   : c0000000ee950000 c0000000ee95f738 0000000000000000 ffffffffc03a8044\n[  306.556000] Hi    : 00000000000574a5\n[  306.560000] Lo    : 6193b7a7e903d8c9\n[  306.564000] epc   : ffffffffc03a80a8 jffs2_rtime_compress+0x98/0x198\n[  306.568000]     Tainted: G        W\n[  306.572000] ra    : ffffffffc03a8044 jffs2_rtime_compress+0x34/0x198\n[  306.580000] Status: 5000f8e3    KX SX UX KERNEL EXL IE\n[  306.584000] Cause : 00800008\n[  306.588000] BadVA : c0000000dfff8002\n[  306.592000] PrId  : 000c1100 (Netlogic XLP)\n[  306.596000] Modules linked in:\n[  306.596000] Process dd (pid: 170, threadinfo=c0000000ee950000, task=c0000000ee6e0858, tls=0000000000c47490)\n[  306.608000] Stack : 7c547f377ddc7ee4 7ffc7f967f5d7fae 7f617f507fc37ff4 7e7d7f817f487f5f\n        7d8e7fec7ee87eb3 7e977ff27eec7f9e 7d677ec67f917f67 7f3d7e457f017ed7\n        7fd37f517f867eb2 7fed7fd17ca57e1d 7e5f7fe87f257f77 7fd77f0d7ede7fdb\n        7fba7fef7e197f99 7fde7fe07ee37eb5 7f5c7f8c7fc67f65 7f457fb87f847e93\n        7f737f3e7d137cd9 7f8e7e9c7fc47d25 7dbb7fac7fb67e52 7ff17f627da97f64\n        7f6b7df77ffa7ec5 80057ef17f357fb3 7f767fa27dfc7fd5 7fe37e8e7fd07e53\n        7e227fcf7efb7fa1 7f547e787fa87fcc 7fcb7fc57f5a7ffb 7fc07f6c7ea97e80\n        7e2d7ed17e587ee0 7fb17f9d7feb7f31 7f607e797e887faa 7f757fdd7c607ff3\n        7e877e657ef37fbd 7ec17fd67fe67ff7 7ff67f797ff87dc4 7eef7f3a7c337fa6\n        7fe57fc97ed87f4b 7ebe7f097f0b8003 7fe97e2a7d997cba 7f587f987f3c7fa9\n        ...\n[  306.676000] Call Trace:\n[  306.680000] [<ffffffffc03a80a8>] jffs2_rtime_compress+0x98/0x198\n[  306.684000] [<ffffffffc0394f10>] jffs2_selected_compress+0x110/0x230\n[  306.692000] [<ffffffffc039508c>] jffs2_compress+0x5c/0x388\n[  306.696000] [<ffffffffc039dc58>] jffs2_write_inode_range+0xd8/0x388\n[  306.704000] [<ffffffffc03971bc>] jffs2_write_end+0x16c/0x2d0\n[  306.708000] [<ffffffffc01d3d90>] generic_file_buffered_write+0xf8/0x2b8\n[  306.716000] [<ffffffffc01d4e7c>] __generic_file_aio_write+0x1ac/0x350\n[  306.720000] [<ffffffffc01d50a0>] generic_file_aio_write+0x80/0x168\n[  306.728000] [<ffffffffc021f7dc>] do_sync_write+0x94/0xf8\n[  306.732000] [<ffffffffc021ff6c>] vfs_write+0xa4/0x1a0\n[  306.736000] [<ffffffffc02202e8>] SyS_write+0x50/0x90\n[  306.744000] [<ffffffffc0116cc0>] handle_sys+0x180/0x1a0\n[  306.748000]\n[  306.748000]\nCode: 020b202d  0205282d  90a50000 <90840000> 14a40038  00000000  0060602d  0000282d  016c5823\n[  306.760000] ---[ end trace 79dd088435be02d0 ]---\nSegmentation fault\n\nThis crash is caused because the 'positions' is declared as an array of signed\nshort. The value of position is in the range 0..65535, and will be converted\nto a negative number when the position is greater than 32767 and causes a\ncorruption and crash. Changing the definition to 'unsigned short' fixes this\nissue\n\nSigned-off-by: Jayachandran C <jchandra@broadcom.com>\nSigned-off-by: Kamlakant Patel <kamlakant.patel@broadcom.com>\nSigned-off-by: Brian Norris <computersforpeace@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/478b5abc25fcb0bb9f24d4611aef32dc8b266004"},{"sha":"921df0ae62306b30b180f269847619481dde48b5","author":{"email":"0f7b9750509bdd3f0afeaad8840394a4bdf8b203@broadcom.com","name":"Ajesh Kunhipurayil Vijayan"},"message":"jffs2: Fix crash due to truncation of csize\n\ncommit 41bf1a24c1001f4d0d41a78e1ac575d2f14789d7 upstream.\n\nmounting JFFS2 partition sometimes crashes with this call trace:\n\n[ 1322.240000] Kernel bug detected[#1]:\n[ 1322.244000] Cpu 2\n[ 1322.244000] $ 0   : 0000000000000000 0000000000000018 000000003ff00070 0000000000000001\n[ 1322.252000] $ 4   : 0000000000000000 c0000000f3980150 0000000000000000 0000000000010000\n[ 1322.260000] $ 8   : ffffffffc09cd5f8 0000000000000001 0000000000000088 c0000000ed300de8\n[ 1322.268000] $12   : e5e19d9c5f613a45 ffffffffc046d464 0000000000000000 66227ba5ea67b74e\n[ 1322.276000] $16   : c0000000f1769c00 c0000000ed1e0200 c0000000f3980150 0000000000000000\n[ 1322.284000] $20   : c0000000f3a80000 00000000fffffffc c0000000ed2cfbd8 c0000000f39818f0\n[ 1322.292000] $24   : 0000000000000004 0000000000000000\n[ 1322.300000] $28   : c0000000ed2c0000 c0000000ed2cfab8 0000000000010000 ffffffffc039c0b0\n[ 1322.308000] Hi    : 000000000000023c\n[ 1322.312000] Lo    : 000000000003f802\n[ 1322.316000] epc   : ffffffffc039a9f8 check_tn_node+0x88/0x3b0\n[ 1322.320000]     Not tainted\n[ 1322.324000] ra    : ffffffffc039c0b0 jffs2_do_read_inode_internal+0x1250/0x1e48\n[ 1322.332000] Status: 5400f8e3    KX SX UX KERNEL EXL IE\n[ 1322.336000] Cause : 00800034\n[ 1322.340000] PrId  : 000c1004 (Netlogic XLP)\n[ 1322.344000] Modules linked in:\n[ 1322.348000] Process jffs2_gcd_mtd7 (pid: 264, threadinfo=c0000000ed2c0000, task=c0000000f0e68dd8, tls=0000000000000000)\n[ 1322.356000] Stack : c0000000f1769e30 c0000000ed010780 c0000000ed010780 c0000000ed300000\n        c0000000f1769c00 c0000000f3980150 c0000000f3a80000 00000000fffffffc\n        c0000000ed2cfbd8 ffffffffc039c0b0 ffffffffc09c6340 0000000000001000\n        0000000000000dec ffffffffc016c9d8 c0000000f39805a0 c0000000f3980180\n        0000008600000000 0000000000000000 0000000000000000 0000000000000000\n        0001000000000dec c0000000f1769d98 c0000000ed2cfb18 0000000000010000\n        0000000000010000 0000000000000044 c0000000f3a80000 c0000000f1769c00\n        c0000000f3d207a8 c0000000f1769d98 c0000000f1769de0 ffffffffc076f9c0\n        0000000000000009 0000000000000000 0000000000000000 ffffffffc039cf90\n        0000000000000017 ffffffffc013fbdc 0000000000000001 000000010003e61c\n        ...\n[ 1322.424000] Call Trace:\n[ 1322.428000] [<ffffffffc039a9f8>] check_tn_node+0x88/0x3b0\n[ 1322.432000] [<ffffffffc039c0b0>] jffs2_do_read_inode_internal+0x1250/0x1e48\n[ 1322.440000] [<ffffffffc039cf90>] jffs2_do_crccheck_inode+0x70/0xd0\n[ 1322.448000] [<ffffffffc03a1b80>] jffs2_garbage_collect_pass+0x160/0x870\n[ 1322.452000] [<ffffffffc03a392c>] jffs2_garbage_collect_thread+0xdc/0x1f0\n[ 1322.460000] [<ffffffffc01541c8>] kthread+0xb8/0xc0\n[ 1322.464000] [<ffffffffc0106d18>] kernel_thread_helper+0x10/0x18\n[ 1322.472000]\n[ 1322.472000]\nCode: 67bd0050  94a4002c  2c830001 <00038036> de050218  2403fffc  0080a82d  00431824  24630044\n[ 1322.480000] ---[ end trace b052bb90e97dfbf5 ]---\n\nThe variable csize in structure jffs2_tmp_dnode_info is of type uint16_t, but it\nis used to hold the compressed data length(csize) which is declared as uint32_t.\nSo, when the value of csize exceeds 16bits, it gets truncated when assigned to\ntn->csize. This is causing a kernel BUG.\nChanging the definition of csize in jffs2_tmp_dnode_info to uint32_t fixes the issue.\n\nSigned-off-by: Ajesh Kunhipurayil Vijayan <ajesh@broadcom.com>\nSigned-off-by: Kamlakant Patel <kamlakant.patel@broadcom.com>\nSigned-off-by: Brian Norris <computersforpeace@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/921df0ae62306b30b180f269847619481dde48b5"},{"sha":"f4459c3f664ef9551c1c188b89f8e106ffc33c13","author":{"email":"a8167b9d27aca9c6624754deb52c4c6420eded04@huawei.com","name":"Li Zefan"},"message":"jffs2: avoid soft-lockup in jffs2_reserve_space_gc()\n\ncommit 13b546d96207c131eeae15dc7b26c6e7d0f1cad7 upstream.\n\nWe triggered soft-lockup under stress test on 2.6.34 kernel.\n\nBUG: soft lockup - CPU#1 stuck for 60009ms! [lockf2.test:14488]\n...\n[<bf09a4d4>] (jffs2_do_reserve_space+0x420/0x440 [jffs2])\n[<bf09a528>] (jffs2_reserve_space_gc+0x34/0x78 [jffs2])\n[<bf0a1350>] (jffs2_garbage_collect_dnode.isra.3+0x264/0x478 [jffs2])\n[<bf0a2078>] (jffs2_garbage_collect_pass+0x9c0/0xe4c [jffs2])\n[<bf09a670>] (jffs2_reserve_space+0x104/0x2a8 [jffs2])\n[<bf09dc48>] (jffs2_write_inode_range+0x5c/0x4d4 [jffs2])\n[<bf097d8c>] (jffs2_write_end+0x198/0x2c0 [jffs2])\n[<c00e00a4>] (generic_file_buffered_write+0x158/0x200)\n[<c00e14f4>] (__generic_file_aio_write+0x3a4/0x414)\n[<c00e15c0>] (generic_file_aio_write+0x5c/0xbc)\n[<c012334c>] (do_sync_write+0x98/0xd4)\n[<c0123a84>] (vfs_write+0xa8/0x150)\n[<c0123d74>] (sys_write+0x3c/0xc0)]\n\nFix this by adding a cond_resched() in the while loop.\n\n[akpm@linux-foundation.org: don't initialize `ret']\nSigned-off-by: Li Zefan <lizefan@huawei.com>\nCc: David Woodhouse <dwmw2@infradead.org>\nCc: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Brian Norris <computersforpeace@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/f4459c3f664ef9551c1c188b89f8e106ffc33c13"},{"sha":"7ed9c89076d6ce464597246ac768755bdfa7dcf8","author":{"email":"a8167b9d27aca9c6624754deb52c4c6420eded04@huawei.com","name":"Li Zefan"},"message":"jffs2: remove from wait queue after schedule()\n\ncommit 3ead9578443b66ddb3d50ed4f53af8a0c0298ec5 upstream.\n\n@wait is a local variable, so if we don't remove it from the wait queue\nlist, later wake_up() may end up accessing invalid memory.\n\nThis was spotted by eyes.\n\nSigned-off-by: Li Zefan <lizefan@huawei.com>\nCc: David Woodhouse <dwmw2@infradead.org>\nCc: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Brian Norris <computersforpeace@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/7ed9c89076d6ce464597246ac768755bdfa7dcf8"},{"sha":"f1f156822fec8da3ed9d1090fd34f3005975cc0f","author":{"email":"20b70f0af00562e63758b9ee42012ecc96c58590@redhat.com","name":"Oleg Nesterov"},"message":"wait: fix reparent_leader() vs EXIT_DEAD->EXIT_ZOMBIE race\n\ncommit dfccbb5e49a621c1b21a62527d61fc4305617aca upstream.\n\nwait_task_zombie() first does EXIT_ZOMBIE->EXIT_DEAD transition and\ndrops tasklist_lock.  If this task is not the natural child and it is\ntraced, we change its state back to EXIT_ZOMBIE for ->real_parent.\n\nThe last transition is racy, this is even documented in 50b8d257486a\n\"ptrace: partially fix the do_wait(WEXITED) vs EXIT_DEAD->EXIT_ZOMBIE\nrace\".  wait_consider_task() tries to detect this transition and clear\n->notask_error but we can't rely on ptrace_reparented(), debugger can\nexit and do ptrace_unlink() before its sub-thread sets EXIT_ZOMBIE.\n\nAnd there is another problem which were missed before: this transition\ncan also race with reparent_leader() which doesn't reset >exit_signal if\nEXIT_DEAD, assuming that this task must be reaped by someone else.  So\nthe tracee can be re-parented with ->exit_signal != SIGCHLD, and if\n/sbin/init doesn't use __WALL it becomes unreapable.\n\nChange reparent_leader() to update ->exit_signal even if EXIT_DEAD.\nNote: this is the simple temporary hack for -stable, it doesn't try to\nsolve all problems, it will be reverted by the next changes.\n\nSigned-off-by: Oleg Nesterov <oleg@redhat.com>\nReported-by: Jan Kratochvil <jan.kratochvil@redhat.com>\nReported-by: Michal Schmidt <mschmidt@redhat.com>\nTested-by: Michal Schmidt <mschmidt@redhat.com>\nCc: Al Viro <viro@ZenIV.linux.org.uk>\nCc: Lennart Poettering <lpoetter@redhat.com>\nCc: Roland McGrath <roland@hack.frob.com>\nCc: Tejun Heo <tj@kernel.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nConflicts:\n\tkernel/exit.c","distinct":true,"url":"https://api.github.com/repos/smac0628/android_kernel_htc_msm8974/commits/f1f156822fec8da3ed9d1090fd34f3005975cc0f"}]}