{"push_id":806507295,"size":1000,"distinct_size":1553,"ref":"refs/heads/lollipop-caf","head":"5e3c8779c2ef34029b77cd0d7c31fbee0fae42dc","before":"ce29aeb18e4606dcc4f8b8d26caa53e5d6cf363d","commits":[{"sha":"f888dec761b5a534373eb6b351d0efa4e74f6630","author":{"email":"9e6ba6483b6a3e14d61f7c987e72ecb5b46122d6@mev.co.uk","name":"Ian Abbott"},"message":"staging: comedi: jr3_pci: fix iomem dereference\n\ncommit e1878957b4676a17cf398f7f5723b365e9a2ca48 upstream.\n\nCorrect a direct dereference of I/O memory to use an appropriate I/O\nmemory access function.  Note that the pointer being dereferenced is not\ncurrently tagged with `__iomem` but I plan to correct that for 3.7.\n\nSigned-off-by: Ian Abbott <abbotti@mev.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/f888dec761b5a534373eb6b351d0efa4e74f6630"},{"sha":"2c98bd030ff703984f670668203234fc17c51a69","author":{"email":"9e6ba6483b6a3e14d61f7c987e72ecb5b46122d6@mev.co.uk","name":"Ian Abbott"},"message":"staging: comedi: don't dereference user memory for INSN_INTTRIG\n\ncommit 5d06e3df280bd230e2eadc16372e62818c63e894 upstream.\n\n`parse_insn()` is dereferencing the user-space pointer `insn->data`\ndirectly when handling the `INSN_INTTRIG` comedi instruction.  It\nshouldn't be using `insn->data` at all; it should be using the separate\n`data` pointer passed to the function.  Fix it.\n\nSigned-off-by: Ian Abbott <abbotti@mev.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/2c98bd030ff703984f670668203234fc17c51a69"},{"sha":"931589143fe6dce8f9729317e395df509d41f5ff","author":{"email":"9e6ba6483b6a3e14d61f7c987e72ecb5b46122d6@mev.co.uk","name":"Ian Abbott"},"message":"staging: comedi: fix memory leak for saved channel list\n\ncommit c8cad4c89ee3b15935c532210ae6ebb5c0a2734d upstream.\n\nWhen `do_cmd_ioctl()` allocates memory for the kernel copy of a channel\nlist, it frees any previously allocated channel list in\n`async->cmd.chanlist` and replaces it with the new one.  However, if the\ndevice is ever removed (or \"detached\") the cleanup code in\n`cleanup_device()` in \"drivers.c\" does not free this memory so it is\nlost.\n\nA sensible place to free the kernel copy of the channel list is in\n`do_become_nonbusy()` as at that point the comedi asynchronous command\nassociated with the channel list is no longer valid.  Free the channel\nlist in `do_become_nonbusy()` instead of `do_cmd_ioctl()` and clear the\npointer to prevent it being freed more than once.\n\nNote that `cleanup_device()` could be called at an inappropriate time\nwhile the comedi device is open, but that's a separate bug not related\nto this this patch.\n\nSigned-off-by: Ian Abbott <abbotti@mev.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/931589143fe6dce8f9729317e395df509d41f5ff"},{"sha":"cb38568e5ea27a1ae5c62170c1790b853e0f3767","author":{"email":"c35bba1a65a9ddf143213fa6f0e8aab779b774e6@redhat.com","name":"Stanislav Kozina"},"message":"Remove BUG_ON from n_tty_read()\n\ncommit e9490e93c1978b6669f3e993caa3189be13ce459 upstream.\n\nChange the BUG_ON to WARN_ON and return in case of tty->read_buf==NULL. We want to track a\ncouple of long standing reports of this but at the same time we can avoid killing the box.\n\nSigned-off-by: Stanislav Kozina <skozina@redhat.com>\nSigned-off-by: Alan Cox <alan@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/cb38568e5ea27a1ae5c62170c1790b853e0f3767"},{"sha":"b7da04be4b724b3823a0f57774683ef9dfc253b9","author":{"email":"dfbf39eb5bf303a3db5454d815cb8c8888cbadf9@suse.cz","name":"Jiri Slaby"},"message":"TTY: ttyprintk, don't touch behind tty->write_buf\n\ncommit ee8b593affdf893012e57f4c54a21984d1b0d92e upstream.\n\nIf a user provides a buffer larger than a tty->write_buf chunk and\npasses '\\r' at the end of the buffer, we touch an out-of-bound memory.\n\nAdd a check there to prevent this.\n\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>\nCc: Samo Pogacnik <samo_pogacnik@t-2.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/b7da04be4b724b3823a0f57774683ef9dfc253b9"},{"sha":"2fdbe9541fa5c667dcbebe64623920487b0b2d1a","author":{"email":"092de8493dfce99e706680bcb51a28b24f7674b5@ti.com","name":"Vikram Pandita"},"message":"serial: omap: fix software flow control\n\ncommit 957ee7270d632245b43f6feb0e70d9a5e9ea6cf6 upstream.\n\nSoftware flow control register bits were not defined correctly.\n\nAlso clarify the IXON and IXOFF logic to reflect what userspace wants.\n\nTested-by: Shubhrajyoti D <shubhrajyoti@ti.com>\nSigned-off-by: Vikram Pandita <vikram.pandita@ti.com>\nSigned-off-by: Shubhrajyoti D <shubhrajyoti@ti.com>\nAcked-by: Tony Lindgren <tony@atomide.com>\nSigned-off-by: Felipe Balbi <balbi@ti.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/2fdbe9541fa5c667dcbebe64623920487b0b2d1a"},{"sha":"ab458e2a66fa1fd5d3754c956ac8b8a88c57268b","author":{"email":"9cd9d802d23c0ed5e224beabf4ae4a5c478746ef@linaro.org","name":"Linus Walleij"},"message":"serial: pl011: handle corruption at high clock speeds\n\ncommit c5dd553b9fd069892c9e2de734f4f604e280fa7a upstream.\n\nThis works around a few glitches in the ST version of the PL011\nserial driver when using very high baud rates, as we do in the\nUx500: 3, 3.25, 4 and 4.05 Mbps.\n\nProblem Observed/rootcause:\n\nWhen using high baud-rates, and the baudrate*8 is getting close to\nthe provided clock frequency (so a division factor close to 1), when\nusing bursts of characters (so they are abutted), then it seems as if\nthere is not enough time to detect the beginning of the start-bit which\nis a timing reference for the entire character, and thus the sampling\nmoment of character bits is moving towards the end of each bit, instead\nof the middle.\n\nFix:\nIncrease slightly the RX baud rate of the UART above the theoretical\nbaudrate by 5%. This will definitely give more margin time to the\nUART_RX to correctly sample the data at the middle of the bit period.\n\nAlso fix the ages old copy-paste error in the very stressed comment,\nit's referencing the registers used in the PL010 driver rather than\nthe PL011 ones.\n\nSigned-off-by: Guillaume Jaunet <guillaume.jaunet@stericsson.com>\nSigned-off-by: Christophe Arnal <christophe.arnal@stericsson.com>\nSigned-off-by: Matthias Locher <matthias.locher@stericsson.com>\nSigned-off-by: Rajanikanth HV <rajanikanth.hv@stericsson.com>\nCc: Bibek Basu <bibek.basu@stericsson.com>\nCc: Par-Gunnar Hjalmdahl <par-gunnar.hjalmdahl@stericsson.com>\nSigned-off-by: Linus Walleij <linus.walleij@linaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/ab458e2a66fa1fd5d3754c956ac8b8a88c57268b"},{"sha":"20ae7faafcfc85aab3965d5faa8a264312ee0862","author":{"email":"aad92d04492d3e9d68113c6843d4514145c8ed06@redhat.com","name":"Flavio Leitner"},"message":"serial: set correct baud_base for EXSYS EX-41092 Dual 16950\n\ncommit 26e8220adb0aec43b7acafa0f1431760eee28522 upstream.\n\nApparently the same card model has two IDs, so this patch\ncomplements the commit 39aced68d664291db3324d0fcf0985ab5626aac2\nadding the missing one.\n\nSigned-off-by: Flavio Leitner <fbl@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/20ae7faafcfc85aab3965d5faa8a264312ee0862"},{"sha":"c478e0131e20325ba310c788685c70c087ae63e8","author":{"email":"73675debcd8a436be48ec22211dcf44fe0df0a64@decadent.org.uk","name":"Ben Hutchings"},"message":"tools/hv: Fix file handle leak\n\ncommit d5ab482799e7c4c4b7c0aa67e8710dce28115d03 upstream.\n\nMatch up each fopen() with an fclose().\n\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: K. Y. Srinivasan <kys@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/c478e0131e20325ba310c788685c70c087ae63e8"},{"sha":"8ff75381573b15e546919ae5a0367634f365b24d","author":{"email":"73675debcd8a436be48ec22211dcf44fe0df0a64@decadent.org.uk","name":"Ben Hutchings"},"message":"tools/hv: Fix exit() error code\n\ncommit 6bb22fea25624ab593eee376fa5fb82d1b13f45a upstream.\n\nLinux native exit codes are 8-bit unsigned values.  exit(-1) results\nin an exit code of 255, which is usually reserved for shells reporting\n'command not found'.  Use the portable value EXIT_FAILURE.  (Not that\nthis matters much for a daemon.)\n\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: K. Y. Srinivasan <kys@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/8ff75381573b15e546919ae5a0367634f365b24d"},{"sha":"057d213bb04248f1408d973bd478b3ad59570d48","author":{"email":"73675debcd8a436be48ec22211dcf44fe0df0a64@decadent.org.uk","name":"Ben Hutchings"},"message":"tools/hv: Check for read/write errors\n\ncommit 436473bc2173499ae274d0f50111d1e355006caf upstream.\n\nhv_kvp_daemon currently does not check whether fread() or fwrite()\nsucceed.  Add the necessary checks.  Also, remove the incorrect use of\nfeof() before fread().\n\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: K. Y. Srinivasan <kys@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/057d213bb04248f1408d973bd478b3ad59570d48"},{"sha":"bc47348887cfcd40bf867a40425397d660d9c3f1","author":{"email":"ed0f1d78b8c21b2970494a178da4bdfa8beba2a7@lwfinger.net","name":"Larry Finger"},"message":"b43legacy: Fix crash on unload when firmware not available\n\ncommit 2d838bb608e2d1f6cb4280e76748cb812dc822e7 upstream.\n\nWhen b43legacy is loaded without the firmware being available, a following\nunload generates a kernel NULL pointer dereference BUG as follows:\n\n[  214.330789] BUG: unable to handle kernel NULL pointer dereference at 0000004c\n[  214.330997] IP: [<c104c395>] drain_workqueue+0x15/0x170\n[  214.331179] *pde = 00000000\n[  214.331311] Oops: 0000 [#1] SMP\n[  214.331471] Modules linked in: b43legacy(-) ssb pcmcia mac80211 cfg80211 af_packet mperf arc4 ppdev sr_mod cdrom sg shpchp yenta_socket pcmcia_rsrc pci_hotplug pcmcia_core battery parport_pc parport floppy container ac button edd autofs4 ohci_hcd ehci_hcd usbcore usb_common thermal processor scsi_dh_rdac scsi_dh_hp_sw scsi_dh_emc scsi_dh_alua scsi_dh fan thermal_sys hwmon ata_generic pata_ali libata [last unloaded: cfg80211]\n[  214.333421] Pid: 3639, comm: modprobe Not tainted 3.6.0-rc6-wl+ #163 Source Technology VIC 9921/ALI Based Notebook\n[  214.333580] EIP: 0060:[<c104c395>] EFLAGS: 00010246 CPU: 0\n[  214.333687] EIP is at drain_workqueue+0x15/0x170\n[  214.333788] EAX: c162ac40 EBX: cdfb8360 ECX: 0000002a EDX: 00002a2a\n[  214.333890] ESI: 00000000 EDI: 00000000 EBP: cd767e7c ESP: cd767e5c\n[  214.333957]  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068\n[  214.333957] CR0: 8005003b CR2: 0000004c CR3: 0c96a000 CR4: 00000090\n[  214.333957] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000\n[  214.333957] DR6: ffff0ff0 DR7: 00000400\n[  214.333957] Process modprobe (pid: 3639, ti=cd766000 task=cf802e90 task.ti=cd766000)\n[  214.333957] Stack:\n[  214.333957]  00000292 cd767e74 c12c5e09 00000296 00000296 cdfb8360 cdfb9220 00000000\n[  214.333957]  cd767e90 c104c4fd cdfb8360 cdfb9220 cd682800 cd767ea4 d0c10184 cd682800\n[  214.333957]  cd767ea4 cba31064 cd767eb8 d0867908 cba31064 d087e09c cd96f034 cd767ec4\n[  214.333957] Call Trace:\n[  214.333957]  [<c12c5e09>] ? skb_dequeue+0x49/0x60\n[  214.333957]  [<c104c4fd>] destroy_workqueue+0xd/0x150\n[  214.333957]  [<d0c10184>] ieee80211_unregister_hw+0xc4/0x100 [mac80211]\n[  214.333957]  [<d0867908>] b43legacy_remove+0x78/0x80 [b43legacy]\n[  214.333957]  [<d083654d>] ssb_device_remove+0x1d/0x30 [ssb]\n[  214.333957]  [<c126f15a>] __device_release_driver+0x5a/0xb0\n[  214.333957]  [<c126fb07>] driver_detach+0x87/0x90\n[  214.333957]  [<c126ef4c>] bus_remove_driver+0x6c/0xe0\n[  214.333957]  [<c1270120>] driver_unregister+0x40/0x70\n[  214.333957]  [<d083686b>] ssb_driver_unregister+0xb/0x10 [ssb]\n[  214.333957]  [<d087c488>] b43legacy_exit+0xd/0xf [b43legacy]\n[  214.333957]  [<c1089dde>] sys_delete_module+0x14e/0x2b0\n[  214.333957]  [<c110a4a7>] ? vfs_write+0xf7/0x150\n[  214.333957]  [<c1240050>] ? tty_write_lock+0x50/0x50\n[  214.333957]  [<c110a6f8>] ? sys_write+0x38/0x70\n[  214.333957]  [<c1397c55>] syscall_call+0x7/0xb\n[  214.333957] Code: bc 27 00 00 00 00 a1 74 61 56 c1 55 89 e5 e8 a3 fc ff ff 5d c3 90 55 89 e5 57 56 89 c6 53 b8 40 ac 62 c1 83 ec 14 e8 bb b7 34 00 <8b> 46 4c 8d 50 01 85 c0 89 56 4c 75 03 83 0e 40 80 05 40 ac 62\n[  214.333957] EIP: [<c104c395>] drain_workqueue+0x15/0x170 SS:ESP 0068:cd767e5c\n[  214.333957] CR2: 000000000000004c\n[  214.341110] ---[ end trace c7e90ec026d875a6 ]---Index: wireless-testing/drivers/net/wireless/b43legacy/main.c\n\nThe problem is fixed by making certain that the ucode pointer is not NULL\nbefore deregistering the driver in mac80211.\n\nSigned-off-by: Larry Finger <Larry.Finger@lwfinger.net>\nSigned-off-by: John W. Linville <linville@tuxdriver.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/bc47348887cfcd40bf867a40425397d660d9c3f1"},{"sha":"f2d1f4efe39313a5100e8725e4d915c50a8bb1a7","author":{"email":"268b168f6e68003afd4dc22fb518c70145f37320@hp.com","name":"Khalid Aziz"},"message":"firmware: Add missing attributes to EFI variable attribute print out from sysfs\n\ncommit 7083909023bbe29b3176e92d2d089def1aa7aa1e upstream.\n\nSome of the EFI variable attributes are missing from print out from\n/sys/firmware/efi/vars/*/attributes. This patch adds those in. It also\nupdates code to use pre-defined constants for masking current value\nof attributes.\n\nSigned-off-by: Khalid Aziz <khalid.aziz@hp.com>\nReviewed-by: Kees Cook <keescook@chromium.org>\nAcked-by: Matthew Garrett <mjg@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/f2d1f4efe39313a5100e8725e4d915c50a8bb1a7"},{"sha":"18188fb5a18b87a9eb6aafc604e883bb5a2db925","author":{"email":"e5de50b86ce1450664c3b7cd3b983ab08cee245f@gmail.com","name":"Elric Fu"},"message":"xHCI: add cmd_ring_state\n\ncommit c181bc5b5d5c79b71203cd10cef97f802fb6f9c1 upstream.\n\nAdding cmd_ring_state for command ring. It helps to verify\nthe current command ring state for controlling the command\nring operations.\n\nThis patch should be backported to kernels as old as 3.0.  The commit\n7ed603ecf8b68ab81f4c83097d3063d43ec73bb8 \"xhci: Add an assertion to\ncheck for virt_dev=0 bug.\" papers over the NULL pointer dereference that\nI now believe is related to a timed out Set Address command.  This (and\nthe four patches that follow it) contain the real fix that also allows\nVIA USB 3.0 hubs to consistently re-enumerate during the plug/unplug\nstress tests.\n\nSigned-off-by: Elric Fu <elricfu1@gmail.com>\nSigned-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>\nTested-by: Miroslav Sabljic <miroslav.sabljic@avl.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/18188fb5a18b87a9eb6aafc604e883bb5a2db925"},{"sha":"85b542a47b853166860e7bb29883c5fd631f13ca","author":{"email":"e5de50b86ce1450664c3b7cd3b983ab08cee245f@gmail.com","name":"Elric Fu"},"message":"xHCI: handle command after aborting the command ring\n\ncommit b63f4053cc8aa22a98e3f9a97845afe6c15d0a0d upstream.\n\nAccording to xHCI spec section 4.6.1.1 and section 4.6.1.2,\nafter aborting a command on the command ring, xHC will\ngenerate a command completion event with its completion\ncode set to Command Ring Stopped at least. If a command is\ncurrently executing at the time of aborting a command, xHC\nalso generate a command completion event with its completion\ncode set to Command Abort. When the command ring is stopped,\nsoftware may remove, add, or rearrage Command Descriptors.\n\nTo cancel a command, software will initialize a command\ndescriptor for the cancel command, and add it into a\ncancel_cmd_list of xhci. When the command ring is stopped,\nsoftware will find the command trbs described by command\ndescriptors in cancel_cmd_list and modify it to No Op\ncommand. If software can't find the matched trbs, we can\nthink it had been finished.\n\nThis patch should be backported to kernels as old as 3.0, that contain\nthe commit 7ed603ecf8b68ab81f4c83097d3063d43ec73bb8 \"xhci: Add an\nassertion to check for virt_dev=0 bug.\" That commit papers over a NULL\npointer dereference, and this patch fixes the underlying issue that\ncaused the NULL pointer dereference.\n\nSigned-off-by: Elric Fu <elricfu1@gmail.com>\nSigned-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>\nTested-by: Miroslav Sabljic <miroslav.sabljic@avl.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/85b542a47b853166860e7bb29883c5fd631f13ca"},{"sha":"97281d1ca3e56486e6f49f86ed6ba66c6117cad5","author":{"email":"e1fb1a05abba8fb04acbcbe6d766da7764320db0@chromium.org","name":"Michael Spang"},"message":"Increase XHCI suspend timeout to 16ms\n\ncommit a6e097dfdfd189b6929af6efa1d289af61858386 upstream.\n\nThe Intel XHCI specification says that after clearing the run/stop bit\nthe controller may take up to 16ms to halt. We've seen a device take\n14ms, which with the current timeout of 10ms causes the kernel to\nabort the suspend. Increasing the timeout to the recommended value\nfixes the problem.\n\nThis patch should be backported to kernels as old as 2.6.37, that\ncontain the commit 5535b1d5f8885695c6ded783c692e3c0d0eda8ca \"USB: xHCI:\nPCI power management implementation\".\n\nSigned-off-by: Michael Spang <spang@chromium.org>\nSigned-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/97281d1ca3e56486e6f49f86ed6ba66c6117cad5"},{"sha":"9c75c3d509db2e128fd0c51a54378a72c8f330e5","author":{"email":"1240f8b9a8d4f8f6d54c4d059a9fef2470495ad4@qualcomm.com","name":"Sujith Manoharan"},"message":"ath9k: Disable ASPM only for AR9285\n\ncommit 046b6802c8d3c8a57448485513bf7291633e0fa3 upstream.\n\nCurrently, ASPM is disabled for all WLAN+BT combo chipsets\nwhen BTCOEX is enabled. This is incorrect since the workaround\nis required only for WB195, which is a AR9285+AR3011 combo\nsolution. Fix this by checking for the HW version when enabling\nthe workaround.\n\nSigned-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>\nTested-by: Paul Stewart <pstew@chromium.org>\nSigned-off-by: John W. Linville <linville@tuxdriver.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/9c75c3d509db2e128fd0c51a54378a72c8f330e5"},{"sha":"ac1fc78cfbc89463e2ac97841be386a5a542a675","author":{"email":"42afb3a19136e88700e8b77002ea6a5a94c16782@googlemail.com","name":"Denys Vlasenko"},"message":"coredump: prevent double-free on an error path in core dumper\n\ncommit f34f9d186df35e5c39163444c43b4fc6255e39c5 upstream.\n\nIn !CORE_DUMP_USE_REGSET case, if elf_note_info_init fails to allocate\nmemory for info->fields, it frees already allocated stuff and returns\nerror to its caller, fill_note_info.  Which in turn returns error to its\ncaller, elf_core_dump.  Which jumps to cleanup label and calls\nfree_note_info, which will happily try to free all info->fields again.\nBOOM.\n\nThis is the fix.\n\nSigned-off-by: Oleg Nesterov <oleg@redhat.com>\nSigned-off-by: Denys Vlasenko <vda.linux@googlemail.com>\nCc: Venu Byravarasu <vbyravarasu@nvidia.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/ac1fc78cfbc89463e2ac97841be386a5a542a675"},{"sha":"669e36efedd333e5817d2a31fde9509d810f4e83","author":{"email":"48a198def0f21664e558e5b3d0e0635a55586a3b@intel.com","name":"xiaojin"},"message":"n_gsm.c: Implement 3GPP27.010 DLC start-up procedure in MUX\n\ncommit 7e8ac7b23b67416700dfb8b4136a4e81ce675b48 upstream.\n\nIn 3GPP27.010 5.8.1, it defined:\nThe TE multiplexer initiates the establishment of the multiplexer control channel by sending a SABM frame on DLCI 0 using the procedures of clause 5.4.1.\nOnce the multiplexer channel is established other DLCs may be established using the procedures of clause 5.4.1.\nThis patch implement 5.8.1 in MUX level, it make sure DLC0 is the first channel to be setup.\n\n[or for those not familiar with the specification: it was possible to try\n and open a data connection while the control channel was not yet fully\n open, which is a spec violation and confuses some modems]\n\nSigned-off-by: xiaojin <jin.xiao@intel.com>\nTested-by: Yin, Fengwei <fengwei.yin@intel.com>\n[tweaked the order we check things and error code]\nSigned-off-by: Alan Cox <alan@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/669e36efedd333e5817d2a31fde9509d810f4e83"},{"sha":"2df240c7d2097d2e07dd171be3ae50c50137080b","author":{"email":"8c0dd04c6ca5d79c1eaeee71b5de75666a31008f@intel.com","name":"Russ Gorby"},"message":"n_gsm: uplink SKBs accumulate on list\n\ncommit 192b6041e75bb4a2aae73834037038cea139a92d upstream.\n\ngsm_dlci_data_kick will not call any output function if tx_bytes > THRESH_LO\nfurthermore it will call the output function only once if tx_bytes == 0\nIf the size of the IP writes are on the order of THRESH_LO\nwe can get into a situation where skbs accumulate on the outbound list\nbeing starved for events to call the output function.\n\ngsm_dlci_data_kick now calls the sweep function when tx_bytes==0\n\nSigned-off-by: Russ Gorby <russ.gorby@intel.com>\nTested-by: Kappel, LaurentX <laurentx.kappel@intel.com>\nSigned-off-by: Alan Cox <alan@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/YoMommaHouse/android_kernel_samsung_klte/commits/2df240c7d2097d2e07dd171be3ae50c50137080b"}]}