{"push_id":623126572,"size":25,"distinct_size":25,"ref":"refs/heads/lollipop","head":"7890002746ee79789b35937e270818461033b786","before":"2b6429efe03c9cb57e1ea8a06f667d4ea874abfd","commits":[{"sha":"aca94817dd9ad209ab904e41362ef45b99c7ee0c","author":{"email":"5b5a0a360fa35167ac197fe6359c229fde284cf2@google.com","name":"Yuchung Cheng"},"message":"tcp: fix false undo corner cases\n\n[ Upstream commit 6e08d5e3c8236e7484229e46fdf92006e1dd4c49 ]\n\nThe undo code assumes that, upon entering loss recovery, TCP\n1) always retransmit something\n2) the retransmission never fails locally (e.g., qdisc drop)\n\nso undo_marker is set in tcp_enter_recovery() and undo_retrans is\nincremented only when tcp_retransmit_skb() is successful.\n\nWhen the assumption is broken because TCP's cwnd is too small to\nretransmit or the retransmit fails locally. The next (DUP)ACK\nwould incorrectly revert the cwnd and the congestion state in\ntcp_try_undo_dsack() or tcp_may_undo(). Subsequent (DUP)ACKs\nmay enter the recovery state. The sender repeatedly enter and\n(incorrectly) exit recovery states if the retransmits continue to\nfail locally while receiving (DUP)ACKs.\n\nThe fix is to initialize undo_retrans to -1 and start counting on\nthe first retransmission. Always increment undo_retrans even if the\nretransmissions fail locally because they couldn't cause DSACKs to\nundo the cwnd reduction.\n\nSigned-off-by: Yuchung Cheng <ycheng@google.com>\nSigned-off-by: Neal Cardwell <ncardwell@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/aca94817dd9ad209ab904e41362ef45b99c7ee0c"},{"sha":"28410980c9ce126262c6537e675a5cc423c0694b","author":{"email":"261da76fe9d2fe2e8bdc22049270af0a9f189e33@gmail.com","name":"Andrey Utkin"},"message":"appletalk: Fix socket referencing in skb\n\n[ Upstream commit 36beddc272c111689f3042bf3d10a64d8a805f93 ]\n\nSetting just skb->sk without taking its reference and setting a\ndestructor is invalid. However, in the places where this was done, skb\nis used in a way not requiring skb->sk setting. So dropping the setting\nof skb->sk.\nThanks to Eric Dumazet <eric.dumazet@gmail.com> for correct solution.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=79441\nReported-by: Ed Martin <edman007@edman007.com>\nSigned-off-by: Andrey Utkin <andrey.krieger.utkin@gmail.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/28410980c9ce126262c6537e675a5cc423c0694b"},{"sha":"cc3ee642153c3807ccd299988e0b7b4c8ab4b6ab","author":{"email":"a5d87d2bd7c424ee5cbdb4e978635bf653d5a005@free-electrons.com","name":"Thomas Petazzoni"},"message":"net: mvneta: fix operation in 10 Mbit/s mode\n\n[ Upstream commit 4d12bc63ab5e48c1d78fa13883cf6fefcea3afb1 ]\n\nAs reported by Maggie Mae Roxas, the mvneta driver doesn't behave\nproperly in 10 Mbit/s mode. This is due to a misconfiguration of the\nMVNETA_GMAC_AUTONEG_CONFIG register: bit MVNETA_GMAC_CONFIG_MII_SPEED\nmust be set for a 100 Mbit/s speed, but cleared for a 10 Mbit/s speed,\nwhich the driver was not properly doing. This commit adjusts that by\nsetting the MVNETA_GMAC_CONFIG_MII_SPEED bit only in 100 Mbit/s mode,\nand relying on the fact that all the speed related bits of this\nregister are cleared at the beginning of the mvneta_adjust_link()\nfunction.\n\nThis problem exists since c5aff18204da0 (\"net: mvneta: driver for\nMarvell Armada 370/XP network unit\") which is the commit that\nintroduced the mvneta driver in the kernel.\n\nCc: <stable@vger.kernel.org> # v3.8+\nFixes: c5aff18204da0 (\"net: mvneta: driver for Marvell Armada 370/XP network unit\")\nReported-by: Maggie Mae Roxas <maggie.mae.roxas@gmail.com>\nCc: Maggie Mae Roxas <maggie.mae.roxas@gmail.com>\nSigned-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/cc3ee642153c3807ccd299988e0b7b4c8ab4b6ab"},{"sha":"a06c73dee2c9c733c28ec214aac74c76d670b3fc","author":{"email":"71a019b94eff525ff623818471ad88e0ecd2aece@fitzsim.org","name":"Thomas Fitzsimmons"},"message":"net: mvneta: Fix big endian issue in mvneta_txq_desc_csum()\n\n[ Upstream commit 0a1985879437d14bda8c90d0dae3455c467d7642 ]\n\nThis commit fixes the command value generated for CSUM calculation\nwhen running in big endian mode.  The Ethernet protocol ID for IP was\nbeing unconditionally byte-swapped in the layer 3 protocol check (with\nswab16), which caused the mvneta driver to not function correctly in\nbig endian mode.  This patch byte-swaps the ID conditionally with\nhtons.\n\nCc: <stable@vger.kernel.org> # v3.13+\nSigned-off-by: Thomas Fitzsimmons <fitzsim@fitzsim.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/a06c73dee2c9c733c28ec214aac74c76d670b3fc"},{"sha":"dbb9f08d6c3553691e0f4bd36dbb61f86a7228da","author":{"email":"6f50513b21952446fbc8c95a8f361b7aa434b7c7@nicira.com","name":"Ben Pfaff"},"message":"netlink: Fix handling of error from netlink_dump().\n\n[ Upstream commit ac30ef832e6af0505b6f0251a6659adcfa74975e ]\n\nnetlink_dump() returns a negative errno value on error.  Until now,\nnetlink_recvmsg() directly recorded that negative value in sk->sk_err, but\nthat's wrong since sk_err takes positive errno values.  (This manifests as\nuserspace receiving a positive return value from the recv() system call,\nfalsely indicating success.) This bug was introduced in the commit that\nstarted checking the netlink_dump() return value, commit b44d211 (netlink:\nhandle errors from netlink_dump()).\n\nMultithreaded Netlink dumps are one way to trigger this behavior in\npractice, as described in the commit message for the userspace workaround\nposted here:\n    http://openvswitch.org/pipermail/dev/2014-June/042339.html\n\nThis commit also fixes the same bug in netlink_poll(), introduced in commit\ncd1df525d (netlink: add flow control for memory mapped I/O).\n\nSigned-off-by: Ben Pfaff <blp@nicira.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/dbb9f08d6c3553691e0f4bd36dbb61f86a7228da"},{"sha":"91ebced344b79ac54f3af88987a10fe03c74f2ad","author":{"email":"6f20f1260d71232ac164dbcd621e9db64127c3a7@emulex.com","name":"Suresh Reddy"},"message":"be2net: set EQ DB clear-intr bit in be_open()\n\n[ Upstream commit 4cad9f3b61c7268fa89ab8096e23202300399b5d ]\n\nOn BE3, if the clear-interrupt bit of the EQ doorbell is not set the first\ntime it is armed, ocassionally we have observed that the EQ doesn't raise\nanymore interrupts even if it is in armed state.\nThis patch fixes this by setting the clear-interrupt bit when EQs are\narmed for the first time in be_open().\n\nSigned-off-by: Suresh Reddy <Suresh.Reddy@emulex.com>\nSigned-off-by: Sathya Perla <sathya.perla@emulex.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/91ebced344b79ac54f3af88987a10fe03c74f2ad"},{"sha":"0ed7cc2d13c27b90c074f17aa9b266eade156131","author":{"email":"0e60c7c02f6d30eccc82572d2a89766b1b2a3d45@ericsson.com","name":"Jon Paul Maloy"},"message":"tipc: clear 'next'-pointer of message fragments before reassembly\n\n[ Upstream commit 999417549c16dd0e3a382aa9f6ae61688db03181 ]\n\nIf the 'next' pointer of the last fragment buffer in a message is not\nzeroed before reassembly, we risk ending up with a corrupt message,\nsince the reassembly function itself isn't doing this.\n\nCurrently, when a buffer is retrieved from the deferred queue of the\nbroadcast link, the next pointer is not cleared, with the result as\ndescribed above.\n\nThis commit corrects this, and thereby fixes a bug that may occur when\nlong broadcast messages are transmitted across dual interfaces. The bug\nhas been present since 40ba3cdf542a469aaa9083fa041656e59b109b90 (\"tipc:\nmessage reassembly using fragment chain\")\n\nThis commit should be applied to both net and net-next.\n\nSigned-off-by: Jon Maloy <jon.maloy@ericsson.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/0ed7cc2d13c27b90c074f17aa9b266eade156131"},{"sha":"e093fe3d8241cf715792701c0fb39558d8c70930","author":{"email":"9ff04a02a69f376b2b9aeec27187017cbf3cf5f9@redhat.com","name":"Daniel Borkmann"},"message":"net: sctp: fix information leaks in ulpevent layer\n\n[ Upstream commit 8f2e5ae40ec193bc0a0ed99e95315c3eebca84ea ]\n\nWhile working on some other SCTP code, I noticed that some\nstructures shared with user space are leaking uninitialized\nstack or heap buffer. In particular, struct sctp_sndrcvinfo\nhas a 2 bytes hole between .sinfo_flags and .sinfo_ppid that\nremains unfilled by us in sctp_ulpevent_read_sndrcvinfo() when\nputting this into cmsg. But also struct sctp_remote_error\ncontains a 2 bytes hole that we don't fill but place into a skb\nthrough skb_copy_expand() via sctp_ulpevent_make_remote_error().\n\nBoth structures are defined by the IETF in RFC6458:\n\n* Section 5.3.2. SCTP Header Information Structure:\n\n  The sctp_sndrcvinfo structure is defined below:\n\n  struct sctp_sndrcvinfo {\n    uint16_t sinfo_stream;\n    uint16_t sinfo_ssn;\n    uint16_t sinfo_flags;\n    <-- 2 bytes hole  -->\n    uint32_t sinfo_ppid;\n    uint32_t sinfo_context;\n    uint32_t sinfo_timetolive;\n    uint32_t sinfo_tsn;\n    uint32_t sinfo_cumtsn;\n    sctp_assoc_t sinfo_assoc_id;\n  };\n\n* 6.1.3. SCTP_REMOTE_ERROR:\n\n  A remote peer may send an Operation Error message to its peer.\n  This message indicates a variety of error conditions on an\n  association. The entire ERROR chunk as it appears on the wire\n  is included in an SCTP_REMOTE_ERROR event. Please refer to the\n  SCTP specification [RFC4960] and any extensions for a list of\n  possible error formats. An SCTP error notification has the\n  following format:\n\n  struct sctp_remote_error {\n    uint16_t sre_type;\n    uint16_t sre_flags;\n    uint32_t sre_length;\n    uint16_t sre_error;\n    <-- 2 bytes hole  -->\n    sctp_assoc_t sre_assoc_id;\n    uint8_t  sre_data[];\n  };\n\nFix this by setting both to 0 before filling them out. We also\nhave other structures shared between user and kernel space in\nSCTP that contains holes (e.g. struct sctp_paddrthlds), but we\ncopy that buffer over from user space first and thus don't need\nto care about it in that cases.\n\nWhile at it, we can also remove lengthy comments copied from\nthe draft, instead, we update the comment with the correct RFC\nnumber where one can look it up.\n\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/e093fe3d8241cf715792701c0fb39558d8c70930"},{"sha":"53b85d8fc5f8ae12658c156b35a10a070a572419","author":{"email":"418a6bc4deccf0f7d5182192d51a54e504b3f3c9@kristov.de","name":"Christoph Schulz"},"message":"net: pppoe: use correct channel MTU when using Multilink PPP\n\n[ Upstream commit a8a3e41c67d24eb12f9ab9680cbb85e24fcd9711 ]\n\nThe PPP channel MTU is used with Multilink PPP when ppp_mp_explode() (see\nppp_generic module) tries to determine how big a fragment might be. According\nto RFC 1661, the MTU excludes the 2-byte PPP protocol field, see the\ncorresponding comment and code in ppp_mp_explode():\n\n\t\t/*\n\t\t * hdrlen includes the 2-byte PPP protocol field, but the\n\t\t * MTU counts only the payload excluding the protocol field.\n\t\t * (RFC1661 Section 2)\n\t\t */\n\t\tmtu = pch->chan->mtu - (hdrlen - 2);\n\nHowever, the pppoe module *does* include the PPP protocol field in the channel\nMTU, which is wrong as it causes the PPP payload to be 1-2 bytes too big under\ncertain circumstances (one byte if PPP protocol compression is used, two\notherwise), causing the generated Ethernet packets to be dropped. So the pppoe\nmodule has to subtract two bytes from the channel MTU. This error only\nmanifests itself when using Multilink PPP, as otherwise the channel MTU is not\nused anywhere.\n\nIn the following, I will describe how to reproduce this bug. We configure two\npppd instances for multilink PPP over two PPPoE links, say eth2 and eth3, with\na MTU of 1492 bytes for each link and a MRRU of 2976 bytes. (This MRRU is\ncomputed by adding the two link MTUs and subtracting the MP header twice, which\nis 4 bytes long.) The necessary pppd statements on both sides are \"multilink\nmtu 1492 mru 1492 mrru 2976\". On the client side, we additionally need \"plugin\nrp-pppoe.so eth2\" and \"plugin rp-pppoe.so eth3\", respectively; on the server\nside, we additionally need to start two pppoe-server instances to be able to\nestablish two PPPoE sessions, one over eth2 and one over eth3. We set the MTU\nof the PPP network interface to the MRRU (2976) on both sides of the connection\nin order to make use of the higher bandwidth. (If we didn't do that, IP\nfragmentation would kick in, which we want to avoid.)\n\nNow we send a ICMPv4 echo request with a payload of 2948 bytes from client to\nserver over the PPP link. This results in the following network packet:\n\n   2948 (echo payload)\n +    8 (ICMPv4 header)\n +   20 (IPv4 header)\n---------------------\n   2976 (PPP payload)\n\nThese 2976 bytes do not exceed the MTU of the PPP network interface, so the\nIP packet is not fragmented. Now the multilink PPP code in ppp_mp_explode()\nprepends one protocol byte (0x21 for IPv4), making the packet one byte bigger\nthan the negotiated MRRU. So this packet would have to be divided in three\nfragments. But this does not happen as each link MTU is assumed to be two bytes\nlarger. So this packet is diveded into two fragments only, one of size 1489 and\none of size 1488. Now we have for that bigger fragment:\n\n   1489 (PPP payload)\n +    4 (MP header)\n +    2 (PPP protocol field for the MP payload (0x3d))\n +    6 (PPPoE header)\n--------------------------\n   1501 (Ethernet payload)\n\nThis packet exceeds the link MTU and is discarded.\n\nIf one configures the link MTU on the client side to 1501, one can see the\ndiscarded Ethernet frames with tcpdump running on the client. A\n\nping -s 2948 -c 1 192.168.15.254\n\nleads to the smaller fragment that is correctly received on the server side:\n\n(tcpdump -vvvne -i eth3 pppoes and ppp proto 0x3d)\n52:54:00:ad:87:fd > 52:54:00:79:5c:d0, ethertype PPPoE S (0x8864),\n  length 1514: PPPoE  [ses 0x3] MLPPP (0x003d), length 1494: seq 0x000,\n  Flags [end], length 1492\n\nand to the bigger fragment that is not received on the server side:\n\n(tcpdump -vvvne -i eth2 pppoes and ppp proto 0x3d)\n52:54:00:70:9e:89 > 52:54:00:5d:6f:b0, ethertype PPPoE S (0x8864),\n  length 1515: PPPoE  [ses 0x5] MLPPP (0x003d), length 1495: seq 0x000,\n  Flags [begin], length 1493\n\nWith the patch below, we correctly obtain three fragments:\n\n52:54:00:ad:87:fd > 52:54:00:79:5c:d0, ethertype PPPoE S (0x8864),\n  length 1514: PPPoE  [ses 0x1] MLPPP (0x003d), length 1494: seq 0x000,\n  Flags [begin], length 1492\n52:54:00:70:9e:89 > 52:54:00:5d:6f:b0, ethertype PPPoE S (0x8864),\n  length 1514: PPPoE  [ses 0x1] MLPPP (0x003d), length 1494: seq 0x000,\n  Flags [none], length 1492\n52:54:00:ad:87:fd > 52:54:00:79:5c:d0, ethertype PPPoE S (0x8864),\n  length 27: PPPoE  [ses 0x1] MLPPP (0x003d), length 7: seq 0x000,\n  Flags [end], length 5\n\nAnd the ICMPv4 echo request is successfully received at the server side:\n\nIP (tos 0x0, ttl 64, id 21925, offset 0, flags [DF], proto ICMP (1),\n  length 2976)\n    192.168.222.2 > 192.168.15.254: ICMP echo request, id 30530, seq 0,\n      length 2956\n\nThe bug was introduced in commit c9aa6895371b2a257401f59d3393c9f7ac5a8698\n(\"[PPPOE]: Advertise PPPoE MTU\") from the very beginning. This patch applies\nto 3.10 upwards but the fix can be applied (with minor modifications) to\nkernels as old as 2.6.32.\n\nSigned-off-by: Christoph Schulz <develop@kristov.de>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/53b85d8fc5f8ae12658c156b35a10a070a572419"},{"sha":"d5159a25b2ed9a97be7429bbaef8658beac06a84","author":{"email":"1a53202f7826b15a582486d4ea9c371e05720251@oracle.com","name":"Sowmini Varadhan"},"message":"sunvnet: clean up objects created in vnet_new() on vnet_exit()\n\n[ Upstream commit a4b70a07ed12a71131cab7adce2ce91c71b37060 ]\n\nNothing cleans up the objects created by\nvnet_new(), they are completely leaked.\n\nvnet_exit(), after doing the vio_unregister_driver() to clean\nup ports, should call a helper function that iterates over vnet_list\nand cleans up those objects. This includes unregister_netdevice()\nas well as free_netdev().\n\nSigned-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>\nAcked-by: Dave Kleikamp <dave.kleikamp@oracle.com>\nReviewed-by: Karl Volz <karl.volz@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/d5159a25b2ed9a97be7429bbaef8658beac06a84"},{"sha":"d460bc9c824b8ae9bf7ba61c052e32f29e79c73e","author":{"email":"4ee0d7378f23119b0354d244027bbe5e74d3b1ce@gmx.de","name":"Manuel Schölling"},"message":"dns_resolver: assure that dns_query() result is null-terminated\n\n[ Upstream commit 84a7c0b1db1c17d5ded8d3800228a608e1070b40 ]\n\ndns_query() credulously assumes that keys are null-terminated and\nreturns a copy of a memory block that is off by one.\n\nSigned-off-by: Manuel Schölling <manuel.schoelling@gmx.de>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/d460bc9c824b8ae9bf7ba61c052e32f29e79c73e"},{"sha":"564c8b6c3ff7e7bf1d88adec1109d32b09a214d6","author":{"email":"73675debcd8a436be48ec22211dcf44fe0df0a64@decadent.org.uk","name":"Ben Hutchings"},"message":"dns_resolver: Null-terminate the right string\n\n[ Upstream commit 640d7efe4c08f06c4ae5d31b79bd8740e7f6790a ]\n\n*_result[len] is parsed as *(_result[len]) which is not at all what we\nwant to touch here.\n\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nFixes: 84a7c0b1db1c (\"dns_resolver: assure that dns_query() result is null-terminated\")\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/564c8b6c3ff7e7bf1d88adec1109d32b09a214d6"},{"sha":"0e8ec3c997c20218b4c97fe1ded7b3748a43eddd","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"ipv4: fix buffer overflow in ip_options_compile()\n\n[ Upstream commit 10ec9472f05b45c94db3c854d22581a20b97db41 ]\n\nThere is a benign buffer overflow in ip_options_compile spotted by\nAddressSanitizer[1] :\n\nIts benign because we always can access one extra byte in skb->head\n(because header is followed by struct skb_shared_info), and in this case\nthis byte is not even used.\n\n[28504.910798] ==================================================================\n[28504.912046] AddressSanitizer: heap-buffer-overflow in ip_options_compile\n[28504.913170] Read of size 1 by thread T15843:\n[28504.914026]  [<ffffffff81802f91>] ip_options_compile+0x121/0x9c0\n[28504.915394]  [<ffffffff81804a0d>] ip_options_get_from_user+0xad/0x120\n[28504.916843]  [<ffffffff8180dedf>] do_ip_setsockopt.isra.15+0x8df/0x1630\n[28504.918175]  [<ffffffff8180ec60>] ip_setsockopt+0x30/0xa0\n[28504.919490]  [<ffffffff8181e59b>] tcp_setsockopt+0x5b/0x90\n[28504.920835]  [<ffffffff8177462f>] sock_common_setsockopt+0x5f/0x70\n[28504.922208]  [<ffffffff817729c2>] SyS_setsockopt+0xa2/0x140\n[28504.923459]  [<ffffffff818cfb69>] system_call_fastpath+0x16/0x1b\n[28504.924722]\n[28504.925106] Allocated by thread T15843:\n[28504.925815]  [<ffffffff81804995>] ip_options_get_from_user+0x35/0x120\n[28504.926884]  [<ffffffff8180dedf>] do_ip_setsockopt.isra.15+0x8df/0x1630\n[28504.927975]  [<ffffffff8180ec60>] ip_setsockopt+0x30/0xa0\n[28504.929175]  [<ffffffff8181e59b>] tcp_setsockopt+0x5b/0x90\n[28504.930400]  [<ffffffff8177462f>] sock_common_setsockopt+0x5f/0x70\n[28504.931677]  [<ffffffff817729c2>] SyS_setsockopt+0xa2/0x140\n[28504.932851]  [<ffffffff818cfb69>] system_call_fastpath+0x16/0x1b\n[28504.934018]\n[28504.934377] The buggy address ffff880026382828 is located 0 bytes to the right\n[28504.934377]  of 40-byte region [ffff880026382800, ffff880026382828)\n[28504.937144]\n[28504.937474] Memory state around the buggy address:\n[28504.938430]  ffff880026382300: ........ rrrrrrrr rrrrrrrr rrrrrrrr\n[28504.939884]  ffff880026382400: ffffffff rrrrrrrr rrrrrrrr rrrrrrrr\n[28504.941294]  ffff880026382500: .....rrr rrrrrrrr rrrrrrrr rrrrrrrr\n[28504.942504]  ffff880026382600: ffffffff rrrrrrrr rrrrrrrr rrrrrrrr\n[28504.943483]  ffff880026382700: ffffffff rrrrrrrr rrrrrrrr rrrrrrrr\n[28504.944511] >ffff880026382800: .....rrr rrrrrrrr rrrrrrrr rrrrrrrr\n[28504.945573]                         ^\n[28504.946277]  ffff880026382900: ffffffff rrrrrrrr rrrrrrrr rrrrrrrr\n[28505.094949]  ffff880026382a00: ffffffff rrrrrrrr rrrrrrrr rrrrrrrr\n[28505.096114]  ffff880026382b00: ffffffff rrrrrrrr rrrrrrrr rrrrrrrr\n[28505.097116]  ffff880026382c00: ffffffff rrrrrrrr rrrrrrrr rrrrrrrr\n[28505.098472]  ffff880026382d00: ffffffff rrrrrrrr rrrrrrrr rrrrrrrr\n[28505.099804] Legend:\n[28505.100269]  f - 8 freed bytes\n[28505.100884]  r - 8 redzone bytes\n[28505.101649]  . - 8 allocated bytes\n[28505.102406]  x=1..7 - x allocated bytes + (8-x) redzone bytes\n[28505.103637] ==================================================================\n\n[1] https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/0e8ec3c997c20218b4c97fe1ded7b3748a43eddd"},{"sha":"ed97d2d360bc16c1bfd4ed1a9def2d522a52cb1d","author":{"email":"e293c7e13ecc029aa287dca4b8ecfdf8a10ea3b9@jp.fujitsu.com","name":"HATAYAMA Daisuke"},"message":"perf/x86/intel: ignore CondChgd bit to avoid false NMI handling\n\ncommit b292d7a10487aee6e74b1c18b8d95b92f40d4a4f upstream.\n\nCurrently, any NMI is falsely handled by a NMI handler of NMI watchdog\nif CondChgd bit in MSR_CORE_PERF_GLOBAL_STATUS MSR is set.\n\nFor example, we use external NMI to make system panic to get crash\ndump, but in this case, the external NMI is falsely handled do to the\nissue.\n\nThis commit deals with the issue simply by ignoring CondChgd bit.\n\nHere is explanation in detail.\n\nOn x86 NMI watchdog uses performance monitoring feature to\nperiodically signal NMI each time performance counter gets overflowed.\n\nintel_pmu_handle_irq() is called as a NMI_LOCAL handler from a NMI\nhandler of NMI watchdog, perf_event_nmi_handler(). It identifies an\nowner of a given NMI by looking at overflow status bits in\nMSR_CORE_PERF_GLOBAL_STATUS MSR. If some of the bits are set, then it\nhandles the given NMI as its own NMI.\n\nThe problem is that the intel_pmu_handle_irq() doesn't distinguish\nCondChgd bit from other bits. Unlike the other status bits, CondChgd\nbit doesn't represent overflow status for performance counters. Thus,\nCondChgd bit cannot be thought of as a mark indicating a given NMI is\nNMI watchdog's.\n\nAs a result, if CondChgd bit is set, any NMI is falsely handled by the\nNMI handler of NMI watchdog. Also, if type of the falsely handled NMI\nis either NMI_UNKNOWN, NMI_SERR or NMI_IO_CHECK, the corresponding\naction is never performed until CondChgd bit is cleared.\n\nI noticed this behavior on systems with Ivy Bridge processors: Intel\nXeon CPU E5-2630 v2 and Intel Xeon CPU E7-8890 v2. On both systems,\nCondChgd bit in MSR_CORE_PERF_GLOBAL_STATUS MSR has already been set\nin the beginning at boot. Then the CondChgd bit is immediately cleared\nby next wrmsr to MSR_CORE_PERF_GLOBAL_CTRL MSR and appears to remain\n0.\n\nOn the other hand, on older processors such as Nehalem, Xeon E7540,\nCondChgd bit is not set in the beginning at boot.\n\nI'm not sure about exact behavior of CondChgd bit, in particular when\nthis bit is set. Although I read Intel System Programmer's Manual to\nfigure out that, the descriptions I found are:\n\n  In 18.9.1:\n\n  \"The MSR_PERF_GLOBAL_STATUS MSR also provides a ¡sticky bit¢ to\n   indicate changes to the state of performancmonitoring hardware\"\n\n  In Table 35-2 IA-32 Architectural MSRs\n\n  63 CondChg: status bits of this register has changed.\n\nThese are different from the bahviour I see on the actual system as I\nexplained above.\n\nAt least, I think ignoring CondChgd bit should be enough for NMI\nwatchdog perspective.\n\nSigned-off-by: HATAYAMA Daisuke <d.hatayama@jp.fujitsu.com>\nAcked-by: Don Zickus <dzickus@redhat.com>\nSigned-off-by: Peter Zijlstra <peterz@infradead.org>\nCc: Arnaldo Carvalho de Melo <acme@kernel.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: linux-kernel@vger.kernel.org\nLink: http://lkml.kernel.org/r/20140625.103503.409316067.d.hatayama@jp.fujitsu.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/ed97d2d360bc16c1bfd4ed1a9def2d522a52cb1d"},{"sha":"f3d0ed53c99d2df5b0c06c23a143165c4d4e788d","author":{"email":"7343c7ffb424bf4c3ebd1cd0c94117b3c12118ff@marvell.com","name":"Amitkumar Karwar"},"message":"mwifiex: fix Tx timeout issue\n\ncommit d76744a93246eccdca1106037e8ee29debf48277 upstream.\n\nhttps://bugzilla.kernel.org/show_bug.cgi?id=70191\nhttps://bugzilla.kernel.org/show_bug.cgi?id=77581\n\nIt is observed that sometimes Tx packet is downloaded without\nadding driver's txpd header. This results in firmware parsing\ngarbage data as packet length. Sometimes firmware is unable\nto read the packet if length comes out as invalid. This stops\nfurther traffic and timeout occurs.\n\nThe root cause is uninitialized fields in tx_info(skb->cb) of\npacket used to get garbage values. In this case if\nMWIFIEX_BUF_FLAG_REQUEUED_PKT flag is mistakenly set, txpd\nheader was skipped. This patch makes sure that tx_info is\ncorrectly initialized to fix the problem.\n\nReported-by: Andrew Wiley <wiley.andrew.j@gmail.com>\nReported-by: Linus Gasser <list@markas-al-nour.org>\nReported-by: Michael Hirsch <hirsch@teufel.de>\nTested-by: Xinming Hu <huxm@marvell.com>\nSigned-off-by: Amitkumar Karwar <akarwar@marvell.com>\nSigned-off-by: Maithili Hinge <maithili@marvell.com>\nSigned-off-by: Avinash Patil <patila@marvell.com>\nSigned-off-by: Bing Zhao <bzhao@marvell.com>\nSigned-off-by: John W. Linville <linville@tuxdriver.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/f3d0ed53c99d2df5b0c06c23a143165c4d4e788d"},{"sha":"6213867b4580d7932b3913dcd549f93933505a68","author":{"email":"2c0d8efbe28c4f7a45c3ab30c984ed2c126716bd@fb.com","name":"Martin Lau"},"message":"ring-buffer: Fix polling on trace_pipe\n\ncommit 97b8ee845393701edc06e27ccec2876ff9596019 upstream.\n\nring_buffer_poll_wait() should always put the poll_table to its wait_queue\neven there is immediate data available.  Otherwise, the following epoll and\nread sequence will eventually hang forever:\n\n1. Put some data to make the trace_pipe ring_buffer read ready first\n2. epoll_ctl(efd, EPOLL_CTL_ADD, trace_pipe_fd, ee)\n3. epoll_wait()\n4. read(trace_pipe_fd) till EAGAIN\n5. Add some more data to the trace_pipe ring_buffer\n6. epoll_wait() -> this epoll_wait() will block forever\n\n~ During the epoll_ctl(efd, EPOLL_CTL_ADD,...) call in step 2,\n  ring_buffer_poll_wait() returns immediately without adding poll_table,\n  which has poll_table->_qproc pointing to ep_poll_callback(), to its\n  wait_queue.\n~ During the epoll_wait() call in step 3 and step 6,\n  ring_buffer_poll_wait() cannot add ep_poll_callback() to its wait_queue\n  because the poll_table->_qproc is NULL and it is how epoll works.\n~ When there is new data available in step 6, ring_buffer does not know\n  it has to call ep_poll_callback() because it is not in its wait queue.\n  Hence, block forever.\n\nOther poll implementation seems to call poll_wait() unconditionally as the very\nfirst thing to do.  For example, tcp_poll() in tcp.c.\n\nLink: http://lkml.kernel.org/p/20140610060637.GA14045@devbig242.prn2.facebook.com\n\nFixes: 2a2cc8f7c4d0 \"ftrace: allow the event pipe to be polled\"\nReviewed-by: Chris Mason <clm@fb.com>\nSigned-off-by: Martin Lau <kafai@fb.com>\nSigned-off-by: Steven Rostedt <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/6213867b4580d7932b3913dcd549f93933505a68"},{"sha":"051ce62bb9b3654d077b28440386973902170652","author":{"email":"28c780319e2c7f6db09304375fbd148f9c25d13f@gmail.com","name":"Matthias Brugger"},"message":"irqchip: gic: Add support for cortex a7 compatible string\n\ncommit a97e8027b1d28eafe6bafe062556c1ec926a49c6 upstream.\n\nPatch 0a68214b \"ARM: DT: Add binding for GIC virtualization extentions (VGIC)\" added\nthe \"arm,cortex-a7-gic\" compatible string, but the corresponding IRQCHIP_DECLARE\nwas never added to the gic driver.\n\nTo let real Cortex-A7 SoCs use it, add the necessary declaration to the device driver.\n\nSigned-off-by: Matthias Brugger <matthias.bgg@gmail.com>\nLink: https://lkml.kernel.org/r/1404388732-28890-1-git-send-email-matthias.bgg@gmail.com\nFixes: 0a68214b76ca (\"ARM: DT: Add binding for GIC virtualization extentions (VGIC)\")\nSigned-off-by: Jason Cooper <jason@lakedaemon.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/051ce62bb9b3654d077b28440386973902170652"},{"sha":"ecb63c36a1ea684b1eb8f63a990b02ea7c5f94ee","author":{"email":"c4885e520559c7b5b4fe1e9e188b924d2debd35e@samsung.com","name":"Tomasz Figa"},"message":"irqchip: gic: Fix core ID calculation when topology is read from DT\n\ncommit 29e697b11853d3f83b1864ae385abdad4aa2c361 upstream.\n\nCertain GIC implementation, namely those found on earlier, single\ncluster, Exynos SoCs, have registers mapped without per-CPU banking,\nwhich means that the driver needs to use different offset for each CPU.\n\nCurrently the driver calculates the offset by multiplying value returned\nby cpu_logical_map() by CPU offset parsed from DT. This is correct when\nCPU topology is not specified in DT and aforementioned function returns\ncore ID alone. However when DT contains CPU topology, the function\nchanges to return cluster ID as well, which is non-zero on mentioned\nSoCs and so breaks the calculation in GIC driver.\n\nThis patch fixes this by masking out cluster ID in CPU offset\ncalculation so that only core ID is considered. Multi-cluster Exynos\nSoCs already have banked GIC implementations, so this simple fix should\nbe enough.\n\nReported-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>\nReported-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>\nSigned-off-by: Tomasz Figa <t.figa@samsung.com>\nFixes: db0d4db22a78d (\"ARM: gic: allow GIC to support non-banked setups\")\nLink: https://lkml.kernel.org/r/1405610624-18722-1-git-send-email-t.figa@samsung.com\nSigned-off-by: Jason Cooper <jason@lakedaemon.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/ecb63c36a1ea684b1eb8f63a990b02ea7c5f94ee"},{"sha":"8eea86d83033856e72f26a5522127c3399161106","author":{"email":"08dc22c6156113f2deff178e35e3ed9b24d6af9e@amd.com","name":"Alex Deucher"},"message":"drm/radeon: set default bl level to something reasonable\n\ncommit 201bb62402e0227375c655446ea04fcd0acf7287 upstream.\n\nIf the value in the scratch register is 0, set it to the\nmax level.  This fixes an issue where the console fb blanking\ncode calls back into the backlight driver on unblank and then\nsets the backlight level to 0 after the driver has already\nset the mode and enabled the backlight.\n\nbugs:\nhttps://bugs.freedesktop.org/show_bug.cgi?id=81382\nhttps://bugs.freedesktop.org/show_bug.cgi?id=70207\n\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nTested-by: David Heidelberger <david.heidelberger@ixit.cz>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/8eea86d83033856e72f26a5522127c3399161106"},{"sha":"a6e23be0aaf9dbd3f2acd9bb73f79bf4acfdc7e6","author":{"email":"808efd45667dbd241e4e026b5673172419ecb43e@redhat.com","name":"Jason Wang"},"message":"drm/qxl: return IRQ_NONE if it was not our irq\n\ncommit fbb60fe35ad579b511de8604b06a30b43846473b upstream.\n\nReturn IRQ_NONE if it was not our irq. This is necessary for the case\nwhen qxl is sharing irq line with a device A in a crash kernel. If qxl\nis initialized before A and A's irq was raised during this gap,\nreturning IRQ_HANDLED in this case will cause this irq to be raised\nagain after EOI since kernel think it was handled but in fact it was\nnot.\n\nCc: Gerd Hoffmann <kraxel@redhat.com>\nSigned-off-by: Jason Wang <jasowang@redhat.com>\nSigned-off-by: Dave Airlie <airlied@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/nychitman1/android_kernel_htc_flounder/commits/a6e23be0aaf9dbd3f2acd9bb73f79bf4acfdc7e6"}]}