{"push_id":680444506,"size":66,"distinct_size":1,"ref":"refs/heads/android-tegra-flounder-3.10-m-preview","head":"605a86c0901aed6dfa8497483430d969d908630e","before":"523889339bb24f29017f624af119b81fb0f977a1","commits":[{"sha":"fb138c4699c94b16bf9400394142c6d86fe70226","author":{"email":"7b8d3696a9dd47ee3daf66a5e039df0a275cda03@gmail.com","name":"Sebastian Pöhn"},"message":"ip_forward: Drop frames with attached skb->sk\n\n[ Upstream commit 2ab957492d13bb819400ac29ae55911d50a82a13 ]\n\nInitial discussion was:\n[FYI] xfrm: Don't lookup sk_policy for timewait sockets\n\nForwarded frames should not have a socket attached. Especially\ntw sockets will lead to panics later-on in the stack.\n\nThis was observed with TPROXY assigning a tw socket and broken\npolicy routing (misconfigured). As a result frame enters\nforwarding path instead of input. We cannot solve this in\nTPROXY as it cannot know that policy routing is broken.\n\nv2:\nRemove useless comment\n\nSigned-off-by: Sebastian Poehn <sebastian.poehn@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/fb138c4699c94b16bf9400394142c6d86fe70226"},{"sha":"aac9fda375bbe75e0b8c033874af25e0f7f5a3a4","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"tcp: fix possible deadlock in tcp_send_fin()\n\n[ Upstream commit d83769a580f1132ac26439f50068a29b02be535e ]\n\nUsing sk_stream_alloc_skb() in tcp_send_fin() is dangerous in\ncase a huge process is killed by OOM, and tcp_mem[2] is hit.\n\nTo be able to free memory we need to make progress, so this\npatch allows FIN packets to not care about tcp_mem[2], if\nskb allocation succeeded.\n\nIn a follow-up patch, we might abort tcp_send_fin() infinite loop\nin case TIF_MEMDIE is set on this thread, as memory allocator\ndid its best getting extra memory already.\n\nThis patch reverts d22e15371811 (\"tcp: fix tcp fin memory accounting\")\n\nFixes: d22e15371811 (\"tcp: fix tcp fin memory accounting\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/aac9fda375bbe75e0b8c033874af25e0f7f5a3a4"},{"sha":"bc9f0ea1c736358f2db263ee2afe5af5a9dfcf2a","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"tcp: avoid looping in tcp_send_fin()\n\n[ Upstream commit 845704a535e9b3c76448f52af1b70e4422ea03fd ]\n\nPresence of an unbound loop in tcp_send_fin() had always been hard\nto explain when analyzing crash dumps involving gigantic dying processes\nwith millions of sockets.\n\nLets try a different strategy :\n\nIn case of memory pressure, try to add the FIN flag to last packet\nin write queue, even if packet was already sent. TCP stack will\nbe able to deliver this FIN after a timeout event. Note that this\nFIN being delivered by a retransmit, it also carries a Push flag\ngiven our current implementation.\n\nBy checking sk_under_memory_pressure(), we anticipate that cooking\nmany FIN packets might deplete tcp memory.\n\nIn the case we could not allocate a packet, even with __GFP_WAIT\nallocation, then not sending a FIN seems quite reasonable if it allows\nto get rid of this socket, free memory, and not block the process from\neventually doing other useful work.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/bc9f0ea1c736358f2db263ee2afe5af5a9dfcf2a"},{"sha":"bf339141f604388ace1c3f97b9297683f45170dd","author":{"email":"e0fcd583df77ec6c08e6d1257619cc1216ddc994@suse.com","name":"Filipe Manana"},"message":"Btrfs: fix log tree corruption when fs mounted with -o discard\n\ncommit dcc82f4783ad91d4ab654f89f37ae9291cdc846a upstream.\n\nWhile committing a transaction we free the log roots before we write the\nnew super block. Freeing the log roots implies marking the disk location\nof every node/leaf (metadata extent) as pinned before the new super block\nis written. This is to prevent the disk location of log metadata extents\nfrom being reused before the new super block is written, otherwise we\nwould have a corrupted log tree if before the new super block is written\na crash/reboot happens and the location of any log tree metadata extent\nended up being reused and rewritten.\n\nEven though we pinned the log tree's metadata extents, we were issuing a\ndiscard against them if the fs was mounted with the -o discard option,\nresulting in corruption of the log tree if a crash/reboot happened before\nwriting the new super block - the next time the fs was mounted, during\nthe log replay process we would find nodes/leafs of the log btree with\na content full of zeroes, causing the process to fail and require the\nuse of the tool btrfs-zero-log to wipeout the log tree (and all data\npreviously fsynced becoming lost forever).\n\nFix this by not doing a discard when pinning an extent. The discard will\nbe done later when it's safe (after the new super block is committed) at\nextent-tree.c:btrfs_finish_extent_commit().\n\nFixes: e688b7252f78 (Btrfs: fix extent pinning bugs in the tree log)\nSigned-off-by: Filipe Manana <fdmanana@suse.com>\nSigned-off-by: Chris Mason <clm@fb.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/bf339141f604388ace1c3f97b9297683f45170dd"},{"sha":"6073c4162289fcae16b359f8e105d60343a209ca","author":{"email":"e0fcd583df77ec6c08e6d1257619cc1216ddc994@suse.com","name":"Filipe Manana"},"message":"Btrfs: fix inode eviction infinite loop after cloning into it\n\ncommit ccccf3d67294714af2d72a6fd6fd7d73b01c9329 upstream.\n\nIf we attempt to clone a 0 length region into a file we can end up\ninserting a range in the inode's extent_io tree with a start offset\nthat is greater then the end offset, which triggers immediately the\nfollowing warning:\n\n[ 3914.619057] WARNING: CPU: 17 PID: 4199 at fs/btrfs/extent_io.c:435 insert_state+0x4b/0x10b [btrfs]()\n[ 3914.620886] BTRFS: end < start 4095 4096\n(...)\n[ 3914.638093] Call Trace:\n[ 3914.638636]  [<ffffffff81425fd9>] dump_stack+0x4c/0x65\n[ 3914.639620]  [<ffffffff81045390>] warn_slowpath_common+0xa1/0xbb\n[ 3914.640789]  [<ffffffffa03ca44f>] ? insert_state+0x4b/0x10b [btrfs]\n[ 3914.642041]  [<ffffffff810453f0>] warn_slowpath_fmt+0x46/0x48\n[ 3914.643236]  [<ffffffffa03ca44f>] insert_state+0x4b/0x10b [btrfs]\n[ 3914.644441]  [<ffffffffa03ca729>] __set_extent_bit+0x107/0x3f4 [btrfs]\n[ 3914.645711]  [<ffffffffa03cb256>] lock_extent_bits+0x65/0x1bf [btrfs]\n[ 3914.646914]  [<ffffffff8142b2fb>] ? _raw_spin_unlock+0x28/0x33\n[ 3914.648058]  [<ffffffffa03cbac4>] ? test_range_bit+0xcc/0xde [btrfs]\n[ 3914.650105]  [<ffffffffa03cb3c3>] lock_extent+0x13/0x15 [btrfs]\n[ 3914.651361]  [<ffffffffa03db39e>] lock_extent_range+0x3d/0xcd [btrfs]\n[ 3914.652761]  [<ffffffffa03de1fe>] btrfs_ioctl_clone+0x278/0x388 [btrfs]\n[ 3914.654128]  [<ffffffff811226dd>] ? might_fault+0x58/0xb5\n[ 3914.655320]  [<ffffffffa03e0909>] btrfs_ioctl+0xb51/0x2195 [btrfs]\n(...)\n[ 3914.669271] ---[ end trace 14843d3e2e622fc1 ]---\n\nThis later makes the inode eviction handler enter an infinite loop that\nkeeps dumping the following warning over and over:\n\n[ 3915.117629] WARNING: CPU: 22 PID: 4228 at fs/btrfs/extent_io.c:435 insert_state+0x4b/0x10b [btrfs]()\n[ 3915.119913] BTRFS: end < start 4095 4096\n(...)\n[ 3915.137394] Call Trace:\n[ 3915.137913]  [<ffffffff81425fd9>] dump_stack+0x4c/0x65\n[ 3915.139154]  [<ffffffff81045390>] warn_slowpath_common+0xa1/0xbb\n[ 3915.140316]  [<ffffffffa03ca44f>] ? insert_state+0x4b/0x10b [btrfs]\n[ 3915.141505]  [<ffffffff810453f0>] warn_slowpath_fmt+0x46/0x48\n[ 3915.142709]  [<ffffffffa03ca44f>] insert_state+0x4b/0x10b [btrfs]\n[ 3915.143849]  [<ffffffffa03ca729>] __set_extent_bit+0x107/0x3f4 [btrfs]\n[ 3915.145120]  [<ffffffffa038c1e3>] ? btrfs_kill_super+0x17/0x23 [btrfs]\n[ 3915.146352]  [<ffffffff811548f6>] ? deactivate_locked_super+0x3b/0x50\n[ 3915.147565]  [<ffffffffa03cb256>] lock_extent_bits+0x65/0x1bf [btrfs]\n[ 3915.148785]  [<ffffffff8142b7e2>] ? _raw_write_unlock+0x28/0x33\n[ 3915.149931]  [<ffffffffa03bc325>] btrfs_evict_inode+0x196/0x482 [btrfs]\n[ 3915.151154]  [<ffffffff81168904>] evict+0xa0/0x148\n[ 3915.152094]  [<ffffffff811689e5>] dispose_list+0x39/0x43\n[ 3915.153081]  [<ffffffff81169564>] evict_inodes+0xdc/0xeb\n[ 3915.154062]  [<ffffffff81154418>] generic_shutdown_super+0x49/0xef\n[ 3915.155193]  [<ffffffff811546d1>] kill_anon_super+0x13/0x1e\n[ 3915.156274]  [<ffffffffa038c1e3>] btrfs_kill_super+0x17/0x23 [btrfs]\n(...)\n[ 3915.167404] ---[ end trace 14843d3e2e622fc2 ]---\n\nSo just bail out of the clone ioctl if the length of the region to clone\nis zero, without locking any extent range, in order to prevent this issue\n(same behaviour as a pwrite with a 0 length for example).\n\nThis is trivial to reproduce. For example, the steps for the test I just\nmade for fstests:\n\n  mkfs.btrfs -f SCRATCH_DEV\n  mount SCRATCH_DEV $SCRATCH_MNT\n\n  touch $SCRATCH_MNT/foo\n  touch $SCRATCH_MNT/bar\n\n  $CLONER_PROG -s 0 -d 4096 -l 0 $SCRATCH_MNT/foo $SCRATCH_MNT/bar\n  umount $SCRATCH_MNT\n\nA test case for fstests follows soon.\n\nSigned-off-by: Filipe Manana <fdmanana@suse.com>\nReviewed-by: Omar Sandoval <osandov@osandov.com>\nSigned-off-by: Chris Mason <clm@fb.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/6073c4162289fcae16b359f8e105d60343a209ca"},{"sha":"3518a2e4bbe8c336d3f59138d1f7bdd628a841b3","author":{"email":"94dddeeef08b001e003cce128ddc162a4e2c6cd2@ti.com","name":"Felipe Balbi"},"message":"usb: gadget: composite: enable BESL support\n\ncommit a6615937bcd9234e6d6bb817c3701fce44d0a84d upstream.\n\nAccording to USB 2.0 ECN Errata for Link Power\nManagement (USB2-LPM-Errata-final.pdf), BESL\nmust be enabled if LPM is enabled.\n\nThis helps with USB30CV TD 9.21 LPM L1\nSuspend Resume Test.\n\nSigned-off-by: Felipe Balbi <balbi@ti.com>\nSigned-off-by: Du, Changbin <changbin.du@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/3518a2e4bbe8c336d3f59138d1f7bdd628a841b3"},{"sha":"38db3faa86115d76cc9df29b3706cb90d6583a77","author":{"email":"f287211da676ffdf91aea974631e3d58cbf5cace@linux.vnet.ibm.com","name":"Ekaterina Tumanova"},"message":"KVM: s390: Zero out current VMDB of STSI before including level3 data.\n\ncommit b75f4c9afac2604feb971441116c07a24ecca1ec upstream.\n\ns390 documentation requires words 0 and 10-15 to be reserved and stored as\nzeros. As we fill out all other fields, we can memset the full structure.\n\nSigned-off-by: Ekaterina Tumanova <tumanova@linux.vnet.ibm.com>\nReviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>\nSigned-off-by: Christian Borntraeger <borntraeger@de.ibm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/38db3faa86115d76cc9df29b3706cb90d6583a77"},{"sha":"793d5cc7015f5ccea3114523471188ece3958904","author":{"email":"8dcf0f69152f32f23184f83357a3731522e56b9c@de.ibm.com","name":"Heiko Carstens"},"message":"s390/hibernate: fix save and restore of kernel text section\n\ncommit d74419495633493c9cd3f2bbeb7f3529d0edded6 upstream.\n\nSebastian reported a crash caused by a jump label mismatch after resume.\nThis happens because we do not save the kernel text section during suspend\nand therefore also do not restore it during resume, but use the kernel image\nthat restores the old system.\n\nThis means that after a suspend/resume cycle we lost all modifications done\nto the kernel text section.\nThe reason for this is the pfn_is_nosave() function, which incorrectly\nreturns that read-only pages don't need to be saved. This is incorrect since\nwe mark the kernel text section read-only.\nWe still need to make sure to not save and restore pages contained within\nNSS and DCSS segment.\nTo fix this add an extra case for the kernel text section and only save\nthose pages if they are not contained within an NSS segment.\n\nFixes the following crash (and the above bugs as well):\n\nJump label code mismatch at netif_receive_skb_internal+0x28/0xd0\nFound:    c0 04 00 00 00 00\nExpected: c0 f4 00 00 00 11\nNew:      c0 04 00 00 00 00\nKernel panic - not syncing: Corrupted kernel text\nCPU: 0 PID: 9 Comm: migration/0 Not tainted 3.19.0-01975-gb1b096e70f23 #4\nCall Trace:\n  [<0000000000113972>] show_stack+0x72/0xf0\n  [<000000000081f15e>] dump_stack+0x6e/0x90\n  [<000000000081c4e8>] panic+0x108/0x2b0\n  [<000000000081be64>] jump_label_bug.isra.2+0x104/0x108\n  [<0000000000112176>] __jump_label_transform+0x9e/0xd0\n  [<00000000001121e6>] __sm_arch_jump_label_transform+0x3e/0x50\n  [<00000000001d1136>] multi_cpu_stop+0x12e/0x170\n  [<00000000001d1472>] cpu_stopper_thread+0xb2/0x168\n  [<000000000015d2ac>] smpboot_thread_fn+0x134/0x1b0\n  [<0000000000158baa>] kthread+0x10a/0x110\n  [<0000000000824a86>] kernel_thread_starter+0x6/0xc\n\nReported-and-tested-by: Sebastian Ott <sebott@linux.vnet.ibm.com>\nSigned-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>\nSigned-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/793d5cc7015f5ccea3114523471188ece3958904"},{"sha":"cad1af8cfbafe09d84ebd87977540fbd896f7225","author":{"email":"e4aea3f2c531804c57884e1d444a6744efb5af4d@redhat.com","name":"Radim Krčmář"},"message":"KVM: use slowpath for cross page cached accesses\n\ncommit ca3f0874723fad81d0c701b63ae3a17a408d5f25 upstream.\n\nkvm_write_guest_cached() does not mark all written pages as dirty and\ncode comments in kvm_gfn_to_hva_cache_init() talk about NULL memslot\nwith cross page accesses.  Fix all the easy way.\n\nThe check is '<= 1' to have the same result for 'len = 0' cache anywhere\nin the page.  (nr_pages_needed is 0 on page boundary.)\n\nFixes: 8f964525a121 (\"KVM: Allow cross page reads and writes from cached translations.\")\nSigned-off-by: Radim Krčmář <rkrcmar@redhat.com>\nMessage-Id: <20150408121648.GA3519@potion.brq.redhat.com>\nReviewed-by: Wanpeng Li <wanpeng.li@linux.intel.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/cad1af8cfbafe09d84ebd87977540fbd896f7225"},{"sha":"dacbdb36cc75ef32aa6b3dccfe5aef77f29bab90","author":{"email":"bddc6ef64099649954804bf58f2e4dee9b3b798f@lemote.com","name":"Huacai Chen"},"message":"MIPS: Hibernate: flush TLB entries earlier\n\ncommit a843d00d038b11267279e3b5388222320f9ddc1d upstream.\n\nWe found that TLB mismatch not only happens after kernel resume, but\nalso happens during snapshot restore. So move it to the beginning of\nswsusp_arch_suspend().\n\nSigned-off-by: Huacai Chen <chenhc@lemote.com>\nCc: Steven J. Hill <Steven.Hill@imgtec.com>\nCc: linux-mips@linux-mips.org\nCc: Fuxin Zhang <zhangfx@lemote.com>\nCc: Zhangjin Wu <wuzhangjin@gmail.com>\nPatchwork: https://patchwork.linux-mips.org/patch/9621/\nSigned-off-by: Ralf Baechle <ralf@linux-mips.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/dacbdb36cc75ef32aa6b3dccfe5aef77f29bab90"},{"sha":"317ff32c67fed6260972f3f706abc05c1752b16e","author":{"email":"bfee72d94d376f4e00f72b756466867d7f9eb24e@suse.de","name":"Oliver Neukum"},"message":"cdc-wdm: fix endianness bug in debug statements\n\ncommit 323ece54e0761198946ecd0c2091f1d2bfdfcb64 upstream.\n\nValues directly from descriptors given in debug statements\nmust be converted to native endianness.\n\nSigned-off-by: Oliver Neukum <oneukum@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/317ff32c67fed6260972f3f706abc05c1752b16e"},{"sha":"14a1fe5de9d7c391301b517e8effb5f098ada9c4","author":{"email":"9e6ba6483b6a3e14d61f7c987e72ecb5b46122d6@mev.co.uk","name":"Ian Abbott"},"message":"spi: spidev: fix possible arithmetic overflow for multi-transfer message\n\ncommit f20fbaad7620af2df36a1f9d1c9ecf48ead5b747 upstream.\n\n`spidev_message()` sums the lengths of the individual SPI transfers to\ndetermine the overall SPI message length.  It restricts the total\nlength, returning an error if too long, but it does not check for\narithmetic overflow.  For example, if the SPI message consisted of two\ntransfers and the first has a length of 10 and the second has a length\nof (__u32)(-1), the total length would be seen as 9, even though the\nsecond transfer is actually very long.  If the second transfer specifies\na null `rx_buf` and a non-null `tx_buf`, the `copy_from_user()` could\noverrun the spidev's pre-allocated tx buffer before it reaches an\ninvalid user memory address.  Fix it by checking that neither the total\nnor the individual transfer lengths exceed the maximum allowed value.\n\nThanks to Dan Carpenter for reporting the potential integer overflow.\n\nSigned-off-by: Ian Abbott <abbotti@mev.co.uk>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/14a1fe5de9d7c391301b517e8effb5f098ada9c4"},{"sha":"faf8db2e2247ac49104653eddfca2e1eeb7efeea","author":{"email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org","name":"Steven Rostedt"},"message":"ring-buffer: Replace this_cpu_*() with __this_cpu_*()\n\ncommit 80a9b64e2c156b6523e7a01f2ba6e5d86e722814 upstream.\n\nIt has come to my attention that this_cpu_read/write are horrible on\narchitectures other than x86. Worse yet, they actually disable\npreemption or interrupts! This caused some unexpected tracing results\non ARM.\n\n   101.356868: preempt_count_add <-ring_buffer_lock_reserve\n   101.356870: preempt_count_sub <-ring_buffer_lock_reserve\n\nThe ring_buffer_lock_reserve has recursion protection that requires\naccessing a per cpu variable. But since preempt_disable() is traced, it\ntoo got traced while accessing the variable that is suppose to prevent\nrecursion like this.\n\nThe generic version of this_cpu_read() and write() are:\n\n #define this_cpu_generic_read(pcp)\t\t\t\t\t\\\n ({\ttypeof(pcp) ret__;\t\t\t\t\t\t\\\n\tpreempt_disable();\t\t\t\t\t\t\\\n\tret__ = *this_cpu_ptr(&(pcp));\t\t\t\t\t\\\n\tpreempt_enable();\t\t\t\t\t\t\\\n\tret__;\t\t\t\t\t\t\t\t\\\n })\n\n #define this_cpu_generic_to_op(pcp, val, op)\t\t\t\t\\\n do {\t\t\t\t\t\t\t\t\t\\\n\tunsigned long flags;\t\t\t\t\t\t\\\n\traw_local_irq_save(flags);\t\t\t\t\t\\\n\t*__this_cpu_ptr(&(pcp)) op val;\t\t\t\t\t\\\n\traw_local_irq_restore(flags);\t\t\t\t\t\\\n } while (0)\n\nWhich is unacceptable for locations that know they are within preempt\ndisabled or interrupt disabled locations.\n\nPaul McKenney stated that __this_cpu_() versions produce much better code on\nother architectures than this_cpu_() does, if we know that the call is done in\na preempt disabled location.\n\nI also changed the recursive_unlock() to use two local variables instead\nof accessing the per_cpu variable twice.\n\nLink: http://lkml.kernel.org/r/20150317114411.GE3589@linux.vnet.ibm.com\nLink: http://lkml.kernel.org/r/20150317104038.312e73d1@gandalf.local.home\n\nAcked-by: Christoph Lameter <cl@linux.com>\nReported-by: Uwe Kleine-Koenig <u.kleine-koenig@pengutronix.de>\nTested-by: Uwe Kleine-Koenig <u.kleine-koenig@pengutronix.de>\nSigned-off-by: Steven Rostedt <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/faf8db2e2247ac49104653eddfca2e1eeb7efeea"},{"sha":"7aea358e5c37d8f17e3911f21bd555d5533be7ec","author":{"email":"1a8531307367602b8284517edb33d53d54e5ce8e@samsung.com","name":"Krzysztof Kozlowski"},"message":"power_supply: lp8788-charger: Fix leaked power supply on probe fail\n\ncommit a7117f81e8391e035c49b3440792f7e6cea28173 upstream.\n\nDriver forgot to unregister charger power supply if registering of\nbattery supply failed in probe(). In such case the memory associated\nwith power supply leaked.\n\nSigned-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>\nFixes: 98a276649358 (\"power_supply: Add new lp8788 charger driver\")\nSigned-off-by: Sebastian Reichel <sre@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/7aea358e5c37d8f17e3911f21bd555d5533be7ec"},{"sha":"e26c761f5a57dc335748b2e730e89925744ce6c5","author":{"email":"d7a2c23eccda99639e3fab64d868a1b1895748fa@samsung.com","name":"Andrey Ryabinin"},"message":"ARM: 8320/1: fix integer overflow in ELF_ET_DYN_BASE\n\ncommit 8defb3367fcd19d1af64c07792aade0747b54e0f upstream.\n\nUsually ELF_ET_DYN_BASE is 2/3 of TASK_SIZE. With 3G/1G user/kernel\nsplit this is not so, because 2*TASK_SIZE overflows 32 bits,\nso the actual value of ELF_ET_DYN_BASE is:\n\t(2 * TASK_SIZE / 3) = 0x2a000000\n\nWhen ASLR is disabled PIE binaries will load at ELF_ET_DYN_BASE address.\nOn 32bit platforms AddressSanitzer uses addresses [0x20000000 - 0x40000000]\nfor shadow memory [1]. So ASan doesn't work for PIE binaries when ASLR disabled\nas it fails to map shadow memory.\nAlso after Kees's 'split ET_DYN ASLR from mmap ASLR' patchset PIE binaries\nhas a high chance of loading somewhere in between [0x2a000000 - 0x40000000]\neven if ASLR enabled. This makes ASan with PIE absolutely incompatible.\n\nFix overflow by dividing TASK_SIZE prior to multiplying.\nAfter this patch ELF_ET_DYN_BASE equals to (for CONFIG_VMSPLIT_3G=y):\n\t(TASK_SIZE / 3 * 2) = 0x7f555554\n\n[1] https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm#Mapping\n\nSigned-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>\nReported-by: Maria Guseva <m.guseva@samsung.com>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/e26c761f5a57dc335748b2e730e89925744ce6c5"},{"sha":"c82d2edfe720101550a377afceb903a52ac44e19","author":{"email":"8e4aa0015eb43ed5ca66aaca3fb498609e1e427c@opensource.wolfsonmicro.com","name":"Charles Keepax"},"message":"ARM: S3C64XX: Use fixed IRQ bases to avoid conflicts on Cragganmore\n\ncommit 4e330ae4ab2915444f1e6dca1358a910aa259362 upstream.\n\nThere are two PMICs on Cragganmore, currently one dynamically assign\nits IRQ base and the other uses a fixed base. It is possible for the\nstatically assigned PMIC to fail if its IRQ is taken by the dynamically\nassigned one. Fix this by statically assigning both the IRQ bases.\n\nSigned-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>\nSigned-off-by: Kukjin Kim <kgene@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/c82d2edfe720101550a377afceb903a52ac44e19"},{"sha":"99cecd301837acb25276c629483eb11205176414","author":{"email":"b6ffd6973e972cb999e8e535ab74da7fee0c035f@ingics.com","name":"Axel Lin"},"message":"usb: phy: Find the right match in devm_usb_phy_match\n\ncommit 869aee0f31429fa9d94d5aef539602b73ae0cf4b upstream.\n\nThe res parameter passed to devm_usb_phy_match() is the location where the\npointer to the usb_phy is stored, hence it needs to be dereferenced before\ncomparing to the match data in order to find the correct match.\n\nFixes: 410219dcd2ba (\"usb: otg: utils: devres: Add API's to associate a device with the phy\")\nSigned-off-by: Axel Lin <axel.lin@ingics.com>\nSigned-off-by: Felipe Balbi <balbi@ti.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/99cecd301837acb25276c629483eb11205176414"},{"sha":"7a2d2855fc7ba8eb962ff596f188b894f2b57eb1","author":{"email":"94dddeeef08b001e003cce128ddc162a4e2c6cd2@ti.com","name":"Felipe Balbi"},"message":"usb: define a generic USB_RESUME_TIMEOUT macro\n\ncommit 62f0342de1f012f3e90607d39e20fce811391169 upstream.\n\nEvery USB Host controller should use this new\nmacro to define for how long resume signalling\nshould be driven on the bus.\n\nCurrently, almost every single USB controller\nis using a 20ms timeout for resume signalling.\n\nThat's problematic for two reasons:\n\na) sometimes that 20ms timer expires a little\nbefore 20ms, which makes us fail certification\n\nb) some (many) devices actually need more than\n20ms resume signalling.\n\nSure, in case of (b) we can state that the device\nis against the USB spec, but the fact is that\nwe have no control over which device the certification\nlab will use. We also have no control over which host\nthey will use. Most likely they'll be using a Windows\nPC which, again, we have no control over how that\nUSB stack is written and how long resume signalling\nthey are using.\n\nAt the end of the day, we must make sure Linux passes\nelectrical compliance when working as Host or as Device\nand currently we don't pass compliance as host because\nwe're driving resume signallig for exactly 20ms and\nthat confuses certification test setup resulting in\nCertification failure.\n\nAcked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nAcked-by: Peter Chen <peter.chen@freescale.com>\nSigned-off-by: Felipe Balbi <balbi@ti.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/7a2d2855fc7ba8eb962ff596f188b894f2b57eb1"},{"sha":"3a8c01bc40fd66c07e8e943dd36dc9bc2090d6aa","author":{"email":"94dddeeef08b001e003cce128ddc162a4e2c6cd2@ti.com","name":"Felipe Balbi"},"message":"usb: host: r8a66597: use new USB_RESUME_TIMEOUT\n\ncommit 7a606ac29752a3e571b83f9b3fceb1eaa1d37781 upstream.\n\nWhile this driver was already using a 50ms resume\ntimeout, let's make sure everybody uses the same\nmacro so it's easy to fix later should anything\ngo wrong.\n\nIt also gives a more \"stable\" expectation to Linux\nusers.\n\nSigned-off-by: Felipe Balbi <balbi@ti.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/3a8c01bc40fd66c07e8e943dd36dc9bc2090d6aa"},{"sha":"38faf1a5651345e72bf176a45877400329fc411d","author":{"email":"94dddeeef08b001e003cce128ddc162a4e2c6cd2@ti.com","name":"Felipe Balbi"},"message":"usb: host: isp116x: use new USB_RESUME_TIMEOUT\n\ncommit 8c0ae6574ccfd3d619876a65829aad74c9d22ba5 upstream.\n\nMake sure we're using the new macro, so our\nresume signaling will always pass certification.\n\nSigned-off-by: Felipe Balbi <balbi@ti.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/USBhost/FIRE-ICE/commits/38faf1a5651345e72bf176a45877400329fc411d"}]}