{"push_id":691202845,"size":11,"distinct_size":11,"ref":"refs/heads/cm10-experimental","head":"74310b152956b8f1a65c5ab2899856f0a3c48ce1","before":"0ffe6894cd498b27e58cc875c40a0b3880e8bd29","commits":[{"sha":"126ea819c56851c57e51531215243d91d63a47d5","author":{"email":"c539153ba1f947bd4b6f910263b967c4a0a62357@neukum.org","name":"Oliver Neukum"},"message":"USB: hub: handle claim of enabled remote wakeup after reset\n\ncommit 07e72b95f5038cc82304b9a4a2eb7f9fc391ea68 upstream.\n\nSome touchscreens have buggy firmware which claims\nremote wakeup to be enabled after a reset. They nevertheless\ncrash if the feature is cleared by the host.\nAdd a check for reset resume before checking for\nan enabled remote wakeup feature. On compliant\ndevices the feature must be cleared after a reset anyway.\n\nSigned-off-by: Oliver Neukum <oneukum@suse.de>\nAcked-by: Alan Stern <stern@rowland.harvard.edu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kabata1975/android_kernel_c8690/commits/126ea819c56851c57e51531215243d91d63a47d5"},{"sha":"36ec6536d4f9038a1fedb3ca987e618a1682b5e4","author":{"email":"5f50a84c1fa3bcff146405017f36aec1a10a9e38@codesourcery.com","name":"Thomas Schwinge"},"message":"sh: Fix FDPIC binary loader\n\ncommit 4a71997a3279a339e7336ea5d0cd27282e2dea44 upstream.\n\nEnsure that the aux table is properly initialized, even when optional features\nare missing.  Without this, the FDPIC loader did not work.  This was meant to\nbe included in commit d5ab780305bb6d60a7b5a74f18cf84eb6ad153b1.\n\nSigned-off-by: Thomas Schwinge <thomas@codesourcery.com>\nSigned-off-by: Paul Mundt <lethal@linux-sh.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kabata1975/android_kernel_c8690/commits/36ec6536d4f9038a1fedb3ca987e618a1682b5e4"},{"sha":"787503001c9d7d7375fb7c453dd6a15ccbbedc30","author":{"email":"4d12f06cff3725783b352157673a720bc67c4afe@chromium.org","name":"Julius Werner"},"message":"xhci: fix null-pointer dereference when destroying half-built segment rings\n\ncommit 68e5254adb88bede68285f11fb442a4d34fb550c upstream.\n\nxhci_alloc_segments_for_ring() builds a list of xhci_segments and links\nthe tail to head at the end (forming a ring). When it bails out for OOM\nreasons half-way through, it tries to destroy its half-built list with\nxhci_free_segments_for_ring(), even though it is not a ring yet. This\ncauses a null-pointer dereference upon hitting the last element.\n\nFurthermore, one of its callers (xhci_ring_alloc()) mistakenly believes\nthe output parameters to be valid upon this kind of OOM failure, and\ncalls xhci_ring_free() on them. Since the (incomplete) list/ring should\nalready be destroyed in that case, this would lead to a use after free.\n\nThis patch fixes those issues by having xhci_alloc_segments_for_ring()\ndestroy its half-built, non-circular list manually and destroying the\ninvalid struct xhci_ring in xhci_ring_alloc() with a plain kfree().\n\nThis patch should be backported to kernels as old as 2.6.31, that\ncontains the commit 0ebbab37422315a5d0cb29792271085bafdf38c0 \"USB: xhci:\nRing allocation and initialization.\"\n\nA separate patch will need to be developed for kernels older than 3.4,\nsince the ring allocation code was refactored in that kernel.\n\nSigned-off-by: Julius Werner <jwerner@chromium.org>\nSigned-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>\nSigned-off-by: Julius Werner <jwerner@chromium.org>\nSigned-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>\n[bwh: Backported to 3.2:\n - Adjust context\n - Since segment allocation is done directly in xhci_ring_alloc(), walk\n   the list starting from ring->first_seg when freeing]\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nSigned-off-by: CAI Qian <caiqian@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kabata1975/android_kernel_c8690/commits/787503001c9d7d7375fb7c453dd6a15ccbbedc30"},{"sha":"f80bc3fc9c0552557c47ca4457f6f3ea986cb2b1","author":{"email":"75ea6bb7bfc1186f92d26164de5f9268c9a45b59@rowland.harvard.edu","name":"Alan Stern"},"message":"USB: fix endpoint-disabling for failed config changes\n\ncommit 36caff5d795429c572443894e8789c2150dd796b upstream.\n\nThis patch (as1631) fixes a bug that shows up when a config change\nfails for a device under an xHCI controller.  The controller needs to\nbe told to disable the endpoints that have been enabled for the new\nconfig.  The existing code does this, but before storing the\ninformation about which endpoints were enabled!  As a result, any\nsecond attempt to install the new config is doomed to fail because\nxhci-hcd will refuse to enable an endpoint that is already enabled.\n\nThe patch optimistically initializes the new endpoints' device\nstructures before asking the device to switch to the new config.  If\nthe request fails then the endpoint information is already stored, so\nwe can use usb_hcd_alloc_bandwidth() to disable the endpoints with no\ntrouble.  The rest of the error path is slightly more complex now; we\nhave to disable the new interfaces and call put_device() rather than\nsimply deallocating them.\n\nSigned-off-by: Alan Stern <stern@rowland.harvard.edu>\nReported-and-tested-by: Matthias Schniedermeyer <ms@citd.de>\nCC: Sarah Sharp <sarah.a.sharp@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: CAI Qian <caiqian@redhat.com>","distinct":true,"url":"https://api.github.com/repos/kabata1975/android_kernel_c8690/commits/f80bc3fc9c0552557c47ca4457f6f3ea986cb2b1"},{"sha":"5d783764b7901fb47c69572d6df9fa67bd0bdea9","author":{"email":"f9cffb48774c5c540daacd974d14454046841468@hp.com","name":"Shuah Khan"},"message":"ioat: Fix DMA memory sync direction correct flag\n\ncommit ac4989874af56435c308bdde9ad9c837a26f8b23 upstream.\n\nioat does DMA memory sync with DMA_TO_DEVICE direction on a buffer allocated\nfor DMA_FROM_DEVICE dma, resulting in the following warning from dma debug.\nFixed the dma_sync_single_for_device() call to use the correct direction.\n\n[  226.288947] WARNING: at lib/dma-debug.c:990 check_sync+0x132/0x550()\n[  226.288948] Hardware name: ProLiant DL380p Gen8\n[  226.288951] ioatdma 0000:00:04.0: DMA-API: device driver syncs DMA memory with different direction [device address=0x00000000ffff7000] [size=4096 bytes] [mapped with DMA_FROM_DEVICE] [synced with DMA_TO_DEVICE]\n[  226.288953] Modules linked in: iTCO_wdt(+) sb_edac(+) ioatdma(+) microcode serio_raw pcspkr edac_core hpwdt(+) iTCO_vendor_support hpilo(+) dca acpi_power_meter ata_generic pata_acpi sd_mod crc_t10dif ata_piix libata hpsa tg3 netxen_nic(+) sunrpc dm_mirror dm_region_hash dm_log dm_mod\n[  226.288967] Pid: 1055, comm: work_for_cpu Tainted: G        W    3.3.0-0.20.el7.x86_64 #1\n[  226.288968] Call Trace:\n[  226.288974]  [<ffffffff810644cf>] warn_slowpath_common+0x7f/0xc0\n[  226.288977]  [<ffffffff810645c6>] warn_slowpath_fmt+0x46/0x50\n[  226.288980]  [<ffffffff81345502>] check_sync+0x132/0x550\n[  226.288983]  [<ffffffff81345c9f>] debug_dma_sync_single_for_device+0x3f/0x50\n[  226.288988]  [<ffffffff81661002>] ? wait_for_common+0x72/0x180\n[  226.288995]  [<ffffffffa019590f>] ioat_xor_val_self_test+0x3e5/0x832 [ioatdma]\n[  226.288999]  [<ffffffff811a5739>] ? kfree+0x259/0x270\n[  226.289004]  [<ffffffffa0195d77>] ioat3_dma_self_test+0x1b/0x20 [ioatdma]\n[  226.289008]  [<ffffffffa01952c3>] ioat_probe+0x2f8/0x348 [ioatdma]\n[  226.289011]  [<ffffffffa0195f51>] ioat3_dma_probe+0x1d5/0x2aa [ioatdma]\n[  226.289016]  [<ffffffffa0194d12>] ioat_pci_probe+0x139/0x17c [ioatdma]\n[  226.289020]  [<ffffffff81354b8c>] local_pci_probe+0x5c/0xd0\n[  226.289023]  [<ffffffff81083e50>] ? destroy_work_on_stack+0x20/0x20\n[  226.289025]  [<ffffffff81083e68>] do_work_for_cpu+0x18/0x30\n[  226.289029]  [<ffffffff8108d997>] kthread+0xb7/0xc0\n[  226.289033]  [<ffffffff8166cef4>] kernel_thread_helper+0x4/0x10\n[  226.289036]  [<ffffffff81662d20>] ? _raw_spin_unlock_irq+0x30/0x50\n[  226.289038]  [<ffffffff81663234>] ? retint_restore_args+0x13/0x13\n[  226.289041]  [<ffffffff8108d8e0>] ? kthread_worker_fn+0x1a0/0x1a0\n[  226.289044]  [<ffffffff8166cef0>] ? gs_change+0x13/0x13\n[  226.289045] ---[ end trace e1618afc7a606089 ]---\n[  226.289047] Mapped at:\n[  226.289048]  [<ffffffff81345307>] debug_dma_map_page+0x87/0x150\n[  226.289050]  [<ffffffffa019653c>] dma_map_page.constprop.18+0x70/0xb34 [ioatdma]\n[  226.289054]  [<ffffffffa0195702>] ioat_xor_val_self_test+0x1d8/0x832 [ioatdma]\n[  226.289058]  [<ffffffffa0195d77>] ioat3_dma_self_test+0x1b/0x20 [ioatdma]\n[  226.289061]  [<ffffffffa01952c3>] ioat_probe+0x2f8/0x348 [ioatdma]\n\nSigned-off-by: Shuah Khan <shuah.khan@hp.com>\nSigned-off-by: Vinod Koul <vinod.koul@linux.intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kabata1975/android_kernel_c8690/commits/5d783764b7901fb47c69572d6df9fa67bd0bdea9"},{"sha":"3dc525759540e590e3a6f8dc8f38197ce1ac71fc","author":{"email":"8001b54ad539330acc19ca3e17ac1f04f07b36a6@gmail.com","name":"Cong Ding"},"message":"fs/cifs/cifs_dfs_ref.c: fix potential memory leakage\n\ncommit 10b8c7dff5d3633b69e77f57d404dab54ead3787 upstream.\n\nWhen it goes to error through line 144, the memory allocated to *devname is\nnot freed, and the caller doesn't free it either in line 250. So we free the\nmemroy of *devname in function cifs_compose_mount_options() when it goes to\nerror.\n\nSigned-off-by: Cong Ding <dinggnu@gmail.com>\nReviewed-by: Jeff Layton <jlayton@redhat.com>\nSigned-off-by: Steve French <smfrench@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kabata1975/android_kernel_c8690/commits/3dc525759540e590e3a6f8dc8f38197ce1ac71fc"},{"sha":"2ce5ed9a70c43256bf8b627c734ecd57aa0d9960","author":{"email":"db186c297188f7acbbdc9bbd6aff2f45665bb42d@tieto.com","name":"Szymon Janc"},"message":"Bluetooth: Fix sending HCI commands after reset\n\ncommit dbccd791a3fbbdac12c33834b73beff3984988e9 upstream.\n\nAfter sending reset command wait for its command complete event before\nsending next command. Some chips sends CC event for command received\nbefore reset if reset was send before chip replied with CC.\n\nThis is also required by specification that host shall not send\nadditional HCI commands before receiving CC for reset.\n\n< HCI Command: Reset (0x03|0x0003) plen 0                              [hci0] 18.404612\n> HCI Event: Command Complete (0x0e) plen 4                            [hci0] 18.405850\n      Write Extended Inquiry Response (0x03|0x0052) ncmd 1\n        Status: Success (0x00)\n< HCI Command: Read Local Supported Features (0x04|0x0003) plen 0      [hci0] 18.406079\n> HCI Event: Command Complete (0x0e) plen 4                            [hci0] 18.407864\n      Reset (0x03|0x0003) ncmd 1\n        Status: Success (0x00)\n< HCI Command: Read Local Supported Features (0x04|0x0003) plen 0      [hci0] 18.408062\n> HCI Event: Command Complete (0x0e) plen 12                           [hci0] 18.408835\n\nSigned-off-by: Szymon Janc <szymon.janc@tieto.com>\nAcked-by: Johan Hedberg <johan.hedberg@intel.com>\nSigned-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kabata1975/android_kernel_c8690/commits/2ce5ed9a70c43256bf8b627c734ecd57aa0d9960"},{"sha":"1d594ee74e454398726dd979a716d9c19204ad23","author":{"email":"1240f8b9a8d4f8f6d54c4d059a9fef2470495ad4@qca.qualcomm.com","name":"Sujith Manoharan"},"message":"ath9k_htc: Fix memory leak\n\ncommit 0981c3b24ef664f5611008a6e6d0622fac6d892b upstream.\n\nSKBs that are allocated in the HTC layer do not have callbacks\nregistered and hence ended up not being freed, Fix this by freeing\nthem properly in the TX completion routine.\n\nReported-by: Larry Finger <Larry.Finger@lwfinger.net>\nSigned-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>\nTested-by: Larry Finger <Larry.Finger@lwfinger.net>\nSigned-off-by: John W. Linville <linville@tuxdriver.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kabata1975/android_kernel_c8690/commits/1d594ee74e454398726dd979a716d9c19204ad23"},{"sha":"169fe061b01eeaeaec94dfccc4280474ad6ff093","author":{"email":"118ed6118e893d16e8c6e0776e0ebc290952c897@openwrt.org","name":"Felix Fietkau"},"message":"ath9k: fix double-free bug on beacon generate failure\n\ncommit 1adb2e2b5f85023d17eb4f95386a57029df27c88 upstream.\n\nWhen the next beacon is sent, the ath_buf from the previous run is reused.\nIf getting a new beacon from mac80211 fails, bf->bf_mpdu is not reset, yet\nthe skb is freed, leading to a double-free on the next beacon tx attempt,\nresulting in a system crash.\n\nSigned-off-by: Felix Fietkau <nbd@openwrt.org>\nSigned-off-by: John W. Linville <linville@tuxdriver.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kabata1975/android_kernel_c8690/commits/169fe061b01eeaeaec94dfccc4280474ad6ff093"},{"sha":"c84330ee9d3e6fc2f14d2a8ae3099d2d1adeca11","author":{"email":"ff341aa343d564f9e53e9dcb6996be8c04859a66@oracle.com","name":"Dan Carpenter"},"message":"EDAC: Test correct variable in ->store function\n\ncommit 8024c4c0b1057d1cd811fc9c3f88f81de9729fcd upstream.\n\nWe're testing for ->show but calling ->store().\n\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nSigned-off-by: Borislav Petkov <bp@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kabata1975/android_kernel_c8690/commits/c84330ee9d3e6fc2f14d2a8ae3099d2d1adeca11"},{"sha":"74310b152956b8f1a65c5ab2899856f0a3c48ce1","author":{"email":"557ba5bc6698264ea5370b43c880f04a35584823@openbossa.org","name":"Anderson Lizardo"},"message":"Bluetooth: Fix incorrect strncpy() in hidp_setup_hid()\n\ncommit 0a9ab9bdb3e891762553f667066190c1d22ad62b upstream.\n\nThe length parameter should be sizeof(req->name) - 1 because there is no\nguarantee that string provided by userspace will contain the trailing\n'\\0'.\n\nCan be easily reproduced by manually setting req->name to 128 non-zero\nbytes prior to ioctl(HIDPCONNADD) and checking the device name setup on\ninput subsystem:\n\n$ cat /sys/devices/pnp0/00\\:04/tty/ttyS0/hci0/hci0\\:1/input8/name\nAAAAAA[...]AAAAAAAAf0:af:f0:af:f0:af\n\n(\"f0:af:f0:af:f0:af\" is the device bluetooth address, taken from \"phys\"\nfield in struct hid_device due to overflow.)\n\nSigned-off-by: Anderson Lizardo <anderson.lizardo@openbossa.org>\nAcked-by: Marcel Holtmann <marcel@holtmann.org>\nSigned-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/kabata1975/android_kernel_c8690/commits/74310b152956b8f1a65c5ab2899856f0a3c48ce1"}]}