{"push_id":811856526,"size":85,"distinct_size":85,"ref":"refs/heads/3.14","head":"2bfe9c0e4bc695334bc53789335dd17e9ebf42ad","before":"f8a00160ebcf48281eb7c7ea74ad4714a570b94d","commits":[{"sha":"efa9b80eddc078c30fa1b075318a82f81f6f5800","author":{"email":"8d0fc11caeb4659419f0ba3104eb4a9d30848d42@canonical.com","name":"Ming Lei"},"message":"blk-mq: fix buffer overflow when reading sysfs file of 'pending'\n\ncommit 596f5aad2a704b72934e5abec1b1b4114c16f45b upstream.\n\nThere may be lots of pending requests so that the buffer of PAGE_SIZE\ncan't hold them at all.\n\nOne typical example is scsi-mq, the queue depth(.can_queue) of\nscsi_host and blk-mq is quite big but scsi_device's queue_depth\nis a bit small(.cmd_per_lun), then it is quite easy to have lots\nof pending requests in hw queue.\n\nThis patch fixes the following warning and the related memory\ndestruction.\n\n[  359.025101] fill_read_buffer: blk_mq_hw_sysfs_show+0x0/0x7d returned bad count^M\n[  359.055595] irq event stamp: 15537^M\n[  359.055606] general protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC ^M\n[  359.055614] Dumping ftrace buffer:^M\n[  359.055660]    (ftrace buffer empty)^M\n[  359.055672] Modules linked in: nbd ipv6 kvm_intel kvm serio_raw^M\n[  359.055678] CPU: 4 PID: 21631 Comm: stress-ng-sysfs Not tainted 4.2.0-rc5-next-20150805 #434^M\n[  359.055679] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011^M\n[  359.055682] task: ffff8802161cc000 ti: ffff88021b4a8000 task.ti: ffff88021b4a8000^M\n[  359.055693] RIP: 0010:[<ffffffff811541c5>]  [<ffffffff811541c5>] __kmalloc+0xe8/0x152^M\n\nSigned-off-by: Ming Lei <ming.lei@canonical.com>\nSigned-off-by: Jens Axboe <axboe@fb.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/efa9b80eddc078c30fa1b075318a82f81f6f5800"},{"sha":"83b9d2dc51426de1a1ac8590e37f2d3ee317b626","author":{"email":"8a741aa8cbd77ebc4a56ddb528ce9fd15d42f034@xmission.com","name":"Eric W. Biederman"},"message":"unshare: Unsharing a thread does not require unsharing a vm\n\ncommit 12c641ab8270f787dfcce08b5f20ce8b65008096 upstream.\n\nIn the logic in the initial commit of unshare made creating a new\nthread group for a process, contingent upon creating a new memory\naddress space for that process.  That is wrong.  Two separate\nprocesses in different thread groups can share a memory address space\nand clone allows creation of such proceses.\n\nThis is significant because it was observed that mm_users > 1 does not\nmean that a process is multi-threaded, as reading /proc/PID/maps\ntemporarily increments mm_users, which allows other processes to\n(accidentally) interfere with unshare() calls.\n\nCorrect the check in check_unshare_flags() to test for\n!thread_group_empty() for CLONE_THREAD, CLONE_SIGHAND, and CLONE_VM.\nFor sighand->count > 1 for CLONE_SIGHAND and CLONE_VM.\nFor !current_is_single_threaded instead of mm_users > 1 for CLONE_VM.\n\nBy using the correct checks in unshare this removes the possibility of\nan accidental denial of service attack.\n\nAdditionally using the correct checks in unshare ensures that only an\nexplicit unshare(CLONE_VM) can possibly trigger the slow path of\ncurrent_is_single_threaded().  As an explict unshare(CLONE_VM) is\npointless it is not expected there are many applications that make\nthat call.\n\nFixes: b2e0d98705e60e45bbb3c0032c48824ad7ae0704 userns: Implement unshare of the user namespace\nReported-by: Ricky Zhou <rickyz@chromium.org>\nReported-by: Kees Cook <keescook@chromium.org>\nReviewed-by: Kees Cook <keescook@chromium.org>\nSigned-off-by: \"Eric W. Biederman\" <ebiederm@xmission.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/83b9d2dc51426de1a1ac8590e37f2d3ee317b626"},{"sha":"a4e80afe2e9d0bcdedb1c3811066b87ff9634ca6","author":{"email":"424ebdc21fc3d0b1d4ce3d72fe6f41801cd0ae69@schischi.me","name":"Adrien Schildknecht"},"message":"rtlwifi: rtl8192cu: Add new device ID\n\ncommit 1642d09fb9b128e8e538b2a4179962a34f38dff9 upstream.\n\nThe v2 of NetGear WNA1000M uses a different idProduct: USB ID 0846:9043\n\nSigned-off-by: Adrien Schildknecht <adrien+dev@schischi.me>\nAcked-by: Larry Finger <Larry.Finger@lwfinger.net>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/a4e80afe2e9d0bcdedb1c3811066b87ff9634ca6"},{"sha":"6c53b52eab4a3a98e59c1b9f98578d1a8a35a6ef","author":{"email":"efca98801f3398ebd7eeff805a2c18e6c49e84d4@suse.de","name":"Jean Delvare"},"message":"tg3: Fix temperature reporting\n\ncommit d3d11fe08ccc9bff174fc958722b5661f0932486 upstream.\n\nThe temperature registers appear to report values in degrees Celsius\nwhile the hwmon API mandates values to be exposed in millidegrees\nCelsius. Do the conversion so that the values reported by \"sensors\"\nare correct.\n\nFixes: aed93e0bf493 (\"tg3: Add hwmon support for temperature\")\nSigned-off-by: Jean Delvare <jdelvare@suse.de>\nCc: Prashant Sreedharan <prashant@broadcom.com>\nCc: Michael Chan <mchan@broadcom.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/6c53b52eab4a3a98e59c1b9f98578d1a8a35a6ef"},{"sha":"3e0c3882922823cc90f5930c78c0fbcb217156b7","author":{"email":"b1c1d8736f20db3fb6c1c66bb1455ed43909f0d8@bobcopeland.com","name":"Bob Copeland"},"message":"mac80211: enable assoc check for mesh interfaces\n\ncommit 3633ebebab2bbe88124388b7620442315c968e8f upstream.\n\nWe already set a station to be associated when peering completes, both\nin user space and in the kernel.  Thus we should always have an\nassociated sta before sending data frames to that station.\n\nFailure to check assoc state can cause crashes in the lower-level driver\ndue to transmitting unicast data frames before driver sta structures\n(e.g. ampdu state in ath9k) are initialized.  This occurred when\nforwarding in the presence of fixed mesh paths: frames were transmitted\nto stations with whom we hadn't yet completed peering.\n\nReported-by: Alexis Green <agreen@cococorp.com>\nTested-by: Jesse Jones <jjones@cococorp.com>\nSigned-off-by: Bob Copeland <me@bobcopeland.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/3e0c3882922823cc90f5930c78c0fbcb217156b7"},{"sha":"e66caeb33c2d3b1dd07dd9a8fc99218c4dd53c21","author":{"email":"fbe788dcd509b324901fbdfe505a4d610d560569@google.com","name":"Jeff Vander Stoep"},"message":"arm64: kconfig: Move LIST_POISON to a safe value\n\ncommit bf0c4e04732479f650ff59d1ee82de761c0071f0 upstream.\n\nMove the poison pointer offset to 0xdead000000000000, a\nrecognized value that is not mappable by user-space exploits.\n\nAcked-by: Catalin Marinas <catalin.marinas@arm.com>\nSigned-off-by: Thierry Strudel <tstrudel@google.com>\nSigned-off-by: Jeff Vander Stoep <jeffv@google.com>\nSigned-off-by: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/e66caeb33c2d3b1dd07dd9a8fc99218c4dd53c21"},{"sha":"e9512ecf5f0337b84fc1f789a613dc264355e61e","author":{"email":"b913f13ef92ac157955c954ccaaff7be065faba4@arm.com","name":"Will Deacon"},"message":"arm64: compat: fix vfp save/restore across signal handlers in big-endian\n\ncommit bdec97a855ef1e239f130f7a11584721c9a1bf04 upstream.\n\nWhen saving/restoring the VFP registers from a compat (AArch32)\nsignal frame, we rely on the compat registers forming a prefix of the\nnative register file and therefore make use of copy_{to,from}_user to\ntransfer between the native fpsimd_state and the compat_vfp_sigframe.\n\nUnfortunately, this doesn't work so well in a big-endian environment.\nOur fpsimd save/restore code operates directly on 128-bit quantities\n(Q registers) whereas the compat_vfp_sigframe represents the registers\nas an array of 64-bit (D) registers. The architecture packs the compat D\nregisters into the Q registers, with the least significant bytes holding\nthe lower register. Consequently, we need to swap the 64-bit halves when\nconverting between these two representations on a big-endian machine.\n\nThis patch replaces the __copy_{to,from}_user invocations in our\ncompat VFP signal handling code with explicit __put_user loops that\noperate on 64-bit values and swap them accordingly.\n\nReviewed-by: Catalin Marinas <catalin.marinas@arm.com>\nSigned-off-by: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/e9512ecf5f0337b84fc1f789a613dc264355e61e"},{"sha":"27369ba9e39eb4d27e6ff3755e210f4af616e56a","author":{"email":"b913f13ef92ac157955c954ccaaff7be065faba4@arm.com","name":"Will Deacon"},"message":"arm64: head.S: initialise mdcr_el2 in el2_setup\n\ncommit d10bcd473301888f957ec4b6b12aa3621be78d59 upstream.\n\nWhen entering the kernel at EL2, we fail to initialise the MDCR_EL2\nregister which controls debug access and PMU capabilities at EL1.\n\nThis patch ensures that the register is initialised so that all traps\nare disabled and all the PMU counters are available to the host. When a\nguest is scheduled, KVM takes care to configure trapping appropriately.\n\nAcked-by: Marc Zyngier <marc.zyngier@arm.com>\nSigned-off-by: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/27369ba9e39eb4d27e6ff3755e210f4af616e56a"},{"sha":"81cce2cabe09f301bc7e85de30609d5e6704e209","author":{"email":"b913f13ef92ac157955c954ccaaff7be065faba4@arm.com","name":"Will Deacon"},"message":"arm64: errata: add module build workaround for erratum #843419\n\ncommit df057cc7b4fa59e9b55f07ffdb6c62bf02e99a00 upstream.\n\nCortex-A53 processors <= r0p4 are affected by erratum #843419 which can\nlead to a memory access using an incorrect address in certain sequences\nheaded by an ADRP instruction.\n\nThere is a linker fix to generate veneers for ADRP instructions, but\nthis doesn't work for kernel modules which are built as unlinked ELF\nobjects.\n\nThis patch adds a new config option for the erratum which, when enabled,\nbuilds kernel modules with the mcmodel=large flag. This uses absolute\naddressing for all kernel symbols, thereby removing the use of ADRP as\na PC-relative form of addressing. The ADRP relocs are removed from the\nmodule loader so that we fail to load any potentially affected modules.\n\nAcked-by: Catalin Marinas <catalin.marinas@arm.com>\nSigned-off-by: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/81cce2cabe09f301bc7e85de30609d5e6704e209"},{"sha":"ea87c4cb9b71dd8d7870e4a30999f1eb14fca20b","author":{"email":"a16cc0c82647c52d401177f8e50567df5499e36c@arm.com","name":"Marc Zyngier"},"message":"arm64: KVM: Disable virtual timer even if the guest is not using it\n\ncommit c4cbba9fa078f55d9f6d081dbb4aec7cf969e7c7 upstream.\n\nWhen running a guest with the architected timer disabled (with QEMU and\nthe kernel_irqchip=off option, for example), it is important to make\nsure the timer gets turned off. Otherwise, the guest may try to\nenable it anyway, leading to a screaming HW interrupt.\n\nThe fix is to unconditionally turn off the virtual timer on guest\nexit.\n\nReviewed-by: Christoffer Dall <christoffer.dall@linaro.org>\nSigned-off-by: Marc Zyngier <marc.zyngier@arm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/ea87c4cb9b71dd8d7870e4a30999f1eb14fca20b"},{"sha":"2350e51bd7a7b84a9d63638eb895a7ad73a4b66c","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"Input: evdev - do not report errors form flush()\n\ncommit eb38f3a4f6e86f8bb10a3217ebd85ecc5d763aae upstream.\n\nWe've got bug reports showing the old systemd-logind (at least\nsystem-210) aborting unexpectedly, and this turned out to be because\nof an invalid error code from close() call to evdev devices.  close()\nis supposed to return only either EINTR or EBADFD, while the device\nreturned ENODEV.  logind was overreacting to it and decided to kill\nitself when an unexpected error code was received.  What a tragedy.\n\nThe bad error code comes from flush fops, and actually evdev_flush()\nreturns ENODEV when device is disconnected or client's access to it is\nrevoked. But in these cases the fact that flush did not actually happen is\nnot an error, but rather normal behavior. For non-disconnected devices\nresult of flush is also not that interesting as there is no potential of\ndata loss and even if it fails application has no way of handling the\nerror. Because of that we are better off always returning success from\nevdev_flush().\n\nAlso returning EINTR from flush()/close() is discouraged (as it is not\nclear how application should handle this error), so let's stop taking\nevdev->mutex interruptibly.\n\nBugzilla: http://bugzilla.suse.com/show_bug.cgi?id=939834\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/2350e51bd7a7b84a9d63638eb895a7ad73a4b66c"},{"sha":"d93369f5349e986cee5877e70db66fcfad0df3c8","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ALSA: hda - Enable headphone jack detect on old Fujitsu laptops\n\ncommit bb148bdeb0ab16fc0ae8009799471e4d7180073b upstream.\n\nAccording to the bug report, FSC Amilo laptops with ALC880 can detect\nthe headphone jack but currently the driver disables it.  It's partly\nintentionally, as non-working jack detect was reported in the past.\nLet's enable now.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=102501\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/d93369f5349e986cee5877e70db66fcfad0df3c8"},{"sha":"aba2a0df20fd044e626ac5fb02bdd40d4cbbacb0","author":{"email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de","name":"Takashi Iwai"},"message":"ALSA: hda - Use ALC880_FIXUP_FUJITSU for FSC Amilo M1437\n\ncommit a161574e200ae63a5042120e0d8c36830e81bde3 upstream.\n\nIt turned out that the machine has a bass speaker, so take a correct\nfixup entry.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=102501\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/aba2a0df20fd044e626ac5fb02bdd40d4cbbacb0"},{"sha":"65489f8c8b3c5331e739596436ae9ceab1a4f39d","author":{"email":"864f124608374e06e4da1fa5d2e47ed839b95411@ellerman.id.au","name":"Michael Ellerman"},"message":"powerpc/mm: Fix pte_pagesize_index() crash on 4K w/64K hash\n\ncommit 74b5037baa2011a2799e2c43adde7d171b072f9e upstream.\n\nThe powerpc kernel can be built to have either a 4K PAGE_SIZE or a 64K\nPAGE_SIZE.\n\nHowever when built with a 4K PAGE_SIZE there is an additional config\noption which can be enabled, PPC_HAS_HASH_64K, which means the kernel\nalso knows how to hash a 64K page even though the base PAGE_SIZE is 4K.\n\nThis is used in one obscure configuration, to support 64K pages for SPU\nlocal store on the Cell processor when the rest of the kernel is using\n4K pages.\n\nIn this configuration, pte_pagesize_index() is defined to just pass\nthrough its arguments to get_slice_psize(). However pte_pagesize_index()\nis called for both user and kernel addresses, whereas get_slice_psize()\nonly knows how to handle user addresses.\n\nThis has been broken forever, however until recently it happened to\nwork. That was because in get_slice_psize() the large kernel address\nwould cause the right shift of the slice mask to return zero.\n\nHowever in commit 7aa0727f3302 (\"powerpc/mm: Increase the slice range to\n64TB\"), the get_slice_psize() code was changed so that instead of a\nright shift we do an array lookup based on the address. When passed a\nkernel address this means we index way off the end of the slice array\nand return random junk.\n\nThat is only fatal if we happen to hit something non-zero, but when we\ndo return a non-zero value we confuse the MMU code and eventually cause\na check stop.\n\nThis fix is ugly, but simple. When we're called for a kernel address we\nreturn 4K, which is always correct in this configuration, otherwise we\nuse the slice mask.\n\nFixes: 7aa0727f3302 (\"powerpc/mm: Increase the slice range to 64TB\")\nReported-by: Cyril Bur <cyrilbur@gmail.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nReviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/65489f8c8b3c5331e739596436ae9ceab1a4f39d"},{"sha":"4d14a9e6fb8bc461bc62a4289bd4bbca7cd610b3","author":{"email":"9e65be74847981e55b2564b6266c57d86d3bac05@redhat.com","name":"Thomas Huth"},"message":"powerpc/rtas: Introduce rtas_get_sensor_fast() for IRQ handlers\n\ncommit 1c2cb594441d02815d304cccec9742ff5c707495 upstream.\n\nThe EPOW interrupt handler uses rtas_get_sensor(), which in turn\nuses rtas_busy_delay() to wait for RTAS becoming ready in case it\nis necessary. But rtas_busy_delay() is annotated with might_sleep()\nand thus may not be used by interrupts handlers like the EPOW handler!\nThis leads to the following BUG when CONFIG_DEBUG_ATOMIC_SLEEP is\nenabled:\n\n BUG: sleeping function called from invalid context at arch/powerpc/kernel/rtas.c:496\n in_atomic(): 1, irqs_disabled(): 1, pid: 0, name: swapper/1\n CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.2.0-rc2-thuth #6\n Call Trace:\n [c00000007ffe7b90] [c000000000807670] dump_stack+0xa0/0xdc (unreliable)\n [c00000007ffe7bc0] [c0000000000e1f14] ___might_sleep+0x134/0x180\n [c00000007ffe7c20] [c00000000002aec0] rtas_busy_delay+0x30/0xd0\n [c00000007ffe7c50] [c00000000002bde4] rtas_get_sensor+0x74/0xe0\n [c00000007ffe7ce0] [c000000000083264] ras_epow_interrupt+0x44/0x450\n [c00000007ffe7d90] [c000000000120260] handle_irq_event_percpu+0xa0/0x300\n [c00000007ffe7e70] [c000000000120524] handle_irq_event+0x64/0xc0\n [c00000007ffe7eb0] [c000000000124dbc] handle_fasteoi_irq+0xec/0x260\n [c00000007ffe7ef0] [c00000000011f4f0] generic_handle_irq+0x50/0x80\n [c00000007ffe7f20] [c000000000010f3c] __do_irq+0x8c/0x200\n [c00000007ffe7f90] [c0000000000236cc] call_do_irq+0x14/0x24\n [c00000007e6f39e0] [c000000000011144] do_IRQ+0x94/0x110\n [c00000007e6f3a30] [c000000000002594] hardware_interrupt_common+0x114/0x180\n\nFix this issue by introducing a new rtas_get_sensor_fast() function\nthat does not use rtas_busy_delay() - and thus can only be used for\nsensors that do not cause a BUSY condition - known as \"fast\" sensors.\n\nThe EPOW sensor is defined to be \"fast\" in sPAPR - mpe.\n\nFixes: 587f83e8dd50 (\"powerpc/pseries: Use rtas_get_sensor in RAS code\")\nSigned-off-by: Thomas Huth <thuth@redhat.com>\nReviewed-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/4d14a9e6fb8bc461bc62a4289bd4bbca7cd610b3"},{"sha":"5d395c5df33ca77b6da7e36a1f971bdcc580ec4a","author":{"email":"f511f818e8a0748edef6b9ee378967da9ed0c78f@linux.vnet.ibm.com","name":"Aneesh Kumar K.V"},"message":"powerpc/mm: Recompute hash value after a failed update\n\ncommit 36b35d5d807b7e57aff7d08e63de8b17731ee211 upstream.\n\nIf we had secondary hash flag set, we ended up modifying hash value in\nthe updatepp code path. Hence with a failed updatepp we will be using\na wrong hash value for the following hash insert. Fix this by\nrecomputing hash before insert.\n\nWithout this patch we can end up with using wrong slot number in linux\npte. That can result in us missing an hash pte update or invalidate\nwhich can cause memory corruption or even machine check.\n\nFixes: 6d492ecc6489 (\"powerpc/THP: Add code to handle HPTE faults for hugepages\")\nSigned-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>\nReviewed-by: Paul Mackerras <paulus@samba.org>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/5d395c5df33ca77b6da7e36a1f971bdcc580ec4a"},{"sha":"cc45b90cf124f0f0afb07f81b6bb9f27bce3ad1a","author":{"email":"1ff1d5ceb421971f93e6626b02a9591b29d7600e@thejh.net","name":"Jann Horn"},"message":"CIFS: fix type confusion in copy offload ioctl\n\ncommit 4c17a6d56bb0cad3066a714e94f7185a24b40f49 upstream.\n\nThis might lead to local privilege escalation (code execution as\nkernel) for systems where the following conditions are met:\n\n - CONFIG_CIFS_SMB2 and CONFIG_CIFS_POSIX are enabled\n - a cifs filesystem is mounted where:\n  - the mount option \"vers\" was used and set to a value >=2.0\n  - the attacker has write access to at least one file on the filesystem\n\nTo attack this, an attacker would have to guess the target_tcon\npointer (but guessing wrong doesn't cause a crash, it just returns an\nerror code) and win a narrow race.\n\nSigned-off-by: Jann Horn <jann@thejh.net>\nSigned-off-by: Steve French <smfrench@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/cc45b90cf124f0f0afb07f81b6bb9f27bce3ad1a"},{"sha":"b8144881745f9e48bb1827ec0014214a3629bfc5","author":{"email":"d794857f3a261131b0913d7b7c8d46da4e1882e5@neverware.com","name":"Jeffery Miller"},"message":"Add radeon suspend/resume quirk for HP Compaq dc5750.\n\ncommit 09bfda10e6efd7b65bcc29237bee1765ed779657 upstream.\n\nWith the radeon driver loaded the HP Compaq dc5750\nSmall Form Factor machine fails to resume from suspend.\nAdding a quirk similar to other devices avoids\nthe problem and the system resumes properly.\n\nSigned-off-by: Jeffery Miller <jmiller@neverware.com>\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/b8144881745f9e48bb1827ec0014214a3629bfc5"},{"sha":"191276cd0e36f4747356b7a298db881886845820","author":{"email":"0674548f4d596393408a51d6287a76ebba2f42aa@kernel.org","name":"Yinghai Lu"},"message":"mm: check if section present during memory block registering\n\ncommit 04697858d89e4bf2650364f8d6956e2554e8ef88 upstream.\n\nTony Luck found on his setup, if memory block size 512M will cause crash\nduring booting.\n\n  BUG: unable to handle kernel paging request at ffffea0074000020\n  IP: get_nid_for_pfn+0x17/0x40\n  PGD 128ffcb067 PUD 128ffc9067 PMD 0\n  Oops: 0000 [#1] SMP\n  Modules linked in:\n  CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.2.0-rc8 #1\n  ...\n  Call Trace:\n     ? register_mem_sect_under_node+0x66/0xe0\n     register_one_node+0x17b/0x240\n     ? pci_iommu_alloc+0x6e/0x6e\n     topology_init+0x3c/0x95\n     do_one_initcall+0xcd/0x1f0\n\nThe system has non continuous RAM address:\n BIOS-e820: [mem 0x0000001300000000-0x0000001cffffffff] usable\n BIOS-e820: [mem 0x0000001d70000000-0x0000001ec7ffefff] usable\n BIOS-e820: [mem 0x0000001f00000000-0x0000002bffffffff] usable\n BIOS-e820: [mem 0x0000002c18000000-0x0000002d6fffefff] usable\n BIOS-e820: [mem 0x0000002e00000000-0x00000039ffffffff] usable\n\nSo there are start sections in memory block not present.  For example:\n\n    memory block : [0x2c18000000, 0x2c20000000) 512M\n\nfirst three sections are not present.\n\nThe current register_mem_sect_under_node() assume first section is\npresent, but memory block section number range [start_section_nr,\nend_section_nr] would include not present section.\n\nFor arch that support vmemmap, we don't setup memmap for struct page\narea within not present sections area.\n\nSo skip the pfn range that belong to absent section.\n\n[akpm@linux-foundation.org: simplification]\n[rientjes@google.com: more simplification]\nFixes: bdee237c0343 (\"x86: mm: Use 2GB memory block size on large memory x86-64 systems\")\nFixes: 982792c782ef (\"x86, mm: probe memory block size for generic x86 64bit\")\nSigned-off-by: Yinghai Lu <yinghai@kernel.org>\nSigned-off-by: David Rientjes <rientjes@google.com>\nReported-by: Tony Luck <tony.luck@intel.com>\nTested-by: Tony Luck <tony.luck@intel.com>\nCc: Greg KH <greg@kroah.com>\nCc: Ingo Molnar <mingo@elte.hu>\nTested-by: David Rientjes <rientjes@google.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/191276cd0e36f4747356b7a298db881886845820"},{"sha":"0fce8532f6a8e94b409a778a1c607c8858a91e68","author":{"email":"3c5fb063765d3c2eb5938ad9ebec439bc976721a@gmail.com","name":"Minfei Huang"},"message":"x86/mm: Initialize pmd_idx in page_table_range_init_count()\n\ncommit 9962eea9e55f797f05f20ba6448929cab2a9f018 upstream.\n\nThe variable pmd_idx is not initialized for the first iteration of the\nfor loop.\n\nAssign the proper value which indexes the start address.\n\nFixes: 719272c45b82 'x86, mm: only call early_ioremap_page_table_range_init() once'\nSigned-off-by: Minfei Huang <mnfhuang@gmail.com>\nCc: tony.luck@intel.com\nCc: wangnan0@huawei.com\nCc: david.vrabel@citrix.com\nReviewed-by: yinghai@kernel.org\nLink: http://lkml.kernel.org/r/1436703522-29552-1-git-send-email-mhuang@redhat.com\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/backbone/backbone-sources/commits/0fce8532f6a8e94b409a778a1c607c8858a91e68"}]}