{"push_id":711552562,"size":92,"distinct_size":92,"ref":"refs/heads/3.18-merge","head":"738735e08e8588b6cfbbe850ae63acf65c2f0a5e","before":"bb3f8613a73d813707c3d33377da8ff000221d0a","commits":[{"sha":"48ab2783948137231b276b2173ca23dae759af78","author":{"email":"e642b69ed2fc111e09ffdc37feb733a52253340d@oracle.com","name":"Sasha Levin"},"message":"Revert \"tools/vm: fix page-flags build\"\n\nThis reverts commit a821ac4c66382f9d6387c8311608f13c6749fea9.\n\nThat patch is not suitable for 3.18.\n\nReported-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/48ab2783948137231b276b2173ca23dae759af78"},{"sha":"0096d0ccb701079017f2ad698d56b89838251724","author":{"email":"66d3c5fdaeea7ff1f996ad04f2c45e08ab38e2f5@linaro.org","name":"Ard Biesheuvel"},"message":"ARM: 8221/1: PJ4: allow building in Thumb-2 mode\n\nTwo files that get included when building the multi_v7_defconfig target\nfail to build when selecting THUMB2_KERNEL for this configuration.\n\nIn both cases, we can just build the file as ARM code, as none of its\nsymbols are exported to modules, so there are no interworking concerns.\nIn the iwmmxt.S case, add ENDPROC() declarations so the symbols are\nannotated as functions, resulting in the linker to emit the appropriate\nmode switches.\n\nAcked-by: Nicolas Pitre <nico@linaro.org>\nTested-by: Olof Johansson <olof@lixom.net>\nSigned-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>\nSigned-off-by: Russell King <rmk+kernel@arm.linux.org.uk>\n(cherry picked from commit 13d1b9575ac2c2da143cd2236b6cf0fc314570f8)\nCc: <stable@vger.kernel.org> # v3.18+\nSigned-off-by: Kevin Hilman <khilman@linaro.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/0096d0ccb701079017f2ad698d56b89838251724"},{"sha":"a2a3d75bc59265924869f15741cce2a8bcce398c","author":{"email":"5c1e68b099950c134891f0b6e179498a8ebe9cf9@linux-foundation.org","name":"Andrew Morton"},"message":"fs/binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings\n\n[ Upstream commit 073aba98f6a2235e2ac4a8402b1a131ab032876e ]\n\ncommit 2b1d3ae940acd11be44c6eced5873d47c2e00ffa upstream.\n\nload_elf_binary() returns `retval', not `error'.\n\nFixes: a87938b2e246b81b4fb (\"fs/binfmt_elf.c: fix bug in loading of PIE binaries\")\nReported-by: James Hogan <james.hogan@imgtec.com>\nCc: Michael Davidson <md@google.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/a2a3d75bc59265924869f15741cce2a8bcce398c"},{"sha":"5d2ed1cd21b16a83059eeb217a562de52239d003","author":{"email":"df4bbba3da7ae0371dc686d07d0ceb66ffa78730@gmail.com","name":"Vlad Yasevich"},"message":"net: core: Correct an over-stringent device loop detection.\n\n[ Upstream commit d66bf7dd27573ee5ea90484899ee952c19ccb194 ]\n\nThe code in __netdev_upper_dev_link() has an over-stringent\nloop detection logic that actually prevents valid configurations\nfrom working correctly.\n\nIn particular, the logic returns an error if an upper device\nis already in the list of all upper devices for a given dev.\nThis particular check seems to be a overzealous as it disallows\nperfectly valid configurations.  For example:\n  # ip l a link eth0 name eth0.10 type vlan id 10\n  # ip l a dev br0 typ bridge\n  # ip l s eth0.10 master br0\n  # ip l s eth0 master br0  <--- Will fail\n\nIf you switch the last two commands (add eth0 first), then both\nwill succeed.  If after that, you remove eth0 and try to re-add\nit, it will fail!\n\nIt appears to be enough to simply check adj_list to keeps things\nsafe.\n\nI've tried stacking multiple devices multiple times in all different\ncombinations, and either rx_handler registration prevented the stacking\nof the device linking cought the error.\n\nSigned-off-by: Vladislav Yasevich <vyasevic@redhat.com>\nAcked-by: Jiri Pirko <jiri@resnulli.us>\nAcked-by: Veaceslav Falico <vfalico@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/5d2ed1cd21b16a83059eeb217a562de52239d003"},{"sha":"8cf633a242cb01b9cea77604337bc9801c3eb5ae","author":{"email":"c24c0248770ae98831f8a654310d4c2e07514c61@plumgrid.com","name":"Alexei Starovoitov"},"message":"x86: bpf_jit: fix FROM_BE16 and FROM_LE16/32 instructions\n\n[ Upstream commit 343f845b375989f1753f605902931fa939aa2223 ]\n\nFROM_BE16:\n'ror %reg, 8' doesn't clear upper bits of the register,\nso use additional 'movzwl' insn to zero extend 16 bits into 64\n\nFROM_LE16:\nshould zero extend lower 16 bits into 64 bit\n\nFROM_LE32:\nshould zero extend lower 32 bits into 64 bit\n\nFixes: 89aa075832b0 (\"net: sock: allow eBPF programs to be attached to sockets\")\nSigned-off-by: Alexei Starovoitov <ast@plumgrid.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/8cf633a242cb01b9cea77604337bc9801c3eb5ae"},{"sha":"645995e2934706449c4214a3f0f881d6c7fbc5fe","author":{"email":"c24c0248770ae98831f8a654310d4c2e07514c61@plumgrid.com","name":"Alexei Starovoitov"},"message":"x86: bpf_jit: fix compilation of large bpf programs\n\n[ Upstream commit 3f7352bf21f8fd7ba3e2fcef9488756f188e12be ]\n\nx86 has variable length encoding. x86 JIT compiler is trying\nto pick the shortest encoding for given bpf instruction.\nWhile doing so the jump targets are changing, so JIT is doing\nmultiple passes over the program. Typical program needs 3 passes.\nSome very short programs converge with 2 passes. Large programs\nmay need 4 or 5. But specially crafted bpf programs may hit the\npass limit and if the program converges on the last iteration\nthe JIT compiler will be producing an image full of 'int 3' insns.\nFix this corner case by doing final iteration over bpf program.\n\nFixes: 0a14842f5a3c (\"net: filter: Just In Time compiler for x86-64\")\nReported-by: Daniel Borkmann <daniel@iogearbox.net>\nSigned-off-by: Alexei Starovoitov <ast@plumgrid.com>\nTested-by: Daniel Borkmann <daniel@iogearbox.net>\nAcked-by: Daniel Borkmann <daniel@iogearbox.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/645995e2934706449c4214a3f0f881d6c7fbc5fe"},{"sha":"b23b97ca70a9fe03bb3e3e74bc8d120b0e15e4fb","author":{"email":"59190c1867e3222b932a0de3c668eb2d980d69a2@gmail.com","name":"Florian Fainelli"},"message":"net: phy: Allow EEE for all RGMII variants\n\n[ Upstream commit 7e14069651591c81046ffaec13c3dac8cb70f5fb ]\n\nRGMII interfaces come in multiple flavors: RGMII with transmit or\nreceive internal delay, no delays at all, or delays in both direction.\n\nThis change extends the initial check for PHY_INTERFACE_MODE_RGMII to\ncover all of these variants since EEE should be allowed for any of these\nmodes, since it is a property of the RGMII, hence Gigabit PHY capability\nmore than the RGMII electrical interface and its delays.\n\nFixes: a59a4d192166 (\"phy: add the EEE support and the way to access to the MMD registers\")\nSigned-off-by: Florian Fainelli <f.fainelli@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/b23b97ca70a9fe03bb3e3e74bc8d120b0e15e4fb"},{"sha":"984ff7a3e0603d4bc472ad09f4f119089085d8ca","author":{"email":"7864bb1e0e12322ea18ea731d051b95b75140567@6wind.com","name":"Nicolas Dichtel"},"message":"rtnl/bond: don't send rtnl msg for unregistered iface\n\n[ Upstream commit ed2a80ab7b76f11af0b2c6255709c4ebf164b667 ]\n\nBefore the patch, the command 'ip link add bond2 type bond mode 802.3ad'\ncauses the kernel to send a rtnl message for the bond2 interface, with an\nifindex 0.\n\n'ip monitor' shows:\n0: bond2: <BROADCAST,MULTICAST,MASTER> mtu 1500 state DOWN group default\n    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff\n9: bond2@NONE: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noop state DOWN group default\n    link/ether ea:3e:1f:53:92:7b brd ff:ff:ff:ff:ff:ff\n[snip]\n\nThe patch fixes the spotted bug by checking in bond driver if the interface\nis registered before calling the notifier chain.\nIt also adds a check in rtmsg_ifinfo() to prevent this kind of bug in the\nfuture.\n\nFixes: d4261e565000 (\"bonding: create netlink event when bonding option is changed\")\nCC: Jiri Pirko <jiri@resnulli.us>\nReported-by: Julien Meunier <julien.meunier@6wind.com>\nSigned-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/984ff7a3e0603d4bc472ad09f4f119089085d8ca"},{"sha":"dc3c6cb6eb811e8e27ff0acefb2cc7d16b1b976b","author":{"email":"787ae617617698b2b89c353cdfb3f2e4d16ffeb7@enst-bretagne.fr","name":"Florent Fourcot"},"message":"tcp/ipv6: fix flow label setting in TIME_WAIT state\n\n[ Upstream commit 21858cd02dabcf290564cbf4769b101eba54d7bb ]\n\ncommit 1d13a96c74fc (\"ipv6: tcp: fix flowlabel value in ACK messages\nsend from TIME_WAIT\") added the flow label in the last TCP packets.\nUnfortunately, it was not casted properly.\n\nThis patch replace the buggy shift with be32_to_cpu/cpu_to_be32.\n\nFixes: 1d13a96c74fc (\"ipv6: tcp: fix flowlabel value in ACK messages\")\nReported-by: Eric Dumazet <eric.dumazet@gmail.com>\nSigned-off-by: Florent Fourcot <florent.fourcot@enst-bretagne.fr>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/dc3c6cb6eb811e8e27ff0acefb2cc7d16b1b976b"},{"sha":"359aeb0ae4a0e461368d7859ceb79086901dea7e","author":{"email":"35b1cb25ad22a15c873242a24069a9b71f851b2d@gmail.com","name":"Henning Rogge"},"message":"net/ipv6/udp: Fix ipv6 multicast socket filter regression\n\n[ Upstream commit 33b4b015e1a1ca7a8fdce40af5e71642a8ea355c ]\n\nCommit <5cf3d46192fc> (\"udp: Simplify__udp*_lib_mcast_deliver\")\nsimplified the filter for incoming IPv6 multicast but removed\nthe check of the local socket address and the UDP destination\naddress.\n\nThis patch restores the filter to prevent sockets bound to a IPv6\nmulticast IP to receive other UDP traffic link unicast.\n\nSigned-off-by: Henning Rogge <hrogge@gmail.com>\nFixes: 5cf3d46192fc (\"udp: Simplify__udp*_lib_mcast_deliver\")\nCc: \"David S. Miller\" <davem@davemloft.net>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/359aeb0ae4a0e461368d7859ceb79086901dea7e"},{"sha":"f9a17e86e8f0cf87ca42ccf7dced3e34cc4d699f","author":{"email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@iogearbox.net","name":"Daniel Borkmann"},"message":"net: sched: fix call_rcu() race on classifier module unloads\n\n[ Upstream commit c78e1746d3ad7d548bdf3fe491898cc453911a49 ]\n\nVijay reported that a loop as simple as ...\n\n  while true; do\n    tc qdisc add dev foo root handle 1: prio\n    tc filter add dev foo parent 1: u32 match u32 0 0  flowid 1\n    tc qdisc del dev foo root\n    rmmod cls_u32\n  done\n\n... will panic the kernel. Moreover, he bisected the change\napparently introducing it to 78fd1d0ab072 (\"netlink: Re-add\nlocking to netlink_lookup() and seq walker\").\n\nThe removal of synchronize_net() from the netlink socket\ntriggering the qdisc to be removed, seems to have uncovered\nan RCU resp. module reference count race from the tc API.\nGiven that RCU conversion was done after e341694e3eb5 (\"netlink:\nConvert netlink_lookup() to use RCU protected hash table\")\nwhich added the synchronize_net() originally, occasion of\nhitting the bug was less likely (not impossible though):\n\nWhen qdiscs that i) support attaching classifiers and,\nii) have at least one of them attached, get deleted, they\ninvoke tcf_destroy_chain(), and thus call into ->destroy()\nhandler from a classifier module.\n\nAfter RCU conversion, all classifier that have an internal\nprio list, unlink them and initiate freeing via call_rcu()\ndeferral.\n\nMeanhile, tcf_destroy() releases already reference to the\ntp->ops->owner module before the queued RCU callback handler\nhas been invoked.\n\nSubsequent rmmod on the classifier module is then not prevented\nsince all module references are already dropped.\n\nBy the time, the kernel invokes the RCU callback handler from\nthe module, that function address is then invalid.\n\nOne way to fix it would be to add an rcu_barrier() to\nunregister_tcf_proto_ops() to wait for all pending call_rcu()s\nto complete.\n\nsynchronize_rcu() is not appropriate as under heavy RCU\ncallback load, registered call_rcu()s could be deferred\nlonger than a grace period. In case we don't have any pending\ncall_rcu()s, the barrier is allowed to return immediately.\n\nSince we came here via unregister_tcf_proto_ops(), there\nare no users of a given classifier anymore. Further nested\ncall_rcu()s pointing into the module space are not being\ndone anywhere.\n\nOnly cls_bpf_delete_prog() may schedule a work item, to\nunlock pages eventually, but that is not in the range/context\nof cls_bpf anymore.\n\nFixes: 25d8c0d55f24 (\"net: rcu-ify tcf_proto\")\nFixes: 9888faefe132 (\"net: sched: cls_basic use RCU\")\nReported-by: Vijay Subramanian <subramanian.vijay@gmail.com>\nSigned-off-by: Daniel Borkmann <daniel@iogearbox.net>\nCc: John Fastabend <john.r.fastabend@intel.com>\nCc: Eric Dumazet <edumazet@google.com>\nCc: Thomas Graf <tgraf@suug.ch>\nCc: Jamal Hadi Salim <jhs@mojatatu.com>\nCc: Alexei Starovoitov <ast@plumgrid.com>\nTested-by: Vijay Subramanian <subramanian.vijay@gmail.com>\nAcked-by: Alexei Starovoitov <ast@plumgrid.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/f9a17e86e8f0cf87ca42ccf7dced3e34cc4d699f"},{"sha":"fd92b07cb49f8d64efbf25bd344ab1855100b3ad","author":{"email":"8a741aa8cbd77ebc4a56ddb528ce9fd15d42f034@xmission.com","name":"Eric W. Biederman"},"message":"ipv4: Avoid crashing in ip_error\n\n[ Upstream commit 381c759d9916c42959515ad34a6d467e24a88e93 ]\n\nip_error does not check if in_dev is NULL before dereferencing it.\n\nIThe following sequence of calls is possible:\nCPU A                          CPU B\nip_rcv_finish\n    ip_route_input_noref()\n        ip_route_input_slow()\n                               inetdev_destroy()\n    dst_input()\n\nWith the result that a network device can be destroyed while processing\nan input packet.\n\nA crash was triggered with only unicast packets in flight, and\nforwarding enabled on the only network device.   The error condition\nwas created by the removal of the network device.\n\nAs such it is likely the that error code was -EHOSTUNREACH, and the\naction taken by ip_error (if in_dev had been accessible) would have\nbeen to not increment any counters and to have tried and likely failed\nto send an icmp error as the network device is going away.\n\nTherefore handle this weird case by just dropping the packet if\n!in_dev.  It will result in dropping the packet sooner, and will not\nresult in an actual change of behavior.\n\nFixes: 251da4130115b (\"ipv4: Cache ip_error() routes even when not forwarding.\")\nReported-by: Vittorio Gambaletta <linuxbugs@vittgam.net>\nTested-by: Vittorio Gambaletta <linuxbugs@vittgam.net>\nSigned-off-by: Vittorio Gambaletta <linuxbugs@vittgam.net>\nSigned-off-by: \"Eric W. Biederman\" <ebiederm@xmission.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/fd92b07cb49f8d64efbf25bd344ab1855100b3ad"},{"sha":"842e6e8fe4c5e2fb62abe3a4ba5b213999d39eb3","author":{"email":"8a2957e0063f2abf61bd145b6236a74a3708ac54@mork.no","name":"Bjørn Mork"},"message":"cdc_ncm: Fix tx_bytes statistics\n\n[ Upstream commit 44f6731d8b68fa02f5ed65eaceac41f8c3c9279e ]\n\nThe tx_curr_frame_payload field is u32. When we try to calculate a\nsmall negative delta based on it, we end up with a positive integer\nclose to 2^32 instead.  So the tx_bytes pointer increases by about\n2^32 for every transmitted frame.\n\nFix by calculating the delta as a signed long.\n\nCc: Ben Hutchings <ben.hutchings@codethink.co.uk>\nReported-by: Florian Bruhin <me@the-compiler.org>\nFixes: 7a1e890e2168 (\"usbnet: Fix tx_bytes statistic running backward in cdc_ncm\")\nSigned-off-by: Bjørn Mork <bjorn@mork.no>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/842e6e8fe4c5e2fb62abe3a4ba5b213999d39eb3"},{"sha":"b1c6cc17a1faac52b22e7597a1cc16d41a9381f4","author":{"email":"c8883472cb5fbead63941b41bccc869c7deaf90f@redhat.com","name":"Thadeu Lima de Souza Cascardo"},"message":"bridge: fix parsing of MLDv2 reports\n\n[ Upstream commit 47cc84ce0c2fe75c99ea5963c4b5704dd78ead54 ]\n\nWhen more than a multicast address is present in a MLDv2 report, all but\nthe first address is ignored, because the code breaks out of the loop if\nthere has not been an error adding that address.\n\nThis has caused failures when two guests connected through the bridge\ntried to communicate using IPv6. Neighbor discoveries would not be\ntransmitted to the other guest when both used a link-local address and a\nstatic address.\n\nThis only happens when there is a MLDv2 querier in the network.\n\nThe fix will only break out of the loop when there is a failure adding a\nmulticast address.\n\nThe mdb before the patch:\n\ndev ovirtmgmt port vnet0 grp ff02::1:ff7d:6603 temp\ndev ovirtmgmt port vnet1 grp ff02::1:ff7d:6604 temp\ndev ovirtmgmt port bond0.86 grp ff02::2 temp\n\nAfter the patch:\n\ndev ovirtmgmt port vnet0 grp ff02::1:ff7d:6603 temp\ndev ovirtmgmt port vnet1 grp ff02::1:ff7d:6604 temp\ndev ovirtmgmt port bond0.86 grp ff02::fb temp\ndev ovirtmgmt port bond0.86 grp ff02::2 temp\ndev ovirtmgmt port bond0.86 grp ff02::d temp\ndev ovirtmgmt port vnet0 grp ff02::1:ff00:76 temp\ndev ovirtmgmt port bond0.86 grp ff02::16 temp\ndev ovirtmgmt port vnet1 grp ff02::1:ff00:77 temp\ndev ovirtmgmt port bond0.86 grp ff02::1:ff00:def temp\ndev ovirtmgmt port bond0.86 grp ff02::1:ffa1:40bf temp\n\nFixes: 08b202b67264 (\"bridge br_multicast: IPv6 MLD support.\")\nReported-by: Rik Theys <Rik.Theys@esat.kuleuven.be>\nSigned-off-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com>\nTested-by: Rik Theys <Rik.Theys@esat.kuleuven.be>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/b1c6cc17a1faac52b22e7597a1cc16d41a9381f4"},{"sha":"33f099e8721a9a0c8b5640da81f4163bdb78f597","author":{"email":"e27030aebe9cad8817d34b8c31dbaf301fb798b9@gmail.com","name":"Richard Cochran"},"message":"net: dp83640: fix broken calibration routine.\n\n[ Upstream commit 397a253af5031de4a4612210055935309af4472c ]\n\nCurrently, the calibration function that corrects the initial offsets\namong multiple devices only works the first time.  If the function is\ncalled more than once, the calibration fails and bogus offsets will be\nprogrammed into the devices.\n\nIn a well hidden spot, the device documentation tells that trigger indexes\n0 and 1 are special in allowing the TRIG_IF_LATE flag to actually work.\n\nThis patch fixes the issue by using one of the special triggers during the\nrecalibration method.\n\nSigned-off-by: Richard Cochran <richardcochran@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/33f099e8721a9a0c8b5640da81f4163bdb78f597"},{"sha":"adbea7ba29a526964bd5f5e1186f198f47f540a5","author":{"email":"e27030aebe9cad8817d34b8c31dbaf301fb798b9@gmail.com","name":"Richard Cochran"},"message":"net: dp83640: reinforce locking rules.\n\n[ Upstream commit a935865c828c8cd20501f618c69f659a5b6d6a5f ]\n\nCallers of the ext_write function are supposed to hold a mutex that\nprotects the state of the dialed page, but one caller was missing the\nlock from the very start, and over time the code has been changed\nwithout following the rule.  This patch cleans up the call sites in\nviolation of the rule.\n\nSigned-off-by: Richard Cochran <richardcochran@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/adbea7ba29a526964bd5f5e1186f198f47f540a5"},{"sha":"21efd84e1033d65507096025e3867f7385e95ef5","author":{"email":"e27030aebe9cad8817d34b8c31dbaf301fb798b9@gmail.com","name":"Richard Cochran"},"message":"net: dp83640: fix improper double spin locking.\n\n[ Upstream commit adbe088f6f8b0b7701fe07f51fe6f2bd602a6665 ]\n\nA pair of nested spin locks was introduced in commit 63502b8d0\n\"dp83640: Fix receive timestamp race condition\".\n\nUnfortunately the 'flags' parameter was reused for the inner lock,\nclobbering the originally saved IRQ state.  This patch fixes the issue\nby changing the inner lock to plain spin_lock without irqsave.\n\nSigned-off-by: Richard Cochran <richardcochran@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/21efd84e1033d65507096025e3867f7385e95ef5"},{"sha":"b991285c5f73cef701c9e81418af4b6eaa322567","author":{"email":"4bb1064d1f46929ded0070376617aece30f0ee54@android.com","name":"Mark Salyzyn"},"message":"unix/caif: sk_socket can disappear when state is unlocked\n\n[ Upstream commit b48732e4a48d80ed4a14812f0bab09560846514e ]\n\ngot a rare NULL pointer dereference in clear_bit\n\nSigned-off-by: Mark Salyzyn <salyzyn@android.com>\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\n----\nv2: switch to sock_flag(sk, SOCK_DEAD) and added net/caif/caif_socket.c\nv3: return -ECONNRESET in upstream caller of wait function for SOCK_DEAD\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/b991285c5f73cef701c9e81418af4b6eaa322567"},{"sha":"688497a2e8db77d26d4944cead7d87dc719c3fa1","author":{"email":"d769abb2ab51a4b3c6d56e5ec4ccdd860b82f07a@citrix.com","name":"Ross Lagerwall"},"message":"xen/netback: Properly initialize credit_bytes\n\n[ Upstream commit ce0e5c522d3924090c20e774359809a7aa08c44c ]\n\nCommit e9ce7cb6b107 (\"xen-netback: Factor queue-specific data into queue\nstruct\") introduced a regression when moving queue-specific data into\nthe queue struct by failing to set the credit_bytes field. This\nprevented bandwidth limiting from working. Initialize the field as it\nwas done before multiqueue support was added.\n\nSigned-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>\nAcked-by: Wei Liu <wei.liu2@citrix.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/688497a2e8db77d26d4944cead7d87dc719c3fa1"},{"sha":"4b72bd1886b316b05349331d62ae0886b78cedd9","author":{"email":"0f114804888b88d50037b04b42e57b858d851b87@gmail.com","name":"WANG Cong"},"message":"net_sched: invoke ->attach() after setting dev->qdisc\n\n[ Upstream commit 86e363dc3b50bfd50a1f315934583fbda673ab8d ]\n\nFor mq qdisc, we add per tx queue qdisc to root qdisc\nfor display purpose, however, that happens too early,\nbefore the new dev->qdisc is finally set, this causes\nq->list points to an old root qdisc which is going to be\nfreed right before assigning with a new one.\n\nFix this by moving ->attach() after setting dev->qdisc.\n\nFor the record, this fixes the following crash:\n\n ------------[ cut here ]------------\n WARNING: CPU: 1 PID: 975 at lib/list_debug.c:59 __list_del_entry+0x5a/0x98()\n list_del corruption. prev->next should be ffff8800d1998ae8, but was 6b6b6b6b6b6b6b6b\n CPU: 1 PID: 975 Comm: tc Not tainted 4.1.0-rc4+ #1019\n Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n  0000000000000009 ffff8800d73fb928 ffffffff81a44e7f 0000000047574756\n  ffff8800d73fb978 ffff8800d73fb968 ffffffff810790da ffff8800cfc4cd20\n  ffffffff814e725b ffff8800d1998ae8 ffffffff82381250 0000000000000000\n Call Trace:\n  [<ffffffff81a44e7f>] dump_stack+0x4c/0x65\n  [<ffffffff810790da>] warn_slowpath_common+0x9c/0xb6\n  [<ffffffff814e725b>] ? __list_del_entry+0x5a/0x98\n  [<ffffffff81079162>] warn_slowpath_fmt+0x46/0x48\n  [<ffffffff81820eb0>] ? dev_graft_qdisc+0x5e/0x6a\n  [<ffffffff814e725b>] __list_del_entry+0x5a/0x98\n  [<ffffffff814e72a7>] list_del+0xe/0x2d\n  [<ffffffff81822f05>] qdisc_list_del+0x1e/0x20\n  [<ffffffff81820cd1>] qdisc_destroy+0x30/0xd6\n  [<ffffffff81822676>] qdisc_graft+0x11d/0x243\n  [<ffffffff818233c1>] tc_get_qdisc+0x1a6/0x1d4\n  [<ffffffff810b5eaf>] ? mark_lock+0x2e/0x226\n  [<ffffffff817ff8f5>] rtnetlink_rcv_msg+0x181/0x194\n  [<ffffffff817ff72e>] ? rtnl_lock+0x17/0x19\n  [<ffffffff817ff72e>] ? rtnl_lock+0x17/0x19\n  [<ffffffff817ff774>] ? __rtnl_unlock+0x17/0x17\n  [<ffffffff81855dc6>] netlink_rcv_skb+0x4d/0x93\n  [<ffffffff817ff756>] rtnetlink_rcv+0x26/0x2d\n  [<ffffffff818544b2>] netlink_unicast+0xcb/0x150\n  [<ffffffff81161db9>] ? might_fault+0x59/0xa9\n  [<ffffffff81854f78>] netlink_sendmsg+0x4fa/0x51c\n  [<ffffffff817d6e09>] sock_sendmsg_nosec+0x12/0x1d\n  [<ffffffff817d8967>] sock_sendmsg+0x29/0x2e\n  [<ffffffff817d8cf3>] ___sys_sendmsg+0x1b4/0x23a\n  [<ffffffff8100a1b8>] ? native_sched_clock+0x35/0x37\n  [<ffffffff810a1d83>] ? sched_clock_local+0x12/0x72\n  [<ffffffff810a1fd4>] ? sched_clock_cpu+0x9e/0xb7\n  [<ffffffff810def2a>] ? current_kernel_time+0xe/0x32\n  [<ffffffff810b4bc5>] ? lock_release_holdtime.part.29+0x71/0x7f\n  [<ffffffff810ddebf>] ? read_seqcount_begin.constprop.27+0x5f/0x76\n  [<ffffffff810b6292>] ? trace_hardirqs_on_caller+0x17d/0x199\n  [<ffffffff811b14d5>] ? __fget_light+0x50/0x78\n  [<ffffffff817d9808>] __sys_sendmsg+0x42/0x60\n  [<ffffffff817d9838>] SyS_sendmsg+0x12/0x1c\n  [<ffffffff81a50e97>] system_call_fastpath+0x12/0x6f\n ---[ end trace ef29d3fb28e97ae7 ]---\n\nFor long term, we probably need to clean up the qdisc_graft() code\nin case it hides other bugs like this.\n\nFixes: 95dc19299f74 (\"pkt_sched: give visibility to mq slave qdiscs\")\nCc: Jamal Hadi Salim <jhs@mojatatu.com>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <sasha.levin@oracle.com>","distinct":true,"url":"https://api.github.com/repos/digetx/picasso_upstream_support/commits/4b72bd1886b316b05349331d62ae0886b78cedd9"}]}