{"push_id":567333415,"size":6,"distinct_size":6,"ref":"refs/heads/master","head":"9d72289915a56e1b5d40844e84ad198c9bc1e3a9","before":"b223ab482a3665493ff3c9b57780ec6266dde837","commits":[{"sha":"6c5fbf1f4901b69cb6feb30144235b1ac2a92422","author":{"email":"de609eb4d5d70b1d38ec6642adbfc33a2781f63c@zeniv.linux.org.uk","name":"Al Viro"},"message":"new helper: iterate_fd()\n\niterates through the opened files in given descriptor table,\ncalling a supplied function; we stop once non-zero is returned.\nCallback gets struct file *, descriptor number and const void *\nargument passed to iterator.  It is called with files->file_lock\nheld, so it is not allowed to block.\n\ntty_io, netprio_cgroup and selinux flush_unauthorized_files()\nconverted to its use.\n\nChange-Id: I2d89b18c450d64c2e9ec20a0b26977b65afce836\nSigned-off-by: Al Viro <viro@zeniv.linux.org.uk>","distinct":true,"url":"https://api.github.com/repos/fxTHaxxorX/android_kernel_sony_msm8974/commits/6c5fbf1f4901b69cb6feb30144235b1ac2a92422"},{"sha":"d34ef2bd9e00e752b2624838851e35f7fc35a975","author":{"email":"b2abd4fd7a88af9e2060dd190b9a75981518104c@gmail.com","name":"maxwen"},"message":"msm8974: added input mediator\n\nBrain dumb simple 2 level input event chain.\nFor clients that want input events to appear in a\ncertain order e.g. cpu hotplugging should get it\nbefore cpufreq so that input boost is on all online\ncpus\n\nThis is used in load_stats and rq_stats hotplugging\ngovernor and in smartmax cpu governor\n\nThis is completely optional and will not influence\n\"normal\" input event handling\n\nChange-Id: I3e3c28cffb640ec0f543eea7994a55bfa4182221","distinct":true,"url":"https://api.github.com/repos/fxTHaxxorX/android_kernel_sony_msm8974/commits/d34ef2bd9e00e752b2624838851e35f7fc35a975"},{"sha":"5cc4f3296fe78b66b53eeb63312520c5161469ab","author":{"email":"85e533f2e78486213c4d69f71462342ec0c62734@redhat.com","name":"Mike Snitzer"},"message":"dm: handle requests beyond end of device instead of using BUG_ON\n\ncommit ba1cbad93dd47223b1f3b8edd50dd9ef2abcb2ed upstream.\n\nThe access beyond the end of device BUG_ON that was introduced to\ndm_request_fn via commit 29e4013de7ad950280e4b2208 (\"dm: implement\nREQ_FLUSH/FUA support for request-based dm\") was an overly\ndrastic (but simple) response to this situation.\n\nI have received a report that this BUG_ON was hit and now think\nit would be better to use dm_kill_unmapped_request() to fail the clone\nand original request with -EIO.\n\nmap_request() will assign the valid target returned by\ndm_table_find_target to tio->ti.  But when the target\nisn't valid tio->ti is never assigned (because map_request isn't\ncalled); so add a check for tio->ti != NULL to dm_done().\n\nReported-by: Mike Christie <michaelc@cs.wisc.edu>\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>\nSigned-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>\nSigned-off-by: Alasdair G Kergon <agk@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nChange-Id: I421ad803bb717d570e55718856e49c19e8dabab7","distinct":true,"url":"https://api.github.com/repos/fxTHaxxorX/android_kernel_sony_msm8974/commits/5cc4f3296fe78b66b53eeb63312520c5161469ab"},{"sha":"4cb59f7a359f143595cb4985c00cf74c060cff87","author":{"email":"cd8c6775e60d6f67a6984377324e5290df3d5358@kernel.dk","name":"Jens Axboe"},"message":"dm: fix deadlock with request based dm and queue request_fn recursion\n\ncommit a8c32a5c98943d370ea606a2e7dc04717eb92206 upstream.\n\nRequest based dm attempts to re-run the request queue off the\nrequest completion path. If used with a driver that potentially does\nend_io from its request_fn, we could deadlock trying to recurse\nback into request dispatch. Fix this by punting the request queue\nrun to kblockd.\n\nTested to fix a quickly reproducible deadlock in such a scenario.\n\nAcked-by: Alasdair G Kergon <agk@redhat.com>\nSigned-off-by: Jens Axboe <axboe@kernel.dk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nChange-Id: If8d1556f89586d0a9737a4ae5e1ac0fa8719c575","distinct":true,"url":"https://api.github.com/repos/fxTHaxxorX/android_kernel_sony_msm8974/commits/4cb59f7a359f143595cb4985c00cf74c060cff87"},{"sha":"c00c4ab8bc5e5acc2a8cb4041f24e1d0f98d2907","author":{"email":"cefec785729e5544bb655781214fffa7fb6a10de@profitbricks.com","name":"Sebastian Riemer"},"message":"md: protect against crash upon fsync on ro array\n\ncommit bbfa57c0f2243a7c31fd248d22e9861a2802cad5 upstream.\n\nIf an fsync occurs on a read-only array, we need to send a\ncompletion for the IO and may not increment the active IO count.\nOtherwise, we hit a bug trace and can't stop the MD array anymore.\n\nBy advice of Christoph Hellwig we return success upon a flush\nrequest but we return -EROFS for other writes.\nWe detect flush requests by checking if the bio has zero sectors.\n\nThis patch is suitable to any -stable kernel to which it applies.\n\nSigned-off-by: Sebastian Riemer <sebastian.riemer@profitbricks.com>\nCc: Christoph Hellwig <hch@infradead.org>\nCc: Ben Hutchings <ben@decadent.org.uk>\nCc: NeilBrown <neilb@suse.de>\nReported-by: Ben Hutchings <ben@decadent.org.uk>\nAcked-by: Paul Menzel <paulepanter@users.sourceforge.net>\nSigned-off-by: NeilBrown <neilb@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nChange-Id: I6373514b4da0fd9b7a570d5a572c80381e4e986c","distinct":true,"url":"https://api.github.com/repos/fxTHaxxorX/android_kernel_sony_msm8974/commits/c00c4ab8bc5e5acc2a8cb4041f24e1d0f98d2907"},{"sha":"9d72289915a56e1b5d40844e84ad198c9bc1e3a9","author":{"email":"620085386a2c64ec2f1d43bef997c15003f13da2@redhat.com","name":"Alasdair G Kergon"},"message":"dm ioctl: prevent unsafe change to dm_ioctl data_size\n\ncommit e910d7ebecd1aac43125944a8641b6cb1a0dfabe upstream.\n\nAbort dm ioctl processing if userspace changes the data_size parameter\nafter we validated it but before we finished copying the data buffer\nfrom userspace.\n\nThe dm ioctl parameters are processed in the following sequence:\n 1. ctl_ioctl() calls copy_params();\n 2. copy_params() makes a first copy of the fixed-sized portion of the\n    userspace parameters into the local variable \"tmp\";\n 3. copy_params() then validates tmp.data_size and allocates a new\n    structure big enough to hold the complete data and copies the whole\n    userspace buffer there;\n 4. ctl_ioctl() reads userspace data the second time and copies the whole\n    buffer into the pointer \"param\";\n 5. ctl_ioctl() reads param->data_size without any validation and stores it\n    in the variable \"input_param_size\";\n 6. \"input_param_size\" is further used as the authoritative size of the\n    kernel buffer.\n\nThe problem is that userspace code could change the contents of user\nmemory between steps 2 and 4.  In particular, the data_size parameter\ncan be changed to an invalid value after the kernel has validated it.\nThis lets userspace force the kernel to access invalid kernel memory.\n\nThe fix is to ensure that the size has not changed at step 4.\n\nThis patch shouldn't have a security impact because CAP_SYS_ADMIN is\nrequired to run this code, but it should be fixed anyway.\n\nReported-by: Mikulas Patocka <mpatocka@redhat.com>\nSigned-off-by: Alasdair G Kergon <agk@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\nChange-Id: I49bbf88aa8ba464bf8fbcb6a970ee905a301b21d","distinct":true,"url":"https://api.github.com/repos/fxTHaxxorX/android_kernel_sony_msm8974/commits/9d72289915a56e1b5d40844e84ad198c9bc1e3a9"}]}