payload: {"push_id":3804079432,"size":6,"distinct_size":6,"ref":"refs/heads/mkp","head":"e7d86097e64d43323f4b4a67d3d6e80d989500c9","before":"66b6bcf29b0f085d33bd3d13ea22d7418998f870","commits":[{"sha":"ebbb8798444a20631b5ff38a54dacf5b5d0ee19b","author":{"name":"PIPIPIG233666","email":"1c9d593876b9ecd3913042a2ff5f1fc2e2497b42@qq.com"},"message":"4.4.184-->4.4.185\n\ncommit 14e11966c8e746308e94cd3cb7af738712def7b1\nMerge: d657433f124d 7bbf48947605\nAuthor: Greg Kroah-Hartman <gregkh@google.com>\nDate:   Wed Jul 10 12:48:10 2019 +0200\n\n    Merge 4.4.185 into android-4.4\n\n    Changes in 4.4.185\n    \tfs/binfmt_flat.c: make load_flat_shared_library() work\n    \tmm/page_idle.c: fix oops because end_pfn is larger than max_pfn\n    \tscsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck()\n    \ttracing: Silence GCC 9 array bounds warning\n    \tgcc-9: silence 'address-of-packed-member' warning\n    \tusb: chipidea: udc: workaround for endpoint conflict issue\n    \tInput: uinput - add compat ioctl number translation for UI_*_FF_UPLOAD\n    \tapparmor: enforce nullbyte at end of tag string\n    \tparport: Fix mem leak in parport_register_dev_model\n    \tparisc: Fix compiler warnings in float emulation code\n    \tIB/hfi1: Insure freeze_work work_struct is canceled on shutdown\n    \tMIPS: uprobes: remove set but not used variable 'epc'\n    \tnet: hns: Fix loopback test failed at copper ports\n    \tsparc: perf: fix updated event period in response to PERF_EVENT_IOC_PERIOD\n    \tscripts/checkstack.pl: Fix arm64 wrong or unknown architecture\n    \tscsi: ufs: Check that space was properly alloced in copy_query_response\n    \ts390/qeth: fix VLAN attribute in bridge_hostnotify udev event\n    \thwmon: (pmbus/core) Treat parameters as paged if on multiple pages\n    \tBtrfs: fix race between readahead and device replace/removal\n    \tbtrfs: start readahead also in seed devices\n    \tcan: flexcan: fix timeout when set small bitrate\n    \tcan: purge socket error queue on sock destruct\n    \tARM: imx: cpuidle-imx6sx: Restrict the SW2ISO increase to i.MX6SX\n    \tBluetooth: Align minimum encryption key size for LE and BR/EDR connections\n    \tBluetooth: Fix regression with minimum encryption key size alignment\n    \tSMB3: retry on STATUS_INSUFFICIENT_RESOURCES instead of failing write\n    \tcfg80211: fix memory leak of wiphy device name\n    \tmac80211: drop robust management frames from unknown TA\n    \tperf ui helpline: Use strlcpy() as a shorter form of strncpy() + explicit set nul\n    \tperf help: Remove needless use of strncpy()\n    \t9p/rdma: do not disconnect on down_interruptible EAGAIN\n    \t9p: acl: fix uninitialized iattr access\n    \t9p/rdma: remove useless check in cm_event_handler\n    \t9p: p9dirent_read: check network-provided name length\n    \tnet/9p: include trans_common.h to fix missing prototype warning.\n    \tKVM: X86: Fix scan ioapic use-before-initialization\n    \tovl: modify ovl_permission() to do checks on two inodes\n    \tx86/speculation: Allow guests to use SSBD even if host does not\n    \tcpu/speculation: Warn on unsupported mitigations= parameter\n    \tsctp: change to hold sk after auth shkey is created successfully\n    \ttipc: change to use register_pernet_device\n    \ttipc: check msg->req data len in tipc_nl_compat_bearer_disable\n    \tteam: Always enable vlan tx offload\n    \tipv4: Use return value of inet_iif() for __raw_v4_lookup in the while loop\n    \tbonding: Always enable vlan tx offload\n    \tnet: check before dereferencing netdev_ops during busy poll\n    \tBluetooth: Fix faulty expression for minimum encryption key size check\n    \tum: Compile with modern headers\n    \tASoC : cs4265 : readable register too low\n    \tspi: bitbang: Fix NULL pointer dereference in spi_unregister_master\n    \tASoC: max98090: remove 24-bit format support if RJ is 0\n    \tusb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i]\n    \tusb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC\n    \tscsi: hpsa: correct ioaccel2 chaining\n    \tARC: Assume multiplier is always present\n    \tARC: fix build warning in elf.h\n    \tMIPS: math-emu: do not use bools for arithmetic\n    \tmfd: omap-usb-tll: Fix register offsets\n    \tswiotlb: Make linux/swiotlb.h standalone includible\n    \tbug.h: work around GCC PR82365 in BUG()\n    \tMIPS: Workaround GCC __builtin_unreachable reordering bug\n    \tptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME\n    \tcrypto: user - prevent operating on larval algorithms\n    \tALSA: seq: fix incorrect order of dest_client/dest_ports arguments\n    \tALSA: firewire-lib/fireworks: fix miss detection of received MIDI messages\n    \tALSA: usb-audio: fix sign unintended sign extension on left shifts\n    \tlib/mpi: Fix karactx leak in mpi_powm\n    \tbtrfs: Ensure replaced device doesn't have pending chunk allocation\n    \ttty: rocket: fix incorrect forward declaration of 'rp_init()'\n    \tARC: handle gcc generated __builtin_trap for older compiler\n    \tarm64, vdso: Define vdso_{start,end} as array\n    \tKVM: x86: degrade WARN to pr_warn_ratelimited\n    \tdmaengine: imx-sdma: remove BD_INTR for channel0\n    \tLinux 4.4.185\n\n    Change-Id: I222f9f81b9d7fba3cd3ac028b473b1ea2fae7cf0\n    Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>\n\ncommit 7bbf48947605d6ccef21a896c4b44dc356dc8726\nAuthor: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nDate:   Wed Jul 10 09:56:45 2019 +0200\n\n    Linux 4.4.185\n\ncommit f66168a2a2eba4cb7d332dd9387198178e5a3b3c\nAuthor: Robin Gong <yibin.gong@nxp.com>\nDate:   Fri Jun 21 16:23:06 2019 +0800\n\n    dmaengine: imx-sdma: remove BD_INTR for channel0\n\n    commit 3f93a4f297961c12bb17aa16cb3a4d1291823cae upstream.\n\n    It is possible for an irq triggered by channel0 to be received later\n    after clks are disabled once firmware loaded during sdma probe. If\n    that happens then clearing them by writing to SDMA_H_INTR won't work\n    and the kernel will hang processing infinite interrupts. Actually,\n    don't need interrupt triggered on channel0 since it's pollling\n    SDMA_H_STATSTOP to know channel0 done rather than interrupt in\n    current code, just clear BD_INTR to disable channel0 interrupt to\n    avoid the above case.\n    This issue was brought by commit 1d069bfa3c78 (\"dmaengine: imx-sdma:\n    ack channel 0 IRQ in the interrupt handler\") which didn't take care\n    the above case.\n\n    Fixes: 1d069bfa3c78 (\"dmaengine: imx-sdma: ack channel 0 IRQ in the interrupt handler\")\n    Cc: stable@vger.kernel.org #5.0+\n    Signed-off-by: Robin Gong <yibin.gong@nxp.com>\n    Reported-by: Sven Van Asbroeck <thesven73@gmail.com>\n    Tested-by: Sven Van Asbroeck <thesven73@gmail.com>\n    Reviewed-by: Michael Olbrich <m.olbrich@pengutronix.de>\n    Signed-off-by: Vinod Koul <vkoul@kernel.org>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit 2fec7f2e38bc7c2ca3e9b503517c3df9a44e3067\nAuthor: Paolo Bonzini <pbonzini@redhat.com>\nDate:   Wed Jun 26 14:16:13 2019 +0200\n\n    KVM: x86: degrade WARN to pr_warn_ratelimited\n\n    commit 3f16a5c318392cbb5a0c7a3d19dff8c8ef3c38ee upstream.\n\n    This warning can be triggered easily by userspace, so it should certainly not\n    cause a panic if panic_on_warn is set.\n\n    Reported-by: syzbot+c03f30b4f4c46bdf8575@syzkaller.appspotmail.com\n    Suggested-by: Alexander Potapenko <glider@google.com>\n    Acked-by: Alexander Potapenko <glider@google.com>\n    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit c0309c7835cd134eb650b2c590c2c69b4f969bb0\nAuthor: Kees Cook <keescook@chromium.org>\nDate:   Fri Jul 5 20:55:50 2019 +0200\n\n    arm64, vdso: Define vdso_{start,end} as array\n\n    Commit dbbb08f500d6146398b794fdc68a8e811366b451 upstream.\n\n    Adjust vdso_{start|end} to be char arrays to avoid compile-time analysis\n    that flags \"too large\" memcmp() calls with CONFIG_FORTIFY_SOURCE.\n\n    Cc: Jisheng Zhang <jszhang@marvell.com>\n    Acked-by: Catalin Marinas <catalin.marinas@arm.com>\n    Suggested-by: Mark Rutland <mark.rutland@arm.com>\n    Signed-off-by: Kees Cook <keescook@chromium.org>\n    Signed-off-by: Will Deacon <will.deacon@arm.com>\n    Signed-off-by: Arnd Bergmann <arnd@arndb.de>\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n\ncommit a62a40c8a3ff18d255d2a325c7780708d54fadc1\nAuthor: Vineet Gupta <vgupta@synopsys.com>\nDate:   Fri Dec 8 08:45:57 2017 -0800\n\n    ARC: handle gcc generated __builtin_trap for older compiler\n\n    commit af1be2e21203867cb958aaceed5366e2e24b88e8 upstream.\n\n    ARC gcc prior to GNU 2018.03 release didn't have a target specific\n    __builtin_trap() implementation, generating default abort() call.\n\n    Implement the abort() call - emulating what newer gcc does for the same,\n    as suggested by Arnd.\n\n    Acked-by: Arnd Bergmann <arnd@arndb.de>\n    Signed-off-by: Vineet Gupta <vgupta@synopsys.com>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit 1ed8ed6d21197ebddaf50bb7223cc8fd00467155\nAuthor: Linus Torvalds <torvalds@linux-foundation.org>\nDate:   Mon May 6 11:28:23 2019 -0700\n\n    tty: rocket: fix incorrect forward declaration of 'rp_init()'\n\n    [ Upstream commit 423ea3255424b954947d167681b71ded1b8fca53 ]\n\n    Make the forward declaration actually match the real function\n    definition, something that previous versions of gcc had just ignored.\n\n    This is another patch to fix new warnings from gcc-9 before I start the\n    merge window pulls.  I don't want to miss legitimate new warnings just\n    because my system update brought a new compiler with new warnings.\n\n    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n\ncommit 986543fcf50c8a3681be44cac42dc498fe25ab34\nAuthor: Nikolay Borisov <nborisov@suse.com>\nDate:   Fri May 17 10:44:25 2019 +0300\n\n    btrfs: Ensure replaced device doesn't have pending chunk allocation\n\n    commit debd1c065d2037919a7da67baf55cc683fee09f0 upstream.\n\n    Recent FITRIM work, namely bbbf7243d62d (\"btrfs: combine device update\n    operations during transaction commit\") combined the way certain\n    operations are recoded in a transaction. As a result an ASSERT was added\n    in dev_replace_finish to ensure the new code works correctly.\n    Unfortunately I got reports that it's possible to trigger the assert,\n    meaning that during a device replace it's possible to have an unfinished\n    chunk allocation on the source device.\n\n    This is supposed to be prevented by the fact that a transaction is\n    committed before finishing the replace oepration and alter acquiring the\n    chunk mutex. This is not sufficient since by the time the transaction is\n    committed and the chunk mutex acquired it's possible to allocate a chunk\n    depending on the workload being executed on the replaced device. This\n    bug has been present ever since device replace was introduced but there\n    was never code which checks for it.\n\n    The correct way to fix is to ensure that there is no pending device\n    modification operation when the chunk mutex is acquire and if there is\n    repeat transaction commit. Unfortunately it's not possible to just\n    exclude the source device from btrfs_fs_devices::dev_alloc_list since\n    this causes ENOSPC to be hit in transaction commit.\n\n    Fixing that in another way would need to add special cases to handle the\n    last writes and forbid new ones. The looped transaction fix is more\n    obvious, and can be easily backported. The runtime of dev-replace is\n    long so there's no noticeable delay caused by that.\n\n    Reported-by: David Sterba <dsterba@suse.com>\n    Fixes: 391cd9df81ac (\"Btrfs: fix unprotected alloc list insertion during the finishing procedure of replace\")\n    CC: stable@vger.kernel.org # 4.4+\n    Signed-off-by: Nikolay Borisov <nborisov@suse.com>\n    Reviewed-by: David Sterba <dsterba@suse.com>\n    Signed-off-by: David Sterba <dsterba@suse.com>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit adbf2b44e8f1764662962dd0580d5dfab082caeb\nAuthor: Herbert Xu <herbert@gondor.apana.org.au>\nDate:   Mon Jun 24 18:32:26 2019 +0800\n\n    lib/mpi: Fix karactx leak in mpi_powm\n\n    commit c8ea9fce2baf7b643384f36f29e4194fa40d33a6 upstream.\n\n    Sometimes mpi_powm will leak karactx because a memory allocation\n    failure causes a bail-out that skips the freeing of karactx.  This\n    patch moves the freeing of karactx to the end of the function like\n    everything else so that it can't be skipped.\n\n    Reported-by: syzbot+f7baccc38dcc1e094e77@syzkaller.appspotmail.com\n    Fixes: cdec9cb5167a (\"crypto: GnuPG based MPI lib - source files...\")\n    Cc: <stable@vger.kernel.org>\n    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>\n    Reviewed-by: Eric Biggers <ebiggers@kernel.org>\n    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit 52e0b9fcd6f60cf66a30d33216aad6148bdaebb7\nAuthor: Colin Ian King <colin.king@canonical.com>\nDate:   Thu Jun 27 17:43:08 2019 +0100\n\n    ALSA: usb-audio: fix sign unintended sign extension on left shifts\n\n    commit 2acf5a3e6e9371e63c9e4ff54d84d08f630467a0 upstream.\n\n    There are a couple of left shifts of unsigned 8 bit values that\n    first get promoted to signed ints and hence get sign extended\n    on the shift if the top bit of the 8 bit values are set. Fix\n    this by casting the 8 bit values to unsigned ints to stop the\n    unintentional sign extension.\n\n    Addresses-Coverity: (\"Unintended sign extension\")\n    Signed-off-by: Colin Ian King <colin.king@canonical.com>\n    Cc: <stable@vger.kernel.org>\n    Signed-off-by: Takashi Iwai <tiwai@suse.de>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit 3864c897a7d92af7c410faed1f5330fc4610e30e\nAuthor: Takashi Sakamoto <o-takashi@sakamocchi.jp>\nDate:   Mon Jul 1 23:43:53 2019 +0900\n\n    ALSA: firewire-lib/fireworks: fix miss detection of received MIDI messages\n\n    commit 7fbd1753b64eafe21cf842348a40a691d0dee440 upstream.\n\n    In IEC 61883-6, 8 MIDI data streams are multiplexed into single\n    MIDI conformant data channel. The index of stream is calculated by\n    modulo 8 of the value of data block counter.\n\n    In fireworks, the value of data block counter in CIP header has a quirk\n    with firmware version v5.0.0, v5.7.3 and v5.8.0. This brings ALSA\n    IEC 61883-1/6 packet streaming engine to miss detection of MIDI\n    messages.\n\n    This commit fixes the miss detection to modify the value of data block\n    counter for the modulo calculation.\n\n    For maintainers, this bug exists since a commit 18f5ed365d3f (\"ALSA:\n    fireworks/firewire-lib: add support for recent firmware quirk\") in Linux\n    kernel v4.2. There're many changes since the commit.  This fix can be\n    backported to Linux kernel v4.4 or later. I tagged a base commit to the\n    backport for your convenience.\n\n    Besides, my work for Linux kernel v5.3 brings heavy code refactoring and\n    some structure members are renamed in 'sound/firewire/amdtp-stream.h'.\n    The content of this patch brings conflict when merging -rc tree with\n    this patch and the latest tree. I request maintainers to solve the\n    conflict to replace 'tx_first_dbc' with 'ctx_data.tx.first_dbc'.\n\n    Fixes: df075feefbd3 (\"ALSA: firewire-lib: complete AM824 data block processing layer\")\n    Cc: <stable@vger.kernel.org> # v4.4+\n    Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>\n    Signed-off-by: Takashi Iwai <tiwai@suse.de>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit 13088bad036a7829d78c788edd8c7a119f3b780e\nAuthor: Colin Ian King <colin.king@canonical.com>\nDate:   Fri Jun 28 10:54:29 2019 +0100\n\n    ALSA: seq: fix incorrect order of dest_client/dest_ports arguments\n\n    commit c3ea60c231446663afd6ea1054da6b7f830855ca upstream.\n\n    There are two occurrances of a call to snd_seq_oss_fill_addr where\n    the dest_client and dest_port arguments are in the wrong order. Fix\n    this by swapping them around.\n\n    Addresses-Coverity: (\"Arguments in wrong order\")\n    Signed-off-by: Colin Ian King <colin.king@canonical.com>\n    Cc: <stable@vger.kernel.org>\n    Signed-off-by: Takashi Iwai <tiwai@suse.de>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit 6e5d6d15daa3090987254c5111999eacab8c7fcd\nAuthor: Eric Biggers <ebiggers@google.com>\nDate:   Tue Jul 2 14:17:00 2019 -0700\n\n    crypto: user - prevent operating on larval algorithms\n\n    commit 21d4120ec6f5b5992b01b96ac484701163917b63 upstream.\n\n    Michal Suchanek reported [1] that running the pcrypt_aead01 test from\n    LTP [2] in a loop and holding Ctrl-C causes a NULL dereference of\n    alg->cra_users.next in crypto_remove_spawns(), via crypto_del_alg().\n    The test repeatedly uses CRYPTO_MSG_NEWALG and CRYPTO_MSG_DELALG.\n\n    The crash occurs when the instance that CRYPTO_MSG_DELALG is trying to\n    unregister isn't a real registered algorithm, but rather is a \"test\n    larval\", which is a special \"algorithm\" added to the algorithms list\n    while the real algorithm is still being tested.  Larvals don't have\n    initialized cra_users, so that causes the crash.  Normally pcrypt_aead01\n    doesn't trigger this because CRYPTO_MSG_NEWALG waits for the algorithm\n    to be tested; however, CRYPTO_MSG_NEWALG returns early when interrupted.\n\n    Everything else in the \"crypto user configuration\" API has this same bug\n    too, i.e. it inappropriately allows operating on larval algorithms\n    (though it doesn't look like the other cases can cause a crash).\n\n    Fix this by making crypto_alg_match() exclude larval algorithms.\n\n    [1] https://lkml.kernel.org/r/20190625071624.27039-1-msuchanek@suse.de\n    [2] https://github.com/linux-test-project/ltp/blob/20190517/testcases/kernel/crypto/pcrypt_aead01.c\n\n    Reported-by: Michal Suchanek <msuchanek@suse.de>\n    Fixes: a38f7907b926 (\"crypto: Add userspace configuration API\")\n    Cc: <stable@vger.kernel.org> # v3.2+\n    Cc: Steffen Klassert <steffen.klassert@secunet.com>\n    Signed-off-by: Eric Biggers <ebiggers@google.com>\n    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit 54562d2b0be5c120b01c8bb94baef1aca37fd329\nAuthor: Jann Horn <jannh@google.com>\nDate:   Thu Jul 4 17:32:23 2019 +0200\n\n    ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME\n\n    commit 6994eefb0053799d2e07cd140df6c2ea106c41ee upstream.\n\n    Fix two issues:\n\n    When called for PTRACE_TRACEME, ptrace_link() would obtain an RCU\n    reference to the parent's objective credentials, then give that pointer\n    to get_cred().  However, the object lifetime rules for things like\n    struct cred do not permit unconditionally turning an RCU reference into\n    a stable reference.\n\n    PTRACE_TRACEME records the parent's credentials as if the parent was\n    acting as the subject, but that's not the case.  If a malicious\n    unprivileged child uses PTRACE_TRACEME and the parent is privileged, and\n    at a later point, the parent process becomes attacker-controlled\n    (because it drops privileges and calls execve()), the attacker ends up\n    with control over two processes with a privileged ptrace relationship,\n    which can be abused to ptrace a suid binary and obtain root privileges.\n\n    Fix both of these by always recording the credentials of the process\n    that is requesting the creation of the ptrace relationship:\n    current_cred() can't change under us, and current is the proper subject\n    for access control.\n\n    This change is theoretically userspace-visible, but I am not aware of\n    any code that it will actually break.\n\n    Fixes: 64b875f7ac8a (\"ptrace: Capture the ptracer's creds not PT_PTRACE_CAP\")\n    Signed-off-by: Jann Horn <jannh@google.com>\n    Acked-by: Oleg Nesterov <oleg@redhat.com>\n    Cc: stable@vger.kernel.org\n    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit 18eee992e8e86dffc6a16e0566b1bcf780c2c7bd\nAuthor: Paul Burton <paul.burton@mips.com>\nDate:   Mon Aug 20 15:36:18 2018 -0700\n\n    MIPS: Workaround GCC __builtin_unreachable reordering bug\n\n    [ Upstream commit 906d441febc0de974b2a6ef848a8f058f3bfada3 ]\n\n    Some versions of GCC for the MIPS architecture suffer from a bug which\n    can lead to instructions from beyond an unreachable statement being\n    incorrectly reordered into earlier branch delay slots if the unreachable\n    statement is the only content of a case in a switch statement. This can\n    lead to seemingly random behaviour, such as invalid memory accesses from\n    incorrectly reordered loads or stores, and link failures on microMIPS\n    builds.\n\n    See this potential GCC fix for details:\n\n        https://gcc.gnu.org/ml/gcc-patches/2015-09/msg00360.html\n\n    Runtime problems resulting from this bug were initially observed using a\n    maltasmvp_defconfig v4.4 kernel built using GCC 4.9.2 (from a Codescape\n    SDK 2015.06-05 toolchain), with the result being an address exception\n    taken after log messages about the L1 caches (during probe of the L2\n    cache):\n\n        Initmem setup node 0 [mem 0x0000000080000000-0x000000009fffffff]\n        VPE topology {2,2} total 4\n        Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.\n        Primary data cache 64kB, 4-way, PIPT, no aliases, linesize 32 bytes\n        <AdEL exception here>\n\n    This is early enough that the kernel exception vectors are not in use,\n    so any further output depends upon the bootloader. This is reproducible\n    in QEMU where no further output occurs - ie. the system hangs here.\n    Given the nature of the bug it may potentially be hit with differing\n    symptoms. The bug is known to affect GCC versions as recent as 7.3, and\n    it is unclear whether GCC 8 fixed it or just happens not to encounter\n    the bug in the testcase found at the link above due to differing\n    optimizations.\n\n    This bug can be worked around by placing a volatile asm statement, which\n    GCC is prevented from reordering past, prior to the\n    __builtin_unreachable call.\n\n    That was actually done already for other reasons by commit 173a3efd3edb\n    (\"bug.h: work around GCC PR82365 in BUG()\"), but creates problems for\n    microMIPS builds due to the lack of a .insn directive. The microMIPS ISA\n    allows for interlinking with regular MIPS32 code by repurposing bit 0 of\n    the program counter as an ISA mode bit. To switch modes one changes the\n    value of this bit in the PC. However typical branch instructions encode\n    their offsets as multiples of 2-byte instruction halfwords, which means\n    they cannot change ISA mode - this must be done using either an indirect\n    branch (a jump-register in MIPS terminology) or a dedicated jalx\n    instruction. In order to ensure that regular branches don't attempt to\n    target code in a different ISA which they can't actually switch to, the\n    linker will check that branch targets are code in the same ISA as the\n    branch.\n\n    Unfortunately our empty asm volatile statements don't qualify as code,\n    and the link for microMIPS builds fails with errors such as:\n\n        arch/mips/mm/dma-default.s:3265: Error: branch to a symbol in another ISA mode\n        arch/mips/mm/dma-default.s:5027: Error: branch to a symbol in another ISA mode\n\n    Resolve this by adding a .insn directive within the asm statement which\n    declares that what comes next is code. This may or may not be true,\n    since we don't really know what comes next, but as this code is in an\n    unreachable path anyway that doesn't matter since we won't execute it.\n\n    We do this in asm/compiler.h & select CONFIG_HAVE_ARCH_COMPILER_H in\n    order to have this included by linux/compiler_types.h after\n    linux/compiler-gcc.h. This will result in asm/compiler.h being included\n    in all C compilations via the -include linux/compiler_types.h argument\n    in c_flags, which should be harmless.\n\n    Signed-off-by: Paul Burton <paul.burton@mips.com>\n    Fixes: 173a3efd3edb (\"bug.h: work around GCC PR82365 in BUG()\")\n    Patchwork: https://patchwork.linux-mips.org/patch/20270/\n    Cc: James Hogan <jhogan@kernel.org>\n    Cc: Ralf Baechle <ralf@linux-mips.org>\n    Cc: Arnd Bergmann <arnd@arndb.de>\n    Cc: linux-mips@linux-mips.org\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n\ncommit 2fbaa1af066f3ae16ce3d3f78b0d2fd1169279fe\nAuthor: Arnd Bergmann <arnd@arndb.de>\nDate:   Wed Feb 21 14:45:54 2018 -0800\n\n    bug.h: work around GCC PR82365 in BUG()\n\n    [ Upstream commit 173a3efd3edb2ef6ef07471397c5f542a360e9c1 ]\n\n    Looking at functions with large stack frames across all architectures\n    led me discovering that BUG() suffers from the same problem as\n    fortify_panic(), which I've added a workaround for already.\n\n    In short, variables that go out of scope by calling a noreturn function\n    or __builtin_unreachable() keep using stack space in functions\n    afterwards.\n\n    A workaround that was identified is to insert an empty assembler\n    statement just before calling the function that doesn't return.  I'm\n    adding a macro \"barrier_before_unreachable()\" to document this, and\n    insert calls to that in all instances of BUG() that currently suffer\n    from this problem.\n\n    The files that saw the largest change from this had these frame sizes\n    before, and much less with my patch:\n\n      fs/ext4/inode.c:82:1: warning: the frame size of 1672 bytes is larger than 800 bytes [-Wframe-larger-than=]\n      fs/ext4/namei.c:434:1: warning: the frame size of 904 bytes is larger than 800 bytes [-Wframe-larger-than=]\n      fs/ext4/super.c:2279:1: warning: the frame size of 1160 bytes is larger than 800 bytes [-Wframe-larger-than=]\n      fs/ext4/xattr.c:146:1: warning: the frame size of 1168 bytes is larger than 800 bytes [-Wframe-larger-than=]\n      fs/f2fs/inode.c:152:1: warning: the frame size of 1424 bytes is larger than 800 bytes [-Wframe-larger-than=]\n      net/netfilter/ipvs/ip_vs_core.c:1195:1: warning: the frame size of 1068 bytes is larger than 800 bytes [-Wframe-larger-than=]\n      net/netfilter/ipvs/ip_vs_core.c:395:1: warning: the frame size of 1084 bytes is larger than 800 bytes [-Wframe-larger-than=]\n      net/netfilter/ipvs/ip_vs_ftp.c:298:1: warning: the frame size of 928 bytes is larger than 800 bytes [-Wframe-larger-than=]\n      net/netfilter/ipvs/ip_vs_ftp.c:418:1: warning: the frame size of 908 bytes is larger than 800 bytes [-Wframe-larger-than=]\n      net/netfilter/ipvs/ip_vs_lblcr.c:718:1: warning: the frame size of 960 bytes is larger than 800 bytes [-Wframe-larger-than=]\n      drivers/net/xen-netback/netback.c:1500:1: warning: the frame size of 1088 bytes is larger than 800 bytes [-Wframe-larger-than=]\n\n    In case of ARC and CRIS, it turns out that the BUG() implementation\n    actually does return (or at least the compiler thinks it does),\n    resulting in lots of warnings about uninitialized variable use and\n    leaving noreturn functions, such as:\n\n      block/cfq-iosched.c: In function 'cfq_async_queue_prio':\n      block/cfq-iosched.c:3804:1: error: control reaches end of non-void function [-Werror=return-type]\n      include/linux/dmaengine.h: In function 'dma_maxpq':\n      include/linux/dmaengine.h:1123:1: error: control reaches end of non-void function [-Werror=return-type]\n\n    This makes them call __builtin_trap() instead, which should normally\n    dump the stack and kill the current process, like some of the other\n    architectures already do.\n\n    I tried adding barrier_before_unreachable() to panic() and\n    fortify_panic() as well, but that had very little effect, so I'm not\n    submitting that patch.\n\n    Vineet said:\n\n    : For ARC, it is double win.\n    :\n    : 1. Fixes 3 -Wreturn-type warnings\n    :\n    : | ../net/core/ethtool.c:311:1: warning: control reaches end of non-void function\n    : [-Wreturn-type]\n    : | ../kernel/sched/core.c:3246:1: warning: control reaches end of non-void function\n    : [-Wreturn-type]\n    : | ../include/linux/sunrpc/svc_xprt.h:180:1: warning: control reaches end of\n    : non-void function [-Wreturn-type]\n    :\n    : 2.  bloat-o-meter reports code size improvements as gcc elides the\n    :    generated code for stack return.\n\n    Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82365\n    Link: http://lkml.kernel.org/r/20171219114112.939391-1-arnd@arndb.de\n    Signed-off-by: Arnd Bergmann <arnd@arndb.de>\n    Acked-by: Vineet Gupta <vgupta@synopsys.com>\t[arch/arc]\n    Tested-by: Vineet Gupta <vgupta@synopsys.com>\t[arch/arc]\n    Cc: Mikael Starvik <starvik@axis.com>\n    Cc: Jesper Nilsson <jesper.nilsson@axis.com>\n    Cc: Tony Luck <tony.luck@intel.com>\n    Cc: Fenghua Yu <fenghua.yu@intel.com>\n    Cc: Geert Uytterhoeven <geert@linux-m68k.org>\n    Cc: \"David S. Miller\" <davem@davemloft.net>\n    Cc: Christopher Li <sparse@chrisli.org>\n    Cc: Thomas Gleixner <tglx@linutronix.de>\n    Cc: Peter Zijlstra <peterz@infradead.org>\n    Cc: Kees Cook <keescook@chromium.org>\n    Cc: Ingo Molnar <mingo@kernel.org>\n    Cc: Josh Poimboeuf <jpoimboe@redhat.com>\n    Cc: Will Deacon <will.deacon@arm.com>\n    Cc: \"Steven Rostedt (VMware)\" <rostedt@goodmis.org>\n    Cc: Mark Rutland <mark.rutland@arm.com>\n    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>\n    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n    [ removed cris changes - gregkh]\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit 2f8180ff3386f18f11ea54f0d89e611a72b9e18d\nAuthor: Thierry Reding <treding@nvidia.com>\nDate:   Wed Jul 1 14:17:58 2015 +0200\n\n    swiotlb: Make linux/swiotlb.h standalone includible\n\n    [ Upstream commit 386744425e35e04984c6e741c7750fd6eef1a9df ]\n\n    This header file uses the enum dma_data_direction and struct page types\n    without explicitly including the corresponding header files. This makes\n    it rely on the includer to have included the proper headers before.\n\n    To fix this, include linux/dma-direction.h and forward-declare struct\n    page. The swiotlb_free() function is also annotated __init, therefore\n    requires linux/init.h to be included as well.\n\n    Signed-off-by: Thierry Reding <treding@nvidia.com>\n    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n\ncommit f1a9886ddd3a26f7c3dd5d5196ae04dc4d2a9da8\nAuthor: Arnd Bergmann <arnd@arndb.de>\nDate:   Wed Aug 23 16:44:51 2017 +0200\n\n    mfd: omap-usb-tll: Fix register offsets\n\n    [ Upstream commit 993dc737c0996c163325961fb62a0ed9fd0308b4 ]\n\n    gcc-8 notices that the register number calculation is wrong\n    when the offset is an 'u8' but the number is larger than 256:\n\n    drivers/mfd/omap-usb-tll.c: In function 'omap_tll_init':\n    drivers/mfd/omap-usb-tll.c:90:46: error: overflow in conversion from 'int' to 'u8 {aka unsigned char}' chages value from 'i * 256 + 2070' to '22' [-Werror=overflow]\n\n    This addresses it by always using a 32-bit offset number for\n    the register. This is apparently an old problem that previous\n    compilers did not find.\n\n    Fixes: 16fa3dc75c22 (\"mfd: omap-usb-tll: HOST TLL platform driver\")\n    Signed-off-by: Arnd Bergmann <arnd@arndb.de>\n    Signed-off-by: Lee Jones <lee.jones@linaro.org>\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n\ncommit a1877fd325cd4d6a8ec311bb05ce62606220332c\nAuthor: Manuel Lauss <manuel.lauss@gmail.com>\nDate:   Mon Aug 14 12:21:48 2017 +0200\n\n    MIPS: math-emu: do not use bools for arithmetic\n\n    [ Upstream commit 8535f2ba0a9b971df62a5890699b9dfe2e0d5580 ]\n\n    GCC-7 complains about a boolean value being used with an arithmetic\n    AND:\n\n    arch/mips/math-emu/cp1emu.c: In function 'cop1Emulate':\n    arch/mips/math-emu/cp1emu.c:838:14: warning: '~' on a boolean expression [-Wbool-operation]\n      fpr = (x) & ~(cop1_64bit(xcp) == 0);    \\\n                  ^\n    arch/mips/math-emu/cp1emu.c:1068:3: note: in expansion of macro 'DITOREG'\n       DITOREG(dval, MIPSInst_RT(ir));\n       ^~~~~~~\n    arch/mips/math-emu/cp1emu.c:838:14: note: did you mean to use logical not?\n      fpr = (x) & ~(cop1_64bit(xcp) == 0);    \\\n\n    Since cop1_64bit() returns and int, just flip the LSB.\n\n    Suggested-by: Maciej W. Rozycki <macro@imgtec.com>\n    Signed-off-by: Manuel Lauss <manuel.lauss@gmail.com>\n    Reviewed-by: Maciej W. Rozycki <macro@imgtec.com>\n    Cc: linux-mips@linux-mips.org\n    Patchwork: https://patchwork.linux-mips.org/patch/17058/\n    Signed-off-by: Ralf Baechle <ralf@linux-mips.org>\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n\ncommit 014275fd848f463fac037fc1b6b9b6e50470b9aa\nAuthor: Vineet Gupta <vgupta@synopsys.com>\nDate:   Wed Oct 19 14:38:50 2016 -0700\n\n    ARC: fix build warning in elf.h\n\n    [ Upstream commit 1dec78585328db00e33fb18dc1a6deed0e2095a5 ]\n\n    The cast valid since TASK_SIZE * 2 will never actually cause overflow.\n\n    |   CC      fs/binfmt_elf.o\n    | In file included from ../include/linux/elf.h:4:0,\n    |                  from ../include/linux/module.h:15,\n    |                  from ../fs/binfmt_elf.c:12:\n    | ../fs/binfmt_elf.c: In function load_elf_binar:\n    | ../arch/arc/include/asm/elf.h:57:29: warning: integer overflow in expression [-Woverflow]\n    |  #define ELF_ET_DYN_BASE  (2 * TASK_SIZE / 3)\n    |                              ^\n    | ../fs/binfmt_elf.c:921:16: note: in expansion of macro ELF_ET_DYN_BASE\n    |     load_bias = ELF_ET_DYN_BASE - vaddr;\n\n    Signed-off-by: Vineet Gupta <vgupta@synopsys.com>\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n\ncommit a414c474578a1ac097a1da0875b02b431f60a4e6\nAuthor: Vineet Gupta <vgupta@synopsys.com>\nDate:   Tue Feb 16 09:42:57 2016 +0530\n\n    ARC: Assume multiplier is always present\n\n    [ Upstream commit 0eca6fdb3193410fbe66b6f064431cc394513e82 ]\n\n    It is unlikely that designs running Linux will not have multiplier.\n    Further the current support is not complete as tool don't generate a\n    multilib w/o multiplier.\n\n    Signed-off-by: Vineet Gupta <vgupta@synopsys.com>\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n\ncommit b3e8f6bc2f41fe3192064fbfe42600d0e728b9e8\nAuthor: Don Brace <don.brace@microsemi.com>\nDate:   Mon Jun 3 16:43:29 2019 -0500\n\n    scsi: hpsa: correct ioaccel2 chaining\n\n    [ Upstream commit 625d7d3518875c4d303c652a198feaa13d9f52d9 ]\n\n    - set ioaccel2_sg_element member 'chain_indicator' to IOACCEL2_LAST_SG for\n      the last s/g element.\n\n    - set ioaccel2_sg_element member 'chain_indicator' to IOACCEL2_CHAIN when\n      chaining.\n\n    Reviewed-by: Bader Ali - Saleh <bader.alisaleh@microsemi.com>\n    Reviewed-by: Scott Teel <scott.teel@microsemi.com>\n    Reviewed-by: Matt Perricone <matt.perricone@microsemi.com>\n    Signed-off-by: Don Brace <don.brace@microsemi.com>\n    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n\ncommit 8978dce0c235a0550634da9c8294dc03a8e784d5\nAuthor: Alexandre Belloni <alexandre.belloni@bootlin.com>\nDate:   Wed May 22 14:07:36 2019 +0200\n\n    usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC\n\n    [ Upstream commit fbc318afadd6e7ae2252d6158cf7d0c5a2132f7d ]\n\n    Gadget drivers may queue request in interrupt context. This would lead to\n    a descriptor allocation in that context. In that case we would hit\n    BUG_ON(in_interrupt()) in __get_vm_area_node.\n\n    Also remove the unnecessary cast.\n\n    Acked-by: Sylvain Lemieux <slemieux.tyco@gmail.com>\n    Tested-by: James Grant <jamesg@zaltys.org>\n    Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>\n    Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n\ncommit 53f1c783ecc036904fa756f75bb557b7f9c2c2d8\nAuthor: Young Xiao <92siuyang@gmail.com>\nDate:   Tue May 28 20:17:54 2019 +0800\n\n    usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i]\n\n    [ Upstream commit 62fd0e0a24abeebe2c19fce49dd5716d9b62042d ]\n\n    There is no deallocation of fusb300->ep[i] elements, allocated at\n    fusb300_probe.\n\n    The patch adds deallocation of fusb300->ep array elements.\n\n    Signed-off-by: Young Xiao <92siuyang@gmail.com>\n    Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n\ncommit 5b3f570661f493f7e4a055ee3b50337b3eb07781\nAuthor: Yu-Hsuan Hsu <yuhsuan@chromium.org>\nDate:   Tue Jun 4 18:49:09 2019 +0800\n\n    ASoC: max98090: remove 24-bit format support if RJ is 0\n\n    [ Upstream commit 5628c8979642a076f91ee86c3bae5ad251639af0 ]\n\n    The supported formats are S16_LE and S24_LE now. However, by datasheet\n    of max98090, S24_LE is only supported when it is in the right justified\n    mode. We should remove 24-bit format if it is not in that mode to avoid\n    triggering error.\n\n    Signed-off-by: Yu-Hsuan Hsu <yuhsuan@chromium.org>\n    Signed-off-by: Mark Brown <broonie@kernel.org>\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n\ncommit 05d6e618f64b877f6db17173f31063d51d023b81\nAuthor: YueHaibing <yuehaibing@huawei.com>\nDate:   Thu May 16 15:56:56 2019 +0800\n\n    spi: bitbang: Fix NULL pointer dereference in spi_unregister_master\n\n    [ Upstream commit 5caaf29af5ca82d5da8bc1d0ad07d9e664ccf1d8 ]\n\n    If spi_register_master fails in spi_bitbang_start\n    because device_add failure, We should return the\n    error code other than 0, otherwise calling\n    spi_bitbang_stop may trigger NULL pointer dereference\n    like this:\n\n    BUG: KASAN: null-ptr-deref in __list_del_entry_valid+0x45/0xd0\n    Read of size 8 at addr 0000000000000000 by task syz-executor.0/3661\n\n    CPU: 0 PID: 3661 Comm: syz-executor.0 Not tainted 5.1.0+ #28\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014\n    Call Trace:\n     dump_stack+0xa9/0x10e\n     ? __list_del_entry_valid+0x45/0xd0\n     ? __list_del_entry_valid+0x45/0xd0\n     __kasan_report+0x171/0x18d\n     ? __list_del_entry_valid+0x45/0xd0\n     kasan_report+0xe/0x20\n     __list_del_entry_valid+0x45/0xd0\n     spi_unregister_controller+0x99/0x1b0\n     spi_lm70llp_attach+0x3ae/0x4b0 [spi_lm70llp]\n     ? 0xffffffffc1128000\n     ? klist_next+0x131/0x1e0\n     ? driver_detach+0x40/0x40 [parport]\n     port_check+0x3b/0x50 [parport]\n     bus_for_each_dev+0x115/0x180\n     ? subsys_dev_iter_exit+0x20/0x20\n     __parport_register_driver+0x1f0/0x210 [parport]\n     ? 0xffffffffc1150000\n     do_one_initcall+0xb9/0x3b5\n     ? perf_trace_initcall_level+0x270/0x270\n     ? kasan_unpoison_shadow+0x30/0x40\n     ? kasan_unpoison_shadow+0x30/0x40\n     do_init_module+0xe0/0x330\n     load_module+0x38eb/0x4270\n     ? module_frob_arch_sections+0x20/0x20\n     ? kernel_read_file+0x188/0x3f0\n     ? find_held_lock+0x6d/0xd0\n     ? fput_many+0x1a/0xe0\n     ? __do_sys_finit_module+0x162/0x190\n     __do_sys_finit_module+0x162/0x190\n     ? __ia32_sys_init_module+0x40/0x40\n     ? __mutex_unlock_slowpath+0xb4/0x3f0\n     ? wait_for_completion+0x240/0x240\n     ? vfs_write+0x160/0x2a0\n     ? lockdep_hardirqs_off+0xb5/0x100\n     ? mark_held_locks+0x1a/0x90\n     ? do_syscall_64+0x14/0x2a0\n     do_syscall_64+0x72/0x2a0\n     entry_SYSCALL_64_after_hwframe+0x49/0xbe\n\n    Reported-by: Hulk Robot <hulkci@huawei.com>\n    Fixes: 702a4879ec33 (\"spi: bitbang: Let spi_bitbang_start() take a reference to master\")\n    Signed-off-by: YueHaibing <yuehaibing@huawei.com>\n    Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>\n    Reviewed-by: Axel Lin <axel.lin@ingics.com>\n    Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>\n    Signed-off-by: Mark Brown <broonie@kernel.org>\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n\ncommit d4dcab6232e9fd730ad063735a5c875a2b6b4802\nAuthor: Matt Flax <flatmax@flatmax.org>\nDate:   Wed May 8 16:33:13 2019 +1000\n\n    ASoC : cs4265 : readable register too low\n\n    [ Upstream commit f3df05c805983427319eddc2411a2105ee1757cf ]\n\n    The cs4265_readable_register function stopped short of the maximum\n    register.\n\n    An example bug is taken from :\n    https://github.com/Audio-Injector/Ultra/issues/25\n\n    Where alsactl store fails with :\n    Cannot read control '2,0,0,C Data Buffer,0': Input/output error\n\n    This patch fixes the bug by setting the cs4265 to have readable\n    registers up to the maximum hardware register CS4265_MAX_REGISTER.\n\n    Signed-off-by: Matt Flax <flatmax@flatmax.org>\n    Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>\n    Signed-off-by: Mark Brown <broonie@kernel.org>\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n\ncommit 3c738429d03e29149f06ab8be2773d5150040c6d\nAuthor: Jason A. Donenfeld <Jason@zx2c4.com>\nDate:   Thu Dec 14 03:23:37 2017 +0100\n\n    um: Compile with modern headers\n\n    commit 530ba6c7cb3c22435a4d26de47037bb6f86a5329 upstream.\n\n    Recent libcs have gotten a bit more strict, so we actually need to\n    include the right headers and use the right types. This enables UML to\n    compile again.\n\n    Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>\n    Cc: stable@vger.kernel.org\n    Signed-off-by: Richard Weinberger <richard@nod.at>\n    Signed-off-by: Alessio Balsini <balsini@android.com>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit 993699d9de09097e2bfd49100b8904774e5304fb\nAuthor: Matias Karhumaa <matias.karhumaa@gmail.com>\nDate:   Tue Jul 2 16:35:09 2019 +0200\n\n    Bluetooth: Fix faulty expression for minimum encryption key size check\n\n    commit eca94432934fe5f141d084f2e36ee2c0e614cc04 upstream.\n\n    Fix minimum encryption key size check so that HCI_MIN_ENC_KEY_SIZE is\n    also allowed as stated in the comment.\n\n    This bug caused connection problems with devices having maximum\n    encryption key size of 7 octets (56-bit).\n\n    Fixes: 693cd8ce3f88 (\"Bluetooth: Fix regression with minimum encryption key size alignment\")\n    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203997\n    Signed-off-by: Matias Karhumaa <matias.karhumaa@gmail.com>\n    Cc: stable@vger.kernel.org\n    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>\n    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit b3c963d51a02153ffd7c2c41ed4a9287c9d25da2\nAuthor: Josh Elsasser <jelsasser@appneta.com>\nDate:   Mon Jul 1 16:48:47 2019 -0700\n\n    net: check before dereferencing netdev_ops during busy poll\n\n    init_dummy_netdev() leaves its netdev_ops pointer zeroed. This leads\n    to a NULL pointer dereference when sk_busy_loop fires against an iwlwifi\n    wireless adapter and checks napi->dev->netdev_ops->ndo_busy_poll.\n\n    Avoid this by ensuring napi->dev->netdev_ops is valid before following\n    the pointer, avoiding the following panic when busy polling on a dummy\n    netdev:\n\n      BUG: unable to handle kernel NULL pointer dereference at 00000000000000c8\n      IP: [<ffffffff817b4b72>] sk_busy_loop+0x92/0x2f0\n      Call Trace:\n       [<ffffffff815a3134>] ? uart_write_room+0x74/0xf0\n       [<ffffffff817964a9>] sock_poll+0x99/0xa0\n       [<ffffffff81223142>] do_sys_poll+0x2e2/0x520\n       [<ffffffff8118d3fc>] ? get_page_from_freelist+0x3bc/0xa30\n       [<ffffffff810ada22>] ? update_curr+0x62/0x140\n       [<ffffffff811ea671>] ? __slab_free+0xa1/0x2a0\n       [<ffffffff811ea671>] ? __slab_free+0xa1/0x2a0\n       [<ffffffff8179dbb1>] ? skb_free_head+0x21/0x30\n       [<ffffffff81221bd0>] ? poll_initwait+0x50/0x50\n       [<ffffffff811eaa36>] ? kmem_cache_free+0x1c6/0x1e0\n       [<ffffffff815a4884>] ? uart_write+0x124/0x1d0\n       [<ffffffff810bd1cd>] ? remove_wait_queue+0x4d/0x60\n       [<ffffffff810bd224>] ? __wake_up+0x44/0x50\n       [<ffffffff81582731>] ? tty_write_unlock+0x31/0x40\n       [<ffffffff8158c5c6>] ? tty_ldisc_deref+0x16/0x20\n       [<ffffffff81584820>] ? tty_write+0x1e0/0x2f0\n       [<ffffffff81587e50>] ? process_echoes+0x80/0x80\n       [<ffffffff8120c17b>] ? __vfs_write+0x2b/0x130\n       [<ffffffff8120d09a>] ? vfs_write+0x15a/0x1a0\n       [<ffffffff81223455>] SyS_poll+0x75/0x100\n       [<ffffffff819a6524>] entry_SYSCALL_64_fastpath+0x24/0xcf\n\n    Commit 79e7fff47b7b (\"net: remove support for per driver ndo_busy_poll()\")\n    indirectly fixed this upstream in linux-4.11 by removing the offending\n    pointer usage. No other users of napi->dev touch its netdev_ops.\n\n    Fixes: 8b80cda536ea (\"net: rename include/net/ll_poll.h to include/net/busy_poll.h\") # 4.4.y\n    Signed-off-by: Josh Elsasser <jelsasser@appneta.com>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit ec109e6a9a1b1c5b1523d922c77f5195dee3dc39\nAuthor: YueHaibing <yuehaibing@huawei.com>\nDate:   Wed Jun 26 16:08:44 2019 +0800\n\n    bonding: Always enable vlan tx offload\n\n    [ Upstream commit 30d8177e8ac776d89d387fad547af6a0f599210e ]\n\n    We build vlan on top of bonding interface, which vlan offload\n    is off, bond mode is 802.3ad (LACP) and xmit_hash_policy is\n    BOND_XMIT_POLICY_ENCAP34.\n\n    Because vlan tx offload is off, vlan tci is cleared and skb push\n    the vlan header in validate_xmit_vlan() while sending from vlan\n    devices. Then in bond_xmit_hash, __skb_flow_dissect() fails to\n    get information from protocol headers encapsulated within vlan,\n    because 'nhoff' is points to IP header, so bond hashing is based\n    on layer 2 info, which fails to distribute packets across slaves.\n\n    This patch always enable bonding's vlan tx offload, pass the vlan\n    packets to the slave devices with vlan tci, let them to handle\n    vlan implementation.\n\n    Fixes: 278339a42a1b (\"bonding: propogate vlan_features to bonding master\")\n    Suggested-by: Jiri Pirko <jiri@resnulli.us>\n    Signed-off-by: YueHaibing <yuehaibing@huawei.com>\n    Acked-by: Jiri Pirko <jiri@mellanox.com>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit 012e59ea8777aafafaf63ff67b12e90d26bfadec\nAuthor: Stephen Suryaputra <ssuryaextr@gmail.com>\nDate:   Mon Jun 24 20:14:06 2019 -0400\n\n    ipv4: Use return value of inet_iif() for __raw_v4_lookup in the while loop\n\n    [ Upstream commit 38c73529de13e1e10914de7030b659a2f8b01c3b ]\n\n    In commit 19e4e768064a8 (\"ipv4: Fix raw socket lookup for local\n    traffic\"), the dif argument to __raw_v4_lookup() is coming from the\n    returned value of inet_iif() but the change was done only for the first\n    lookup. Subsequent lookups in the while loop still use skb->dev->ifIndex.\n\n    Fixes: 19e4e768064a8 (\"ipv4: Fix raw socket lookup for local traffic\")\n    Signed-off-by: Stephen Suryaputra <ssuryaextr@gmail.com>\n    Reviewed-by: David Ahern <dsahern@gmail.com>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit 8b4c9dfab314f4884d33e7f6c7b74e1e317f967f\nAuthor: YueHaibing <yuehaibing@huawei.com>\nDate:   Thu Jun 27 00:03:39 2019 +0800\n\n    team: Always enable vlan tx offload\n\n    [ Upstream commit ee4297420d56a0033a8593e80b33fcc93fda8509 ]\n\n    We should rather have vlan_tci filled all the way down\n    to the transmitting netdevice and let it do the hw/sw\n    vlan implementation.\n\n    Suggested-by: Jiri Pirko <jiri@resnulli.us>\n    Signed-off-by: YueHaibing <yuehaibing@huawei.com>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit 36ad5e8b3833de6cd41520e1f2cc1d0ae019a005\nAuthor: Xin Long <lucien.xin@gmail.com>\nDate:   Tue Jun 25 00:28:19 2019 +0800\n\n    tipc: check msg->req data len in tipc_nl_compat_bearer_disable\n\n    [ Upstream commit 4f07b80c973348a99b5d2a32476a2e7877e94a05 ]\n\n    This patch is to fix an uninit-value issue, reported by syzbot:\n\n      BUG: KMSAN: uninit-value in memchr+0xce/0x110 lib/string.c:981\n      Call Trace:\n        __dump_stack lib/dump_stack.c:77 [inline]\n        dump_stack+0x191/0x1f0 lib/dump_stack.c:113\n        kmsan_report+0x130/0x2a0 mm/kmsan/kmsan.c:622\n        __msan_warning+0x75/0xe0 mm/kmsan/kmsan_instr.c:310\n        memchr+0xce/0x110 lib/string.c:981\n        string_is_valid net/tipc/netlink_compat.c:176 [inline]\n        tipc_nl_compat_bearer_disable+0x2a1/0x480 net/tipc/netlink_compat.c:449\n        __tipc_nl_compat_doit net/tipc/netlink_compat.c:327 [inline]\n        tipc_nl_compat_doit+0x3ac/0xb00 net/tipc/netlink_compat.c:360\n        tipc_nl_compat_handle net/tipc/netlink_compat.c:1178 [inline]\n        tipc_nl_compat_recv+0x1b1b/0x27b0 net/tipc/netlink_compat.c:1281\n\n    TLV_GET_DATA_LEN() may return a negtive int value, which will be\n    used as size_t (becoming a big unsigned long) passed into memchr,\n    cause this issue.\n\n    Similar to what it does in tipc_nl_compat_bearer_enable(), this\n    fix is to return -EINVAL when TLV_GET_DATA_LEN() is negtive in\n    tipc_nl_compat_bearer_disable(), as well as in\n    tipc_nl_compat_link_stat_dump() and tipc_nl_compat_link_reset_stats().\n\n    v1->v2:\n      - add the missing Fixes tags per Eric's request.\n\n    Fixes: 0762216c0ad2 (\"tipc: fix uninit-value in tipc_nl_compat_bearer_enable\")\n    Fixes: 8b66fee7f8ee (\"tipc: fix uninit-value in tipc_nl_compat_link_reset_stats\")\n    Reported-by: syzbot+30eaa8bf392f7fafffaf@syzkaller.appspotmail.com\n    Signed-off-by: Xin Long <lucien.xin@gmail.com>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit 253c7176af9f978b7fe0ea850f4f6ce30546b7f1\nAuthor: Xin Long <lucien.xin@gmail.com>\nDate:   Thu Jun 20 18:39:28 2019 +0800\n\n    tipc: change to use register_pernet_device\n\n    [ Upstream commit c492d4c74dd3f87559883ffa0f94a8f1ae3fe5f5 ]\n\n    This patch is to fix a dst defcnt leak, which can be reproduced by doing:\n\n      # ip net a c; ip net a s; modprobe tipc\n      # ip net e s ip l a n eth1 type veth peer n eth1 netns c\n      # ip net e c ip l s lo up; ip net e c ip l s eth1 up\n      # ip net e s ip l s lo up; ip net e s ip l s eth1 up\n      # ip net e c ip a a 1.1.1.2/8 dev eth1\n      # ip net e s ip a a 1.1.1.1/8 dev eth1\n      # ip net e c tipc b e m udp n u1 localip 1.1.1.2\n      # ip net e s tipc b e m udp n u1 localip 1.1.1.1\n      # ip net d c; ip net d s; rmmod tipc\n\n    and it will get stuck and keep logging the error:\n\n      unregister_netdevice: waiting for lo to become free. Usage count = 1\n\n    The cause is that a dst is held by the udp sock's sk_rx_dst set on udp rx\n    path with udp_early_demux == 1, and this dst (eventually holding lo dev)\n    can't be released as bearer's removal in tipc pernet .exit happens after\n    lo dev's removal, default_device pernet .exit.\n\n     \"There are two distinct types of pernet_operations recognized: subsys and\n      device.  At creation all subsys init functions are called before device\n      init functions, and at destruction all device exit functions are called\n      before subsys exit function.\"\n\n    So by calling register_pernet_device instead to register tipc_net_ops, the\n    pernet .exit() will be invoked earlier than loopback dev's removal when a\n    netns is being destroyed, as fou/gue does.\n\n    Note that vxlan and geneve udp tunnels don't have this issue, as the udp\n    sock is released in their device ndo_stop().\n\n    This fix is also necessary for tipc dst_cache, which will hold dsts on tx\n    path and I will introduce in my next patch.\n\n    Reported-by: Li Shuang <shuali@redhat.com>\n    Signed-off-by: Xin Long <lucien.xin@gmail.com>\n    Acked-by: Jon Maloy <jon.maloy@ericsson.com>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit 92598c5db140940c1b1ef0c10894b5c9d5293930\nAuthor: Xin Long <lucien.xin@gmail.com>\nDate:   Tue Jun 25 00:21:45 2019 +0800\n\n    sctp: change to hold sk after auth shkey is created successfully\n\n    [ Upstream commit 25bff6d5478b2a02368097015b7d8eb727c87e16 ]\n\n    Now in sctp_endpoint_init(), it holds the sk then creates auth\n    shkey. But when the creation fails, it doesn't release the sk,\n    which causes a sk defcnf leak,\n\n    Here to fix it by only holding the sk when auth shkey is created\n    successfully.\n\n    Fixes: a29a5bd4f5c3 (\"[SCTP]: Implement SCTP-AUTH initializations.\")\n    Reported-by: syzbot+afabda3890cc2f765041@syzkaller.appspotmail.com\n    Reported-by: syzbot+276ca1c77a19977c0130@syzkaller.appspotmail.com\n    Signed-off-by: Xin Long <lucien.xin@gmail.com>\n    Acked-by: Neil Horman <nhorman@redhat.com>\n    Signed-off-by: David S. Miller <davem@davemloft.net>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit a892d74963c83e7ac357e5815a238076c4e57d99\nAuthor: Geert Uytterhoeven <geert@linux-m68k.org>\nDate:   Thu May 16 09:09:35 2019 +0200\n\n    cpu/speculation: Warn on unsupported mitigations= parameter\n\n    commit 1bf72720281770162c87990697eae1ba2f1d917a upstream.\n\n    Currently, if the user specifies an unsupported mitigation strategy on the\n    kernel command line, it will be ignored silently.  The code will fall back\n    to the default strategy, possibly leaving the system more vulnerable than\n    expected.\n\n    This may happen due to e.g. a simple typo, or, for a stable kernel release,\n    because not all mitigation strategies have been backported.\n\n    Inform the user by printing a message.\n\n    Fixes: 98af8452945c5565 (\"cpu/speculation: Add 'mitigations=' cmdline option\")\n    Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>\n    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>\n    Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>\n    Cc: Peter Zijlstra <peterz@infradead.org>\n    Cc: Jiri Kosina <jkosina@suse.cz>\n    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n    Cc: Ben Hutchings <ben@decadent.org.uk>\n    Cc: stable@vger.kernel.org\n    Link: https://lkml.kernel.org/r/20190516070935.22546-1-geert@linux-m68k.org\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit 8ac3c1abffbb308dc6c7191fecd0ada06a75a3aa\nAuthor: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>\nDate:   Mon Jun 10 13:20:10 2019 -0400\n\n    x86/speculation: Allow guests to use SSBD even if host does not\n\n    commit c1f7fec1eb6a2c86d01bc22afce772c743451d88 upstream.\n\n    The bits set in x86_spec_ctrl_mask are used to calculate the guest's value\n    of SPEC_CTRL that is written to the MSR before VMENTRY, and control which\n    mitigations the guest can enable.  In the case of SSBD, unless the host has\n    enabled SSBD always on mode (by passing \"spec_store_bypass_disable=on\" in\n    the kernel parameters), the SSBD bit is not set in the mask and the guest\n    can not properly enable the SSBD always on mitigation mode.\n\n    This has been confirmed by running the SSBD PoC on a guest using the SSBD\n    always on mitigation mode (booted with kernel parameter\n    \"spec_store_bypass_disable=on\"), and verifying that the guest is vulnerable\n    unless the host is also using SSBD always on mode. In addition, the guest\n    OS incorrectly reports the SSB vulnerability as mitigated.\n\n    Always set the SSBD bit in x86_spec_ctrl_mask when the host CPU supports\n    it, allowing the guest to use SSBD whether or not the host has chosen to\n    enable the mitigation in any of its modes.\n\n    Fixes: be6fcb5478e9 (\"x86/bugs: Rework spec_ctrl base and mask logic\")\n    Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>\n    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>\n    Reviewed-by: Liam Merwick <liam.merwick@oracle.com>\n    Reviewed-by: Mark Kanda <mark.kanda@oracle.com>\n    Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>\n    Cc: bp@alien8.de\n    Cc: rkrcmar@redhat.com\n    Cc: kvm@vger.kernel.org\n    Cc: stable@vger.kernel.org\n    Link: https://lkml.kernel.org/r/1560187210-11054-1-git-send-email-alejandro.j.jimenez@oracle.com\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit b24be4acd17a8963a29b2a92e1d80b9ddf759c95\nAuthor: Vivek Goyal <vgoyal@redhat.com>\nDate:   Fri Jul 1 16:34:27 2016 -0400\n\n    ovl: modify ovl_permission() to do checks on two inodes\n\n    commit c0ca3d70e8d3cf81e2255a217f7ca402f5ed0862 upstream.\n\n    Right now ovl_permission() calls __inode_permission(realinode), to do\n    permission checks on real inode and no checks are done on overlay inode.\n\n    Modify it to do checks both on overlay inode as well as underlying inode.\n    Checks on overlay inode will be done with the creds of calling task while\n    checks on underlying inode will be done with the creds of mounter.\n\n    Signed-off-by: Vivek Goyal <vgoyal@redhat.com>\n    Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>\n    [ Srivatsa: 4.4.y backport:\n      - Skipped the hunk modifying non-existent function ovl_get_acl()\n      - Adjusted the error path\n      - Included linux/cred.h to get prototype for revert_creds() ]\n    Signed-off-by: Srivatsa S. Bhat (VMware) <srivatsa@csail.mit.edu>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit 485ac3d91b2d158a6aab27caaa33840d67a46896\nAuthor: Wanpeng Li <wanpengli@tencent.com>\nDate:   Tue Nov 20 16:34:18 2018 +0800\n\n    KVM: X86: Fix scan ioapic use-before-initialization\n\n    commit e97f852fd4561e77721bb9a4e0ea9d98305b1e93 upstream.\n\n    Reported by syzkaller:\n\n     BUG: unable to handle kernel NULL pointer dereference at 00000000000001c8\n     PGD 80000003ec4da067 P4D 80000003ec4da067 PUD 3f7bfa067 PMD 0\n     Oops: 0000 [#1] PREEMPT SMP PTI\n     CPU: 7 PID: 5059 Comm: debug Tainted: G           OE     4.19.0-rc5 #16\n     RIP: 0010:__lock_acquire+0x1a6/0x1990\n     Call Trace:\n      lock_acquire+0xdb/0x210\n      _raw_spin_lock+0x38/0x70\n      kvm_ioapic_scan_entry+0x3e/0x110 [kvm]\n      vcpu_enter_guest+0x167e/0x1910 [kvm]\n      kvm_arch_vcpu_ioctl_run+0x35c/0x610 [kvm]\n      kvm_vcpu_ioctl+0x3e9/0x6d0 [kvm]\n      do_vfs_ioctl+0xa5/0x690\n      ksys_ioctl+0x6d/0x80\n      __x64_sys_ioctl+0x1a/0x20\n      do_syscall_64+0x83/0x6e0\n      entry_SYSCALL_64_after_hwframe+0x49/0xbe\n\n    The reason is that the testcase writes hyperv synic HV_X64_MSR_SINT6 msr\n    and triggers scan ioapic logic to load synic vectors into EOI exit bitmap.\n    However, irqchip is not initialized by this simple testcase, ioapic/apic\n    objects should not be accessed.\n    This can be triggered by the following program:\n\n        #define _GNU_SOURCE\n\n        #include <endian.h>\n        #include <stdint.h>\n        #include <stdio.h>\n        #include <stdlib.h>\n        #include <string.h>\n        #include <sys/syscall.h>\n        #include <sys/types.h>\n        #include <unistd.h>\n\n        uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};\n\n        int main(void)\n        {\n        \tsyscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);\n        \tlong res = 0;\n        \tmemcpy((void*)0x20000040, \"/dev/kvm\", 9);\n        \tres = syscall(__NR_openat, 0xffffffffffffff9c, 0x20000040, 0, 0);\n        \tif (res != -1)\n        \t\tr[0] = res;\n        \tres = syscall(__NR_ioctl, r[0], 0xae01, 0);\n        \tif (res != -1)\n        \t\tr[1] = res;\n        \tres = syscall(__NR_ioctl, r[1], 0xae41, 0);\n        \tif (res != -1)\n        \t\tr[2] = res;\n        \tmemcpy(\n        \t\t\t(void*)0x20000080,\n        \t\t\t\"\\x01\\x00\\x00\\x00\\x00\\x5b\\x61\\xbb\\x96\\x00\\x00\\x40\\x00\\x00\\x00\\x00\\x01\\x00\"\n        \t\t\t\"\\x08\\x00\\x00\\x00\\x00\\x00\\x0b\\x77\\xd1\\x78\\x4d\\xd8\\x3a\\xed\\xb1\\x5c\\x2e\\x43\"\n        \t\t\t\"\\xaa\\x43\\x39\\xd6\\xff\\xf5\\xf0\\xa8\\x98\\xf2\\x3e\\x37\\x29\\x89\\xde\\x88\\xc6\\x33\"\n        \t\t\t\"\\xfc\\x2a\\xdb\\xb7\\xe1\\x4c\\xac\\x28\\x61\\x7b\\x9c\\xa9\\xbc\\x0d\\xa0\\x63\\xfe\\xfe\"\n        \t\t\t\"\\xe8\\x75\\xde\\xdd\\x19\\x38\\xdc\\x34\\xf5\\xec\\x05\\xfd\\xeb\\x5d\\xed\\x2e\\xaf\\x22\"\n        \t\t\t\"\\xfa\\xab\\xb7\\xe4\\x42\\x67\\xd0\\xaf\\x06\\x1c\\x6a\\x35\\x67\\x10\\x55\\xcb\",\n        \t\t\t106);\n        \tsyscall(__NR_ioctl, r[2], 0x4008ae89, 0x20000080);\n        \tsyscall(__NR_ioctl, r[2], 0xae80, 0);\n        \treturn 0;\n        }\n\n    This patch fixes it by bailing out scan ioapic if ioapic is not initialized in\n    kernel.\n\n    Reported-by: Wei Wu <ww9210@gmail.com>\n    Cc: Paolo Bonzini <pbonzini@redhat.com>\n    Cc: Radim Krčmář <rkrcmar@redhat.com>\n    Cc: Wei Wu <ww9210@gmail.com>\n    Signed-off-by: Wanpeng Li <wanpengli@tencent.com>\n    Cc: stable@vger.kernel.org\n    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>\n    [ Srivatsa: Adjusted the context for 4.4.y ]\n    Signed-off-by: Srivatsa S. Bhat (VMware) <srivatsa@csail.mit.edu>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit 33da943746bd482c6917bc8213e537c8721710c8\nAuthor: Adeodato Simó <dato@net.com.org.es>\nDate:   Tue Nov 13 03:28:53 2018 -0300\n\n    net/9p: include trans_common.h to fix missing prototype warning.\n\n    [ Upstream commit 52ad259eaac0454c1ac7123e7148cf8d6e6f5301 ]\n\n    This silences -Wmissing-prototypes when defining p9_release_pages.\n\n    Link: http://lkml.kernel.org/r/b1c4df8f21689b10d451c28fe38e860722d20e71.1542089696.git.dato@net.com.org.es\n    Signed-off-by: Adeodato Simó <dato@net.com.org.es>\n    Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n\ncommit 33e0f07f6f29c6c3727b28c5c4a1576c04dec3af\nAuthor: Dominique Martinet <dominique.martinet@cea.fr>\nDate:   Sat Sep 8 00:36:08 2018 +0900\n\n    9p: p9dirent_read: check network-provided name length\n\n    [ Upstream commit ef5305f1f72eb1cfcda25c382bb0368509c0385b ]\n\n    strcpy to dirent->d_name could overflow the buffer, use strscpy to check\n    the provided string length and error out if the size was too big.\n\n    While we are here, make the function return an error when the pdu\n    parsing failed, instead of returning the pdu offset as if it had been a\n    success...\n\n    Link: http://lkml.kernel.org/r/1536339057-21974-4-git-send-email-asmadeus@codewreck.org\n    Addresses-Coverity-ID: 139133 (\"Copy into fixed size buffer\")\n    Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n\ncommit 3479b3c35e82ed10aa0ca2ee9e78c4eded06ba62\nAuthor: Dominique Martinet <dominique.martinet@cea.fr>\nDate:   Sat Sep 8 00:26:50 2018 +0900\n\n    9p/rdma: remove useless check in cm_event_handler\n\n    [ Upstream commit 473c7dd1d7b59ff8f88a5154737e3eac78a96e5b ]\n\n    the client c is always dereferenced to get the rdma struct, so c has to\n    be a valid pointer at this point.\n    Gcc would optimize that away but let's make coverity happy...\n\n    Link: http://lkml.kernel.org/r/1536339057-21974-3-git-send-email-asmadeus@codewreck.org\n    Addresses-Coverity-ID: 102778 (\"Dereference before null check\")\n    Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n\ncommit 1275a5cf02a39ae48ae4ae770a43f56e3317f750\nAuthor: Dominique Martinet <dominique.martinet@cea.fr>\nDate:   Sat Sep 8 00:10:57 2018 +0900\n\n    9p: acl: fix uninitialized iattr access\n\n    [ Upstream commit e02a53d92e197706cad1627bd84705d4aa20a145 ]\n\n    iattr is passed to v9fs_vfs_setattr_dotl which does send various\n    values from iattr over the wire, even if it tells the server to\n    only look at iattr.ia_valid fields this could leak some stack data.\n\n    Link: http://lkml.kernel.org/r/1536339057-21974-2-git-send-email-asmadeus@codewreck.org\n    Addresses-Coverity-ID: 1195601 (\"Uninitalized scalar variable\")\n    Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n\ncommit 87451738cb176c7d41988fde6c2ec40b2c5a7b65\nAuthor: Dominique Martinet <dominique.martinet@cea.fr>\nDate:   Thu Aug 30 19:29:36 2018 +0900\n\n    9p/rdma: do not disconnect on down_interruptible EAGAIN\n\n    [ Upstream commit 8b894adb2b7e1d1e64b8954569c761eaf3d51ab5 ]\n\n    9p/rdma would sometimes drop the connection and display errors in\n    recv_done when the user does ^C.\n    The errors were caused by recv buffers that were posted at the time\n    of disconnect, and we just do not want to disconnect when\n    down_interruptible is... interrupted.\n\n    Link: http://lkml.kernel.org/r/1535625307-18019-1-git-send-email-asmadeus@codewreck.org\n    Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>\n    Signed-off-by: Sasha Levin <sashal@kernel.org>\n\ncommit 6052d03fc9e3bcb5ed0070f20cff3abb3cef4461\nAuthor: Arnaldo Carvalho de Melo <acme@redhat.com>\nDate:   Thu Dec 6 11:20:21 2018 -0300\n\n    perf help: Remove needless use of strncpy()\n\n    commit b6313899f4ed2e76b8375cf8069556f5b94fbff0 upstream.\n\n    Since we make sure the destination buffer has at least strlen(orig) + 1,\n    no need to do a strncpy(dest, orig, strlen(orig)), just use strcpy(dest,\n    orig).\n\n    This silences this gcc 8.2 warning on Alpine Linux:\n\n      In function 'add_man_viewer',\n          inlined from 'perf_help_config' at builtin-help.c:284:3:\n      builtin-help.c:192:2: error: 'strncpy' output truncated before terminating nul copying as many bytes from a string as its length [-Werror=stringop-truncation]\n        strncpy((*p)->name, name, len);\n        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n      builtin-help.c: In function 'perf_help_config':\n      builtin-help.c:187:15: note: length computed here\n        size_t len = strlen(name);\n                     ^~~~~~~~~~~~\n\n    Cc: Adrian Hunter <adrian.hunter@intel.com>\n    Cc: Jiri Olsa <jolsa@kernel.org>\n    Cc: Namhyung Kim <namhyung@kernel.org>\n    Fixes: 078006012401 (\"perf_counter tools: add in basic glue from Git\")\n    Link: https://lkml.kernel.org/n/tip-2f69l7drca427ob4km8i7kvo@git.kernel.org\n    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>\n    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\ncommit e1f60e369ad58188403aea08e1f9b3809fd589a6\nAuthor: Arnaldo Carvalho de Melo <acme@redhat.com>\nDate:   Thu Dec 6 11:41:03 2018 -0300\n\n    perf ui helpline: Use strlcpy() as a shorter form of strncpy() + explicit set nul\n\n    commit 4d0f16d059ddb91424480d88473f7392f24aebdc upstream.\n\n    The strncpy() function may leave the destination string buffer\n    unterminated, better use strlcpy() that we have a __weak fallback\n    implementation for systems without it.\n\n    In this case we are actually setting the null byte at the right place,\n    but since we pass the buffer size as the lim…","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_xiaomi_wayne/commits/ebbb8798444a20631b5ff38a54dacf5b5d0ee19b"},{"sha":"9c2d87a406f1da324da626d05934777e570477ab","author":{"name":"PIPIPIG233666","email":"1c9d593876b9ecd3913042a2ff5f1fc2e2497b42@qq.com"},"message":"\"LA.UM.7.2.r1-07200-sdm660.0\"\n\ncommit 30f4c91dbb256adffbb170317bd5f1834413587f\nMerge: fdf3178bf02d 7b96ca1e7fcd\nAuthor: Pradosh Das <prados@codeaurora.org>\nDate:   Wed Jul 3 16:59:58 2019 +0530\n\n    Merge commit '7b96ca1e7fcd95dbd20d460d19b52675edbe906f' into HEAD\n\n    Change-Id: I445e96c2d16725b53e38b399f1919131a8e71139\n    Signed-off-by: Pradosh Das <prados@codeaurora.org>\n\ncommit 7b96ca1e7fcd95dbd20d460d19b52675edbe906f\nMerge: b061f9ea06ec 12fa51817570\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Sat Jun 29 05:13:25 2019 -0700\n\n    Merge \"msm: ais: handle the error value returned during get clock\"\n\ncommit 12fa51817570798dc5e1d030b1e27e3797dc36f3\nAuthor: E V Ravi <evenka@codeaurora.org>\nDate:   Thu May 16 14:14:58 2019 +0530\n\n    msm: ais: handle the error value returned during get clock\n\n    currently only NULL pointer check is used to validate the return\n    value from clkget this change to handle all the failures.\n\n    Change-Id: I275cb4717c675baf528e05c50058f2c6b0025011\n    Signed-off-by: E V Ravi <evenka@codeaurora.org>\n    Signed-off-by: Sumalatha Malothu <smalot@codeaurora.org>\n\ncommit b061f9ea06ecb076dbc88cd045787e312ec2dad0\nMerge: e42eed967e04 f94667b92e53\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Thu Jun 27 11:34:46 2019 -0700\n\n    Merge \"soc: qcom: smem: validate fields of shared structures\"\n\ncommit e42eed967e0435831fefa8d20cae83dd818801ff\nMerge: 5100cbd1b3e8 7123fa1089f3\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Thu Jun 27 04:38:42 2019 -0700\n\n    Merge \"msm: ipa: fix to validate the ioctl WAN_IOC_SEND_LAN_CLIENT_MSG params\"\n\ncommit 5100cbd1b3e8ec5d817b71532254b6ce8a67009c\nMerge: dea74cf7d552 25e6769daa4b\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Thu Jun 27 04:38:41 2019 -0700\n\n    Merge \"diag: Prevent out-of-bound access while processing userspace data\"\n\ncommit f94667b92e53f7db4e69006f03af00a7b449099d\nAuthor: Deepak Kumar Singh <deesin@codeaurora.org>\nDate:   Tue Apr 30 15:45:37 2019 +0530\n\n    soc: qcom: smem: validate fields of shared structures\n\n    Structures in shared memory that can be modified by remote\n    processors may have untrusted values, they should be validated\n    before use.\n\n    Adding proper validation before using fields of shared\n    structures.\n\n    CRs-Fixed: 2421611\n    Change-Id: Ifed71c506a26105eac3db9ee35f086d7dbf5a3a3\n    Signed-off-by: Deepak Kumar Singh <deesin@codeaurora.org>\n\ncommit 7123fa1089f367fb81e01445c445b86176a98535\nAuthor: Chaitanya Pratapa <cpratapa@codeaurora.org>\nDate:   Tue Feb 26 15:06:31 2019 +0530\n\n    msm: ipa: fix to validate the ioctl WAN_IOC_SEND_LAN_CLIENT_MSG params\n\n    When processing WAN_IOC_SEND_LAN_CLIENT_MSG ioctl there is a possibility\n    of message_type being invalid and this can lead to out of buffer error.\n    Make a change to validate the ioctl params before processing.\n\n    Change-Id: If7955f77863b772ae1c8feda5ca0145c822403b9\n    Signed-off-by: Chaitanya Pratapa <cpratapa@codeaurora.org>\n\ncommit 25e6769daa4bbb74989e5775408eab2f12d996e1\nAuthor: Hardik Arya <harya@codeaurora.org>\nDate:   Tue Apr 30 12:48:29 2019 +0530\n\n    diag: Prevent out-of-bound access while processing userspace data\n\n    Proper buffer length checks are missing in diagchar_write\n    handlers for userspace data while processing the same buffer.\n\n    Change-Id: I5b8095766e09c22f164398089505fe827fee8b54\n    Signed-off-by: Hardik Arya <harya@codeaurora.org>\n\ncommit dea74cf7d55260eb81b8a50c22c37eaa0c6bea13\nAuthor: Andrew Zaborowski <andrew.zaborowski@intel.com>\nDate:   Wed Nov 28 17:26:34 2018 +0800\n\n    cfg80211: NL80211_ATTR_SOCKET_OWNER support for CMD_CONNECT\n\n    Disconnect or deauthenticate when the owning socket is closed if this\n    flag is supplied to CMD_CONNECT or CMD_ASSOCIATE.  This may be used\n    to ensure userspace daemon doesn't leave an unmanaged connection behind.\n\n    In some situations it would be possible to account for that, to some\n    degree, in the deamon restart code or in the up/down scripts without\n    the use of this attribute.  But there will be systems where the daemon\n    can go away for varying periods without a warning due to local resource\n    management.\n\n    Signed-off-by: Andrew Zaborowski <andrew.zaborowski@intel.com>\n    Signed-off-by: Johannes Berg <johannes.berg@intel.com>\n\n    Git-commit: 36a554cec119bbd20c4ec0cb96bd4712d124bfea\n    Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git\n    Change-Id: Ic09ee323fc6215059d5c2572ba3e77c56addad32\n    CRs-Fixed: 2468738\n    Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>\n    Signed-off-by: Jiachao Wu <jiacwu@codeaurora.org>\n    Signed-off-by: Min Liu <minliu@codeaurora.org>\n    Signed-off-by: stonez <stonez@codeaurora.org>\n\ncommit 2692bfe6507d962f1d5260dc1fc5e26c6e82e05b\nMerge: ca05390f0c94 ae49a1758fa4\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Mon Jun 24 20:00:54 2019 -0700\n\n    Merge \"dsp: q6core: validate payload size before memory copy\"\n\ncommit ca05390f0c94747d7cba1375f55e7088bb308069\nMerge: 6240792cdaed 94835ff2d3f5\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Tue Jun 18 09:48:15 2019 -0700\n\n    Merge \"msm: sensor: actuator: fix out of bound read for bivcm region params\"\n\ncommit 6240792cdaed212430301d07debda13a1ed4d75c\nMerge: 166ba6a45bd6 82caeda13986\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Tue Jun 18 00:25:17 2019 -0700\n\n    Merge \"diag: Prevent out of bound access while getting build mask\"\n\ncommit 94835ff2d3f502c4b5cc198616645ff9e369795a\nAuthor: Haibin Liu <haibinl@codeaurora.org>\nDate:   Tue Apr 30 14:16:47 2019 +0800\n\n    msm: sensor: actuator: fix out of bound read for bivcm region params\n\n    The region index for bivcm is not validated against the region size.\n    This causes out-of-bound read on the KASAN kernel.\n    Add restriction that region index smaller than region size.\n\n    CRs-Fixed: 2379514\n    Change-Id: I72c4a41a4b41c8fa70c174ffd3215a81eaa14355\n    Signed-off-by: Haibin Liu <haibinl@codeaurora.org>\n\ncommit 82caeda1398689e495f03c00e4fc1547bb810ae8\nAuthor: Manoj Prabhu B <bmanoj@codeaurora.org>\nDate:   Wed Apr 24 21:42:10 2019 +0530\n\n    diag: Prevent out of bound access while getting build mask\n\n    Add check for minimum length before typecasting to build mask\n    structure to prevent out of bound access.\n\n    CRs-Fixed: 2431005\n    Change-Id: I97b439ead62c8a67869c9209442ef771308f2d3f\n    Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>\n\ncommit 166ba6a45bd62a4cc2ad5299c21b27e2226e7ec0\nAuthor: Deepak Kumar Singh <deesin@codeaurora.org>\nDate:   Tue May 28 17:36:33 2019 +0530\n\n    soc: qcom: smem: validate fields of shared structures\n\n    Structures in shared memory that can be modified by remote\n    processors may have untrusted values, they should be validated\n    before use.\n\n    Adding proper validation before using fields of shared\n    structures.\n\n    CRs-Fixed: 2421602\n    Change-Id: I947ed5b0fe5705e5223d75b0ea8aafb36113ca5a\n    Signed-off-by: Deepak Kumar Singh <deesin@codeaurora.org>\n\ncommit b9a42b4ce5297632a2fdb900c30a3894c5f53f4e\nAuthor: Tharun Kumar Merugu <mtharu@codeaurora.org>\nDate:   Tue May 7 00:39:43 2019 +0530\n\n    msm: adsprpc: maintain local copy of rpra offloaded to DSP\n\n    Since DSP is not supposed to modify the base pointer rpra of the\n    input/output arguments offloaded to DSP, maintain a local copy of\n    the pointer and use it after receiving interrupt from DSP.\n\n    Change-Id: I4afade7184cb2aca148060fb0cda06c6174f3b55\n    Acked-by: Maitreyi Gupta <maitreyi@qti.qualcomm.com>\n    Signed-off-by: Tharun Kumar Merugu <mtharu@codeaurora.org>\n    Signed-off-by: Mohammed Nayeem Ur Rahman <mohara@codeaurora.org>\n\ncommit 26b963c83a75d481d28d5ae2cfd8332d8037610b\nMerge: 9c3d573678c3 53f933ef2d18\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Tue Jun 11 12:23:56 2019 -0700\n\n    Merge \"msm: ipa3: Fix to validate check for IP type\"\n\ncommit 53f933ef2d189fa5744b0b8f27a74eff191550b3\nAuthor: Praveen Kurapati <pkurapat@codeaurora.org>\nDate:   Tue May 21 16:08:10 2019 +0530\n\n    msm: ipa3: Fix to validate check for IP type\n\n    Add proper check for validating the IP type while\n    sending request for ul-filter-rule install.\n\n    Change-Id: I170230310884f176cf41d5ae20287f6d74a4bc29\n    Signed-off-by: Praveen Kurapati <pkurapat@codeaurora.org>\n\ncommit 9c3d573678c3455dba316c9518d5899ba34374a5\nMerge: ebbd0af9c7cc 92e370e6293b\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Tue Jun 11 04:12:21 2019 -0700\n\n    Merge \"dwc3-msm: Fix dwc3_drd_state_string for undefined state\"\n\ncommit ebbd0af9c7cc24ab4d16d177501c517b13c009c4\nMerge: 84253b6fc694 cc4d1a6cb19f\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Sun Jun 9 18:48:03 2019 -0700\n\n    Merge \"msm: camera: isp: Fix frame drop pattern\"\n\ncommit 84253b6fc694978c5a722aee3d59a24f8f39c087\nMerge: 220c735ef46a 5bee717e4331\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Sun Jun 9 08:03:25 2019 -0700\n\n    Merge \"asoc: Ratelimit error logs to avoid excessive logging\"\n\ncommit 220c735ef46a2658fd5ced3da29a8f0e55b764b1\nMerge: bb646b5795fa b308c9c0291a\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Sun Jun 9 08:03:24 2019 -0700\n\n    Merge \"msm: ipa: fix to validate input parameters\"\n\ncommit bb646b5795fa33e316eef74b31cc1deaf950bb9e\nMerge: 1569dc4f6c3d 639259bb3283\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Sun Jun 9 08:03:23 2019 -0700\n\n    Merge \"msm: mdss: hdmi: fix 4 block EDID read failure\"\n\ncommit 1569dc4f6c3ddd876a4f24aa912f75d2c6322c08\nMerge: b90147890063 ad283e50ec9f\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Sun Jun 9 00:24:39 2019 -0700\n\n    Merge \"msm: mdss: hdmi: parse extended EDID block map\"\n\ncommit b90147890063ea966882bcc3641da487ebe03c75\nMerge: 5e170b6a8d28 5f7a491185c9\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Sat Jun 8 11:26:05 2019 -0700\n\n    Merge \"soc: msm8998: Add 16ch playback and record support for TDM\"\n\ncommit 5e170b6a8d28910b15a307049c1026450d9a5484\nMerge: 6dc4873f91a0 8c174167dcd5\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Sat Jun 8 11:26:04 2019 -0700\n\n    Merge \"asoc: Update max channels for TDM ports\"\n\ncommit 5f7a491185c93e91002d4c19e843d5f88b029728\nAuthor: Dhanalakshmi Siddani <dsiddani@codeaurora.org>\nDate:   Tue Jun 4 18:22:59 2019 +0530\n\n    soc: msm8998: Add 16ch playback and record support for TDM\n\n    Add support for 16ch playback and record usecase support\n    for primary and quaternary TDM ports.\n    Add mixer controls to set slot width, slot mapping and\n    calculate bit clock dynamically. Set bit clock for all\n    TDM ports dynamically.\n\n    Change-Id: I9d356d61f29ba18dd77138bd895139042a3c01f6\n    Signed-off-by: Dhanalakshmi Siddani <dsiddani@codeaurora.org>\n\ncommit b308c9c0291acabcad9bb1feb6933f0e66cb626c\nAuthor: Abhishek Choubey <abchoube@codeaurora.org>\nDate:   Mon Feb 25 15:52:46 2019 +0530\n\n    msm: ipa: fix to validate input parameters\n\n    Validate the input parameters to avoid any unexpected\n    scenarios.\n\n    Change-Id: If77ac66470baf937b160800174ea14f1a8cb6408\n    Signed-off-by: Pooja Kumari <kumarip@codeaurora.org>\n    Signed-off-by: Abhishek Choubey <abchoube@codeaurora.org>\n\ncommit ae49a1758fa494d03bce188e4bd38a279981ef80\nAuthor: kunleiz <kunleiz@codeaurora.org>\nDate:   Wed Apr 24 15:16:17 2019 +0800\n\n    dsp: q6core: validate payload size before memory copy\n\n    Payload size is not checked before memory copy.\n    Check payload size to avoid out-of-boundary memory\n    access.\n\n    Change-Id: I07857564d4e8ce415df3810b25f0e9e17a60993d\n    Signed-off-by: Kunlei Zhang <kunleiz@codeaurora.org>\n\ncommit 8c174167dcd529f4864996ffe139b8634693447b\nAuthor: Dhanalakshmi Siddani <dsiddani@codeaurora.org>\nDate:   Mon Jun 3 22:13:42 2019 +0530\n\n    asoc: Update max channels for TDM ports\n\n    Update max channels supported for TDM ports from 8 to 16.\n    Update pcm driver to support 32 channels and 32bit format.\n\n    Change-Id: I3d3b42983fff22e0102b9eb2aaca1a5698820605\n    Signed-off-by: Dhanalakshmi Siddani <dsiddani@codeaurora.org>\n\ncommit 5bee717e4331358923452571a3ece2428f30f19a\nAuthor: Aditya Bavanari <abavanar@codeaurora.org>\nDate:   Tue May 7 15:42:18 2019 +0530\n\n    asoc: Ratelimit error logs to avoid excessive logging\n\n    Ratelimit error logs of boundary check conditions\n    in audio effects driver to avoid excessive logging.\n\n    CRs-Fixed: 2426159\n    Change-Id: Iaf10eee281389773a21340997e3ffbe88c6e79f6\n    Signed-off-by: Aditya Bavanari <abavanar@codeaurora.org>\n\ncommit 92e370e6293b5d13022bdea1c5c9291d393e3a10\nAuthor: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>\nDate:   Mon Dec 17 12:34:51 2018 -0800\n\n    dwc3-msm: Fix dwc3_drd_state_string for undefined state\n\n    dwc3_drd_state_string() will return null for undefined state and\n    fix it by adding undefined name to state_names.\n\n    Change-Id: I40be0b14c098fe2e9d77df3ff1108c3d4d55a30f\n    Signed-off-by: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>\n\ncommit 7d34ffa6c3e52b166a495c181fce7b5aa90a2811\nAuthor: Manu Gautam <mgautam@codeaurora.org>\nDate:   Mon Dec 3 14:38:23 2018 +0530\n\n    usb: dwc3-msm: Ensure hardware is reset during role change\n\n    Introduce additional WAIT_FOR_LPM input flag to ensure USB\n    enters low power mode after stop_peripheral or stop_host.\n    This makes sure that USB hardware is reset after LPM for\n    cases where quick transition to host mode happens while\n    its child was still preventing dwc3 to enter low power mode.\n    In the absence of h/w reset after stop_peripheral, host mode\n    doesn't work.\n\n    Change-Id: I67e4fcdc11a3337e3e90b4ca8f461e328a6e8ecf\n    Signed-off-by: Manu Gautam <mgautam@codeaurora.org>\n\ncommit 582ce26ce1b9b6c0f16b3385c2da29d032c35885\nAuthor: Manu Gautam <mgautam@codeaurora.org>\nDate:   Thu Dec 6 15:45:22 2018 +0530\n\n    usb: dwc3-msm: add enum for drd_states to remove otg_state usage\n\n    otg_state enum defines states for USB OTG devices. Since, driver\n    supports only role change (DRD) and no OTG support, hence, instead\n    of using otg_states create separate drd_state enums.\n\n    Change-Id: Ifda1fac712e751c980ce51b60b473e5921f2001d\n    Signed-off-by: Manu Gautam <mgautam@codeaurora.org>\n\ncommit 6dc4873f91a0db6dfc34097bc6c38dd36a111377\nAuthor: Anmolpreet Kaur <anmolpre@codeaurora.org>\nDate:   Thu May 2 17:32:08 2019 +0530\n\n    qcom: smcinvoke: Fix stack overflow for arr_filp\n\n    arr_filp is an alias to filp_to_release. It is exposed\n    to access indices greater than allotted space of 15 bytes,\n    equal to size of OBJECT_COUNTS_MAX_OO. This change fixes\n    the stack overflow by taking an independent variable to track\n    the number of output objects.\n\n    Change-Id: Idca9cef3c69693d27d4ca3d0e0b4845fc27c998a\n    Signed-off-by: Anmolpreet Kaur <anmolpre@codeaurora.org>\n\ncommit cc4d1a6cb19f252e64d9c8449a317fa807ba4a6a\nAuthor: Meera Gande <mgande@codeaurora.org>\nDate:   Tue Oct 16 12:20:15 2018 +0530\n\n    msm: camera: isp: Fix frame drop pattern\n\n    In few scenarios, the request frame may get\n    delayed and current and request frame id may\n    become same. While user space is informed to\n    delay a frame in such scenarios, the pattern\n    shouldn't get reset.\n\n    Change-Id: I63f1301fbbe7cba024a686cbd783af25232f1293\n    Signed-off-by: Meera Gande <mgande@codeaurora.org>\n\ncommit fdf3178bf02d61bea6bd6ce7d114756330a7bd2d\nMerge: 8b48ca29e833 7171e1ea3b1f\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Sun Jun 2 13:39:05 2019 -0700\n\n    Merge \"msm: ais: handle the error value returned during get clock\" into kernel.lnx.4.4.r34-rel\n\ncommit 7171e1ea3b1f0c5b47202deaebcb95fcbee752f5\nAuthor: E V Ravi <evenka@codeaurora.org>\nDate:   Thu May 16 14:14:58 2019 +0530\n\n    msm: ais: handle the error value returned during get clock\n\n    currently only NULL pointer check is used to validate the return\n    value from clk_get, this change to handle all the failures.\n    This snapshot is taken from auto-kernel.lnx.4.4.c1\n    ported it from auto-kernel.lnx.4.4.c1 to 4.4\n\n    Change-Id: I275cb4717c675baf528e05c50058f2c6b0025011\n    Signed-off-by: E V Ravi <evenka@codeaurora.org>\n\ncommit 8b48ca29e8333a31a45a9c7092136d151eb64652\nAuthor: Abhishek Choubey <abchoube@codeaurora.org>\nDate:   Mon Feb 25 15:52:46 2019 +0530\n\n    msm: ipa: fix to validate input parameters\n\n    Validate the input parameters to avoid any unexpected\n    scenarios.\n\n    Change-Id: If77ac66470baf937b160800174ea14f1a8cb6408\n    Signed-off-by: Pooja Kumari <kumarip@codeaurora.org>\n    Signed-off-by: Abhishek Choubey <abchoube@codeaurora.org>\n\ncommit b12f919f4aa23bd504c6f53adfe275d803eb6c25\nMerge: 5fede01367db 96eca3707198\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Sat Jun 1 22:11:56 2019 -0700\n\n    Merge 96eca370719871e5e3f65a62bd9f0d37cb389432 on remote branch\n\n    Change-Id: I23f13c6e414b8ab19b33af2b0f1b032a0a6e50cf\n\ncommit 96eca370719871e5e3f65a62bd9f0d37cb389432\nAuthor: Manoj Prabhu B <bmanoj@codeaurora.org>\nDate:   Wed Apr 24 21:11:06 2019 +0530\n\n    diag: Check command size against the minimum before parsing\n\n    Add check for minimum length before typecasting to build mask\n    structure to prevent out of bound access while processing\n    get msg mask command.\n\n    CRs-Fixed: 2431047\n    Change-Id: I5b8341f278b0b46359800e43c604c5671261c728\n    Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>\n\ncommit ad283e50ec9f6db0397a2c00d51c9359982e5b56\nAuthor: Narender Ankam <nankam@codeaurora.org>\nDate:   Wed May 29 13:37:52 2019 +0530\n\n    msm: mdss: hdmi: parse extended EDID block map\n\n    As part of EDID parser, add support to parse extended EDID\n    Block Map (0xf0) block and parse all subsequent CEA (0x02)\n    extended EDID Blocks.\n\n    Change-Id: I581efae59dde3abf6f297d5a2519ac0088554b64\n    Signed-off-by: Narender Ankam <nankam@codeaurora.org>\n\ncommit 639259bb3283347cc7ecca2e8041fd8319dac772\nAuthor: Narender Ankam <nankam@codeaurora.org>\nDate:   Wed May 29 13:25:00 2019 +0530\n\n    msm: mdss: hdmi: fix 4 block EDID read failure\n\n    Only Block0 and Block1 of EDID are being read successfully.\n    Fix EDID segment read failure for Block2 and Block3.\n\n    Change-Id: I2d501878c6089b275e77587f3f41416aec2ef389\n    Signed-off-by: Narender Ankam <nankam@codeaurora.org>\n\ncommit 10da01940da1d5eaeb3eab6c2238ba12524ffa2e\nMerge: 526404d09d6f a935cbe4375c\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Fri May 24 10:20:00 2019 -0700\n\n    Merge \"msm: adm: validate ADSP payload size before access\"\n\ncommit 526404d09d6f68ffd3f11161566ca64728fb9214\nAuthor: Narender Ankam <nankam@codeaurora.org>\nDate:   Thu May 16 19:30:37 2019 +0530\n\n    msm: mdss: assign block_id for INTF_3\n\n    As part of destination scalar on HDMI, INTF3 will be\n    configured as dual LM single display for higher video\n    timings. Assign block_id for HDMI INTF.\n\n    Change-Id: I09f5eb4136c4a8248f3dc9a36e2d94110419112d\n    Signed-off-by: Narender Ankam <nankam@codeaurora.org>\n\ncommit a935cbe4375cde0027646c6e838b98243be84e22\nAuthor: Vignesh Kulothungan <vigneshk@codeaurora.org>\nDate:   Thu Feb 28 15:38:00 2019 -0800\n\n    msm: adm: validate ADSP payload size before access\n\n    Check the size of ADSP payload before accessing it.\n\n    CRs-Fixed: 2380694\n    Change-Id: Icdc19a85b39a397ba6d7177f42ece4626b901832\n    Signed-off-by: Vignesh Kulothungan <vigneshk@codeaurora.org>\n\ncommit dabba2bc7bea2366304ce48e25721c533552c53b\nAuthor: E V Ravi <evenka@codeaurora.org>\nDate:   Mon May 6 18:16:43 2019 +0530\n\n    msm: ais : Lock Implementation for avoid race condition\n\n    Lock Implementation for avoid race condition leading\n    to out-of-bound write in \"msm_vb2_queue_setup\n\n    Change-Id: I386f1709bdf3328ae0c1db44980db8453849babf\n    Signed-off-by: E V Ravi <evenka@codeaurora.org>\n\ncommit 44d964e1d22f094e1f9510c81cec5fe519fb2ec1\nMerge: 403885b338a3 a919f50d9673\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Tue May 21 18:17:00 2019 -0700\n\n    Merge \"dsp: afe: check for minimum size before payload access\"\n\ncommit a919f50d967310eb7c150ba809c2c6434e0a7149\nAuthor: Karthikeyan Mani <kmani@codeaurora.org>\nDate:   Tue May 14 14:10:55 2019 -0700\n\n    dsp: afe: check for minimum size before payload access\n\n    Check if payload data is atleast the minimum expected size\n    before accessing the data in it.\n\n    Change-Id: Ia1295ca5ad5d002122e416fae53588681da687ea\n    Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>\n\ncommit 403885b338a35c316b66cd2770a32cf3279b48d9\nMerge: 5bfaf959ac8d f455966ef097\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Tue May 21 10:20:10 2019 -0700\n\n    Merge \"msm: qdsp6v2: Check size of payload before access\"\n\ncommit f455966ef0977e78f8005ce1ed82d66e21508f5d\nAuthor: Vatsal Bucha <vbucha@codeaurora.org>\nDate:   Fri Feb 22 15:38:30 2019 +0530\n\n    msm: qdsp6v2: Check size of payload before access\n\n    Check size of payload array before access in qdsp_mvm_callback.\n\n    Change-Id: I81d945f963cfb4a3cb26155700b82880d891ec5e\n    Signed-off-by: Vatsal Bucha <vbucha@codeaurora.org>\n\ncommit 5bfaf959ac8daa1e99531ba33f63139628ed5ae9\nMerge: 2cbfe924cf01 ee8a9362ca92\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Tue May 21 02:24:46 2019 -0700\n\n    Merge \"msm: mdss: hdmi: reset sink_caps before parsing EDID\"\n\ncommit ee8a9362ca923da6d6ad6f12c030b61539afe510\nAuthor: Narender Ankam <nankam@codeaurora.org>\nDate:   Thu May 16 18:10:54 2019 +0530\n\n    msm: mdss: hdmi: reset sink_caps before parsing EDID\n\n    Within EDID parser's data structure, sink_caps of previous\n    EDID are being retained. Reset sink_caps before parsing new\n    EDID.\n\n    Change-Id: I7927161256ec87ab77b26a9d7bc5e0cd1df5583b\n    Signed-off-by: Narender Ankam <nankam@codeaurora.org>\n\ncommit 2cbfe924cf01c742edc184a016bede2e3c6eb0a7\nAuthor: Narender Ankam <nankam@codeaurora.org>\nDate:   Tue Apr 9 18:56:37 2019 +0530\n\n    msm: mdss: mdp: mixer allocation for pluggable primary display\n\n    Try to allocate mixers LM0 and LM1 to an external pluggable\n    display if it is configured as primary display.\n\n    Change-Id: I81672132a6452535dcd7c2977e76f88a5f3aecf9\n    Signed-off-by: Narender Ankam <nankam@codeaurora.org>\n\ncommit eddc389f5a697df4aa0957e18a3b66a1c067fab5\nMerge: 26ac9f568e8a 4d2f6ab9a889\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Mon May 20 09:12:58 2019 -0700\n\n    Merge \"net: sockev: avoid races between sockev and socket_close\"\n\ncommit 4d2f6ab9a889a4db5aa02168a17f25d2f44ccf02\nAuthor: Sharath Chandra Vurukala <sharathv@codeaurora.org>\nDate:   Wed Apr 24 11:35:26 2019 +0530\n\n    net: sockev: avoid races between sockev and socket_close\n\n    Use-after-free is seen when sending a sockev netlink message\n    since socket is not held which can race with sk_free.\n\n    KASAN: use-after-free in sockev_client_cb+0x41c/0x4b8\n    \tin net/core/sockev_nlmcast.c:104\n    Read of size 2 at addr ffffffc08420c550\n    Call trace:\n    dump_backtrace+0x0/0x388 arch/arm64/kernel/time.c:55\n    show_stack+0x24/0x30 arch/arm64/kernel/traps.c:152\n    __dump_stack+0x24/0x2c lib/dump_stack.c:17\n    dump_stack+0x8c/0xd0 lib/dump_stack.c:53\n    print_address_description+0x74/0x234 mm/kasan/report.c:256\n    kasan_report_error mm/kasan/report.c:354 [inline]\n    kasan_report+0x240/0x264 mm/kasan/report.c:412\n    __asan_report_load2_noabort+0x2c/0x38 mm/kasan/report.c:431\n    sockev_client_cb+0x41c/0x4b8 net/core/sockev_nlmcast.c:104\n    notifier_call_chain+0x104/0x158 kernel/notifier.c:93\n    __blocking_notifier_call_chain+0x80/0xb0 kernel/notifier.c:317\n    blocking_notifier_call_chain+0x3c/0x4c kernel/notifier.c:328\n    sockev_notify+0x30/0x3c net/socket.c:181\n    SYSC_bind net/socket.c:1509 [inline]\n    SyS_bind+0x1ec/0x30c net/socket.c:1489\n    el0_svc_naked+0x34/0x38\n    Freed by task 19460:\n    save_stack mm/kasan/kasan.c:447 [inline]\n    set_track mm/kasan/kasan.c:459 [inline]\n    __kasan_slab_free+0x134/0x20c mm/kasan/kasan.c:520\n    kasan_slab_free+0x10/0x1c mm/kasan/kasan.c:527\n    slab_free_hook mm/slub.c:1401 [inline]\n    slab_free_freelist_hook mm/slub.c:1422 [inline]\n    slab_free mm/slub.c:2979 [inline]\n    kmem_cache_free+0x114/0x664 mm/slub.c:3001\n    sk_prot_free net/core/sock.c:1504 [inline]\n    __sk_destruct+0x324/0x3c0 net/core/sock.c:1585\n    __sk_free+0x180/0x200 net/core/sock.c:1601\n    sk_free+0x44/0x50 net/core/sock.c:1612\n    sock_put include/net/sock.h:1643 [inline]\n    sk_common_release+0x198/0x20c net/core/sock.c:3014\n    raw_close+0x38/0x44 net/ipv4/raw.c:703\n    inet_release+0x128/0x15c net/ipv4/af_inet.c:446\n    __sock_release+0xb8/0x258 net/socket.c:614\n    sock_close+0x24/0x34 net/socket.c:1150\n    __fput+0x1f4/0x4e4 fs/file_table.c:345\n    ____fput+0x20/0x2c fs/file_table.c:380\n    task_work_run+0x9c/0x174 kernel/task_work.c:113\n\n    Change-Id: Idb4335889b6e4228f36d76ca5b6156cc5e5838da\n    Signed-off-by: Sharath Chandra Vurukala <sharathv@codeaurora.org>\n\ncommit 26ac9f568e8a201f89bb6055c553cbbcd95ba1ef\nAuthor: Karthikeyan Mani <kmani@codeaurora.org>\nDate:   Tue Mar 12 23:03:18 2019 -0700\n\n    dsp: afe: check for payload size before payload access\n\n    Check if payload data is big enough before accessing\n    the data in it.\n\n    Change-Id: I939f205a8cebf6ef4859f81fae5429bca013d540\n    Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>\n\ncommit 51f1f59a3f1e19a8106af9dc370d21a08fb072b8\nAuthor: Rajesh Kemisetti <rajeshk@codeaurora.org>\nDate:   Tue Apr 30 19:04:30 2019 +0530\n\n    msm: kgsl: Fix race condition while making page as dirty\n\n    set_page_dirty() is racy if the caller has no\n    reference against page->mapping->host, and if\n    the page is unlocked. This is because another\n    CPU could truncate the page off the mapping and\n    then free the mapping.\n\n    Use set_page_dirty_lock() to avoid this race condition.\n\n    Change-Id: I517fb9aee66560618c7676b311368f7a7498011f\n    Signed-off-by: Rajesh Kemisetti <rajeshk@codeaurora.org>\n    Signed-off-by: Archana Sriram <apsrir@codeaurora.org>\n\ncommit b1d5c60aa5379d72f54b49039b214987244bf53b\nMerge: 1c16771a7b6f edc083e81200\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Wed May 15 11:46:11 2019 -0700\n\n    Merge \"msm: camera : Lock Implementation for avoid race condition\"\n\ncommit edc083e81200388e6237fc6db9033d01ef636747\nAuthor: Vijay kumar Tumati <vtumati@codeaurora.org>\nDate:   Tue Apr 16 15:37:42 2019 +0530\n\n    msm: camera : Lock Implementation for avoid race condition\n\n    Lock Implementation for avoid race condition leading\n    to out-of-bound write in \"msm_vb2_queue_setup\n\n    CRs-Fixed: 2362627\n    Change-Id: I7f7420c7437b9ac2f215929a8614b0846e890c98\n    Signed-off-by: Vijay kumar Tumati <vtumati@codeaurora.org>\n    Signed-off-by: Haibin Liu <haibinl@codeaurora.org>\n\ncommit 1c16771a7b6fd7a56e6c7b3548f08e49778bb7c3\nAuthor: Naman Padhiar <npadhiar@codeaurora.org>\nDate:   Wed May 8 16:34:37 2019 +0530\n\n    icnss: Add check on msa region\n\n    When icnss receive server arrive it send wlfw_msa_mem_info_send_sync_msg\n    QMI request to firmware and in response expect range of addresses and size\n    to be mapped. Add condition to check whether addresses in response falls\n    under valid range otherwise it asserts.\n\n    Change-Id: I9a8542cb6c3b3cefe112d1f08a76dd2eadf68d2f\n    Signed-off-by: Naman Padhiar <npadhiar@codeaurora.org>\n\ncommit 2153161639b1bcdb5337fd6e16a331a5b0122c0e\nAuthor: Sumalatha Malothu <smalot@codeaurora.org>\nDate:   Mon Apr 29 18:05:53 2019 +0530\n\n    msm: camera_v2: handle the error value returned during get clock\n\n    currently only NULL pointer check is used to validate the return\n    value from clk_get, this change to handle all the failures.\n    This snapshot is taken from msm-4.9\n    Ported it from 4.9 to 4.4\n\n    Change-Id: Icd8b7e33d0f235a7c5dde2307972a594908e6a60\n    Signed-off-by: Sumalatha Malothu <smalot@codeaurora.org>\n\ncommit 8258c6a068daa049958bfbd92f8540a80683271d\nMerge: 0e545f94b2b1 b03b261cfc11\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Mon May 13 09:47:45 2019 -0700\n\n    Merge \"msm: mdss: hdmi: skip pan_display during handoff\"\n\ncommit 0e545f94b2b1f81a45d4091e8534c4b03b5aa97e\nMerge: f311145c920b 60e2d8fafa1e\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Fri May 10 01:53:18 2019 -0700\n\n    Merge \"diag: Check buffer size against command structure size\"\n\ncommit b03b261cfc1123002524b6c50d5b5e6ed754196f\nAuthor: Venkata Prahlad Valluru <vvalluru@codeaurora.org>\nDate:   Tue May 7 19:58:00 2019 +0530\n\n    msm: mdss: hdmi: skip pan_display during handoff\n\n    In case of HDMI as primary, skip pan_display until\n    handoff completes.\n\n    Change-Id: I5af8142292bcac0f085fffab1af99f635d3ff304\n    Signed-off-by: Venkata Prahlad Valluru <vvalluru@codeaurora.org>\n\ncommit f311145c920b1e0c241f2e0d798b8846e47d9511\nMerge: 1204b2acd6c8 051345384790\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Thu May 9 15:11:38 2019 -0700\n\n    Merge \"ARM: msm: dts: add splash memory region for APQ8098\"\n\ncommit 1204b2acd6c85e66e5c4ea323f11728eafec376f\nMerge: 1d08efb4306f 797de5526fef\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Thu May 9 15:11:37 2019 -0700\n\n    Merge \"msm: sps: Update debug message format specifier\"\n\ncommit 1d08efb4306fe30816e46e3023715cd849d12d98\nMerge: e6d0962b5701 e2220d73ad25\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Thu May 9 15:11:36 2019 -0700\n\n    Merge \"diag: Validate command length against size of command structure\"\n\ncommit 797de5526fef399ff7d6dd23fb3fcb0dfca92842\nAuthor: Jishnu Prakash <jprakash@codeaurora.org>\nDate:   Wed Mar 13 18:12:26 2019 +0530\n\n    msm: sps: Update debug message format specifier\n\n    Restrict printing of kernel virtual addresses in SPS driver.\n\n    In debug prints, handles to bam device structures may be printed\n    as integers. As these handles are obtained by casting pointer\n    to bam device structures to integer, they can reveal addresses\n    of the structures to attackers.\n\n    Cast the handles in debug prints to pointers, printed with with %pK,\n    which hides these values if kptr_restrict is set (default on Android).\n\n    Change-Id: Idd28c7d11a06113605f7428a4cfc2505c1ae0073\n    Signed-off-by: Jishnu Prakash <jprakash@codeaurora.org>\n\ncommit 051345384790e28ab2101978954fcb9cc830bab0\nAuthor: Venkata Prahlad Valluru <vvalluru@codeaurora.org>\nDate:   Tue May 7 19:46:22 2019 +0530\n\n    ARM: msm: dts: add splash memory region for APQ8098\n\n    Add splash region to handle continuous splash over\n    HDMI.\n\n    Change-Id: I827111ce1656fcd4bc3bc61232c2f81af3bef5eb\n    Signed-off-by: Venkata Prahlad Valluru <vvalluru@codeaurora.org>\n\ncommit 60e2d8fafa1ef7f417670aa1ba5a2dc945c9cf46\nAuthor: Manoj Prabhu B <bmanoj@codeaurora.org>\nDate:   Mon Apr 29 12:00:48 2019 +0530\n\n    diag: Check buffer size against command structure size\n\n    Validate the buffer size against the parsing command structure size\n    before parsing to prevent possible out of bound error case.\n\n    CRs-Fixed: 2437341\n    Change-Id: I31c9a556539fce403691294a76160ae4936e7065\n    Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>\n\ncommit e2220d73ad253a8cb6df491bfbc57860cfcd92bd\nAuthor: Manoj Prabhu B <bmanoj@codeaurora.org>\nDate:   Wed May 1 22:11:18 2019 +0530\n\n    diag: Validate command length against size of command structure\n\n    While processing a packet containing command request, buffer size\n    need to be checked against size of the command structures that is\n    being parsed to prevent possible out of bound access.\n\n    CRs-Fixed: 2432633\n    Change-Id: I048bdbd0c096a6d03501bdd5b1d2d4bb50d45dd6\n    Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>\n\ncommit e6d0962b57019513b4770aaf96138fb433b66ceb\nAuthor: Manoj Prabhu B <bmanoj@codeaurora.org>\nDate:   Thu Apr 18 16:49:49 2019 +0530\n\n    diag: dci: Validate dci response length before parsing\n\n    Prevent possible out of bound access due to missing length check\n    while extracting dci packet response by adding proper checks.\n\n    CRs-Fixed: 2434571\n    Change-Id: I7b6972bf6559bdca99333a75d989cd6d3431b801\n    Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>\n\ncommit 94b04372771c255d7cbbf34225d323de85178d9e\nAuthor: Isaac J. Manjarres <isaacm@codeaurora.org>\nDate:   Tue Apr 16 17:14:33 2019 -0700\n\n    soc: qcom: secure_buffer: Process large SG tables in batches\n\n    Currently, if processing an SG table consumes more memory\n    than can fit in the pre-allocated buffer, then calls to\n    hyp_assign_table() will fail as if there were not enough\n    memory available to process the request.\n\n    Instead, for every call to hyp assign, allocate enough\n    memory to process the maximum batch size, and process large\n    SG tables in pieces, using this memory. This avoids failures\n    due to large SG tables. Also, since the memory for handling\n    these requests is now allocated per hyp_assign_table() call,\n    we can drop the pre-allocated buffer, as it is no longer in\n    use.\n\n    Change-Id: Ie9899a5e2c8de6127707609101f5fb557e3f0533\n    Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>\n\ncommit 6e386e788febebd38b14a20e2e2828246ff8edd6\nMerge: c0bc51b83961 bc0ac2b798ca\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Mon Apr 29 23:25:28 2019 -0700\n\n    Merge \"soc: qcom: glink: Initialize local state while fetching ctx\"\n\ncommit c0bc51b83961d38517d06abf85100a50f0692d24\nMerge: aa5bbc972fed 189c079da22c\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Mon Apr 29 23:25:24 2019 -0700\n\n    Merge \"msm: wlan: Update regulatory database\"\n\ncommit aa5bbc972fed1cc0a96c3a97f7ae79dcfa1d3bb1\nMerge: 803b2f4ca7a0 215ee16770c2\nAuthor: Linux Build Service Account <lnxbuild@localhost>\nDate:   Mon Apr 29 15:11:08 2019 -0700\n\n    Merge \"msm: vidc: do not set video state to DEINIT very early\"\n\ncommit 215ee16770c2d9dcb27e9efaee58ad089e87c73f\nAuthor: Darshan Kumsi Srinivasa <darssr@codeaurora.org>\nDate:   Fri Oct 5 17:14:32 2018 +0530\n\n    msm: vidc: do not set video state to DEINIT very early\n\n    If video state set to DEINIT before processing all frame done\n    packets in the list may create video failures as explained below,\n    the client communication to video hardware will fail because of\n    DEINIT state and client will close the session upon failure which\n    will happen in parallel to response thread processing the response\n    packets in the list. It may happen that client already free'd the\n    buffer references and response thread might access the same buffer\n    reference and results in use-after-free memory fault. So In case\n    of sys error from video hardware, set video state to DEINIT after\n    processing all packets in the list to avoid use-after-free failure\n\n    Change-Id: I688c3ec3feb2b5621d75c4da93ee9870aa0e6dfe\n    Signed-off-by: Darshan Kumsi Srinivasa <darssr@codeaurora.org>\n    Signed-off-by: Sanjay Singh <sisanj@codeaurora.org>\n\ncommit 189c079da22c4339b75dd257ca1053c46f037111\nAuthor: gaolez <gaolez@codeaurora.org>\nDate:   Tue Jul 31 14:04:45 2018 +0800\n\n    msm: wlan: Update regulatory database\n\n    Enable DFS flag for TT.\n\n    Change-Id: I291dd2927ff0c92b243ee9c009b1549fb203165b\n    CRs-Fixed: 2287335\n    Signed-off-by: Gaole Zhang <gaolez@codeaurora.org>\n\ncommit bc0ac2b798ca553096862f205683a29d4f3b64d7\nAuthor: Dhoat Harpal <hdhoat@codeaurora.org>\nDate:   Thu Jan 18 00:29:20 2018 +0530\n\n    soc: qcom: glink: Initialize local state while fetching ctx\n\n    Initialization of channel's local state is not done at the time of\n    fetching context from list of channels. This leads to race condition\n    if remote close happens during this time. Remote close will check if\n    local state is not open then delete channel from list. This leads to\n    use after free scenerio.\n\n    Initialize local state at the time of fetching channel context from\n    list of channels.\n\n    CRs-Fixed: 2155992\n    Change-Id: If113daba129191bd67ef2460eb4e87c2d5614403\n    Signed-off-by: Dhoat Harpal <hdhoat@codeaurora.org>\n\nChange-Id: I013e7115d6da2de2bf614da4a483379e3cf6006e","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_xiaomi_wayne/commits/9c2d87a406f1da324da626d05934777e570477ab"},{"sha":"8bea281236aab6e7f37d0a74d8d0e6a17edba844","author":{"name":"LuK1337","email":"6c9bff5473b68c1565a176ad458785864409abaa@gmail.com"},"message":"Revert \"qcacld-3.0: Fix OOB in wma_stats_event_handler\"\n\n* This change makes WiFi report invalid signal strength.\n\nThis reverts commit be468730d315e973e9936da275b06600d0ce276c.\n\nChange-Id: I01094049520ea706c27e00f316539f9d9d53bbc7\nSigned-off-by: Albert I <kras@raphielgang.org>\nSigned-off-by: Akhil Narang <akhilnarang.1999@gmail.com>\nSigned-off-by: PIPIPIG233666 <2212848813@qq.com>","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_xiaomi_wayne/commits/8bea281236aab6e7f37d0a74d8d0e6a17edba844"},{"sha":"066f2a953a9bbccf50f598300e7b2a3be43170cd","author":{"name":"Albert I","email":"c73a553824e83a9925bed331a4f33eafa561e786@raphielgang.org"},"message":"Revert \"soc: qcom: secure_buffer: Process large SG tables in batches\"\n\nThis reverts commit 94b04372771c255d7cbbf34225d323de85178d9e.\n\nSome people report that their device don't boot. I assume it's caused by\nincompatibilites with our firmware (particularly hyp) that's based on\nolder CAF tag.\n\nSigned-off-by: Albert I <kras@raphielgang.org>\nSigned-off-by: Akhil Narang <akhilnarang.1999@gmail.com>\nSigned-off-by: PIPIPIG233666 <2212848813@qq.com>","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_xiaomi_wayne/commits/066f2a953a9bbccf50f598300e7b2a3be43170cd"},{"sha":"f0fd2c376c1490c67db9d10e522f1d39a48097e2","author":{"name":"Albert I","email":"c73a553824e83a9925bed331a4f33eafa561e786@raphielgang.org"},"message":"qcacld-3.0: Add packet capture feature option into Kconfig\n\n* After LA.UM.7.2.r1-07000-sdm660.0 merge.\n\nSigned-off-by: Albert I <kras@raphielgang.org>\nSigned-off-by: Akhil Narang <akhilnarang.1999@gmail.com>\nSigned-off-by: PIPIPIG233666 <2212848813@qq.com>\nChange-Id: Ibb43ba6710682d29537a87a0c4327964130f3a08","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_xiaomi_wayne/commits/f0fd2c376c1490c67db9d10e522f1d39a48097e2"},{"sha":"e7d86097e64d43323f4b4a67d3d6e80d989500c9","author":{"name":"Albert I","email":"c73a553824e83a9925bed331a4f33eafa561e786@raphielgang.org"},"message":"{wayne,whyred}: defconfig: Enable qcacld packet capture feature\n\n* Fixes WiFi tethering\n\nSigned-off-by: Albert I <kras@raphielgang.org>\nSigned-off-by: Akhil Narang <akhilnarang.1999@gmail.com>\nSigned-off-by: PIPIPIG233666 <2212848813@qq.com>\nChange-Id: I9591b39d45332d9289936f52d8afb62ee3b3dc49","distinct":true,"url":"https://api.github.com/repos/MoKee/android_kernel_xiaomi_wayne/commits/e7d86097e64d43323f4b4a67d3d6e80d989500c9"}]}
other: {"actor":{"display_login":"mokeeopensource"}}