)]}'
{
  "log": [
    {
      "commit": "bebc6082da0a9f5d47a1ea2edc099bf671058bd4",
      "tree": "e013f4d121199d60b70043f525aef4a7e641b5f6",
      "parents": [
        "152bbb43b30ced1b32e9ed6f5ba2ac448de725b6"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Nov 12 10:46:13 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Nov 12 10:46:13 2017 -0800"
      },
      "message": "Linux 4.14\n"
    },
    {
      "commit": "152bbb43b30ced1b32e9ed6f5ba2ac448de725b6",
      "tree": "e000f3cc8b82bc48531ce417cfe97e9b7c51239e",
      "parents": [
        "69581c74721f40b2e21667197a135120844c03b7",
        "b8347c2196492f4e1cccde3d92fda1cc2cc7de7e"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Nov 12 10:12:41 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Nov 12 10:12:41 2017 -0800"
      },
      "message": "Merge branch \u0027x86-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Thomas Gleixner:\n \"A set of small fixes:\n\n   - make KGDB work again which got broken by the conversion of WARN()\n     to #UD. The WARN fixup needs to run before the notifier callchain,\n     otherwise KGDB tries to handle it and crashes.\n\n   - disable KASAN in the ORC unwinder to prevent false positive KASAN\n     warnings\n\n   - prevent default mapping above 47bit when 5 level page tables are\n     enabled\n\n   - make the delay calibration optimization work correctly, which had\n     the conditionals the wrong way around and was operating on data\n     which was not yet updated.\n\n   - remove the bogus X86_TRAP_BP trap init from the default IDT init\n     table, which broke 32bit int3 handling by overwriting the correct\n     int3 setup.\n\n   - replace this_cpu* with boot_cpu_data access in the preemptible\n     oprofile init code\"\n\n* \u0027x86-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  x86/debug: Handle warnings before the notifier chain, to fix KGDB crash\n  x86/mm: Fix ELF_ET_DYN_BASE for 5-level paging\n  x86/idt: Remove X86_TRAP_BP initialization in idt_setup_traps()\n  x86/oprofile/ppro: Do not use __this_cpu*() in preemptible context\n  x86/unwind: Disable KASAN checking in the ORC unwinder\n  x86/smpboot: Make optimization of delay calibration work correctly\n"
    },
    {
      "commit": "69581c74721f40b2e21667197a135120844c03b7",
      "tree": "8fc2b3e655d93546d42fcc6c899266b92d6d3aa5",
      "parents": [
        "b39545684a90ef3374abc0969d64c7bc540d128d",
        "505ee76761062a1872b024140e886b7136a6c1d5"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Nov 12 09:43:53 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Nov 12 09:43:53 2017 -0800"
      },
      "message": "Merge branch \u0027perf-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf tool fixes from Thomas Gleixner:\n \"A small set of fixes for perf tool:\n\n   - synchronize the i915 drm header to avoid the \u0027out of date\u0027 warning\n\n   - make sure that perf trace cleans up its temporary files on exit\n\n   - unbreak the build with newer flex versions\n\n   - add missing braces in the eBPF parsing rules\"\n\n* \u0027perf-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  tooling/headers: Sync the tools/include/uapi/drm/i915_drm.h UAPI header\n  perf trace: Call machine__exit() at exit\n  perf tools: Fix eBPF event specification parsing\n  perf tools: Add \"reject\" option for parse-events.l\n"
    },
    {
      "commit": "b39545684a90ef3374abc0969d64c7bc540d128d",
      "tree": "353886870b0f1b926a62f7b902f122d0964a7434",
      "parents": [
        "ca91659962303d4fd5211a5e4e13df5cbb11e744",
        "92d28828179675176cd90293699b394b6d22ce68"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat Nov 11 09:10:39 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sat Nov 11 09:10:39 2017 -0800"
      },
      "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nPull networking fixes from David Miller:\n\n 1) Use after free in vlan, from Cong Wang.\n\n 2) Handle NAPI poll with a zero budget properly in mlx5 driver, from\n    Saeed Mahameed.\n\n 3) If DMA mapping fails in mlx5 driver, NULL out page, from Inbar\n    Karmy.\n\n 4) Handle overrun in RX FIFO of sun4i CAN driver, from Gerhard\n    Bertelsmann.\n\n 5) Missing return in mdb and vlan prepare phase of DSA layer, from\n    Vivien Didelot.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:\n  vlan: fix a use-after-free in vlan_device_event()\n  net: dsa: return after vlan prepare phase\n  net: dsa: return after mdb prepare phase\n  can: ifi: Fix transmitter delay calculation\n  tcp: fix tcp_fastretrans_alert warning\n  tcp: gso: avoid refcount_t warning from tcp_gso_segment()\n  can: peak: Add support for new PCIe/M2 CAN FD interfaces\n  can: sun4i: handle overrun in RX FIFO\n  can: c_can: don\u0027t indicate triple sampling support for D_CAN\n  net/mlx5e: Increase Striding RQ minimum size limit to 4 multi-packet WQEs\n  net/mlx5e: Set page to null in case dma mapping fails\n  net/mlx5e: Fix napi poll with zero budget\n  net/mlx5: Cancel health poll before sending panic teardown command\n  net/mlx5: Loop over temp list to release delay events\n  rds: ib: Fix NULL pointer dereference in debug code\n"
    },
    {
      "commit": "92d28828179675176cd90293699b394b6d22ce68",
      "tree": "a59ab85f275679d36aeea7bc998f0c350569f0f0",
      "parents": [
        "be234ba93c61927fd881e7c033a1cf31237d2742",
        "4f7116757b4bd99e4ef2636c7d957a6d63035d11"
      ],
      "author": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Sat Nov 11 21:52:01 2017 +0900"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Sat Nov 11 21:52:01 2017 +0900"
      },
      "message": "Merge tag \u0027linux-can-fixes-for-4.14-20171110\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can\n\nMarc Kleine-Budde says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull-request: can 2017-11-10\n\nthis is a pull request for net/master.\n\nThe first patch by Richard Schütz for the c_can driver removes the false\nindication to support triple sampling for d_can. Gerhard Bertelsmann\u0027s\npatch for the sun4i driver improves the RX overrun handling. The patch\nby Stephane Grosjean for the peak_canfd driver adds the PCI ids for\nvarious new PCIe/M2 interfaces. Marek Vasut\u0027s patch for the ifi driver\nfix transmitter delay calculation.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "be234ba93c61927fd881e7c033a1cf31237d2742",
      "tree": "9fe8e79d29c29698c61ebc3c1d4dc22bddf4243b",
      "parents": [
        "052d41c01b3a2e3371d66de569717353af489d63",
        "d1c61e6d79ea0d4d53dc18bcd2db30ef2d99cfa7"
      ],
      "author": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Sat Nov 11 19:40:05 2017 +0900"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Sat Nov 11 19:40:05 2017 +0900"
      },
      "message": "Merge tag \u0027mlx5-fixes-2017-11-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux\n\nSaeed Mahameed says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nMellanox, mlx5 fixes 2017-11-08\n\nThe following series includes some fixes for mlx5 core and etherent\ndriver.\n\nSorry for the late submission but as you can see i have some very\ncritical fixes below that i would like them merged into this RC.\n\nPlease pull and let me know if there is any problem.\n\nFor -stable:\n(\u0027net/mlx5e: Set page to null in case dma mapping fails\u0027) kernels \u003e\u003d 4.13\n(\u0027net/mlx5: FPGA, return -EINVAL if size is zero\u0027) kernels \u003e\u003d 4.13\n(\u0027net/mlx5: Cancel health poll before sending panic teardown command\u0027) kernels \u003e\u003d 4.13\n\nV1-\u003eV2:\n\t- Fix Reviewed-by tag of the 2nd patch.\n\t- Drop the FPGA 0 size fix, it needs some more change log info.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "052d41c01b3a2e3371d66de569717353af489d63",
      "tree": "995570b6b32fea4c07ac142f608f40c6b2baa9fa",
      "parents": [
        "2118df93b5e1742931da358c2b8804c46fd64490"
      ],
      "author": {
        "name": "Cong Wang",
        "email": "xiyou.wangcong@gmail.com",
        "time": "Thu Nov 09 16:43:13 2017 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Sat Nov 11 19:35:32 2017 +0900"
      },
      "message": "vlan: fix a use-after-free in vlan_device_event()\n\nAfter refcnt reaches zero, vlan_vid_del() could free\ndev-\u003evlan_info via RCU:\n\n\tRCU_INIT_POINTER(dev-\u003evlan_info, NULL);\n\tcall_rcu(\u0026vlan_info-\u003ercu, vlan_info_rcu_free);\n\nHowever, the pointer \u0027grp\u0027 still points to that memory\nsince it is set before vlan_vid_del():\n\n        vlan_info \u003d rtnl_dereference(dev-\u003evlan_info);\n        if (!vlan_info)\n                goto out;\n        grp \u003d \u0026vlan_info-\u003egrp;\n\nDepends on when that RCU callback is scheduled, we could\ntrigger a use-after-free in vlan_group_for_each_dev()\nright following this vlan_vid_del().\n\nFix it by moving vlan_vid_del() before setting grp. This\nis also symmetric to the vlan_vid_add() we call in\nvlan_device_event().\n\nReported-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nFixes: efc73f4bbc23 (\"net: Fix memory leak - vlan_info struct\")\nCc: Alexander Duyck \u003calexander.duyck@gmail.com\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Girish Moodalbail \u003cgirish.moodalbail@oracle.com\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nReviewed-by: Girish Moodalbail \u003cgirish.moodalbail@oracle.com\u003e\nTested-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "505ee76761062a1872b024140e886b7136a6c1d5",
      "tree": "27153038bc7d58e00683549609303668bbe3d76c",
      "parents": [
        "529b3ca8323e282485b7c880e4cd26eaba15934f"
      ],
      "author": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Sat Nov 11 09:06:57 2017 +0100"
      },
      "committer": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Sat Nov 11 09:08:43 2017 +0100"
      },
      "message": "tooling/headers: Sync the tools/include/uapi/drm/i915_drm.h UAPI header\n\nLast minute upstream update to one of the UAPI headers - sync it with tooling,\nto address this warning:\n\n  Warning: Kernel ABI header at \u0027tools/include/uapi/drm/i915_drm.h\u0027 differs from latest version at \u0027include/uapi/drm/i915_drm.h\u0027\n\nCc: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\nCc: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: linux-kernel@vger.kernel.org\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n"
    },
    {
      "commit": "529b3ca8323e282485b7c880e4cd26eaba15934f",
      "tree": "8575044e2ff66eb976c6629ea3e705893d857ff9",
      "parents": [
        "ca91659962303d4fd5211a5e4e13df5cbb11e744",
        "33974a414ce2324554f75dbd204ff0868f499e32"
      ],
      "author": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Sat Nov 11 09:03:59 2017 +0100"
      },
      "committer": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Sat Nov 11 09:03:59 2017 +0100"
      },
      "message": "Merge branch \u0027perf/urgent\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent\n\nPull perf tooling fixes from Arnaldo Carvalho de Melo.\n\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n"
    },
    {
      "commit": "2118df93b5e1742931da358c2b8804c46fd64490",
      "tree": "164f16f86631b705edea08104baa9dd30bc60ae8",
      "parents": [
        "b0b38a1c6684b10dd0462bef4fef038917115012"
      ],
      "author": {
        "name": "Vivien Didelot",
        "email": "vivien.didelot@savoirfairelinux.com",
        "time": "Wed Nov 08 10:50:10 2017 -0500"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Sat Nov 11 15:45:09 2017 +0900"
      },
      "message": "net: dsa: return after vlan prepare phase\n\nThe current code does not return after successfully preparing the VLAN\naddition on every ports member of a it. Fix this.\n\nFixes: 1ca4aa9cd4cc (\"net: dsa: check VLAN capability of every switch\")\nSigned-off-by: Vivien Didelot \u003cvivien.didelot@savoirfairelinux.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "b0b38a1c6684b10dd0462bef4fef038917115012",
      "tree": "b77bb85ca46fa98ee5a1f1ffa33a6cd2d3f23fb7",
      "parents": [
        "0eb96bf754d7fa6635aa0b0f6650c74b8a6b1cc9"
      ],
      "author": {
        "name": "Vivien Didelot",
        "email": "vivien.didelot@savoirfairelinux.com",
        "time": "Wed Nov 08 10:49:56 2017 -0500"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Sat Nov 11 15:45:09 2017 +0900"
      },
      "message": "net: dsa: return after mdb prepare phase\n\nThe current code does not return after successfully preparing the MDB\naddition on every ports member of a multicast group. Fix this.\n\nFixes: a1a6b7ea7f2d (\"net: dsa: add cross-chip multicast support\")\nReported-by: Egil Hjelmeland \u003cprivat@egil-hjelmeland.no\u003e\nSigned-off-by: Vivien Didelot \u003cvivien.didelot@savoirfairelinux.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "ca91659962303d4fd5211a5e4e13df5cbb11e744",
      "tree": "8700c2aba2572b9cdef98c20ad63bfc1be3b7f0c",
      "parents": [
        "60cfc98b242cd89f6d9ec69ca40c38e8d1d80ed8",
        "1e37f2f84680fa7f8394fd444b6928e334495ccc"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Nov 10 14:18:24 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Nov 10 14:18:24 2017 -0800"
      },
      "message": "Merge tag \u0027ceph-for-4.14-rc9\u0027 of git://github.com/ceph/ceph-client\n\nPull ceph gix from Ilya Dryomov:\n \"Memory allocation flags fix, marked for stable\"\n\n* tag \u0027ceph-for-4.14-rc9\u0027 of git://github.com/ceph/ceph-client:\n  rbd: use GFP_NOIO for parent stat and data requests\n"
    },
    {
      "commit": "60cfc98b242cd89f6d9ec69ca40c38e8d1d80ed8",
      "tree": "ba67c7bd1f06d58746b94bb729924a148e953a99",
      "parents": [
        "5cf2360ba6eceee13ac2e72f4c21fdd31613f59b",
        "26dd633e437dca218547ccbeacc71fe8a620b6f6"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Nov 10 14:14:23 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Nov 10 14:14:23 2017 -0800"
      },
      "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input layer updates from Dmitry Torokhov:\n\n - a new ACPI ID for Elan touchpad found in yet another Ideapad model\n\n - Synaptics RMI4 will allow binding to controllers reporting SMB\n   version 3 (note that we are not adding any new ACPI IDs to the\n   Synaptics PS/2 drover so unless user explicitly enables intertouch\n   support there is no user-visible change)\n\n - a fixup to TSC 2004/5 touchscreen driver to mark input devices as\n   \"direct\" to help userspace identify the type of device they are\n   dealing with\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n  Input: synaptics-rmi4 - RMI4 can also use SMBUS version 3\n  Input: tsc200x-core - set INPUT_PROP_DIRECT\n  Input: elan_i2c - add ELAN060C to the ACPI table\n"
    },
    {
      "commit": "5cf2360ba6eceee13ac2e72f4c21fdd31613f59b",
      "tree": "751abdc68ebb4fa9a26201df26a20fb040fa60d1",
      "parents": [
        "a579e949378eab7b992d2bf942b655ca407f2948",
        "d850a255d5b961fbe085f06ddd116910378b78f1"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Nov 10 12:24:42 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Nov 10 12:24:42 2017 -0800"
      },
      "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull KVM fix from Radim Krčmář:\n \"Fix PPC HV host crash that can occur as a result of resizing the guest\n  hashed page table\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm:\n  KVM: PPC: Book3S HV: Fix exclusion between HPT resizing and other HPT updates\n"
    },
    {
      "commit": "a579e949378eab7b992d2bf942b655ca407f2948",
      "tree": "018f96514490a7ce47f67c6c296f94e3345040c5",
      "parents": [
        "085c17ff6bacccb45201098e71f95675e08f0e17",
        "b084116f8587b222a2c5ef6dcd846f40f24b9420"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Nov 10 12:21:15 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Nov 10 12:21:15 2017 -0800"
      },
      "message": "Merge tag \u0027mips_fixes_4.14_2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/mips\n\nPull MIPS fixes from James Hogan:\n \"A final few MIPS fixes for 4.14:\n\n   - fix BMIPS NULL pointer dereference (4.7)\n\n   - fix AR7 early GPIO init allocation failure (3.19)\n\n   - fix dead serial output on certain AR7 platforms (2.6.35)\"\n\n* tag \u0027mips_fixes_4.14_2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/mips:\n  MIPS: AR7: Ensure that serial ports are properly set up\n  MIPS: AR7: Defer registration of GPIO\n  MIPS: BMIPS: Fix missing cbr address\n"
    },
    {
      "commit": "085c17ff6bacccb45201098e71f95675e08f0e17",
      "tree": "3ab342be87d34f96dbd8390ef0f4ca35950854a5",
      "parents": [
        "ea0ee33988778fb73e4f45e7c73fb735787e2f32"
      ],
      "author": {
        "name": "Maciej W. Rozycki",
        "email": "macro@mips.com",
        "time": "Fri Nov 10 20:05:24 2017 +0000"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Nov 10 12:16:15 2017 -0800"
      },
      "message": ".mailmap: Add Maciej W. Rozycki\u0027s Imagination e-mail address\n\nFollowing my recent transition from Imagination Technologies to the\u003d20\nreincarnated MIPS company add a .mailmap mapping for my work address,\nso that `scripts/get_maintainer.pl\u0027 gets it right for past commits.\n\nSigned-off-by: Maciej W. Rozycki \u003cmacro@mips.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "ea0ee33988778fb73e4f45e7c73fb735787e2f32",
      "tree": "45ebd3e4347a879157dab48b2bc88f9bf2cf9286",
      "parents": [
        "3e81277a6edd6b568c3a091a372dfe6368697b21"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Nov 10 11:19:11 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Nov 10 11:19:11 2017 -0800"
      },
      "message": "Revert \"x86: CPU: Fix up \"cpu MHz\" in /proc/cpuinfo\"\n\nThis reverts commit 941f5f0f6ef5338814145cf2b813cf1f98873e2f.\n\nSadly, it turns out that we really can\u0027t just do the cross-CPU IPI to\nall CPU\u0027s to get their proper frequencies, because it\u0027s much too\nexpensive on systems with lots of cores.\n\nSo we\u0027ll have to revert this for now, and revisit it using a smarter\nmodel (probably doing one system-wide IPI at open time, and doing all\nthe frequency calculations in parallel).\n\nReported-by: WANG Chao \u003cchao.wang@ucloud.cn\u003e\nReported-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Rafael J Wysocki \u003crafael.j.wysocki@intel.com\u003e\nCc: stable@kernel.org\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "3e81277a6edd6b568c3a091a372dfe6368697b21",
      "tree": "c3a4a2dc72a6b499d8c0f2a962d695bf300960c6",
      "parents": [
        "1c9dbd4615fd751e5e0b99807a3c7c8612e28e20",
        "60ccb31bd680469ee0db92b0b6594d79bd13ff87"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Nov 10 09:59:41 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Nov 10 09:59:41 2017 -0800"
      },
      "message": "Merge tag \u0027drm-fixes-for-v4.14-rc9\u0027 of git://people.freedesktop.org/~airlied/linux\n\nPull drm fixes from Dave Airlie:\n \"Last few patches to wrap up.\n\n  Two i915 fixes that are on their way to stable, one vmware black\n  screen bug, and one const patch that I was going to drop, but it was\n  clearly a pretty safe one liner\"\n\n* tag \u0027drm-fixes-for-v4.14-rc9\u0027 of git://people.freedesktop.org/~airlied/linux:\n  drm/i915: Deconstruct struct sgt_dma initialiser\n  drm/i915: Reject unknown syncobj flags\n  drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue\n  drm/vmwgfx: constify vmw_fence_ops\n"
    },
    {
      "commit": "4f7116757b4bd99e4ef2636c7d957a6d63035d11",
      "tree": "646683ff5425c5687d2c747e454a8567f972b4f6",
      "parents": [
        "4cbdd0ee67191481ec57ceed94febdfef95c9f25"
      ],
      "author": {
        "name": "Marek Vasut",
        "email": "marex@denx.de",
        "time": "Fri Nov 10 11:22:39 2017 +0100"
      },
      "committer": {
        "name": "Marc Kleine-Budde",
        "email": "mkl@pengutronix.de",
        "time": "Fri Nov 10 11:35:09 2017 +0100"
      },
      "message": "can: ifi: Fix transmitter delay calculation\n\nThe CANFD transmitter delay calculation formula was updated in the\nlatest software drop from IFI and improves the behavior of the IFI\nCANFD core during bitrate switching. Use the new formula to improve\nstability of the CANFD operation.\n\nSigned-off-by: Marek Vasut \u003cmarex@denx.de\u003e\nCc: Markus Marb \u003cmarkus@marb.org\u003e\nCc: linux-stable \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n"
    },
    {
      "commit": "0eb96bf754d7fa6635aa0b0f6650c74b8a6b1cc9",
      "tree": "a3b7e8feaeef3a348435ad4827e66de62d776cd3",
      "parents": [
        "7ec318feeed10a64c0359ec4d10889cb4defa39a"
      ],
      "author": {
        "name": "Yuchung Cheng",
        "email": "ycheng@google.com",
        "time": "Tue Nov 07 15:33:43 2017 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Fri Nov 10 18:09:19 2017 +0900"
      },
      "message": "tcp: fix tcp_fastretrans_alert warning\n\nThis patch fixes the cause of an WARNING indicatng TCP has pending\nretransmission in Open state in tcp_fastretrans_alert().\n\nThe root cause is a bad interaction between path mtu probing,\nif enabled, and the RACK loss detection. Upong receiving a SACK\nabove the sequence of the MTU probing packet, RACK could mark the\nprobe packet lost in tcp_fastretrans_alert(), prior to calling\ntcp_simple_retransmit().\n\ntcp_simple_retransmit() only enters Loss state if it newly marks\nthe probe packet lost. If the probe packet is already identified as\nlost by RACK, the sender remains in Open state with some packets\nmarked lost and retransmitted. Then the next SACK would trigger\nthe warning. The likely scenario is that the probe packet was\nlost due to its size or network congestion. The actual impact of\nthis warning is small by potentially entering fast recovery an\nACK later.\n\nThe simple fix is always entering recovery (Loss) state if some\npacket is marked lost during path MTU probing.\n\nFixes: a0370b3f3f2c (\"tcp: enable RACK loss detection to trigger recovery\")\nReported-by: Oleksandr Natalenko \u003coleksandr@natalenko.name\u003e\nReported-by: Alexei Starovoitov \u003calexei.starovoitov@gmail.com\u003e\nReported-by: Roman Gushchin \u003cguro@fb.com\u003e\nSigned-off-by: Yuchung Cheng \u003cycheng@google.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Neal Cardwell \u003cncardwell@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "7ec318feeed10a64c0359ec4d10889cb4defa39a",
      "tree": "cd59086e204ef2d48634ef67d301310bdc374576",
      "parents": [
        "1cb483a5cc84b497afb51a6c5dfb5a38a0b67086"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Tue Nov 07 15:15:04 2017 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Fri Nov 10 18:07:15 2017 +0900"
      },
      "message": "tcp: gso: avoid refcount_t warning from tcp_gso_segment()\n\nWhen a GSO skb of truesize O is segmented into 2 new skbs of truesize N1\nand N2, we want to transfer socket ownership to the new fresh skbs.\n\nIn order to avoid expensive atomic operations on a cache line subject to\ncache bouncing, we replace the sequence :\n\nrefcount_add(N1, \u0026sk-\u003esk_wmem_alloc);\nrefcount_add(N2, \u0026sk-\u003esk_wmem_alloc); // repeated by number of segments\n\nrefcount_sub(O, \u0026sk-\u003esk_wmem_alloc);\n\nby a single\n\nrefcount_add(sum_of(N) - O, \u0026sk-\u003esk_wmem_alloc);\n\nProblem is :\n\nIn some pathological cases, sum(N) - O might be a negative number, and\nsyzkaller bot was apparently able to trigger this trace [1]\n\natomic_t was ok with this construct, but we need to take care of the\nnegative delta with refcount_t\n\n[1]\nrefcount_t: saturated; leaking memory.\n------------[ cut here ]------------\nWARNING: CPU: 0 PID: 8404 at lib/refcount.c:77 refcount_add_not_zero+0x198/0x200 lib/refcount.c:77\nKernel panic - not syncing: panic_on_warn set ...\n\nCPU: 0 PID: 8404 Comm: syz-executor2 Not tainted 4.14.0-rc5-mm1+ #20\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:16 [inline]\n dump_stack+0x194/0x257 lib/dump_stack.c:52\n panic+0x1e4/0x41c kernel/panic.c:183\n __warn+0x1c4/0x1e0 kernel/panic.c:546\n report_bug+0x211/0x2d0 lib/bug.c:183\n fixup_bug+0x40/0x90 arch/x86/kernel/traps.c:177\n do_trap_no_signal arch/x86/kernel/traps.c:211 [inline]\n do_trap+0x260/0x390 arch/x86/kernel/traps.c:260\n do_error_trap+0x120/0x390 arch/x86/kernel/traps.c:297\n do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:310\n invalid_op+0x18/0x20 arch/x86/entry/entry_64.S:905\nRIP: 0010:refcount_add_not_zero+0x198/0x200 lib/refcount.c:77\nRSP: 0018:ffff8801c606e3a0 EFLAGS: 00010282\nRAX: 0000000000000026 RBX: 0000000000001401 RCX: 0000000000000000\nRDX: 0000000000000026 RSI: ffffc900036fc000 RDI: ffffed0038c0dc68\nRBP: ffff8801c606e430 R08: 0000000000000001 R09: 0000000000000000\nR10: ffff8801d97f5eba R11: 0000000000000000 R12: ffff8801d5acf73c\nR13: 1ffff10038c0dc75 R14: 00000000ffffffff R15: 00000000fffff72f\n refcount_add+0x1b/0x60 lib/refcount.c:101\n tcp_gso_segment+0x10d0/0x16b0 net/ipv4/tcp_offload.c:155\n tcp4_gso_segment+0xd4/0x310 net/ipv4/tcp_offload.c:51\n inet_gso_segment+0x60c/0x11c0 net/ipv4/af_inet.c:1271\n skb_mac_gso_segment+0x33f/0x660 net/core/dev.c:2749\n __skb_gso_segment+0x35f/0x7f0 net/core/dev.c:2821\n skb_gso_segment include/linux/netdevice.h:3971 [inline]\n validate_xmit_skb+0x4ba/0xb20 net/core/dev.c:3074\n __dev_queue_xmit+0xe49/0x2070 net/core/dev.c:3497\n dev_queue_xmit+0x17/0x20 net/core/dev.c:3538\n neigh_hh_output include/net/neighbour.h:471 [inline]\n neigh_output include/net/neighbour.h:479 [inline]\n ip_finish_output2+0xece/0x1460 net/ipv4/ip_output.c:229\n ip_finish_output+0x85e/0xd10 net/ipv4/ip_output.c:317\n NF_HOOK_COND include/linux/netfilter.h:238 [inline]\n ip_output+0x1cc/0x860 net/ipv4/ip_output.c:405\n dst_output include/net/dst.h:459 [inline]\n ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124\n ip_queue_xmit+0x8c6/0x18e0 net/ipv4/ip_output.c:504\n tcp_transmit_skb+0x1ab7/0x3840 net/ipv4/tcp_output.c:1137\n tcp_write_xmit+0x663/0x4de0 net/ipv4/tcp_output.c:2341\n __tcp_push_pending_frames+0xa0/0x250 net/ipv4/tcp_output.c:2513\n tcp_push_pending_frames include/net/tcp.h:1722 [inline]\n tcp_data_snd_check net/ipv4/tcp_input.c:5050 [inline]\n tcp_rcv_established+0x8c7/0x18a0 net/ipv4/tcp_input.c:5497\n tcp_v4_do_rcv+0x2ab/0x7d0 net/ipv4/tcp_ipv4.c:1460\n sk_backlog_rcv include/net/sock.h:909 [inline]\n __release_sock+0x124/0x360 net/core/sock.c:2264\n release_sock+0xa4/0x2a0 net/core/sock.c:2776\n tcp_sendmsg+0x3a/0x50 net/ipv4/tcp.c:1462\n inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:763\n sock_sendmsg_nosec net/socket.c:632 [inline]\n sock_sendmsg+0xca/0x110 net/socket.c:642\n ___sys_sendmsg+0x31c/0x890 net/socket.c:2048\n __sys_sendmmsg+0x1e6/0x5f0 net/socket.c:2138\n\nFixes: 14afee4b6092 (\"net: convert sock.sk_wmem_alloc from atomic_t to refcount_t\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReported-by: syzbot \u003csyzkaller@googlegroups.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "4cbdd0ee67191481ec57ceed94febdfef95c9f25",
      "tree": "312087ea514006820301cb9ed52f6ebacc08b8a7",
      "parents": [
        "4dcf924c2eda0c47a5c53b7703e3dc65ddaa8920"
      ],
      "author": {
        "name": "Stephane Grosjean",
        "email": "s.grosjean@peak-system.com",
        "time": "Thu Nov 09 14:42:14 2017 +0100"
      },
      "committer": {
        "name": "Marc Kleine-Budde",
        "email": "mkl@pengutronix.de",
        "time": "Fri Nov 10 09:15:28 2017 +0100"
      },
      "message": "can: peak: Add support for new PCIe/M2 CAN FD interfaces\n\nThis adds support for the following PEAK-System CAN FD interfaces:\n\nPCAN-cPCIe FD         CAN FD Interface for cPCI Serial (2 or 4 channels)\nPCAN-PCIe/104-Express CAN FD Interface for PCIe/104-Express (1, 2 or 4 ch.)\nPCAN-miniPCIe FD      CAN FD Interface for PCIe Mini (1, 2 or 4 channels)\nPCAN-PCIe FD OEM      CAN FD Interface for PCIe OEM version (1, 2 or 4 ch.)\nPCAN-M.2              CAN FD Interface for M.2 (1 or 2 channels)\n\nLike the PCAN-PCIe FD interface, all of these boards run the same IP Core\nthat is able to handle CAN FD (see also http://www.peak-system.com).\n\nSigned-off-by: Stephane Grosjean \u003cs.grosjean@peak-system.com\u003e\nCc: linux-stable \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n"
    },
    {
      "commit": "4dcf924c2eda0c47a5c53b7703e3dc65ddaa8920",
      "tree": "e742435ca056392373c7a028cef2a4c65eff3c80",
      "parents": [
        "fb5f0b3ef69b95e665e4bbe8a3de7201f09f1071"
      ],
      "author": {
        "name": "Gerhard Bertelsmann",
        "email": "info@gerhard-bertelsmann.de",
        "time": "Mon Nov 06 18:16:56 2017 +0100"
      },
      "committer": {
        "name": "Marc Kleine-Budde",
        "email": "mkl@pengutronix.de",
        "time": "Fri Nov 10 09:15:28 2017 +0100"
      },
      "message": "can: sun4i: handle overrun in RX FIFO\n\nSUN4Is CAN IP has a 64 byte deep FIFO buffer. If the buffer is not\ndrained fast enough (overrun) it\u0027s getting mangled. Already received\nframes are dropped - the data can\u0027t be restored.\n\nSigned-off-by: Gerhard Bertelsmann \u003cinfo@gerhard-bertelsmann.de\u003e\nCc: linux-stable \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n"
    },
    {
      "commit": "fb5f0b3ef69b95e665e4bbe8a3de7201f09f1071",
      "tree": "1ff689df4f9cf44d86d309fe49df1f16c5a4f4d1",
      "parents": [
        "1cb483a5cc84b497afb51a6c5dfb5a38a0b67086"
      ],
      "author": {
        "name": "Richard Schütz",
        "email": "rschuetz@uni-koblenz.de",
        "time": "Sun Oct 29 13:03:22 2017 +0100"
      },
      "committer": {
        "name": "Marc Kleine-Budde",
        "email": "mkl@pengutronix.de",
        "time": "Fri Nov 10 09:15:28 2017 +0100"
      },
      "message": "can: c_can: don\u0027t indicate triple sampling support for D_CAN\n\nThe D_CAN controller doesn\u0027t provide a triple sampling mode, so don\u0027t set\nthe CAN_CTRLMODE_3_SAMPLES flag in ctrlmode_supported. Currently enabling\ntriple sampling is a no-op.\n\nSigned-off-by: Richard Schütz \u003crschuetz@uni-koblenz.de\u003e\nCc: linux-stable \u003cstable@vger.kernel.org\u003e # \u003e\u003d v3.6\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n"
    },
    {
      "commit": "b8347c2196492f4e1cccde3d92fda1cc2cc7de7e",
      "tree": "5de43435f937ffaa8ea5525517c5aef848faf2bb",
      "parents": [
        "be739f4b5ddece74ef25e2304b17a7fd24575e9b"
      ],
      "author": {
        "name": "Alexander Shishkin",
        "email": "alexander.shishkin@linux.intel.com",
        "time": "Mon Jul 24 13:04:28 2017 +0300"
      },
      "committer": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Fri Nov 10 08:04:19 2017 +0100"
      },
      "message": "x86/debug: Handle warnings before the notifier chain, to fix KGDB crash\n\nCommit:\n\n  9a93848fe787 (\"x86/debug: Implement __WARN() using UD0\")\n\nturned warnings into UD0, but the fixup code only runs after the\nnotify_die() chain. This is a problem, in particular, with kgdb,\nwhich kicks in as if it was a BUG().\n\nFix this by running the fixup code before the notifier chain in\nthe invalid op handler path.\n\nSigned-off-by: Alexander Shishkin \u003calexander.shishkin@linux.intel.com\u003e\nTested-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\nAcked-by: Daniel Thompson \u003cdaniel.thompson@linaro.org\u003e\nAcked-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Jason Wessel \u003cjason.wessel@windriver.com\u003e\nCc: Arjan van de Ven \u003carjan@linux.intel.com\u003e\nCc: Borislav Petkov \u003cbp@alien8.de\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Richard Weinberger \u003crichard.weinberger@gmail.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v4.12+\nLink: http://lkml.kernel.org/r/20170724100428.19173-1-alexander.shishkin@linux.intel.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n"
    },
    {
      "commit": "d1c61e6d79ea0d4d53dc18bcd2db30ef2d99cfa7",
      "tree": "1b0014aefd9e02b79331307f34f59fc541921724",
      "parents": [
        "2e50b2619538ea0224c037f6fa746023089e0654"
      ],
      "author": {
        "name": "Eugenia Emantayev",
        "email": "eugenia@mellanox.com",
        "time": "Thu Jan 12 17:11:45 2017 +0200"
      },
      "committer": {
        "name": "Saeed Mahameed",
        "email": "saeedm@mellanox.com",
        "time": "Fri Nov 10 15:39:21 2017 +0900"
      },
      "message": "net/mlx5e: Increase Striding RQ minimum size limit to 4 multi-packet WQEs\n\nThis is to prevent the case of working with a single MPWQE\n(1 WQE is always reserved as RQ is linked-list).\nWhen the WQE is fully consumed, HW should still have available buffer\nin order not to drop packets.\n\nFixes: 461017cb006a (\"net/mlx5e: Support RX multi-packet WQE (Striding RQ)\")\nSigned-off-by: Eugenia Emantayev \u003ceugenia@mellanox.com\u003e\nReviewed-by: Tariq Toukan \u003ctariqt@mellanox.com\u003e\nCc: kernel-team@fb.com\nSigned-off-by: Saeed Mahameed \u003csaeedm@mellanox.com\u003e\n"
    },
    {
      "commit": "2e50b2619538ea0224c037f6fa746023089e0654",
      "tree": "17bd1896764b82285889c2c0efca9df0dc24efad",
      "parents": [
        "2a8d6065e7b90ad9d5540650944d802b0f86bdfe"
      ],
      "author": {
        "name": "Inbar Karmy",
        "email": "inbark@mellanox.com",
        "time": "Sun Oct 15 17:30:59 2017 +0300"
      },
      "committer": {
        "name": "Saeed Mahameed",
        "email": "saeedm@mellanox.com",
        "time": "Fri Nov 10 15:39:21 2017 +0900"
      },
      "message": "net/mlx5e: Set page to null in case dma mapping fails\n\nCurrently, when dma mapping fails, put_page is called,\nbut the page is not set to null. Later, in the page_reuse treatment in\nmlx5e_free_rx_descs(), mlx5e_page_release() is called for the second time,\nimproperly doing dma_unmap (for a non-mapped address) and an extra put_page.\nPrevent this by nullifying the page pointer when dma_map fails.\n\nFixes: accd58833237 (\"net/mlx5e: Introduce RX Page-Reuse\")\nSigned-off-by: Inbar Karmy \u003cinbark@mellanox.com\u003e\nReviewed-by: Tariq Toukan \u003ctariqt@mellanox.com\u003e\nCc: kernel-team@fb.com\nSigned-off-by: Saeed Mahameed \u003csaeedm@mellanox.com\u003e\n"
    },
    {
      "commit": "2a8d6065e7b90ad9d5540650944d802b0f86bdfe",
      "tree": "1986cbf86d179ac840942b2baad28333f76b463c",
      "parents": [
        "d2aa060d40fa060e963f9a356d43481e43ba3dac"
      ],
      "author": {
        "name": "Saeed Mahameed",
        "email": "saeedm@mellanox.com",
        "time": "Tue Oct 31 15:34:00 2017 -0700"
      },
      "committer": {
        "name": "Saeed Mahameed",
        "email": "saeedm@mellanox.com",
        "time": "Fri Nov 10 15:39:20 2017 +0900"
      },
      "message": "net/mlx5e: Fix napi poll with zero budget\n\nnapi-\u003epoll can be called with budget 0, e.g. in netpoll scenarios\nwhere the caller only wants to poll TX rings\n(poll_one_napi@net/core/netpoll.c).\n\nThe below commit changed RX polling from \"while\" loop to \"do {} while\",\nwhich caused to ignore the initial budget and handle at least one RX\npacket.\n\nThis fixes the following warning:\n[ 2852.049194] mlx5e_napi_poll+0x0/0x260 [mlx5_core] exceeded budget in poll\n[ 2852.049195] ------------[ cut here ]------------\n[ 2852.049195] WARNING: CPU: 0 PID: 25691 at net/core/netpoll.c:171 netpoll_poll_dev+0x18a/0x1a0\n\nFixes: 4b7dfc992514 (\"net/mlx5e: Early-return on empty completion queues\")\nSigned-off-by: Saeed Mahameed \u003csaeedm@mellanox.com\u003e\nReviewed-by: Tariq Toukan \u003ctariqt@mellanox.com\u003e\nReported-by: Martin KaFai Lau \u003ckafai@fb.com\u003e\nTested-by: Martin KaFai Lau \u003ckafai@fb.com\u003e\nCc: kernel-team@fb.com\nSigned-off-by: Saeed Mahameed \u003csaeedm@mellanox.com\u003e\n"
    },
    {
      "commit": "d2aa060d40fa060e963f9a356d43481e43ba3dac",
      "tree": "0c4f1cf9eeb0801454323350aa3300b726fad418",
      "parents": [
        "b8cce68bf1f1b773ac1a535707f968512b3c1e5f"
      ],
      "author": {
        "name": "Huy Nguyen",
        "email": "huyn@mellanox.com",
        "time": "Tue Sep 26 15:11:56 2017 -0500"
      },
      "committer": {
        "name": "Saeed Mahameed",
        "email": "saeedm@mellanox.com",
        "time": "Fri Nov 10 15:39:20 2017 +0900"
      },
      "message": "net/mlx5: Cancel health poll before sending panic teardown command\n\nAfter the panic teardown firmware command, health_care detects the error\nin PCI bus and calls the mlx5_pci_err_detected. This health_care flow is\nno longer needed because the panic teardown firmware command will bring\ndown the PCI bus communication with the HCA.\n\nThe solution is to cancel the health care timer and its pending\nworkqueue request before sending panic teardown firmware command.\n\nKernel trace:\nmlx5_core 0033:01:00.0: Shutdown was called\nmlx5_core 0033:01:00.0: health_care:154:(pid 9304): handling bad device here\nmlx5_core 0033:01:00.0: mlx5_handle_bad_state:114:(pid 9304): NIC state 1\nmlx5_core 0033:01:00.0: mlx5_pci_err_detected was called\nmlx5_core 0033:01:00.0: mlx5_enter_error_state:96:(pid 9304): start\nmlx5_3:mlx5_ib_event:3061:(pid 9304): warning: event on port 0\nmlx5_core 0033:01:00.0: mlx5_enter_error_state:104:(pid 9304): end\nUnable to handle kernel paging request for data at address 0x0000003f\nFaulting instruction address: 0xc0080000434b8c80\n\nFixes: 8812c24d28f4 (\u0027net/mlx5: Add fast unload support in shutdown flow\u0027)\nSigned-off-by: Huy Nguyen \u003chuyn@mellanox.com\u003e\nReviewed-by: Moshe Shemesh \u003cmoshe@mellanox.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@mellanox.com\u003e\n"
    },
    {
      "commit": "b8cce68bf1f1b773ac1a535707f968512b3c1e5f",
      "tree": "3cae0980b4aec28ae12861b3ab83921e31c8bc7c",
      "parents": [
        "1cb483a5cc84b497afb51a6c5dfb5a38a0b67086"
      ],
      "author": {
        "name": "Huy Nguyen",
        "email": "huyn@mellanox.com",
        "time": "Sun Oct 29 22:40:56 2017 -0500"
      },
      "committer": {
        "name": "Saeed Mahameed",
        "email": "saeedm@mellanox.com",
        "time": "Fri Nov 10 15:39:20 2017 +0900"
      },
      "message": "net/mlx5: Loop over temp list to release delay events\n\nlist_splice_init initializing waiting_events_list after splicing it to\ntemp list, therefore we should loop over temp list to fire the events.\n\nFixes: 4ca637a20a52 (\"net/mlx5: Delay events till mlx5 interface\u0027s add complete for pci resume\")\nSigned-off-by: Huy Nguyen \u003chuyn@mellanox.com\u003e\nSigned-off-by: Feras Daoud \u003cferasda@mellanox.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@mellanox.com\u003e\n"
    },
    {
      "commit": "1cb483a5cc84b497afb51a6c5dfb5a38a0b67086",
      "tree": "fb176285a81a6afd4fdcebdb29ee5348c4886eca",
      "parents": [
        "3fefc31843cfe2b5f072efe11ed9ccaf6a7a5092"
      ],
      "author": {
        "name": "Håkon Bugge",
        "email": "Haakon.Bugge@oracle.com",
        "time": "Tue Nov 07 16:33:34 2017 +0100"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Fri Nov 10 14:54:47 2017 +0900"
      },
      "message": "rds: ib: Fix NULL pointer dereference in debug code\n\nrds_ib_recv_refill() is a function that refills an IB receive\nqueue. It can be called from both the CQE handler (tasklet) and a\nworker thread.\n\nJust after the call to ib_post_recv(), a debug message is printed with\nrdsdebug():\n\n            ret \u003d ib_post_recv(ic-\u003ei_cm_id-\u003eqp, \u0026recv-\u003er_wr, \u0026failed_wr);\n            rdsdebug(\"recv %p ibinc %p page %p addr %lu ret %d\\n\", recv,\n                     recv-\u003er_ibinc, sg_page(\u0026recv-\u003er_frag-\u003ef_sg),\n                     (long) ib_sg_dma_address(\n                            ic-\u003ei_cm_id-\u003edevice,\n                            \u0026recv-\u003er_frag-\u003ef_sg),\n                    ret);\n\nNow consider an invocation of rds_ib_recv_refill() from the worker\nthread, which is preemptible. Further, assume that the worker thread\nis preempted between the ib_post_recv() and rdsdebug() statements.\n\nThen, if the preemption is due to a receive CQE event, the\nrds_ib_recv_cqe_handler() will be invoked. This function processes\nreceive completions, including freeing up data structures, such as the\nrecv-\u003er_frag.\n\nIn this scenario, rds_ib_recv_cqe_handler() will process the receive\nWR posted above. That implies, that the recv-\u003er_frag has been freed\nbefore the above rdsdebug() statement has been executed. When it is\nlater executed, we will have a NULL pointer dereference:\n\n[ 4088.068008] BUG: unable to handle kernel NULL pointer dereference at 0000000000000020\n[ 4088.076754] IP: rds_ib_recv_refill+0x87/0x620 [rds_rdma]\n[ 4088.082686] PGD 0 P4D 0\n[ 4088.085515] Oops: 0000 [#1] SMP\n[ 4088.089015] Modules linked in: rds_rdma(OE) rds(OE) rpcsec_gss_krb5(E) nfsv4(E) dns_resolver(E) nfs(E) fscache(E) mlx4_ib(E) ib_ipoib(E) rdma_ucm(E) ib_ucm(E) ib_uverbs(E) ib_umad(E) rdma_cm(E) ib_cm(E) iw_cm(E) ib_core(E) binfmt_misc(E) sb_edac(E) intel_powerclamp(E) coretemp(E) kvm_intel(E) kvm(E) irqbypass(E) crct10dif_pclmul(E) crc32_pclmul(E) ghash_clmulni_intel(E) pcbc(E) aesni_intel(E) crypto_simd(E) iTCO_wdt(E) glue_helper(E) iTCO_vendor_support(E) sg(E) cryptd(E) pcspkr(E) ipmi_si(E) ipmi_devintf(E) ipmi_msghandler(E) shpchp(E) ioatdma(E) i2c_i801(E) wmi(E) lpc_ich(E) mei_me(E) mei(E) mfd_core(E) nfsd(E) auth_rpcgss(E) nfs_acl(E) lockd(E) grace(E) sunrpc(E) ip_tables(E) ext4(E) mbcache(E) jbd2(E) fscrypto(E) mgag200(E) i2c_algo_bit(E) drm_kms_helper(E) syscopyarea(E) sysfillrect(E) sysimgblt(E)\n[ 4088.168486]  fb_sys_fops(E) ahci(E) ixgbe(E) libahci(E) ttm(E) mdio(E) ptp(E) pps_core(E) drm(E) sd_mod(E) libata(E) crc32c_intel(E) mlx4_core(E) i2c_core(E) dca(E) megaraid_sas(E) dm_mirror(E) dm_region_hash(E) dm_log(E) dm_mod(E) [last unloaded: rds]\n[ 4088.193442] CPU: 20 PID: 1244 Comm: kworker/20:2 Tainted: G           OE   4.14.0-rc7.master.20171105.ol7.x86_64 #1\n[ 4088.205097] Hardware name: Oracle Corporation ORACLE SERVER X5-2L/ASM,MOBO TRAY,2U, BIOS 31110000 03/03/2017\n[ 4088.216074] Workqueue: ib_cm cm_work_handler [ib_cm]\n[ 4088.221614] task: ffff885fa11d0000 task.stack: ffffc9000e598000\n[ 4088.228224] RIP: 0010:rds_ib_recv_refill+0x87/0x620 [rds_rdma]\n[ 4088.234736] RSP: 0018:ffffc9000e59bb68 EFLAGS: 00010286\n[ 4088.240568] RAX: 0000000000000000 RBX: ffffc9002115d050 RCX: ffffc9002115d050\n[ 4088.248535] RDX: ffffffffa0521380 RSI: ffffffffa0522158 RDI: ffffffffa0525580\n[ 4088.256498] RBP: ffffc9000e59bbf8 R08: 0000000000000005 R09: 0000000000000000\n[ 4088.264465] R10: 0000000000000339 R11: 0000000000000001 R12: 0000000000000000\n[ 4088.272433] R13: ffff885f8c9d8000 R14: ffffffff81a0a060 R15: ffff884676268000\n[ 4088.280397] FS:  0000000000000000(0000) GS:ffff885fbec80000(0000) knlGS:0000000000000000\n[ 4088.289434] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 4088.295846] CR2: 0000000000000020 CR3: 0000000001e09005 CR4: 00000000001606e0\n[ 4088.303816] Call Trace:\n[ 4088.306557]  rds_ib_cm_connect_complete+0xe0/0x220 [rds_rdma]\n[ 4088.312982]  ? __dynamic_pr_debug+0x8c/0xb0\n[ 4088.317664]  ? __queue_work+0x142/0x3c0\n[ 4088.321944]  rds_rdma_cm_event_handler+0x19e/0x250 [rds_rdma]\n[ 4088.328370]  cma_ib_handler+0xcd/0x280 [rdma_cm]\n[ 4088.333522]  cm_process_work+0x25/0x120 [ib_cm]\n[ 4088.338580]  cm_work_handler+0xd6b/0x17aa [ib_cm]\n[ 4088.343832]  process_one_work+0x149/0x360\n[ 4088.348307]  worker_thread+0x4d/0x3e0\n[ 4088.352397]  kthread+0x109/0x140\n[ 4088.355996]  ? rescuer_thread+0x380/0x380\n[ 4088.360467]  ? kthread_park+0x60/0x60\n[ 4088.364563]  ret_from_fork+0x25/0x30\n[ 4088.368548] Code: 48 89 45 90 48 89 45 98 eb 4d 0f 1f 44 00 00 48 8b 43 08 48 89 d9 48 c7 c2 80 13 52 a0 48 c7 c6 58 21 52 a0 48 c7 c7 80 55 52 a0 \u003c4c\u003e 8b 48 20 44 89 64 24 08 48 8b 40 30 49 83 e1 fc 48 89 04 24\n[ 4088.389612] RIP: rds_ib_recv_refill+0x87/0x620 [rds_rdma] RSP: ffffc9000e59bb68\n[ 4088.397772] CR2: 0000000000000020\n[ 4088.401505] ---[ end trace fe922e6ccf004431 ]---\n\nThis bug was provoked by compiling rds out-of-tree with\nEXTRA_CFLAGS\u003d\"-DRDS_DEBUG -DDEBUG\" and inserting an artificial delay\nbetween the rdsdebug() and ib_ib_port_recv() statements:\n\n   \t       /* XXX when can this fail? */\n\t       ret \u003d ib_post_recv(ic-\u003ei_cm_id-\u003eqp, \u0026recv-\u003er_wr, \u0026failed_wr);\n+\t\tif (can_wait)\n+\t\t\tusleep_range(1000, 5000);\n\t       rdsdebug(\"recv %p ibinc %p page %p addr %lu ret %d\\n\", recv,\n\t\t\trecv-\u003er_ibinc, sg_page(\u0026recv-\u003er_frag-\u003ef_sg),\n\t\t\t(long) ib_sg_dma_address(\n\nThe fix is simply to move the rdsdebug() statement up before the\nib_post_recv() and remove the printing of ret, which is taken care of\nanyway by the non-debug code.\n\nSigned-off-by: Håkon Bugge \u003chaakon.bugge@oracle.com\u003e\nReviewed-by: Knut Omang \u003cknut.omang@oracle.com\u003e\nReviewed-by: Wei Lin Guay \u003cwei.lin.guay@oracle.com\u003e\nAcked-by: Santosh Shilimkar \u003csantosh.shilimkar@oracle.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "1c9dbd4615fd751e5e0b99807a3c7c8612e28e20",
      "tree": "3960ffcd424c9b61c485d6cc2966440c67f15485",
      "parents": [
        "5cff3684192773a2c2b1102acd10b99aaa6a3f67",
        "60fdb44a23cbc5d8db224577e14ea667d7c53478"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Nov 09 18:26:51 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Nov 09 18:26:51 2017 -0800"
      },
      "message": "Merge branch \u0027akpm\u0027 (patches from Andrew)\n\nMerge misc fixes from Andrew Morton:\n \"2 fixes\"\n\n* emailed patches from Andrew Morton \u003cakpm@linux-foundation.org\u003e:\n  MAINTAINERS: update TPM driver infrastructure changes\n  sysctl: add register_sysctl() dummy helper\n"
    },
    {
      "commit": "60fdb44a23cbc5d8db224577e14ea667d7c53478",
      "tree": "874bf414a7b62bb5a55dc0df7ee4ed2a226742f4",
      "parents": [
        "e609a6b85182f8a479d265839d3ff9aad2e67b18"
      ],
      "author": {
        "name": "Jarkko Sakkinen",
        "email": "jarkko.sakkinen@linux.intel.com",
        "time": "Thu Nov 09 13:38:21 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Nov 09 17:58:40 2017 -0800"
      },
      "message": "MAINTAINERS: update TPM driver infrastructure changes\n\n[akpm@linux-foundation.org: alpha-sort CREDITS, per Randy]\nLink: http://lkml.kernel.org/r/20170915223811.21368-1-jarkko.sakkinen@linux.intel.com\nSigned-off-by: Jarkko Sakkinen \u003cjarkko.sakkinen@linux.intel.com\u003e\nCc: Marcel Selhorst \u003ctpmdd@selhorst.net\u003e\nCc: Ashley Lai \u003cashleydlai@gmail.com\u003e\nCc: Mimi Zohar \u003czohar@linux.vnet.ibm.com\u003e\nCc: Jarkko Sakkinen \u003cjarkko.sakkinen@linux.intel.com\u003e\nCc: Boris Brezillon \u003cboris.brezillon@free-electrons.com\u003e\nCc: Borislav Petkov \u003cbp@suse.de\u003e\nCc: Håvard Skinnemoen \u003chskinnemoen@gmail.com\u003e\nCc: Martin Kepplinger \u003cmartink@posteo.de\u003e\nCc: Pavel Machek \u003cpavel@ucw.cz\u003e\nCc: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nCc: Hans-Christian Noren Egtvedt \u003cegtvedt@samfundet.no\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@kernel.org\u003e\nCc: Gertjan van Wingerde \u003cgwingerde@gmail.com\u003e\nCc: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nCc: David S. Miller \u003cdavem@davemloft.net\u003e\nCc: Mauro Carvalho Chehab \u003cmchehab@kernel.org\u003e\nCc: Randy Dunlap \u003crdunlap@infradead.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "e609a6b85182f8a479d265839d3ff9aad2e67b18",
      "tree": "7ebf1f10de166906af502899a6267b730cd04de2",
      "parents": [
        "3fefc31843cfe2b5f072efe11ed9ccaf6a7a5092"
      ],
      "author": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Thu Nov 09 13:38:18 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Nov 09 17:58:40 2017 -0800"
      },
      "message": "sysctl: add register_sysctl() dummy helper\n\nregister_sysctl() has been around for five years with commit\nfea478d4101a (\"sysctl: Add register_sysctl for normal sysctl users\") but\nnow that arm64 started using it, I ran into a compile error:\n\n  arch/arm64/kernel/armv8_deprecated.c: In function \u0027register_insn_emulation_sysctl\u0027:\n  arch/arm64/kernel/armv8_deprecated.c:257:2: error: implicit declaration of function \u0027register_sysctl\u0027\n\nThis adds a inline function like we already have for\nregister_sysctl_paths() and register_sysctl_table().\n\nLink: http://lkml.kernel.org/r/20171106133700.558647-1-arnd@arndb.de\nFixes: 38b9aeb32fa7 (\"arm64: Port deprecated instruction emulation to new sysctl interface\")\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nReviewed-by: Dave Martin \u003cDave.Martin@arm.com\u003e\nAcked-by: Kees Cook \u003ckeescook@chromium.org\u003e\nAcked-by: Will Deacon \u003cwill.deacon@arm.com\u003e\nCc: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: \"Luis R. Rodriguez\" \u003cmcgrof@kernel.org\u003e\nCc: Alex Benne \u003calex.bennee@linaro.org\u003e\nCc: Arnd Bergmann \u003carnd@arndb.de\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "5cff3684192773a2c2b1102acd10b99aaa6a3f67",
      "tree": "e37b1ac297b4afb20befc46843e82ad0d99170af",
      "parents": [
        "e7a7912a91cc1a274fab17f8a66b1e9dcfe00047",
        "6b7be529634bbfbf6395f23217a66d731fbed0a0"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Nov 09 17:43:27 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Nov 09 17:43:27 2017 -0800"
      },
      "message": "Merge tag \u0027pci-v4.14-fixes-7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci\n\nPull PCI maintainership updates from Bjorn Helgaas:\n \"Update MAINTAINERS for HiSilicon, Microsemi Switchtec, and native host\n  bridge drivers (Gabriele Paoloni, Sebastian Andrzej Siewior).\n\n  Note that starting with changes intended for v4.16, Lorenzo Pieralisi\n  will maintain the drivers/pci/{dwc,endpoint,host} directories. My\n  intent is to continue to merge those changes via my tree, so this\n  should be transparent to you\"\n\n* tag \u0027pci-v4.14-fixes-7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:\n  MAINTAINERS: Add Lorenzo Pieralisi for PCI host bridge drivers\n  MAINTAINERS: Remove Gabriele Paoloni as HiSilicon PCI maintainer\n  MAINTAINERS: Remove Stephen Bates as Microsemi Switchtec maintainer\n"
    },
    {
      "commit": "e7a7912a91cc1a274fab17f8a66b1e9dcfe00047",
      "tree": "d6a7e32b9af7227e16265f3f280fe97b2b766af4",
      "parents": [
        "3fefc31843cfe2b5f072efe11ed9ccaf6a7a5092",
        "b9dd05c7002ee0ca8b676428b2268c26399b5e31"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Nov 09 17:41:39 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Nov 09 17:41:39 2017 -0800"
      },
      "message": "Merge branch \u0027fixes\u0027 of git://git.armlinux.org.uk/~rmk/linux-arm\n\nPull ARM fix from Russell King:\n \"Last ARM fix for 4.14.\n\n  This plugs a hole in dump_instr(), which, with certain conditions\n  satisfied, can dump instructions from kernel space\"\n\n* \u0027fixes\u0027 of git://git.armlinux.org.uk/~rmk/linux-arm:\n  ARM: 8720/1: ensure dump_instr() checks addr_limit\n"
    },
    {
      "commit": "3fefc31843cfe2b5f072efe11ed9ccaf6a7a5092",
      "tree": "972363ae187c21bb3d4ec8948bf06603973dd163",
      "parents": [
        "d93d4ce103fdd6c6689e94cfbd0316b027d6ead2",
        "e029b9bf1221f200319541cd6861912b89345665"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Nov 09 11:16:28 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Nov 09 11:16:28 2017 -0800"
      },
      "message": "Merge tag \u0027pm-final-4.14\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull final power management fixes from Rafael Wysocki:\n \"These fix a regression in the schedutil cpufreq governor introduced by\n  a recent change and blacklist Dell XPS13 9360 from using the Low Power\n  S0 Idle _DSM interface which triggers serious problems on one of these\n  machines.\n\n  Specifics:\n\n   - Prevent the schedutil cpufreq governor from using the utilization\n     of a wrong CPU in some cases which started to happen after one of\n     the recent changes in it (Chris Redpath).\n\n   - Blacklist Dell XPS13 9360 from using the Low Power S0 Idle _DSM\n     interface as that causes serious issue (related to NVMe) to appear\n     on one of these machines, even though the other Dells XPS13 9360 in\n     somewhat different HW configurations behave correctly (Rafael\n     Wysocki)\"\n\n* tag \u0027pm-final-4.14\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n  ACPI / PM: Blacklist Low Power S0 Idle _DSM for Dell XPS13 9360\n  cpufreq: schedutil: Examine the correct CPU when we update util\n"
    },
    {
      "commit": "d93d4ce103fdd6c6689e94cfbd0316b027d6ead2",
      "tree": "7d28acab8905fc77005b0d09ef4c8bcb0ff45a29",
      "parents": [
        "d1041cdc60bc122aac09f822aad1ff6c5cb84406",
        "75ee94b20b46459e3d29f5ac2c3af3cebdeef777"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Nov 09 09:58:11 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Nov 09 09:58:11 2017 -0800"
      },
      "message": "Merge tag \u0027sound-4.14\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"The amount of the changes isn\u0027t as quite small as wished, nevertheless\n  they are straight fixes that deserve merging to 4.14 final.\n\n  Most of fixes are about ALSA core bugs spotted by fuzzer: a follow-up\n  fix for the previous nested rwsem patch, a fix to avoid the resource\n  hogs due to too many concurrent ALSA timer invocations, and a fix for\n  a crash with SYSEX MIDI transfer over OSS sequencer emulation that is\n  used by none but fuzzer.\n\n  The rest are usual HD-audio and USB-audio device-specific quirks,\n  which are safe to apply\"\n\n* tag \u0027sound-4.14\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n  ALSA: hda - fix headset mic problem for Dell machines with alc274\n  ALSA: seq: Fix OSS sysex delivery in OSS emulation\n  ALSA: seq: Avoid invalid lockdep class warning\n  ALSA: timer: Limit max instances per timer\n  ALSA: usb-audio: support new Amanero Combo384 firmware version\n"
    },
    {
      "commit": "d1041cdc60bc122aac09f822aad1ff6c5cb84406",
      "tree": "e537e5c0812f100a22512809fde0a2c0e73f5a22",
      "parents": [
        "87df26175e67c26ccdd3a002fbbb8cde78e28a19",
        "6a17280247458ac2c302200e2d6ae36656f75bc6"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Nov 09 09:31:34 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Nov 09 09:31:34 2017 -0800"
      },
      "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nPull networking fixes from David Miller:\n\n 1) Fix use-after-free in IPSEC input parsing, desintation address\n    pointer was loaded before pskb_may_pull() which can change the SKB\n    data pointers. From Florian Westphal.\n\n 2) Stack out-of-bounds read in xfrm_state_find(), from Steffen\n    Klassert.\n\n 3) IPVS state of SKB is not properly reset when moving between\n    namespaces, from Ye Yin.\n\n 4) Fix crash in asix driver suspend and resume, from Andrey Konovalov.\n\n 5) Don\u0027t deliver ipv6 l2tp tunnel packets to ipv4 l2tp tunnels, and\n    vice versa, from Guillaume Nault.\n\n 6) Fix DSACK undo on non-dup ACKs, from Priyaranjan Jha.\n\n 7) Fix regression in bond_xmit_hash()\u0027s behavior after the TCP port\n    selection changes back in 4.2, from Hangbin Liu.\n\n 8) Two divide by zero bugs in USB networking drivers when parsing\n    descriptors, from Bjorn Mork.\n\n 9) Fix bonding slaves being stuck in BOND_LINK_FAIL state, from Jay\n    Vosburgh.\n\n10) Missing skb_reset_mac_header() in qmi_wwan, from Kristian Evensen.\n\n11) Fix the destruction of tc action object races properly, from Cong\n    Wang.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (31 commits)\n  cls_u32: use tcf_exts_get_net() before call_rcu()\n  cls_tcindex: use tcf_exts_get_net() before call_rcu()\n  cls_rsvp: use tcf_exts_get_net() before call_rcu()\n  cls_route: use tcf_exts_get_net() before call_rcu()\n  cls_matchall: use tcf_exts_get_net() before call_rcu()\n  cls_fw: use tcf_exts_get_net() before call_rcu()\n  cls_flower: use tcf_exts_get_net() before call_rcu()\n  cls_flow: use tcf_exts_get_net() before call_rcu()\n  cls_cgroup: use tcf_exts_get_net() before call_rcu()\n  cls_bpf: use tcf_exts_get_net() before call_rcu()\n  cls_basic: use tcf_exts_get_net() before call_rcu()\n  net_sched: introduce tcf_exts_get_net() and tcf_exts_put_net()\n  Revert \"net_sched: hold netns refcnt for each action\"\n  net: usb: asix: fill null-ptr-deref in asix_suspend\n  Revert \"net: usb: asix: fill null-ptr-deref in asix_suspend\"\n  qmi_wwan: Add missing skb_reset_mac_header-call\n  bonding: fix slave stuck in BOND_LINK_FAIL state\n  qrtr: Move to postcore_initcall\n  net: qmi_wwan: fix divide by 0 on bad descriptors\n  net: cdc_ether: fix divide by 0 on bad descriptors\n  ...\n"
    },
    {
      "commit": "be739f4b5ddece74ef25e2304b17a7fd24575e9b",
      "tree": "2e0f2e78107f54781f4e278bdbbd5df0a14760bc",
      "parents": [
        "d0cd64b02aa854d68ce517cb7da1fe4e4fff2653"
      ],
      "author": {
        "name": "Kirill A. Shutemov",
        "email": "kirill.shutemov@linux.intel.com",
        "time": "Tue Nov 07 13:38:04 2017 +0300"
      },
      "committer": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Thu Nov 09 18:20:20 2017 +0100"
      },
      "message": "x86/mm: Fix ELF_ET_DYN_BASE for 5-level paging\n\nOn machines with 5-level paging we don\u0027t want to allocate mapping above\n47-bit unless user explicitly asked for it. See b569bab78d8d (\"x86/mm:\nPrepare to expose larger address space to userspace\") for details.\n\nc715b72c1ba4 (\"mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base\nchanges\") broke the behaviour. After the commit elf binary and heap got\nmapped above 47-bits.\n\nUse DEFAULT_MAP_WINDOW instead of TASK_SIZE to determine ELF_ET_DYN_BASE so\nit\u0027s forced to be below 47-bits unconditionally.\n\nFixes: c715b72c1ba4 (\"mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes\")\nSigned-off-by: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Nicholas Piggin \u003cnpiggin@gmail.com\u003e\nCc: linux-mm@kvack.org\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nLink: https://lkml.kernel.org/r/20171107103804.47341-1-kirill.shutemov@linux.intel.com\n\n"
    },
    {
      "commit": "33974a414ce2324554f75dbd204ff0868f499e32",
      "tree": "14364cfb984af7ef81223fcea111f791012ed26c",
      "parents": [
        "a271bfaf30ce8f7f57c6b65c47bff6d306d0b758"
      ],
      "author": {
        "name": "Andrei Vagin",
        "email": "avagin@openvz.org",
        "time": "Tue Nov 07 16:22:45 2017 -0800"
      },
      "committer": {
        "name": "Arnaldo Carvalho de Melo",
        "email": "acme@redhat.com",
        "time": "Thu Nov 09 10:17:32 2017 -0300"
      },
      "message": "perf trace: Call machine__exit() at exit\n\nOtherwise \u0027perf trace\u0027 leaves a temporary file /tmp/perf-vdso.so-XXXXXX.\n\n  $ perf trace -o log true\n  $ ls -l /tmp/perf-vdso.*\n  -rw------- 1 root root 8192 Nov  8 03:08 /tmp/perf-vdso.so-5bCpD0\n\nSigned-off-by: Andrei Vagin \u003cavagin@openvz.org\u003e\nReviewed-by: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Alexander Shishkin \u003calexander.shishkin@linux.intel.com\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Vasily Averin \u003cvvs@virtuozzo.com\u003e\nLink: http://lkml.kernel.org/r/20171108002246.8924-1-avagin@openvz.org\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n"
    },
    {
      "commit": "a271bfaf30ce8f7f57c6b65c47bff6d306d0b758",
      "tree": "08d0fe37874f9e750db9e522b38b6eefee954822",
      "parents": [
        "b6af53b7d6fa40262c16753fe2781a3e792d5e1b"
      ],
      "author": {
        "name": "Jiri Olsa",
        "email": "jolsa@redhat.com",
        "time": "Thu Nov 09 10:02:10 2017 +0100"
      },
      "committer": {
        "name": "Arnaldo Carvalho de Melo",
        "email": "acme@redhat.com",
        "time": "Thu Nov 09 10:10:58 2017 -0300"
      },
      "message": "perf tools: Fix eBPF event specification parsing\n\nLooks like I\u0027ve reached the new level of stupidity, adding missing braces.\n\nCommitter testing:\n\nGiven the following eBPF C filter, that will add a record when it\nreturns true, i.e. when the tv_nsec variable is \u003e 2000ns, should be\nbuilt and installed via sys_bpf(), but fails to do so before this patch:\n\n  # cat filter.c\n  #include \u003cuapi/linux/bpf.h\u003e\n  #define SEC(NAME) __attribute__((section(NAME), used))\n\n  SEC(\"func\u003dhrtimer_nanosleep rqtp-\u003etv_nsec\")\n  int func(void *ctx, int err, long nsec)\n  {\n\t  return nsec \u003e 1000;\n  }\n  char _license[] SEC(\"license\") \u003d \"GPL\";\n  int _version SEC(\"version\") \u003d LINUX_VERSION_CODE;\n  #\n\n  # perf trace -e nanosleep,filter.c usleep 1\n  invalid or unsupported event: \u0027filter.c\u0027\n  Run \u0027perf list\u0027 for a list of valid events\n\n   Usage: perf trace [\u003coptions\u003e] [\u003ccommand\u003e]\n      or: perf trace [\u003coptions\u003e] -- \u003ccommand\u003e [\u003coptions\u003e]\n      or: perf trace record [\u003coptions\u003e] [\u003ccommand\u003e]\n      or: perf trace record [\u003coptions\u003e] -- \u003ccommand\u003e [\u003coptions\u003e]\n\n      -e, --event \u003cevent\u003e   event/syscall selector. use \u0027perf list\u0027 to list available events\n  #\n\nAnd works again after it is applied, the nothing is inserted when the co\n\n  # perf trace -e *sleep,filter.c usleep 1\n     0.000 ( 0.066 ms): usleep/23994 nanosleep(rqtp: 0x7ffead94a0d0) \u003d 0\n  # perf trace -e *sleep,filter.c usleep 2\n     0.000 ( 0.008 ms): usleep/24378 nanosleep(rqtp: 0x7fffa021ba50) ...\n     0.008 (         ): perf_bpf_probe:func:(ffffffffb410cb30) tv_nsec\u003d2000)\n     0.000 ( 0.066 ms): usleep/24378  ... [continued]: nanosleep()) \u003d 0\n  #\n\nThe intent of 9445464bb831 is kept:\n\n  # perf stat -e \u0027cpu/uops_executed.core,krava/\u0027  true\n  event syntax error: \u0027..cuted.core,krava/\u0027\n                                    \\___ unknown term\n\n  valid terms: cmask,pc,event,edge,in_tx,any,ldlat,inv,umask,in_tx_cp,offcore_rsp,config,config1,config2,name,period\n  Run \u0027perf list\u0027 for a list of valid events\n\n   Usage: perf stat [\u003coptions\u003e] [\u003ccommand\u003e]\n\n      -e, --event \u003cevent\u003e   event selector. use \u0027perf list\u0027 to list available events\n  #\n  # perf stat -e \u0027cpu/uops_executed.core,period\u003d1/\u0027  true\n\n   Performance counter stats for \u0027true\u0027:\n\n           808,332      cpu/uops_executed.core,period\u003d1/\n\n       0.002997237 seconds time elapsed\n\n  #\n\nReported-by: Arnaldo Carvalho de Melo \u003cacme@kernel.org\u003e\nSigned-off-by: Jiri Olsa \u003cjolsa@kernel.org\u003e\nCc: Andi Kleen \u003candi@firstfloor.org\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nFixes: 9445464bb831 (\"perf tools: Unwind properly location after REJECT\")\nLink: http://lkml.kernel.org/n/tip-diea0ihbwpxfw6938huv3whj@git.kernel.org\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n"
    },
    {
      "commit": "b6af53b7d6fa40262c16753fe2781a3e792d5e1b",
      "tree": "b0d386d8c6d17d54bfe4fdce53ed7751f15d8a52",
      "parents": [
        "fb7df12d645cfba6a76a45fdcc7e3f7fbbcda661"
      ],
      "author": {
        "name": "Jiri Olsa",
        "email": "jolsa@redhat.com",
        "time": "Wed Nov 08 16:43:09 2017 +0100"
      },
      "committer": {
        "name": "Arnaldo Carvalho de Melo",
        "email": "acme@redhat.com",
        "time": "Thu Nov 09 10:09:03 2017 -0300"
      },
      "message": "perf tools: Add \"reject\" option for parse-events.l\n\nArnaldo reported broken builds in some distros using a newer flex\nrelease, 2.6.4, found in Alpine Linux 3.6 and Edge, with flex not\nspotting the REJECT macro:\n\n  CC       /tmp/build/perf/util/parse-events-flex.o\n  util/parse-events.l: In function \u0027parse_events_lex\u0027:\n  /tmp/build/perf/util/parse-events-flex.c:4734:16: error: \\\n  \u0027reject_used_but_not_detected\u0027 undeclared (first use in this function)\n\nIt\u0027s happening because we put the REJECT under another USER_REJECT macro\nin following commit:\n\n  9445464bb831 perf tools: Unwind properly location after REJECT\n\nFortunately flex provides option for force it to use REJECT, adding it\nto parse-events.l.\n\nReported-by: Arnaldo Carvalho de Melo \u003cacme@kernel.org\u003e\nReported-by: Markus Trippelsdorf \u003cmarkus@trippelsdorf.de\u003e\nSigned-off-by: Jiri Olsa \u003cjolsa@kernel.org\u003e\nReviewed-by: Andi Kleen \u003candi@firstfloor.org\u003e\nTested-by: Arnaldo Carvalho de Melo \u003cacme@kernel.org\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nFixes: 9445464bb831 (\"perf tools: Unwind properly location after REJECT\")\nLink: http://lkml.kernel.org/n/tip-7kdont984mw12ijk7rji6b8p@git.kernel.org\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n"
    },
    {
      "commit": "1e37f2f84680fa7f8394fd444b6928e334495ccc",
      "tree": "b69c9047d3d73f4e39716fbbf90d659e512d788a",
      "parents": [
        "39dae59d66acd86d1de24294bd2f343fd5e7a625"
      ],
      "author": {
        "name": "Ilya Dryomov",
        "email": "idryomov@gmail.com",
        "time": "Mon Nov 06 11:33:36 2017 +0100"
      },
      "committer": {
        "name": "Ilya Dryomov",
        "email": "idryomov@gmail.com",
        "time": "Thu Nov 09 09:32:53 2017 +0100"
      },
      "message": "rbd: use GFP_NOIO for parent stat and data requests\n\nrbd_img_obj_exists_submit() and rbd_img_obj_parent_read_full() are on\nthe writeback path for cloned images -- we attempt a stat on the parent\nobject to see if it exists and potentially read it in to call copyup.\nGFP_NOIO should be used instead of GFP_KERNEL here.\n\nCc: stable@vger.kernel.org\nLink: http://tracker.ceph.com/issues/22014\nSigned-off-by: Ilya Dryomov \u003cidryomov@gmail.com\u003e\nReviewed-by: David Disseldorp \u003cddiss@suse.de\u003e\n"
    },
    {
      "commit": "75ee94b20b46459e3d29f5ac2c3af3cebdeef777",
      "tree": "f1b4d477aee7ba51fe2bfe9f9242166fac152ff5",
      "parents": [
        "132d358b183ac6ad8b3fea32ad5e0663456d18d1"
      ],
      "author": {
        "name": "Hui Wang",
        "email": "hui.wang@canonical.com",
        "time": "Thu Nov 09 08:48:08 2017 +0800"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Nov 09 08:42:27 2017 +0100"
      },
      "message": "ALSA: hda - fix headset mic problem for Dell machines with alc274\n\nConfirmed with Kailang of Realtek, the pin 0x19 is for Headset Mic, and\nthe pin 0x1a is for Headphone Mic, he suggested to apply\nALC269_FIXUP_DELL1_MIC_NO_PRESENCE to fix this problem. And we\nverified applying this FIXUP can fix this problem.\n\nCc: \u003cstable@vger.kernel.org\u003e\nCc: Kailang Yang \u003ckailang@realtek.com\u003e\nSigned-off-by: Hui Wang \u003chui.wang@canonical.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "6a17280247458ac2c302200e2d6ae36656f75bc6",
      "tree": "1063ef6609bf185e13de668e07156e795d9cafb4",
      "parents": [
        "623859ae06b85cabba79ce78f0d49e67783d4c34",
        "c9f3f813d462c72dbe412cee6a5cbacf13c4ad5e"
      ],
      "author": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 10:58:35 2017 +0900"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 10:58:35 2017 +0900"
      },
      "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec\n\nSteffen Klassert says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull request (net): ipsec 2017-11-09\n\n1) Fix a use after free due to a reallocated skb head.\n   From Florian Westphal.\n\n2) Fix sporadic lookup failures on labeled IPSEC.\n   From Florian Westphal.\n\n3) Fix a stack out of bounds when a socket policy is applied\n   to an IPv6 socket that sends IPv4 packets.\n\nPlease pull or let me know if there are problems.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "60ccb31bd680469ee0db92b0b6594d79bd13ff87",
      "tree": "ab9617f03341392ddd182866f73a454cd1330dec",
      "parents": [
        "17208f1dec433b60eb9b427c17598adc431ab6de",
        "423a8a942e95493b73228ba6a3f176dcc7f35fa9"
      ],
      "author": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Thu Nov 09 11:17:32 2017 +1000"
      },
      "committer": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Thu Nov 09 11:17:32 2017 +1000"
      },
      "message": "Merge tag \u0027drm-intel-fixes-2017-11-08\u0027 of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes\n\n- Fix possible NULL dereference (Chris).\n- Avoid miss usage of syncobj by rejecting unknown flags (Tvrtko).\n\n* tag \u0027drm-intel-fixes-2017-11-08\u0027 of git://anongit.freedesktop.org/drm/drm-intel:\n  drm/i915: Deconstruct struct sgt_dma initialiser\n  drm/i915: Reject unknown syncobj flags\n"
    },
    {
      "commit": "623859ae06b85cabba79ce78f0d49e67783d4c34",
      "tree": "4600cfecab2372a77cfb9143e4b24b059d24433a",
      "parents": [
        "8f5624629105589bcc23d0e51cc01bd8103d09a5",
        "35c55fc156d85a396a975fc17636f560fc02fd65"
      ],
      "author": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 10:03:10 2017 +0900"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 10:03:10 2017 +0900"
      },
      "message": "Merge branch \u0027net-sched-race-fix\u0027\n\nCong Wang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet_sched: close the race between call_rcu() and cleanup_net()\n\nThis patchset tries to fix the race between call_rcu() and\ncleanup_net() again. Without holding the netns refcnt the\ntc_action_net_exit() in netns workqueue could be called before\nfilter destroy works in tc filter workqueue. This patchset\nmoves the netns refcnt from tc actions to tcf_exts, without\nbreaking per-netns tc actions.\n\nPatch 1 reverts the previous fix, patch 2 introduces two new\nAPI\u0027s to help to address the bug and the rest patches switch\nto the new API\u0027s. Please see each patch for details.\n\nI was not able to reproduce this bug, but now after adding\nsome delay in filter destroy work I manage to trigger the\ncrash. After this patchset, the crash is not reproducible\nany more and the debugging printk\u0027s show the order is expected\ntoo.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nFixes: ddf97ccdd7cb (\"net_sched: add network namespace support for tc actions\")\nReported-by: Lucas Bates \u003clucasb@mojatatu.com\u003e\nCc: Lucas Bates \u003clucasb@mojatatu.com\u003e\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "35c55fc156d85a396a975fc17636f560fc02fd65",
      "tree": "4600cfecab2372a77cfb9143e4b24b059d24433a",
      "parents": [
        "f2b751053ee9314e82c178f6ca0fee7e160fac95"
      ],
      "author": {
        "name": "Cong Wang",
        "email": "xiyou.wangcong@gmail.com",
        "time": "Mon Nov 06 13:47:30 2017 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 10:03:10 2017 +0900"
      },
      "message": "cls_u32: use tcf_exts_get_net() before call_rcu()\n\nHold netns refcnt before call_rcu() and release it after\nthe tcf_exts_destroy() is done.\n\nNote, on -\u003edestroy() path we have to respect the return value\nof tcf_exts_get_net(), on other paths it should always return\ntrue, so we don\u0027t need to care.\n\nCc: Lucas Bates \u003clucasb@mojatatu.com\u003e\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "f2b751053ee9314e82c178f6ca0fee7e160fac95",
      "tree": "4d645ccb5b6dff27b785edc40b3b047cb2975c69",
      "parents": [
        "96585063a27f0704dcf7a09f8b78edd6a8973965"
      ],
      "author": {
        "name": "Cong Wang",
        "email": "xiyou.wangcong@gmail.com",
        "time": "Mon Nov 06 13:47:29 2017 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 10:03:10 2017 +0900"
      },
      "message": "cls_tcindex: use tcf_exts_get_net() before call_rcu()\n\nHold netns refcnt before call_rcu() and release it after\nthe tcf_exts_destroy() is done.\n\nNote, on -\u003edestroy() path we have to respect the return value\nof tcf_exts_get_net(), on other paths it should always return\ntrue, so we don\u0027t need to care.\n\nCc: Lucas Bates \u003clucasb@mojatatu.com\u003e\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "96585063a27f0704dcf7a09f8b78edd6a8973965",
      "tree": "d30f51bd07a578f76f2c2dba4fd935b93feaa014",
      "parents": [
        "3fd51de5e3ba447624a08a8ba29f90d94f0fe909"
      ],
      "author": {
        "name": "Cong Wang",
        "email": "xiyou.wangcong@gmail.com",
        "time": "Mon Nov 06 13:47:28 2017 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 10:03:10 2017 +0900"
      },
      "message": "cls_rsvp: use tcf_exts_get_net() before call_rcu()\n\nHold netns refcnt before call_rcu() and release it after\nthe tcf_exts_destroy() is done.\n\nNote, on -\u003edestroy() path we have to respect the return value\nof tcf_exts_get_net(), on other paths it should always return\ntrue, so we don\u0027t need to care.\n\nCc: Lucas Bates \u003clucasb@mojatatu.com\u003e\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "3fd51de5e3ba447624a08a8ba29f90d94f0fe909",
      "tree": "55ba3158b8db1830bdf195485776ddda9fdfb36b",
      "parents": [
        "57767e785321a427b8cdd282db2b8b33cd218ffa"
      ],
      "author": {
        "name": "Cong Wang",
        "email": "xiyou.wangcong@gmail.com",
        "time": "Mon Nov 06 13:47:27 2017 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 10:03:10 2017 +0900"
      },
      "message": "cls_route: use tcf_exts_get_net() before call_rcu()\n\nHold netns refcnt before call_rcu() and release it after\nthe tcf_exts_destroy() is done.\n\nNote, on -\u003edestroy() path we have to respect the return value\nof tcf_exts_get_net(), on other paths it should always return\ntrue, so we don\u0027t need to care.\n\nCc: Lucas Bates \u003clucasb@mojatatu.com\u003e\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "57767e785321a427b8cdd282db2b8b33cd218ffa",
      "tree": "e865e8d9b4dd890e8709c64383df52a37b4ff235",
      "parents": [
        "d5f984f5af1d926bc9c7a7f90e7a1e1e313a8ba7"
      ],
      "author": {
        "name": "Cong Wang",
        "email": "xiyou.wangcong@gmail.com",
        "time": "Mon Nov 06 13:47:26 2017 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 10:03:10 2017 +0900"
      },
      "message": "cls_matchall: use tcf_exts_get_net() before call_rcu()\n\nHold netns refcnt before call_rcu() and release it after\nthe tcf_exts_destroy() is done.\n\nCc: Lucas Bates \u003clucasb@mojatatu.com\u003e\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "d5f984f5af1d926bc9c7a7f90e7a1e1e313a8ba7",
      "tree": "2c5a1671182ea951953b39baa2f1b3155d6153eb",
      "parents": [
        "0dadc117ac8bc78d8144e862ac8ad23f342f9ea8"
      ],
      "author": {
        "name": "Cong Wang",
        "email": "xiyou.wangcong@gmail.com",
        "time": "Mon Nov 06 13:47:25 2017 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 10:03:09 2017 +0900"
      },
      "message": "cls_fw: use tcf_exts_get_net() before call_rcu()\n\nHold netns refcnt before call_rcu() and release it after\nthe tcf_exts_destroy() is done.\n\nNote, on -\u003edestroy() path we have to respect the return value\nof tcf_exts_get_net(), on other paths it should always return\ntrue, so we don\u0027t need to care.\n\nCc: Lucas Bates \u003clucasb@mojatatu.com\u003e\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "0dadc117ac8bc78d8144e862ac8ad23f342f9ea8",
      "tree": "2b69557f22b63bfe4660bef06b0dfac64b741b47",
      "parents": [
        "22f7cec93f0af86c4b66bf34a977da9d7cef076e"
      ],
      "author": {
        "name": "Cong Wang",
        "email": "xiyou.wangcong@gmail.com",
        "time": "Mon Nov 06 13:47:24 2017 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 10:03:09 2017 +0900"
      },
      "message": "cls_flower: use tcf_exts_get_net() before call_rcu()\n\nHold netns refcnt before call_rcu() and release it after\nthe tcf_exts_destroy() is done.\n\nNote, on -\u003edestroy() path we have to respect the return value\nof tcf_exts_get_net(), on other paths it should always return\ntrue, so we don\u0027t need to care.\n\nCc: Lucas Bates \u003clucasb@mojatatu.com\u003e\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "22f7cec93f0af86c4b66bf34a977da9d7cef076e",
      "tree": "7ef156054146fce727443685455fb4f90f67b305",
      "parents": [
        "ed1481681414e4d4264ad46864d5c1da5ff6ccb1"
      ],
      "author": {
        "name": "Cong Wang",
        "email": "xiyou.wangcong@gmail.com",
        "time": "Mon Nov 06 13:47:23 2017 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 10:03:09 2017 +0900"
      },
      "message": "cls_flow: use tcf_exts_get_net() before call_rcu()\n\nHold netns refcnt before call_rcu() and release it after\nthe tcf_exts_destroy() is done.\n\nNote, on -\u003edestroy() path we have to respect the return value\nof tcf_exts_get_net(), on other paths it should always return\ntrue, so we don\u0027t need to care.\n\nCc: Lucas Bates \u003clucasb@mojatatu.com\u003e\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "ed1481681414e4d4264ad46864d5c1da5ff6ccb1",
      "tree": "7674aba4bcb962e836a97dc7a6cced3bf06e37e8",
      "parents": [
        "aae2c35ec89252639a97769fa72dbbf8f1cc3107"
      ],
      "author": {
        "name": "Cong Wang",
        "email": "xiyou.wangcong@gmail.com",
        "time": "Mon Nov 06 13:47:22 2017 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 10:03:09 2017 +0900"
      },
      "message": "cls_cgroup: use tcf_exts_get_net() before call_rcu()\n\nHold netns refcnt before call_rcu() and release it after\nthe tcf_exts_destroy() is done.\n\nNote, on -\u003edestroy() path we have to respect the return value\nof tcf_exts_get_net(), on other paths it should always return\ntrue, so we don\u0027t need to care.\n\nCc: Lucas Bates \u003clucasb@mojatatu.com\u003e\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "aae2c35ec89252639a97769fa72dbbf8f1cc3107",
      "tree": "11c169b12411dddfdbf648fd68e2d611e2417a7c",
      "parents": [
        "0b2a59894b7657fab46b50f176bd772aa495044f"
      ],
      "author": {
        "name": "Cong Wang",
        "email": "xiyou.wangcong@gmail.com",
        "time": "Mon Nov 06 13:47:21 2017 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 10:03:09 2017 +0900"
      },
      "message": "cls_bpf: use tcf_exts_get_net() before call_rcu()\n\nHold netns refcnt before call_rcu() and release it after\nthe tcf_exts_destroy() is done.\n\nNote, on -\u003edestroy() path we have to respect the return value\nof tcf_exts_get_net(), on other paths it should always return\ntrue, so we don\u0027t need to care.\n\nCc: Lucas Bates \u003clucasb@mojatatu.com\u003e\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "0b2a59894b7657fab46b50f176bd772aa495044f",
      "tree": "3861183d9cc6d207b5dda58ab48203bcacdd1144",
      "parents": [
        "e4b95c41df36befcfd117210900cd790bc2cd048"
      ],
      "author": {
        "name": "Cong Wang",
        "email": "xiyou.wangcong@gmail.com",
        "time": "Mon Nov 06 13:47:20 2017 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 10:03:09 2017 +0900"
      },
      "message": "cls_basic: use tcf_exts_get_net() before call_rcu()\n\nHold netns refcnt before call_rcu() and release it after\nthe tcf_exts_destroy() is done.\n\nNote, on -\u003edestroy() path we have to respect the return value\nof tcf_exts_get_net(), on other paths it should always return\ntrue, so we don\u0027t need to care.\n\nCc: Lucas Bates \u003clucasb@mojatatu.com\u003e\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "e4b95c41df36befcfd117210900cd790bc2cd048",
      "tree": "53d51109b9ec8ebc29f14fc9689671cda519556a",
      "parents": [
        "c7e460ce55724d4e4e22d3126e5c47273819c53a"
      ],
      "author": {
        "name": "Cong Wang",
        "email": "xiyou.wangcong@gmail.com",
        "time": "Mon Nov 06 13:47:19 2017 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 10:03:09 2017 +0900"
      },
      "message": "net_sched: introduce tcf_exts_get_net() and tcf_exts_put_net()\n\nInstead of holding netns refcnt in tc actions, we can minimize\nthe holding time by saving it in struct tcf_exts instead. This\nmeans we can just hold netns refcnt right before call_rcu() and\nrelease it after tcf_exts_destroy() is done.\n\nHowever, because on netns cleanup path we call tcf_proto_destroy()\ntoo, obviously we can not hold netns for a zero refcnt, in this\ncase we have to do cleanup synchronously. It is fine for RCU too,\nthe caller cleanup_net() already waits for a grace period.\n\nFor other cases, refcnt is non-zero and we can safely grab it as\nnormal and release it after we are done.\n\nThis patch provides two new API for each filter to use:\ntcf_exts_get_net() and tcf_exts_put_net(). And all filters now can\nuse the following pattern:\n\nvoid __destroy_filter() {\n  tcf_exts_destroy();\n  tcf_exts_put_net();  // \u003c\u003d\u003d release netns refcnt\n  kfree();\n}\nvoid some_work() {\n  rtnl_lock();\n  __destroy_filter();\n  rtnl_unlock();\n}\nvoid some_rcu_callback() {\n  tcf_queue_work(some_work);\n}\n\nif (tcf_exts_get_net())  // \u003c\u003d\u003d hold netns refcnt\n  call_rcu(some_rcu_callback);\nelse\n  __destroy_filter();\n\nCc: Lucas Bates \u003clucasb@mojatatu.com\u003e\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "c7e460ce55724d4e4e22d3126e5c47273819c53a",
      "tree": "ad2918c2f935998144a787fd643d06e16e5a56a2",
      "parents": [
        "8f5624629105589bcc23d0e51cc01bd8103d09a5"
      ],
      "author": {
        "name": "Cong Wang",
        "email": "xiyou.wangcong@gmail.com",
        "time": "Mon Nov 06 13:47:18 2017 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 10:03:09 2017 +0900"
      },
      "message": "Revert \"net_sched: hold netns refcnt for each action\"\n\nThis reverts commit ceffcc5e254b450e6159f173e4538215cebf1b59.\nIf we hold that refcnt, the netns can never be destroyed until\nall actions are destroyed by user, this breaks our netns design\nwhich we expect all actions are destroyed when we destroy the\nwhole netns.\n\nCc: Lucas Bates \u003clucasb@mojatatu.com\u003e\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "8f5624629105589bcc23d0e51cc01bd8103d09a5",
      "tree": "267766861d83db54607617237cc2c4fdf2b5cd97",
      "parents": [
        "1a8e6b48fbf534028ce4031d0d035e7e72779cef"
      ],
      "author": {
        "name": "Andrey Konovalov",
        "email": "andreyknvl@google.com",
        "time": "Mon Nov 06 13:26:46 2017 +0100"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 09:22:13 2017 +0900"
      },
      "message": "net: usb: asix: fill null-ptr-deref in asix_suspend\n\nWhen asix_suspend() is called dev-\u003edriver_priv might not have been\nassigned a value, so we need to check that it\u0027s not NULL.\n\nSimilar issue is present in asix_resume(), this patch fixes it as well.\n\nFound by syzkaller.\n\nkasan: CONFIG_KASAN_INLINE enabled\nkasan: GPF could be caused by NULL-ptr deref or user memory access\ngeneral protection fault: 0000 [#1] PREEMPT SMP KASAN\nModules linked in:\nCPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.14.0-rc4-43422-geccacdd69a8c #400\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\nWorkqueue: usb_hub_wq hub_event\ntask: ffff88006bb36300 task.stack: ffff88006bba8000\nRIP: 0010:asix_suspend+0x76/0xc0 drivers/net/usb/asix_devices.c:629\nRSP: 0018:ffff88006bbae718 EFLAGS: 00010202\nRAX: dffffc0000000000 RBX: ffff880061ba3b80 RCX: 1ffff1000c34d644\nRDX: 0000000000000001 RSI: 0000000000000402 RDI: 0000000000000008\nRBP: ffff88006bbae738 R08: 1ffff1000d775cad R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff8800630a8b40\nR13: 0000000000000000 R14: 0000000000000402 R15: ffff880061ba3b80\nFS:  0000000000000000(0000) GS:ffff88006c600000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ff33cf89000 CR3: 0000000061c0a000 CR4: 00000000000006f0\nCall Trace:\n usb_suspend_interface drivers/usb/core/driver.c:1209\n usb_suspend_both+0x27f/0x7e0 drivers/usb/core/driver.c:1314\n usb_runtime_suspend+0x41/0x120 drivers/usb/core/driver.c:1852\n __rpm_callback+0x339/0xb60 drivers/base/power/runtime.c:334\n rpm_callback+0x106/0x220 drivers/base/power/runtime.c:461\n rpm_suspend+0x465/0x1980 drivers/base/power/runtime.c:596\n __pm_runtime_suspend+0x11e/0x230 drivers/base/power/runtime.c:1009\n pm_runtime_put_sync_autosuspend ./include/linux/pm_runtime.h:251\n usb_new_device+0xa37/0x1020 drivers/usb/core/hub.c:2487\n hub_port_connect drivers/usb/core/hub.c:4903\n hub_port_connect_change drivers/usb/core/hub.c:5009\n port_event drivers/usb/core/hub.c:5115\n hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195\n process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119\n worker_thread+0x221/0x1850 kernel/workqueue.c:2253\n kthread+0x3a1/0x470 kernel/kthread.c:231\n ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431\nCode: 8d 7c 24 20 48 89 fa 48 c1 ea 03 80 3c 02 00 75 5b 48 b8 00 00\n00 00 00 fc ff df 4d 8b 6c 24 20 49 8d 7d 08 48 89 fa 48 c1 ea 03 \u003c80\u003e\n3c 02 00 75 34 4d 8b 6d 08 4d 85 ed 74 0b e8 26 2b 51 fd 4c\nRIP: asix_suspend+0x76/0xc0 RSP: ffff88006bbae718\n---[ end trace dfc4f5649284342c ]---\n\nSigned-off-by: Andrey Konovalov \u003candreyknvl@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "1a8e6b48fbf534028ce4031d0d035e7e72779cef",
      "tree": "c430fcd655ebf5887a7691893243b0e2ebf2e2b4",
      "parents": [
        "0de0add10e587effa880c741c9413c874f16be91"
      ],
      "author": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 09:21:44 2017 +0900"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Thu Nov 09 09:21:44 2017 +0900"
      },
      "message": "Revert \"net: usb: asix: fill null-ptr-deref in asix_suspend\"\n\nThis reverts commit baedf68a068ca29624f241426843635920f16e1d.\n\nThere is an updated version of this fix which covers\nthe problem more thoroughly.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "e029b9bf1221f200319541cd6861912b89345665",
      "tree": "6be5266edbba881b0fa3a80280c8d514af3993eb",
      "parents": [
        "71630b7a832f699d6a6764ae75797e4e743ae348",
        "d62d813c0d714a2d0aaf3d796a7a51ae60bf5470"
      ],
      "author": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Thu Nov 09 00:07:56 2017 +0100"
      },
      "committer": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Thu Nov 09 00:07:56 2017 +0100"
      },
      "message": "Merge branch \u0027pm-cpufreq-sched\u0027\n\n* pm-cpufreq-sched:\n  cpufreq: schedutil: Examine the correct CPU when we update util\n"
    },
    {
      "commit": "87df26175e67c26ccdd3a002fbbb8cde78e28a19",
      "tree": "3911c372b93712e2d8951f1e784693a67af4e237",
      "parents": [
        "d6a2cf07f0c91e339d2c53f1e1ca6e731af2e72a"
      ],
      "author": {
        "name": "Jiri Kosina",
        "email": "jkosina@suse.cz",
        "time": "Wed Nov 08 21:18:18 2017 +0100"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Nov 08 13:52:36 2017 -0800"
      },
      "message": "x86/mm: Unbreak modules that rely on external PAGE_KERNEL availability\n\nCommit 7744ccdbc16f0 (\"x86/mm: Add Secure Memory Encryption (SME)\nsupport\") as a side-effect made PAGE_KERNEL all of a sudden unavailable\nto modules which can\u0027t make use of EXPORT_SYMBOL_GPL() symbols.\n\nThis is because once SME is enabled, sme_me_mask (which is introduced as\nEXPORT_SYMBOL_GPL) makes its way to PAGE_KERNEL through _PAGE_ENC,\ncausing imminent build failure for all the modules which make use of all\nthe EXPORT-SYMBOL()-exported API (such as vmap(), __vmalloc(),\nremap_pfn_range(), ...).\n\nExporting (as EXPORT_SYMBOL()) interfaces (and having done so for ages)\nthat take pgprot_t argument, while making it impossible to -- all of a\nsudden -- pass PAGE_KERNEL to it, feels rather incosistent.\n\nRestore the original behavior and make it possible to pass PAGE_KERNEL\nto all its EXPORT_SYMBOL() consumers.\n\n[ This is all so not wonderful. We shouldn\u0027t need that \"sme_me_mask\"\n  access at all in all those places that really don\u0027t care about that\n  level of detail, and just want _PAGE_KERNEL or whatever.\n\n  We have some similar issues with _PAGE_CACHE_WP and _PAGE_NOCACHE,\n  both of which hide a \"cachemode2protval()\" call, and which also ends\n  up using another EXPORT_SYMBOL(), but at least that only triggers for\n  the much more rare cases.\n\n  Maybe we could move these dynamic page table bits to be generated much\n  deeper down in the VM layer, instead of hiding them in the macros that\n  everybody uses.\n\n  So this all would merit some cleanup. But not today.   - Linus ]\n\nCc: Tom Lendacky \u003cthomas.lendacky@amd.com\u003e\nSigned-off-by: Jiri Kosina \u003cjkosina@suse.cz\u003e\nDespised-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "d0cd64b02aa854d68ce517cb7da1fe4e4fff2653",
      "tree": "418bb9bd443c622bb0737a30860de5a883ef4d92",
      "parents": [
        "a743bbeef27b9176987ec0cb7f906ab0ab52d1da"
      ],
      "author": {
        "name": "Yonghong Song",
        "email": "yhs@fb.com",
        "time": "Wed Nov 08 11:28:45 2017 -0800"
      },
      "committer": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Wed Nov 08 21:05:23 2017 +0100"
      },
      "message": "x86/idt: Remove X86_TRAP_BP initialization in idt_setup_traps()\n\nCommit b70543a0b2b6(\"x86/idt: Move regular trap init to tables\") moves\nregular trap init for each trap vector into a table based\ninitialization. It introduced the initialization for vector X86_TRAP_BP\nwhich was not in the code which it replaced. This breaks uprobe\nfunctionality for x86_32; the probed program segfaults instead of handling\nthe probe proper.\n\nThe reason for this is that TRAP_BP is set up as system interrupt gate\n(DPL3) in the early IDT and then replaced by a regular interrupt gate\n(DPL0) in idt_setup_traps(). The DPL0 restriction causes the int3 trap\nto fail with a #GP resulting in a SIGSEGV of the probed program.\n\nOn 64bit this does not cause a problem because the IDT entry is replaced\nwith a system interrupt gate (DPL3) with interrupt stack afterwards.\n\nRemove X86_TRAP_BP from the def_idts table which is used in\nidt_setup_traps(). Remove a redundant entry for X86_TRAP_NMI in def_idts\nwhile at it. Tested on both x86_64 and x86_32.\n\n[ tglx: Amended changelog with a description of the root cause ]\n\nFixes: b70543a0b2b6(\"x86/idt: Move regular trap init to tables\")\nReported-and-tested-by: Yonghong Song \u003cyhs@fb.com\u003e\nSigned-off-by: Yonghong Song \u003cyhs@fb.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: a.p.zijlstra@chello.nl\nCc: ast@fb.com\nCc: oleg@redhat.com\nCc: luto@kernel.org\nCc: kernel-team@fb.com\nLink: https://lkml.kernel.org/r/20171108192845.552709-1-yhs@fb.com\n\n"
    },
    {
      "commit": "d6a2cf07f0c91e339d2c53f1e1ca6e731af2e72a",
      "tree": "191177732b23ff3e4dedac329372349bb6ba46f5",
      "parents": [
        "f7dc4c9a855a13dbb33294c9fc94f17af03f6291",
        "624f5ab8720b3371367327a822c267699c1823b8"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Nov 08 11:21:52 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Nov 08 11:21:52 2017 -0800"
      },
      "message": "Merge branch \u0027fixes-v4.14-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security\n\nPull key handling fix from James Morris:\n \"Fix by Eric Biggers for the keys subsystem\"\n\n* \u0027fixes-v4.14-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:\n  KEYS: fix NULL pointer dereference during ASN.1 parsing [ver #2]\n"
    },
    {
      "commit": "f7dc4c9a855a13dbb33294c9fc94f17af03f6291",
      "tree": "9ce322841e592dae220139d91d5e48e555987a70",
      "parents": [
        "fbc3edf7d7731d7a22c483c679700589bab936a3"
      ],
      "author": {
        "name": "John Johansen",
        "email": "john.johansen@canonical.com",
        "time": "Wed Nov 08 08:09:52 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Nov 08 10:56:22 2017 -0800"
      },
      "message": "apparmor: fix off-by-one comparison on MAXMAPPED_SIG\n\nThis came in yesterday, and I have verified our regression tests\nwere missing this and it can cause an oops. Please apply.\n\nThere is a an off-by-one comparision on sig against MAXMAPPED_SIG\nthat can lead to a read outside the sig_map array if sig\nis MAXMAPPED_SIG. Fix this.\n\nVerified that the check is an out of bounds case that can cause an oops.\n\nRevised: add comparison fix to second case\nFixes: cd1dbf76b23d (\"apparmor: add the ability to mediate signals\")\nSigned-off-by: Colin Ian King \u003ccolin.king@canonical.com\u003e\nSigned-off-by: John Johansen \u003cjohn.johansen@canonical.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "423a8a942e95493b73228ba6a3f176dcc7f35fa9",
      "tree": "f23761f8b0b2f1d9010a1f2872f3e64e105baae6",
      "parents": [
        "40a4884512d5bf9ed3a9cb162b8a7ec3306b6cfc"
      ],
      "author": {
        "name": "Chris Wilson",
        "email": "chris@chris-wilson.co.uk",
        "time": "Mon Nov 06 21:11:28 2017 +0000"
      },
      "committer": {
        "name": "Rodrigo Vivi",
        "email": "rodrigo.vivi@intel.com",
        "time": "Wed Nov 08 10:20:29 2017 -0800"
      },
      "message": "drm/i915: Deconstruct struct sgt_dma initialiser\n\ngcc-4.4 complains about:\n\n\tstruct sgt_dma iter \u003d {\n\t\t.sg \u003d vma-\u003epages-\u003esgl,\n\t\t.dma \u003d sg_dma_address(iter.sg),\n\t\t.max \u003d iter.dma + iter.sg-\u003elength,\n\t};\n\ndrivers/gpu/drm/i915/i915_gem_gtt.c: In function ‘gen8_ppgtt_insert_4lvl’:\ndrivers/gpu/drm/i915/i915_gem_gtt.c:938: error: ‘iter.sg’ is used uninitialized in this function\ndrivers/gpu/drm/i915/i915_gem_gtt.c:939: error: ‘iter.dma’ is used uninitialized in this function\n\nand worse generates invalid code that triggers a GPF:\n\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000010\nIP: gen8_ppgtt_insert_4lvl+0x1b/0x1e0 [i915]\nPGD 0\nOops: 0000 [#1] SMP\nModules linked in: snd_aloop nf_conntrack_ipv6 nf_defrag_ipv6 nf_log_ipv6 ip6table_filter ip6_tables ctr ccm xt_state nf_log_ipv4\nnf_log_common xt_LOG xt_limit xt_recent xt_owner xt_addrtype iptable_filter ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat\nnf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack libcrc32c ip_tables dm_mod vhost_net macvtap macvlan vhost tun kvm_intel kvm\nirqbypass uas usb_storage hid_multitouch btusb btrtl uvcvideo videobuf2_v4l2 videobuf2_core videodev media videobuf2_vmalloc videobuf2_memops\nsg ppdev dell_wmi sparse_keymap mei_wdt sd_mod iTCO_wdt iTCO_vendor_support rtsx_pci_ms memstick rtsx_pci_sdmmc mmc_core dell_smm_hwmon hwmon\ndell_laptop dell_smbios dcdbas joydev input_leds hci_uart btintel btqca btbcm bluetooth parport_pc parport i2c_hid\n  intel_lpss_acpi intel_lpss pcspkr wmi int3400_thermal acpi_thermal_rel dell_rbtn mei_me mei snd_hda_codec_hdmi snd_hda_codec_realtek\nsnd_hda_codec_generic ahci libahci acpi_pad xhci_pci xhci_hcd snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device\nsnd_pcm snd_timer snd soundcore int3403_thermal arc4 e1000e ptp pps_core i2c_i801 iwlmvm mac80211 rtsx_pci iwlwifi cfg80211 rfkill\nintel_pch_thermal processor_thermal_device int340x_thermal_zone intel_soc_dts_iosf i915 video fjes\nCPU: 2 PID: 2408 Comm: X Not tainted 4.10.0-rc5+ #1\nHardware name: Dell Inc. Latitude E7470/0T6HHJ, BIOS 1.11.3 11/09/2016\ntask: ffff880219fe4740 task.stack: ffffc90005f98000\nRIP: 0010:gen8_ppgtt_insert_4lvl+0x1b/0x1e0 [i915]\nRSP: 0018:ffffc90005f9b8c8 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff8802167d8000 RCX: 0000000000000001\nRDX: 00000000ffff7000 RSI: ffff880219f94140 RDI: ffff880228444000\nRBP: ffffc90005f9b948 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000080\nR13: 0000000000000001 R14: ffffc90005f9bcd7 R15: ffff88020c9a83c0\nFS:  00007fb53e1ee920(0000) GS:ffff88024dd00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000010 CR3: 000000022ef95000 CR4: 00000000003406e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n  ppgtt_bind_vma+0x40/0x50 [i915]\n  i915_vma_bind+0xcb/0x1c0 [i915]\n  __i915_vma_do_pin+0x6e/0xd0 [i915]\n  i915_gem_execbuffer_reserve_vma+0x162/0x1d0 [i915]\n  i915_gem_execbuffer_reserve+0x4fc/0x510 [i915]\n  ? __kmalloc+0x134/0x250\n  ? i915_gem_wait_for_error+0x25/0x100 [i915]\n  ? i915_gem_wait_for_error+0x25/0x100 [i915]\n  i915_gem_do_execbuffer+0x2df/0xa00 [i915]\n  ? drm_malloc_gfp.clone.0+0x42/0x80 [i915]\n  ? path_put+0x22/0x30\n  ? __check_object_size+0x62/0x1f0\n  ? terminate_walk+0x44/0x90\n  i915_gem_execbuffer2+0x95/0x1e0 [i915]\n  drm_ioctl+0x243/0x490\n  ? handle_pte_fault+0x1d7/0x220\n  ? i915_gem_do_execbuffer+0xa00/0xa00 [i915]\n  ? handle_mm_fault+0x10d/0x2a0\n  vfs_ioctl+0x18/0x30\n  do_vfs_ioctl+0x14b/0x3f0\n  SyS_ioctl+0x92/0xa0\n  entry_SYSCALL_64_fastpath+0x1a/0xa9\nRIP: 0033:0x7fb53b4fcb77\nRSP: 002b:00007ffe0c572898 EFLAGS: 00003246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007fb53e17c038 RCX: 00007fb53b4fcb77\nRDX: 00007ffe0c572900 RSI: 0000000040406469 RDI: 000000000000000b\nRBP: 00007fb5376d67e0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000028 R11: 0000000000003246 R12: 0000000000000000\nR13: 0000000000000000 R14: 000055eecb314d00 R15: 000055eecb315460\nCode: 0f 84 5d ff ff ff eb a2 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 58 0f 1f 44 00 00 31 c0 89 4d b0 \u003c4c\u003e\n8b 60 10 44 8b 70 0c 48 89 d0 4c 8b 2e 48 c1 e8 27 25 ff 01\nRIP: gen8_ppgtt_insert_4lvl+0x1b/0x1e0 [i915] RSP: ffffc90005f9b8c8\nCR2: 0000000000000010\n\nRecent gccs, such as 4.9, 6.3 or 7.2, do not generate the warning nor do\nthey explode on use. If we manually create the struct using locals from\nthe stack, this should eliminate this issue, and does not alter code\ngeneration with gcc-7.2.\n\nFixes: 894ccebee2b0 (\"drm/i915: Micro-optimise gen8_ppgtt_insert_entries()\")\nReported-by: Kelly French \u003ckfrench@federalhill.net\u003e\nSigned-off-by: Chris Wilson \u003cchris@chris-wilson.co.uk\u003e\nCc: Kelly French \u003ckfrench@federalhill.net\u003e\nCc: Mika Kuoppala \u003cmika.kuoppala@intel.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20171106211128.12538-1-chris@chris-wilson.co.uk\nTested-by: Kelly French \u003ckfrench@federalhill.net\u003e\nReviewed-by: Tvrtko Ursulin \u003ctvrtko.ursulin@intel.com\u003e\n(cherry picked from commit 5684514ba9dc6d7aa932cc53d97d866b2386221f)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n"
    },
    {
      "commit": "40a4884512d5bf9ed3a9cb162b8a7ec3306b6cfc",
      "tree": "da0b4156263cba25b94ee051ccace5df4e9eedb5",
      "parents": [
        "39dae59d66acd86d1de24294bd2f343fd5e7a625"
      ],
      "author": {
        "name": "Tvrtko Ursulin",
        "email": "tvrtko.ursulin@intel.com",
        "time": "Tue Oct 31 10:23:25 2017 +0000"
      },
      "committer": {
        "name": "Rodrigo Vivi",
        "email": "rodrigo.vivi@intel.com",
        "time": "Wed Nov 08 10:19:45 2017 -0800"
      },
      "message": "drm/i915: Reject unknown syncobj flags\n\nWe have to reject unknown flags for uAPI considerations, and also\nbecause the curent implementation limits their i915 storage space\nto two bits.\n\nv2: (Chris Wilson)\n * Fix fail in ABI check.\n * Added unknown flags and BUILD_BUG_ON.\n\nv3:\n * Use ARCH_KMALLOC_MINALIGN instead of alignof. (Chris Wilson)\n\nSigned-off-by: Tvrtko Ursulin \u003ctvrtko.ursulin@intel.com\u003e\nFixes: cf6e7bac6357 (\"drm/i915: Add support for drm syncobjs\")\nCc: Jason Ekstrand \u003cjason@jlekstrand.net\u003e\nCc: Chris Wilson \u003cchris@chris-wilson.co.uk\u003e\nCc: Jani Nikula \u003cjani.nikula@linux.intel.com\u003e\nCc: Joonas Lahtinen \u003cjoonas.lahtinen@linux.intel.com\u003e\nCc: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nCc: David Airlie \u003cairlied@linux.ie\u003e\nCc: intel-gfx@lists.freedesktop.org\nCc: dri-devel@lists.freedesktop.org\nReviewed-by: Chris Wilson \u003cchris@chris-wilson.co.uk\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20171031102326.9738-1-tvrtko.ursulin@linux.intel.com\n(cherry picked from commit ebcaa1ff8b59097805d548fe7a676f194625c033)\nSigned-off-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\n"
    },
    {
      "commit": "b084116f8587b222a2c5ef6dcd846f40f24b9420",
      "tree": "419c610571b9ee880d39b66b84f18f9506c4c2ef",
      "parents": [
        "e6b03ab63b4d270e0249f96536fde632409dc1dc"
      ],
      "author": {
        "name": "Oswald Buddenhagen",
        "email": "oswald.buddenhagen@gmx.de",
        "time": "Sun Oct 29 16:27:20 2017 +0100"
      },
      "committer": {
        "name": "James Hogan",
        "email": "jhogan@kernel.org",
        "time": "Wed Nov 08 14:57:55 2017 +0000"
      },
      "message": "MIPS: AR7: Ensure that serial ports are properly set up\n\nWithout UPF_FIXED_TYPE, the data from the PORT_AR7 uart_config entry is\nnever copied, resulting in a dead port.\n\nFixes: 154615d55459 (\"MIPS: AR7: Use correct UART port type\")\nSigned-off-by: Oswald Buddenhagen \u003coswald.buddenhagen@gmx.de\u003e\n[jonas.gorski: add Fixes tag]\nSigned-off-by: Jonas Gorski \u003cjonas.gorski@gmail.com\u003e\nReviewed-by: Florian Fainelli \u003cf.fainelli@gmail.com\u003e\nCc: Ralf Baechle \u003cralf@linux-mips.org\u003e\nCc: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nCc: Yoshihiro YUNOMAE \u003cyoshihiro.yunomae.ez@hitachi.com\u003e\nCc: Nicolas Schichan \u003cnschichan@freebox.fr\u003e\nCc: Oswald Buddenhagen \u003coswald.buddenhagen@gmx.de\u003e\nCc: linux-mips@linux-mips.org\nCc: linux-serial@vger.kernel.org\nCc: \u003cstable@vger.kernel.org\u003e\nPatchwork: https://patchwork.linux-mips.org/patch/17543/\nSigned-off-by: James Hogan \u003cjhogan@kernel.org\u003e\n"
    },
    {
      "commit": "6b7be529634bbfbf6395f23217a66d731fbed0a0",
      "tree": "27fcfd83b860fd989b177ce9ad492afd433ad311",
      "parents": [
        "e806fa6bad186d7d353509b5a909abcf3a1e968b"
      ],
      "author": {
        "name": "Bjorn Helgaas",
        "email": "bhelgaas@google.com",
        "time": "Wed Nov 08 08:49:49 2017 -0600"
      },
      "committer": {
        "name": "Bjorn Helgaas",
        "email": "bhelgaas@google.com",
        "time": "Wed Nov 08 08:49:49 2017 -0600"
      },
      "message": "MAINTAINERS: Add Lorenzo Pieralisi for PCI host bridge drivers\n\nAdd Lorenzo Pieralisi as maintainer for PCI native host bridge drivers and\nthe endpoint driver framework.\n\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nAcked-by: Lorenzo Pieralisi \u003clorenzo.pieralisi@arm.com\u003e"
    },
    {
      "commit": "624f5ab8720b3371367327a822c267699c1823b8",
      "tree": "91db804547747274e274444faad34edd9f92a0ad",
      "parents": [
        "fbc3edf7d7731d7a22c483c679700589bab936a3"
      ],
      "author": {
        "name": "Eric Biggers",
        "email": "ebiggers@google.com",
        "time": "Tue Nov 07 22:29:02 2017 +0000"
      },
      "committer": {
        "name": "James Morris",
        "email": "james.l.morris@oracle.com",
        "time": "Thu Nov 09 00:38:21 2017 +1100"
      },
      "message": "KEYS: fix NULL pointer dereference during ASN.1 parsing [ver #2]\n\nsyzkaller reported a NULL pointer dereference in asn1_ber_decoder().  It\ncan be reproduced by the following command, assuming\nCONFIG_PKCS7_TEST_KEY\u003dy:\n\n        keyctl add pkcs7_test desc \u0027\u0027 @s\n\nThe bug is that if the data buffer is empty, an integer underflow occurs\nin the following check:\n\n        if (unlikely(dp \u003e\u003d datalen - 1))\n                goto data_overrun_error;\n\nThis results in the NULL data pointer being dereferenced.\n\nFix it by checking for \u0027datalen - dp \u003c 2\u0027 instead.\n\nAlso fix the similar check for \u0027dp \u003e\u003d datalen - n\u0027 later in the same\nfunction.  That one possibly could result in a buffer overread.\n\nThe NULL pointer dereference was reproducible using the \"pkcs7_test\" key\ntype but not the \"asymmetric\" key type because the \"asymmetric\" key type\nchecks for a 0-length payload before calling into the ASN.1 decoder but\nthe \"pkcs7_test\" key type does not.\n\nThe bug report was:\n\n    BUG: unable to handle kernel NULL pointer dereference at           (null)\n    IP: asn1_ber_decoder+0x17f/0xe60 lib/asn1_decoder.c:233\n    PGD 7b708067 P4D 7b708067 PUD 7b6ee067 PMD 0\n    Oops: 0000 [#1] SMP\n    Modules linked in:\n    CPU: 0 PID: 522 Comm: syz-executor1 Not tainted 4.14.0-rc8 #7\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.3-20171021_125229-anatol 04/01/2014\n    task: ffff9b6b3798c040 task.stack: ffff9b6b37970000\n    RIP: 0010:asn1_ber_decoder+0x17f/0xe60 lib/asn1_decoder.c:233\n    RSP: 0018:ffff9b6b37973c78 EFLAGS: 00010216\n    RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000021c\n    RDX: ffffffff814a04ed RSI: ffffb1524066e000 RDI: ffffffff910759e0\n    RBP: ffff9b6b37973d60 R08: 0000000000000001 R09: ffff9b6b3caa4180\n    R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002\n    R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n    FS:  00007f10ed1f2700(0000) GS:ffff9b6b3ea00000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    CR2: 0000000000000000 CR3: 000000007b6f3000 CR4: 00000000000006f0\n    Call Trace:\n     pkcs7_parse_message+0xee/0x240 crypto/asymmetric_keys/pkcs7_parser.c:139\n     verify_pkcs7_signature+0x33/0x180 certs/system_keyring.c:216\n     pkcs7_preparse+0x41/0x70 crypto/asymmetric_keys/pkcs7_key_type.c:63\n     key_create_or_update+0x180/0x530 security/keys/key.c:855\n     SYSC_add_key security/keys/keyctl.c:122 [inline]\n     SyS_add_key+0xbf/0x250 security/keys/keyctl.c:62\n     entry_SYSCALL_64_fastpath+0x1f/0xbe\n    RIP: 0033:0x4585c9\n    RSP: 002b:00007f10ed1f1bd8 EFLAGS: 00000216 ORIG_RAX: 00000000000000f8\n    RAX: ffffffffffffffda RBX: 00007f10ed1f2700 RCX: 00000000004585c9\n    RDX: 0000000020000000 RSI: 0000000020008ffb RDI: 0000000020008000\n    RBP: 0000000000000000 R08: ffffffffffffffff R09: 0000000000000000\n    R10: 0000000000000000 R11: 0000000000000216 R12: 00007fff1b2260ae\n    R13: 00007fff1b2260af R14: 00007f10ed1f2700 R15: 0000000000000000\n    Code: dd ca ff 48 8b 45 88 48 83 e8 01 4c 39 f0 0f 86 a8 07 00 00 e8 53 dd ca ff 49 8d 46 01 48 89 85 58 ff ff ff 48 8b 85 60 ff ff ff \u003c42\u003e 0f b6 0c 30 89 c8 88 8d 75 ff ff ff 83 e0 1f 89 8d 28 ff ff\n    RIP: asn1_ber_decoder+0x17f/0xe60 lib/asn1_decoder.c:233 RSP: ffff9b6b37973c78\n    CR2: 0000000000000000\n\nFixes: 42d5ec27f873 (\"X.509: Add an ASN.1 decoder\")\nReported-by: syzbot \u003csyzkaller@googlegroups.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v3.7+\nSigned-off-by: Eric Biggers \u003cebiggers@google.com\u003e\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n"
    },
    {
      "commit": "d850a255d5b961fbe085f06ddd116910378b78f1",
      "tree": "c59464a7393d850367fe37227f899b55c18d8c45",
      "parents": [
        "39dae59d66acd86d1de24294bd2f343fd5e7a625",
        "38c53af853069adf87181684370d7b8866d6387b"
      ],
      "author": {
        "name": "Radim Krčmář",
        "email": "rkrcmar@redhat.com",
        "time": "Wed Nov 08 14:08:59 2017 +0100"
      },
      "committer": {
        "name": "Radim Krčmář",
        "email": "rkrcmar@redhat.com",
        "time": "Wed Nov 08 14:08:59 2017 +0100"
      },
      "message": "Merge tag \u0027kvm-ppc-fixes-4.14-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc\n\nPPC KVM fixes for 4.14\n\nJust one fix here for a host crash that can occur with HV KVM\nas a result of resizing the guest hashed page table (HPT).\n"
    },
    {
      "commit": "e6b03ab63b4d270e0249f96536fde632409dc1dc",
      "tree": "25e5e31c20e38bab9fdb7e50e04055396f42a5b9",
      "parents": [
        "ea4b3afe1eac8f88bb453798a084fba47a1f155a"
      ],
      "author": {
        "name": "Jonas Gorski",
        "email": "jonas.gorski@gmail.com",
        "time": "Sun Oct 29 16:27:19 2017 +0100"
      },
      "committer": {
        "name": "James Hogan",
        "email": "jhogan@kernel.org",
        "time": "Wed Nov 08 12:44:26 2017 +0000"
      },
      "message": "MIPS: AR7: Defer registration of GPIO\n\nWhen called from prom init code, ar7_gpio_init() will fail as it will\ncall gpiochip_add() which relies on a working kmalloc() to alloc\nthe gpio_desc array and kmalloc is not useable yet at prom init time.\n\nMove ar7_gpio_init() to ar7_register_devices() (a device_initcall)\nwhere kmalloc works.\n\nFixes: 14e85c0e69d5 (\"gpio: remove gpio_descs global array\")\nSigned-off-by: Jonas Gorski \u003cjonas.gorski@gmail.com\u003e\nReviewed-by: Florian Fainelli \u003cf.fainelli@gmail.com\u003e\nCc: Ralf Baechle \u003cralf@linux-mips.org\u003e\nCc: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nCc: Yoshihiro YUNOMAE \u003cyoshihiro.yunomae.ez@hitachi.com\u003e\nCc: Nicolas Schichan \u003cnschichan@freebox.fr\u003e\nCc: linux-mips@linux-mips.org\nCc: linux-serial@vger.kernel.org\nCc: \u003cstable@vger.kernel.org\u003e # 3.19+\nPatchwork: https://patchwork.linux-mips.org/patch/17542/\nSigned-off-by: James Hogan \u003cjhogan@kernel.org\u003e\n"
    },
    {
      "commit": "a743bbeef27b9176987ec0cb7f906ab0ab52d1da",
      "tree": "9eba6a03580df5766aff919ba38c0ae4d4a5ed80",
      "parents": [
        "881125bfe65bb772f34f4fcb04a35dfe117e186a"
      ],
      "author": {
        "name": "Borislav Petkov",
        "email": "bp@suse.de",
        "time": "Tue Nov 07 18:53:07 2017 +0100"
      },
      "committer": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Wed Nov 08 13:01:54 2017 +0100"
      },
      "message": "x86/oprofile/ppro: Do not use __this_cpu*() in preemptible context\n\nThe warning below says it all:\n\n  BUG: using __this_cpu_read() in preemptible [00000000] code: swapper/0/1\n  caller is __this_cpu_preempt_check\n  CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.14.0-rc8 #4\n  Call Trace:\n   dump_stack\n   check_preemption_disabled\n   ? do_early_param\n   __this_cpu_preempt_check\n   arch_perfmon_init\n   op_nmi_init\n   ? alloc_pci_root_info\n   oprofile_arch_init\n   oprofile_init\n   do_one_initcall\n   ...\n\nThese accessors should not have been used in the first place: it is PPro so\nno mixed silicon revisions and thus it can simply use boot_cpu_data.\n\nReported-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nTested-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nFix-creation-mandated-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Borislav Petkov \u003cbp@suse.de\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Robert Richter \u003crric@kernel.org\u003e\nCc: x86@kernel.org\nCc: stable@vger.kernel.org\n"
    },
    {
      "commit": "881125bfe65bb772f34f4fcb04a35dfe117e186a",
      "tree": "4a8c871fc19400c6ac7500c090c8783754a8f23b",
      "parents": [
        "76ce7cfe35ef58f34e6ba85327afb5fbf6c3ff9b"
      ],
      "author": {
        "name": "Josh Poimboeuf",
        "email": "jpoimboe@redhat.com",
        "time": "Tue Nov 07 20:19:34 2017 -0600"
      },
      "committer": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Wed Nov 08 10:21:49 2017 +0100"
      },
      "message": "x86/unwind: Disable KASAN checking in the ORC unwinder\n\nFengguang reported a KASAN warning:\n\n  Kprobe smoke test: started\n  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n  BUG: KASAN: stack-out-of-bounds in deref_stack_reg+0xb5/0x11a\n  Read of size 8 at addr ffff8800001c7cd8 by task swapper/1\n\n  CPU: 0 PID: 1 Comm: swapper Not tainted 4.14.0-rc8 #26\n  Call Trace:\n   \u003c#DB\u003e\n   ...\n   save_trace+0xd9/0x1d3\n   mark_lock+0x5f7/0xdc3\n   __lock_acquire+0x6b4/0x38ef\n   lock_acquire+0x1a1/0x2aa\n   _raw_spin_lock_irqsave+0x46/0x55\n   kretprobe_table_lock+0x1a/0x42\n   pre_handler_kretprobe+0x3f5/0x521\n   kprobe_int3_handler+0x19c/0x25f\n   do_int3+0x61/0x142\n   int3+0x30/0x60\n  [...]\n\nThe ORC unwinder got confused by some kprobes changes, which isn\u0027t\nsurprising since the runtime code no longer matches vmlinux and the\nstack was modified for kretprobes.\n\nUntil we have a way for generated code to register changes with the\nunwinder, these types of warnings are inevitable.  So just disable KASAN\nchecks for stack accesses in the ORC unwinder.\n\nReported-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nSigned-off-by: Josh Poimboeuf \u003cjpoimboe@redhat.com\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Thiago Jung Bauermann \u003cbauerman@linux.vnet.ibm.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nLink: http://lkml.kernel.org/r/20171108021934.zbl6unh5hpugybc5@treble\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n"
    },
    {
      "commit": "0de0add10e587effa880c741c9413c874f16be91",
      "tree": "b90356c3c5203bb30b97a6ebb42c014027225cf0",
      "parents": [
        "055db6957e4735b16cd2fa94a5bbfb754c9b8023"
      ],
      "author": {
        "name": "Kristian Evensen",
        "email": "kristian.evensen@gmail.com",
        "time": "Tue Nov 07 13:47:56 2017 +0100"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Wed Nov 08 16:10:30 2017 +0900"
      },
      "message": "qmi_wwan: Add missing skb_reset_mac_header-call\n\nWhen we receive a packet on a QMI device in raw IP mode, we should call\nskb_reset_mac_header() to ensure that skb-\u003emac_header contains a valid\noffset in the packet. While it shouldn\u0027t really matter, the packets have\nno MAC header and the interface is configured as-such, it seems certain\nparts of the network stack expects a \"good\" value in skb-\u003emac_header.\n\nWithout the skb_reset_mac_header() call added in this patch, for example\nshaping traffic (using tc) triggers the following oops on the first\nreceived packet:\n\n[  303.642957] skbuff: skb_under_panic: text:8f137918 len:177 put:67 head:8e4b0f00 data:8e4b0eff tail:0x8e4b0fb0 end:0x8e4b1520 dev:wwan0\n[  303.655045] Kernel bug detected[#1]:\n[  303.658622] CPU: 1 PID: 1002 Comm: logd Not tainted 4.9.58 #0\n[  303.664339] task: 8fdf05e0 task.stack: 8f15c000\n[  303.668844] $ 0   : 00000000 00000001 0000007a 00000000\n[  303.674062] $ 4   : 8149a2fc 8149a2fc 8149ce20 00000000\n[  303.679284] $ 8   : 00000030 3878303a 31623465 20303235\n[  303.684510] $12   : ded731e3 2626a277 00000000 03bd0000\n[  303.689747] $16   : 8ef62b40 00000043 8f137918 804db5fc\n[  303.694978] $20   : 00000001 00000004 8fc13800 00000003\n[  303.700215] $24   : 00000001 8024ab10\n[  303.705442] $28   : 8f15c000 8fc19cf0 00000043 802cc920\n[  303.710664] Hi    : 00000000\n[  303.713533] Lo    : 74e58000\n[  303.716436] epc   : 802cc920 skb_panic+0x58/0x5c\n[  303.721046] ra    : 802cc920 skb_panic+0x58/0x5c\n[  303.725639] Status: 11007c03 KERNEL EXL IE\n[  303.729823] Cause : 50800024 (ExcCode 09)\n[  303.733817] PrId  : 0001992f (MIPS 1004Kc)\n[  303.737892] Modules linked in: rt2800pci rt2800mmio rt2800lib qcserial ppp_async option usb_wwan rt2x00pci rt2x00mmio rt2x00lib rndis_host qmi_wwan ppp_generic nf_nat_pptp nf_conntrack_pptp nf_conntrack_ipv6 mt76x2i\nProcess logd (pid: 1002, threadinfo\u003d8f15c000, task\u003d8fdf05e0, tls\u003d77b3eee4)\n[  303.962509] Stack : 00000000 80408990 8f137918 000000b1 00000043 8e4b0f00 8e4b0eff 8e4b0fb0\n[  303.970871]         8e4b1520 8fec1800 00000043 802cd2a4 6e000045 00000043 00000000 8ef62000\n[  303.979219]         8eef5d00 8ef62b40 8fea7300 8f137918 00000000 00000000 0002bb01 793e5664\n[  303.987568]         8ef08884 00000001 8fea7300 00000002 8fc19e80 8eef5d00 00000006 00000003\n[  303.995934]         00000000 8030ba90 00000003 77ab3fd0 8149dc80 8004d1bc 8f15c000 8f383700\n[  304.004324]         ...\n[  304.006767] Call Trace:\n[  304.009241] [\u003c802cc920\u003e] skb_panic+0x58/0x5c\n[  304.013504] [\u003c802cd2a4\u003e] skb_push+0x78/0x90\n[  304.017783] [\u003c8f137918\u003e] 0x8f137918\n[  304.021269] Code: 00602825  0c02a3b4  24842888 \u003c000c000d\u003e 8c870060  8c8200a0  0007382b  00070336  8c88005c\n[  304.031034]\n[  304.032805] ---[ end trace b778c482b3f0bda9 ]---\n[  304.041384] Kernel panic - not syncing: Fatal exception in interrupt\n[  304.051975] Rebooting in 3 seconds..\n\nWhile the oops is for a 4.9-kernel, I was able to trigger the same oops with\nnet-next as of yesterday.\n\nFixes: 32f7adf633b9 (\"net: qmi_wwan: support \"raw IP\" mode\")\nSigned-off-by: Kristian Evensen \u003ckristian.evensen@gmail.com\u003e\nAcked-by: Bjørn Mork \u003cbjorn@mork.no\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "055db6957e4735b16cd2fa94a5bbfb754c9b8023",
      "tree": "78db33199a5d1852a261f48dd0941b35a0028301",
      "parents": [
        "b7e732fa3171318418524b776b841b4024933b2b"
      ],
      "author": {
        "name": "Jay Vosburgh",
        "email": "jay.vosburgh@canonical.com",
        "time": "Tue Nov 07 19:50:07 2017 +0900"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Wed Nov 08 16:07:10 2017 +0900"
      },
      "message": "bonding: fix slave stuck in BOND_LINK_FAIL state\n\nThe bonding miimon logic has a flaw, in that a failure of the\nrtnl_trylock can cause a slave to become permanently stuck in\nBOND_LINK_FAIL state.\n\n\tThe sequence of events to cause this is as follows:\n\n\t1) bond_miimon_inspect finds that a slave\u0027s link is down, and so\ncalls bond_propose_link_state, setting slave-\u003enew_link_state to\nBOND_LINK_FAIL, then sets slave-\u003enew_link to BOND_LINK_DOWN and returns\nnon-zero.\n\n\t2) In bond_mii_monitor, the rtnl_trylock fails, and the timer is\nrescheduled.  No change is committed.\n\n\t3) bond_miimon_inspect is called again, but this time the slave\nfrom step 1 has recovered.  slave-\u003enew_link is reset to NOCHANGE, and, as\nslave-\u003elink was never changed, the switch enters the BOND_LINK_UP case,\nand does nothing.  The pending BOND_LINK_FAIL state from step 1 remains\npending, as new_link_state is not reset.\n\n\t4) The state from step 3 persists until another slave changes link\nstate and causes bond_miimon_inspect to return non-zero.  At this point,\nthe BOND_LINK_FAIL state change on the slave from steps 1-3 is committed,\nand the slave will remain stuck in BOND_LINK_FAIL state even though it\nis actually link up.\n\n\tThe remedy for this is to initialize new_link_state on each entry\nto bond_miimon_inspect, as is already done with new_link.\n\nFixes: fb9eb899a6dc (\"bonding: handle link transition from FAIL to UP correctly\")\nReported-by: Alex Sidorenko \u003calexandre.sidorenko@hpe.com\u003e\nReviewed-by: Jarod Wilson \u003cjarod@redhat.com\u003e\nSigned-off-by: Jay Vosburgh \u003cjay.vosburgh@canonical.com\u003e\nAcked-by: Mahesh Bandewar \u003cmaheshb@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "b7e732fa3171318418524b776b841b4024933b2b",
      "tree": "7ed40101ef6844da7b7c38c1c278196a912fe02c",
      "parents": [
        "7fd078337201cf7468f53c3d9ef81ff78cb6df3b"
      ],
      "author": {
        "name": "Bjorn Andersson",
        "email": "bjorn.andersson@linaro.org",
        "time": "Mon Nov 06 20:50:35 2017 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Wed Nov 08 14:32:18 2017 +0900"
      },
      "message": "qrtr: Move to postcore_initcall\n\nRegistering qrtr with module_init makes the ability of typical platform\ncode to create AF_QIPCRTR socket during probe a matter of link order\nluck. Moving qrtr to postcore_initcall() avoids this.\n\nSigned-off-by: Bjorn Andersson \u003cbjorn.andersson@linaro.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "7fd078337201cf7468f53c3d9ef81ff78cb6df3b",
      "tree": "4fb79589af21b0a4591f8902be6460f81343d09d",
      "parents": [
        "2cb80187ba065d7decad7c6614e35e07aec8a974"
      ],
      "author": {
        "name": "Bjørn Mork",
        "email": "bjorn@mork.no",
        "time": "Mon Nov 06 15:32:18 2017 +0100"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Wed Nov 08 13:42:43 2017 +0900"
      },
      "message": "net: qmi_wwan: fix divide by 0 on bad descriptors\n\nA CDC Ethernet functional descriptor with wMaxSegmentSize \u003d 0 will\ncause a divide error in usbnet_probe:\n\ndivide error: 0000 [#1] PREEMPT SMP KASAN\nModules linked in:\nCPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.14.0-rc8-44453-g1fdc1a82c34f #56\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\nWorkqueue: usb_hub_wq hub_event\ntask: ffff88006bef5c00 task.stack: ffff88006bf60000\nRIP: 0010:usbnet_update_max_qlen+0x24d/0x390 drivers/net/usb/usbnet.c:355\nRSP: 0018:ffff88006bf67508 EFLAGS: 00010246\nRAX: 00000000000163c8 RBX: ffff8800621fce40 RCX: ffff8800621fcf34\nRDX: 0000000000000000 RSI: ffffffff837ecb7a RDI: ffff8800621fcf34\nRBP: ffff88006bf67520 R08: ffff88006bef5c00 R09: ffffed000c43f881\nR10: ffffed000c43f880 R11: ffff8800621fc406 R12: 0000000000000003\nR13: ffffffff85c71de0 R14: 0000000000000000 R15: 0000000000000000\nFS:  0000000000000000(0000) GS:ffff88006ca00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ffe9c0d6dac CR3: 00000000614f4000 CR4: 00000000000006f0\nCall Trace:\n usbnet_probe+0x18b5/0x2790 drivers/net/usb/usbnet.c:1783\n qmi_wwan_probe+0x133/0x220 drivers/net/usb/qmi_wwan.c:1338\n usb_probe_interface+0x324/0x940 drivers/usb/core/driver.c:361\n really_probe drivers/base/dd.c:413\n driver_probe_device+0x522/0x740 drivers/base/dd.c:557\n\nFix by simply ignoring the bogus descriptor, as it is optional\nfor QMI devices anyway.\n\nFixes: 423ce8caab7e (\"net: usb: qmi_wwan: New driver for Huawei QMI based WWAN devices\")\nReported-by: Andrey Konovalov \u003candreyknvl@google.com\u003e\nSigned-off-by: Bjørn Mork \u003cbjorn@mork.no\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "2cb80187ba065d7decad7c6614e35e07aec8a974",
      "tree": "5eaea6c250d176f2b2f04cf13a6708f6b495c7d4",
      "parents": [
        "b5f862180d7011d9575d0499fa37f0f25b423b12"
      ],
      "author": {
        "name": "Bjørn Mork",
        "email": "bjorn@mork.no",
        "time": "Mon Nov 06 15:37:22 2017 +0100"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Wed Nov 08 13:42:01 2017 +0900"
      },
      "message": "net: cdc_ether: fix divide by 0 on bad descriptors\n\nSetting dev-\u003ehard_mtu to 0 will cause a divide error in\nusbnet_probe. Protect against devices with bogus CDC Ethernet\nfunctional descriptors by ignoring a zero wMaxSegmentSize.\n\nSigned-off-by: Bjørn Mork \u003cbjorn@mork.no\u003e\nAcked-by: Oliver Neukum \u003coneukum@suse.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "38c53af853069adf87181684370d7b8866d6387b",
      "tree": "e5f1783dbbf7f3e640525f57301a01a599737ded",
      "parents": [
        "ad98dd1a75ac6a8b68cd2f7bf4676b65734f2a43"
      ],
      "author": {
        "name": "Paul Mackerras",
        "email": "paulus@ozlabs.org",
        "time": "Wed Nov 08 14:44:04 2017 +1100"
      },
      "committer": {
        "name": "Paul Mackerras",
        "email": "paulus@ozlabs.org",
        "time": "Wed Nov 08 15:14:02 2017 +1100"
      },
      "message": "KVM: PPC: Book3S HV: Fix exclusion between HPT resizing and other HPT updates\n\nCommit 5e9859699aba (\"KVM: PPC: Book3S HV: Outline of KVM-HV HPT resizing\nimplementation\", 2016-12-20) added code that tries to exclude any use\nor update of the hashed page table (HPT) while the HPT resizing code\nis iterating through all the entries in the HPT.  It does this by\ntaking the kvm-\u003elock mutex, clearing the kvm-\u003earch.hpte_setup_done\nflag and then sending an IPI to all CPUs in the host.  The idea is\nthat any VCPU task that tries to enter the guest will see that the\nhpte_setup_done flag is clear and therefore call kvmppc_hv_setup_htab_rma,\nwhich also takes the kvm-\u003elock mutex and will therefore block until\nwe release kvm-\u003elock.\n\nHowever, any VCPU that is already in the guest, or is handling a\nhypervisor page fault or hypercall, can re-enter the guest without\nrechecking the hpte_setup_done flag.  The IPI will cause a guest exit\nof any VCPUs that are currently in the guest, but does not prevent\nthose VCPU tasks from immediately re-entering the guest.\n\nThe result is that after resize_hpt_rehash_hpte() has made a HPTE\nabsent, a hypervisor page fault can occur and make that HPTE present\nagain.  This includes updating the rmap array for the guest real page,\nmeaning that we now have a pointer in the rmap array which connects\nwith pointers in the old rev array but not the new rev array.  In\nfact, if the HPT is being reduced in size, the pointer in the rmap\narray could point outside the bounds of the new rev array.  If that\nhappens, we can get a host crash later on such as this one:\n\n[91652.628516] Unable to handle kernel paging request for data at address 0xd0000000157fb10c\n[91652.628668] Faulting instruction address: 0xc0000000000e2640\n[91652.628736] Oops: Kernel access of bad area, sig: 11 [#1]\n[91652.628789] LE SMP NR_CPUS\u003d1024 NUMA PowerNV\n[91652.628847] Modules linked in: binfmt_misc vhost_net vhost tap xt_CHECKSUM ipt_MASQUERADE nf_nat_masquerade_ipv4 ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_mangle ip6table_security ip6table_raw iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack libcrc32c iptable_mangle iptable_security iptable_raw ebtable_filter ebtables ip6table_filter ip6_tables ses enclosure scsi_transport_sas i2c_opal ipmi_powernv ipmi_devintf i2c_core ipmi_msghandler powernv_op_panel nfsd auth_rpcgss oid_registry nfs_acl lockd grace sunrpc kvm_hv kvm_pr kvm scsi_dh_alua dm_service_time dm_multipath tg3 ptp pps_core [last unloaded: stap_552b612747aec2da355051e464fa72a1_14259]\n[91652.629566] CPU: 136 PID: 41315 Comm: CPU 21/KVM Tainted: G           O    4.14.0-1.rc4.dev.gitb27fc5c.el7.centos.ppc64le #1\n[91652.629684] task: c0000007a419e400 task.stack: c0000000028d8000\n[91652.629750] NIP:  c0000000000e2640 LR: d00000000c36e498 CTR: c0000000000e25f0\n[91652.629829] REGS: c0000000028db5d0 TRAP: 0300   Tainted: G           O     (4.14.0-1.rc4.dev.gitb27fc5c.el7.centos.ppc64le)\n[91652.629932] MSR:  900000010280b033 \u003cSF,HV,VEC,VSX,EE,FP,ME,IR,DR,RI,LE,TM[E]\u003e  CR: 44022422  XER: 00000000\n[91652.630034] CFAR: d00000000c373f84 DAR: d0000000157fb10c DSISR: 40000000 SOFTE: 1\n[91652.630034] GPR00: d00000000c36e498 c0000000028db850 c000000001403900 c0000007b7960000\n[91652.630034] GPR04: d0000000117fb100 d000000007ab00d8 000000000033bb10 0000000000000000\n[91652.630034] GPR08: fffffffffffffe7f 801001810073bb10 d00000000e440000 d00000000c373f70\n[91652.630034] GPR12: c0000000000e25f0 c00000000fdb9400 f000000003b24680 0000000000000000\n[91652.630034] GPR16: 00000000000004fb 00007ff7081a0000 00000000000ec91a 000000000033bb10\n[91652.630034] GPR20: 0000000000010000 00000000001b1190 0000000000000001 0000000000010000\n[91652.630034] GPR24: c0000007b7ab8038 d0000000117fb100 0000000ec91a1190 c000001e6a000000\n[91652.630034] GPR28: 00000000033bb100 000000000073bb10 c0000007b7960000 d0000000157fb100\n[91652.630735] NIP [c0000000000e2640] kvmppc_add_revmap_chain+0x50/0x120\n[91652.630806] LR [d00000000c36e498] kvmppc_book3s_hv_page_fault+0xbb8/0xc40 [kvm_hv]\n[91652.630884] Call Trace:\n[91652.630913] [c0000000028db850] [c0000000028db8b0] 0xc0000000028db8b0 (unreliable)\n[91652.630996] [c0000000028db8b0] [d00000000c36e498] kvmppc_book3s_hv_page_fault+0xbb8/0xc40 [kvm_hv]\n[91652.631091] [c0000000028db9e0] [d00000000c36a078] kvmppc_vcpu_run_hv+0xdf8/0x1300 [kvm_hv]\n[91652.631179] [c0000000028dbb30] [d00000000c2248c4] kvmppc_vcpu_run+0x34/0x50 [kvm]\n[91652.631266] [c0000000028dbb50] [d00000000c220d54] kvm_arch_vcpu_ioctl_run+0x114/0x2a0 [kvm]\n[91652.631351] [c0000000028dbbd0] [d00000000c2139d8] kvm_vcpu_ioctl+0x598/0x7a0 [kvm]\n[91652.631433] [c0000000028dbd40] [c0000000003832e0] do_vfs_ioctl+0xd0/0x8c0\n[91652.631501] [c0000000028dbde0] [c000000000383ba4] SyS_ioctl+0xd4/0x130\n[91652.631569] [c0000000028dbe30] [c00000000000b8e0] system_call+0x58/0x6c\n[91652.631635] Instruction dump:\n[91652.631676] fba1ffe8 fbc1fff0 fbe1fff8 f8010010 f821ffa1 2fa70000 793d0020 e9432110\n[91652.631814] 7bbf26e4 7c7e1b78 7feafa14 409e0094 \u003c807f000c\u003e 786326e4 7c6a1a14 93a40008\n[91652.631959] ---[ end trace ac85ba6db72e5b2e ]---\n\nTo fix this, we tighten up the way that the hpte_setup_done flag is\nchecked to ensure that it does provide the guarantee that the resizing\ncode needs.  In kvmppc_run_core(), we check the hpte_setup_done flag\nafter disabling interrupts and refuse to enter the guest if it is\nclear (for a HPT guest).  The code that checks hpte_setup_done and\ncalls kvmppc_hv_setup_htab_rma() is moved from kvmppc_vcpu_run_hv()\nto a point inside the main loop in kvmppc_run_vcpu(), ensuring that\nwe don\u0027t just spin endlessly calling kvmppc_run_core() while\nhpte_setup_done is clear, but instead have a chance to block on the\nkvm-\u003elock mutex.\n\nFinally we also check hpte_setup_done inside the region in\nkvmppc_book3s_hv_page_fault() where the HPTE is locked and we are about\nto update the HPTE, and bail out if it is clear.  If another CPU is\ninside kvm_vm_ioctl_resize_hpt_commit) and has cleared hpte_setup_done,\nthen we know that either we are looking at a HPTE\nthat resize_hpt_rehash_hpte() has not yet processed, which is OK,\nor else we will see hpte_setup_done clear and refuse to update it,\nbecause of the full barrier formed by the unlock of the HPTE in\nresize_hpt_rehash_hpte() combined with the locking of the HPTE\nin kvmppc_book3s_hv_page_fault().\n\nFixes: 5e9859699aba (\"KVM: PPC: Book3S HV: Outline of KVM-HV HPT resizing implementation\")\nCc: stable@vger.kernel.org # v4.10+\nReported-by: Satheesh Rajendran \u003csatheera@in.ibm.com\u003e\nSigned-off-by: Paul Mackerras \u003cpaulus@ozlabs.org\u003e\n"
    },
    {
      "commit": "b5f862180d7011d9575d0499fa37f0f25b423b12",
      "tree": "1148c40af363908755859fc2179e1890821f27aa",
      "parents": [
        "39a4b86f0de4ce5024985a56fc39b16194b04313"
      ],
      "author": {
        "name": "Hangbin Liu",
        "email": "liuhangbin@gmail.com",
        "time": "Mon Nov 06 09:01:57 2017 +0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Wed Nov 08 11:28:43 2017 +0900"
      },
      "message": "bonding: discard lowest hash bit for 802.3ad layer3+4\n\nAfter commit 07f4c90062f8 (\"tcp/dccp: try to not exhaust ip_local_port_range\nin connect()\"), we will try to use even ports for connect(). Then if an\napplication (seen clearly with iperf) opens multiple streams to the same\ndestination IP and port, each stream will be given an even source port.\n\nSo the bonding driver\u0027s simple xmit_hash_policy based on layer3+4 addressing\nwill always hash all these streams to the same interface. And the total\nthroughput will limited to a single slave.\n\nChange the tcp code will impact the whole tcp behavior, only for bonding\nusage. Paolo Abeni suggested fix this by changing the bonding code only,\nwhich should be more reasonable, and less impact.\n\nFix this by discarding the lowest hash bit because it contains little entropy.\nAfter the fix we can re-balance between slaves.\n\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: Hangbin Liu \u003cliuhangbin@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "26dd633e437dca218547ccbeacc71fe8a620b6f6",
      "tree": "d65c778b22a5a5fb5c94010fe8a4f7fad6d49991",
      "parents": [
        "eca253912f734927005500da7d646536064b3ed3"
      ],
      "author": {
        "name": "Yiannis Marangos",
        "email": "yiannis.marangos@gmail.com",
        "time": "Tue Nov 07 16:23:11 2017 -0800"
      },
      "committer": {
        "name": "Dmitry Torokhov",
        "email": "dmitry.torokhov@gmail.com",
        "time": "Tue Nov 07 17:45:07 2017 -0800"
      },
      "message": "Input: synaptics-rmi4 - RMI4 can also use SMBUS version 3\n\nSome Synaptics devices, such as LEN0073, use SMBUS version 3.\n\nSigned-off-by: Yiannis Marangos \u003cyiannis.marangos@gmail.com\u003e\nAcked-by: Benjamin Tissoires \u003cbenjamion.tissoires@redhat.com\u003e\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e"
    },
    {
      "commit": "eca253912f734927005500da7d646536064b3ed3",
      "tree": "5b5e8c50909999aa7733a5a767db7ce7396a591f",
      "parents": [
        "cdea6a30c2689cc33b34c6691b57cca277f0c5dc"
      ],
      "author": {
        "name": "Martin Kepplinger",
        "email": "martink@posteo.de",
        "time": "Tue Nov 07 16:20:49 2017 -0800"
      },
      "committer": {
        "name": "Dmitry Torokhov",
        "email": "dmitry.torokhov@gmail.com",
        "time": "Tue Nov 07 17:44:56 2017 -0800"
      },
      "message": "Input: tsc200x-core - set INPUT_PROP_DIRECT\n\nIf INPUT_PROP_DIRECT is set, userspace doesn\u0027t have to fall back to old\nways of identifying touchscreen devices.\n\nIn order to identify a touchscreen device, Android for example, seems to\nalready depend on INPUT_PROP_DIRECT to be present in drivers. udev still\nchecks for either BTN_TOUCH or INPUT_PROP_DIRECT. Checking for BTN_TOUCH\nhowever can quite easily lead to false positives; it\u0027s a code that not only\ntouchscreen device drivers use.\n\nAccording to the documentation, touchscreen drivers should have this\nproperty set and in order to make life easy for userspace, let\u0027s set it.\n\nSigned-off-by: Martin Kepplinger \u003cmartink@posteo.de\u003e\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e"
    },
    {
      "commit": "cdea6a30c2689cc33b34c6691b57cca277f0c5dc",
      "tree": "47292ac751d49de77b4a251cb137730d86b2adbc",
      "parents": [
        "6f29c244075c12713b4d8c32a2707fa4604bf60d"
      ],
      "author": {
        "name": "Kai-Heng Feng",
        "email": "kai.heng.feng@canonical.com",
        "time": "Tue Nov 07 16:19:24 2017 -0800"
      },
      "committer": {
        "name": "Dmitry Torokhov",
        "email": "dmitry.torokhov@gmail.com",
        "time": "Tue Nov 07 17:44:40 2017 -0800"
      },
      "message": "Input: elan_i2c - add ELAN060C to the ACPI table\n\nELAN060C touchpad uses elan_i2c as its driver. It can be\nfound on Lenovo ideapad 320-14AST.\n\nBugLink: https://bugs.launchpad.net/bugs/1727544\nSigned-off-by: Kai-Heng Feng \u003ckai.heng.feng@canonical.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e"
    },
    {
      "commit": "39a4b86f0de4ce5024985a56fc39b16194b04313",
      "tree": "57d0550e5ea32b7c51ae340d18d8c8a961db8267",
      "parents": [
        "13c249a94f525fe4c757d28854049780b25605c4"
      ],
      "author": {
        "name": "Gustavo A. R. Silva",
        "email": "garsilva@embeddedor.com",
        "time": "Sat Nov 04 22:54:53 2017 -0500"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Wed Nov 08 10:41:32 2017 +0900"
      },
      "message": "net/mlx5e/core/en_fs: fix pointer dereference after free in mlx5e_execute_l2_action\n\nhn is being kfree\u0027d in mlx5e_del_l2_from_hash and then dereferenced\nby accessing hn-\u003eai.addr\n\nFix this by copying the MAC address into a local variable for its safe use\nin all possible execution paths within function mlx5e_execute_l2_action.\n\nAddresses-Coverity-ID: 1417789\nFixes: eeb66cdb6826 (\"net/mlx5: Separate between E-Switch and MPFS\")\nSigned-off-by: Gustavo A. R. Silva \u003cgarsilva@embeddedor.com\u003e\nAcked-by: Saeed Mahameed \u003csaeedm@mellanox.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "13c249a94f525fe4c757d28854049780b25605c4",
      "tree": "f5a0f6ce23bf2fdbf688b7e256fab945896ab8f2",
      "parents": [
        "d09b9e60e06d431b008a878c4b1d48d6cce816ef"
      ],
      "author": {
        "name": "Marc Zyngier",
        "email": "marc.zyngier@arm.com",
        "time": "Sat Nov 04 12:33:47 2017 +0000"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Wed Nov 08 10:30:34 2017 +0900"
      },
      "message": "net: mvpp2: Prevent userspace from changing TX affinities\n\nThe mvpp2 driver can\u0027t cope at all with the TX affinities being\nchanged from userspace, and spit an endless stream of\n\n[   91.779920] mvpp2 f4000000.ethernet eth2: wrong cpu on the end of Tx processing\n[   91.779930] mvpp2 f4000000.ethernet eth2: wrong cpu on the end of Tx processing\n[   91.780402] mvpp2 f4000000.ethernet eth2: wrong cpu on the end of Tx processing\n[   91.780406] mvpp2 f4000000.ethernet eth2: wrong cpu on the end of Tx processing\n[   91.780415] mvpp2 f4000000.ethernet eth2: wrong cpu on the end of Tx processing\n[   91.780418] mvpp2 f4000000.ethernet eth2: wrong cpu on the end of Tx processing\n\nrendering the box completely useless (I\u0027ve measured around 600k\ninterrupts/s on a 8040 box) once irqbalance kicks in and start\ndoing its job.\n\nObviously, the driver was never designed with this in mind. So let\u0027s\nwork around the problem by preventing userspace from interacting\nwith these interrupts altogether.\n\nSigned-off-by: Marc Zyngier \u003cmarc.zyngier@arm.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "e806fa6bad186d7d353509b5a909abcf3a1e968b",
      "tree": "27a7342171735e8def826b6f5f6d3beb5ddec906",
      "parents": [
        "c18475a41a13504928fc57e423f42e264844c5ad"
      ],
      "author": {
        "name": "Gabriele Paoloni",
        "email": "gabriele.paoloni@huawei.com",
        "time": "Tue Nov 07 18:37:54 2017 -0600"
      },
      "committer": {
        "name": "Bjorn Helgaas",
        "email": "bhelgaas@google.com",
        "time": "Tue Nov 07 18:37:54 2017 -0600"
      },
      "message": "MAINTAINERS: Remove Gabriele Paoloni as HiSilicon PCI maintainer\n\nGabriele is now moving to a different role, so remove him as HiSilicon PCI\nmaintainer.\n\nSigned-off-by: Gabriele Paoloni \u003cgabriele.paoloni@huawei.com\u003e\n[bhelgaas: Thanks for all your help, Gabriele, and best wishes!]\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\nAcked-by: Zhou Wang \u003cwangzhou1@hisilicon.com\u003e\n"
    },
    {
      "commit": "c18475a41a13504928fc57e423f42e264844c5ad",
      "tree": "27880efc2175e13986b793ae00f4b8e9b264dd64",
      "parents": [
        "814eae5982cc55988f642f7f1d10eaf340845c00"
      ],
      "author": {
        "name": "Sebastian Andrzej Siewior",
        "email": "bigeasy@linutronix.de",
        "time": "Tue Nov 07 18:37:38 2017 -0600"
      },
      "committer": {
        "name": "Bjorn Helgaas",
        "email": "bhelgaas@google.com",
        "time": "Tue Nov 07 18:37:38 2017 -0600"
      },
      "message": "MAINTAINERS: Remove Stephen Bates as Microsemi Switchtec maintainer\n\nJust sent an email there and received an autoreply because he no longer\nworks there.\n\nSigned-off-by: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nSigned-off-by: Bjorn Helgaas \u003cbhelgaas@google.com\u003e\n"
    },
    {
      "commit": "ea4b3afe1eac8f88bb453798a084fba47a1f155a",
      "tree": "2a60f2dd86a21d54a8f01b2bbb78d5cf28ec6b6e",
      "parents": [
        "39dae59d66acd86d1de24294bd2f343fd5e7a625"
      ],
      "author": {
        "name": "Jaedon Shin",
        "email": "jaedon.shin@gmail.com",
        "time": "Fri Jun 16 20:03:01 2017 +0900"
      },
      "committer": {
        "name": "James Hogan",
        "email": "jhogan@kernel.org",
        "time": "Tue Nov 07 21:28:19 2017 +0000"
      },
      "message": "MIPS: BMIPS: Fix missing cbr address\n\nFix NULL pointer access in BMIPS3300 RAC flush.\n\nFixes: 738a3f79027b (\"MIPS: BMIPS: Add early CPU initialization code\")\nSigned-off-by: Jaedon Shin \u003cjaedon.shin@gmail.com\u003e\nReviewed-by: Florian Fainelli \u003cf.fainelli@gmail.com\u003e\nCc: Kevin Cernekee \u003ccernekee@gmail.com\u003e\nCc: linux-mips@linux-mips.org\nCc: \u003cstable@vger.kernel.org\u003e # 4.7+\nPatchwork: https://patchwork.linux-mips.org/patch/16423/\nSigned-off-by: James Hogan \u003cjhogan@kernel.org\u003e\n"
    },
    {
      "commit": "fbc3edf7d7731d7a22c483c679700589bab936a3",
      "tree": "c91f4ba712dd9dd44399e170f0c676ef32a74d07",
      "parents": [
        "a817e73fe693f0718b6210f4b959478877fb2e2f"
      ],
      "author": {
        "name": "Borislav Petkov",
        "email": "bp@suse.de",
        "time": "Tue Nov 07 17:37:24 2017 +0100"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Nov 07 09:12:04 2017 -0800"
      },
      "message": "drivers/ide-cd: Handle missing driver data during status check gracefully\n\nThe 0day bot reports the below failure which happens occasionally, with\ntheir randconfig testing (once every ~100 boots).  The Code points at\nthe private pointer -\u003edriver_data being NULL, which hints at a race of\nsorts where the private driver_data descriptor has disappeared by the\ntime we get to run the workqueue.\n\nSo let\u0027s check that pointer before we continue with issuing the command\nto the drive.\n\nThis fix is of the brown paper bag nature but considering that IDE is\nlong deprecated, let\u0027s do that so that random testing which happens to\nenable CONFIG_IDE during randconfig builds, doesn\u0027t fail because of\nthis.\n\nBesides, failing the TEST_UNIT_READY command because the drive private\ndata is gone is something which we could simply do anyway, to denote\nthat there was a problem communicating with the device.\n\n  BUG: unable to handle kernel NULL pointer dereference at 000001c0\n  IP: cdrom_check_status\n  *pde \u003d 00000000\n  Oops: 0000 [#1] SMP\n  CPU: 1 PID: 155 Comm: kworker/1:2 Not tainted 4.14.0-rc8 #127\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014\n  Workqueue: events_freezable_power_ disk_events_workfn\n  task: 4fe90980 task.stack: 507ac000\n  EIP: cdrom_check_status+0x2c/0x90\n  EFLAGS: 00210246 CPU: 1\n  EAX: 00000000 EBX: 4fefec00 ECX: 00000000 EDX: 00000000\n  ESI: 00000003 EDI: ffffffff EBP: 467a9340 ESP: 507aded0\n   DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068\n  CR0: 80050033 CR2: 000001c0 CR3: 06e0f000 CR4: 00000690\n  Call Trace:\n   ? ide_cdrom_check_events_real\n   ? cdrom_check_events\n   ? disk_check_events\n   ? process_one_work\n   ? process_one_work\n   ? worker_thread\n   ? kthread\n   ? process_one_work\n   ? __kthread_create_on_node\n   ? ret_from_fork\n  Code: 53 83 ec 14 89 c3 89 d1 be 03 00 00 00 65 a1 14 00 00 00 89 44 24 10 31 c0 8b 43 18 c7 44 24 04 00 00 00 00 c7 04 24 00 00 00 00 \u003c8a\u003e 80 c0 01 00 00 c7 44 24 08 00 00 00 00 83 e0 03 c7 44 24 0c\n  EIP: cdrom_check_status+0x2c/0x90 SS:ESP: 0068:507aded0\n  CR2: 00000000000001c0\n  ---[ end trace 2410e586dd8f88b2 ]---\n\nReported-and-tested-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nSigned-off-by: Borislav Petkov \u003cbp@suse.de\u003e\nCc: \"David S. Miller\" \u003cdavem@davemloft.net\u003e\nCc: Jens Axboe \u003caxboe@kernel.dk\u003e\nCc: Bart Van Assche \u003cbart.vanassche@sandisk.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "a817e73fe693f0718b6210f4b959478877fb2e2f",
      "tree": "377b6fd9c622f4d67448bf1c716522ebc8601140",
      "parents": [
        "e4880bc5dfb1f02b152e62a894b5c6f3e995b3cf"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Nov 07 09:04:32 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Nov 07 09:04:32 2017 -0800"
      },
      "message": "Revert \"scsi: make \u0027state\u0027 device attribute pollable\"\n\nThis reverts commit 8a97712e5314aefe16b3ffb4583a34deaa49de04.\n\nThis commit added a call to sysfs_notify() from within\nscsi_device_set_state(), which in turn turns out to make libata very\nunhappy, because ata_eh_detach_dev() does\n\n        spin_lock_irqsave(ap-\u003elock, flags);\n        ..\n        if (ata_scsi_offline_dev(dev)) {\n                dev-\u003eflags |\u003d ATA_DFLAG_DETACHED;\n                ap-\u003epflags |\u003d ATA_PFLAG_SCSI_HOTPLUG;\n        }\n\nand ata_scsi_offline_dev() then does that scsi_device_set_state() to set\nit offline.\n\nSo now we called sysfs_notify() from within a spinlocked region, which\nreally doesn\u0027t work.  The 0day robot reported this as:\n\n   BUG: sleeping function called from invalid context at kernel/locking/mutex.c:238\n\nbecause sysfs_notify() ends up calling kernfs_find_and_get_ns() which\nthen does mutex_lock(\u0026kernfs_mutex)..\n\nThe pollability of the device state isn\u0027t critical, so revert this all\nfor now, and maybe we\u0027ll do it differently in the future.\n\nReported-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nAcked-by: Martin K. Petersen \u003cmartin.petersen@oracle.com\u003e\nAcked-by: Hannes Reinecke \u003chare@suse.de\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "132d358b183ac6ad8b3fea32ad5e0663456d18d1",
      "tree": "d8a8493cf13d43f4ed5e8e6d96b57b7de45ef195",
      "parents": [
        "3510c7aa069aa83a2de6dab2b41401a198317bdc"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Tue Nov 07 16:05:24 2017 +0100"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Tue Nov 07 16:05:24 2017 +0100"
      },
      "message": "ALSA: seq: Fix OSS sysex delivery in OSS emulation\n\nThe SYSEX event delivery in OSS sequencer emulation assumed that the\nevent is encoded in the variable-length data with the straight\nbuffering.  This was the normal behavior in the past, but during the\ndevelopment, the chained buffers were introduced for carrying more\ndata, while the OSS code was left intact.  As a result, when a SYSEX\nevent with the chained buffer data is passed to OSS sequencer port,\nit may end up with the wrong memory access, as if it were having a too\nlarge buffer.\n\nThis patch addresses the bug, by applying the buffer data expansion by\nthe generic snd_seq_dump_var_event() helper function.\n\nReported-by: syzbot \u003csyzkaller@googlegroups.com\u003e\nReported-by: Mark Salyzyn \u003csalyzyn@android.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "76ce7cfe35ef58f34e6ba85327afb5fbf6c3ff9b",
      "tree": "ad750f9e42d213b7847a9f3cec679cf4d9406951",
      "parents": [
        "e4880bc5dfb1f02b152e62a894b5c6f3e995b3cf"
      ],
      "author": {
        "name": "Pavel Tatashin",
        "email": "pasha.tatashin@oracle.com",
        "time": "Fri Oct 27 20:11:00 2017 -0400"
      },
      "committer": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Tue Nov 07 16:04:54 2017 +0100"
      },
      "message": "x86/smpboot: Make optimization of delay calibration work correctly\n\nIf the TSC has constant frequency then the delay calibration can be skipped\nwhen it has been calibrated for a package already. This is checked in\ncalibrate_delay_is_known(), but that function is buggy in two aspects:\n\nIt returns \u0027false\u0027 if\n\n  (!tsc_disabled \u0026\u0026 !cpu_has(\u0026cpu_data(cpu), X86_FEATURE_CONSTANT_TSC)\n\nwhich is obviously the reverse of the intended check and the check for the\nsibling mask cannot work either because the topology links have not been\nset up yet.\n\nCorrect the condition and move the call to set_cpu_sibling_map() before\ninvoking calibrate_delay() so the sibling check works correctly.\n\n[ tglx: Rewrote changelong ]\n\nFixes: c25323c07345 (\"x86/tsc: Use topology functions\")\nSigned-off-by: Pavel Tatashin \u003cpasha.tatashin@oracle.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: peterz@infradead.org\nCc: bob.picco@oracle.com\nCc: steven.sistare@oracle.com\nCc: daniel.m.jordan@oracle.com\nCc: stable@vger.kernel.org\nLink: https://lkml.kernel.org/r/20171028001100.26603-1-pasha.tatashin@oracle.com\n"
    },
    {
      "commit": "17208f1dec433b60eb9b427c17598adc431ab6de",
      "tree": "3081244133d5709df54e61da7e5aaf87f40cbfa2",
      "parents": [
        "39dae59d66acd86d1de24294bd2f343fd5e7a625",
        "cef75036c40408ba3bc308bcb00a3d440da713fc"
      ],
      "author": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Tue Nov 07 17:01:39 2017 +1000"
      },
      "committer": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Tue Nov 07 17:01:39 2017 +1000"
      },
      "message": "Merge branch \u0027drm-vmwgfx-fixes\u0027 of git://people.freedesktop.org/~syeh/repos_linux into drm-fixes\n\nOne vmwgfx blackscreen fix and trivial patch.\n\n* \u0027drm-vmwgfx-fixes\u0027 of git://people.freedesktop.org/~syeh/repos_linux:\n  drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue\n  drm/vmwgfx: constify vmw_fence_ops\n"
    },
    {
      "commit": "71630b7a832f699d6a6764ae75797e4e743ae348",
      "tree": "1ffe6cf536ab76a6d5d838a48d3de35916f18e26",
      "parents": [
        "39dae59d66acd86d1de24294bd2f343fd5e7a625"
      ],
      "author": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Mon Nov 06 23:56:57 2017 +0100"
      },
      "committer": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Mon Nov 06 23:56:57 2017 +0100"
      },
      "message": "ACPI / PM: Blacklist Low Power S0 Idle _DSM for Dell XPS13 9360\n\nAt least one Dell XPS13 9360 is reported to have serious issues with\nthe Low Power S0 Idle _DSM interface and since this machine model\ngenerally can do ACPI S3 just fine, add a blacklist entry to disable\nthat interface for Dell XPS13 9360.\n\nFixes: 8110dd281e15 (ACPI / sleep: EC-based wakeup from suspend-to-idle on recent systems)\nLink: https://bugzilla.kernel.org/show_bug.cgi?id\u003d196907\nReported-by: Paul Menzel \u003cpmenzel@molgen.mpg.de\u003e\nTested-by: Paul Menzel \u003cpmenzel@molgen.mpg.de\u003e\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nCc: 4.13+ \u003cstable@vger.kernel.org\u003e # 4.13+\n"
    },
    {
      "commit": "e4880bc5dfb1f02b152e62a894b5c6f3e995b3cf",
      "tree": "d49f90a4fd53973af7609fcd0958bb7528cdf5bf",
      "parents": [
        "136fc5c41f349296db1910677bb7402b0eeff376",
        "cef572ad9bd7f85035ba8272e5352040e8be0152"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Mon Nov 06 12:26:49 2017 -0800"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Mon Nov 06 12:26:49 2017 -0800"
      },
      "message": "Merge branch \u0027for-4.14-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq\n\nPull workqueue fix from Tejun Heo:\n \"Another fix for a really old bug.\n\n  It only affects drain_workqueue() which isn\u0027t used often and even then\n  triggers only during a pretty small race window, so it isn\u0027t too\n  surprising that it stayed hidden for so long.\n\n  The fix is straight-forward and low-risk. Kudos to Li Bin for\n  reporting and fixing the bug\"\n\n* \u0027for-4.14-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:\n  workqueue: Fix NULL pointer dereference\n"
    },
    {
      "commit": "136fc5c41f349296db1910677bb7402b0eeff376",
      "tree": "eb9005942d3ac0327edb58b6bdc2bcbad5915f3d",
      "parents": [
        "af903dcd31e1b345d858ca2af9a84ed61c960b57"
      ],
      "author": {
        "name": "Tobin C. Harding",
        "email": "me@tobin.cc",
        "time": "Mon Nov 06 16:19:27 2017 +1100"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Mon Nov 06 11:46:42 2017 -0800"
      },
      "message": "scripts: add leaking_addresses.pl\n\nCurrently we are leaking addresses from the kernel to user space. This\nscript is an attempt to find some of those leakages. Script parses\n`dmesg` output and /proc and /sys files for hex strings that look like\nkernel addresses.\n\nOnly works for 64 bit kernels, the reason being that kernel addresses on\n64 bit kernels have \u0027ffff\u0027 as the leading bit pattern making greping\npossible. On 32 kernels we don\u0027t have this luxury.\n\nScripts is _slightly_ smarter than a straight grep, we check for false\npositives (all 0\u0027s or all 1\u0027s, and vsyscall start/finish addresses).\n\n[ I think there is a lot of room for improvement here, but it\u0027s already\n  useful, so I\u0027m merging it as-is. The whole \"hash %p format\" series is\n  expected to go into 4.15, but will not fix %x users, and will not\n  incentivize people to look at what they are leaking.     - Linus ]\n\nSigned-off-by: Tobin C. Harding \u003cme@tobin.cc\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    }
  ],
  "next": "3510c7aa069aa83a2de6dab2b41401a198317bdc"
}