)]}'
{
  "log": [
    {
      "commit": "14ccee78fc82f5512908f4424f541549a5705b89",
      "tree": "a227171b7e07bdb7f4bd14818b361577464487bd",
      "parents": [
        "197e7e521384a23b9e585178f3f11c9fa08274b9"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Aug 20 14:13:52 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Aug 20 14:13:52 2017 -0700"
      },
      "message": "Linux 4.13-rc6\n"
    },
    {
      "commit": "197e7e521384a23b9e585178f3f11c9fa08274b9",
      "tree": "920791387f88f49b969b36cdb722f5f2c951d673",
      "parents": [
        "7f680d7ec3153dffc4d37aea517ead2b9fb9b8e9"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Aug 20 13:26:27 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Aug 20 13:26:27 2017 -0700"
      },
      "message": "Sanitize \u0027move_pages()\u0027 permission checks\n\nThe \u0027move_paghes()\u0027 system call was introduced long long ago with the\nsame permission checks as for sending a signal (except using\nCAP_SYS_NICE instead of CAP_SYS_KILL for the overriding capability).\n\nThat turns out to not be a great choice - while the system call really\nonly moves physical page allocations around (and you need other\ncapabilities to do a lot of it), you can check the return value to map\nout some the virtual address choices and defeat ASLR of a binary that\nstill shares your uid.\n\nSo change the access checks to the more common \u0027ptrace_may_access()\u0027\nmodel instead.\n\nThis tightens the access checks for the uid, and also effectively\nchanges the CAP_SYS_NICE check to CAP_SYS_PTRACE, but it\u0027s unlikely that\nanybody really _uses_ this legacy system call any more (we hav ebetter\nNUMA placement models these days), so I expect nobody to notice.\n\nFamous last words.\n\nReported-by: Otto Ebeling \u003cotto.ebeling@iki.fi\u003e\nAcked-by: Eric W. Biederman \u003cebiederm@xmission.com\u003e\nCc: Willy Tarreau \u003cw@1wt.eu\u003e\nCc: stable@kernel.org\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "7f680d7ec3153dffc4d37aea517ead2b9fb9b8e9",
      "tree": "b2e253a3cd025130610147f343bfb23024234a33",
      "parents": [
        "2615a38f142ffda863dece40120d7fe69af46490",
        "45bd07ad82622fb7c8dd7504d976b7dd11568965"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Aug 20 09:36:52 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Aug 20 09:36:52 2017 -0700"
      },
      "message": "Merge branch \u0027x86-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Thomas Gleixner:\n \"Another pile of small fixes and updates for x86:\n\n   - Plug a hole in the SMAP implementation which misses to clear AC on\n     NMI entry\n\n   - Fix the norandmaps/ADDR_NO_RANDOMIZE logic so the command line\n     parameter works correctly again\n\n   - Use the proper accessor in the startup64 code for next_early_pgt to\n     prevent accessing of invalid addresses and faulting in the early\n     boot code.\n\n   - Prevent CPU hotplug lock recursion in the MTRR code\n\n   - Unbreak CPU0 hotplugging\n\n   - Rename overly long CPUID bits which got introduced in this cycle\n\n   - Two commits which mark data \u0027const\u0027 and restrict the scope of data\n     and functions to file scope by making them \u0027static\u0027\"\n\n* \u0027x86-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  x86: Constify attribute_group structures\n  x86/boot/64/clang: Use fixup_pointer() to access \u0027next_early_pgt\u0027\n  x86/elf: Remove the unnecessary ADDR_NO_RANDOMIZE checks\n  x86: Fix norandmaps/ADDR_NO_RANDOMIZE\n  x86/mtrr: Prevent CPU hotplug lock recursion\n  x86: Mark various structures and functions as \u0027static\u0027\n  x86/cpufeature, kvm/svm: Rename (shorten) the new \"virtualized VMSAVE/VMLOAD\" CPUID flag\n  x86/smpboot: Unbreak CPU0 hotplug\n  x86/asm/64: Clear AC on NMI entries\n"
    },
    {
      "commit": "2615a38f142ffda863dece40120d7fe69af46490",
      "tree": "dc8007bf28a1d91d74fc76f20fe8cad64672df41",
      "parents": [
        "e46db8d2ef58f9b515f83be4608cef90ff9ae2c6",
        "b60bf53abc0323f91ac59b08a7642216281e662e"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Aug 20 09:34:24 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Aug 20 09:34:24 2017 -0700"
      },
      "message": "Merge branch \u0027timers-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fixes from Thomas Gleixner:\n \"A few small fixes for timer drivers:\n\n   - Prevent infinite recursion in the arm architected timer driver with\n     ftrace\n\n   - Propagate error codes to the caller in case of failure in EM STI\n     driver\n\n   - Adjust a bogus loop iteration in the arm architected timer driver\n\n   - Add a missing Kconfig dependency to the pistachio clocksource to\n     prevent build failures\n\n   - Correctly check for IS_ERR() instead of NULL in the shared timer-of\n     code\"\n\n* \u0027timers-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  clocksource/drivers/arm_arch_timer: Avoid infinite recursion when ftrace is enabled\n  clocksource/drivers/Kconfig: Fix CLKSRC_PISTACHIO dependencies\n  clocksource/drivers/timer-of: Checking for IS_ERR() instead of NULL\n  clocksource/drivers/em_sti: Fix error return codes in em_sti_probe()\n  clocksource/drivers/arm_arch_timer: Fix mem frame loop initialization\n"
    },
    {
      "commit": "e46db8d2ef58f9b515f83be4608cef90ff9ae2c6",
      "tree": "a06fb90781963e956c964da12e7cc3aabd33af72",
      "parents": [
        "9dae41a238a952eb65c8aa8a59d8aa39058a7bcf",
        "9b231d9f47c6114d317ce28cff92a74ad80547f5"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Aug 20 09:20:57 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Aug 20 09:20:57 2017 -0700"
      },
      "message": "Merge branch \u0027perf-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf fixes from Thomas Gleixner:\n \"Two fixes for the perf subsystem:\n\n   - Fix an inconsistency of RDPMC mm struct tagging across exec() which\n     causes RDPMC to fault.\n\n   - Correct the timestamp mechanics across IOC_DISABLE/ENABLE which\n     causes incorrect timestamps and total time calculations\"\n\n* \u0027perf-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  perf/core: Fix time on IOC_ENABLE\n  perf/x86: Fix RDPMC vs. mm_struct tracking\n"
    },
    {
      "commit": "9dae41a238a952eb65c8aa8a59d8aa39058a7bcf",
      "tree": "19a6382bdef8db85c7dac475ed524f7e78803b2a",
      "parents": [
        "e18a5ebc2d507f42ca724581a1039ba058fa12da",
        "8fbbe2d7cc478d1544f41f2271787c993c23a4f6"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Aug 20 09:07:56 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Aug 20 09:07:56 2017 -0700"
      },
      "message": "Merge branch \u0027irq-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull irq fixes from Thomas Gleixner:\n \"A pile of smallish changes all over the place:\n\n   - Add a missing ISB in the GIC V1 driver\n\n   - Remove an ACPI version check in the GIC V3 ITS driver\n\n   - Add the missing irq_pm_shutdown function for BRCMSTB-L2 to avoid\n     spurious wakeups\n\n   - Remove the artifical limitation of ITS instances to the number of\n     NUMA nodes which prevents utilizing the ITS hardware correctly\n\n   - Prevent a infinite parsing loop in the GIC-V3 ITS/MSI code\n\n   - Honour the force affinity argument in the GIC-V3 driver which is\n     required to make perf work correctly\n\n   - Correctly report allocation failures in GIC-V2/V3 to avoid using\n     half allocated and initialized interrupts.\n\n   - Fixup checks against nr_cpu_ids in the generic IPI code\"\n\n* \u0027irq-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  genirq/ipi: Fixup checks against nr_cpu_ids\n  genirq: Restore trigger settings in irq_modify_status()\n  MAINTAINERS: Remove Jason Cooper\u0027s irqchip git tree\n  irqchip/gic-v3-its-platform-msi: Fix msi-parent parsing loop\n  irqchip/gic-v3-its: Allow GIC ITS number more than MAX_NUMNODES\n  irqchip: brcmstb-l2: Define an irq_pm_shutdown function\n  irqchip/gic: Ensure we have an ISB between ack and -\u003ehandle_irq\n  irqchip/gic-v3-its: Remove ACPICA version check for ACPI NUMA\n  irqchip/gic-v3: Honor forced affinity setting\n  irqchip/gic-v3: Report failures in gic_irq_domain_alloc\n  irqchip/gic-v2: Report failures in gic_irq_domain_alloc\n  irqchip/atmel-aic: Remove root argument from -\u003efixup() prototype\n  irqchip/atmel-aic: Fix unbalanced refcount in aic_common_rtc_irq_fixup()\n  irqchip/atmel-aic: Fix unbalanced of_node_put() in aic_common_irq_fixup()\n"
    },
    {
      "commit": "e18a5ebc2d507f42ca724581a1039ba058fa12da",
      "tree": "9c2378623f5b97f82e1ed31ffb66f21924f35e32",
      "parents": [
        "58d4e450a490d5f02183f6834c12550ba26d3b47",
        "7edaeb6841dfb27e362288ab8466ebdc4972e867"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Aug 20 08:54:30 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Sun Aug 20 08:54:30 2017 -0700"
      },
      "message": "Merge branch \u0027core-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull watchdog fix from Thomas Gleixner:\n \"A fix for the hardlockup watchdog to prevent false positives with\n  extreme Turbo-Modes which make the perf/NMI watchdog fire faster than\n  the hrtimer which is used to verify.\n\n  Slightly larger than the minimal fix, which just would increase the\n  hrtimer frequency, but comes with extra overhead of more watchdog\n  timer interrupts and thread wakeups for all users.\n\n  With this change we restrict the overhead to the extreme Turbo-Mode\n  systems\"\n\n* \u0027core-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n  kernel/watchdog: Prevent false positives with turbo modes\n"
    },
    {
      "commit": "8fbbe2d7cc478d1544f41f2271787c993c23a4f6",
      "tree": "5216664c8a0de1fab6a27d5400042efc132d6901",
      "parents": [
        "e8f241893dfbbebe2813c01eac54f263e6a5e59c"
      ],
      "author": {
        "name": "Alexey Dobriyan",
        "email": "adobriyan@gmail.com",
        "time": "Sat Aug 19 12:57:51 2017 +0300"
      },
      "committer": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Sun Aug 20 10:49:05 2017 +0200"
      },
      "message": "genirq/ipi: Fixup checks against nr_cpu_ids\n\nValid CPU ids are [0, nr_cpu_ids-1] inclusive.\n\nFixes: 3b8e29a82dd1 (\"genirq: Implement ipi_send_mask/single()\")\nFixes: f9bce791ae2a (\"genirq: Add a new function to get IPI reverse mapping\")\nSigned-off-by: Alexey Dobriyan \u003cadobriyan@gmail.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: stable@vger.kernel.org\nLink: http://lkml.kernel.org/r/20170819095751.GB27864@avx2\n\n"
    },
    {
      "commit": "58d4e450a490d5f02183f6834c12550ba26d3b47",
      "tree": "4c1ada2d3cb98f5fb8c546a0c95fc28a3f733b83",
      "parents": [
        "cc28fcdc017e553375c999ca12107ceb27f34ab3",
        "c715b72c1ba406f133217b509044c38d8e714a37"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 16:06:33 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 16:06:33 2017 -0700"
      },
      "message": "Merge branch \u0027akpm\u0027 (patches from Andrew)\n\nMerge misc fixes from Andrew Morton:\n \"14 fixes\"\n\n* emailed patches from Andrew Morton \u003cakpm@linux-foundation.org\u003e:\n  mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes\n  mm/vmalloc.c: don\u0027t unconditonally use __GFP_HIGHMEM\n  mm/mempolicy: fix use after free when calling get_mempolicy\n  mm/cma_debug.c: fix stack corruption due to sprintf usage\n  signal: don\u0027t remove SIGNAL_UNKILLABLE for traced tasks.\n  mm, oom: fix potential data corruption when oom_reaper races with writer\n  mm: fix double mmap_sem unlock on MMF_UNSTABLE enforced SIGBUS\n  slub: fix per memcg cache leak on css offline\n  mm: discard memblock data later\n  test_kmod: fix description for -s -and -c parameters\n  kmod: fix wait on recursive loop\n  wait: add wait_event_killable_timeout()\n  kernel/watchdog: fix Kconfig constraints for perf hardlockup watchdog\n  mm: memcontrol: fix NULL pointer crash in test_clear_page_writeback()\n"
    },
    {
      "commit": "c715b72c1ba406f133217b509044c38d8e714a37",
      "tree": "0b8b674d1aada4584cf33d48bd9c75576a21a327",
      "parents": [
        "704b862f9efd6d4c87a8d0a344dda19bda9c6b69"
      ],
      "author": {
        "name": "Kees Cook",
        "email": "keescook@chromium.org",
        "time": "Fri Aug 18 15:16:31 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 15:32:02 2017 -0700"
      },
      "message": "mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes\n\nMoving the x86_64 and arm64 PIE base from 0x555555554000 to 0x000100000000\nbroke AddressSanitizer.  This is a partial revert of:\n\n  eab09532d400 (\"binfmt_elf: use ELF_ET_DYN_BASE only for PIE\")\n  02445990a96e (\"arm64: move ELF_ET_DYN_BASE to 4GB / 4MB\")\n\nThe AddressSanitizer tool has hard-coded expectations about where\nexecutable mappings are loaded.\n\nThe motivation for changing the PIE base in the above commits was to\navoid the Stack-Clash CVEs that allowed executable mappings to get too\nclose to heap and stack.  This was mainly a problem on 32-bit, but the\n64-bit bases were moved too, in an effort to proactively protect those\nsystems (proofs of concept do exist that show 64-bit collisions, but\nother recent changes to fix stack accounting and setuid behaviors will\nminimize the impact).\n\nThe new 32-bit PIE base is fine for ASan (since it matches the ET_EXEC\nbase), so only the 64-bit PIE base needs to be reverted to let x86 and\narm64 ASan binaries run again.  Future changes to the 64-bit PIE base on\nthese architectures can be made optional once a more dynamic method for\ndealing with AddressSanitizer is found.  (e.g.  always loading PIE into\nthe mmap region for marked binaries.)\n\nLink: http://lkml.kernel.org/r/20170807201542.GA21271@beast\nFixes: eab09532d400 (\"binfmt_elf: use ELF_ET_DYN_BASE only for PIE\")\nFixes: 02445990a96e (\"arm64: move ELF_ET_DYN_BASE to 4GB / 4MB\")\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nReported-by: Kostya Serebryany \u003ckcc@google.com\u003e\nAcked-by: Will Deacon \u003cwill.deacon@arm.com\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: \"H. Peter Anvin\" \u003chpa@zytor.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "704b862f9efd6d4c87a8d0a344dda19bda9c6b69",
      "tree": "7e5b86e24c47e8ac8c021be6a08a705c40a134e2",
      "parents": [
        "73223e4e2e3867ebf033a5a8eb2e5df0158ccc99"
      ],
      "author": {
        "name": "Laura Abbott",
        "email": "labbott@redhat.com",
        "time": "Fri Aug 18 15:16:27 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 15:32:02 2017 -0700"
      },
      "message": "mm/vmalloc.c: don\u0027t unconditonally use __GFP_HIGHMEM\n\nCommit 19809c2da28a (\"mm, vmalloc: use __GFP_HIGHMEM implicitly\") added\nuse of __GFP_HIGHMEM for allocations.  vmalloc_32 may use\nGFP_DMA/GFP_DMA32 which does not play nice with __GFP_HIGHMEM and will\ntrigger a BUG in gfp_zone.\n\nOnly add __GFP_HIGHMEM if we aren\u0027t using GFP_DMA/GFP_DMA32.\n\nBugzilla: https://bugzilla.redhat.com/show_bug.cgi?id\u003d1482249\nLink: http://lkml.kernel.org/r/20170816220705.31374-1-labbott@redhat.com\nFixes: 19809c2da28a (\"mm, vmalloc: use __GFP_HIGHMEM implicitly\")\nSigned-off-by: Laura Abbott \u003clabbott@redhat.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nCc: \"Kirill A. Shutemov\" \u003ckirill.shutemov@linux.intel.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "73223e4e2e3867ebf033a5a8eb2e5df0158ccc99",
      "tree": "cedd086b2294cc820f574ecbdb5ae7251e7d46c9",
      "parents": [
        "da094e42848e3c36feaa3b5271e53983fd45424f"
      ],
      "author": {
        "name": "zhong jiang",
        "email": "zhongjiang@huawei.com",
        "time": "Fri Aug 18 15:16:24 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 15:32:02 2017 -0700"
      },
      "message": "mm/mempolicy: fix use after free when calling get_mempolicy\n\nI hit a use after free issue when executing trinity and repoduced it\nwith KASAN enabled.  The related call trace is as follows.\n\n  BUG: KASan: use after free in SyS_get_mempolicy+0x3c8/0x960 at addr ffff8801f582d766\n  Read of size 2 by task syz-executor1/798\n\n  INFO: Allocated in mpol_new.part.2+0x74/0x160 age\u003d3 cpu\u003d1 pid\u003d799\n     __slab_alloc+0x768/0x970\n     kmem_cache_alloc+0x2e7/0x450\n     mpol_new.part.2+0x74/0x160\n     mpol_new+0x66/0x80\n     SyS_mbind+0x267/0x9f0\n     system_call_fastpath+0x16/0x1b\n  INFO: Freed in __mpol_put+0x2b/0x40 age\u003d4 cpu\u003d1 pid\u003d799\n     __slab_free+0x495/0x8e0\n     kmem_cache_free+0x2f3/0x4c0\n     __mpol_put+0x2b/0x40\n     SyS_mbind+0x383/0x9f0\n     system_call_fastpath+0x16/0x1b\n  INFO: Slab 0xffffea0009cb8dc0 objects\u003d23 used\u003d8 fp\u003d0xffff8801f582de40 flags\u003d0x200000000004080\n  INFO: Object 0xffff8801f582d760 @offset\u003d5984 fp\u003d0xffff8801f582d600\n\n  Bytes b4 ffff8801f582d750: ae 01 ff ff 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a  ........ZZZZZZZZ\n  Object ffff8801f582d760: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk\n  Object ffff8801f582d770: 6b 6b 6b 6b 6b 6b 6b a5                          kkkkkkk.\n  Redzone ffff8801f582d778: bb bb bb bb bb bb bb bb                          ........\n  Padding ffff8801f582d8b8: 5a 5a 5a 5a 5a 5a 5a 5a                          ZZZZZZZZ\n  Memory state around the buggy address:\n  ffff8801f582d600: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc\n  ffff8801f582d680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n  \u003effff8801f582d700: fc fc fc fc fc fc fc fc fc fc fc fc fb fb fb fc\n\n!shared memory policy is not protected against parallel removal by other\nthread which is normally protected by the mmap_sem.  do_get_mempolicy,\nhowever, drops the lock midway while we can still access it later.\n\nEarly premature up_read is a historical artifact from times when\nput_user was called in this path see https://lwn.net/Articles/124754/\nbut that is gone since 8bccd85ffbaf (\"[PATCH] Implement sys_* do_*\nlayering in the memory policy layer.\").  but when we have the the\ncurrent mempolicy ref count model.  The issue was introduced\naccordingly.\n\nFix the issue by removing the premature release.\n\nLink: http://lkml.kernel.org/r/1502950924-27521-1-git-send-email-zhongjiang@huawei.com\nSigned-off-by: zhong jiang \u003czhongjiang@huawei.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Minchan Kim \u003cminchan@kernel.org\u003e\nCc: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nCc: David Rientjes \u003crientjes@google.com\u003e\nCc: Mel Gorman \u003cmgorman@techsingularity.net\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[2.6+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "da094e42848e3c36feaa3b5271e53983fd45424f",
      "tree": "b33c69a6eb206dc58225c2e8a2920fafd3804ca1",
      "parents": [
        "eb61b5911bdc923875cde99eb25203a0e2b06d43"
      ],
      "author": {
        "name": "Prakash Gupta",
        "email": "guptap@codeaurora.org",
        "time": "Fri Aug 18 15:16:21 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 15:32:02 2017 -0700"
      },
      "message": "mm/cma_debug.c: fix stack corruption due to sprintf usage\n\nname[] in cma_debugfs_add_one() can only accommodate 16 chars including\nNULL to store sprintf output.  It\u0027s common for cma device name to be\nlarger than 15 chars.  This can cause stack corrpution.  If the gcc\nstack protector is turned on, this can cause a panic due to stack\ncorruption.\n\nBelow is one example trace:\n\n  Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in:\n  ffffff8e69a75730\n  Call trace:\n     dump_backtrace+0x0/0x2c4\n     show_stack+0x20/0x28\n     dump_stack+0xb8/0xf4\n     panic+0x154/0x2b0\n     print_tainted+0x0/0xc0\n     cma_debugfs_init+0x274/0x290\n     do_one_initcall+0x5c/0x168\n     kernel_init_freeable+0x1c8/0x280\n\nFix the short sprintf buffer in cma_debugfs_add_one() by using\nscnprintf() instead of sprintf().\n\nLink: http://lkml.kernel.org/r/1502446217-21840-1-git-send-email-guptap@codeaurora.org\nFixes: f318dd083c81 (\"cma: Store a name in the cma structure\")\nSigned-off-by: Prakash Gupta \u003cguptap@codeaurora.org\u003e\nAcked-by: Laura Abbott \u003clabbott@redhat.com\u003e\nCc: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "eb61b5911bdc923875cde99eb25203a0e2b06d43",
      "tree": "5ba019b857b23212a0c30aeb24f7a3f54b568b51",
      "parents": [
        "6b31d5955cb29a51c5baffee382f213d75e98fb8"
      ],
      "author": {
        "name": "Jamie Iles",
        "email": "jamie.iles@oracle.com",
        "time": "Fri Aug 18 15:16:18 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 15:32:02 2017 -0700"
      },
      "message": "signal: don\u0027t remove SIGNAL_UNKILLABLE for traced tasks.\n\nWhen forcing a signal, SIGNAL_UNKILLABLE is removed to prevent recursive\nfaults, but this is undesirable when tracing.  For example, debugging an\ninit process (whether global or namespace), hitting a breakpoint and\nSIGTRAP will force SIGTRAP and then remove SIGNAL_UNKILLABLE.\nEverything continues fine, but then once debugging has finished, the\ninit process is left killable which is unlikely what the user expects,\nresulting in either an accidentally killed init or an init that stops\nreaping zombies.\n\nLink: http://lkml.kernel.org/r/20170815112806.10728-1-jamie.iles@oracle.com\nSigned-off-by: Jamie Iles \u003cjamie.iles@oracle.com\u003e\nAcked-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "6b31d5955cb29a51c5baffee382f213d75e98fb8",
      "tree": "86405062da720e3cc0f60c9c0e48e21e3ab0189c",
      "parents": [
        "5b53a6ea886700a128b697a6fe8375340dea2c30"
      ],
      "author": {
        "name": "Michal Hocko",
        "email": "mhocko@suse.com",
        "time": "Fri Aug 18 15:16:15 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 15:32:01 2017 -0700"
      },
      "message": "mm, oom: fix potential data corruption when oom_reaper races with writer\n\nWenwei Tao has noticed that our current assumption that the oom victim\nis dying and never doing any visible changes after it dies, and so the\noom_reaper can tear it down, is not entirely true.\n\n__task_will_free_mem consider a task dying when SIGNAL_GROUP_EXIT is set\nbut do_group_exit sends SIGKILL to all threads _after_ the flag is set.\nSo there is a race window when some threads won\u0027t have\nfatal_signal_pending while the oom_reaper could start unmapping the\naddress space.  Moreover some paths might not check for fatal signals\nbefore each PF/g-u-p/copy_from_user.\n\nWe already have a protection for oom_reaper vs.  PF races by checking\nMMF_UNSTABLE.  This has been, however, checked only for kernel threads\n(use_mm users) which can outlive the oom victim.  A simple fix would be\nto extend the current check in handle_mm_fault for all tasks but that\nwouldn\u0027t be sufficient because the current check assumes that a kernel\nthread would bail out after EFAULT from get_user*/copy_from_user and\nnever re-read the same address which would succeed because the PF path\nhas established page tables already.  This seems to be the case for the\nonly existing use_mm user currently (virtio driver) but it is rather\nfragile in general.\n\nThis is even more fragile in general for more complex paths such as\ngeneric_perform_write which can re-read the same address more times\n(e.g.  iov_iter_copy_from_user_atomic to fail and then\niov_iter_fault_in_readable on retry).\n\nTherefore we have to implement MMF_UNSTABLE protection in a robust way\nand never make a potentially corrupted content visible.  That requires\nto hook deeper into the PF path and check for the flag _every time_\nbefore a pte for anonymous memory is established (that means all\n!VM_SHARED mappings).\n\nThe corruption can be triggered artificially\n(http://lkml.kernel.org/r/201708040646.v746kkhC024636@www262.sakura.ne.jp)\nbut there doesn\u0027t seem to be any real life bug report.  The race window\nshould be quite tight to trigger most of the time.\n\nLink: http://lkml.kernel.org/r/20170807113839.16695-3-mhocko@kernel.org\nFixes: aac453635549 (\"mm, oom: introduce oom reaper\")\nSigned-off-by: Michal Hocko \u003cmhocko@suse.com\u003e\nReported-by: Wenwei Tao \u003cwenwei.tww@alibaba-inc.com\u003e\nTested-by: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nCc: \"Kirill A. Shutemov\" \u003ckirill@shutemov.name\u003e\nCc: Andrea Argangeli \u003candrea@kernel.org\u003e\nCc: David Rientjes \u003crientjes@google.com\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: Tetsuo Handa \u003cpenguin-kernel@i-love.sakura.ne.jp\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "5b53a6ea886700a128b697a6fe8375340dea2c30",
      "tree": "b0b1fa8f6673367612dca66bce5c81d6bdbc7f11",
      "parents": [
        "f6ba488073fe8159851fe398cc3c5ee383bb4c7a"
      ],
      "author": {
        "name": "Michal Hocko",
        "email": "mhocko@suse.com",
        "time": "Fri Aug 18 15:16:12 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 15:32:01 2017 -0700"
      },
      "message": "mm: fix double mmap_sem unlock on MMF_UNSTABLE enforced SIGBUS\n\nTetsuo Handa has noticed that MMF_UNSTABLE SIGBUS path in\nhandle_mm_fault causes a lockdep splat\n\n  Out of memory: Kill process 1056 (a.out) score 603 or sacrifice child\n  Killed process 1056 (a.out) total-vm:4268108kB, anon-rss:2246048kB, file-rss:0kB, shmem-rss:0kB\n  a.out (1169) used greatest stack depth: 11664 bytes left\n  DEBUG_LOCKS_WARN_ON(depth \u003c\u003d 0)\n  ------------[ cut here ]------------\n  WARNING: CPU: 6 PID: 1339 at kernel/locking/lockdep.c:3617 lock_release+0x172/0x1e0\n  CPU: 6 PID: 1339 Comm: a.out Not tainted 4.13.0-rc3-next-20170803+ #142\n  Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/02/2015\n  RIP: 0010:lock_release+0x172/0x1e0\n  Call Trace:\n     up_read+0x1a/0x40\n     __do_page_fault+0x28e/0x4c0\n     do_page_fault+0x30/0x80\n     page_fault+0x28/0x30\n\nThe reason is that the page fault path might have dropped the mmap_sem\nand returned with VM_FAULT_RETRY.  MMF_UNSTABLE check however rewrites\nthe error path to VM_FAULT_SIGBUS and we always expect mmap_sem taken in\nthat path.  Fix this by taking mmap_sem when VM_FAULT_RETRY is held in\nthe MMF_UNSTABLE path.\n\nWe cannot simply add VM_FAULT_SIGBUS to the existing error code because\nall arch specific page fault handlers and g-u-p would have to learn a\nnew error code combination.\n\nLink: http://lkml.kernel.org/r/20170807113839.16695-2-mhocko@kernel.org\nFixes: 3f70dc38cec2 (\"mm: make sure that kthreads will not refault oom reaped memory\")\nReported-by: Tetsuo Handa \u003cpenguin-kernel@i-love.sakura.ne.jp\u003e\nSigned-off-by: Michal Hocko \u003cmhocko@suse.com\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nCc: Andrea Argangeli \u003candrea@kernel.org\u003e\nCc: \"Kirill A. Shutemov\" \u003ckirill@shutemov.name\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: Wenwei Tao \u003cwenwei.tww@alibaba-inc.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[4.9+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "f6ba488073fe8159851fe398cc3c5ee383bb4c7a",
      "tree": "ef31a6801b9ba41c586349319994cb5eaf6555b6",
      "parents": [
        "3010f876500f9ba921afaeccec30c45ca6584dc8"
      ],
      "author": {
        "name": "Vladimir Davydov",
        "email": "vdavydov.dev@gmail.com",
        "time": "Fri Aug 18 15:16:08 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 15:32:01 2017 -0700"
      },
      "message": "slub: fix per memcg cache leak on css offline\n\nTo avoid a possible deadlock, sysfs_slab_remove() schedules an\nasynchronous work to delete sysfs entries corresponding to the kmem\ncache.  To ensure the cache isn\u0027t freed before the work function is\ncalled, it takes a reference to the cache kobject.  The reference is\nsupposed to be released by the work function.\n\nHowever, the work function (sysfs_slab_remove_workfn()) does nothing in\ncase the cache sysfs entry has already been deleted, leaking the kobject\nand the corresponding cache.\n\nThis may happen on a per memcg cache destruction, because sysfs entries\nof a per memcg cache are deleted on memcg offline if the cache is empty\n(see __kmemcg_cache_deactivate()).\n\nThe kmemleak report looks like this:\n\n  unreferenced object 0xffff9f798a79f540 (size 32):\n    comm \"kworker/1:4\", pid 15416, jiffies 4307432429 (age 28687.554s)\n    hex dump (first 32 bytes):\n      6b 6d 61 6c 6c 6f 63 2d 31 36 28 31 35 39 39 3a  kmalloc-16(1599:\n      6e 65 77 72 6f 6f 74 29 00 23 6b c0 ff ff ff ff  newroot).#k.....\n    backtrace:\n       kmemleak_alloc+0x4a/0xa0\n       __kmalloc_track_caller+0x148/0x2c0\n       kvasprintf+0x66/0xd0\n       kasprintf+0x49/0x70\n       memcg_create_kmem_cache+0xe6/0x160\n       memcg_kmem_cache_create_func+0x20/0x110\n       process_one_work+0x205/0x5d0\n       worker_thread+0x4e/0x3a0\n       kthread+0x109/0x140\n       ret_from_fork+0x2a/0x40\n  unreferenced object 0xffff9f79b6136840 (size 416):\n    comm \"kworker/1:4\", pid 15416, jiffies 4307432429 (age 28687.573s)\n    hex dump (first 32 bytes):\n      40 fb 80 c2 3e 33 00 00 00 00 00 40 00 00 00 00  @...\u003e3.....@....\n      00 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00  ................\n    backtrace:\n       kmemleak_alloc+0x4a/0xa0\n       kmem_cache_alloc+0x128/0x280\n       create_cache+0x3b/0x1e0\n       memcg_create_kmem_cache+0x118/0x160\n       memcg_kmem_cache_create_func+0x20/0x110\n       process_one_work+0x205/0x5d0\n       worker_thread+0x4e/0x3a0\n       kthread+0x109/0x140\n       ret_from_fork+0x2a/0x40\n\nFix the leak by adding the missing call to kobject_put() to\nsysfs_slab_remove_workfn().\n\nLink: http://lkml.kernel.org/r/20170812181134.25027-1-vdavydov.dev@gmail.com\nFixes: 3b7b314053d02 (\"slub: make sysfs file removal asynchronous\")\nSigned-off-by: Vladimir Davydov \u003cvdavydov.dev@gmail.com\u003e\nReported-by: Andrei Vagin \u003cavagin@gmail.com\u003e\nTested-by: Andrei Vagin \u003cavagin@gmail.com\u003e\nAcked-by: Tejun Heo \u003ctj@kernel.org\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nCc: Michal Hocko \u003cmhocko@kernel.org\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: Christoph Lameter \u003ccl@linux.com\u003e\nCc: Pekka Enberg \u003cpenberg@kernel.org\u003e\nCc: Joonsoo Kim \u003ciamjoonsoo.kim@lge.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[4.12.x]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "3010f876500f9ba921afaeccec30c45ca6584dc8",
      "tree": "61f656b6b3f56459f27cb11944102bf3dfcc162b",
      "parents": [
        "768dc4e48420955518974d8486c1b00ec05e7274"
      ],
      "author": {
        "name": "Pavel Tatashin",
        "email": "pasha.tatashin@oracle.com",
        "time": "Fri Aug 18 15:16:05 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 15:32:01 2017 -0700"
      },
      "message": "mm: discard memblock data later\n\nThere is existing use after free bug when deferred struct pages are\nenabled:\n\nThe memblock_add() allocates memory for the memory array if more than\n128 entries are needed.  See comment in e820__memblock_setup():\n\n  * The bootstrap memblock region count maximum is 128 entries\n  * (INIT_MEMBLOCK_REGIONS), but EFI might pass us more E820 entries\n  * than that - so allow memblock resizing.\n\nThis memblock memory is freed here:\n        free_low_memory_core_early()\n\nWe access the freed memblock.memory later in boot when deferred pages\nare initialized in this path:\n\n        deferred_init_memmap()\n                for_each_mem_pfn_range()\n                  __next_mem_pfn_range()\n                    type \u003d \u0026memblock.memory;\n\nOne possible explanation for why this use-after-free hasn\u0027t been hit\nbefore is that the limit of INIT_MEMBLOCK_REGIONS has never been\nexceeded at least on systems where deferred struct pages were enabled.\n\nTested by reducing INIT_MEMBLOCK_REGIONS down to 4 from the current 128,\nand verifying in qemu that this code is getting excuted and that the\nfreed pages are sane.\n\nLink: http://lkml.kernel.org/r/1502485554-318703-2-git-send-email-pasha.tatashin@oracle.com\nFixes: 7e18adb4f80b (\"mm: meminit: initialise remaining struct pages in parallel with kswapd\")\nSigned-off-by: Pavel Tatashin \u003cpasha.tatashin@oracle.com\u003e\nReviewed-by: Steven Sistare \u003csteven.sistare@oracle.com\u003e\nReviewed-by: Daniel Jordan \u003cdaniel.m.jordan@oracle.com\u003e\nReviewed-by: Bob Picco \u003cbob.picco@oracle.com\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Mel Gorman \u003cmgorman@techsingularity.net\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "768dc4e48420955518974d8486c1b00ec05e7274",
      "tree": "de2cbc00cdbbfe3c78ec62f0d620e7a60b9e79df",
      "parents": [
        "2ba293c9e7db150943f06b12d3eb7213e7fae624"
      ],
      "author": {
        "name": "Luis R. Rodriguez",
        "email": "mcgrof@kernel.org",
        "time": "Fri Aug 18 15:16:02 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 15:32:01 2017 -0700"
      },
      "message": "test_kmod: fix description for -s -and -c parameters\n\nThe descriptions were reversed, correct this.\n\nLink: http://lkml.kernel.org/r/20170809234635.13443-4-mcgrof@kernel.org\nFixes: 64b671204afd71 (\"test_sysctl: add generic script to expand on tests\")\nSigned-off-by: Luis R. Rodriguez \u003cmcgrof@kernel.org\u003e\nReported-by: Daniel Mentz \u003cdanielmentz@google.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Colin Ian King \u003ccolin.king@canonical.com\u003e\nCc: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nCc: David Binderman \u003cdcb314@hotmail.com\u003e\nCc: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: Jessica Yu \u003cjeyu@redhat.com\u003e\nCc: Josh Poimboeuf \u003cjpoimboe@redhat.com\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Matt Redfearn \u003cmatt.redfearn@imgetc.com\u003e\nCc: Matt Redfearn \u003cmatt.redfearn@imgtec.com\u003e\nCc: Michal Marek \u003cmmarek@suse.com\u003e\nCc: Miroslav Benes \u003cmbenes@suse.cz\u003e\nCc: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nCc: Petr Mladek \u003cpmladek@suse.com\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "2ba293c9e7db150943f06b12d3eb7213e7fae624",
      "tree": "cfb1356e158aa173014f9b3b364309eefc5d0d61",
      "parents": [
        "8ada92799ec4de00f4bc0f10b1ededa256c1ab22"
      ],
      "author": {
        "name": "Luis R. Rodriguez",
        "email": "mcgrof@kernel.org",
        "time": "Fri Aug 18 15:15:58 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 15:32:01 2017 -0700"
      },
      "message": "kmod: fix wait on recursive loop\n\nRecursive loops with module loading were previously handled in kmod by\nrestricting the number of modprobe calls to 50 and if that limit was\nbreached request_module() would return an error and a user would see the\nfollowing on their kernel dmesg:\n\n  request_module: runaway loop modprobe binfmt-464c\n  Starting init:/sbin/init exists but couldn\u0027t execute it (error -8)\n\nThis issue could happen for instance when a 64-bit kernel boots a 32-bit\nuserspace on some architectures and has no 32-bit binary format\nhanlders.  This is visible, for instance, when a CONFIG_MODULES enabled\n64-bit MIPS kernel boots a into o32 root filesystem and the binfmt\nhandler for o32 binaries is not built-in.\n\nAfter commit 6d7964a722af (\"kmod: throttle kmod thread limit\") we now\ndon\u0027t have any visible signs of an error and the kernel just waits for\nthe loop to end somehow.\n\nAlthough this *particular* recursive loop could also be addressed by\ndoing a sanity check on search_binary_handler() and disallowing a\nmodular binfmt to be required for modprobe, a generic solution for any\nrecursive kernel kmod issues is still needed.\n\nThis should catch these loops.  We can investigate each loop and address\neach one separately as they come in, this however puts a stop gap for\nthem as before.\n\nLink: http://lkml.kernel.org/r/20170809234635.13443-3-mcgrof@kernel.org\nFixes: 6d7964a722af (\"kmod: throttle kmod thread limit\")\nSigned-off-by: Luis R. Rodriguez \u003cmcgrof@kernel.org\u003e\nReported-by: Matt Redfearn \u003cmatt.redfearn@imgtec.com\u003e\nTested-by: Matt Redfearn \u003cmatt.redfearn@imgetc.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Colin Ian King \u003ccolin.king@canonical.com\u003e\nCc: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nCc: Daniel Mentz \u003cdanielmentz@google.com\u003e\nCc: David Binderman \u003cdcb314@hotmail.com\u003e\nCc: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: Jessica Yu \u003cjeyu@redhat.com\u003e\nCc: Josh Poimboeuf \u003cjpoimboe@redhat.com\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Michal Marek \u003cmmarek@suse.com\u003e\nCc: Miroslav Benes \u003cmbenes@suse.cz\u003e\nCc: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nCc: Petr Mladek \u003cpmladek@suse.com\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "8ada92799ec4de00f4bc0f10b1ededa256c1ab22",
      "tree": "0a46e01c5681017a638409044478f708bdf0792e",
      "parents": [
        "92e5aae457787d0bc6b255200d2fb116edf69794"
      ],
      "author": {
        "name": "Luis R. Rodriguez",
        "email": "mcgrof@kernel.org",
        "time": "Fri Aug 18 15:15:55 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 15:32:01 2017 -0700"
      },
      "message": "wait: add wait_event_killable_timeout()\n\nThese are the few pending fixes I have queued up for v4.13-final.  One\nis a a generic regression fix for recursive loops on kmod and the other\none is a trivial print out correction.\n\nDuring the v4.13 development we assumed that recursive kmod loops were\nno longer possible.  Clearly that is not true.  The regression fix makes\nuse of a new killable wait.  We use a killable wait to be paranoid in\nhow signals might be sent to modprobe and only accept a proper SIGKILL.\nThe signal will only be available to userspace to issue *iff* a thread\nhas already entered a wait state, and that happens only if we\u0027ve already\nthrottled after 50 kmod threads have been hit.\n\nNote that although it may seem excessive to trigger a failure afer 5\nseconds if all kmod thread remain busy, prior to the series of changes\nthat went into v4.13 we would actually *always* fatally fail any request\nwhich came in if the limit was already reached.  The new waiting\nimplemented in v4.13 actually gives us *more* breathing room -- the wait\nfor 5 seconds is a wait for *any* kmod thread to finish.  We give up and\nfail *iff* no kmod thread has finished and they\u0027re *all* running\nstraight for 5 consecutive seconds.  If 50 kmod threads are running\nconsecutively for 5 seconds something else must be really bad.\n\nRecursive loops with kmod are bad but they\u0027re also hard to implement\nproperly as a selftest without currently fooling current userspace tools\nlike kmod [1].  For instance kmod will complain when you run depmod if\nit finds a recursive loop with symbol dependency between modules as such\nthis type of recursive loop cannot go upstream as the modules_install\ntarget will fail after running depmod.\n\nThese tests already exist on userspace kmod upstream though (refer to\nthe testsuite/module-playground/mod-loop-*.c files).  The same is not\ntrue if request_module() is used though, or worst if aliases are used.\n\nLikewise the issue with 64-bit kernels booting 32-bit userspace without\na binfmt handler built-in is also currently not detected and proactively\navoided by userspace kmod tools, or kconfig for all architectures.\nAlthough we could complain in the kernel when some of these individual\nrecursive issues creep up, proactively avoiding these situations in\nuserspace at build time is what we should keep striving for.\n\nLastly, since recursive loops could happen with kmod it may mean\nrecursive loops may also be possible with other kernel usermode helpers,\nthis should be investigated and long term if we can come up with a more\nsensible generic solution even better!\n\n[0] https://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux.git/log/?h\u003d20170809-kmod-for-v4.13-final\n[1] https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git\n\nThis patch (of 3):\n\nThis wait is similar to wait_event_interruptible_timeout() but only\naccepts SIGKILL interrupt signal.  Other signals are ignored.\n\nLink: http://lkml.kernel.org/r/20170809234635.13443-2-mcgrof@kernel.org\nSigned-off-by: Luis R. Rodriguez \u003cmcgrof@kernel.org\u003e\nAcked-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\nCc: Jessica Yu \u003cjeyu@redhat.com\u003e\nCc: Rusty Russell \u003crusty@rustcorp.com.au\u003e\nCc: Michal Marek \u003cmmarek@suse.com\u003e\nCc: Petr Mladek \u003cpmladek@suse.com\u003e\nCc: Miroslav Benes \u003cmbenes@suse.cz\u003e\nCc: Josh Poimboeuf \u003cjpoimboe@redhat.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nCc: Matt Redfearn \u003cmatt.redfearn@imgtec.com\u003e\nCc: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nCc: Colin Ian King \u003ccolin.king@canonical.com\u003e\nCc: Daniel Mentz \u003cdanielmentz@google.com\u003e\nCc: David Binderman \u003cdcb314@hotmail.com\u003e\nCc: Matt Redfearn \u003cmatt.redfearn@imgetc.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "92e5aae457787d0bc6b255200d2fb116edf69794",
      "tree": "e246feb15627b3bbde2a033947ccede1eb0b2004",
      "parents": [
        "739f79fc9db1b38f96b5a5109b247a650fbebf6d"
      ],
      "author": {
        "name": "Nicholas Piggin",
        "email": "npiggin@gmail.com",
        "time": "Fri Aug 18 15:15:51 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 15:32:01 2017 -0700"
      },
      "message": "kernel/watchdog: fix Kconfig constraints for perf hardlockup watchdog\n\nCommit 05a4a9527931 (\"kernel/watchdog: split up config options\") lost\nthe perf-based hardlockup detector\u0027s dependency on PERF_EVENTS, which\ncan result in broken builds with some powerpc configurations.\n\nRestore the dependency.  Add it in for x86 too, despite x86 always\nselecting PERF_EVENTS it seems reasonable to make the dependency\nexplicit.\n\nLink: http://lkml.kernel.org/r/20170810114452.6673-1-npiggin@gmail.com\nFixes: 05a4a9527931 (\"kernel/watchdog: split up config options\")\nSigned-off-by: Nicholas Piggin \u003cnpiggin@gmail.com\u003e\nAcked-by: Don Zickus \u003cdzickus@redhat.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "739f79fc9db1b38f96b5a5109b247a650fbebf6d",
      "tree": "793f1f37d28fb7f6e9e4cb9cb1c20bbb457662df",
      "parents": [
        "039a8e38473323ed9f6c4415b4c3a36777efac34"
      ],
      "author": {
        "name": "Johannes Weiner",
        "email": "hannes@cmpxchg.org",
        "time": "Fri Aug 18 15:15:48 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 15:32:01 2017 -0700"
      },
      "message": "mm: memcontrol: fix NULL pointer crash in test_clear_page_writeback()\n\nJaegeuk and Brad report a NULL pointer crash when writeback ending tries\nto update the memcg stats:\n\n    BUG: unable to handle kernel NULL pointer dereference at 00000000000003b0\n    IP: test_clear_page_writeback+0x12e/0x2c0\n    [...]\n    RIP: 0010:test_clear_page_writeback+0x12e/0x2c0\n    Call Trace:\n     \u003cIRQ\u003e\n     end_page_writeback+0x47/0x70\n     f2fs_write_end_io+0x76/0x180 [f2fs]\n     bio_endio+0x9f/0x120\n     blk_update_request+0xa8/0x2f0\n     scsi_end_request+0x39/0x1d0\n     scsi_io_completion+0x211/0x690\n     scsi_finish_command+0xd9/0x120\n     scsi_softirq_done+0x127/0x150\n     __blk_mq_complete_request_remote+0x13/0x20\n     flush_smp_call_function_queue+0x56/0x110\n     generic_smp_call_function_single_interrupt+0x13/0x30\n     smp_call_function_single_interrupt+0x27/0x40\n     call_function_single_interrupt+0x89/0x90\n    RIP: 0010:native_safe_halt+0x6/0x10\n\n    (gdb) l *(test_clear_page_writeback+0x12e)\n    0xffffffff811bae3e is in test_clear_page_writeback (./include/linux/memcontrol.h:619).\n    614\t\tmod_node_page_state(page_pgdat(page), idx, val);\n    615\t\tif (mem_cgroup_disabled() || !page-\u003emem_cgroup)\n    616\t\t\treturn;\n    617\t\tmod_memcg_state(page-\u003emem_cgroup, idx, val);\n    618\t\tpn \u003d page-\u003emem_cgroup-\u003enodeinfo[page_to_nid(page)];\n    619\t\tthis_cpu_add(pn-\u003elruvec_stat-\u003ecount[idx], val);\n    620\t}\n    621\n    622\tunsigned long mem_cgroup_soft_limit_reclaim(pg_data_t *pgdat, int order,\n    623\t\t\t\t\t\t\tgfp_t gfp_mask,\n\nThe issue is that writeback doesn\u0027t hold a page reference and the page\nmight get freed after PG_writeback is cleared (and the mapping is\nunlocked) in test_clear_page_writeback().  The stat functions looking up\nthe page\u0027s node or zone are safe, as those attributes are static across\nallocation and free cycles.  But page-\u003emem_cgroup is not, and it will\nget cleared if we race with truncation or migration.\n\nIt appears this race window has been around for a while, but less likely\nto trigger when the memcg stats were updated first thing after\nPG_writeback is cleared.  Recent changes reshuffled this code to update\nthe global node stats before the memcg ones, though, stretching the race\nwindow out to an extent where people can reproduce the problem.\n\nUpdate test_clear_page_writeback() to look up and pin page-\u003emem_cgroup\nbefore clearing PG_writeback, then not use that pointer afterward.  It\nis a partial revert of 62cccb8c8e7a (\"mm: simplify lock_page_memcg()\")\nbut leaves the pageref-holding callsites that aren\u0027t affected alone.\n\nLink: http://lkml.kernel.org/r/20170809183825.GA26387@cmpxchg.org\nFixes: 62cccb8c8e7a (\"mm: simplify lock_page_memcg()\")\nSigned-off-by: Johannes Weiner \u003channes@cmpxchg.org\u003e\nReported-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\nTested-by: Jaegeuk Kim \u003cjaegeuk@kernel.org\u003e\nReported-by: Bradley Bolen \u003cbradleybolen@gmail.com\u003e\nTested-by: Brad Bolen \u003cbradleybolen@gmail.com\u003e\nCc: Vladimir Davydov \u003cvdavydov@virtuozzo.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.cz\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[4.6+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "cc28fcdc017e553375c999ca12107ceb27f34ab3",
      "tree": "c76c0a50ca4d6739f31eff748734dc524c6e49d9",
      "parents": [
        "70bfc741f845e55227900e4e5770bc359192c564",
        "77aff8c76425c8f49b50d0b9009915066739e7d2"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 14:25:50 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 14:25:50 2017 -0700"
      },
      "message": "Merge tag \u0027xfs-4.13-fixes-5\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fixes from Darrick Wong:\n \"A handful more bug fixes for you today.\n\n  Changes since last time:\n\n   - Don\u0027t leak resources when mount fails\n\n   - Don\u0027t accidentally clobber variables when looking for free inodes\"\n\n* tag \u0027xfs-4.13-fixes-5\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:\n  xfs: don\u0027t leak quotacheck dquots when cow recovery\n  xfs: clear MS_ACTIVE after finishing log recovery\n  iomap: fix integer truncation issues in the zeroing and dirtying helpers\n  xfs: fix inobt inode allocation search optimization\n"
    },
    {
      "commit": "70bfc741f845e55227900e4e5770bc359192c564",
      "tree": "7d71492bd7a3df269d83ece5e5de6fce59774193",
      "parents": [
        "edb20a1b4a31fae825470138a45a1ccee1e051c7",
        "c005390374957baacbc38eef96ea360559510aa7"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 14:12:39 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 14:12:39 2017 -0700"
      },
      "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.dk/linux-block\n\nPull block fixes from Jens Axboe:\n \"A small set of fixes that should go into this release. This contains:\n\n   - An NVMe pull request from Christoph, with a few select fixes.\n\n     One of them fix a polling regression in this series, in which it\u0027s\n     trivial to cause the kernel to disable most of the hardware queue\n     interrupts.\n\n   - Fixup for a blk-mq queue usage imbalance on request allocation,\n     from Keith.\n\n   - A xen block pull request from Konrad, fixing two issues with\n     xen/xen-blkfront\"\n\n* \u0027for-linus\u0027 of git://git.kernel.dk/linux-block:\n  blk-mq-pci: add a fallback when pci_irq_get_affinity returns NULL\n  nvme-pci: set cqe_seen on polled completions\n  nvme-fabrics: fix reporting of unrecognized options\n  nvmet-fc: eliminate incorrect static markers on local variables\n  nvmet-fc: correct use after free on list teardown\n  nvmet: don\u0027t overwrite identify sn/fr with 0-bytes\n  xen-blkfront: use a right index when checking requests\n  xen: fix bio vec merging\n  blk-mq: Fix queue usage on failed request allocation\n"
    },
    {
      "commit": "edb20a1b4a31fae825470138a45a1ccee1e051c7",
      "tree": "45b8377d31d8d306cca629c9d35eb41bca5c8d34",
      "parents": [
        "039a8e38473323ed9f6c4415b4c3a36777efac34",
        "870201f95fcbd19538aef630393fe9d583eff82e"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 12:35:22 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 12:35:22 2017 -0700"
      },
      "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma\n\nPull rdma fixes from Doug Ledford:\n \"Fourth set of -rc fixes for 4.13 cycle. This is all of the -rc fixes\n  that we know of. I suspect this will be the last rc pull request, but\n  you never know, I could be wrong.\n\n  Nothing major here. There are the i40iw patches I mentioned in my last\n  pull request minus one that I pulled out because it wasn\u0027t a fix and\n  not appropriate for the rc cycle. Then a few other items trickled in\n  and were added to the pull request. It\u0027s fairly small aside from those\n  five i40iw patches\n\n   - Set of five i40iw fixes (the first of these is rather large by line\n     count consideration, but I decided to send it because if fixes a\n     legitimate issue and the line count is because it does so by\n     creating a new function and using it where needed instead of just\n     patching up a few lines...a smaller fix could probably be done, but\n     the larger fix is the better code solution)\n\n   - One vmw_pvrdma fix\n\n   - One hns_roce fix (this silences a checker warning, but can\u0027t\n     actually happen, I expect a patch to remove this from all drivers\n     that share this same check in for-next)\n\n   - One iw_cxgb4 fix\n\n   - Two IB core fixes\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:\n  IB/uverbs: Fix NULL pointer dereference during device removal\n  IB/core: Protect sysfs entry on ib_unregister_device\n  iw_cxgb4: fix misuse of integer variable\n  IB/hns: fix memory leak on ah on error return path\n  i40iw: Fix potential fcn_id_array out of bounds\n  i40iw: Use correct alignment for CQ0 memory\n  i40iw: Fix typecast of tcp_seq_num\n  i40iw: Correct variable names\n  i40iw: Fix parsing of query/commit FPM buffers\n  RDMA/vmw_pvrdma: Report CQ missed events\n"
    },
    {
      "commit": "039a8e38473323ed9f6c4415b4c3a36777efac34",
      "tree": "315d9235076a263249b8ee365b3eed51b13ab6b5",
      "parents": [
        "42833468027770b8b731e3d9620165873439d237",
        "5a69aec945d27e78abac9fd032533d3aaebf7c1e"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 11:11:03 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 11:11:03 2017 -0700"
      },
      "message": "Merge tag \u0027powerpc-4.13-7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux\n\nPull powerpc fixes from Michael Ellerman:\n \"A bug in the VSX register saving that could cause userspace FP/VMX\n  register corruption.\n\n  Never seen to happen (that we know of), was found by code inspection,\n  but still tagged for stable given the consequences\"\n\n* tag \u0027powerpc-4.13-7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:\n  powerpc: Fix VSX enabling/flushing to also test MSR_FP and MSR_VEC\n"
    },
    {
      "commit": "42833468027770b8b731e3d9620165873439d237",
      "tree": "b94b2ef35c8921126fa975417183f8795b076dc7",
      "parents": [
        "cb247857f3dae0bdb843362c35027a0066b963a4",
        "4dd6a9973b8aaffac4bf37c5bb70e8eae5a7afb4"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 11:08:48 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 11:08:48 2017 -0700"
      },
      "message": "Merge tag \u0027armsoc-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc\n\nPull ARM SoC fixes from Arnd Bergmann:\n \"A small number of bugfixes, nothing serious this time. Here is a full\n  list.\n\n  4.13 regression fix:\n\n   - imx7d-sdb pinctrl support regressed in 4.13 due to an incomplete\n     patch\n\n  DT fixes for recently added devices:\n\n   - badly copied DT entries on imx6qdl-nitrogen6_som broke PCI reset\n\n   - sama5d2 memory controller had the wrong ID and registers\n\n   - imx7 power domains did not work correctly with deferred probing\n     (driver added in 4.12)\n\n   - Allwinner H5 pinctrl (added in 4.12) did not work right with GPIO\n     interrupts\n\n  Fixes for older bugs that just got noticed:\n\n   - i.MX25 ADC support (added in 4.6) apparently never worked right due\n     to a missing \u0027ranges\u0027 property in DT.\n\n   - Renesas Salvador Audio support (added in v4.5) was broken for\n     device repeated bind/unbind due to a naming conflict.\n\n   - Various allwinner boards are missing an \u0027ethernet\u0027 alias in DT,\n     leading to unstable device naming.\n\n  Preventive bugfix:\n\n   - TI Keystone needs a fix to prevent a NULL pointer dereference with\n     an upcoming PM change\"\n\n* tag \u0027armsoc-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:\n  soc: ti: ti_sci_pm_domains: Populate name for genpd\n  ARM: dts: imx6qdl-nitrogen6_som2: fix PCIe reset\n  arm64: allwinner: h5: fix pinctrl IRQs\n  arm64: allwinner: a64: sopine: add missing ethernet0 alias\n  arm64: allwinner: a64: pine64: add missing ethernet0 alias\n  arm64: allwinner: a64: bananapi-m64: add missing ethernet0 alias\n  arm64: renesas: salvator-common: avoid audio_clkout naming conflict\n  ARM: dts: i.MX25: add ranges to tscadc\n  soc: imx: gpcv2: fix regulator deferred probe\n  ARM: dts: at91: sama5d2: fix EBI/NAND controllers declaration\n  ARM: dts: at91: sama5d2: use sama5d2 compatible string for SMC\n  ARM: dts: imx7d-sdb: Put pinctrl_spi4 in the correct location\n"
    },
    {
      "commit": "cb247857f3dae0bdb843362c35027a0066b963a4",
      "tree": "ffb4d52bde2172ba7c195bbd3f33084acba948d4",
      "parents": [
        "4478976a43c5df8bc70e3a6b0e8ead9d7cff0a3f",
        "0b36f2bd28d040acedb52f4327eb2441afe4f514"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 11:02:49 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 11:02:49 2017 -0700"
      },
      "message": "Merge tag \u0027sound-4.13-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A collection of small fixes, mostly for regression fixes (sequencer\n  kconfig and emu10k1 probe) and device-specific quirks (three for USB\n  and one for HD-audio).\n\n  One significant change is a fix for races in ALSA sequencer core,\n  which covers over the previous incomplete fix\"\n\n* tag \u0027sound-4.13-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n  ALSA: emu10k1: Fix forgotten user-copy conversion in init code\n  ALSA: usb-audio: add DSD support for new Amanero PID\n  ALSA: usb-audio: Add mute TLV for playback volumes on C-Media devices\n  ALSA: usb-audio: Apply sample rate quirk to Sennheiser headset\n  ALSA: seq: 2nd attempt at fixing race creating a queue\n  ALSA: hda/realtek - Fix pincfg for Dell XPS 13 9370\n  ALSA: seq: Fix CONFIG_SND_SEQ_MIDI dependency\n"
    },
    {
      "commit": "4478976a43c5df8bc70e3a6b0e8ead9d7cff0a3f",
      "tree": "237e1fbcc10735f806781f55f3ac6fb6268dfe12",
      "parents": [
        "04d49f3638d0210de592dd52ad62cfca8b3ed9fe",
        "ee7b1f31200d9f3cc45e1bd22e962bd6b1d4d611"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 10:51:30 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Fri Aug 18 10:51:30 2017 -0700"
      },
      "message": "Merge tag \u0027dma-mapping-4.13-3\u0027 of git://git.infradead.org/users/hch/dma-mapping\n\nPull dma-mapping fix from Christoph Hellwig:\n \"Another dma-mapping regression fix\"\n\n* tag \u0027dma-mapping-4.13-3\u0027 of git://git.infradead.org/users/hch/dma-mapping:\n  of: fix DMA mask generation\n"
    },
    {
      "commit": "c005390374957baacbc38eef96ea360559510aa7",
      "tree": "6055f163f22d993bcf03ed965510a45a8d28745b",
      "parents": [
        "6caa0503c43d65de92309b967b5b1aa289af303b"
      ],
      "author": {
        "name": "Christoph Hellwig",
        "email": "hch@lst.de",
        "time": "Thu Aug 17 12:24:47 2017 +0200"
      },
      "committer": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Fri Aug 18 08:08:14 2017 -0600"
      },
      "message": "blk-mq-pci: add a fallback when pci_irq_get_affinity returns NULL\n\nWhile pci_irq_get_affinity should never fail for SMP kernel that\nimplement the affinity mapping, it will always return NULL in the\nUP case, so provide a fallback mapping of all queues to CPU 0 in\nthat case.\n\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nCc: stable@vger.kernel.org\nReviewed-by: Omar Sandoval \u003cosandov@fb.com\u003e\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n"
    },
    {
      "commit": "6caa0503c43d65de92309b967b5b1aa289af303b",
      "tree": "a6c71e2455deac92e834d36cfe4509fa289d301c",
      "parents": [
        "3e09fc802d05695393a48f6c2d888771b80c4301",
        "e9d8a0fdeacd843c85dcef480cdb2ab76bcdb6e4"
      ],
      "author": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Fri Aug 18 08:04:15 2017 -0600"
      },
      "committer": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Fri Aug 18 08:04:15 2017 -0600"
      },
      "message": "Merge branch \u0027nvme-4.13\u0027 of git://git.infradead.org/nvme into for-linus\n\nPull NVMe changes from Christoph:\n\n\"The fixes are getting really small now - two for FC, one for PCI, one\n for the fabrics layer and one for the target.\"\n"
    },
    {
      "commit": "7edaeb6841dfb27e362288ab8466ebdc4972e867",
      "tree": "419ce3f71f7ffc17131bb911fb16ff037e3c6bb1",
      "parents": [
        "ef954844c7ace62f773f4f23e28d2d915adc419f"
      ],
      "author": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Tue Aug 15 09:50:13 2017 +0200"
      },
      "committer": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Fri Aug 18 12:35:02 2017 +0200"
      },
      "message": "kernel/watchdog: Prevent false positives with turbo modes\n\nThe hardlockup detector on x86 uses a performance counter based on unhalted\nCPU cycles and a periodic hrtimer. The hrtimer period is about 2/5 of the\nperformance counter period, so the hrtimer should fire 2-3 times before the\nperformance counter NMI fires. The NMI code checks whether the hrtimer\nfired since the last invocation. If not, it assumess a hard lockup.\n\nThe calculation of those periods is based on the nominal CPU\nfrequency. Turbo modes increase the CPU clock frequency and therefore\nshorten the period of the perf/NMI watchdog. With extreme Turbo-modes (3x\nnominal frequency) the perf/NMI period is shorter than the hrtimer period\nwhich leads to false positives.\n\nA simple fix would be to shorten the hrtimer period, but that comes with\nthe side effect of more frequent hrtimer and softlockup thread wakeups,\nwhich is not desired.\n\nImplement a low pass filter, which checks the perf/NMI period against\nkernel time. If the perf/NMI fires before 4/5 of the watchdog period has\nelapsed then the event is ignored and postponed to the next perf/NMI.\n\nThat solves the problem and avoids the overhead of shorter hrtimer periods\nand more frequent softlockup thread wakeups.\n\nFixes: 58687acba592 (\"lockup_detector: Combine nmi_watchdog and softlockup detector\")\nReported-and-tested-by: Kan Liang \u003cKan.liang@intel.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: dzickus@redhat.com\nCc: prarit@redhat.com\nCc: ak@linux.intel.com\nCc: babu.moger@oracle.com\nCc: peterz@infradead.org\nCc: eranian@google.com\nCc: acme@redhat.com\nCc: stable@vger.kernel.org\nCc: atomlin@redhat.com\nCc: akpm@linux-foundation.org\nCc: torvalds@linux-foundation.org\nLink: http://lkml.kernel.org/r/alpine.DEB.2.20.1708150931310.1886@nanos\n"
    },
    {
      "commit": "e8f241893dfbbebe2813c01eac54f263e6a5e59c",
      "tree": "756b308ef749eb12bc0b6011d301f3d272ce0d62",
      "parents": [
        "7374bfb82e3844abcc5a5b8034620d80b92b820d"
      ],
      "author": {
        "name": "Marc Zyngier",
        "email": "marc.zyngier@arm.com",
        "time": "Fri Aug 18 10:53:45 2017 +0100"
      },
      "committer": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Fri Aug 18 12:04:14 2017 +0200"
      },
      "message": "genirq: Restore trigger settings in irq_modify_status()\n\nirq_modify_status starts by clearing the trigger settings from\nirq_data before applying the new settings, but doesn\u0027t restore them,\nleaving them to IRQ_TYPE_NONE.\n\nThat\u0027s pretty confusing to the potential request_irq() that could\nfollow. Instead, snapshot the settings before clearing them, and restore\nthem if the irq_modify_status() invocation was not changing the trigger.\n\nFixes: 1e2a7d78499e (\"irqdomain: Don\u0027t set type when mapping an IRQ\")\nReported-and-tested-by: jeffy \u003cjeffy.chen@rock-chips.com\u003e\nSigned-off-by: Marc Zyngier \u003cmarc.zyngier@arm.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Jon Hunter \u003cjonathanh@nvidia.com\u003e\nCc: stable@vger.kernel.org\nLink: http://lkml.kernel.org/r/20170818095345.12378-1-marc.zyngier@arm.com\n\n"
    },
    {
      "commit": "4dd6a9973b8aaffac4bf37c5bb70e8eae5a7afb4",
      "tree": "139c5acd4a4f0d98649ce414f57b2de382561032",
      "parents": [
        "93112486f4b625130e7a998932b5fe6ff05bef3d"
      ],
      "author": {
        "name": "Dave Gerlach",
        "email": "d-gerlach@ti.com",
        "time": "Fri Jul 28 09:51:34 2017 -0700"
      },
      "committer": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Fri Aug 18 11:59:53 2017 +0200"
      },
      "message": "soc: ti: ti_sci_pm_domains: Populate name for genpd\n\nCommit b6a1d093f96b (\"PM / Domains: Extend generic power domain\ndebugfs\") now creates a debugfs directory for each genpd based on the\nname of the genpd. Currently no name is given to the genpd created by\nti_sci_pm_domains driver so because of this we see a NULL pointer\ndereferences when it is accessed on boot when the debugfs entry creation\nis attempted.\n\nGive the genpd a name before registering it to avoid this.\n\nFixes: 52835d59fc6c (\"soc: ti: Add ti_sci_pm_domains driver\")\nSigned-off-by: Dave Gerlach \u003cd-gerlach@ti.com\u003e\nSigned-off-by: Santosh Shilimkar \u003cssantosh@kernel.org\u003e\nSigned-off-by: Arnd Bergmann \u003carnd@arndb.de\u003e\n"
    },
    {
      "commit": "93112486f4b625130e7a998932b5fe6ff05bef3d",
      "tree": "028679b25f45d9ece5c6b683761dbc7c21dc8087",
      "parents": [
        "552c497c406e49261e6bee6236dd9a3f8fdd7ab5",
        "c40bc54fdf2d52a80f66b365f1eac9d43b32e107"
      ],
      "author": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Fri Aug 18 11:58:38 2017 +0200"
      },
      "committer": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Fri Aug 18 11:58:38 2017 +0200"
      },
      "message": "Merge tag \u0027imx-fixes-4.13-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into fixes\n\nPull \"i.MX fixes for 4.13, round 3\" from Shawn Guo:\n\n - Fix PCIe reset GPIO of imx6qdl-nitrogen6_som2 board, which was\n   a bad copy from nitrogen6_max device tree.\n\n* tag \u0027imx-fixes-4.13-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:\n  ARM: dts: imx6qdl-nitrogen6_som2: fix PCIe reset\n"
    },
    {
      "commit": "552c497c406e49261e6bee6236dd9a3f8fdd7ab5",
      "tree": "7d9ea53510a3b1aa8174c7ae83e550b921dcbf7b",
      "parents": [
        "872784bffbe4217611922bc0f929dbd9cad65528",
        "d86e63e1f0b7868c55c8d4a54854b85e2bac690b"
      ],
      "author": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Fri Aug 18 11:55:44 2017 +0200"
      },
      "committer": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Fri Aug 18 11:55:44 2017 +0200"
      },
      "message": "Merge tag \u0027sunxi-fixes-for-4.13-2\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into fixes\n\nPull \"Allwinner fixes for 4.13, round 2\" from Chen-Yu Tsai:\n\nThree fixes adding a missing alias for the Ethernet controller on A64\nboards. One adding a missing interrupt for the pin controller.\n\n* tag \u0027sunxi-fixes-for-4.13-2\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux:\n  arm64: allwinner: h5: fix pinctrl IRQs\n  arm64: allwinner: a64: sopine: add missing ethernet0 alias\n  arm64: allwinner: a64: pine64: add missing ethernet0 alias\n  arm64: allwinner: a64: bananapi-m64: add missing ethernet0 alias\n"
    },
    {
      "commit": "45bd07ad82622fb7c8dd7504d976b7dd11568965",
      "tree": "714db6b5a427f26ac62018479a9019216930c4a7",
      "parents": [
        "187e91fe5e915f4b7f39b824aa422493463e443d"
      ],
      "author": {
        "name": "Arvind Yadav",
        "email": "arvind.yadav.cs@gmail.com",
        "time": "Thu Jul 20 17:00:32 2017 +0530"
      },
      "committer": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Fri Aug 18 11:30:35 2017 +0200"
      },
      "message": "x86: Constify attribute_group structures\n\nattribute_groups are not supposed to change at runtime and none of the\ngroups is modified.\n\nMark the non-const structs as const.\n\n[ tglx: Folded into one big patch ]\n\nSigned-off-by: Arvind Yadav \u003carvind.yadav.cs@gmail.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: tony.luck@intel.com\nCc: bp@alien8.de\nLink: http://lkml.kernel.org/r/1500550238-15655-2-git-send-email-arvind.yadav.cs@gmail.com\n\n"
    },
    {
      "commit": "7374bfb82e3844abcc5a5b8034620d80b92b820d",
      "tree": "d1d2272dff303239a270341ca025ce1be715eef6",
      "parents": [
        "9c9947f893a254ec92cd5fe1439587e583302c9c"
      ],
      "author": {
        "name": "Florian Fainelli",
        "email": "f.fainelli@gmail.com",
        "time": "Thu Jul 27 15:47:33 2017 -0700"
      },
      "committer": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Fri Aug 18 11:06:35 2017 +0200"
      },
      "message": "MAINTAINERS: Remove Jason Cooper\u0027s irqchip git tree\n\nJason\u0027s irqchip tree does not seem to have been updated for many months\nnow, remove it from the list of trees to avoid any possible confusion.\n\nJason says:\n\n  \"Unfortunately, when I have time for irqchip, I don\u0027t always have the\n   time to properly follow up with pull-requests. So, for the time being,\n   I\u0027ll stick to reviewing as I can.\"\n\nSigned-off-by: Florian Fainelli \u003cf.fainelli@gmail.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nAcked-by: Jason Cooper \u003cjason@lakedaemon.net\u003e\nCc: marc.zyngier@arm.com\nLink: http://lkml.kernel.org/r/20170727224733.8288-1-f.fainelli@gmail.com\n"
    },
    {
      "commit": "0b36f2bd28d040acedb52f4327eb2441afe4f514",
      "tree": "cc2ebf4500efe626c1e1627359848f26f2e49ffc",
      "parents": [
        "ed993c6fdfa7734881a4516852d95ae2d3b604d3"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Fri Aug 18 10:55:10 2017 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Fri Aug 18 10:59:02 2017 +0200"
      },
      "message": "ALSA: emu10k1: Fix forgotten user-copy conversion in init code\n\nThe commit d42fe63d5839 (\"ALSA: emu10k1: Get rid of set_fs() usage\")\nconverted the user-space copy hack with set_fs() to the direct\nmemcpy(), but one place was forgotten.  This resulted in the error\nfrom snd_emu10k1_init_efx(), eventually failed to load the driver.\nFix the missing piece.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id\u003d196687\nFixes: d42fe63d5839 (\"ALSA: emu10k1: Get rid of set_fs() usage\")\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "ed993c6fdfa7734881a4516852d95ae2d3b604d3",
      "tree": "d329f785ef41b3a02036ecd83c25a7ea06f0387b",
      "parents": [
        "0f174b3525a43bd51f9397394763925e0ebe7bc7"
      ],
      "author": {
        "name": "Jussi Laako",
        "email": "jussi@sonarnerd.net",
        "time": "Fri Aug 18 10:42:14 2017 +0300"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Fri Aug 18 10:13:21 2017 +0200"
      },
      "message": "ALSA: usb-audio: add DSD support for new Amanero PID\n\nAdd DSD support for new Amanero Combo384 firmware version with a new\nPID. This firmware uses DSD_U32_BE.\n\nFixes: 3eff682d765b (\"ALSA: usb-audio: Support both DSD LE/BE Amanero firmware versions\")\nSigned-off-by: Jussi Laako \u003cjussi@sonarnerd.net\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "e9d8a0fdeacd843c85dcef480cdb2ab76bcdb6e4",
      "tree": "a0abd84c323fd92b2e267c989334bc1d8715f2ee",
      "parents": [
        "81a0b8d74edd5841be29d223ce44bc8db2b00d09"
      ],
      "author": {
        "name": "Keith Busch",
        "email": "keith.busch@intel.com",
        "time": "Thu Aug 17 16:45:06 2017 -0400"
      },
      "committer": {
        "name": "Christoph Hellwig",
        "email": "hch@lst.de",
        "time": "Fri Aug 18 09:19:39 2017 +0200"
      },
      "message": "nvme-pci: set cqe_seen on polled completions\n\nFixes: 920d13a884 (\"nvme-pci: factor out the cqe reading mechanics from __nvme_process_cq\")\nReported-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Keith Busch \u003ckeith.busch@intel.com\u003e\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\n"
    },
    {
      "commit": "c40bc54fdf2d52a80f66b365f1eac9d43b32e107",
      "tree": "414f215d615b70e74da2bcc6f4be34789608a82b",
      "parents": [
        "8317562097acec4c9e9750eb91115687931bca35"
      ],
      "author": {
        "name": "Gary Bisson",
        "email": "gary.bisson@boundarydevices.com",
        "time": "Thu Aug 17 15:50:10 2017 +0200"
      },
      "committer": {
        "name": "Shawn Guo",
        "email": "shawnguo@kernel.org",
        "time": "Fri Aug 18 09:40:40 2017 +0800"
      },
      "message": "ARM: dts: imx6qdl-nitrogen6_som2: fix PCIe reset\n\nPrevious value was a bad copy of nitrogen6_max device tree.\n\nSigned-off-by: Gary Bisson \u003cgary.bisson@boundarydevices.com\u003e\nFixes: 3faa1bb2e89c (\"ARM: dts: imx: add Boundary Devices Nitrogen6_SOM2 support\")\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Shawn Guo \u003cshawnguo@kernel.org\u003e\n"
    },
    {
      "commit": "04d49f3638d0210de592dd52ad62cfca8b3ed9fe",
      "tree": "7fecc08beedc44265ede1b6716f7633226255a70",
      "parents": [
        "d33a2a914319e9ec71f49bad2b8c8b9e05a58edf",
        "28eb46287916f7f3ceec874959693e3fc49a294a"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Aug 17 16:48:29 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Aug 17 16:48:29 2017 -0700"
      },
      "message": "Merge tag \u0027drm-fixes-for-v4.13-rc6\u0027 of git://people.freedesktop.org/~airlied/linux\n\nPull drm fixes from Dave Airlie:\n \"Seems to be slowing down nicely, just one amdgpu fix, and a bunch of\n  i915 fixes\"\n\n* tag \u0027drm-fixes-for-v4.13-rc6\u0027 of git://people.freedesktop.org/~airlied/linux:\n  drm/amdgpu: save list length when fence is signaled\n  drm/i915: Avoid the gpu reset vs. modeset deadlock\n  drm/i915: Suppress switch_mm emission between the same aliasing_ppgtt\n  drm/i915: Return correct EDP voltage swing table for 0.85V\n  drm/i915/cnl: Add slice and subslice information to debugfs.\n  drm/i915: Perform an invalidate prior to executing golden renderstate\n  drm/i915: remove unused function declaration\n"
    },
    {
      "commit": "d33a2a914319e9ec71f49bad2b8c8b9e05a58edf",
      "tree": "4e4de33d81a96e99da477ed28e3eb5965be475d2",
      "parents": [
        "440105d3c958cf10b5900fac9d4632d47d57a0cc",
        "8179962b84668d71586cd3efcb70e823f37a5702"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Aug 17 14:21:18 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Aug 17 14:21:18 2017 -0700"
      },
      "message": "Merge tag \u0027pm-4.13-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n \"These fix two issues related to exposing the current CPU frequency to\n  user space on x86.\n\n  Specifics:\n\n   - Disable interrupts around reading IA32_APERF and IA32_MPERF in\n     aperfmperf_snapshot_khz() (introduced recently) to avoid excessive\n     delays between the reads that may result from interrupt handling\n     (Doug Smythies).\n\n   - Fix the computation of the CPU frequency to be reported through the\n     pstate_sample tracepoint in intel_pstate (Doug Smythies)\"\n\n* tag \u0027pm-4.13-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n  cpufreq: x86: Disable interrupts during MSRs reading\n  cpufreq: intel_pstate: report correct CPU frequencies during trace\n"
    },
    {
      "commit": "440105d3c958cf10b5900fac9d4632d47d57a0cc",
      "tree": "e89313c0979b050f985f252c76ad6613cc5a91ad",
      "parents": [
        "3bc6c906eacec34f0d8dcfd3c7e4513edf152297",
        "76988690402dde2880bfe06ecccf381d48ba8e1c"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Aug 17 13:45:44 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Aug 17 13:45:44 2017 -0700"
      },
      "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input fixes from Dmitry Torokhov.\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n  Input: elan_i2c - Add antoher Lenovo ACPI ID for upcoming Lenovo NB\n  Input: elan_i2c - add ELAN0608 to the ACPI table\n  Input: trackpoint - assume 3 buttons when buttons detection fails\n"
    },
    {
      "commit": "28eb46287916f7f3ceec874959693e3fc49a294a",
      "tree": "fdbce10ee987b700ec3794141401ba823f7640d3",
      "parents": [
        "41d31b5fd29bd768a7174b754249c97563c21fae",
        "7a7c286d07f9c704e8fd11dd960bf421cc67b66b"
      ],
      "author": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Fri Aug 18 05:45:03 2017 +1000"
      },
      "committer": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Fri Aug 18 05:45:03 2017 +1000"
      },
      "message": "Merge branch \u0027drm-fixes-4.13\u0027 of git://people.freedesktop.org/~agd5f/linux into drm-fixes\n\nsingle amdgpu fix.\n\n* \u0027drm-fixes-4.13\u0027 of git://people.freedesktop.org/~agd5f/linux:\n  drm/amdgpu: save list length when fence is signaled\n"
    },
    {
      "commit": "41d31b5fd29bd768a7174b754249c97563c21fae",
      "tree": "3c3d1f16f3ec2706a463a388ae58c699b9b22144",
      "parents": [
        "ef954844c7ace62f773f4f23e28d2d915adc419f",
        "781cc76e0c2469cb7ac12ba238a4ea006978e321"
      ],
      "author": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Fri Aug 18 05:43:10 2017 +1000"
      },
      "committer": {
        "name": "Dave Airlie",
        "email": "airlied@redhat.com",
        "time": "Fri Aug 18 05:43:10 2017 +1000"
      },
      "message": "Merge tag \u0027drm-intel-fixes-2017-08-16\u0027 of git://anongit.freedesktop.org/git/drm-intel into drm-fixes\n\ndrm/i915 fixes for v4.13-rc6\n\n\"Chris\u0027 \"drm/i915: Perform an invalidate prior to executing golden renderstate\" and Daniel\u0027s\n\"drm/i915: Avoid the gpu reset vs. modeset deadlock\" seem like the most important ones.\n\n* tag \u0027drm-intel-fixes-2017-08-16\u0027 of git://anongit.freedesktop.org/git/drm-intel:\n  drm/i915: Avoid the gpu reset vs. modeset deadlock\n  drm/i915: Suppress switch_mm emission between the same aliasing_ppgtt\n  drm/i915: Return correct EDP voltage swing table for 0.85V\n  drm/i915/cnl: Add slice and subslice information to debugfs.\n  drm/i915: Perform an invalidate prior to executing golden renderstate\n  drm/i915: remove unused function declaration\n"
    },
    {
      "commit": "77aff8c76425c8f49b50d0b9009915066739e7d2",
      "tree": "a50370e38abe86979873fbf79c68e791c9aff0cd",
      "parents": [
        "8204f8ddaafafcae074746fcf2a05a45e6827603"
      ],
      "author": {
        "name": "Darrick J. Wong",
        "email": "darrick.wong@oracle.com",
        "time": "Thu Aug 10 14:20:29 2017 -0700"
      },
      "committer": {
        "name": "Darrick J. Wong",
        "email": "darrick.wong@oracle.com",
        "time": "Thu Aug 17 12:40:33 2017 -0700"
      },
      "message": "xfs: don\u0027t leak quotacheck dquots when cow recovery\n\nIf we fail a mount on account of cow recovery errors, it\u0027s possible that\na previous quotacheck left some dquots in memory.  The bailout clause of\nxfs_mountfs forgets to purge these, and so we leak them.  Fix that.\n\nSigned-off-by: Darrick J. Wong \u003cdarrick.wong@oracle.com\u003e\nReviewed-by: Brian Foster \u003cbfoster@redhat.com\u003e\n"
    },
    {
      "commit": "8204f8ddaafafcae074746fcf2a05a45e6827603",
      "tree": "9313a82a31be8acdbc07a403981a3636a900d608",
      "parents": [
        "e28ae8e428fefe2facd72cea9f29906ecb9c861d"
      ],
      "author": {
        "name": "Darrick J. Wong",
        "email": "darrick.wong@oracle.com",
        "time": "Thu Aug 10 14:20:28 2017 -0700"
      },
      "committer": {
        "name": "Darrick J. Wong",
        "email": "darrick.wong@oracle.com",
        "time": "Thu Aug 17 12:40:33 2017 -0700"
      },
      "message": "xfs: clear MS_ACTIVE after finishing log recovery\n\nWay back when we established inode block-map redo log items, it was\ndiscovered that we needed to prevent the VFS from evicting inodes during\nlog recovery because any given inode might be have bmap redo items to\nreplay even if the inode has no link count and is ultimately deleted,\nand any eviction of an unlinked inode causes the inode to be truncated\nand freed too early.\n\nTo make this possible, we set MS_ACTIVE so that inodes would not be torn\ndown immediately upon release.  Unfortunately, this also results in the\nquota inodes not being released at all if a later part of the mount\nprocess should fail, because we never reclaim the inodes.  So, set\nMS_ACTIVE right before we do the last part of log recovery and clear it\nimmediately after we finish the log recovery so that everything\nwill be torn down properly if we abort the mount.\n\nFixes: 17c12bcd30 (\"xfs: when replaying bmap operations, don\u0027t let unlinked inodes get reaped\")\nSigned-off-by: Darrick J. Wong \u003cdarrick.wong@oracle.com\u003e\nReviewed-by: Brian Foster \u003cbfoster@redhat.com\u003e\n"
    },
    {
      "commit": "8179962b84668d71586cd3efcb70e823f37a5702",
      "tree": "406df08e9216516d057e3c7b6ede926c845637fa",
      "parents": [
        "ef954844c7ace62f773f4f23e28d2d915adc419f",
        "c587c79f90632df59c61383c6abebb2e07a81911",
        "8e2f3bce05e056575c2c84a344a8291fdabb5f21"
      ],
      "author": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Thu Aug 17 21:00:30 2017 +0200"
      },
      "committer": {
        "name": "Rafael J. Wysocki",
        "email": "rafael.j.wysocki@intel.com",
        "time": "Thu Aug 17 21:00:30 2017 +0200"
      },
      "message": "Merge branches \u0027intel_pstate-fix\u0027 and \u0027cpufreq-x86-fix\u0027\n\n* intel_pstate-fix:\n  cpufreq: intel_pstate: report correct CPU frequencies during trace\n\n* cpufreq-x86-fix:\n  cpufreq: x86: Disable interrupts during MSRs reading\n"
    },
    {
      "commit": "3bc6c906eacec34f0d8dcfd3c7e4513edf152297",
      "tree": "6fdca669a44a3084d140fffeda7fc4a157b5772b",
      "parents": [
        "99f781b1bfc199ec8eb86d4e015920faf79d5d57",
        "d6957f3396d0b1ee54d183524550d791054b5ebe"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Aug 17 11:39:54 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Aug 17 11:39:54 2017 -0700"
      },
      "message": "Merge branch \u0027parisc-4.13-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux\n\nPull parisc fixes from Helge Deller:\n\n - Fix PCI memory bar assignments with 64-bit kernels on machines with\n   Dino/Cujo PCI chipsets. This makes PCI graphic cards work on such\n   machines (from Thomas Bogendoerfer).\n\n - Fix documentation to be more clear about the difference between %pF\n   and %pS printk format usage. There are still many places in the\n   kernel which have it wrong (from Petr Mladek, Sergey Senozhatsky \u0026\n   me).\n\n* \u0027parisc-4.13-5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:\n  printk-formats.txt: Better describe the difference between %pS and %pF\n  parisc: pci memory bar assignment fails with 64bit kernels on dino/cujo\n"
    },
    {
      "commit": "81a0b8d74edd5841be29d223ce44bc8db2b00d09",
      "tree": "84017dbbeda72bcf8c2dc30a3b3a35b086098b76",
      "parents": [
        "369157b41cca435442cf5add9df209aaf951860d"
      ],
      "author": {
        "name": "Christoph Hellwig",
        "email": "hch@lst.de",
        "time": "Thu Aug 17 13:57:49 2017 +0200"
      },
      "committer": {
        "name": "Christoph Hellwig",
        "email": "hch@lst.de",
        "time": "Thu Aug 17 18:48:54 2017 +0200"
      },
      "message": "nvme-fabrics: fix reporting of unrecognized options\n\nOnly print the specified options that are not recognized, instead\nof the whole list of options.\n\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nReviewed-by: Max Gurtovoy \u003cmaxg@mellanox.com\u003e\n"
    },
    {
      "commit": "99f781b1bfc199ec8eb86d4e015920faf79d5d57",
      "tree": "68fe7253ef59880a6a18b51f51a8bef8bdc427b6",
      "parents": [
        "c8c03f1858331e85d397bacccd34ef409aae993c",
        "41e327b586762833e48b3703d53312ac32f05f24"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Aug 17 09:26:10 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Aug 17 09:26:10 2017 -0700"
      },
      "message": "Merge branch \u0027for_linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs\n\nPull quota fix from Jan Kara:\n \"A fix of a check for quota limit\"\n\n* \u0027for_linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:\n  quota: correct space limit check\n"
    },
    {
      "commit": "c8c03f1858331e85d397bacccd34ef409aae993c",
      "tree": "02e36380538407e87ebd5b523c79851f7549d6c9",
      "parents": [
        "ac9a40905a610fb02086a37b11ff4bf046825a88"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Aug 16 17:08:07 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Thu Aug 17 09:10:48 2017 -0700"
      },
      "message": "pty: fix the cached path of the pty slave file descriptor in the master\n\nChristian Brauner reported that if you use the TIOCGPTPEER ioctl() to\nget a slave pty file descriptor, the resulting file descriptor doesn\u0027t\nlook right in /proc/\u003cpid\u003e/fd/\u003cfd\u003e.  In particular, he wanted to use\nreadlink() on /proc/self/fd/\u003cfd\u003e to get the pathname of the slave pty\n(basically implementing \"ptsname{_r}()\").\n\nThe reason for that was that we had generated the wrong \u0027struct path\u0027\nwhen we create the pty in ptmx_open().\n\nIn particular, the dentry was correct, but the vfsmount pointed to the\nmount of the ptmx node. That _can_ be correct - in case you use\n\"/dev/pts/ptmx\" to open the master - but usually is not.  The normal\ncase is to use /dev/ptmx, which then looks up the pts/ directory, and\nthen the vfsmount of the ptmx node is obviously the /dev directory, not\nthe /dev/pts/ directory.\n\nWe actually did have the right vfsmount available, but in the wrong\nplace (it gets looked up in \u0027devpts_acquire()\u0027 when we get a reference\nto the pts filesystem), and so ptmx_open() used the wrong mnt pointer.\n\nThe end result of this confusion was that the pty worked fine, but when\nif you did TIOCGPTPEER to get the slave side of the pty, end end result\nwould also work, but have that dodgy \u0027struct path\u0027.\n\nAnd then when doing \"d_path()\" on to get the pathname, the vfsmount\nwould not match the root of the pts directory, and d_path() would return\nan empty pathname thinking that the entry had escaped a bind mount into\nanother mount.\n\nThis fixes the problem by making devpts_acquire() return the vfsmount\nfor the pts filesystem, allowing ptmx_open() to trivially just use the\nright mount for the pts dentry, and create the proper \u0027struct path\u0027.\n\nReported-by: Christian Brauner \u003cchristian.brauner@ubuntu.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nAcked-by: Eric Biederman \u003cebiederm@xmission.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n"
    },
    {
      "commit": "0f174b3525a43bd51f9397394763925e0ebe7bc7",
      "tree": "f13262060f55267e5740e1cea1ad979e36813f4a",
      "parents": [
        "a8e800fe0f68bc28ce309914f47e432742b865ed"
      ],
      "author": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Wed Aug 16 14:18:37 2017 +0200"
      },
      "committer": {
        "name": "Takashi Iwai",
        "email": "tiwai@suse.de",
        "time": "Thu Aug 17 17:52:16 2017 +0200"
      },
      "message": "ALSA: usb-audio: Add mute TLV for playback volumes on C-Media devices\n\nC-Media devices (at least some models) mute the playback stream when\nvolumes are set to the minimum value.  But this isn\u0027t informed via TLV\nand the user-space, typically PulseAudio, gets confused as if it\u0027s\nstill played in a low volume.\n\nThis patch adds the new flag, min_mute, to struct usb_mixer_elem_info\nfor indicating that the mixer element is with the minimum-mute volume.\nThis flag is set for known C-Media devices in\nsnd_usb_mixer_fu_apply_quirk() in turn.\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id\u003d196669\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n"
    },
    {
      "commit": "872784bffbe4217611922bc0f929dbd9cad65528",
      "tree": "b38bd8ba020eff9da284786ae629ab7e3740b4ed",
      "parents": [
        "44506752fafae0c9358af95ffc89c687ce56650e",
        "8cd7b51ff57c74260b20c97623b0e0d420c22be8"
      ],
      "author": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Thu Aug 17 11:00:26 2017 +0200"
      },
      "committer": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Thu Aug 17 11:00:26 2017 +0200"
      },
      "message": "Merge tag \u0027renesas-fixes4-for-v4.13\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into fixes\n\nPull \"Fourth Round of Renesas ARM Based SoC Fixes for v4.13\" from Simon Horman:\n\n* Avoid audio_clkout naming conflict for salvator boards using\n  Renesas R-Car Gen 3 SoCs\n\n  Morimoto-san says \"The clock name of \"audio_clkout\" is used by the\n  Renesas sound driver.  This duplicated naming breaks its clock\n  registering/unregistering.  Especially when unbind/bind it can\u0027t handle\n  clkout correctly.  This patch renames \"audio_clkout\" to \"audio-clkout\" to\n  avoid the naming conflict.\"\n\n* tag \u0027renesas-fixes4-for-v4.13\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:\n  arm64: renesas: salvator-common: avoid audio_clkout naming conflict\n"
    },
    {
      "commit": "ee7b1f31200d9f3cc45e1bd22e962bd6b1d4d611",
      "tree": "9988e94d8327023090322f4b5e54683cddb51d2c",
      "parents": [
        "ef954844c7ace62f773f4f23e28d2d915adc419f"
      ],
      "author": {
        "name": "Robin Murphy",
        "email": "robin.murphy@arm.com",
        "time": "Fri Aug 11 17:29:56 2017 +0100"
      },
      "committer": {
        "name": "Christoph Hellwig",
        "email": "hch@lst.de",
        "time": "Thu Aug 17 10:23:45 2017 +0200"
      },
      "message": "of: fix DMA mask generation\n\nHistorically, DMA masks have suffered some ambiguity between whether\nthey represent the range of physical memory a device can access, or the\naddress bits a device is capable of driving, particularly since on many\nplatforms the two are equivalent. Whilst there are some stragglers left\n(dma_max_pfn(), I\u0027m looking at you...), the majority of DMA code has\nbeen cleaned up to follow the latter definition, not least since it is\nthe only one which makes sense once IOMMUs are involved.\n\nIn this respect, of_dma_configure() has always done the wrong thing in\nhow it generates initial masks based on \"dma-ranges\". Although rounding\ndown did not affect the TI Keystone platform where dma_addr + size is\nalready a power of two, in any other case it results in a mask which is\nat best unnecessarily constrained and at worst unusable.\n\nBCM2837 illustrates the problem nicely, where we have a DMA base of 3GB\nand a size of 1GB - 16MB, giving dma_addr + size \u003d 0xff000000 and a\nresultant mask of 0x7fffffff, which is then insufficient to even cover\nthe necessary offset, effectively making all DMA addresses out-of-range.\nThis has been hidden until now (mostly because we don\u0027t yet prevent\ndrivers from simply overwriting this initial mask later upon probe), but\ndue to recent changes elsewhere now shows up as USB being broken on\nRaspberry Pi 3.\n\nMake it right by rounding up instead of down, such that the mask\ncorrectly correctly describes all possisble bits the device needs to\nemit.\n\nFixes: 9a6d7298b083 (\"of: Calculate device DMA masks based on DT dma-range size\")\nReported-by: Stefan Wahren \u003cstefan.wahren@i2se.com\u003e\nReported-by: Andreas Färber \u003cafaerber@suse.de\u003e\nReported-by: Hans Verkuil \u003chverkuil@xs4all.nl\u003e\nSigned-off-by: Robin Murphy \u003crobin.murphy@arm.com\u003e\nAcked-by: Rob Herring \u003crobh@kernel.org\u003e\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\n"
    },
    {
      "commit": "187e91fe5e915f4b7f39b824aa422493463e443d",
      "tree": "4b2c8fe90f4d4be61b2a25ceb1c5a6fe20d6aad0",
      "parents": [
        "01578e36163cdd0e4fd61d9976de15f13364e26d"
      ],
      "author": {
        "name": "Alexander Potapenko",
        "email": "glider@google.com",
        "time": "Wed Aug 16 21:08:08 2017 +0200"
      },
      "committer": {
        "name": "Ingo Molnar",
        "email": "mingo@kernel.org",
        "time": "Thu Aug 17 09:53:00 2017 +0200"
      },
      "message": "x86/boot/64/clang: Use fixup_pointer() to access \u0027next_early_pgt\u0027\n\n__startup_64() is normally using fixup_pointer() to access globals in a\nposition-independent fashion. However \u0027next_early_pgt\u0027 was accessed\ndirectly, which wasn\u0027t guaranteed to work.\n\nLuckily GCC was generating a R_X86_64_PC32 PC-relative relocation for\n\u0027next_early_pgt\u0027, but Clang emitted a R_X86_64_32S, which led to\naccessing invalid memory and rebooting the kernel.\n\nSigned-off-by: Alexander Potapenko \u003cglider@google.com\u003e\nAcked-by: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nCc: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nCc: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Michael Davidson \u003cmd@google.com\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nFixes: c88d71508e36 (\"x86/boot/64: Rewrite startup_64() in C\")\nLink: http://lkml.kernel.org/r/20170816190808.131748-1-glider@google.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n"
    },
    {
      "commit": "369157b41cca435442cf5add9df209aaf951860d",
      "tree": "01e5eb2a6603be7be9b56374b8de54fa79589f13",
      "parents": [
        "16a5a480f067f945fd27bf91ffdce3f959b0d4b6"
      ],
      "author": {
        "name": "James Smart",
        "email": "jsmart2021@gmail.com",
        "time": "Wed Aug 16 10:47:03 2017 -0700"
      },
      "committer": {
        "name": "Christoph Hellwig",
        "email": "hch@lst.de",
        "time": "Thu Aug 17 09:35:08 2017 +0200"
      },
      "message": "nvmet-fc: eliminate incorrect static markers on local variables\n\nThere were 2 statics introduced that were bogus. Removed the static\ndesignations.\n\nSigned-off-by: James Smart \u003cjames.smart@broadcom.com\u003e\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\n"
    },
    {
      "commit": "ac9a40905a610fb02086a37b11ff4bf046825a88",
      "tree": "b08dfbd233483126fa1cd8aa5559564105d00c02",
      "parents": [
        "422ce075f969ffd650e371faa5a02586d0c0b2e6",
        "424f727b94132a4193af401dd823c44612d1d59f"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Aug 16 17:21:20 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Aug 16 17:21:20 2017 -0700"
      },
      "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"A couple of minor fixes (st, ses) and some bigger driver fixes for\n  qla2xxx (crash triggered by fw dump) and ipr (lockdep problems with\n  mq)\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n  scsi: ses: Fix wrong page error\n  scsi: ipr: Fix scsi-mq lockdep issue\n  scsi: st: fix blk_get_queue usage\n  scsi: qla2xxx: Fix system crash while triggering FW dump\n"
    },
    {
      "commit": "422ce075f969ffd650e371faa5a02586d0c0b2e6",
      "tree": "c9cbc23d3ae63eef00447a592799014e47b428cd",
      "parents": [
        "510c8a899caf095cb13d09d203573deef15db2fe",
        "b5fed474b98332559f2590c6bc90388a0899e793"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Aug 16 16:48:34 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Wed Aug 16 16:48:34 2017 -0700"
      },
      "message": "Merge tag \u0027audit-pr-20170816\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit\n\nPull audit fixes from Paul Moore:\n \"Two small fixes to the audit code, both explained well in the\n  respective patch descriptions, but the quick summary is one\n  use-after-free fix, and one silly fanotify notification flag fix\"\n\n* tag \u0027audit-pr-20170816\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:\n  audit: Receive unmount event\n  audit: Fix use after free in audit_remove_watch_rule()\n"
    },
    {
      "commit": "d6957f3396d0b1ee54d183524550d791054b5ebe",
      "tree": "ae4a0c48a2595a8dd04fcd134ddaf5ad7061a5a9",
      "parents": [
        "4098116039911e8870d84c975e2ec22dab65a909"
      ],
      "author": {
        "name": "Helge Deller",
        "email": "deller@gmx.de",
        "time": "Tue Aug 15 11:34:19 2017 +0200"
      },
      "committer": {
        "name": "Helge Deller",
        "email": "deller@gmx.de",
        "time": "Wed Aug 16 21:09:45 2017 +0200"
      },
      "message": "printk-formats.txt: Better describe the difference between %pS and %pF\n\nSometimes people seems unclear when to use the %pS or %pF printk format.\nFor example, see commit 51d96dc2e2dc (\"random: fix warning message on ia64\nand parisc\") which fixed such a wrong format string.\n\nThe documentation should be more clear about the difference.\n\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\n[pmladek@suse.com: Restructure the entire section]\nSigned-off-by: Petr Mladek \u003cpmladek@suse.com\u003e\nReviewed-by: Sergey Senozhatsky \u003csergey.senozhatsky@gmail.com\u003e\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\n"
    },
    {
      "commit": "01578e36163cdd0e4fd61d9976de15f13364e26d",
      "tree": "86533cfa0a449da9da60106db7e198502a0a65c1",
      "parents": [
        "47ac5484fd961420e5ec0bb5b972fde381f57365"
      ],
      "author": {
        "name": "Oleg Nesterov",
        "email": "oleg@redhat.com",
        "time": "Tue Aug 15 17:40:11 2017 +0200"
      },
      "committer": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Wed Aug 16 20:32:02 2017 +0200"
      },
      "message": "x86/elf: Remove the unnecessary ADDR_NO_RANDOMIZE checks\n\nThe ADDR_NO_RANDOMIZE checks in stack_maxrandom_size() and\nrandomize_stack_top() are not required.\n\nPF_RANDOMIZE is set by load_elf_binary() only if ADDR_NO_RANDOMIZE is not\nset, no need to re-check after that.\n\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nReviewed-by: Dmitry Safonov \u003cdsafonov@virtuozzo.com\u003e\nCc: stable@vger.kernel.org\nCc: Andy Lutomirski \u003cluto@amacapital.net\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Borislav Petkov \u003cbp@suse.de\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: \"Kirill A. Shutemov\" \u003ckirill.shutemov@linux.intel.com\u003e\nLink: http://lkml.kernel.org/r/20170815154011.GB1076@redhat.com\n\n"
    },
    {
      "commit": "47ac5484fd961420e5ec0bb5b972fde381f57365",
      "tree": "c18c896db669c488159a0ad412dc999931127346",
      "parents": [
        "84393817db09bb436e934f8f8cc981cbca9ea4dc"
      ],
      "author": {
        "name": "Oleg Nesterov",
        "email": "oleg@redhat.com",
        "time": "Tue Aug 15 17:39:52 2017 +0200"
      },
      "committer": {
        "name": "Thomas Gleixner",
        "email": "tglx@linutronix.de",
        "time": "Wed Aug 16 20:32:01 2017 +0200"
      },
      "message": "x86: Fix norandmaps/ADDR_NO_RANDOMIZE\n\nDocumentation/admin-guide/kernel-parameters.txt says:\n\n    norandmaps  Don\u0027t use address space randomization. Equivalent\n                to echo 0 \u003e /proc/sys/kernel/randomize_va_space\n\nbut it doesn\u0027t work because arch_rnd() which is used to randomize\nmm-\u003emmap_base returns a random value unconditionally. And as Kirill\npointed out, ADDR_NO_RANDOMIZE is broken by the same reason.\n\nJust shift the PF_RANDOMIZE check from arch_mmap_rnd() to arch_rnd().\n\nFixes: 1b028f784e8c (\"x86/mm: Introduce mmap_compat_base() for 32-bit mmap()\")\nSigned-off-by: Oleg Nesterov \u003coleg@redhat.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nAcked-by: Kirill A. Shutemov \u003ckirill.shutemov@linux.intel.com\u003e\nAcked-by: Cyrill Gorcunov \u003cgorcunov@openvz.org\u003e\nReviewed-by: Dmitry Safonov \u003cdsafonov@virtuozzo.com\u003e\nCc: stable@vger.kernel.org\nCc: Andy Lutomirski \u003cluto@amacapital.net\u003e\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Borislav Petkov \u003cbp@suse.de\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nLink: http://lkml.kernel.org/r/20170815153952.GA1076@redhat.com\n\n"
    },
    {
      "commit": "870201f95fcbd19538aef630393fe9d583eff82e",
      "tree": "4d465d12776a4ee8f8f7ae1af7f03e3535d499b4",
      "parents": [
        "06f8174a97822f6befd28fc2dd315b43b82c700f"
      ],
      "author": {
        "name": "Maor Gottlieb",
        "email": "maorg@mellanox.com",
        "time": "Wed Aug 16 18:57:04 2017 +0300"
      },
      "committer": {
        "name": "Doug Ledford",
        "email": "dledford@redhat.com",
        "time": "Wed Aug 16 12:53:15 2017 -0400"
      },
      "message": "IB/uverbs: Fix NULL pointer dereference during device removal\n\nAs part of ib_uverbs_remove_one which might be triggered upon\nreset flow, we trigger IB_EVENT_DEVICE_FATAL event to userspace\napplication.\nIf device was removed after uverbs fd was opened but before\nib_uverbs_get_context was called, the event file will be accessed\nbefore it was allocated, result in NULL pointer dereference:\n\n[ 72.325873] BUG: unable to handle kernel NULL pointer dereference at (null)\n...\n[ 72.325984] IP: _raw_spin_lock_irqsave+0x22/0x40\n[ 72.327123] Call Trace:\n[ 72.327168] ib_uverbs_async_handler.isra.8+0x2e/0x160 [ib_uverbs]\n[ 72.327216] ? synchronize_srcu_expedited+0x27/0x30\n[ 72.327269] ib_uverbs_remove_one+0x120/0x2c0 [ib_uverbs]\n[ 72.327330] ib_unregister_device+0xd0/0x180 [ib_core]\n[ 72.327373] mlx5_ib_remove+0x74/0x140 [mlx5_ib]\n[ 72.327422] mlx5_remove_device+0xfb/0x110 [mlx5_core]\n[ 72.327466] mlx5_unregister_interface+0x3c/0xa0 [mlx5_core]\n[ 72.327509] mlx5_ib_cleanup+0x10/0x962 [mlx5_ib]\n[ 72.327546] SyS_delete_module+0x155/0x230\n[ 72.328472] ? exit_to_usermode_loop+0x70/0xa6\n[ 72.329370] do_syscall_64+0x54/0xc0\n[ 72.330262] entry_SYSCALL64_slow_path+0x25/0x25\n\nFix it by checking that user context was allocated before\ntrigger the event.\n\nFixes: 036b10635739 (\u0027IB/uverbs: Enable device removal when there are active user space applications\u0027)\nSigned-off-by: Maor Gottlieb \u003cmaorg@mellanox.com\u003e\nReviewed-by: Matan Barak \u003cmatanb@mellanox.com\u003e\nSigned-off-by: Leon Romanovsky \u003cleon@kernel.org\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\n"
    },
    {
      "commit": "3e09fc802d05695393a48f6c2d888771b80c4301",
      "tree": "91ca26e7faf70ac11bd6c90cb5058a4e67a0aa49",
      "parents": [
        "3280d66a6363af0df0441709bc0bc302bd9a2510",
        "b15bd8cb37598afb2963f7eb9e2de468d2d60a2f"
      ],
      "author": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Wed Aug 16 09:56:34 2017 -0600"
      },
      "committer": {
        "name": "Jens Axboe",
        "email": "axboe@kernel.dk",
        "time": "Wed Aug 16 09:56:34 2017 -0600"
      },
      "message": "Merge branch \u0027stable/for-jens-4.13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen into for-linus\n\nPull xen block changes from Konrad:\n\nTwo fixes, both of them spotted by Amazon:\n\n 1) Fix in Xen-blkfront caused by the re-write in 4.8 time-frame.\n 2) Fix in the xen_biovec_phys_mergeable which allowed guest\n    requests when using NVMe - to slurp up more data than allowed\n    leading to an XSA (which has been made public today).\n"
    },
    {
      "commit": "06f8174a97822f6befd28fc2dd315b43b82c700f",
      "tree": "e3ad4668fb0634969fed2a747623f9e7751dac33",
      "parents": [
        "d4ba61d218822578dcf6c2453a38e000b0ea01e6"
      ],
      "author": {
        "name": "Shiraz Saleem",
        "email": "shiraz.saleem@intel.com",
        "time": "Mon Jul 17 14:03:50 2017 -0500"
      },
      "committer": {
        "name": "Doug Ledford",
        "email": "dledford@redhat.com",
        "time": "Wed Aug 16 11:47:55 2017 -0400"
      },
      "message": "IB/core: Protect sysfs entry on ib_unregister_device\n\nib_unregister_device is not protecting removal of sysfs entries.\nA call to ib_register_device in that window can result in\nduplicate sysfs entry warning. Move mutex_unlock to after\nib_device_unregister_sysfs to protect against sysfs entry creation.\n\nThis issue is exposed during driver load/unload stress test.\n\nWARNING: CPU: 5 PID: 4445 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x5f/0x70\nsysfs: cannot create duplicate filename \u0027/class/infiniband/i40iw0\u0027\nHardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./Q87M-D2H\nBIOS F7 01/17/2014\nWorkqueue: i40e i40e_service_task [i40e]\nCall Trace:\ndump_stack+0x67/0x98\n__warn+0xcc/0xf0\nwarn_slowpath_fmt+0x4a/0x50\n? kernfs_path_from_node+0x4b/0x60\nsysfs_warn_dup+0x5f/0x70\nsysfs_do_create_link_sd.isra.2+0xb7/0xc0\nsysfs_create_link+0x20/0x40\ndevice_add+0x28c/0x600\nib_device_register_sysfs+0x58/0x170 [ib_core]\nib_register_device+0x325/0x570 [ib_core]\n? i40iw_register_rdma_device+0x1f4/0x400 [i40iw]\n? kmem_cache_alloc_trace+0x143/0x330\n? __raw_spin_lock_init+0x2d/0x50\ni40iw_register_rdma_device+0x2dc/0x400 [i40iw]\ni40iw_open+0x10a6/0x1950 [i40iw]\n? i40iw_open+0xeab/0x1950 [i40iw]\n? i40iw_make_cm_node+0x9c0/0x9c0 [i40iw]\ni40e_client_subtask+0xa4/0x110 [i40e]\ni40e_service_task+0xc2d/0x1320 [i40e]\nprocess_one_work+0x203/0x710\n? process_one_work+0x16f/0x710\nworker_thread+0x126/0x4a0\n? trace_hardirqs_on+0xd/0x10\nkthread+0x112/0x150\n? process_one_work+0x710/0x710\n? kthread_create_on_node+0x40/0x40\nret_from_fork+0x2e/0x40\n---[ end trace fd11b69e21ea7653 ]---\nCouldn\u0027t register device i40iw0 with driver model\n\nSigned-off-by: Shiraz Saleem \u003cshiraz.saleem@intel.com\u003e\nSigned-off-by: Sindhu Devale \u003csindhu.devale@intel.com\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\n"
    },
    {
      "commit": "d4ba61d218822578dcf6c2453a38e000b0ea01e6",
      "tree": "c27f5df236f27303f2db40ba5d19038f75ca16f2",
      "parents": [
        "5b59a3969e95cd9be3699ecf7149ae8ef103b6f5"
      ],
      "author": {
        "name": "Steve Wise",
        "email": "swise@opengridcomputing.com",
        "time": "Tue Jul 25 06:51:15 2017 -0700"
      },
      "committer": {
        "name": "Doug Ledford",
        "email": "dledford@redhat.com",
        "time": "Wed Aug 16 11:43:21 2017 -0400"
      },
      "message": "iw_cxgb4: fix misuse of integer variable\n\nFixes: ee30f7d507c0 (\"iw_cxgb4: Max fastreg depth depends on DSGL support\")\nSigned-off-by: Steve Wise \u003cswise@opengridcomputing.com\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\n"
    },
    {
      "commit": "5b59a3969e95cd9be3699ecf7149ae8ef103b6f5",
      "tree": "940d528d54ef8bb6b51f82225ecd41a1b96b056e",
      "parents": [
        "aa939c12ab8a0c094420ad1b909a957ac590e43e"
      ],
      "author": {
        "name": "Colin Ian King",
        "email": "colin.king@canonical.com",
        "time": "Tue Aug 08 18:41:02 2017 +0100"
      },
      "committer": {
        "name": "Doug Ledford",
        "email": "dledford@redhat.com",
        "time": "Wed Aug 16 11:30:33 2017 -0400"
      },
      "message": "IB/hns: fix memory leak on ah on error return path\n\nWhen dmac is NULL, ah is not being freed on the error return path. Fix\nthis by kfree\u0027ing it.\n\nDetected by CoverityScan, CID#1452636 (\"Resource Leak\")\n\nFixes: d8966fcd4c25 (\"IB/core: Use rdma_ah_attr accessor functions\")\nSigned-off-by: Colin Ian King \u003ccolin.king@canonical.com\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\n"
    },
    {
      "commit": "aa939c12ab8a0c094420ad1b909a957ac590e43e",
      "tree": "4d25488be5d3e1f41da77144adea0d379c0d8a6a",
      "parents": [
        "a28f047e5f9b987d614eeee34388087ffdda3e53"
      ],
      "author": {
        "name": "Christopher N Bednarz",
        "email": "christopher.n.bednarz@intel.com",
        "time": "Tue Aug 08 20:38:48 2017 -0500"
      },
      "committer": {
        "name": "Doug Ledford",
        "email": "dledford@redhat.com",
        "time": "Wed Aug 16 11:27:44 2017 -0400"
      },
      "message": "i40iw: Fix potential fcn_id_array out of bounds\n\nAvoid out of bounds error by utilizing I40IW_MAX_STATS_COUNT\ninstead of I40IW_INVALID_FCN_ID.\n\nSigned-off-by: Christopher N Bednarz \u003cchristoper.n.bednarz@intel.com\u003e\nSigned-off-by: Henry Orosco \u003chenry.orosco@intel.com\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\n"
    },
    {
      "commit": "a28f047e5f9b987d614eeee34388087ffdda3e53",
      "tree": "26c3c9d73b9bf112bc5ed783ec7e5e339760a44e",
      "parents": [
        "29c2415a6669bab354f0aa3445777fe147c7a05d"
      ],
      "author": {
        "name": "Christopher N Bednarz",
        "email": "christopher.n.bednarz@intel.com",
        "time": "Tue Aug 08 20:38:47 2017 -0500"
      },
      "committer": {
        "name": "Doug Ledford",
        "email": "dledford@redhat.com",
        "time": "Wed Aug 16 11:27:44 2017 -0400"
      },
      "message": "i40iw: Use correct alignment for CQ0 memory\n\nUtilize correct alignment variable when allocating\nDMA memory for CQ0.\n\nSigned-off-by: Christopher N Bednarz \u003cchristopher.n.bednarz@intel.com\u003e\nSigned-off-by: Henry Orosco \u003chenry.orosco@intel.com\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\n"
    },
    {
      "commit": "29c2415a6669bab354f0aa3445777fe147c7a05d",
      "tree": "d6128e28aa822eacb63a6cd0893a3331b73966cc",
      "parents": [
        "8129331f01a683ed8d9a9a65ed01b5c6ad26403a"
      ],
      "author": {
        "name": "Mustafa Ismail",
        "email": "mustafa.ismail@intel.com",
        "time": "Tue Aug 08 20:38:46 2017 -0500"
      },
      "committer": {
        "name": "Doug Ledford",
        "email": "dledford@redhat.com",
        "time": "Wed Aug 16 11:27:44 2017 -0400"
      },
      "message": "i40iw: Fix typecast of tcp_seq_num\n\nThe typecast of tcp_seq_num incorrectly uses u8. Fix by\ncasting to u32.\n\nSigned-off-by: Mustafa Ismail \u003cmustafa.ismail@intel.com\u003e\nSigned-off-by: Henry Orosco \u003chenry.orosco@intel.com\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\n"
    },
    {
      "commit": "8129331f01a683ed8d9a9a65ed01b5c6ad26403a",
      "tree": "4341020798ddb0e56e7d84ca36bdf131c5f197ce",
      "parents": [
        "f67ace2d8868d06710ceea1b10b124eead5040da"
      ],
      "author": {
        "name": "Mustafa Ismail",
        "email": "mustafa.ismail@intel.com",
        "time": "Tue Aug 08 20:38:44 2017 -0500"
      },
      "committer": {
        "name": "Doug Ledford",
        "email": "dledford@redhat.com",
        "time": "Wed Aug 16 11:27:44 2017 -0400"
      },
      "message": "i40iw: Correct variable names\n\nFix incorrect naming of status code and struct. Use inline\ninstead of immediate.\n\nSigned-off-by: Mustafa Ismail \u003cmustafa.ismail@intel.com\u003e\nSigned-off-by: Henry Orosco \u003chenry.orosco@intel.com\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\n"
    },
    {
      "commit": "f67ace2d8868d06710ceea1b10b124eead5040da",
      "tree": "4ac7ede457cbb693c120d646ab6b84f54bb7c42d",
      "parents": [
        "a7d2e03928c1936004750c56faf7534c8534f875"
      ],
      "author": {
        "name": "Chien Tin Tung",
        "email": "chien.tin.tung@intel.com",
        "time": "Tue Aug 08 20:38:43 2017 -0500"
      },
      "committer": {
        "name": "Doug Ledford",
        "email": "dledford@redhat.com",
        "time": "Wed Aug 16 11:27:44 2017 -0400"
      },
      "message": "i40iw: Fix parsing of query/commit FPM buffers\n\nParsing of commit/query Host Memory Cache Function Private Memory\nis not skipping over reserved fields and incorrectly assigning\nthose values into object\u0027s base/cnt/max_cnt fields. Skip over\nreserved fields and set correct values. Also correct memory\nalignment requirement for commit/query FPM buffers.\n\nSigned-off-by: Chien Tin Tung \u003cchien.tin.tung@intel.com\u003e\nSigned-off-by: Shiraz Saleem \u003cshiraz.saleem@intel.com\u003e\nSigned-off-by: Christopher N Bednarz \u003cchristopher.n.bednarz@intel.com\u003e\nSigned-off-by: Henry Orosco \u003chenry.orosco@intel.com\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\n"
    },
    {
      "commit": "a7d2e03928c1936004750c56faf7534c8534f875",
      "tree": "fa3937c849945344e71c5a8a53daeb21051332aa",
      "parents": [
        "48107c4e596c8523d46c7b04f92cf29e7569a01e"
      ],
      "author": {
        "name": "Bryan Tan",
        "email": "bryantan@vmware.com",
        "time": "Thu Aug 10 12:05:02 2017 -0700"
      },
      "committer": {
        "name": "Doug Ledford",
        "email": "dledford@redhat.com",
        "time": "Wed Aug 16 10:56:04 2017 -0400"
      },
      "message": "RDMA/vmw_pvrdma: Report CQ missed events\n\nThere is a chance of a race between arming the CQ and receiving\ncompletions. By reporting CQ missed events any ULPs should poll\nagain to get the completions.\n\nFixes: 29c8d9eba550 (\"IB: Add vmw_pvrdma driver\")\nAcked-by: Aditya Sarwade \u003casarwade@vmware.com\u003e\nSigned-off-by: Bryan Tan \u003cbryantan@vmware.com\u003e\nSigned-off-by: Adit Ranadive \u003caditr@vmware.com\u003e\nReviewed-by: Yuval Shaia \u003cyuval.shaia@oracle.com\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\n"
    },
    {
      "commit": "5a69aec945d27e78abac9fd032533d3aaebf7c1e",
      "tree": "c5dde66bc1e715b8bc0e30fe872828d931a88038",
      "parents": [
        "96ea91e7b6ee2c406598d859e7348b4829404eea"
      ],
      "author": {
        "name": "Benjamin Herrenschmidt",
        "email": "benh@kernel.crashing.org",
        "time": "Wed Aug 16 16:01:14 2017 +1000"
      },
      "committer": {
        "name": "Michael Ellerman",
        "email": "mpe@ellerman.id.au",
        "time": "Wed Aug 16 19:35:54 2017 +1000"
      },
      "message": "powerpc: Fix VSX enabling/flushing to also test MSR_FP and MSR_VEC\n\nVSX uses a combination of the old vector registers, the old FP\nregisters and new \"second halves\" of the FP registers.\n\nThus when we need to see the VSX state in the thread struct\n(flush_vsx_to_thread()) or when we\u0027ll use the VSX in the kernel\n(enable_kernel_vsx()) we need to ensure they are all flushed into\nthe thread struct if either of them is individually enabled.\n\nUnfortunately we only tested if the whole VSX was enabled, not if they\nwere individually enabled.\n\nFixes: 72cd7b44bc99 (\"powerpc: Uncomment and make enable_kernel_vsx() routine available\")\nCc: stable@vger.kernel.org # v4.3+\nSigned-off-by: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\n"
    },
    {
      "commit": "16a5a480f067f945fd27bf91ffdce3f959b0d4b6",
      "tree": "d04bb93e2ec23fa0fa679794e954943920396b5d",
      "parents": [
        "42819eb7a0957cc340ad4ed8bba736bab5ebc464"
      ],
      "author": {
        "name": "James Smart",
        "email": "jsmart2021@gmail.com",
        "time": "Mon Aug 14 11:20:32 2017 -0700"
      },
      "committer": {
        "name": "Christoph Hellwig",
        "email": "hch@lst.de",
        "time": "Wed Aug 16 10:06:18 2017 +0200"
      },
      "message": "nvmet-fc: correct use after free on list teardown\n\nUse list_for_each_entry_safe to prevent list handling from referencing\nnext pointers directly after list_del\u0027s\n\nSigned-off-by: James Smart \u003cjames.smart@broadcom.com\u003e\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\n"
    },
    {
      "commit": "42819eb7a0957cc340ad4ed8bba736bab5ebc464",
      "tree": "35400590bfecbbdff6c8df86819b509356df43fd",
      "parents": [
        "a082b426286d1ead97fb87646ea361d528be023d"
      ],
      "author": {
        "name": "Martin Wilck",
        "email": "mwilck@suse.com",
        "time": "Mon Aug 14 22:12:37 2017 +0200"
      },
      "committer": {
        "name": "Christoph Hellwig",
        "email": "hch@lst.de",
        "time": "Wed Aug 16 10:06:10 2017 +0200"
      },
      "message": "nvmet: don\u0027t overwrite identify sn/fr with 0-bytes\n\nThe merged version of my patch \"nvmet: don\u0027t report 0-bytes in serial\nnumber\" fails to remove two lines which should have been replaced,\nso that the space-padded strings are overwritten again with 0-bytes.\nFix it.\n\nFixes: 42de82a8b544 nvmet: don\u0027t report 0-bytes in serial number\nSigned-off-by: Martin Wilck \u003cmwilck@suse.com\u003e\nReviewed-by: Sagi Grimberg \u003csagi@grimbeg.me\u003e\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\n"
    },
    {
      "commit": "4098116039911e8870d84c975e2ec22dab65a909",
      "tree": "6e6c858d8307269d52282018cc5aa067e945d6f9",
      "parents": [
        "ef954844c7ace62f773f4f23e28d2d915adc419f"
      ],
      "author": {
        "name": "Thomas Bogendoerfer",
        "email": "tsbogend@alpha.franken.de",
        "time": "Sat Aug 12 23:36:47 2017 +0200"
      },
      "committer": {
        "name": "Helge Deller",
        "email": "deller@gmx.de",
        "time": "Wed Aug 16 09:50:39 2017 +0200"
      },
      "message": "parisc: pci memory bar assignment fails with 64bit kernels on dino/cujo\n\nFor 64bit kernels the lmmio_space_offset of the host bridge window\nisn\u0027t set correctly on systems with dino/cujo PCI host bridges.\nThis leads to not assigned memory bars and failing drivers, which\nneed to use these bars.\n\nSigned-off-by: Thomas Bogendoerfer \u003ctsbogend@alpha.franken.de\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nAcked-by: Helge Deller \u003cdeller@gmx.de\u003e\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\n"
    },
    {
      "commit": "510c8a899caf095cb13d09d203573deef15db2fe",
      "tree": "5ddaa46e8ecef7029c6dd0a4a7801597df707b78",
      "parents": [
        "40c6d1b9e2fc4251ca19fa69398f6fa34e813e27",
        "88a5c690b66110ad255380d8f629c629cf6ca559"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Aug 15 18:52:28 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Aug 15 18:52:28 2017 -0700"
      },
      "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nPull networking fixes from David Miller:\n\n 1) Fix TCP checksum offload handling in iwlwifi driver, from Emmanuel\n    Grumbach.\n\n 2) In ksz DSA tagging code, free SKB if skb_put_padto() fails. From\n    Vivien Didelot.\n\n 3) Fix two regressions with bonding on wireless, from Andreas Born.\n\n 4) Fix build when busypoll is disabled, from Daniel Borkmann.\n\n 5) Fix copy_linear_skb() wrt. SO_PEEK_OFF, from Eric Dumazet.\n\n 6) Set SKB cached route properly in inet_rtm_getroute(), from Florian\n    Westphal.\n\n 7) Fix PCI-E relaxed ordering handling in cxgb4 driver, from Ding\n    Tianhong.\n\n 8) Fix module refcnt leak in ULP code, from Sabrina Dubroca.\n\n 9) Fix use of GFP_KERNEL in atomic contexts in AF_KEY code, from Eric\n    Dumazet.\n\n10) Need to purge socket write queue in dccp_destroy_sock(), also from\n    Eric Dumazet.\n\n11) Make bpf_trace_printk() work properly on 32-bit architectures, from\n    Daniel Borkmann.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (47 commits)\n  bpf: fix bpf_trace_printk on 32 bit archs\n  PCI: fix oops when try to find Root Port for a PCI device\n  sfc: don\u0027t try and read ef10 data on non-ef10 NIC\n  net_sched: remove warning from qdisc_hash_add\n  net_sched/sfq: update hierarchical backlog when drop packet\n  net_sched: reset pointers to tcf blocks in classful qdiscs\u0027 destructors\n  ipv4: fix NULL dereference in free_fib_info_rcu()\n  net: Fix a typo in comment about sock flags.\n  ipv6: fix NULL dereference in ip6_route_dev_notify()\n  tcp: fix possible deadlock in TCP stack vs BPF filter\n  dccp: purge write queue in dccp_destroy_sock()\n  udp: fix linear skb reception with PEEK_OFF\n  ipv6: release rt6-\u003ert6i_idev properly during ifdown\n  af_key: do not use GFP_KERNEL in atomic contexts\n  tcp: ulp: avoid module refcnt leak in tcp_set_ulp\n  net/cxgb4vf: Use new PCI_DEV_FLAGS_NO_RELAXED_ORDERING flag\n  net/cxgb4: Use new PCI_DEV_FLAGS_NO_RELAXED_ORDERING flag\n  PCI: Disable Relaxed Ordering Attributes for AMD A1100\n  PCI: Disable Relaxed Ordering for some Intel processors\n  PCI: Disable PCIe Relaxed Ordering if unsupported\n  ...\n"
    },
    {
      "commit": "88a5c690b66110ad255380d8f629c629cf6ca559",
      "tree": "f2c4151bf0deb258d60c0a5dc0e1d13d77fcf8e6",
      "parents": [
        "0e405232871d67bf1b238d56b6b3d500e69ebbf3"
      ],
      "author": {
        "name": "Daniel Borkmann",
        "email": "daniel@iogearbox.net",
        "time": "Wed Aug 16 01:45:33 2017 +0200"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Tue Aug 15 17:32:15 2017 -0700"
      },
      "message": "bpf: fix bpf_trace_printk on 32 bit archs\n\nJames reported that on MIPS32 bpf_trace_printk() is currently\nbroken while MIPS64 works fine:\n\n  bpf_trace_printk() uses conditional operators to attempt to\n  pass different types to __trace_printk() depending on the\n  format operators. This doesn\u0027t work as intended on 32-bit\n  architectures where u32 and long are passed differently to\n  u64, since the result of C conditional operators follows the\n  \"usual arithmetic conversions\" rules, such that the values\n  passed to __trace_printk() will always be u64 [causing issues\n  later in the va_list handling for vscnprintf()].\n\n  For example the samples/bpf/tracex5 test printed lines like\n  below on MIPS32, where the fd and buf have come from the u64\n  fd argument, and the size from the buf argument:\n\n    [...] 1180.941542: 0x00000001: write(fd\u003d1, buf\u003d  (null), size\u003d6258688)\n\n  Instead of this:\n\n    [...] 1625.616026: 0x00000001: write(fd\u003d1, buf\u003d009e4000, size\u003d512)\n\nOne way to get it working is to expand various combinations\nof argument types into 8 different combinations for 32 bit\nand 64 bit kernels. Fix tested by James on MIPS32 and MIPS64\nas well that it resolves the issue.\n\nFixes: 9c959c863f82 (\"tracing: Allow BPF programs to call bpf_trace_printk()\")\nReported-by: James Hogan \u003cjames.hogan@imgtec.com\u003e\nTested-by: James Hogan \u003cjames.hogan@imgtec.com\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "0e405232871d67bf1b238d56b6b3d500e69ebbf3",
      "tree": "7a94cafa371f986b0c47a82719e0151067ec611c",
      "parents": [
        "61deee962896f7eb547adc66ef09c8f1e7ddf7d7"
      ],
      "author": {
        "name": "dingtianhong",
        "email": "dingtianhong@huawei.com",
        "time": "Tue Aug 15 23:24:48 2017 +0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Tue Aug 15 17:25:16 2017 -0700"
      },
      "message": "PCI: fix oops when try to find Root Port for a PCI device\n\nEric report a oops when booting the system after applying\nthe commit a99b646afa8a (\"PCI: Disable PCIe Relaxed...\"):\n\n[    4.241029] BUG: unable to handle kernel NULL pointer dereference at 0000000000000050\n[    4.247001] IP: pci_find_pcie_root_port+0x62/0x80\n[    4.253011] PGD 0\n[    4.253011] P4D 0\n[    4.253011]\n[    4.258013] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC\n[    4.262015] Modules linked in:\n[    4.265005] CPU: 31 PID: 1 Comm: swapper/0 Not tainted 4.13.0-dbx-DEV #316\n[    4.271002] Hardware name: Intel RML,PCH/Iota_QC_19, BIOS 2.40.0 06/22/2016\n[    4.279002] task: ffffa2ee38cfa040 task.stack: ffffa51ec0004000\n[    4.285001] RIP: 0010:pci_find_pcie_root_port+0x62/0x80\n[    4.290012] RSP: 0000:ffffa51ec0007ab8 EFLAGS: 00010246\n[    4.295003] RAX: 0000000000000000 RBX: ffffa2ee36bae000 RCX: 0000000000000006\n[    4.303002] RDX: 000000000000081c RSI: ffffa2ee38cfa8c8 RDI: ffffa2ee36bae000\n[    4.310013] RBP: ffffa51ec0007b58 R08: 0000000000000001 R09: 0000000000000000\n[    4.317001] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa51ec0007ad0\n[    4.324005] R13: ffffa2ee36bae098 R14: 0000000000000002 R15: ffffa2ee37204818\n[    4.331002] FS:  0000000000000000(0000) GS:ffffa2ee3fcc0000(0000) knlGS:0000000000000000\n[    4.339002] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    4.345001] CR2: 0000000000000050 CR3: 000000401000f000 CR4: 00000000001406e0\n[    4.351002] Call Trace:\n[    4.354012]  ? pci_configure_device+0x19f/0x570\n[    4.359002]  ? pci_conf1_read+0xb8/0xf0\n[    4.363002]  ? raw_pci_read+0x23/0x40\n[    4.366011]  ? pci_read+0x2c/0x30\n[    4.370014]  ? pci_read_config_word+0x67/0x70\n[    4.374012]  pci_device_add+0x28/0x230\n[    4.378012]  ? pci_vpd_f0_read+0x50/0x80\n[    4.382014]  pci_scan_single_device+0x96/0xc0\n[    4.386012]  pci_scan_slot+0x79/0xf0\n[    4.389001]  pci_scan_child_bus+0x31/0x180\n[    4.394014]  acpi_pci_root_create+0x1c6/0x240\n[    4.398013]  pci_acpi_scan_root+0x15f/0x1b0\n[    4.402012]  acpi_pci_root_add+0x2e6/0x400\n[    4.406012]  ? acpi_evaluate_integer+0x37/0x60\n[    4.411002]  acpi_bus_attach+0xdf/0x200\n[    4.415002]  acpi_bus_attach+0x6a/0x200\n[    4.418014]  acpi_bus_attach+0x6a/0x200\n[    4.422013]  acpi_bus_scan+0x38/0x70\n[    4.426011]  acpi_scan_init+0x10c/0x271\n[    4.429001]  acpi_init+0x2fa/0x348\n[    4.433004]  ? acpi_sleep_proc_init+0x2d/0x2d\n[    4.437001]  do_one_initcall+0x43/0x169\n[    4.441001]  kernel_init_freeable+0x1d0/0x258\n[    4.445003]  ? rest_init+0xe0/0xe0\n[    4.449001]  kernel_init+0xe/0x150\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d cut here \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nIt looks like the pci_find_pcie_root_port() was trying to\nfind the Root Port for the PCI device which is the Root\nPort already, it will return NULL and trigger the problem,\nso check the highest_pcie_bridge to fix thie problem.\n\nFixes: a99b646afa8a (\"PCI: Disable PCIe Relaxed Ordering if unsupported\")\nFixes: c56d4450eb68 (\"PCI: Turn off Request Attributes to avoid Chelsio T5 Completion erratum\")\nReported-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nSigned-off-by: Ding Tianhong \u003cdingtianhong@huawei.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "61deee962896f7eb547adc66ef09c8f1e7ddf7d7",
      "tree": "a342ee636b165b5ef500aa18d79f2ff55f43427c",
      "parents": [
        "c90e95147c27b1780e76c6e8fea1b5c78d7d387f"
      ],
      "author": {
        "name": "Bert Kenward",
        "email": "bkenward@solarflare.com",
        "time": "Tue Aug 15 14:55:32 2017 +0100"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Tue Aug 15 17:19:34 2017 -0700"
      },
      "message": "sfc: don\u0027t try and read ef10 data on non-ef10 NIC\n\nThe MAC stats command takes a port ID, which doesn\u0027t exist on\npre-ef10 NICs (5000- and 6000- series). This is extracted from the\nNIC specific data; we misinterpret this as the ef10 data structure,\ncausing us to read potentially unallocated data. With a KASAN kernel\nthis can cause errors with:\n   BUG: KASAN: slab-out-of-bounds in efx_mcdi_mac_stats\n\nFixes: 0a2ab4d988d7 (\"sfc: set the port-id when calling MC_CMD_MAC_STATS\")\nReported-by: Stefano Brivio \u003csbrivio@redhat.com\u003e\nTested-by: Stefano Brivio \u003csbrivio@redhat.com\u003e\nSigned-off-by: Bert Kenward \u003cbkenward@solarflare.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "c90e95147c27b1780e76c6e8fea1b5c78d7d387f",
      "tree": "cb5984fdaf9b630ebb4ab99d832e9b861bd78d99",
      "parents": [
        "325d5dc3f7e7c2840b65e4a2988c082c2c0025c5"
      ],
      "author": {
        "name": "Konstantin Khlebnikov",
        "email": "khlebnikov@yandex-team.ru",
        "time": "Tue Aug 15 16:39:05 2017 +0300"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Tue Aug 15 17:16:39 2017 -0700"
      },
      "message": "net_sched: remove warning from qdisc_hash_add\n\nIt was added in commit e57a784d8cae (\"pkt_sched: set root qdisc\nbefore change() in attach_default_qdiscs()\") to hide duplicates\nfrom \"tc qdisc show\" for incative deivices.\n\nAfter 59cc1f61f (\"net: sched: convert qdisc linked list to hashtable\")\nit triggered when classful qdisc is added to inactive device because\ndefault qdiscs are added before switching root qdisc.\n\nAnyway after commit ea3274695353 (\"net: sched: avoid duplicates in\nqdisc dump\") duplicates are filtered right in dumper.\n\nSigned-off-by: Konstantin Khlebnikov \u003ckhlebnikov@yandex-team.ru\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "325d5dc3f7e7c2840b65e4a2988c082c2c0025c5",
      "tree": "ede387bd3f12c88eb0b059e622ead1704d91ddb2",
      "parents": [
        "898904226b5a6dee657f23cf51e385f50da22596"
      ],
      "author": {
        "name": "Konstantin Khlebnikov",
        "email": "khlebnikov@yandex-team.ru",
        "time": "Tue Aug 15 16:37:04 2017 +0300"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Tue Aug 15 17:16:39 2017 -0700"
      },
      "message": "net_sched/sfq: update hierarchical backlog when drop packet\n\nWhen sfq_enqueue() drops head packet or packet from another queue it\nhave to update backlog at upper qdiscs too.\n\nFixes: 2ccccf5fb43f (\"net_sched: update hierarchical backlog too\")\nSigned-off-by: Konstantin Khlebnikov \u003ckhlebnikov@yandex-team.ru\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "898904226b5a6dee657f23cf51e385f50da22596",
      "tree": "1d05b77926120b605ee6ef71f3abe270a49c66e6",
      "parents": [
        "187e5b3ac84d3421d2de3aca949b2791fbcad554"
      ],
      "author": {
        "name": "Konstantin Khlebnikov",
        "email": "khlebnikov@yandex-team.ru",
        "time": "Tue Aug 15 16:35:21 2017 +0300"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Tue Aug 15 17:16:39 2017 -0700"
      },
      "message": "net_sched: reset pointers to tcf blocks in classful qdiscs\u0027 destructors\n\nTraffic filters could keep direct pointers to classes in classful qdisc,\nthus qdisc destruction first removes all filters before freeing classes.\nClass destruction methods also tries to free attached filters but now\nthis isn\u0027t safe because tcf_block_put() unlike to tcf_destroy_chain()\ncannot be called second time.\n\nThis patch set class-\u003eblock to NULL after first tcf_block_put() and\nturn second call into no-op.\n\nFixes: 6529eaba33f0 (\"net: sched: introduce tcf block infractructure\")\nSigned-off-by: Konstantin Khlebnikov \u003ckhlebnikov@yandex-team.ru\u003e\nAcked-by: Jiri Pirko \u003cjiri@mellanox.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "187e5b3ac84d3421d2de3aca949b2791fbcad554",
      "tree": "44a56af785355119f067c75a799d55fd3789ca86",
      "parents": [
        "b3dc8f772fab5b2d284b780830fd56494491e493"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Tue Aug 15 05:26:17 2017 -0700"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Tue Aug 15 17:07:52 2017 -0700"
      },
      "message": "ipv4: fix NULL dereference in free_fib_info_rcu()\n\nIf fi-\u003efib_metrics could not be allocated in fib_create_info()\nwe attempt to dereference a NULL pointer in free_fib_info_rcu() :\n\n    m \u003d fi-\u003efib_metrics;\n    if (m !\u003d \u0026dst_default_metrics \u0026\u0026 atomic_dec_and_test(\u0026m-\u003erefcnt))\n            kfree(m);\n\nBefore my recent patch, we used to call kfree(NULL) and nothing wrong\nhappened.\n\nInstead of using RCU to defer freeing while we are under memory stress,\nit seems better to take immediate action.\n\nThis was reported by syzkaller team.\n\nFixes: 3fb07daff8e9 (\"ipv4: add reference counting to metrics\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "b3dc8f772fab5b2d284b780830fd56494491e493",
      "tree": "4653c1a474cca8c86a0f73e68f078df3956fefd7",
      "parents": [
        "12d94a804946af291e24b80fc53ec86264765781"
      ],
      "author": {
        "name": "Tonghao Zhang",
        "email": "xiangxia.m.yue@gmail.com",
        "time": "Tue Aug 15 04:28:54 2017 -0700"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Tue Aug 15 17:07:17 2017 -0700"
      },
      "message": "net: Fix a typo in comment about sock flags.\n\nSigned-off-by: Tonghao Zhang \u003cxiangxia.m.yue@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "12d94a804946af291e24b80fc53ec86264765781",
      "tree": "3b5a06908e100ce2934e37100bbe1f8a1937fd25",
      "parents": [
        "0a6f04184d3d9c21cb6aa12140732aac6930922a"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Tue Aug 15 04:09:51 2017 -0700"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Tue Aug 15 17:06:34 2017 -0700"
      },
      "message": "ipv6: fix NULL dereference in ip6_route_dev_notify()\n\nBased on a syzkaller report [1], I found that a per cpu allocation\nfailure in snmp6_alloc_dev() would then lead to NULL dereference in\nip6_route_dev_notify().\n\nIt seems this is a very old bug, thus no Fixes tag in this submission.\n\nLet\u0027s add in6_dev_put_clear() helper, as we will probably use\nit elsewhere (once available/present in net-next)\n\n[1]\nkasan: CONFIG_KASAN_INLINE enabled\nkasan: GPF could be caused by NULL-ptr deref or user memory access\ngeneral protection fault: 0000 [#1] SMP KASAN\nDumping ftrace buffer:\n   (ftrace buffer empty)\nModules linked in:\nCPU: 1 PID: 17294 Comm: syz-executor6 Not tainted 4.13.0-rc2+ #10\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\ntask: ffff88019f456680 task.stack: ffff8801c6e58000\nRIP: 0010:__read_once_size include/linux/compiler.h:250 [inline]\nRIP: 0010:atomic_read arch/x86/include/asm/atomic.h:26 [inline]\nRIP: 0010:refcount_sub_and_test+0x7d/0x1b0 lib/refcount.c:178\nRSP: 0018:ffff8801c6e5f1b0 EFLAGS: 00010202\nRAX: 0000000000000037 RBX: dffffc0000000000 RCX: ffffc90005d25000\nRDX: ffff8801c6e5f218 RSI: ffffffff82342bbf RDI: 0000000000000001\nRBP: ffff8801c6e5f240 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 1ffff10038dcbe37\nR13: 0000000000000006 R14: 0000000000000001 R15: 00000000000001b8\nFS:  00007f21e0429700(0000) GS:ffff8801dc100000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001ddbc22000 CR3: 00000001d632b000 CR4: 00000000001426e0\nDR0: 0000000020000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600\nCall Trace:\n refcount_dec_and_test+0x1a/0x20 lib/refcount.c:211\n in6_dev_put include/net/addrconf.h:335 [inline]\n ip6_route_dev_notify+0x1c9/0x4a0 net/ipv6/route.c:3732\n notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93\n __raw_notifier_call_chain kernel/notifier.c:394 [inline]\n raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401\n call_netdevice_notifiers_info+0x51/0x90 net/core/dev.c:1678\n call_netdevice_notifiers net/core/dev.c:1694 [inline]\n rollback_registered_many+0x91c/0xe80 net/core/dev.c:7107\n rollback_registered+0x1be/0x3c0 net/core/dev.c:7149\n register_netdevice+0xbcd/0xee0 net/core/dev.c:7587\n register_netdev+0x1a/0x30 net/core/dev.c:7669\n loopback_net_init+0x76/0x160 drivers/net/loopback.c:214\n ops_init+0x10a/0x570 net/core/net_namespace.c:118\n setup_net+0x313/0x710 net/core/net_namespace.c:294\n copy_net_ns+0x27c/0x580 net/core/net_namespace.c:418\n create_new_namespaces+0x425/0x880 kernel/nsproxy.c:107\n unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:206\n SYSC_unshare kernel/fork.c:2347 [inline]\n SyS_unshare+0x653/0xfa0 kernel/fork.c:2297\n entry_SYSCALL_64_fastpath+0x1f/0xbe\nRIP: 0033:0x4512c9\nRSP: 002b:00007f21e0428c08 EFLAGS: 00000216 ORIG_RAX: 0000000000000110\nRAX: ffffffffffffffda RBX: 0000000000718150 RCX: 00000000004512c9\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000062020200\nRBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000216 R12: 00000000004b973d\nR13: 00000000ffffffff R14: 000000002001d000 R15: 00000000000002dd\nCode: 50 2b 34 82 c7 00 f1 f1 f1 f1 c7 40 04 04 f2 f2 f2 c7 40 08 f3 f3\nf3 f3 e8 a1 43 39 ff 4c 89 f8 48 8b 95 70 ff ff ff 48 c1 e8 03 \u003c0f\u003e b6\n0c 18 4c 89 f8 83 e0 07 83 c0 03 38 c8 7c 08 84 c9 0f 85\nRIP: __read_once_size include/linux/compiler.h:250 [inline] RSP:\nffff8801c6e5f1b0\nRIP: atomic_read arch/x86/include/asm/atomic.h:26 [inline] RSP:\nffff8801c6e5f1b0\nRIP: refcount_sub_and_test+0x7d/0x1b0 lib/refcount.c:178 RSP:\nffff8801c6e5f1b0\n---[ end trace e441d046c6410d31 ]---\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "b5fed474b98332559f2590c6bc90388a0899e793",
      "tree": "4f7cd528a01280492744ff415ba745f62a02ecfc",
      "parents": [
        "d76036ab47eafa6ce52b69482e91ca3ba337d6d6"
      ],
      "author": {
        "name": "Jan Kara",
        "email": "jack@suse.cz",
        "time": "Tue Aug 15 13:00:37 2017 +0200"
      },
      "committer": {
        "name": "Paul Moore",
        "email": "paul@paul-moore.com",
        "time": "Tue Aug 15 16:03:00 2017 -0400"
      },
      "message": "audit: Receive unmount event\n\nAlthough audit_watch_handle_event() can handle FS_UNMOUNT event, it is\nnot part of AUDIT_FS_WATCH mask and thus such event never gets to\naudit_watch_handle_event(). Thus fsnotify marks are deleted by fsnotify\nsubsystem on unmount without audit being notified about that which leads\nto a strange state of existing audit rules with dead fsnotify marks.\n\nAdd FS_UNMOUNT to the mask of events to be received so that audit can\nclean up its state accordingly.\n\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Paul Moore \u003cpaul@paul-moore.com\u003e\n"
    },
    {
      "commit": "d76036ab47eafa6ce52b69482e91ca3ba337d6d6",
      "tree": "36e9cad8d69f7b801ef976a4f86a5276e7c59fe5",
      "parents": [
        "b0659ae5e30074ede1dc08f2c6d64f0c11d64e0f"
      ],
      "author": {
        "name": "Jan Kara",
        "email": "jack@suse.cz",
        "time": "Tue Aug 15 13:00:36 2017 +0200"
      },
      "committer": {
        "name": "Paul Moore",
        "email": "paul@paul-moore.com",
        "time": "Tue Aug 15 15:58:17 2017 -0400"
      },
      "message": "audit: Fix use after free in audit_remove_watch_rule()\n\naudit_remove_watch_rule() drops watch\u0027s reference to parent but then\ncontinues to work with it. That is not safe as parent can get freed once\nwe drop our reference. The following is a trivial reproducer:\n\nmount -o loop image /mnt\ntouch /mnt/file\nauditctl -w /mnt/file -p wax\numount /mnt\nauditctl -D\n\u003ccrash in fsnotify_destroy_mark()\u003e\n\nGrab our own reference in audit_remove_watch_rule() earlier to make sure\nmark does not get freed under us.\n\nCC: stable@vger.kernel.org\nReported-by: Tony Jones \u003ctonyj@suse.de\u003e\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nTested-by: Tony Jones \u003ctonyj@suse.de\u003e\nSigned-off-by: Paul Moore \u003cpaul@paul-moore.com\u003e\n"
    },
    {
      "commit": "40c6d1b9e2fc4251ca19fa69398f6fa34e813e27",
      "tree": "2cc26d206f9dcd60c877ab6944fd3ecc5ec5b1d9",
      "parents": [
        "fcd07350007bdcc0aab506fb9b5703fad48a6521",
        "622b2fbe625bc255faa4ee69a0fbcab80d3e40e6"
      ],
      "author": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Aug 15 12:49:43 2017 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@linux-foundation.org",
        "time": "Tue Aug 15 12:49:43 2017 -0700"
      },
      "message": "Merge tag \u0027linux-kselftest-4.13-rc6-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest\n\nPull kselftest fixes from Shuah Khan:\n \"This update consists of important compile and run-time error fixes to\n  timers/freq-step, kmod, and sysctl tests\"\n\n* tag \u0027linux-kselftest-4.13-rc6-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:\n  selftests: timers: freq-step: fix compile error\n  selftests: futex: fix run_tests target\n  test_sysctl: fix sysctl.sh by making it executable\n  test_kmod: fix kmod.sh by making it executable\n"
    },
    {
      "commit": "7a7c286d07f9c704e8fd11dd960bf421cc67b66b",
      "tree": "b766310f61cc1ed41f35dbd2b9af4304e5d33366",
      "parents": [
        "46828dc77961d9286e55671c4dd3b6c9effadf1a"
      ],
      "author": {
        "name": "Chunming Zhou",
        "email": "David1.Zhou@amd.com",
        "time": "Fri Aug 11 09:34:33 2017 +0800"
      },
      "committer": {
        "name": "Alex Deucher",
        "email": "alexander.deucher@amd.com",
        "time": "Tue Aug 15 14:10:01 2017 -0400"
      },
      "message": "drm/amdgpu: save list length when fence is signaled\n\nupdate the list first to avoid redundant checks.\n\nSigned-off-by: Chunming Zhou \u003cDavid1.Zhou@amd.com\u003e\nReviewed-by: Christian König \u003cchristian.koenig@amd.com\u003e\nReviewed-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nSigned-off-by: Alex Deucher \u003calexander.deucher@amd.com\u003e\nCc: stable@vger.kernel.org\n"
    },
    {
      "commit": "0a6f04184d3d9c21cb6aa12140732aac6930922a",
      "tree": "cbb22e8c7c52d59523775cf9e50d4e5bfdf3f295",
      "parents": [
        "d624d276d1ddacbcb12ad96832ce0c7b82cd25db",
        "e9bf53ab1ee34bb05c104bbfd2b77c844773f8e6"
      ],
      "author": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Tue Aug 15 10:19:14 2017 -0700"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Tue Aug 15 10:19:14 2017 -0700"
      },
      "message": "Merge tag \u0027wireless-drivers-for-davem-2017-08-15\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers\n\nKalle Valo says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nwireless-drivers fixes for 4.13\n\nThis time quite a few fixes for iwlwifi and one major regression fix\nfor brcmfmac. For the iwlwifi aggregation bug a small change was\nneeded for mac80211, but as Johannes is still away the mac80211 patch\nis taken via wireless-drivers tree.\n\nbrcmfmac\n\n* fix firmware crash (a recent regression in bcm4343{0,1,8}\n\niwlwifi\n\n* Some simple PCI HW ID fix-ups and additions for family 9000\n\n* Remove a bogus warning message with new FWs (bug #196915)\n\n* Don\u0027t allow illegal channel options to be used (bug #195299)\n\n* A fix for checksum offload in family 9000\n\n* A fix serious throughput degradation in 11ac with multiple streams\n\n* An old bug in SMPS where the firmware was not aware of SMPS changes\n\n* Fix a memory leak in the SAR code\n\n* Fix a stuck queue case in AP mode;\n\n* Convert a WARN to a simple debug in a legitimate race case (from\n  which we can recover)\n\n* Fix a severe throughput aggregation on 9000-family devices due to\n  aggregation issues, needed a small change in mac80211\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "44506752fafae0c9358af95ffc89c687ce56650e",
      "tree": "a66eb0f477a3f9855c12f55f458c12cc369392bb",
      "parents": [
        "64c2c372dbcf1b701b79e1f6f0f75c5c83529994",
        "8ff235fe7a8c4a5824c223b9996457174442e73a"
      ],
      "author": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Tue Aug 15 17:37:10 2017 +0200"
      },
      "committer": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Tue Aug 15 17:37:10 2017 +0200"
      },
      "message": "Merge tag \u0027at91-ab-4.13-dt-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux into fixes\n\nPull \"DT fixes for 4.13\" from Alexandre Belloni:\n\n - Fix NAND flash support for sama5d2\n\n* tag \u0027at91-ab-4.13-dt-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux:\n  ARM: dts: at91: sama5d2: fix EBI/NAND controllers declaration\n  ARM: dts: at91: sama5d2: use sama5d2 compatible string for SMC\n"
    },
    {
      "commit": "64c2c372dbcf1b701b79e1f6f0f75c5c83529994",
      "tree": "94e8888da9c9907622d1e1721f9632e642debb0d",
      "parents": [
        "69a80d8c2cb0956fc2aab41aae786ed0c663b582",
        "8317562097acec4c9e9750eb91115687931bca35"
      ],
      "author": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Tue Aug 15 17:34:52 2017 +0200"
      },
      "committer": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Tue Aug 15 17:34:52 2017 +0200"
      },
      "message": "Merge tag \u0027imx-fixes-4.13-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into fixes\n\nPull \"i.MX fixes for 4.13, round 2\" from Shawn Guo:\n\n - Add missing \u0027ranges\u0027 property for i.MX25 device tree TSCADC node, so\n   that it\u0027s child nodes ADC and TSC device can be probed by kernel.\n - Fix i.MX GPCv2 power domain driver to request regulator after power\n   domain initialization, since regulator could defer probing and\n   therefore cause power domain initialized twice.\n\n* tag \u0027imx-fixes-4.13-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:\n  ARM: dts: i.MX25: add ranges to tscadc\n  soc: imx: gpcv2: fix regulator deferred probe\n"
    },
    {
      "commit": "69a80d8c2cb0956fc2aab41aae786ed0c663b582",
      "tree": "141fa0617efbc3b22adce471043ff3c911e7212b",
      "parents": [
        "aae4e7a8bc44722fe70d58920a36916b1043195e",
        "05969566e6d64113a861adc6c17cbba685c640b3"
      ],
      "author": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Tue Aug 15 17:34:04 2017 +0200"
      },
      "committer": {
        "name": "Arnd Bergmann",
        "email": "arnd@arndb.de",
        "time": "Tue Aug 15 17:34:04 2017 +0200"
      },
      "message": "Merge tag \u0027imx-fixes-4.13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into fixes\n\nPull \"i.MX fixes for 4.13\" from Shawn Guo:\n\n - A fix for imx7d-sdb board to move pinctrl_spi4 pins from low power\n   iomux controller to normal iomuxc node, as the pins belong to normal\n   iomuxc rather than low power one.\n\n* tag \u0027imx-fixes-4.13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:\n  ARM: dts: imx7d-sdb: Put pinctrl_spi4 in the correct location\n"
    },
    {
      "commit": "b15bd8cb37598afb2963f7eb9e2de468d2d60a2f",
      "tree": "7c81882b72db9488b87fd9c516512b6499ad4210",
      "parents": [
        "462cdace790ac2ed6aad1b19c9c0af0143b6aab0"
      ],
      "author": {
        "name": "Munehisa Kamata",
        "email": "kamatam@amazon.com",
        "time": "Wed Aug 09 15:31:40 2017 -0700"
      },
      "committer": {
        "name": "Konrad Rzeszutek Wilk",
        "email": "konrad.wilk@oracle.com",
        "time": "Tue Aug 15 10:34:04 2017 -0400"
      },
      "message": "xen-blkfront: use a right index when checking requests\n\nSince commit d05d7f40791c (\"Merge branch \u0027for-4.8/core\u0027 of\ngit://git.kernel.dk/linux-block\") and 3fc9d690936f (\"Merge branch\n\u0027for-4.8/drivers\u0027 of git://git.kernel.dk/linux-block\"), blkfront_resume()\nhas been using an index for iterating ring_info to check request when\niterating blk_shadow in an inner loop. This seems to have been\naccidentally introduced during the massive rewrite of the block layer\nmacros in the commits.\n\nThis may cause crash like this:\n\n[11798.057074] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048\n[11798.058832] IP: [\u003cffffffff814411fa\u003e] blkfront_resume+0x10a/0x610\n....\n[11798.061063] Call Trace:\n[11798.061063]  [\u003cffffffff8139ce93\u003e] xenbus_dev_resume+0x53/0x140\n[11798.061063]  [\u003cffffffff8139ce40\u003e] ? xenbus_dev_probe+0x150/0x150\n[11798.061063]  [\u003cffffffff813f359e\u003e] dpm_run_callback+0x3e/0x110\n[11798.061063]  [\u003cffffffff813f3a08\u003e] device_resume+0x88/0x190\n[11798.061063]  [\u003cffffffff813f4cc0\u003e] dpm_resume+0x100/0x2d0\n[11798.061063]  [\u003cffffffff813f5221\u003e] dpm_resume_end+0x11/0x20\n[11798.061063]  [\u003cffffffff813950a8\u003e] do_suspend+0xe8/0x1a0\n[11798.061063]  [\u003cffffffff813954bd\u003e] shutdown_handler+0xfd/0x130\n[11798.061063]  [\u003cffffffff8139aba0\u003e] ? split+0x110/0x110\n[11798.061063]  [\u003cffffffff8139ac26\u003e] xenwatch_thread+0x86/0x120\n[11798.061063]  [\u003cffffffff810b4570\u003e] ? prepare_to_wait_event+0x110/0x110\n[11798.061063]  [\u003cffffffff8108fe57\u003e] kthread+0xd7/0xf0\n[11798.061063]  [\u003cffffffff811da811\u003e] ? kfree+0x121/0x170\n[11798.061063]  [\u003cffffffff8108fd80\u003e] ? kthread_park+0x60/0x60\n[11798.061063]  [\u003cffffffff810863b0\u003e] ?  call_usermodehelper_exec_work+0xb0/0xb0\n[11798.061063]  [\u003cffffffff810864ea\u003e] ?  call_usermodehelper_exec_async+0x13a/0x140\n[11798.061063]  [\u003cffffffff81534a45\u003e] ret_from_fork+0x25/0x30\n\nUse the right index in the inner loop.\n\nFixes: d05d7f40791c (\"Merge branch \u0027for-4.8/core\u0027 of git://git.kernel.dk/linux-block\")\nFixes: 3fc9d690936f (\"Merge branch \u0027for-4.8/drivers\u0027 of git://git.kernel.dk/linux-block\")\nSigned-off-by: Munehisa Kamata \u003ckamatam@amazon.com\u003e\nReviewed-by: Thomas Friebel \u003cfriebelt@amazon.de\u003e\nReviewed-by: Eduardo Valentin \u003ceduval@amazon.com\u003e\nReviewed-by: Boris Ostrovsky \u003cboris.ostrovsky@oracle.com\u003e\nCc: Juergen Gross \u003cjgross@suse.com\u003e\nCc: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nReviewed-by: Roger Pau Monne \u003croger.pau@citrix.com\u003e\nCc: xen-devel@lists.xenproject.org\nCc: stable@vger.kernel.org\nSigned-off-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\n"
    },
    {
      "commit": "462cdace790ac2ed6aad1b19c9c0af0143b6aab0",
      "tree": "a502ad9954d658360351782787054bc7de81eec6",
      "parents": [
        "bd912ef3e46b6edb51bb8af4b73fd2be7817e305"
      ],
      "author": {
        "name": "Roger Pau Monne",
        "email": "roger.pau@citrix.com",
        "time": "Tue Jul 18 15:01:00 2017 +0100"
      },
      "committer": {
        "name": "Konrad Rzeszutek Wilk",
        "email": "konrad.wilk@oracle.com",
        "time": "Tue Aug 15 10:32:49 2017 -0400"
      },
      "message": "xen: fix bio vec merging\n\nThe current test for bio vec merging is not fully accurate and can be\ntricked into merging bios when certain grant combinations are used.\nThe result of these malicious bio merges is a bio that extends past\nthe memory page used by any of the originating bios.\n\nTake into account the following scenario, where a guest creates two\ngrant references that point to the same mfn, ie: grant 1 -\u003e mfn A,\ngrant 2 -\u003e mfn A.\n\nThese references are then used in a PV block request, and mapped by\nthe backend domain, thus obtaining two different pfns that point to\nthe same mfn, pfn B -\u003e mfn A, pfn C -\u003e mfn A.\n\nIf those grants happen to be used in two consecutive sectors of a disk\nIO operation becoming two different bios in the backend domain, the\nchecks in xen_biovec_phys_mergeable will succeed, because bfn1 \u003d\u003d bfn2\n(they both point to the same mfn). However due to the bio merging,\nthe backend domain will end up with a bio that expands past mfn A into\nmfn A + 1.\n\nFix this by making sure the check in xen_biovec_phys_mergeable takes\ninto account the offset and the length of the bio, this basically\nreplicates whats done in __BIOVEC_PHYS_MERGEABLE using mfns (bus\naddresses). While there also remove the usage of\n__BIOVEC_PHYS_MERGEABLE, since that\u0027s already checked by the callers\nof xen_biovec_phys_mergeable.\n\nCC: stable@vger.kernel.org\nReported-by: \"Jan H. Schönherr\" \u003cjschoenh@amazon.de\u003e\nSigned-off-by: Roger Pau Monné \u003croger.pau@citrix.com\u003e\nReviewed-by: Juergen Gross \u003cjgross@suse.com\u003e\nSigned-off-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\n"
    }
  ],
  "next": "3280d66a6363af0df0441709bc0bc302bd9a2510"
}