{"push_id":1647936983,"size":111,"distinct_size":111,"ref":"refs/heads/linux-4.10.y","head":"55db23d3a51e8a5b2f05f121f71525c13efb5e35","before":"df6ed56f43524c1cefa9a8bc5126a09ce01e3bc3","commits":[{"sha":"3c9f2c656aca1478d1bd57bc384347882a5cf263","author":{"name":"Or Gerlitz","email":"1d5567bccfc6dd59c6f26cddb2897fb0786c20af@mellanox.com"},"message":"net/openvswitch: Set the ipv6 source tunnel key address attribute correctly\n\n[ Upstream commit 3d20f1f7bd575d147ffa75621fa560eea0aec690 ]\n\nWhen dealing with ipv6 source tunnel key address attribute\n(OVS_TUNNEL_KEY_ATTR_IPV6_SRC) we are wrongly setting the tunnel\ndst ip, fix that.\n\nFixes: 6b26ba3a7d95 ('openvswitch: netlink attributes for IPv6 tunneling')\nSigned-off-by: Or Gerlitz <ogerlitz@mellanox.com>\nReported-by: Paul Blakey <paulb@mellanox.com>\nAcked-by: Jiri Benc <jbenc@redhat.com>\nAcked-by: Joe Stringer <joe@ovn.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/3c9f2c656aca1478d1bd57bc384347882a5cf263"},{"sha":"200caa0be5d238a0024031c543db6a7379126c26","author":{"name":"Florian Fainelli","email":"244da8ca84c0b82369d8dd3f15015e61f28f6fe5@gmail.com"},"message":"net: bcmgenet: Do not suspend PHY if Wake-on-LAN is enabled\n\n[ Upstream commit 5371bbf4b295eea334ed453efa286afa2c3ccff3 ]\n\nSuspending the PHY would be putting it in a low power state where it\nmay no longer allow us to do Wake-on-LAN.\n\nFixes: cc013fb48898 (\"net: bcmgenet: correctly suspend and resume PHY device\")\nSigned-off-by: Florian Fainelli <f.fainelli@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/200caa0be5d238a0024031c543db6a7379126c26"},{"sha":"5dd697af3014b800525607342d1b17b2f0398605","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"net: properly release sk_frag.page\n\n[ Upstream commit 22a0e18eac7a9e986fec76c60fa4a2926d1291e2 ]\n\nI mistakenly added the code to release sk->sk_frag in\nsk_common_release() instead of sk_destruct()\n\nTCP sockets using sk->sk_allocation == GFP_ATOMIC do no call\nsk_common_release() at close time, thus leaking one (order-3) page.\n\niSCSI is using such sockets.\n\nFixes: 5640f7685831 (\"net: use a per task frag allocator\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/5dd697af3014b800525607342d1b17b2f0398605"},{"sha":"ae9d577f3dbb686862b7d0dc9cc73054f0964d4d","author":{"name":"Lendacky, Thomas","email":"d5db58ce03adbcc583dbaf917b29a17cf34c721c@amd.com"},"message":"amd-xgbe: Fix jumbo MTU processing on newer hardware\n\n[ Upstream commit 622c36f143fc9566ba49d7cec994c2da1182d9e2 ]\n\nNewer hardware does not provide a cumulative payload length when multiple\ndescriptors are needed to handle the data. Once the MTU increases beyond\nthe size that can be handled by a single descriptor, the SKB does not get\nbuilt properly by the driver.\n\nThe driver will now calculate the size of the data buffers used by the\nhardware.  The first buffer of the first descriptor is for packet headers\nor packet headers and data when the headers can't be split. Subsequent\ndescriptors in a multi-descriptor chain will not use the first buffer. The\nsecond buffer is used by all the descriptors in the chain for payload data.\nBased on whether the driver is processing the first, intermediate, or last\ndescriptor it can calculate the buffer usage and build the SKB properly.\n\nTested and verified on both old and new hardware.\n\nSigned-off-by: Tom Lendacky <thomas.lendacky@amd.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/ae9d577f3dbb686862b7d0dc9cc73054f0964d4d"},{"sha":"d965848569f9c6cbba2df610adb8de80ae65b7cc","author":{"name":"Kris Murphy","email":"b73fcc03bb19c283c02af25b362b095012e058dc@linux.vnet.ibm.com"},"message":"openvswitch: Add missing case OVS_TUNNEL_KEY_ATTR_PAD\n\n[ Upstream commit 8f3dbfd79ed9ef9770305a7cc4e13dfd31ad2cd0 ]\n\nAdded a case for OVS_TUNNEL_KEY_ATTR_PAD to the switch statement\nin ip_tun_from_nlattr in order to prevent the default case\nreturning an error.\n\nFixes: b46f6ded906e (\"libnl: nla_put_be64(): align on a 64-bit area\")\nSigned-off-by: Kris Murphy <kriskend@linux.vnet.ibm.com>\nAcked-by: Joe Stringer <joe@ovn.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/d965848569f9c6cbba2df610adb8de80ae65b7cc"},{"sha":"4f320b855b8ab045b196cdbee0bde391ef66bae6","author":{"name":"Andrey Ulanov","email":"c3e6669d5b723807ae109d2f086f5e383918adbe@google.com"},"message":"net: unix: properly re-increment inflight counter of GC discarded candidates\n\n[ Upstream commit 7df9c24625b9981779afb8fcdbe2bb4765e61147 ]\n\nDmitry has reported that a BUG_ON() condition in unix_notinflight()\nmay be triggered by a simple code that forwards unix socket in an\nSCM_RIGHTS message.\nThat is caused by incorrect unix socket GC implementation in unix_gc().\n\nThe GC first collects list of candidates, then (a) decrements their\n\"children's\" inflight counter, (b) checks which inflight counters are\nnow 0, and then (c) increments all inflight counters back.\n(a) and (c) are done by calling scan_children() with inc_inflight or\ndec_inflight as the second argument.\n\nCommit 6209344f5a37 (\"net: unix: fix inflight counting bug in garbage\ncollector\") changed scan_children() such that it no longer considers\nsockets that do not have UNIX_GC_CANDIDATE flag. It also added a block\nof code that that unsets this flag _before_ invoking\nscan_children(, dec_iflight, ). This may lead to incorrect inflight\ncounters for some sockets.\n\nThis change fixes this bug by changing order of operations:\nUNIX_GC_CANDIDATE is now unset only after all inflight counters are\nrestored to the original state.\n\n  kernel BUG at net/unix/garbage.c:149!\n  RIP: 0010:[<ffffffff8717ebf4>]  [<ffffffff8717ebf4>]\n  unix_notinflight+0x3b4/0x490 net/unix/garbage.c:149\n  Call Trace:\n   [<ffffffff8716cfbf>] unix_detach_fds.isra.19+0xff/0x170 net/unix/af_unix.c:1487\n   [<ffffffff8716f6a9>] unix_destruct_scm+0xf9/0x210 net/unix/af_unix.c:1496\n   [<ffffffff86a90a01>] skb_release_head_state+0x101/0x200 net/core/skbuff.c:655\n   [<ffffffff86a9808a>] skb_release_all+0x1a/0x60 net/core/skbuff.c:668\n   [<ffffffff86a980ea>] __kfree_skb+0x1a/0x30 net/core/skbuff.c:684\n   [<ffffffff86a98284>] kfree_skb+0x184/0x570 net/core/skbuff.c:705\n   [<ffffffff871789d5>] unix_release_sock+0x5b5/0xbd0 net/unix/af_unix.c:559\n   [<ffffffff87179039>] unix_release+0x49/0x90 net/unix/af_unix.c:836\n   [<ffffffff86a694b2>] sock_release+0x92/0x1f0 net/socket.c:570\n   [<ffffffff86a6962b>] sock_close+0x1b/0x20 net/socket.c:1017\n   [<ffffffff81a76b8e>] __fput+0x34e/0x910 fs/file_table.c:208\n   [<ffffffff81a771da>] ____fput+0x1a/0x20 fs/file_table.c:244\n   [<ffffffff81483ab0>] task_work_run+0x1a0/0x280 kernel/task_work.c:116\n   [<     inline     >] exit_task_work include/linux/task_work.h:21\n   [<ffffffff8141287a>] do_exit+0x183a/0x2640 kernel/exit.c:828\n   [<ffffffff8141383e>] do_group_exit+0x14e/0x420 kernel/exit.c:931\n   [<ffffffff814429d3>] get_signal+0x663/0x1880 kernel/signal.c:2307\n   [<ffffffff81239b45>] do_signal+0xc5/0x2190 arch/x86/kernel/signal.c:807\n   [<ffffffff8100666a>] exit_to_usermode_loop+0x1ea/0x2d0\n  arch/x86/entry/common.c:156\n   [<     inline     >] prepare_exit_to_usermode arch/x86/entry/common.c:190\n   [<ffffffff81009693>] syscall_return_slowpath+0x4d3/0x570\n  arch/x86/entry/common.c:259\n   [<ffffffff881478e6>] entry_SYSCALL_64_fastpath+0xc4/0xc6\n\nLink: https://lkml.org/lkml/2017/3/6/252\nSigned-off-by: Andrey Ulanov <andreyu@google.com>\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nFixes: 6209344 (\"net: unix: fix inflight counting bug in garbage collector\")\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/4f320b855b8ab045b196cdbee0bde391ef66bae6"},{"sha":"29323e2def4860b20e32e6a8229836d875eb3597","author":{"name":"Bjørn Mork","email":"73004647096653cb035375f893ae959ac7bd4f38@mork.no"},"message":"qmi_wwan: add Dell DW5811e\n\n[ Upstream commit 6bd845d1cf98b45c634baacb8381436dad3c2dd0 ]\n\nThis is a Dell branded Sierra Wireless EM7455. It is operating in\nMBIM mode by default, but can be configured to provide two QMI/RMNET\nfunctions.\n\nSigned-off-by: Bjørn Mork <bjorn@mork.no>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/29323e2def4860b20e32e6a8229836d875eb3597"},{"sha":"eccc68710effc0c062bd57c5399c404bb2c9ac5e","author":{"name":"David Ahern","email":"e530dc8f30cd5fef67eca6e0378269caad10dfeb@cumulusnetworks.com"},"message":"net: vrf: Reset rt6i_idev in local dst after put\n\n[ Upstream commit 3dc857f0e8fc22610a59cbb346ba62c6e921863f ]\n\nThe VRF driver takes a reference to the inet6_dev on the VRF device for\nits rt6_local dst when handling local traffic through the VRF device as\na loopback. When the device is deleted the driver does a put on the idev\nbut does not reset rt6i_idev in the rt6_info struct. When the dst is\ndestroyed, dst_destroy calls ip6_dst_destroy which does a second put for\nwhat is essentially the same reference causing it to be prematurely freed.\nReset rt6i_idev after the put in the vrf driver.\n\nFixes: b4869aa2f881e (\"net: vrf: ipv6 support for local traffic to\n                       local addresses\")\nSigned-off-by: David Ahern <dsa@cumulusnetworks.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/eccc68710effc0c062bd57c5399c404bb2c9ac5e"},{"sha":"5e96d44bbdd406bbaf49492a6ec537ebb0e7eba5","author":{"name":"Or Gerlitz","email":"1d5567bccfc6dd59c6f26cddb2897fb0786c20af@mellanox.com"},"message":"net/mlx5: Add missing entries for set/query rate limit commands\n\n[ Upstream commit 1f30a86c58093046dc3e49c23d2618894e098f7a ]\n\nThe switch cases for the rate limit set and query commands were\nmissing, which could get us wrong under fw error or driver reset\nflow, fix that.\n\nFixes: 1466cc5b23d1 ('net/mlx5: Rate limit tables support')\nSigned-off-by: Or Gerlitz <ogerlitz@mellanox.com>\nReviewed-by: Hadar Hen Zion <hadarh@mellanox.com>\nSigned-off-by: Saeed Mahameed <saeedm@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/5e96d44bbdd406bbaf49492a6ec537ebb0e7eba5"},{"sha":"402073e7e39adceef109d337353a3bdb6cc9b22f","author":{"name":"Or Gerlitz","email":"1d5567bccfc6dd59c6f26cddb2897fb0786c20af@mellanox.com"},"message":"net/mlx5e: Change the TC offload rule add/del code path to be per NIC or E-Switch\n\n[ Upstream commit d85cdccbb3fe9a632ec9d0f4e4526c8c84fc3523 ]\n\nRefactor the code to deal with add/del TC rules to have handler per NIC/E-switch\noffloading use case, and push the latter into the e-switch code. This provides\nbetter separation and is to be used in down-stream patch for applying a fix.\n\nFixes: bffaa916588e (\"net/mlx5: E-Switch, Add control for inline mode\")\nSigned-off-by: Or Gerlitz <ogerlitz@mellanox.com>\nReviewed-by: Roi Dayan <roid@mellanox.com>\nSigned-off-by: Saeed Mahameed <saeedm@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/402073e7e39adceef109d337353a3bdb6cc9b22f"},{"sha":"b709b83ea5ece6ec5c6d2e4a2be6a5035d5af4eb","author":{"name":"Roi Dayan","email":"8a1b41b0042121336755de723a95aa49a4b911ca@mellanox.com"},"message":"net/mlx5: E-Switch, Don't allow changing inline mode when flows are configured\n\n[ Upstream commit 375f51e2b5b7b9a42b3139aea519cbb1bfc5d6ef ]\n\nChanging the eswitch inline mode can potentially cause already configured\nflows not to match the policy. E.g. set policy L4, add some L4 rules,\nset policy to L2 --> bad! Hence we disallow it.\n\nKeep track of how many offloaded rules are now set and refuse\ninline mode changes if this isn't zero.\n\nFixes: bffaa916588e (\"net/mlx5: E-Switch, Add control for inline mode\")\nSigned-off-by: Roi Dayan <roid@mellanox.com>\nReviewed-by: Or Gerlitz <ogerlitz@mellanox.com>\nSigned-off-by: Saeed Mahameed <saeedm@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/b709b83ea5ece6ec5c6d2e4a2be6a5035d5af4eb"},{"sha":"daa6e01308ad32ba2ffee6685389c4750aff56ed","author":{"name":"Or Gerlitz","email":"1d5567bccfc6dd59c6f26cddb2897fb0786c20af@mellanox.com"},"message":"net/mlx5e: Use the proper UAPI values when offloading TC vlan actions\n\n[ Upstream commit 09c91ddf2cd33489c2c14edfef43ae38d412888e ]\n\nCurrently we use the non UAPI values and we miss erring on\nthe modify action which is not supported, fix that.\n\nFixes: 8b32580df1cb ('net/mlx5e: Add TC vlan action for SRIOV offloads')\nSigned-off-by: Or Gerlitz <ogerlitz@mellanox.com>\nReported-by: Petr Machata <petrm@mellanox.com>\nReviewed-by: Jiri Pirko <jiri@mellanox.com>\nSigned-off-by: Saeed Mahameed <saeedm@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/daa6e01308ad32ba2ffee6685389c4750aff56ed"},{"sha":"458034b72f35ffc27d87ae1c9cf628028abcb079","author":{"name":"Paul Blakey","email":"369f8d7184b233967aead7681ea3b1720f0dc3d0@mellanox.com"},"message":"net/mlx5e: Avoid supporting udp tunnel port ndo for VF reps\n\n[ Upstream commit 1ad9a00ae0efc2e9337148d6c382fad3d27bf99a ]\n\nThis was added to allow the TC offloading code to identify offloading\nencap/decap vxlan rules.\n\nThe VF reps are effectively related to the same mlx5 PCI device as the\nPF. Since the kernel invokes the (say) delete ndo for each netdev, the\nFW erred on multiple vxlan dst port deletes when the port was deleted\nfrom the system.\n\nWe fix that by keeping the registration to be carried out only by the\nPF. Since the PF serves as the uplink device, the VF reps will look\nup a port there and realize if they are ok to offload that.\n\nTested:\n <SETUP VFS>\n <SETUP switchdev mode to have representors>\n ip link add vxlan1 type vxlan id 44 dev ens5f0 dstport 9999\n ip link set vxlan1 up\n ip link del dev vxlan1\n\nFixes: 4a25730eb202 ('net/mlx5e: Add ndo_udp_tunnel_add to VF representors')\nSigned-off-by: Paul Blakey <paulb@mellanox.com>\nReviewed-by: Or Gerlitz <ogerlitz@mellanox.com>\nSigned-off-by: Saeed Mahameed <saeedm@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/458034b72f35ffc27d87ae1c9cf628028abcb079"},{"sha":"345aad1f460293baf48c845d02f28429fa317d54","author":{"name":"Maor Gottlieb","email":"9a814851566e85e810d399739f3db0de09beb73c@mellanox.com"},"message":"net/mlx5: Increase number of max QPs in default profile\n\n[ Upstream commit 5f40b4ed975c26016cf41953b7510fe90718e21c ]\n\nWith ConnectX-4 sharing SRQs from the same space as QPs, we hit a\nlimit preventing some applications to allocate needed QPs amount.\nDouble the size to 256K.\n\nFixes: e126ba97dba9e ('mlx5: Add driver for Mellanox Connect-IB adapters')\nSigned-off-by: Maor Gottlieb <maorg@mellanox.com>\nSigned-off-by: Saeed Mahameed <saeedm@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/345aad1f460293baf48c845d02f28429fa317d54"},{"sha":"4ec387a74cdc440c9f7f78d1286451bf313e77f2","author":{"name":"Gal Pressman","email":"9c475a168a78d08c8fde80de9ff848ff0c3cb70b@mellanox.com"},"message":"net/mlx5e: Count GSO packets correctly\n\n[ Upstream commit d3a4e4da54c7adb420d5f48e89be913b14bdeff1 ]\n\nTX packets statistics ('tx_packets' counter) used to count GSO packets\nas one, even though it contains multiple segments.\nThis patch will increment the counter by the number of segments, and\nalign the driver with the behavior of other drivers in the stack.\n\nNote that no information is lost in this patch due to 'tx_tso_packets'\ncounter existence.\n\nBefore, ethtool showed:\n$ ethtool -S ens6 | egrep \"tx_packets|tx_tso_packets\"\n     tx_packets: 61340\n     tx_tso_packets: 60954\n     tx_packets_phy: 2451115\n\nNow, we will see the more logical statistics:\n$ ethtool -S ens6 | egrep \"tx_packets|tx_tso_packets\"\n     tx_packets: 2451115\n     tx_tso_packets: 60954\n     tx_packets_phy: 2451115\n\nFixes: e586b3b0baee (\"net/mlx5: Ethernet Datapath files\")\nSigned-off-by: Gal Pressman <galp@mellanox.com>\nCc: kernel-team@fb.com\nSigned-off-by: Saeed Mahameed <saeedm@mellanox.com>\nAcked-by: Alexei Starovoitov <ast@kernel.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/4ec387a74cdc440c9f7f78d1286451bf313e77f2"},{"sha":"4162e85c7134627179e25ece5f401e1f7e1b604c","author":{"name":"Gal Pressman","email":"9c475a168a78d08c8fde80de9ff848ff0c3cb70b@mellanox.com"},"message":"net/mlx5e: Count LRO packets correctly\n\n[ Upstream commit 8ab7e2ae15d84ba758b2c8c6f4075722e9bd2a08 ]\n\nRX packets statistics ('rx_packets' counter) used to count LRO packets\nas one, even though it contains multiple segments.\nThis patch will increment the counter by the number of segments, and\nalign the driver with the behavior of other drivers in the stack.\n\nNote that no information is lost in this patch due to 'rx_lro_packets'\ncounter existence.\n\nBefore, ethtool showed:\n$ ethtool -S ens6 | egrep \"rx_packets|rx_lro_packets\"\n     rx_packets: 435277\n     rx_lro_packets: 35847\n     rx_packets_phy: 1935066\n\nNow, we will see the more logical statistics:\n$ ethtool -S ens6 | egrep \"rx_packets|rx_lro_packets\"\n     rx_packets: 1935066\n     rx_lro_packets: 35847\n     rx_packets_phy: 1935066\n\nFixes: e586b3b0baee (\"net/mlx5: Ethernet Datapath files\")\nSigned-off-by: Gal Pressman <galp@mellanox.com>\nCc: kernel-team@fb.com\nSigned-off-by: Saeed Mahameed <saeedm@mellanox.com>\nAcked-by: Alexei Starovoitov <ast@kernel.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/4162e85c7134627179e25ece5f401e1f7e1b604c"},{"sha":"30b72691dbca4828f9abffd79aae3b39f31aa186","author":{"name":"Alexander Potapenko","email":"8a652d6e37d449a8e8c8989569d8839dd1bfdb29@google.com"},"message":"ipv6: make sure to initialize sockc.tsflags before first use\n\n[ Upstream commit d515684d78148884d5fc425ba904c50f03844020 ]\n\nIn the case udp_sk(sk)->pending is AF_INET6, udpv6_sendmsg() would\njump to do_append_data, skipping the initialization of sockc.tsflags.\nFix the problem by moving sockc.tsflags initialization earlier.\n\nThe bug was detected with KMSAN.\n\nFixes: c14ac9451c34 (\"sock: enable timestamping using control messages\")\nSigned-off-by: Alexander Potapenko <glider@google.com>\nAcked-by: Soheil Hassas Yeganeh <soheil@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/30b72691dbca4828f9abffd79aae3b39f31aa186"},{"sha":"212508f709ab66f972481a681a29ca971d78692b","author":{"name":"Doug Berger","email":"a5e842be13d05e3351c9e4cf3d1cd95903dfe01e@gmail.com"},"message":"net: bcmgenet: remove bcmgenet_internal_phy_setup()\n\n[ Upstream commit 31739eae738ccbe8b9d627c3f2251017ca03f4d2 ]\n\nCommit 6ac3ce8295e6 (\"net: bcmgenet: Remove excessive PHY reset\")\nremoved the bcmgenet_mii_reset() function from bcmgenet_power_up() and\nbcmgenet_internal_phy_setup() functions.  In so doing it broke the reset\nof the internal PHY devices used by the GENETv1-GENETv3 which required\nthis reset before the UniMAC was enabled.  It also broke the internal\nGPHY devices used by the GENETv4 because the config_init that installed\nthe AFE workaround was no longer occurring after the reset of the GPHY\nperformed by bcmgenet_phy_power_set() in bcmgenet_internal_phy_setup().\nIn addition the code in bcmgenet_internal_phy_setup() related to the\n\"enable APD\" comment goes with the bcmgenet_mii_reset() so it should\nhave also been removed.\n\nCommit bd4060a6108b (\"net: bcmgenet: Power on integrated GPHY in\nbcmgenet_power_up()\") moved the bcmgenet_phy_power_set() call to the\nbcmgenet_power_up() function, but failed to remove it from the\nbcmgenet_internal_phy_setup() function.  Had it done so, the\nbcmgenet_internal_phy_setup() function would have been empty and could\nhave been removed at that time.\n\nCommit 5dbebbb44a6a (\"net: bcmgenet: Software reset EPHY after power on\")\nwas submitted to correct the functional problems introduced by\ncommit 6ac3ce8295e6 (\"net: bcmgenet: Remove excessive PHY reset\"). It\nwas included in v4.4 and made available on 4.3-stable. Unfortunately,\nit didn't fully revert the commit because this bcmgenet_mii_reset()\ndoesn't apply the soft reset to the internal GPHY used by GENETv4 like\nthe previous one did. This prevents the restoration of the AFE work-\narounds for internal GPHY devices after the bcmgenet_phy_power_set() in\nbcmgenet_internal_phy_setup().\n\nThis commit takes the alternate approach of removing the unnecessary\nbcmgenet_internal_phy_setup() function which shouldn't have been in v4.3\nso that when bcmgenet_mii_reset() was restored it should have only gone\ninto bcmgenet_power_up().  This will avoid the problems while also\nremoving the redundancy (and hopefully some of the confusion).\n\nFixes: 6ac3ce8295e6 (\"net: bcmgenet: Remove excessive PHY reset\")\nSigned-off-by: Doug Berger <opendmb@gmail.com>\nReviewed-by: Florian Fainelli <f.fainelli@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/212508f709ab66f972481a681a29ca971d78692b"},{"sha":"1880e1308e9da2337b74b4241361ac54433ffd95","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"ipv4: provide stronger user input validation in nl_fib_input()\n\n[ Upstream commit c64c0b3cac4c5b8cb093727d2c19743ea3965c0b ]\n\nAlexander reported a KMSAN splat caused by reads of uninitialized\nfield (tb_id_in) from user provided struct fib_result_nl\n\nIt turns out nl_fib_input() sanity tests on user input is a bit\nwrong :\n\nUser can pretend nlh->nlmsg_len is big enough, but provide\nat sendmsg() time a too small buffer.\n\nReported-by: Alexander Potapenko <glider@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/1880e1308e9da2337b74b4241361ac54433ffd95"},{"sha":"aaa31c62f737f7b09a27c5aa7f4627141744b1e8","author":{"name":"Daniel Borkmann","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@iogearbox.net"},"message":"socket, bpf: fix sk_filter use after free in sk_clone_lock\n\n[ Upstream commit a97e50cc4cb67e1e7bff56f6b41cda62ca832336 ]\n\nIn sk_clone_lock(), we create a new socket and inherit most of the\nparent's members via sock_copy() which memcpy()'s various sections.\nNow, in case the parent socket had a BPF socket filter attached,\nthen newsk->sk_filter points to the same instance as the original\nsk->sk_filter.\n\nsk_filter_charge() is then called on the newsk->sk_filter to take a\nreference and should that fail due to hitting max optmem, we bail\nout and release the newsk instance.\n\nThe issue is that commit 278571baca2a (\"net: filter: simplify socket\ncharging\") wrongly combined the dismantle path with the failure path\nof xfrm_sk_clone_policy(). This means, even when charging failed, we\ncall sk_free_unlock_clone() on the newsk, which then still points to\nthe same sk_filter as the original sk.\n\nThus, sk_free_unlock_clone() calls into __sk_destruct() eventually\nwhere it tests for present sk_filter and calls sk_filter_uncharge()\non it, which potentially lets sk_omem_alloc wrap around and releases\nthe eBPF prog and sk_filter structure from the (still intact) parent.\n\nFix it by making sure that when sk_filter_charge() failed, we reset\nnewsk->sk_filter back to NULL before passing to sk_free_unlock_clone(),\nso that we don't mess with the parents sk_filter.\n\nOnly if xfrm_sk_clone_policy() fails, we did reach the point where\neither the parent's filter was NULL and as a result newsk's as well\nor where we previously had a successful sk_filter_charge(), thus for\nthat case, we do need sk_filter_uncharge() to release the prior taken\nreference on sk_filter.\n\nFixes: 278571baca2a (\"net: filter: simplify socket charging\")\nSigned-off-by: Daniel Borkmann <daniel@iogearbox.net>\nAcked-by: Alexei Starovoitov <ast@kernel.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/aaa31c62f737f7b09a27c5aa7f4627141744b1e8"}]}
{"actor":{"display_login":"woodsts"}}