{"push_id":1752064666,"size":148,"distinct_size":148,"ref":"refs/heads/dominion-4.11","head":"dadae010017d2b1c968df2c0027180afeb107c81","before":"f30113607a09a7b3f0963daa002e5234170b2177","commits":[{"sha":"40a1937317e26d05c815096e1151df6600b7b525","author":{"name":"Adrian Salido","email":"6d635a0a76d943c7a6d2808755e208535d850b07@google.com"},"message":"dm ioctl: prevent stack leak in dm ioctl call\n\ncommit 4617f564c06117c7d1b611be49521a4430042287 upstream.\n\nWhen calling a dm ioctl that doesn't process any data\n(IOCTL_FLAGS_NO_PARAMS), the contents of the data field in struct\ndm_ioctl are left initialized.  Current code is incorrectly extending\nthe size of data copied back to user, causing the contents of kernel\nstack to be leaked to user.  Fix by only copying contents before data\nand allow the functions processing the ioctl to override.\n\nSigned-off-by: Adrian Salido <salidoa@google.com>\nReviewed-by: Alasdair G Kergon <agk@redhat.com>\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/40a1937317e26d05c815096e1151df6600b7b525"},{"sha":"648ada88cba2e78171d8ee81f4fceffc0386f6aa","author":{"name":"Vincent Abriou","email":"e34a1c2952295d87d3bb46d3e5d505ae5af10870@st.com"},"message":"drm/sti: fix GDP size to support up to UHD resolution\n\ncommit 2f410f88c0a1c7e19762918d2614f506a7b63a82 upstream.\n\nOn stih407-410 chip family the GDP layers are able to support up to UHD\nresolution (3840 x 2160).\n\nSigned-off-by: Vincent Abriou <vincent.abriou@st.com>\nAcked-by: Lee Jones <lee.jones@linaro.org>\nTested-by: Lee Jones <lee.jones@linaro.org>\nLink: http://patchwork.freedesktop.org/patch/msgid/1490280292-30466-1-git-send-email-vincent.abriou@st.com\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/648ada88cba2e78171d8ee81f4fceffc0386f6aa"},{"sha":"b998524b6c6082805dded8b03c826233f66241bd","author":{"name":"Giedrius Statkevičius","email":"39a5fa750eb67fb226ff9a8e977110f51aaff793@gmail.com"},"message":"power: supply: lp8788: prevent out of bounds array access\n\ncommit bdd9968d35f7fcdb76089347d1529bf079534214 upstream.\n\nval might become 7 in which case stime[7] (array of length 7) would be\naccessed during the scnprintf call later and that will cause issues.\nObviously, string concatenation is not intended here so just a comma needs\nto be added to fix the issue.\n\nFixes: 98a276649358 (\"power_supply: Add new lp8788 charger driver\")\nSigned-off-by: Giedrius Statkevičius <giedrius.statkevicius@gmail.com>\nAcked-by: Milo Kim <milo.kim@ti.com>\nSigned-off-by: Sebastian Reichel <sre@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/b998524b6c6082805dded8b03c826233f66241bd"},{"sha":"7f073b7e4d63afdcf3abc91f8d9c11ab9317ed0b","author":{"name":"James Hughes","email":"95b9f28333d4c74fdec10c0e20b6222bb3683402@raspberrypi.org"},"message":"brcmfmac: Ensure pointer correctly set if skb data location changes\n\ncommit 455a1eb4654c24560eb9dfc634f29cba3d87601e upstream.\n\nThe incoming skb header may be resized if header space is\ninsufficient, which might change the data adddress in the skb.\nEnsure that a cached pointer to that data is correctly set by\nmoving assignment to after any possible changes.\n\nSigned-off-by: James Hughes <james.hughes@raspberrypi.org>\nAcked-by: Arend van Spriel <arend.vanspriel@broadcom.com>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>\nSigned-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/7f073b7e4d63afdcf3abc91f8d9c11ab9317ed0b"},{"sha":"c98f47c1f645774e02e04e94111c98b97462ee98","author":{"name":"James Hughes","email":"95b9f28333d4c74fdec10c0e20b6222bb3683402@raspberrypi.org"},"message":"brcmfmac: Make skb header writable before use\n\ncommit 9cc4b7cb86cbcc6330a3faa8cd65268cd2d3c227 upstream.\n\nThe driver was making changes to the skb_header without\nensuring it was writable (i.e. uncloned).\nThis patch also removes some boiler plate header size\nchecking/adjustment code as that is also handled by the\nskb_cow_header function used to make header writable.\n\nSigned-off-by: James Hughes <james.hughes@raspberrypi.org>\nAcked-by: Arend van Spriel <arend.vanspriel@broadcom.com>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>\nSigned-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/c98f47c1f645774e02e04e94111c98b97462ee98"},{"sha":"e2b8851f1fdfe1d038fa9a03497d257f7a8ffb63","author":{"name":"Dave Aldridge","email":"e03ba4c6f8535e430ecc1db9e3b5a3d5e615db9f@oracle.com"},"message":"sparc64: fix fault handling in NGbzero.S and GENbzero.S\n\ncommit 3c7f62212018b904ae17f5636ead18a4dca3a88f upstream.\n\nWhen any of the functions contained in NGbzero.S and GENbzero.S\nvector through *bzero_from_clear_user, we may end up taking a\nfault when executing one of the store alternate address space\ninstructions. If this happens, the exception handler does not\nrestore the %asi register.\n\nThis commit fixes the issue by introducing a new exception\nhandler that ensures the %asi register is restored when\na fault is handled.\n\nOrabug: 25577560\n\nSigned-off-by: Dave Aldridge <david.j.aldridge@oracle.com>\nReviewed-by: Rob Gardner <rob.gardner@oracle.com>\nReviewed-by: Babu Moger <babu.moger@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/e2b8851f1fdfe1d038fa9a03497d257f7a8ffb63"},{"sha":"acc7c954b035b53c58714ce951354becaddfd5b8","author":{"name":"Greg Kroah-Hartman","email":"4931344b09d7a7d3573e8b1ebec918e229ead9bf@linuxfoundation.org"},"message":"refcount: change EXPORT_SYMBOL markings\n\ncommit d557d1b58b3546bab2c5bc2d624c5709840e6b10 upstream.\n\nNow that kref is using the refcount apis, the _GPL markings are getting\nexported to places that it previously wasn't.  Now kref.h is GPLv2\nlicensed, so any non-GPL code using it better be talking to some\nlawyers, but changing api markings isn't considered \"nice\", so let's fix\nthis up.\n\nCc: Philip Müller <philm@manjaro.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/acc7c954b035b53c58714ce951354becaddfd5b8"},{"sha":"c0e5b847c77e2b8265a5abe7f7642526f08cd51a","author":{"name":"Alexandre Belloni","email":"7b8bd04b94da78b84fb04a2a85797dbf15d0072c@free-electrons.com"},"message":"net: macb: fix phy interrupt parsing\n\n[ Upstream commit ae3696c167cc04d32634c4af82f43b446c5176b0 ]\n\nSince 83a77e9ec415, the phydev irq is explicitly set to PHY_POLL when\nthere is no pdata. It doesn't work on DT enabled platforms because the\nphydev irq is already set by libphy before.\n\nFixes: 83a77e9ec415 (\"net: macb: Added PCI wrapper for Platform Driver.\")\nSigned-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>\nAcked-by: Nicolas Ferre <nicolas.ferre@microchip.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/c0e5b847c77e2b8265a5abe7f7642526f08cd51a"},{"sha":"011fbfb296e4cfcd5769fb3f84ae2f263b1faac1","author":{"name":"Davide Caratti","email":"6f31f02d035d14420e3dc1e73aa793505bdcbcd7@redhat.com"},"message":"tcp: fix access to sk->sk_state in tcp_poll()\n\n[ Upstream commit d68be71ea14d609a5f31534003319be5db422595 ]\n\navoid direct access to sk->sk_state when tcp_poll() is called on a socket\nusing active TCP fastopen with deferred connect. Use local variable\n'state', which stores the result of sk_state_load(), like it was done in\ncommit 00fd38d938db (\"tcp: ensure proper barriers in lockless contexts\").\n\nFixes: 19f6d3f3c842 (\"net/tcp-fastopen: Add new API support\")\nSigned-off-by: Davide Caratti <dcaratti@redhat.com>\nAcked-by: Wei Wang <weiwan@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/011fbfb296e4cfcd5769fb3f84ae2f263b1faac1"},{"sha":"5a5b34164f93d5cb002a9eb6a9a8024e24e5e299","author":{"name":"Girish Moodalbail","email":"28233744abf51a4dd97535cd8b03bceb7d9e113e@oracle.com"},"message":"geneve: fix incorrect setting of UDP checksum flag\n\n[ Upstream commit 5e0740c445e6ae4026f5e52456ff8d0be9725183 ]\n\nCreating a geneve link with 'udpcsum' set results in a creation of link\nfor which UDP checksum will NOT be computed on outbound packets, as can\nbe seen below.\n\n11: gen0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN\n    link/ether c2:85:27:b6:b4:15 brd ff:ff:ff:ff:ff:ff promiscuity 0\n    geneve id 200 remote 192.168.13.1 dstport 6081 noudpcsum\n\nSimilarly, creating a link with 'noudpcsum' set results in a creation\nof link for which UDP checksum will be computed on outbound packets.\n\nFixes: 9b4437a5b870 (\"geneve: Unify LWT and netdev handling.\")\nSigned-off-by: Girish Moodalbail <girish.moodalbail@oracle.com>\nAcked-by: Pravin B Shelar <pshelar@ovn.org>\nAcked-by: Lance Richardson <lrichard@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/5a5b34164f93d5cb002a9eb6a9a8024e24e5e299"},{"sha":"34acfbf08cce238b79cfdc6c59a5fea020056c08","author":{"name":"Yonghong Song","email":"98d525f41db4150172331cbb12213accc29a4f05@fb.com"},"message":"bpf: enhance verifier to understand stack pointer arithmetic\n\n[ Upstream commit 332270fdc8b6fba07d059a9ad44df9e1a2ad4529 ]\n\nllvm 4.0 and above generates the code like below:\n....\n440: (b7) r1 = 15\n441: (05) goto pc+73\n515: (79) r6 = *(u64 *)(r10 -152)\n516: (bf) r7 = r10\n517: (07) r7 += -112\n518: (bf) r2 = r7\n519: (0f) r2 += r1\n520: (71) r1 = *(u8 *)(r8 +0)\n521: (73) *(u8 *)(r2 +45) = r1\n....\nand the verifier complains \"R2 invalid mem access 'inv'\" for insn #521.\nThis is because verifier marks register r2 as unknown value after #519\nwhere r2 is a stack pointer and r1 holds a constant value.\n\nTeach verifier to recognize \"stack_ptr + imm\" and\n\"stack_ptr + reg with const val\" as valid stack_ptr with new offset.\n\nSigned-off-by: Yonghong Song <yhs@fb.com>\nAcked-by: Martin KaFai Lau <kafai@fb.com>\nAcked-by: Daniel Borkmann <daniel@iogearbox.net>\nSigned-off-by: Alexei Starovoitov <ast@kernel.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/34acfbf08cce238b79cfdc6c59a5fea020056c08"},{"sha":"f94cc32ccbbab581ffd116795ac76c8ae69b8f22","author":{"name":"Daniel Borkmann","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@iogearbox.net"},"message":"bpf, arm64: fix jit branch offset related to ldimm64\n\n[ Upstream commit ddc665a4bb4b728b4e6ecec8db1b64efa9184b9c ]\n\nWhen the instruction right before the branch destination is\na 64 bit load immediate, we currently calculate the wrong\njump offset in the ctx->offset[] array as we only account\none instruction slot for the 64 bit load immediate although\nit uses two BPF instructions. Fix it up by setting the offset\ninto the right slot after we incremented the index.\n\nBefore (ldimm64 test 1):\n\n  [...]\n  00000020:  52800007  mov w7, #0x0 // #0\n  00000024:  d2800060  mov x0, #0x3 // #3\n  00000028:  d2800041  mov x1, #0x2 // #2\n  0000002c:  eb01001f  cmp x0, x1\n  00000030:  54ffff82  b.cs 0x00000020\n  00000034:  d29fffe7  mov x7, #0xffff // #65535\n  00000038:  f2bfffe7  movk x7, #0xffff, lsl #16\n  0000003c:  f2dfffe7  movk x7, #0xffff, lsl #32\n  00000040:  f2ffffe7  movk x7, #0xffff, lsl #48\n  00000044:  d29dddc7  mov x7, #0xeeee // #61166\n  00000048:  f2bdddc7  movk x7, #0xeeee, lsl #16\n  0000004c:  f2ddddc7  movk x7, #0xeeee, lsl #32\n  00000050:  f2fdddc7  movk x7, #0xeeee, lsl #48\n  [...]\n\nAfter (ldimm64 test 1):\n\n  [...]\n  00000020:  52800007  mov w7, #0x0 // #0\n  00000024:  d2800060  mov x0, #0x3 // #3\n  00000028:  d2800041  mov x1, #0x2 // #2\n  0000002c:  eb01001f  cmp x0, x1\n  00000030:  540000a2  b.cs 0x00000044\n  00000034:  d29fffe7  mov x7, #0xffff // #65535\n  00000038:  f2bfffe7  movk x7, #0xffff, lsl #16\n  0000003c:  f2dfffe7  movk x7, #0xffff, lsl #32\n  00000040:  f2ffffe7  movk x7, #0xffff, lsl #48\n  00000044:  d29dddc7  mov x7, #0xeeee // #61166\n  00000048:  f2bdddc7  movk x7, #0xeeee, lsl #16\n  0000004c:  f2ddddc7  movk x7, #0xeeee, lsl #32\n  00000050:  f2fdddc7  movk x7, #0xeeee, lsl #48\n  [...]\n\nAlso, add a couple of test cases to make sure JITs pass\nthis test. Tested on Cavium ThunderX ARMv8. The added\ntest cases all pass after the fix.\n\nFixes: 8eee539ddea0 (\"arm64: bpf: fix out-of-bounds read in bpf2a64_offset()\")\nReported-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Daniel Borkmann <daniel@iogearbox.net>\nAcked-by: Alexei Starovoitov <ast@kernel.org>\nCc: Xi Wang <xi.wang@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/f94cc32ccbbab581ffd116795ac76c8ae69b8f22"},{"sha":"a1baca92afd5c420fb854ed79cb8cd3d8be29fbb","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"tcp: fix wraparound issue in tcp_lp\n\n[ Upstream commit a9f11f963a546fea9144f6a6d1a307e814a387e7 ]\n\nBe careful when comparing tcp_time_stamp to some u32 quantity,\notherwise result can be surprising.\n\nFixes: 7c106d7e782b (\"[TCP]: TCP Low Priority congestion control\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/a1baca92afd5c420fb854ed79cb8cd3d8be29fbb"},{"sha":"23e761f37b4fa1c6420c5d72a56fd63d575dc4c0","author":{"name":"David Ahern","email":"e0d419a0ba2bdeef0ad5e59f7813befeb3252a55@gmail.com"},"message":"net: ipv6: Do not duplicate DAD on link up\n\n[ Upstream commit 6d717134a1a6e1b34a7d0d70e953037bc2642046 ]\n\nAndrey reported a warning triggered by the rcu code:\n\n------------[ cut here ]------------\nWARNING: CPU: 1 PID: 5911 at lib/debugobjects.c:289\ndebug_print_object+0x175/0x210\nODEBUG: activate active (active state 1) object type: rcu_head hint:\n        (null)\nModules linked in:\nCPU: 1 PID: 5911 Comm: a.out Not tainted 4.11.0-rc8+ #271\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:16\n dump_stack+0x192/0x22d lib/dump_stack.c:52\n __warn+0x19f/0x1e0 kernel/panic.c:549\n warn_slowpath_fmt+0xe0/0x120 kernel/panic.c:564\n debug_print_object+0x175/0x210 lib/debugobjects.c:286\n debug_object_activate+0x574/0x7e0 lib/debugobjects.c:442\n debug_rcu_head_queue kernel/rcu/rcu.h:75\n __call_rcu.constprop.76+0xff/0x9c0 kernel/rcu/tree.c:3229\n call_rcu_sched+0x12/0x20 kernel/rcu/tree.c:3288\n rt6_rcu_free net/ipv6/ip6_fib.c:158\n rt6_release+0x1ea/0x290 net/ipv6/ip6_fib.c:188\n fib6_del_route net/ipv6/ip6_fib.c:1461\n fib6_del+0xa42/0xdc0 net/ipv6/ip6_fib.c:1500\n __ip6_del_rt+0x100/0x160 net/ipv6/route.c:2174\n ip6_del_rt+0x140/0x1b0 net/ipv6/route.c:2187\n __ipv6_ifa_notify+0x269/0x780 net/ipv6/addrconf.c:5520\n addrconf_ifdown+0xe60/0x1a20 net/ipv6/addrconf.c:3672\n...\n\nAndrey's reproducer program runs in a very tight loop, calling\n'unshare -n' and then spawning 2 sets of 14 threads running random ioctl\ncalls. The relevant networking sequence:\n\n1. New network namespace created via unshare -n\n- ip6tnl0 device is created in down state\n\n2. address added to ip6tnl0\n- equivalent to ip -6 addr add dev ip6tnl0 fd00::bb/1\n- DAD is started on the address and when it completes the host\n  route is inserted into the FIB\n\n3. ip6tnl0 is brought up\n- the new fixup_permanent_addr function restarts DAD on the address\n\n4. exit namespace\n- teardown / cleanup sequence starts\n- once in a blue moon, lo teardown appears to happen BEFORE teardown\n  of ip6tunl0\n  + down on 'lo' removes the host route from the FIB since the dst->dev\n    for the route is loobback\n  + host route added to rcu callback list\n    * rcu callback has not run yet, so rt is NOT on the gc list so it has\n      NOT been marked obsolete\n\n5. in parallel to 4. worker_thread runs addrconf_dad_completed\n- DAD on the address on ip6tnl0 completes\n- calls ipv6_ifa_notify which inserts the host route\n\nAll of that happens very quickly. The result is that a host route that\nhas been deleted from the IPv6 FIB and added to the RCU list is re-inserted\ninto the FIB.\n\nThe exit namespace eventually gets to cleaning up ip6tnl0 which removes the\nhost route from the FIB again, calls the rcu function for cleanup -- and\ntriggers the double rcu trace.\n\nThe root cause is duplicate DAD on the address -- steps 2 and 3. Arguably,\nDAD should not be started in step 2. The interface is in the down state,\nso it can not really send out requests for the address which makes starting\nDAD pointless.\n\nSince the second DAD was introduced by a recent change, seems appropriate\nto use it for the Fixes tag and have the fixup function only start DAD for\naddresses in the PREDAD state which occurs in addrconf_ifdown if the\naddress is retained.\n\nBig thanks to Andrey for isolating a reliable reproducer for this problem.\nFixes: f1705ec197e7 (\"net: ipv6: Make address flushing on ifdown optional\")\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: David Ahern <dsahern@gmail.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/23e761f37b4fa1c6420c5d72a56fd63d575dc4c0"},{"sha":"0b1d889cb0c9ebc706e459d459822f7a38cc88ae","author":{"name":"Daniele Palmas","email":"8eadd4e0f410715cd0bee604d0bbc31740484d9b@gmail.com"},"message":"net: usb: qmi_wwan: add Telit ME910 support\n\n[ Upstream commit 4c54dc0277d0d55a9248c43aebd31858f926a056 ]\n\nThis patch adds support for Telit ME910 PID 0x1100.\n\nSigned-off-by: Daniele Palmas <dnlplm@gmail.com>\nAcked-by: Bjørn Mork <bjorn@mork.no>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/0b1d889cb0c9ebc706e459d459822f7a38cc88ae"},{"sha":"86a9a0884d287a9417193179fcd10e7b63f136c2","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"tcp: do not inherit fastopen_req from parent\n\n[ Upstream commit 8b485ce69876c65db12ed390e7f9c0d2a64eff2c ]\n\nUnder fuzzer stress, it is possible that a child gets a non NULL\nfastopen_req pointer from its parent at accept() time, when/if parent\nmorphs from listener to active session.\n\nWe need to make sure this can not happen, by clearing the field after\nsocket cloning.\n\nBUG: Double free or freeing an invalid pointer\nUnexpected shadow byte: 0xFB\nCPU: 3 PID: 20933 Comm: syz-executor3 Not tainted 4.11.0+ #306\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs\n01/01/2011\nCall Trace:\n <IRQ>\n __dump_stack lib/dump_stack.c:16 [inline]\n dump_stack+0x292/0x395 lib/dump_stack.c:52\n kasan_object_err+0x1c/0x70 mm/kasan/report.c:164\n kasan_report_double_free+0x5c/0x70 mm/kasan/report.c:185\n kasan_slab_free+0x9d/0xc0 mm/kasan/kasan.c:580\n slab_free_hook mm/slub.c:1357 [inline]\n slab_free_freelist_hook mm/slub.c:1379 [inline]\n slab_free mm/slub.c:2961 [inline]\n kfree+0xe8/0x2b0 mm/slub.c:3882\n tcp_free_fastopen_req net/ipv4/tcp.c:1077 [inline]\n tcp_disconnect+0xc15/0x13e0 net/ipv4/tcp.c:2328\n inet_child_forget+0xb8/0x600 net/ipv4/inet_connection_sock.c:898\n inet_csk_reqsk_queue_add+0x1e7/0x250\nnet/ipv4/inet_connection_sock.c:928\n tcp_get_cookie_sock+0x21a/0x510 net/ipv4/syncookies.c:217\n cookie_v4_check+0x1a19/0x28b0 net/ipv4/syncookies.c:384\n tcp_v4_cookie_check net/ipv4/tcp_ipv4.c:1384 [inline]\n tcp_v4_do_rcv+0x731/0x940 net/ipv4/tcp_ipv4.c:1421\n tcp_v4_rcv+0x2dc0/0x31c0 net/ipv4/tcp_ipv4.c:1715\n ip_local_deliver_finish+0x4cc/0xc20 net/ipv4/ip_input.c:216\n NF_HOOK include/linux/netfilter.h:257 [inline]\n ip_local_deliver+0x1ce/0x700 net/ipv4/ip_input.c:257\n dst_input include/net/dst.h:492 [inline]\n ip_rcv_finish+0xb1d/0x20b0 net/ipv4/ip_input.c:396\n NF_HOOK include/linux/netfilter.h:257 [inline]\n ip_rcv+0xd8c/0x19c0 net/ipv4/ip_input.c:487\n __netif_receive_skb_core+0x1ad1/0x3400 net/core/dev.c:4210\n __netif_receive_skb+0x2a/0x1a0 net/core/dev.c:4248\n process_backlog+0xe5/0x6c0 net/core/dev.c:4868\n napi_poll net/core/dev.c:5270 [inline]\n net_rx_action+0xe70/0x18e0 net/core/dev.c:5335\n __do_softirq+0x2fb/0xb99 kernel/softirq.c:284\n do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:899\n </IRQ>\n do_softirq.part.17+0x1e8/0x230 kernel/softirq.c:328\n do_softirq kernel/softirq.c:176 [inline]\n __local_bh_enable_ip+0x1cf/0x1e0 kernel/softirq.c:181\n local_bh_enable include/linux/bottom_half.h:31 [inline]\n rcu_read_unlock_bh include/linux/rcupdate.h:931 [inline]\n ip_finish_output2+0x9ab/0x15e0 net/ipv4/ip_output.c:230\n ip_finish_output+0xa35/0xdf0 net/ipv4/ip_output.c:316\n NF_HOOK_COND include/linux/netfilter.h:246 [inline]\n ip_output+0x1f6/0x7b0 net/ipv4/ip_output.c:404\n dst_output include/net/dst.h:486 [inline]\n ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124\n ip_queue_xmit+0x9a8/0x1a10 net/ipv4/ip_output.c:503\n tcp_transmit_skb+0x1ade/0x3470 net/ipv4/tcp_output.c:1057\n tcp_write_xmit+0x79e/0x55b0 net/ipv4/tcp_output.c:2265\n __tcp_push_pending_frames+0xfa/0x3a0 net/ipv4/tcp_output.c:2450\n tcp_push+0x4ee/0x780 net/ipv4/tcp.c:683\n tcp_sendmsg+0x128d/0x39b0 net/ipv4/tcp.c:1342\n inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762\n sock_sendmsg_nosec net/socket.c:633 [inline]\n sock_sendmsg+0xca/0x110 net/socket.c:643\n SYSC_sendto+0x660/0x810 net/socket.c:1696\n SyS_sendto+0x40/0x50 net/socket.c:1664\n entry_SYSCALL_64_fastpath+0x1f/0xbe\nRIP: 0033:0x446059\nRSP: 002b:00007faa6761fb58 EFLAGS: 00000282 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 0000000000000017 RCX: 0000000000446059\nRDX: 0000000000000001 RSI: 0000000020ba3fcd RDI: 0000000000000017\nRBP: 00000000006e40a0 R08: 0000000020ba4ff0 R09: 0000000000000010\nR10: 0000000020000000 R11: 0000000000000282 R12: 0000000000708150\nR13: 0000000000000000 R14: 00007faa676209c0 R15: 00007faa67620700\nObject at ffff88003b5bbcb8, in cache kmalloc-64 size: 64\nAllocated:\nPID = 20909\n save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59\n save_stack+0x43/0xd0 mm/kasan/kasan.c:513\n set_track mm/kasan/kasan.c:525 [inline]\n kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616\n kmem_cache_alloc_trace+0x82/0x270 mm/slub.c:2745\n kmalloc include/linux/slab.h:490 [inline]\n kzalloc include/linux/slab.h:663 [inline]\n tcp_sendmsg_fastopen net/ipv4/tcp.c:1094 [inline]\n tcp_sendmsg+0x221a/0x39b0 net/ipv4/tcp.c:1139\n inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762\n sock_sendmsg_nosec net/socket.c:633 [inline]\n sock_sendmsg+0xca/0x110 net/socket.c:643\n SYSC_sendto+0x660/0x810 net/socket.c:1696\n SyS_sendto+0x40/0x50 net/socket.c:1664\n entry_SYSCALL_64_fastpath+0x1f/0xbe\nFreed:\nPID = 20909\n save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59\n save_stack+0x43/0xd0 mm/kasan/kasan.c:513\n set_track mm/kasan/kasan.c:525 [inline]\n kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:589\n slab_free_hook mm/slub.c:1357 [inline]\n slab_free_freelist_hook mm/slub.c:1379 [inline]\n slab_free mm/slub.c:2961 [inline]\n kfree+0xe8/0x2b0 mm/slub.c:3882\n tcp_free_fastopen_req net/ipv4/tcp.c:1077 [inline]\n tcp_disconnect+0xc15/0x13e0 net/ipv4/tcp.c:2328\n __inet_stream_connect+0x20c/0xf90 net/ipv4/af_inet.c:593\n tcp_sendmsg_fastopen net/ipv4/tcp.c:1111 [inline]\n tcp_sendmsg+0x23a8/0x39b0 net/ipv4/tcp.c:1139\n inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762\n sock_sendmsg_nosec net/socket.c:633 [inline]\n sock_sendmsg+0xca/0x110 net/socket.c:643\n SYSC_sendto+0x660/0x810 net/socket.c:1696\n SyS_sendto+0x40/0x50 net/socket.c:1664\n entry_SYSCALL_64_fastpath+0x1f/0xbe\n\nFixes: e994b2f0fb92 (\"tcp: do not lock listener to process SYN packets\")\nFixes: 7db92362d2fe (\"tcp: fix potential double free issue for fastopen_req\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nAcked-by: Wei Wang <weiwan@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/86a9a0884d287a9417193179fcd10e7b63f136c2"},{"sha":"165a007e51f0f8b93c6a83f80f261b020bb9dffe","author":{"name":"Alexander Potapenko","email":"8a652d6e37d449a8e8c8989569d8839dd1bfdb29@google.com"},"message":"ipv4, ipv6: ensure raw socket message is big enough to hold an IP header\n\n[ Upstream commit 86f4c90a1c5c1493f07f2d12c1079f5bf01936f2 ]\n\nraw_send_hdrinc() and rawv6_send_hdrinc() expect that the buffer copied\nfrom the userspace contains the IPv4/IPv6 header, so if too few bytes are\ncopied, parts of the header may remain uninitialized.\n\nThis bug has been detected with KMSAN.\n\nFor the record, the KMSAN report:\n\n==================================================================\nBUG: KMSAN: use of unitialized memory in nf_ct_frag6_gather+0xf5a/0x44a0\ninter: 0\nCPU: 0 PID: 1036 Comm: probe Not tainted 4.11.0-rc5+ #2455\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:16\n dump_stack+0x143/0x1b0 lib/dump_stack.c:52\n kmsan_report+0x16b/0x1e0 mm/kmsan/kmsan.c:1078\n __kmsan_warning_32+0x5c/0xa0 mm/kmsan/kmsan_instr.c:510\n nf_ct_frag6_gather+0xf5a/0x44a0 net/ipv6/netfilter/nf_conntrack_reasm.c:577\n ipv6_defrag+0x1d9/0x280 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:68\n nf_hook_entry_hookfn ./include/linux/netfilter.h:102\n nf_hook_slow+0x13f/0x3c0 net/netfilter/core.c:310\n nf_hook ./include/linux/netfilter.h:212\n NF_HOOK ./include/linux/netfilter.h:255\n rawv6_send_hdrinc net/ipv6/raw.c:673\n rawv6_sendmsg+0x2fcb/0x41a0 net/ipv6/raw.c:919\n inet_sendmsg+0x3f8/0x6d0 net/ipv4/af_inet.c:762\n sock_sendmsg_nosec net/socket.c:633\n sock_sendmsg net/socket.c:643\n SYSC_sendto+0x6a5/0x7c0 net/socket.c:1696\n SyS_sendto+0xbc/0xe0 net/socket.c:1664\n do_syscall_64+0x72/0xa0 arch/x86/entry/common.c:285\n entry_SYSCALL64_slow_path+0x25/0x25 arch/x86/entry/entry_64.S:246\nRIP: 0033:0x436e03\nRSP: 002b:00007ffce48baf38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 00000000004002b0 RCX: 0000000000436e03\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003\nRBP: 00007ffce48baf90 R08: 00007ffce48baf50 R09: 000000000000001c\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000401790 R14: 0000000000401820 R15: 0000000000000000\norigin: 00000000d9400053\n save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59\n kmsan_save_stack_with_flags mm/kmsan/kmsan.c:362\n kmsan_internal_poison_shadow+0xb1/0x1a0 mm/kmsan/kmsan.c:257\n kmsan_poison_shadow+0x6d/0xc0 mm/kmsan/kmsan.c:270\n slab_alloc_node mm/slub.c:2735\n __kmalloc_node_track_caller+0x1f4/0x390 mm/slub.c:4341\n __kmalloc_reserve net/core/skbuff.c:138\n __alloc_skb+0x2cd/0x740 net/core/skbuff.c:231\n alloc_skb ./include/linux/skbuff.h:933\n alloc_skb_with_frags+0x209/0xbc0 net/core/skbuff.c:4678\n sock_alloc_send_pskb+0x9ff/0xe00 net/core/sock.c:1903\n sock_alloc_send_skb+0xe4/0x100 net/core/sock.c:1920\n rawv6_send_hdrinc net/ipv6/raw.c:638\n rawv6_sendmsg+0x2918/0x41a0 net/ipv6/raw.c:919\n inet_sendmsg+0x3f8/0x6d0 net/ipv4/af_inet.c:762\n sock_sendmsg_nosec net/socket.c:633\n sock_sendmsg net/socket.c:643\n SYSC_sendto+0x6a5/0x7c0 net/socket.c:1696\n SyS_sendto+0xbc/0xe0 net/socket.c:1664\n do_syscall_64+0x72/0xa0 arch/x86/entry/common.c:285\n return_from_SYSCALL_64+0x0/0x6a arch/x86/entry/entry_64.S:246\n==================================================================\n\n, triggered by the following syscalls:\n  socket(PF_INET6, SOCK_RAW, IPPROTO_RAW) = 3\n  sendto(3, NULL, 0, 0, {sa_family=AF_INET6, sin6_port=htons(0), inet_pton(AF_INET6, \"ff00::\", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = -1 EPERM\n\nA similar report is triggered in net/ipv4/raw.c if we use a PF_INET socket\ninstead of a PF_INET6 one.\n\nSigned-off-by: Alexander Potapenko <glider@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/165a007e51f0f8b93c6a83f80f261b020bb9dffe"},{"sha":"0913e5733167f958114327975898ea356161febc","author":{"name":"Michal Schmidt","email":"9e0dfbdba9df196aa363c42d09d56c053cd1a2ed@redhat.com"},"message":"rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string\n\n[ Upstream commit 77ef033b687c3e030017c94a29bf6ea3aaaef678 ]\n\nIFLA_PHYS_PORT_NAME is a string attribute, so terminate it with \\0.\nOtherwise libnl3 fails to validate netlink messages with this attribute.\n\"ip -detail a\" assumes too that the attribute is NUL-terminated when\nprinting it. It often was, due to padding.\n\nI noticed this as libvirtd failing to start on a system with sfc driver\nafter upgrading it to Linux 4.11, i.e. when sfc added support for\nphys_port_name.\n\nSigned-off-by: Michal Schmidt <mschmidt@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/0913e5733167f958114327975898ea356161febc"},{"sha":"5ee83127ac04d1d36f79c714c8342fc5f316ae60","author":{"name":"WANG Cong","email":"3f5d79d28d6d48052800caba9df0b30e06fefe41@gmail.com"},"message":"ipv6: initialize route null entry in addrconf_init()\n\n[ Upstream commit 2f460933f58eee3393aba64f0f6d14acb08d1724 ]\n\nAndrey reported a crash on init_net.ipv6.ip6_null_entry->rt6i_idev\nsince it is always NULL.\n\nThis is clearly wrong, we have code to initialize it to loopback_dev,\nunfortunately the order is still not correct.\n\nloopback_dev is registered very early during boot, we lose a chance\nto re-initialize it in notifier. addrconf_init() is called after\nip6_route_init(), which means we have no chance to correct it.\n\nFix it by moving this initialization explicitly after\nipv6_add_dev(init_net.loopback_dev) in addrconf_init().\n\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/5ee83127ac04d1d36f79c714c8342fc5f316ae60"},{"sha":"3960afa2e02f86463e893d0d5583b1e612f6f1ea","author":{"name":"WANG Cong","email":"3f5d79d28d6d48052800caba9df0b30e06fefe41@gmail.com"},"message":"ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf\n\n[ Upstream commit 242d3a49a2a1a71d8eb9f953db1bcaa9d698ce00 ]\n\nFor each netns (except init_net), we initialize its null entry\nin 3 places:\n\n1) The template itself, as we use kmemdup()\n2) Code around dst_init_metrics() in ip6_route_net_init()\n3) ip6_route_dev_notify(), which is supposed to initialize it after\n   loopback registers\n\nUnfortunately the last one still happens in a wrong order because\nwe expect to initialize net->ipv6.ip6_null_entry->rt6i_idev to\nnet->loopback_dev's idev, thus we have to do that after we add\nidev to loopback. However, this notifier has priority == 0 same as\nipv6_dev_notf, and ipv6_dev_notf is registered after\nip6_route_dev_notifier so it is called actually after\nip6_route_dev_notifier. This is similar to commit 2f460933f58e\n(\"ipv6: initialize route null entry in addrconf_init()\") which\nfixes init_net.\n\nFix it by picking a smaller priority for ip6_route_dev_notifier.\nAlso, we have to release the refcnt accordingly when unregistering\nloopback_dev because device exit functions are called before subsys\nexit functions.\n\nAcked-by: David Ahern <dsahern@gmail.com>\nTested-by: David Ahern <dsahern@gmail.com>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/koenkooi/linux/commits/3960afa2e02f86463e893d0d5583b1e612f6f1ea"}]}
{"actor":{"display_login":"koenkooi"}}