{"push_id":1810544441,"size":189,"distinct_size":0,"ref":"refs/heads/caf/korg/linux-4.4.y","head":"1bd30958ec55d80ca72d2ca4e7e5c3d9fbf3173e","before":"b409ba3b053501181d47a35769fe61823da012e9","commits":[{"sha":"b9978c27454cca3a0ba73577c23c15401d30e833","author":{"name":"Orlando Arias","email":"7803c31a5cbf0a8eeb98b1f4485088fc3d8ea680@knights.ucf.edu"},"message":"sparc: Fix -Wstringop-overflow warning\n\n\n[ Upstream commit deba804c90642c8ed0f15ac1083663976d578f54 ]\n\nGreetings,\n\nGCC 7 introduced the -Wstringop-overflow flag to detect buffer overflows\nin calls to string handling functions [1][2]. Due to the way\n``empty_zero_page'' is declared in arch/sparc/include/setup.h, this\ncauses a warning to trigger at compile time in the function mem_init(),\nwhich is subsequently converted to an error. The ensuing patch fixes\nthis issue and aligns the declaration of empty_zero_page to that of\nother architectures. Thank you.\n\nCheers,\nOrlando.\n\n[1] https://gcc.gnu.org/ml/gcc-patches/2016-10/msg02308.html\n[2] https://gcc.gnu.org/gcc-7/changes.html\n\nSigned-off-by: Orlando Arias <oarias@knights.ucf.edu>\n\n--------------------------------------------------------------------------------\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/b9978c27454cca3a0ba73577c23c15401d30e833"},{"sha":"5f67a1663c03a73962fb240cf821338f78981a23","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"dccp/tcp: do not inherit mc_list from parent\n\n\n[ Upstream commit 657831ffc38e30092a2d5f03d385d710eb88b09a ]\n\nsyzkaller found a way to trigger double frees from ip_mc_drop_socket()\n\nIt turns out that leave a copy of parent mc_list at accept() time,\nwhich is very bad.\n\nVery similar to commit 8b485ce69876 (\"tcp: do not inherit\nfastopen_req from parent\")\n\nInitial report from Pray3r, completed by Andrey one.\nThanks a lot to them !\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Pray3r <pray3r.z@gmail.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/5f67a1663c03a73962fb240cf821338f78981a23"},{"sha":"d1428ee5407396185aab56ca62d49e89726455e0","author":{"name":"WANG Cong","email":"3f5d79d28d6d48052800caba9df0b30e06fefe41@gmail.com"},"message":"ipv6/dccp: do not inherit ipv6_mc_list from parent\n\n\n[ Upstream commit 83eaddab4378db256d00d295bda6ca997cd13a52 ]\n\nLike commit 657831ffc38e (\"dccp/tcp: do not inherit mc_list from parent\")\nwe should clear ipv6_mc_list etc. for IPv6 sockets too.\n\nCc: Eric Dumazet <edumazet@google.com>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/d1428ee5407396185aab56ca62d49e89726455e0"},{"sha":"2ac37098ee3db7777ff61cc5a92487cdb6e642d0","author":{"name":"Ursula Braun","email":"bb80a5b71d7ccb33e0f48503af4b98b8a157f79b@linux.vnet.ibm.com"},"message":"s390/qeth: handle sysfs error during initialization\n\n\n[ Upstream commit 9111e7880ccf419548c7b0887df020b08eadb075 ]\n\nWhen setting up the device from within the layer discipline's\nprobe routine, creating the layer-specific sysfs attributes can fail.\nReport this error back to the caller, and handle it by\nreleasing the layer discipline.\n\nSigned-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com>\n[jwi: updated commit msg, moved an OSN change to a subsequent patch]\nSigned-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/2ac37098ee3db7777ff61cc5a92487cdb6e642d0"},{"sha":"21b871582375ed711311fbfae37db91f789ac10a","author":{"name":"Julian Wiedmann","email":"174a9fc5b810c717cf9467d55c8d87e214886168@linux.vnet.ibm.com"},"message":"s390/qeth: unbreak OSM and OSN support\n\n\n[ Upstream commit 2d2ebb3ed0c6acfb014f98e427298673a5d07b82 ]\n\ncommit b4d72c08b358 (\"qeth: bridgeport support - basic control\")\nbroke the support for OSM and OSN devices as follows:\n\nAs OSM and OSN are L2 only, qeth_core_probe_device() does an early\nsetup by loading the l2 discipline and calling qeth_l2_probe_device().\nIn this context, adding the l2-specific bridgeport sysfs attributes\nvia qeth_l2_create_device_attributes() hits a BUG_ON in fs/sysfs/group.c,\nsince the basic sysfs infrastructure for the device hasn't been\nestablished yet.\n\nNote that OSN actually has its own unique sysfs attributes\n(qeth_osn_devtype), so the additional attributes shouldn't be created\nat all.\nFor OSM, add a new qeth_l2_devtype that contains all the common\nand l2-specific sysfs attributes.\nWhen qeth_core_probe_device() does early setup for OSM or OSN, assign\nthe corresponding devtype so that the ccwgroup probe code creates the\nfull set of sysfs attributes.\nThis allows us to skip qeth_l2_create_device_attributes() in case\nof an early setup.\n\nAny device that can't do early setup will initially have only the\ngeneric sysfs attributes, and when it's probed later\nqeth_l2_probe_device() adds the l2-specific attributes.\n\nIf an early-setup device is removed (by calling ccwgroup_ungroup()),\ndevice_unregister() will - using the devtype - delete the\nl2-specific attributes before qeth_l2_remove_device() is called.\nSo make sure to not remove them twice.\n\nWhat complicates the issue is that qeth_l2_probe_device() and\nqeth_l2_remove_device() is also called on a device when its\nlayer2 attribute changes (ie. its layer mode is switched).\nFor early-setup devices this wouldn't work properly - we wouldn't\nremove the l2-specific attributes when switching to L3.\nBut switching the layer mode doesn't actually make any sense;\nwe already decided that the device can only operate in L2!\nSo just refuse to switch the layer mode on such devices. Note that\nOSN doesn't have a layer2 attribute, so we only need to special-case\nOSM.\n\nBased on an initial patch by Ursula Braun.\n\nFixes: b4d72c08b358 (\"qeth: bridgeport support - basic control\")\nSigned-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/21b871582375ed711311fbfae37db91f789ac10a"},{"sha":"182abc4e74a1599cc35be6acb3e70fe89823a94b","author":{"name":"Julian Wiedmann","email":"174a9fc5b810c717cf9467d55c8d87e214886168@linux.vnet.ibm.com"},"message":"s390/qeth: avoid null pointer dereference on OSN\n\n\n[ Upstream commit 25e2c341e7818a394da9abc403716278ee646014 ]\n\nAccess card->dev only after checking whether's its valid.\n\nSigned-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>\nReviewed-by: Ursula Braun <ubraun@linux.vnet.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/182abc4e74a1599cc35be6acb3e70fe89823a94b"},{"sha":"90e3f8a5587147f088df361bee984b524b7c0ac1","author":{"name":"Yuchung Cheng","email":"e9603dd2756952b85012eef69eadebbcaf13f45b@google.com"},"message":"tcp: avoid fragmenting peculiar skbs in SACK\n\n\n[ Upstream commit b451e5d24ba6687c6f0e7319c727a709a1846c06 ]\n\nThis patch fixes a bug in splitting an SKB during SACK\nprocessing. Specifically if an skb contains multiple\npackets and is only partially sacked in the higher sequences,\ntcp_match_sack_to_skb() splits the skb and marks the second fragment\nas SACKed.\n\nThe current code further attempts rounding up the first fragment\nto MSS boundaries. But it misses a boundary condition when the\nrounded-up fragment size (pkt_len) is exactly skb size.  Spliting\nsuch an skb is pointless and causses a kernel warning and aborts\nthe SACK processing. This patch universally checks such over-split\nbefore calling tcp_fragment to prevent these unnecessary warnings.\n\nFixes: adb92db857ee (\"tcp: Make SACK code to split only at mss boundaries\")\nSigned-off-by: Yuchung Cheng <ycheng@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: Soheil Hassas Yeganeh <soheil@google.com>\nAcked-by: Neal Cardwell <ncardwell@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/90e3f8a5587147f088df361bee984b524b7c0ac1"},{"sha":"704e6c6b865113c859e5ce3e1f42cec7b1551b79","author":{"name":"Xin Long","email":"0c651f6709819e543c4ca1708bc1021b57131127@gmail.com"},"message":"sctp: fix src address selection if using secondary addresses for ipv6\n\n\n[ Upstream commit dbc2b5e9a09e9a6664679a667ff81cff6e5f2641 ]\n\nCommit 0ca50d12fe46 (\"sctp: fix src address selection if using secondary\naddresses\") has fixed a src address selection issue when using secondary\naddresses for ipv4.\n\nNow sctp ipv6 also has the similar issue. When using a secondary address,\nsctp_v6_get_dst tries to choose the saddr which has the most same bits\nwith the daddr by sctp_v6_addr_match_len. It may make some cases not work\nas expected.\n\nhostA:\n  [1] fd21:356b:459a:cf10::11 (eth1)\n  [2] fd21:356b:459a:cf20::11 (eth2)\n\nhostB:\n  [a] fd21:356b:459a:cf30::2  (eth1)\n  [b] fd21:356b:459a:cf40::2  (eth2)\n\nroute from hostA to hostB:\n  fd21:356b:459a:cf30::/64 dev eth1  metric 1024  mtu 1500\n\nThe expected path should be:\n  fd21:356b:459a:cf10::11 <-> fd21:356b:459a:cf30::2\nBut addr[2] matches addr[a] more bits than addr[1] does, according to\nsctp_v6_addr_match_len. It causes the path to be:\n  fd21:356b:459a:cf20::11 <-> fd21:356b:459a:cf30::2\n\nThis patch is to fix it with the same way as Marcelo's fix for sctp ipv4.\nAs no ip_dev_find for ipv6, this patch is to use ipv6_chk_addr to check\nif the saddr is in a dev instead.\n\nNote that for backwards compatibility, it will still do the addr_match_len\ncheck here when no optimal is found.\n\nReported-by: Patrick Talbert <ptalbert@redhat.com>\nSigned-off-by: Xin Long <lucien.xin@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/704e6c6b865113c859e5ce3e1f42cec7b1551b79"},{"sha":"ffa551def59c9b0e1747955af6a742443ae152fc","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"sctp: do not inherit ipv6_{mc|ac|fl}_list from parent\n\n\n[ Upstream commit fdcee2cbb8438702ea1b328fb6e0ac5e9a40c7f8 ]\n\nSCTP needs fixes similar to 83eaddab4378 (\"ipv6/dccp: do not inherit\nipv6_mc_list from parent\"), otherwise bad things can happen.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/ffa551def59c9b0e1747955af6a742443ae152fc"},{"sha":"7ede5c90fcdd6d33b3507203e3b8e57b025f34b2","author":{"name":"Soheil Hassas Yeganeh","email":"920eeabab42d22e09c9b529ec000cdb22f8b4e6f@google.com"},"message":"tcp: eliminate negative reordering in tcp_clean_rtx_queue\n\n\n[ Upstream commit bafbb9c73241760023d8981191ddd30bb1c6dbac ]\n\ntcp_ack() can call tcp_fragment() which may dededuct the\nvalue tp->fackets_out when MSS changes. When prior_fackets\nis larger than tp->fackets_out, tcp_clean_rtx_queue() can\ninvoke tcp_update_reordering() with negative values. This\nresults in absurd tp->reodering values higher than\nsysctl_tcp_max_reordering.\n\nNote that tcp_update_reordering indeeds sets tp->reordering\nto min(sysctl_tcp_max_reordering, metric), but because\nthe comparison is signed, a negative metric always wins.\n\nFixes: c7caf8d3ed7a (\"[TCP]: Fix reord detection due to snd_una covered holes\")\nReported-by: Rebecca Isaacs <risaacs@google.com>\nSigned-off-by: Soheil Hassas Yeganeh <soheil@google.com>\nSigned-off-by: Neal Cardwell <ncardwell@google.com>\nSigned-off-by: Yuchung Cheng <ycheng@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/7ede5c90fcdd6d33b3507203e3b8e57b025f34b2"},{"sha":"640bfcf232a93bdd446552f5417c52a0ad300e8b","author":{"name":"David Ahern","email":"e0d419a0ba2bdeef0ad5e59f7813befeb3252a55@gmail.com"},"message":"net: Improve handling of failures on link and route dumps\n\n\n[ Upstream commit f6c5775ff0bfa62b072face6bf1d40f659f194b2 ]\n\nIn general, rtnetlink dumps do not anticipate failure to dump a single\nobject (e.g., link or route) on a single pass. As both route and link\nobjects have grown via more attributes, that is no longer a given.\n\nnetlink dumps can handle a failure if the dump function returns an\nerror; specifically, netlink_dump adds the return code to the response\nif it is <= 0 so userspace is notified of the failure. The missing\npiece is the rtnetlink dump functions returning the error.\n\nFix route and link dump functions to return the errors if no object is\nadded to an skb (detected by skb->len != 0). IPv6 route dumps\n(rt6_dump_route) already return the error; this patch updates IPv4 and\nlink dumps. Other dump functions may need to be ajusted as well.\n\nReported-by: Jan Moskyto Matejka <mq@ucw.cz>\nSigned-off-by: David Ahern <dsahern@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/640bfcf232a93bdd446552f5417c52a0ad300e8b"},{"sha":"017fabead5c2aacb36df910bbfbfb1e813517ae3","author":{"name":"Craig Gallek","email":"c6e2ad0efde8bc3e999e384eb1af5b8a235c7f1f@google.com"},"message":"ipv6: Prevent overrun when parsing v6 header options\n\n\n[ Upstream commit 2423496af35d94a87156b063ea5cedffc10a70a1 ]\n\nThe KASAN warning repoted below was discovered with a syzkaller\nprogram.  The reproducer is basically:\n  int s = socket(AF_INET6, SOCK_RAW, NEXTHDR_HOP);\n  send(s, &one_byte_of_data, 1, MSG_MORE);\n  send(s, &more_than_mtu_bytes_data, 2000, 0);\n\nThe socket() call sets the nexthdr field of the v6 header to\nNEXTHDR_HOP, the first send call primes the payload with a non zero\nbyte of data, and the second send call triggers the fragmentation path.\n\nThe fragmentation code tries to parse the header options in order\nto figure out where to insert the fragment option.  Since nexthdr points\nto an invalid option, the calculation of the size of the network header\ncan made to be much larger than the linear section of the skb and data\nis read outside of it.\n\nThis fix makes ip6_find_1stfrag return an error if it detects\nrunning out-of-bounds.\n\n[   42.361487] ==================================================================\n[   42.364412] BUG: KASAN: slab-out-of-bounds in ip6_fragment+0x11c8/0x3730\n[   42.365471] Read of size 840 at addr ffff88000969e798 by task ip6_fragment-oo/3789\n[   42.366469]\n[   42.366696] CPU: 1 PID: 3789 Comm: ip6_fragment-oo Not tainted 4.11.0+ #41\n[   42.367628] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.1-1ubuntu1 04/01/2014\n[   42.368824] Call Trace:\n[   42.369183]  dump_stack+0xb3/0x10b\n[   42.369664]  print_address_description+0x73/0x290\n[   42.370325]  kasan_report+0x252/0x370\n[   42.370839]  ? ip6_fragment+0x11c8/0x3730\n[   42.371396]  check_memory_region+0x13c/0x1a0\n[   42.371978]  memcpy+0x23/0x50\n[   42.372395]  ip6_fragment+0x11c8/0x3730\n[   42.372920]  ? nf_ct_expect_unregister_notifier+0x110/0x110\n[   42.373681]  ? ip6_copy_metadata+0x7f0/0x7f0\n[   42.374263]  ? ip6_forward+0x2e30/0x2e30\n[   42.374803]  ip6_finish_output+0x584/0x990\n[   42.375350]  ip6_output+0x1b7/0x690\n[   42.375836]  ? ip6_finish_output+0x990/0x990\n[   42.376411]  ? ip6_fragment+0x3730/0x3730\n[   42.376968]  ip6_local_out+0x95/0x160\n[   42.377471]  ip6_send_skb+0xa1/0x330\n[   42.377969]  ip6_push_pending_frames+0xb3/0xe0\n[   42.378589]  rawv6_sendmsg+0x2051/0x2db0\n[   42.379129]  ? rawv6_bind+0x8b0/0x8b0\n[   42.379633]  ? _copy_from_user+0x84/0xe0\n[   42.380193]  ? debug_check_no_locks_freed+0x290/0x290\n[   42.380878]  ? ___sys_sendmsg+0x162/0x930\n[   42.381427]  ? rcu_read_lock_sched_held+0xa3/0x120\n[   42.382074]  ? sock_has_perm+0x1f6/0x290\n[   42.382614]  ? ___sys_sendmsg+0x167/0x930\n[   42.383173]  ? lock_downgrade+0x660/0x660\n[   42.383727]  inet_sendmsg+0x123/0x500\n[   42.384226]  ? inet_sendmsg+0x123/0x500\n[   42.384748]  ? inet_recvmsg+0x540/0x540\n[   42.385263]  sock_sendmsg+0xca/0x110\n[   42.385758]  SYSC_sendto+0x217/0x380\n[   42.386249]  ? SYSC_connect+0x310/0x310\n[   42.386783]  ? __might_fault+0x110/0x1d0\n[   42.387324]  ? lock_downgrade+0x660/0x660\n[   42.387880]  ? __fget_light+0xa1/0x1f0\n[   42.388403]  ? __fdget+0x18/0x20\n[   42.388851]  ? sock_common_setsockopt+0x95/0xd0\n[   42.389472]  ? SyS_setsockopt+0x17f/0x260\n[   42.390021]  ? entry_SYSCALL_64_fastpath+0x5/0xbe\n[   42.390650]  SyS_sendto+0x40/0x50\n[   42.391103]  entry_SYSCALL_64_fastpath+0x1f/0xbe\n[   42.391731] RIP: 0033:0x7fbbb711e383\n[   42.392217] RSP: 002b:00007ffff4d34f28 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\n[   42.393235] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbbb711e383\n[   42.394195] RDX: 0000000000001000 RSI: 00007ffff4d34f60 RDI: 0000000000000003\n[   42.395145] RBP: 0000000000000046 R08: 00007ffff4d34f40 R09: 0000000000000018\n[   42.396056] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000400aad\n[   42.396598] R13: 0000000000000066 R14: 00007ffff4d34ee0 R15: 00007fbbb717af00\n[   42.397257]\n[   42.397411] Allocated by task 3789:\n[   42.397702]  save_stack_trace+0x16/0x20\n[   42.398005]  save_stack+0x46/0xd0\n[   42.398267]  kasan_kmalloc+0xad/0xe0\n[   42.398548]  kasan_slab_alloc+0x12/0x20\n[   42.398848]  __kmalloc_node_track_caller+0xcb/0x380\n[   42.399224]  __kmalloc_reserve.isra.32+0x41/0xe0\n[   42.399654]  __alloc_skb+0xf8/0x580\n[   42.400003]  sock_wmalloc+0xab/0xf0\n[   42.400346]  __ip6_append_data.isra.41+0x2472/0x33d0\n[   42.400813]  ip6_append_data+0x1a8/0x2f0\n[   42.401122]  rawv6_sendmsg+0x11ee/0x2db0\n[   42.401505]  inet_sendmsg+0x123/0x500\n[   42.401860]  sock_sendmsg+0xca/0x110\n[   42.402209]  ___sys_sendmsg+0x7cb/0x930\n[   42.402582]  __sys_sendmsg+0xd9/0x190\n[   42.402941]  SyS_sendmsg+0x2d/0x50\n[   42.403273]  entry_SYSCALL_64_fastpath+0x1f/0xbe\n[   42.403718]\n[   42.403871] Freed by task 1794:\n[   42.404146]  save_stack_trace+0x16/0x20\n[   42.404515]  save_stack+0x46/0xd0\n[   42.404827]  kasan_slab_free+0x72/0xc0\n[   42.405167]  kfree+0xe8/0x2b0\n[   42.405462]  skb_free_head+0x74/0xb0\n[   42.405806]  skb_release_data+0x30e/0x3a0\n[   42.406198]  skb_release_all+0x4a/0x60\n[   42.406563]  consume_skb+0x113/0x2e0\n[   42.406910]  skb_free_datagram+0x1a/0xe0\n[   42.407288]  netlink_recvmsg+0x60d/0xe40\n[   42.407667]  sock_recvmsg+0xd7/0x110\n[   42.408022]  ___sys_recvmsg+0x25c/0x580\n[   42.408395]  __sys_recvmsg+0xd6/0x190\n[   42.408753]  SyS_recvmsg+0x2d/0x50\n[   42.409086]  entry_SYSCALL_64_fastpath+0x1f/0xbe\n[   42.409513]\n[   42.409665] The buggy address belongs to the object at ffff88000969e780\n[   42.409665]  which belongs to the cache kmalloc-512 of size 512\n[   42.410846] The buggy address is located 24 bytes inside of\n[   42.410846]  512-byte region [ffff88000969e780, ffff88000969e980)\n[   42.411941] The buggy address belongs to the page:\n[   42.412405] page:ffffea000025a780 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0\n[   42.413298] flags: 0x100000000008100(slab|head)\n[   42.413729] raw: 0100000000008100 0000000000000000 0000000000000000 00000001800c000c\n[   42.414387] raw: ffffea00002a9500 0000000900000007 ffff88000c401280 0000000000000000\n[   42.415074] page dumped because: kasan: bad access detected\n[   42.415604]\n[   42.415757] Memory state around the buggy address:\n[   42.416222]  ffff88000969e880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[   42.416904]  ffff88000969e900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[   42.417591] >ffff88000969e980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[   42.418273]                    ^\n[   42.418588]  ffff88000969ea00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n[   42.419273]  ffff88000969ea80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n[   42.419882] ==================================================================\n\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: Craig Gallek <kraig@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/017fabead5c2aacb36df910bbfbfb1e813517ae3"},{"sha":"f76d54a8882ed61d4686707fff58a84a1664860c","author":{"name":"David S. Miller","email":"79caf591e37e1438a2d55ae59670d5cd0d717764@davemloft.net"},"message":"ipv6: Check ip6_find_1stfragopt() return value properly.\n\n\n[ Upstream commit 7dd7eb9513bd02184d45f000ab69d78cb1fa1531 ]\n\nDo not use unsigned variables to see if it returns a negative\nerror or not.\n\nFixes: 2423496af35d (\"ipv6: Prevent overrun when parsing v6 header options\")\nReported-by: Julia Lawall <julia.lawall@lip6.fr>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/f76d54a8882ed61d4686707fff58a84a1664860c"},{"sha":"94c0bf3cbb9969ee79c758e4664be0e2a3ecf937","author":{"name":"Tobias Jungel","email":"f36ef5bc5639e5b8f02c9c57566e4b5d9efe6f21@bisdn.de"},"message":"bridge: netlink: check vlan_default_pvid range\n\n\n[ Upstream commit a285860211bf257b0e6d522dac6006794be348af ]\n\nCurrently it is allowed to set the default pvid of a bridge to a value\nabove VLAN_VID_MASK (0xfff). This patch adds a check to br_validate and\nreturns -EINVAL in case the pvid is out of bounds.\n\nReproduce by calling:\n\n[root@test ~]# ip l a type bridge\n[root@test ~]# ip l a type dummy\n[root@test ~]# ip l s bridge0 type bridge vlan_filtering 1\n[root@test ~]# ip l s bridge0 type bridge vlan_default_pvid 9999\n[root@test ~]# ip l s dummy0 master bridge0\n[root@test ~]# bridge vlan\nport\tvlan ids\nbridge0\t 9999 PVID Egress Untagged\n\ndummy0\t 9999 PVID Egress Untagged\n\nFixes: 0f963b7592ef (\"bridge: netlink: add support for default_pvid\")\nAcked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>\nSigned-off-by: Tobias Jungel <tobias.jungel@bisdn.de>\nAcked-by: Sabrina Dubroca <sd@queasysnail.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/94c0bf3cbb9969ee79c758e4664be0e2a3ecf937"},{"sha":"b543ccc4f627cea5d9aee6009aca39f3e2d4822e","author":{"name":"Bjørn Mork","email":"73004647096653cb035375f893ae959ac7bd4f38@mork.no"},"message":"qmi_wwan: add another Lenovo EM74xx device ID\n\n\n[ Upstream commit 486181bcb3248e2f1977f4e69387a898234a4e1e ]\n\nIn their infinite wisdom, and never ending quest for end user frustration,\nLenovo has decided to use a new USB device ID for the wwan modules in\ntheir 2017 laptops.  The actual hardware is still the Sierra Wireless\nEM7455 or EM7430, depending on region.\n\nSigned-off-by: Bjørn Mork <bjorn@mork.no>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/b543ccc4f627cea5d9aee6009aca39f3e2d4822e"},{"sha":"3a854210f9a555681eef4480ef2400922b31ca2b","author":{"name":"Xin Long","email":"0c651f6709819e543c4ca1708bc1021b57131127@gmail.com"},"message":"bridge: start hello_timer when enabling KERNEL_STP in br_stp_start\n\n\n[ Upstream commit 6d18c732b95c0a9d35e9f978b4438bba15412284 ]\n\nSince commit 76b91c32dd86 (\"bridge: stp: when using userspace stp stop\nkernel hello and hold timers\"), bridge would not start hello_timer if\nstp_enabled is not KERNEL_STP when br_dev_open.\n\nThe problem is even if users set stp_enabled with KERNEL_STP later,\nthe timer will still not be started. It causes that KERNEL_STP can\nnot really work. Users have to re-ifup the bridge to avoid this.\n\nThis patch is to fix it by starting br->hello_timer when enabling\nKERNEL_STP in br_stp_start.\n\nAs an improvement, it's also to start hello_timer again only when\nbr->stp_enabled is KERNEL_STP in br_hello_timer_expired, there is\nno reason to start the timer again when it's NO_STP.\n\nFixes: 76b91c32dd86 (\"bridge: stp: when using userspace stp stop kernel hello and hold timers\")\nReported-by: Haidong Li <haili@redhat.com>\nSigned-off-by: Xin Long <lucien.xin@gmail.com>\nAcked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>\nReviewed-by: Ivan Vecera <cera@cera.cz>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/3a854210f9a555681eef4480ef2400922b31ca2b"},{"sha":"38f02f2ce0ca58c45d95567a5d64f7dc90aa9c95","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"ipv6: fix out of bound writes in __ip6_append_data()\n\n\n[ Upstream commit 232cd35d0804cc241eb887bb8d4d9b3b9881c64a ]\n\nAndrey Konovalov and idaifish@gmail.com reported crashes caused by\none skb shared_info being overwritten from __ip6_append_data()\n\nAndrey program lead to following state :\n\ncopy -4200 datalen 2000 fraglen 2040\nmaxfraglen 2040 alloclen 2048 transhdrlen 0 offset 0 fraggap 6200\n\nThe skb_copy_and_csum_bits(skb_prev, maxfraglen, data + transhdrlen,\nfraggap, 0); is overwriting skb->head and skb_shared_info\n\nSince we apparently detect this rare condition too late, move the\ncode earlier to even avoid allocating skb and risking crashes.\n\nOnce again, many thanks to Andrey and syzkaller team.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nReported-by: <idaifish@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/38f02f2ce0ca58c45d95567a5d64f7dc90aa9c95"},{"sha":"8380f16d0702817d2b5070d82972db03d2462e50","author":{"name":"Vlad Yasevich","email":"b995673e4f0a2a11d67148b25b1eb25e3a163d93@gmail.com"},"message":"be2net: Fix offload features for Q-in-Q packets\n\n\n[ Upstream commit cc6e9de62a7f84c9293a2ea41bc412b55bb46e85 ]\n\nAt least some of the be2net cards do not seem to be capabled\nof performing checksum offload computions on Q-in-Q packets.\nIn these case, the recevied checksum on the remote is invalid\nand TCP syn packets are dropped.\n\nThis patch adds a call to check disbled acceleration features\non Q-in-Q tagged traffic.\n\nCC: Sathya Perla <sathya.perla@broadcom.com>\nCC: Ajit Khaparde <ajit.khaparde@broadcom.com>\nCC: Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com>\nCC: Somnath Kotur <somnath.kotur@broadcom.com>\nSigned-off-by: Vladislav Yasevich <vyasevic@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/8380f16d0702817d2b5070d82972db03d2462e50"},{"sha":"d7ed7fcecf2082f44ac6b1e7b69055a0e713af03","author":{"name":"Vlad Yasevich","email":"b995673e4f0a2a11d67148b25b1eb25e3a163d93@gmail.com"},"message":"virtio-net: enable TSO/checksum offloads for Q-in-Q vlans\n\n\n[ Upstream commit 2836b4f224d4fd7d1a2b23c3eecaf0f0ae199a74 ]\n\nSince virtio does not provide it's own ndo_features_check handler,\nTSO, and now checksum offload, are disabled for stacked vlans.\nRe-enable the support and let the host take care of it.  This\nrestores/improves Guest-to-Guest performance over Q-in-Q vlans.\n\nAcked-by: Jason Wang <jasowang@redhat.com>\nAcked-by: Michael S. Tsirkin <mst@redhat.com>\nSigned-off-by: Vladislav Yasevich <vyasevic@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/d7ed7fcecf2082f44ac6b1e7b69055a0e713af03"},{"sha":"fe22b6005538095f6e95e5152a99fc59e9ad198c","author":{"name":"Wei Wang","email":"f5e441d9376675c1080c91dfcb46bb84ae267df0@google.com"},"message":"tcp: avoid fastopen API to be used on AF_UNSPEC\n\n\n[ Upstream commit ba615f675281d76fd19aa03558777f81fb6b6084 ]\n\nFastopen API should be used to perform fastopen operations on the TCP\nsocket. It does not make sense to use fastopen API to perform disconnect\nby calling it with AF_UNSPEC. The fastopen data path is also prone to\nrace conditions and bugs when using with AF_UNSPEC.\n\nOne issue reported and analyzed by Vegard Nossum is as follows:\n+++++++++++++++++++++++++++++++++++++++++++++++++++++++++\nThread A:                            Thread B:\n------------------------------------------------------------------------\nsendto()\n - tcp_sendmsg()\n     - sk_stream_memory_free() = 0\n         - goto wait_for_sndbuf\n\t     - sk_stream_wait_memory()\n\t        - sk_wait_event() // sleep\n          |                          sendto(flags=MSG_FASTOPEN, dest_addr=AF_UNSPEC)\n\t  |                           - tcp_sendmsg()\n\t  |                              - tcp_sendmsg_fastopen()\n\t  |                                 - __inet_stream_connect()\n\t  |                                    - tcp_disconnect() //because of AF_UNSPEC\n\t  |                                       - tcp_transmit_skb()// send RST\n\t  |                                    - return 0; // no reconnect!\n\t  |                           - sk_stream_wait_connect()\n\t  |                                 - sock_error()\n\t  |                                    - xchg(&sk->sk_err, 0)\n\t  |                                    - return -ECONNRESET\n\t- ... // wake up, see sk->sk_err == 0\n    - skb_entail() on TCP_CLOSE socket\n\nIf the connection is reopened then we will send a brand new SYN packet\nafter thread A has already queued a buffer. At this point I think the\nsocket internal state (sequence numbers etc.) becomes messed up.\n\nWhen the new connection is closed, the FIN-ACK is rejected because the\nsequence number is outside the window. The other side tries to\nretransmit,\nbut __tcp_retransmit_skb() calls tcp_trim_head() on an empty skb which\ncorrupts the skb data length and hits a BUG() in copy_and_csum_bits().\n+++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n\nHence, this patch adds a check for AF_UNSPEC in the fastopen data path\nand return EOPNOTSUPP to user if such case happens.\n\nFixes: cf60af03ca4e7 (\"tcp: Fast Open client - sendmsg(MSG_FASTOPEN)\")\nReported-by: Vegard Nossum <vegard.nossum@oracle.com>\nSigned-off-by: Wei Wang <weiwan@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/codeaurora-unofficial/kernel-msm-3.10/commits/fe22b6005538095f6e95e5152a99fc59e9ad198c"}]}
{"actor":{"display_login":"Mazda--"}}