{"push_id":1789130801,"size":116,"distinct_size":1,"ref":"refs/heads/4.11/master","head":"f42f224622b8ce6fa5844e568861610ecb078b88","before":"5ed4cc0cdf80f0f09fbfbf6b49a93ae3c4877822","commits":[{"sha":"db8ebc6da8cfd1057dc94e69fbd7a8c5ff34cef6","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"dccp/tcp: do not inherit mc_list from parent\n\n\n[ Upstream commit 657831ffc38e30092a2d5f03d385d710eb88b09a ]\n\nsyzkaller found a way to trigger double frees from ip_mc_drop_socket()\n\nIt turns out that leave a copy of parent mc_list at accept() time,\nwhich is very bad.\n\nVery similar to commit 8b485ce69876 (\"tcp: do not inherit\nfastopen_req from parent\")\n\nInitial report from Pray3r, completed by Andrey one.\nThanks a lot to them !\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Pray3r <pray3r.z@gmail.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/db8ebc6da8cfd1057dc94e69fbd7a8c5ff34cef6"},{"sha":"03a275f5aa819b8824a94572ac1c18cf69cae3ca","author":{"name":"Gao Feng","email":"28258e26ac94dc167005a458bb1495218312fd29@vip.163.com"},"message":"driver: vrf: Fix one possible use-after-free issue\n\n\n[ Upstream commit 1a4a5bf52a4adb477adb075e5afce925824ad132 ]\n\nThe current codes only deal with the case that the skb is dropped, it\nmay meet one use-after-free issue when NF_HOOK returns 0 that means\nthe skb is stolen by one netfilter rule or hook.\n\nWhen one netfilter rule or hook stoles the skb and return NF_STOLEN,\nit means the skb is taken by the rule, and other modules should not\ntouch this skb ever. Maybe the skb is queued or freed directly by the\nrule.\n\nNow uses the nf_hook instead of NF_HOOK to get the result of netfilter,\nand check the return value of nf_hook. Only when its value equals 1, it\nmeans the skb could go ahead. Or reset the skb as NULL.\n\nBTW, because vrf_rcv_finish is empty function, so needn't invoke it\neven though nf_hook returns 1. But we need to modify vrf_rcv_finish\nto deal with the NF_STOLEN case.\n\nThere are two cases when skb is stolen.\n1. The skb is stolen and freed directly.\n   There is nothing we need to do, and vrf_rcv_finish isn't invoked.\n2. The skb is queued and reinjected again.\n   The vrf_rcv_finish would be invoked as okfn, so need to free the\n   skb in it.\n\nSigned-off-by: Gao Feng <gfree.wind@vip.163.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/03a275f5aa819b8824a94572ac1c18cf69cae3ca"},{"sha":"8e929937f8813fb209a2d733ee1367db80b6f622","author":{"name":"WANG Cong","email":"3f5d79d28d6d48052800caba9df0b30e06fefe41@gmail.com"},"message":"ipv6/dccp: do not inherit ipv6_mc_list from parent\n\n\n[ Upstream commit 83eaddab4378db256d00d295bda6ca997cd13a52 ]\n\nLike commit 657831ffc38e (\"dccp/tcp: do not inherit mc_list from parent\")\nwe should clear ipv6_mc_list etc. for IPv6 sockets too.\n\nCc: Eric Dumazet <edumazet@google.com>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/8e929937f8813fb209a2d733ee1367db80b6f622"},{"sha":"41b81ff056a486cfc4ff9abc10085a17917dd102","author":{"name":"Ursula Braun","email":"bb80a5b71d7ccb33e0f48503af4b98b8a157f79b@linux.vnet.ibm.com"},"message":"s390/qeth: handle sysfs error during initialization\n\n\n[ Upstream commit 9111e7880ccf419548c7b0887df020b08eadb075 ]\n\nWhen setting up the device from within the layer discipline's\nprobe routine, creating the layer-specific sysfs attributes can fail.\nReport this error back to the caller, and handle it by\nreleasing the layer discipline.\n\nSigned-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com>\n[jwi: updated commit msg, moved an OSN change to a subsequent patch]\nSigned-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/41b81ff056a486cfc4ff9abc10085a17917dd102"},{"sha":"9b1042aa59c46a0cc8c5aceb5c8c4441e4e3b0f5","author":{"name":"Julian Wiedmann","email":"174a9fc5b810c717cf9467d55c8d87e214886168@linux.vnet.ibm.com"},"message":"s390/qeth: unbreak OSM and OSN support\n\n\n[ Upstream commit 2d2ebb3ed0c6acfb014f98e427298673a5d07b82 ]\n\ncommit b4d72c08b358 (\"qeth: bridgeport support - basic control\")\nbroke the support for OSM and OSN devices as follows:\n\nAs OSM and OSN are L2 only, qeth_core_probe_device() does an early\nsetup by loading the l2 discipline and calling qeth_l2_probe_device().\nIn this context, adding the l2-specific bridgeport sysfs attributes\nvia qeth_l2_create_device_attributes() hits a BUG_ON in fs/sysfs/group.c,\nsince the basic sysfs infrastructure for the device hasn't been\nestablished yet.\n\nNote that OSN actually has its own unique sysfs attributes\n(qeth_osn_devtype), so the additional attributes shouldn't be created\nat all.\nFor OSM, add a new qeth_l2_devtype that contains all the common\nand l2-specific sysfs attributes.\nWhen qeth_core_probe_device() does early setup for OSM or OSN, assign\nthe corresponding devtype so that the ccwgroup probe code creates the\nfull set of sysfs attributes.\nThis allows us to skip qeth_l2_create_device_attributes() in case\nof an early setup.\n\nAny device that can't do early setup will initially have only the\ngeneric sysfs attributes, and when it's probed later\nqeth_l2_probe_device() adds the l2-specific attributes.\n\nIf an early-setup device is removed (by calling ccwgroup_ungroup()),\ndevice_unregister() will - using the devtype - delete the\nl2-specific attributes before qeth_l2_remove_device() is called.\nSo make sure to not remove them twice.\n\nWhat complicates the issue is that qeth_l2_probe_device() and\nqeth_l2_remove_device() is also called on a device when its\nlayer2 attribute changes (ie. its layer mode is switched).\nFor early-setup devices this wouldn't work properly - we wouldn't\nremove the l2-specific attributes when switching to L3.\nBut switching the layer mode doesn't actually make any sense;\nwe already decided that the device can only operate in L2!\nSo just refuse to switch the layer mode on such devices. Note that\nOSN doesn't have a layer2 attribute, so we only need to special-case\nOSM.\n\nBased on an initial patch by Ursula Braun.\n\nFixes: b4d72c08b358 (\"qeth: bridgeport support - basic control\")\nSigned-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/9b1042aa59c46a0cc8c5aceb5c8c4441e4e3b0f5"},{"sha":"b8a9a79c8913046ff2477c948ee8e69648afe81d","author":{"name":"Julian Wiedmann","email":"174a9fc5b810c717cf9467d55c8d87e214886168@linux.vnet.ibm.com"},"message":"s390/qeth: avoid null pointer dereference on OSN\n\n\n[ Upstream commit 25e2c341e7818a394da9abc403716278ee646014 ]\n\nAccess card->dev only after checking whether's its valid.\n\nSigned-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>\nReviewed-by: Ursula Braun <ubraun@linux.vnet.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/b8a9a79c8913046ff2477c948ee8e69648afe81d"},{"sha":"617461cac6523a03fcac1d64962753d844dd23bb","author":{"name":"Ursula Braun","email":"bb80a5b71d7ccb33e0f48503af4b98b8a157f79b@linux.vnet.ibm.com"},"message":"s390/qeth: add missing hash table initializations\n\n\n[ Upstream commit ebccc7397e4a49ff64c8f44a54895de9d32fe742 ]\n\ncommit 5f78e29ceebf (\"qeth: optimize IP handling in rx_mode callback\")\nadded new hash tables, but missed to initialize them.\n\nFixes: 5f78e29ceebf (\"qeth: optimize IP handling in rx_mode callback\")\nSigned-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com>\nReviewed-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>\nSigned-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/617461cac6523a03fcac1d64962753d844dd23bb"},{"sha":"3bfb04d10247c111acee0ed785600a837afadf9d","author":{"name":"Daniel Borkmann","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@iogearbox.net"},"message":"bpf, arm64: fix faulty emission of map access in tail calls\n\n\n[ Upstream commit d8b54110ee944de522ccd3531191f39986ec20f9 ]\n\nShubham was recently asking on netdev why in arm64 JIT we don't multiply\nthe index for accessing the tail call map by 8. That led me into testing\nout arm64 JIT wrt tail calls and it turned out I got a NULL pointer\ndereference on the tail call.\n\nThe buggy access is at:\n\n  prog = array->ptrs[index];\n  if (prog == NULL)\n      goto out;\n\n  [...]\n  00000060:  d2800e0a  mov x10, #0x70 // #112\n  00000064:  f86a682a  ldr x10, [x1,x10]\n  00000068:  f862694b  ldr x11, [x10,x2]\n  0000006c:  b40000ab  cbz x11, 0x00000080\n  [...]\n\nThe code triggering the crash is f862694b. x1 at the time contains the\naddress of the bpf array, x10 offsetof(struct bpf_array, ptrs). Meaning,\nabove we load the pointer to the program at map slot 0 into x10. x10\ncan then be NULL if the slot is not occupied, which we later on try to\naccess with a user given offset in x2 that is the map index.\n\nFix this by emitting the following instead:\n\n  [...]\n  00000060:  d2800e0a  mov x10, #0x70 // #112\n  00000064:  8b0a002a  add x10, x1, x10\n  00000068:  d37df04b  lsl x11, x2, #3\n  0000006c:  f86b694b  ldr x11, [x10,x11]\n  00000070:  b40000ab  cbz x11, 0x00000084\n  [...]\n\nThis basically adds the offset to ptrs to the base address of the bpf\narray we got and we later on access the map with an index * 8 offset\nrelative to that. The tail call map itself is basically one large area\nwith meta data at the head followed by the array of prog pointers.\nThis makes tail calls working again, tested on Cavium ThunderX ARMv8.\n\nFixes: ddb55992b04d (\"arm64: bpf: implement bpf_tail_call() helper\")\nReported-by: Shubham Bansal <illusionist.neo@gmail.com>\nSigned-off-by: Daniel Borkmann <daniel@iogearbox.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/3bfb04d10247c111acee0ed785600a837afadf9d"},{"sha":"e13cb6c25b555f75cef9eb44d348b361da1291d5","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"netem: fix skb_orphan_partial()\n\n\n[ Upstream commit f6ba8d33cfbb46df569972e64dbb5bb7e929bfd9 ]\n\nI should have known that lowering skb->truesize was dangerous :/\n\nIn case packets are not leaving the host via a standard Ethernet device,\nbut looped back to local sockets, bad things can happen, as reported\nby Michael Madsen ( https://bugzilla.kernel.org/show_bug.cgi?id=195713 )\n\nSo instead of tweaking skb->truesize, lets change skb->destructor\nand keep a reference on the owner socket via its sk_refcnt.\n\nFixes: f2f872f9272a (\"netem: Introduce skb_orphan_partial() helper\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Michael Madsen <mkm@nabto.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/e13cb6c25b555f75cef9eb44d348b361da1291d5"},{"sha":"20d699e0ca98c9708aab910937c3f7235527036d","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"net: fix compile error in skb_orphan_partial()\n\n\n[ Upstream commit 9142e9007f2d7ab58a587a1e1d921b0064a339aa ]\n\nIf CONFIG_INET is not set, net/core/sock.c can not compile :\n\nnet/core/sock.c: In function ‘skb_orphan_partial’:\nnet/core/sock.c:1810:2: error: implicit declaration of function\n‘skb_is_tcp_pure_ack’ [-Werror=implicit-function-declaration]\n  if (skb_is_tcp_pure_ack(skb))\n  ^\n\nFix this by always including <net/tcp.h>\n\nFixes: f6ba8d33cfbb (\"netem: fix skb_orphan_partial()\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Paul Gortmaker <paul.gortmaker@windriver.com>\nReported-by: Randy Dunlap <rdunlap@infradead.org>\nReported-by: Stephen Rothwell <sfr@canb.auug.org.au>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/20d699e0ca98c9708aab910937c3f7235527036d"},{"sha":"c91cd74b32ecbfa1a796e9f789e229024f9902f1","author":{"name":"Yuchung Cheng","email":"e9603dd2756952b85012eef69eadebbcaf13f45b@google.com"},"message":"tcp: avoid fragmenting peculiar skbs in SACK\n\n\n[ Upstream commit b451e5d24ba6687c6f0e7319c727a709a1846c06 ]\n\nThis patch fixes a bug in splitting an SKB during SACK\nprocessing. Specifically if an skb contains multiple\npackets and is only partially sacked in the higher sequences,\ntcp_match_sack_to_skb() splits the skb and marks the second fragment\nas SACKed.\n\nThe current code further attempts rounding up the first fragment\nto MSS boundaries. But it misses a boundary condition when the\nrounded-up fragment size (pkt_len) is exactly skb size.  Spliting\nsuch an skb is pointless and causses a kernel warning and aborts\nthe SACK processing. This patch universally checks such over-split\nbefore calling tcp_fragment to prevent these unnecessary warnings.\n\nFixes: adb92db857ee (\"tcp: Make SACK code to split only at mss boundaries\")\nSigned-off-by: Yuchung Cheng <ycheng@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: Soheil Hassas Yeganeh <soheil@google.com>\nAcked-by: Neal Cardwell <ncardwell@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/c91cd74b32ecbfa1a796e9f789e229024f9902f1"},{"sha":"d9cb26d6a39f4d75dddf699033d5963b6633b98b","author":{"name":"Jon Paul Maloy","email":"b0012c6b16a2cc61cfde6c8e64b78c583cb9e8a8@ericsson.com"},"message":"tipc: make macro tipc_wait_for_cond() smp safe\n\n\n[ Upstream commit 844cf763fba654436d3a4279b6a672c196cf1901 ]\n\nThe macro tipc_wait_for_cond() is embedding the macro sk_wait_event()\nto fulfil its task. The latter, in turn, is evaluating the stated\ncondition outside the socket lock context. This is problematic if\nthe condition is accessing non-trivial data structures which may be\naltered by incoming interrupts, as is the case with the cong_links()\nlinked list, used by socket to keep track of the current set of\ncongested links. We sometimes see crashes when this list is accessed\nby a condition function at the same time as a SOCK_WAKEUP interrupt\nis removing an element from the list.\n\nWe fix this by expanding selected parts of sk_wait_event() into the\nouter macro, while ensuring that all evaluations of a given condition\nare performed under socket lock protection.\n\nFixes: commit 365ad353c256 (\"tipc: reduce risk of user starvation during link congestion\")\nReviewed-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>\nSigned-off-by: Jon Maloy <jon.maloy@ericsson.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/d9cb26d6a39f4d75dddf699033d5963b6633b98b"},{"sha":"dc9bf5513e0ffa01e5f0c7b8a183d24610e6cdaa","author":{"name":"Xin Long","email":"0c651f6709819e543c4ca1708bc1021b57131127@gmail.com"},"message":"sctp: fix src address selection if using secondary addresses for ipv6\n\n\n[ Upstream commit dbc2b5e9a09e9a6664679a667ff81cff6e5f2641 ]\n\nCommit 0ca50d12fe46 (\"sctp: fix src address selection if using secondary\naddresses\") has fixed a src address selection issue when using secondary\naddresses for ipv4.\n\nNow sctp ipv6 also has the similar issue. When using a secondary address,\nsctp_v6_get_dst tries to choose the saddr which has the most same bits\nwith the daddr by sctp_v6_addr_match_len. It may make some cases not work\nas expected.\n\nhostA:\n  [1] fd21:356b:459a:cf10::11 (eth1)\n  [2] fd21:356b:459a:cf20::11 (eth2)\n\nhostB:\n  [a] fd21:356b:459a:cf30::2  (eth1)\n  [b] fd21:356b:459a:cf40::2  (eth2)\n\nroute from hostA to hostB:\n  fd21:356b:459a:cf30::/64 dev eth1  metric 1024  mtu 1500\n\nThe expected path should be:\n  fd21:356b:459a:cf10::11 <-> fd21:356b:459a:cf30::2\nBut addr[2] matches addr[a] more bits than addr[1] does, according to\nsctp_v6_addr_match_len. It causes the path to be:\n  fd21:356b:459a:cf20::11 <-> fd21:356b:459a:cf30::2\n\nThis patch is to fix it with the same way as Marcelo's fix for sctp ipv4.\nAs no ip_dev_find for ipv6, this patch is to use ipv6_chk_addr to check\nif the saddr is in a dev instead.\n\nNote that for backwards compatibility, it will still do the addr_match_len\ncheck here when no optimal is found.\n\nReported-by: Patrick Talbert <ptalbert@redhat.com>\nSigned-off-by: Xin Long <lucien.xin@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/dc9bf5513e0ffa01e5f0c7b8a183d24610e6cdaa"},{"sha":"703a20827411c3906b644713bc4462d4b3fb6a5f","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"sctp: do not inherit ipv6_{mc|ac|fl}_list from parent\n\n\n[ Upstream commit fdcee2cbb8438702ea1b328fb6e0ac5e9a40c7f8 ]\n\nSCTP needs fixes similar to 83eaddab4378 (\"ipv6/dccp: do not inherit\nipv6_mc_list from parent\"), otherwise bad things can happen.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/703a20827411c3906b644713bc4462d4b3fb6a5f"},{"sha":"03c10a87f16fb27f65cb3eb54dc4a84753177720","author":{"name":"Douglas Caetano dos Santos","email":"377843afb517f10c5d64c4b70fd8588c69e7c258@taghos.com.br"},"message":"net/packet: fix missing net_device reference release\n\n\n[ Upstream commit d19b183cdc1fa3d70d6abe2a4c369e748cd7ebb8 ]\n\nWhen using a TX ring buffer, if an error occurs processing a control\nmessage (e.g. invalid message), the net_device reference is not\nreleased.\n\nFixes c14ac9451c348 (\"sock: enable timestamping using control messages\")\nSigned-off-by: Douglas Caetano dos Santos <douglascs@taghos.com.br>\nAcked-by: Soheil Hassas Yeganeh <soheil@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/03c10a87f16fb27f65cb3eb54dc4a84753177720"},{"sha":"c8a52aa79a4b44a50cf4f213f6dfe3e3cfda5368","author":{"name":"Gal Pressman","email":"9c475a168a78d08c8fde80de9ff848ff0c3cb70b@mellanox.com"},"message":"net/mlx5e: Use the correct pause values for ethtool advertising\n\n\n[ Upstream commit b383b544f2666d67446b951a9a97af239dafed5d ]\n\nQuery the operational pause from firmware (PFCC register) instead of\nalways passing zeros.\n\nFixes: 665bc53969d7 (\"net/mlx5e: Use new ethtool get/set link ksettings API\")\nSigned-off-by: Gal Pressman <galp@mellanox.com>\nCc: kernel-team@fb.com\nSigned-off-by: Saeed Mahameed <saeedm@mellanox.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/c8a52aa79a4b44a50cf4f213f6dfe3e3cfda5368"},{"sha":"cc1d2a620dd0aeb55e641f5a406bab631aa6842c","author":{"name":"Gal Pressman","email":"9c475a168a78d08c8fde80de9ff848ff0c3cb70b@mellanox.com"},"message":"net/mlx5e: Fix ethtool pause support and advertise reporting\n\n\n[ Upstream commit e3c19503712d6360239b19c14cded56dd63c40d7 ]\n\nPause bit should set when RX pause is on, not TX pause.\nAlso, setting Asym_Pause is incorrect, and should be turned off.\n\nFixes: 665bc53969d7 (\"net/mlx5e: Use new ethtool get/set link ksettings API\")\nSigned-off-by: Gal Pressman <galp@mellanox.com>\nCc: kernel-team@fb.com\nSigned-off-by: Saeed Mahameed <saeedm@mellanox.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/cc1d2a620dd0aeb55e641f5a406bab631aa6842c"},{"sha":"d6cb41cf3023ac2026f149ce77864ea49cbb470b","author":{"name":"Soheil Hassas Yeganeh","email":"920eeabab42d22e09c9b529ec000cdb22f8b4e6f@google.com"},"message":"tcp: eliminate negative reordering in tcp_clean_rtx_queue\n\n\n[ Upstream commit bafbb9c73241760023d8981191ddd30bb1c6dbac ]\n\ntcp_ack() can call tcp_fragment() which may dededuct the\nvalue tp->fackets_out when MSS changes. When prior_fackets\nis larger than tp->fackets_out, tcp_clean_rtx_queue() can\ninvoke tcp_update_reordering() with negative values. This\nresults in absurd tp->reodering values higher than\nsysctl_tcp_max_reordering.\n\nNote that tcp_update_reordering indeeds sets tp->reordering\nto min(sysctl_tcp_max_reordering, metric), but because\nthe comparison is signed, a negative metric always wins.\n\nFixes: c7caf8d3ed7a (\"[TCP]: Fix reord detection due to snd_una covered holes\")\nReported-by: Rebecca Isaacs <risaacs@google.com>\nSigned-off-by: Soheil Hassas Yeganeh <soheil@google.com>\nSigned-off-by: Neal Cardwell <ncardwell@google.com>\nSigned-off-by: Yuchung Cheng <ycheng@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/d6cb41cf3023ac2026f149ce77864ea49cbb470b"},{"sha":"516b3ed999efddfec7c49f06b9630ec55ebc9631","author":{"name":"Ursula Braun","email":"bb80a5b71d7ccb33e0f48503af4b98b8a157f79b@linux.vnet.ibm.com"},"message":"smc: switch to usage of IB_PD_UNSAFE_GLOBAL_RKEY\n\n\n[ Upstream commit 263eec9b2a82e8697d064709414914b5b10ac538 ]\n\nCurrently, SMC enables remote access to physical memory when a user\nhas successfully configured and established an SMC-connection until ten\nminutes after the last SMC connection is closed. Because this is considered\na security risk, drivers are supposed to use IB_PD_UNSAFE_GLOBAL_RKEY in\nsuch a case.\n\nThis patch changes the current SMC code to use IB_PD_UNSAFE_GLOBAL_RKEY.\nThis improves user awareness, but does not remove the security risk itself.\n\nSigned-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/516b3ed999efddfec7c49f06b9630ec55ebc9631"},{"sha":"a19f55f9bb374b24f3bca3bfd7e75752b9e6d372","author":{"name":"Christoph Hellwig","email":"ed9f47d6dfaca04b245b5f2816a0d3e9462a0b83@lst.de"},"message":"net/smc: Add warning about remote memory exposure\n\n\n[ Upstream commit 19a0f7e37c0761a0a1cbf550705a6063c9675223 ]\n\nThe driver explicitly bypasses APIs to register all memory once a\nconnection is made, and thus allows remote access to memory.\n\nSigned-off-by: Christoph Hellwig <hch@lst.de>\nSigned-off-by: Leon Romanovsky <leon@kernel.org>\nAcked-by: Ursula Braun <ubraun@linux.vnet.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/zen-kernel/zen-kernel/commits/a19f55f9bb374b24f3bca3bfd7e75752b9e6d372"}]}
{"actor":{"display_login":"heftig"}}