{"push_id":2059210560,"size":37,"distinct_size":37,"ref":"refs/heads/sagit-n-oss","head":"7954bf40e408a1fddc73bc10c43b6f2f9fceb20c","before":"157cf1e4d16698344324d125366196defbafc5f1","commits":[{"sha":"a748be62ffc48abcfab964d98a323386bff5103b","author":{"name":"Florian Westphal","email":"dbfaf6a80dfd937969ef4cfe4989863cfe354fce@strlen.de"},"message":"dctcp: avoid bogus doubling of cwnd after loss\n\n[ Upstream commit ce6dd23329b1ee6a794acf5f7e40f8e89b8317ee ]\n\nIf a congestion control module doesn't provide .undo_cwnd function,\ntcp_undo_cwnd_reduction() will set cwnd to\n\n   tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh << 1);\n\n... which makes sense for reno (it sets ssthresh to half the current cwnd),\nbut it makes no sense for dctcp, which sets ssthresh based on the current\ncongestion estimate.\n\nThis can cause severe growth of cwnd (eventually overflowing u32).\n\nFix this by saving last cwnd on loss and restore cwnd based on that,\nsimilar to cubic and other algorithms.\n\nFixes: e3118e8359bb7c (\"net: tcp: add DCTCP congestion control algorithm\")\nCc: Lawrence Brakmo <brakmo@fb.com>\nCc: Andrew Shewmaker <agshew@gmail.com>\nCc: Glenn Judd <glenn.judd@morganstanley.com>\nAcked-by: Daniel Borkmann <daniel@iogearbox.net>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/a748be62ffc48abcfab964d98a323386bff5103b"},{"sha":"485f3b39fe692ad1026963655dff519cce43d3ec","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"net: clear sk_err_soft in sk_clone_lock()\n\n[ Upstream commit e551c32d57c88923f99f8f010e89ca7ed0735e83 ]\n\nAt accept() time, it is possible the parent has a non zero\nsk_err_soft, leftover from a prior error.\n\nMake sure we do not leave this value in the child, as it\nmakes future getsockopt(SO_ERROR) calls quite unreliable.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nAcked-by: Soheil Hassas Yeganeh <soheil@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/485f3b39fe692ad1026963655dff519cce43d3ec"},{"sha":"d4cc2db2bcf3a6dab34577e430b3cdd798a316b8","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"net: mangle zero checksum in skb_checksum_help()\n\n[ Upstream commit 4f2e4ad56a65f3b7d64c258e373cb71e8d2499f4 ]\n\nSending zero checksum is ok for TCP, but not for UDP.\n\nUDPv6 receiver should by default drop a frame with a 0 checksum,\nand UDPv4 would not verify the checksum and might accept a corrupted\npacket.\n\nSimply replace such checksum by 0xffff, regardless of transport.\n\nThis error was caught on SIT tunnels, but seems generic.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Maciej Żenczykowski <maze@google.com>\nCc: Willem de Bruijn <willemb@google.com>\nAcked-by: Maciej Żenczykowski <maze@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/d4cc2db2bcf3a6dab34577e430b3cdd798a316b8"},{"sha":"cfbab4f4a1dc8bdaf0f439acf69880e855749de3","author":{"name":"Andy Gospodarek","email":"d5bb94bfe4a4a4ee479b7ab07f2b90ec80fb30eb@broadcom.com"},"message":"bgmac: stop clearing DMA receive control register right after it is set\n\n[ Upstream commit fcdefccac976ee51dd6071832b842d8fb41c479c ]\n\nCurrent bgmac code initializes some DMA settings in the receive control\nregister for some hardware and then immediately clears those settings.\nNot clearing those settings results in ~420Mbps *improvement* in\nthroughput; this system can now receive frames at line-rate on Broadcom\n5871x hardware compared to ~520Mbps today.  I also tested a few other\nvalues but found there to be no discernible difference in CPU\nutilization even if burst size and prefetching values are different.\n\nOn the hardware tested there was no need to keep the code that cleared\nall but bits 16-17, but since there is a wide variety of hardware that\nused this driver (I did not look at all hardware docs for hardware using\nthis IP block), I find it wise to move this call up and clear bits just\nafter reading the default value from the hardware rather than completely\nremoving it.\n\nThis is a good candidate for -stable >=3.14 since that is when the code\nthat was supposed to improve performance (but did not) was introduced.\n\nSigned-off-by: Andy Gospodarek <gospo@broadcom.com>\nFixes: 56ceecde1f29 (\"bgmac: initialize the DMA controller of core...\")\nCc: Hauke Mehrtens <hauke@hauke-m.de>\nAcked-by: Hauke Mehrtens <hauke@hauke-m.de>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/cfbab4f4a1dc8bdaf0f439acf69880e855749de3"},{"sha":"317c25df1b6435bc25bd22251080225ad5ef529e","author":{"name":"Eli Cooper","email":"f316908503372631bc2bfa9518d47f53dbbbe381@gmx.com"},"message":"ip6_tunnel: Clear IP6CB in ip6tunnel_xmit()\n\n[ Upstream commit 23f4ffedb7d751c7e298732ba91ca75d224bc1a6 ]\n\nskb->cb may contain data from previous layers. In the observed scenario,\nthe garbage data were misinterpreted as IP6CB(skb)->frag_max_size, so\nthat small packets sent through the tunnel are mistakenly fragmented.\n\nThis patch unconditionally clears the control buffer in ip6tunnel_xmit(),\nwhich affects ip6_tunnel, ip6_udp_tunnel and ip6_gre. Currently none of\nthese tunnels set IP6CB(skb)->flags, otherwise it needs to be done earlier.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Eli Cooper <elicooper@gmx.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/317c25df1b6435bc25bd22251080225ad5ef529e"},{"sha":"ab0580ec48c455273545cd70a3373b5e66d3a707","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"tcp: fix potential memory corruption\n\n[ Upstream commit ac9e70b17ecd7c6e933ff2eaf7ab37429e71bf4d ]\n\nImagine initial value of max_skb_frags is 17, and last\nskb in write queue has 15 frags.\n\nThen max_skb_frags is lowered to 14 or smaller value.\n\ntcp_sendmsg() will then be allowed to add additional page frags\nand eventually go past MAX_SKB_FRAGS, overflowing struct\nskb_shared_info.\n\nFixes: 5f74f82ea34c (\"net:Add sysctl_max_skb_frags\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Hans Westgaard Ry <hans.westgaard.ry@oracle.com>\nCc: Håkon Bugge <haakon.bugge@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/ab0580ec48c455273545cd70a3373b5e66d3a707"},{"sha":"2d040616984b0391db7427483da2d3235fdd82e3","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"dccp: do not send reset to already closed sockets\n\n[ Upstream commit 346da62cc186c4b4b1ac59f87f4482b47a047388 ]\n\nAndrey reported following warning while fuzzing with syzkaller\n\nWARNING: CPU: 1 PID: 21072 at net/dccp/proto.c:83 dccp_set_state+0x229/0x290\nKernel panic - not syncing: panic_on_warn set ...\n\nCPU: 1 PID: 21072 Comm: syz-executor Not tainted 4.9.0-rc1+ #293\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n ffff88003d4c7738 ffffffff81b474f4 0000000000000003 dffffc0000000000\n ffffffff844f8b00 ffff88003d4c7804 ffff88003d4c7800 ffffffff8140c06a\n 0000000041b58ab3 ffffffff8479ab7d ffffffff8140beae ffffffff8140cd00\nCall Trace:\n [<     inline     >] __dump_stack lib/dump_stack.c:15\n [<ffffffff81b474f4>] dump_stack+0xb3/0x10f lib/dump_stack.c:51\n [<ffffffff8140c06a>] panic+0x1bc/0x39d kernel/panic.c:179\n [<ffffffff8111125c>] __warn+0x1cc/0x1f0 kernel/panic.c:542\n [<ffffffff8111144c>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585\n [<ffffffff8389e5d9>] dccp_set_state+0x229/0x290 net/dccp/proto.c:83\n [<ffffffff838a0aa2>] dccp_close+0x612/0xc10 net/dccp/proto.c:1016\n [<ffffffff8316bf1f>] inet_release+0xef/0x1c0 net/ipv4/af_inet.c:415\n [<ffffffff82b6e89e>] sock_release+0x8e/0x1d0 net/socket.c:570\n [<ffffffff82b6e9f6>] sock_close+0x16/0x20 net/socket.c:1017\n [<ffffffff815256ad>] __fput+0x29d/0x720 fs/file_table.c:208\n [<ffffffff81525bb5>] ____fput+0x15/0x20 fs/file_table.c:244\n [<ffffffff811727d8>] task_work_run+0xf8/0x170 kernel/task_work.c:116\n [<     inline     >] exit_task_work include/linux/task_work.h:21\n [<ffffffff8111bc53>] do_exit+0x883/0x2ac0 kernel/exit.c:828\n [<ffffffff811221fe>] do_group_exit+0x10e/0x340 kernel/exit.c:931\n [<ffffffff81143c94>] get_signal+0x634/0x15a0 kernel/signal.c:2307\n [<ffffffff81054aad>] do_signal+0x8d/0x1a30 arch/x86/kernel/signal.c:807\n [<ffffffff81003a05>] exit_to_usermode_loop+0xe5/0x130\narch/x86/entry/common.c:156\n [<     inline     >] prepare_exit_to_usermode arch/x86/entry/common.c:190\n [<ffffffff81006298>] syscall_return_slowpath+0x1a8/0x1e0\narch/x86/entry/common.c:259\n [<ffffffff83fc1a62>] entry_SYSCALL_64_fastpath+0xc0/0xc2\nDumping ftrace buffer:\n   (ftrace buffer empty)\nKernel Offset: disabled\n\nFix this the same way we did for TCP in commit 565b7b2d2e63\n(\"tcp: do not send reset to already closed sockets\")\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/2d040616984b0391db7427483da2d3235fdd82e3"},{"sha":"b16a255216b2b05625128f38d8c916e210a8e6d5","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"dccp: fix out of bound access in dccp_v4_err()\n\n[ Upstream commit 6706a97fec963d6cb3f7fc2978ec1427b4651214 ]\n\ndccp_v4_err() does not use pskb_may_pull() and might access garbage.\n\nWe only need 4 bytes at the beginning of the DCCP header, like TCP,\nso the 8 bytes pulled in icmp_socket_deliver() are more than enough.\n\nThis patch might allow to process more ICMP messages, as some routers\nare still limiting the size of reflected bytes to 28 (RFC 792), instead\nof extended lengths (RFC 1812 4.3.2.3)\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/b16a255216b2b05625128f38d8c916e210a8e6d5"},{"sha":"6632cfc7eda9dec829536f12f92bfaa050c2e67d","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"ipv6: dccp: fix out of bound access in dccp_v6_err()\n\n[ Upstream commit 1aa9d1a0e7eefcc61696e147d123453fc0016005 ]\n\ndccp_v6_err() does not use pskb_may_pull() and might access garbage.\n\nWe only need 4 bytes at the beginning of the DCCP header, like TCP,\nso the 8 bytes pulled in icmpv6_notify() are more than enough.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/6632cfc7eda9dec829536f12f92bfaa050c2e67d"},{"sha":"21c798bde4657442c119af3170293b740789b851","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"ipv6: dccp: add missing bind_conflict to dccp_ipv6_mapped\n\n[ Upstream commit 990ff4d84408fc55942ca6644f67e361737b3d8e ]\n\nWhile fuzzing kernel with syzkaller, Andrey reported a nasty crash\nin inet6_bind() caused by DCCP lacking a required method.\n\nFixes: ab1e0a13d7029 (\"[SOCK] proto: Add hashinfo member to struct proto\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nCc: Arnaldo Carvalho de Melo <acme@redhat.com>\nAcked-by: Arnaldo Carvalho de Melo <acme@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/21c798bde4657442c119af3170293b740789b851"},{"sha":"ae72680f72151ec239161790d623905da4b250dd","author":{"name":"Marcelo Ricardo Leitner","email":"c04fb515492b5d50ffd8453e8f592dfba6d0858b@gmail.com"},"message":"sctp: assign assoc_id earlier in __sctp_connect\n\n[ Upstream commit 7233bc84a3aeda835d334499dc00448373caf5c0 ]\n\nsctp_wait_for_connect() currently already holds the asoc to keep it\nalive during the sleep, in case another thread release it. But Andrey\nKonovalov and Dmitry Vyukov reported an use-after-free in such\nsituation.\n\nProblem is that __sctp_connect() doesn't get a ref on the asoc and will\ndo a read on the asoc after calling sctp_wait_for_connect(), but by then\nanother thread may have closed it and the _put on sctp_wait_for_connect\nwill actually release it, causing the use-after-free.\n\nFix is, instead of doing the read after waiting for the connect, do it\nbefore so, and avoid this issue as the socket is still locked by then.\nThere should be no issue on returning the asoc id in case of failure as\nthe application shouldn't trust on that number in such situations\nanyway.\n\nThis issue doesn't exist in sctp_sendmsg() path.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>\nReviewed-by: Xin Long <lucien.xin@gmail.com>\nAcked-by: Neil Horman <nhorman@tuxdriver.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/ae72680f72151ec239161790d623905da4b250dd"},{"sha":"9b338d1a9a132eb4c5441f1e86cc5c0a019e4b7b","author":{"name":"Alexander Duyck","email":"030901eb82fcd8c9aabfbfd7a0b79f2e7f6fffee@intel.com"},"message":"fib_trie: Correct /proc/net/route off by one error\n\n[ Upstream commit fd0285a39b1cb496f60210a9a00ad33a815603e7 ]\n\nThe display of /proc/net/route has had a couple issues due to the fact that\nwhen I originally rewrote most of fib_trie I made it so that the iterator\nwas tracking the next value to use instead of the current.\n\nIn addition it had an off by 1 error where I was tracking the first piece\nof data as position 0, even though in reality that belonged to the\nSEQ_START_TOKEN.\n\nThis patch updates the code so the iterator tracks the last reported\nposition and key instead of the next expected position and key.  In\naddition it shifts things so that all of the leaves start at 1 instead of\ntrying to report leaves starting with offset 0 as being valid.  With these\ntwo issues addressed this should resolve any off by one errors that were\npresent in the display of /proc/net/route.\n\nFixes: 25b97c016b26 (\"ipv4: off-by-one in continuation handling in /proc/net/route\")\nCc: Andy Whitcroft <apw@canonical.com>\nReported-by: Jason Baron <jbaron@akamai.com>\nTested-by: Jason Baron <jbaron@akamai.com>\nSigned-off-by: Alexander Duyck <alexander.h.duyck@intel.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/9b338d1a9a132eb4c5441f1e86cc5c0a019e4b7b"},{"sha":"f36a0cf473d2aaa950ec85d8660bf9668e36d596","author":{"name":"Soheil Hassas Yeganeh","email":"920eeabab42d22e09c9b529ec000cdb22f8b4e6f@google.com"},"message":"sock: fix sendmmsg for partial sendmsg\n\n[ Upstream commit 3023898b7d4aac65987bd2f485cc22390aae6f78 ]\n\nDo not send the next message in sendmmsg for partial sendmsg\ninvocations.\n\nsendmmsg assumes that it can continue sending the next message\nwhen the return value of the individual sendmsg invocations\nis positive. It results in corrupting the data for TCP,\nSCTP, and UNIX streams.\n\nFor example, sendmmsg([[\"abcd\"], [\"efgh\"]]) can result in a stream\nof \"aefgh\" if the first sendmsg invocation sends only the first\nbyte while the second sendmsg goes through.\n\nDatagram sockets either send the entire datagram or fail, so\nthis patch affects only sockets of type SOCK_STREAM and\nSOCK_SEQPACKET.\n\nFixes: 228e548e6020 (\"net: Add sendmmsg socket system call\")\nSigned-off-by: Soheil Hassas Yeganeh <soheil@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: Willem de Bruijn <willemb@google.com>\nSigned-off-by: Neal Cardwell <ncardwell@google.com>\nAcked-by: Maciej Żenczykowski <maze@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/f36a0cf473d2aaa950ec85d8660bf9668e36d596"},{"sha":"bebdbf6af57e59f3d238d053a3511905e311a154","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"net: __skb_flow_dissect() must cap its return value\n\n[ Upstream commit 34fad54c2537f7c99d07375e50cb30aa3c23bd83 ]\n\nAfter Tom patch, thoff field could point past the end of the buffer,\nthis could fool some callers.\n\nIf an skb was provided, skb->len should be the upper limit.\nIf not, hlen is supposed to be the upper limit.\n\nFixes: a6e544b0a88b (\"flow_dissector: Jump to exit code in __skb_flow_dissect\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Yibin Yang <yibyang@cisco.com\nAcked-by: Alexander Duyck <alexander.h.duyck@intel.com>\nAcked-by: Willem de Bruijn <willemb@google.com>\nAcked-by: Alexei Starovoitov <ast@kernel.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/bebdbf6af57e59f3d238d053a3511905e311a154"},{"sha":"bf6ce93e5ec730f0ea73fcf44b4b3c473f360a5e","author":{"name":"Stephen Suryaputra Lin","email":"2fadb1bbad9828792ee21a9dc296758fb56a495b@gmail.com"},"message":"ipv4: use new_gw for redirect neigh lookup\n\n[ Upstream commit 969447f226b451c453ddc83cac6144eaeac6f2e3 ]\n\nIn v2.6, ip_rt_redirect() calls arp_bind_neighbour() which returns 0\nand then the state of the neigh for the new_gw is checked. If the state\nisn't valid then the redirected route is deleted. This behavior is\nmaintained up to v3.5.7 by check_peer_redirect() because rt->rt_gateway\nis assigned to peer->redirect_learned.a4 before calling\nipv4_neigh_lookup().\n\nAfter commit 5943634fc559 (\"ipv4: Maintain redirect and PMTU info in\nstruct rtable again.\"), ipv4_neigh_lookup() is performed without the\nrt_gateway assigned to the new_gw. In the case when rt_gateway (old_gw)\nisn't zero, the function uses it as the key. The neigh is most likely\nvalid since the old_gw is the one that sends the ICMP redirect message.\nThen the new_gw is assigned to fib_nh_exception. The problem is: the\nnew_gw ARP may never gets resolved and the traffic is blackholed.\n\nSo, use the new_gw for neigh lookup.\n\nChanges from v1:\n - use __ipv4_neigh_lookup instead (per Eric Dumazet).\n\nFixes: 5943634fc559 (\"ipv4: Maintain redirect and PMTU info in struct rtable again.\")\nSigned-off-by: Stephen Suryaputra Lin <ssurya@ieee.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/bf6ce93e5ec730f0ea73fcf44b4b3c473f360a5e"},{"sha":"feec9a78aab6c3fd62f9ec823da4c6be9625b79e","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"tcp: take care of truncations done by sk_filter()\n\n[ Upstream commit ac6e780070e30e4c35bd395acfe9191e6268bdd3 ]\n\nWith syzkaller help, Marco Grassi found a bug in TCP stack,\ncrashing in tcp_collapse()\n\nRoot cause is that sk_filter() can truncate the incoming skb,\nbut TCP stack was not really expecting this to happen.\nIt probably was expecting a simple DROP or ACCEPT behavior.\n\nWe first need to make sure no part of TCP header could be removed.\nThen we need to adjust TCP_SKB_CB(skb)->end_seq\n\nMany thanks to syzkaller team and Marco for giving us a reproducer.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Marco Grassi <marco.gra@gmail.com>\nReported-by: Vladis Dronov <vdronov@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n\n# Conflicts:\n#\tnet/core/filter.c","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/feec9a78aab6c3fd62f9ec823da4c6be9625b79e"},{"sha":"871bd5e003a161f5179b3da9ebb303a3beae8c46","author":{"name":"David S. Miller","email":"79caf591e37e1438a2d55ae59670d5cd0d717764@davemloft.net"},"message":"sparc: Don't leak context bits into thread->fault_address\n\n[ Upstream commit 4f6deb8cbab532a8d7250bc09234c1795ecb5e2c ]\n\nOn pre-Niagara systems, we fetch the fault address on data TLB\nexceptions from the TLB_TAG_ACCESS register.  But this register also\ncontains the context ID assosciated with the fault in the low 13 bits\nof the register value.\n\nThis propagates into current_thread_info()->fault_address and can\ncause trouble later on.\n\nSo clear the low 13-bits out of the TLB_TAG_ACCESS value in the cases\nwhere it matters.\n\nReported-by: Mikulas Patocka <mpatocka@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/871bd5e003a161f5179b3da9ebb303a3beae8c46"},{"sha":"d345d0748e25db8eaaee365ae5e114dab054bd5b","author":{"name":"Dan Carpenter","email":"60b2bf2bc0bec4ca4a4b046ca7ef9255248abff8@oracle.com"},"message":"sparc: serial: sunhv: fix a double lock bug\n\n[ Upstream commit 344e3c7734d5090b148c19ac6539b8947fed6767 ]\n\nWe accidentally take the \"port->lock\" twice in a row.  This old code\nwas supposed to be deleted.\n\nFixes: e58e241c1788 ('sparc: serial: Clean up the locking for -rt')\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/d345d0748e25db8eaaee365ae5e114dab054bd5b"},{"sha":"a1c6073152d6bec4019ff11f0e850148f1f221fb","author":{"name":"Mike Kravetz","email":"d107146bb715ad1d7b031c14b4c72b7561dc8356@oracle.com"},"message":"sparc64 mm: Fix base TSB sizing when hugetlb pages are used\n\n[ Upstream commit af1b1a9b36b8f9d583d4b4f90dd8946ed0cd4bd0 ]\n\ndo_sparc64_fault() calculates both the base and huge page RSS sizes and\nuses this information in calls to tsb_grow().  The calculation for base\npage TSB size is not correct if the task uses hugetlb pages.  hugetlb\npages are not accounted for in RSS, therefore the call to get_mm_rss(mm)\ndoes not include hugetlb pages.  However, the number of pages based on\nhuge_pte_count (which does include hugetlb pages) is subtracted from\nthis value.  This will result in an artificially small and often negative\nRSS calculation.  The base TSB size is then often set to max_tsb_size\nas the passed RSS is unsigned, so a negative value looks really big.\n\nTHP pages are also accounted for in huge_pte_count, and THP pages are\naccounted for in RSS so the calculation in do_sparc64_fault() is correct\nif a task only uses THP pages.\n\nA single huge_pte_count is not sufficient for TSB sizing if both hugetlb\nand THP pages can be used.  Instead of a single counter, use two:  one\nfor hugetlb and one for THP.\n\nSigned-off-by: Mike Kravetz <mike.kravetz@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/a1c6073152d6bec4019ff11f0e850148f1f221fb"},{"sha":"800f7eb5cc99b6977744d8a29ad53dc0ffca6dc8","author":{"name":"James Clarke","email":"839b7c75ae321548c047f0be618b9152548af6e9@jrtc27.com"},"message":"sparc: Handle negative offsets in arch_jump_label_transform\n\n[ Upstream commit 9d9fa230206a3aea6ef451646c97122f04777983 ]\n\nAdditionally, if the offset will overflow the immediate for a ba,pt\ninstruction, fall back on a standard ba to get an extra 3 bits.\n\nSigned-off-by: James Clarke <jrtc27@jrtc27.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/carck/Xiaomi_Kernel_OpenSource/commits/800f7eb5cc99b6977744d8a29ad53dc0ffca6dc8"}]}
{"actor":{"display_login":"carck"}}