{"push_id":1309030790,"size":336,"distinct_size":3,"ref":"refs/heads/work/hns/mips/minibook","head":"ba44c0a5c8b0a38d4f51a098790a858ff7088c23","before":"de6929578e0bb57be926a112429591ab68982407","commits":[{"sha":"1ba5bf993c6a3142e18e68ea6452b347f9cb5635","author":{"name":"Vegard Nossum","email":"9c44e0ed746b5c309b0bf31e4bae8fb5eb72beb1@oracle.com"},"message":"xfrm: fix crash in XFRM_MSG_GETSA netlink handler\n\nIf we hit any of the error conditions inside xfrm_dump_sa(), then\nxfrm_state_walk_init() never gets called. However, we still call\nxfrm_state_walk_done() from xfrm_dump_sa_done(), which will crash\nbecause the state walk was never initialized properly.\n\nWe can fix this by setting cb->args[0] only after we've processed the\nfirst element and checking this before calling xfrm_state_walk_done().\n\nFixes: d3623099d3 (\"ipsec: add support of limited SA dump\")\nCc: Nicolas Dichtel <nicolas.dichtel@6wind.com>\nCc: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: Vegard Nossum <vegard.nossum@oracle.com>\nAcked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/1ba5bf993c6a3142e18e68ea6452b347f9cb5635"},{"sha":"73efc3245fd3edb3632d82a3a9c5d5d975a02efc","author":{"name":"Vegard Nossum","email":"9c44e0ed746b5c309b0bf31e4bae8fb5eb72beb1@oracle.com"},"message":"xfrm: get rid of incorrect WARN\n\nAFAICT this message is just printed whenever input validation fails.\nThis is a normal failure and we shouldn't be dumping the stack over it.\n\nLooks like it was originally a printk that was maybe incorrectly\nupgraded to a WARN:\n\ncommit 62db5cfd70b1ef53aa21f144a806fe3b78c84fab\nAuthor: stephen hemminger <shemminger@vyatta.com>\nDate:   Wed May 12 06:37:06 2010 +0000\n\n    xfrm: add severity to printk\n\nCc: Stephen Hemminger <stephen@networkplumber.org>\nCc: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: Vegard Nossum <vegard.nossum@oracle.com>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/73efc3245fd3edb3632d82a3a9c5d5d975a02efc"},{"sha":"7677c7560c3e80fde08a7e710d378dedabf950c3","author":{"name":"Vegard Nossum","email":"9c44e0ed746b5c309b0bf31e4bae8fb5eb72beb1@oracle.com"},"message":"xfrm: get rid of another incorrect WARN\n\nDuring fuzzing I regularly run into this WARN(). According to Herbert Xu,\nthis \"certainly shouldn't be a WARN, it probably shouldn't print anything\neither\".\n\nCc: Stephen Hemminger <stephen@networkplumber.org>\nCc: Steffen Klassert <steffen.klassert@secunet.com>\nCc: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Vegard Nossum <vegard.nossum@oracle.com>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/7677c7560c3e80fde08a7e710d378dedabf950c3"},{"sha":"6916fb3b10b3cbe3b1f9f5b680675f53e4e299eb","author":{"name":"Tobias Brunner","email":"36c5bbefeb290c7a456f392d21ced31cf0271e32@strongswan.org"},"message":"xfrm: Ignore socket policies when rebuilding hash tables\n\nWhenever thresholds are changed the hash tables are rebuilt.  This is\ndone by enumerating all policies and hashing and inserting them into\nthe right table according to the thresholds and direction.\n\nBecause socket policies are also contained in net->xfrm.policy_all but\nno hash tables are defined for their direction (dir + XFRM_POLICY_MAX)\nthis causes a NULL or invalid pointer dereference after returning from\npolicy_hash_bysel() if the rebuild is done while any socket policies\nare installed.\n\nSince the rebuild after changing thresholds is scheduled this crash\ncould even occur if the userland sets thresholds seemingly before\ninstalling any socket policies.\n\nFixes: 53c2e285f970 (\"xfrm: Do not hash socket policies\")\nSigned-off-by: Tobias Brunner <tobias@strongswan.org>\nAcked-by: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/6916fb3b10b3cbe3b1f9f5b680675f53e4e299eb"},{"sha":"4d0bd46a4d55383f7b925e6cf7865a77e0f0e020","author":{"name":"Johannes Berg","email":"9a5936d824e6835dfe162c5611d10d2cf40ffbad@intel.com"},"message":"Revert \"wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel\"\n\nThis reverts commit 3d5fdff46c4b2b9534fa2f9fc78e90a48e0ff724.\n\nBen Hutchings pointed out that the commit isn't safe since it assumes\nthat the structure used by the driver is iw_point, when in fact there's\nno way to know about that.\n\nFortunately, the only driver in the tree that ever runs this code path\nis the wilc1000 staging driver, so it doesn't really matter.\n\nClearly I should have investigated this better before applying, sorry.\n\nReported-by: Ben Hutchings <ben@decadent.org.uk>\nCc: stable@vger.kernel.org [though I guess it doesn't matter much]\nFixes: 3d5fdff46c4b (\"wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel\")\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/4d0bd46a4d55383f7b925e6cf7865a77e0f0e020"},{"sha":"7e196aa1a011da35a04cb1f161e186563aa8d8db","author":{"name":"Wei Yongjun","email":"07c9053292b1ab0fc7bfece763550eb7eb3e7a18@trendmicro.com.cn"},"message":"clk: sunxi: pll2: Fix return value check in sun4i_pll2_setup()\n\nIn case of error, the functions clk_register_composite() and\nclk_register_divider() returns ERR_PTR() and never returns NULL.\nThe NULL test in the return value check should be replaced with\nIS_ERR().\n\nSigned-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>\nSigned-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/7e196aa1a011da35a04cb1f161e186563aa8d8db"},{"sha":"fbe359f12ce40e3126bea959b135656e4a305897","author":{"name":"Wei Yongjun","email":"07c9053292b1ab0fc7bfece763550eb7eb3e7a18@trendmicro.com.cn"},"message":"clk: sunxi: Fix return value check in sun8i_a23_mbus_setup()\n\nIn case of error, the function of_io_request_and_map() returns ERR_PTR()\nand never returns NULL. The NULL test in the return value check should be\nreplaced with IS_ERR().\n\nSigned-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>\nSigned-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/fbe359f12ce40e3126bea959b135656e4a305897"},{"sha":"156ad0d7eae4825a0d94a4bf68571e97302f2501","author":{"name":"Chen-Yu Tsai","email":"d935d34b7d281e4f50030b838a1bf5c8f10bdb43@csie.org"},"message":"clk: sunxi-ng: Fix inverted test condition in ccu_helper_wait_for_lock\n\nThe condition passed to read*_poll_timeout() is the break condition,\ni.e. wait for this condition to happen and return success.\n\nThe original code assumed the opposite, resulting in a warning when\nthe PLL clock rate was changed but never lost it's lock as far as\nthe readout indicated. This was verified by checking the read out\nregister value.\n\nFixes: 1d80c14248d6 (\"clk: sunxi-ng: Add common infrastructure\")\nSigned-off-by: Chen-Yu Tsai <wens@csie.org>\nAcked-by: Maxime Ripard <maxime.ripard@free-electrons.com>\nSigned-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/156ad0d7eae4825a0d94a4bf68571e97302f2501"},{"sha":"06421a7821f9040467e0db2702309b72aa2b7af4","author":{"name":"Chen-Yu Tsai","email":"d935d34b7d281e4f50030b838a1bf5c8f10bdb43@csie.org"},"message":"clk: sunxi-ng: nk: Make ccu_nk_find_best static\n\nmake C=2 reports:\n\n  CHECK   drivers/clk/sunxi-ng/ccu_nk.c\ndrivers/clk/sunxi-ng/ccu_nk.c:17:6: warning: symbol 'ccu_nk_find_best' was\nnot declared. Should it be static?\n\nccu_nk_find_best is only used within ccu_nk.c. So make it static to get\nrid of this warning.\n\nFixes: adbfb0056e03 (\"clk: sunxi-ng: Add N-K-factor clock support\")\nSigned-off-by: Chen-Yu Tsai <wens@csie.org>\nSigned-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/06421a7821f9040467e0db2702309b72aa2b7af4"},{"sha":"1625f4529957738be7d87cf157e107b8fb9d23b9","author":{"name":"Alexey Kodanev","email":"9f3808f0a12da1be5378a18211ea35dc74f98ef4@oracle.com"},"message":"net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key\n\nRunning LTP 'icmp-uni-basic.sh -6 -p ipcomp -m tunnel' test over\nopenvswitch + veth can trigger kernel panic:\n\n  BUG: unable to handle kernel NULL pointer dereference\n  at 00000000000000e0 IP: [<ffffffff8169d1d2>] xfrm_input+0x82/0x750\n  ...\n  [<ffffffff816d472e>] xfrm6_rcv_spi+0x1e/0x20\n  [<ffffffffa082c3c2>] xfrm6_tunnel_rcv+0x42/0x50 [xfrm6_tunnel]\n  [<ffffffffa082727e>] tunnel6_rcv+0x3e/0x8c [tunnel6]\n  [<ffffffff8169f365>] ip6_input_finish+0xd5/0x430\n  [<ffffffff8169fc53>] ip6_input+0x33/0x90\n  [<ffffffff8169f1d5>] ip6_rcv_finish+0xa5/0xb0\n  ...\n\nIt seems that tunnel.ip6 can have garbage values and also dereferenced\nwithout a proper check, only tunnel.ip4 is being verified. Fix it by\nadding one more if block for AF_INET6 and initialize tunnel.ip6 with NULL\ninside xfrm6_rcv_spi() (which is similar to xfrm4_rcv_spi()).\n\nFixes: 049f8e2 (\"xfrm: Override skb->mark with tunnel->parm.i_key in xfrm_input\")\n\nSigned-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/1625f4529957738be7d87cf157e107b8fb9d23b9"},{"sha":"c81396f3da22aa8f1e8fbf7943616a0839c4d63d","author":{"name":"Cathy Luo","email":"6a721370647220ce4ea409daacd971a4d8991bf7@marvell.com"},"message":"mwifiex: fix large amsdu packets causing firmware hang\n\nSometimes host prepares and downloads a large amsdu packet to firmware\nwhich leads to a memory corruption in firmware.\nThe reason is __dev_alloc_skb() may allocate larger buffer than required\nsize. This patch solves the problem by checking \"adapter->tx_buf_size\"\ninstead of relying on skb_tailroom().\n\nSigned-off-by: Cathy Luo <cluo@marvell.com>\nSigned-off-by: Amitkumar Karwar <akarwar@marvell.com>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/c81396f3da22aa8f1e8fbf7943616a0839c4d63d"},{"sha":"11d7a0bb95eaaba1741bb24a7c3c169c82f09c7b","author":{"name":"David Ahern","email":"e530dc8f30cd5fef67eca6e0378269caad10dfeb@cumulusnetworks.com"},"message":"xfrm: Only add l3mdev oif to dst lookups\n\nSubash reported that commit 42a7b32b73d6 (\"xfrm: Add oif to dst lookups\")\nbroke a wifi use case that uses fib rules and xfrms. The intent of\n42a7b32b73d6 was driven by VRFs with IPsec. As a compromise relax the\nuse of oif in xfrm lookups to L3 master devices only (ie., oif is either\nan L3 master device or is enslaved to a master device).\n\nFixes: 42a7b32b73d6 (\"xfrm: Add oif to dst lookups\")\nReported-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>\nSigned-off-by: David Ahern <dsa@cumulusnetworks.com>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/11d7a0bb95eaaba1741bb24a7c3c169c82f09c7b"},{"sha":"05860bed491b114a9f2d7a4f6e09fb02c0b69056","author":{"name":"Felix Fietkau","email":"8cf1b58efcecbc12846b1b7b0c62f2bc67216d26@nbd.name"},"message":"ath9k: fix client mode beacon configuration\n\nFor pure station mode, iter_data.primary_beacon_vif was used and passed\nto ath_beacon_config, but not set to the station vif.\nThis was causing the following warning:\n\n[  100.310919] ------------[ cut here ]------------\n[  100.315683] WARNING: CPU: 0 PID: 7 at compat-wireless-2016-06-20/drivers/net/wireless/ath/ath9k/beacon.c:642 ath9k_calculate_summary_state+0x250/0x60c [ath9k]()\n[  100.402028] CPU: 0 PID: 7 Comm: kworker/u2:1 Tainted: G        W       4.4.15 #5\n[  100.409676] Workqueue: phy0 ieee80211_ibss_leave [mac80211]\n[  100.415351] Stack : 8736e98c 870b4b20 87a25b54 800a6800 8782a080 80400d63 8039b96c 00000007\n[  100.415351]    803c5edc 87875914 80400000 800a47cc 87a25b54 800a6800 803a0fd8 80400000\n[  100.415351]    00000003 87875914 80400000 80094ae0 87a25b54 8787594c 00000000 801ef308\n[  100.415351]    803ffe70 801ef300 87193d58 87b3a400 87b3ad00 70687930 00000000 00000000\n[  100.415351]    00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000\n[  100.415351]    ...\n[  100.451703] Call Trace:\n[  100.454235] [<800a6800>] vprintk_default+0x24/0x30\n[  100.459110] [<800a47cc>] printk+0x2c/0x38\n[  100.463190] [<800a6800>] vprintk_default+0x24/0x30\n[  100.468072] [<80094ae0>] print_worker_info+0x148/0x174\n[  100.473378] [<801ef308>] serial8250_console_putchar+0x0/0x44\n[  100.479122] [<801ef300>] wait_for_xmitr+0xc4/0xcc\n[  100.484014] [<87193d58>] ieee80211_ibss_leave+0xb90/0x1900 [mac80211]\n[  100.490590] [<80081604>] warn_slowpath_common+0xa0/0xd0\n[  100.495922] [<801a359c>] dump_stack+0x14/0x28\n[  100.500350] [<80071a00>] show_stack+0x50/0x84\n[  100.504784] [<80081604>] warn_slowpath_common+0xa0/0xd0\n[  100.510106] [<87024c60>] ath9k_calculate_summary_state+0x250/0x60c [ath9k]\n[  100.517105] [<800816b8>] warn_slowpath_null+0x18/0x24\n[  100.522256] [<87024c60>] ath9k_calculate_summary_state+0x250/0x60c [ath9k]\n[  100.529273] [<87025418>] ath9k_set_txpower+0x148/0x498 [ath9k]\n[  100.535302] [<871d2c64>] cleanup_module+0xa74/0xd4c [mac80211]\n[  100.541237] [<801ef308>] serial8250_console_putchar+0x0/0x44\n[  100.547042] [<800a5d18>] wake_up_klogd+0x54/0x68\n[  100.551730] [<800a6650>] vprintk_emit+0x404/0x43c\n[  100.556623] [<871b9db8>] ieee80211_sta_rx_notify+0x258/0x32c [mac80211]\n[  100.563475] [<871ba6a4>] ieee80211_sta_rx_queued_mgmt+0x63c/0x734 [mac80211]\n[  100.570693] [<871aa49c>] ieee80211_tx_prepare_skb+0x210/0x230 [mac80211]\n[  100.577609] [<800af5d4>] mod_timer+0x15c/0x190\n[  100.582220] [<871ba8b8>] ieee80211_sta_work+0xfc/0xe1c [mac80211]\n[  100.588539] [<871940b4>] ieee80211_ibss_leave+0xeec/0x1900 [mac80211]\n[  100.595122] [<8009ec84>] dequeue_task_fair+0x44/0x130\n[  100.600281] [<80092a34>] process_one_work+0x1f8/0x334\n[  100.605454] [<80093830>] worker_thread+0x2b4/0x408\n[  100.610317] [<8009357c>] worker_thread+0x0/0x408\n[  100.615019] [<8009357c>] worker_thread+0x0/0x408\n[  100.619705] [<80097b68>] kthread+0xdc/0xe8\n[  100.623886] [<80097a8c>] kthread+0x0/0xe8\n[  100.627961] [<80060878>] ret_from_kernel_thread+0x14/0x1c\n[  100.633448]\n[  100.634956] ---[ end trace aafbe57e9ae6862f ]---\n\nFixes: cfda2d8e2314 (\"ath9k: Fix beacon configuration for addition/removal of interfaces\")\nSigned-off-by: Felix Fietkau <nbd@nbd.name>\nSigned-off-by: Kalle Valo <kvalo@qca.qualcomm.com>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/05860bed491b114a9f2d7a4f6e09fb02c0b69056"},{"sha":"7711aaf08ad3fc4d0e937eec1de0a63620444ce7","author":{"name":"Felix Fietkau","email":"8cf1b58efcecbc12846b1b7b0c62f2bc67216d26@nbd.name"},"message":"ath9k: fix using sta->drv_priv before initializing it\n\nA station pointer can be passed to the driver on tx, before it has been\nmarked as associated. Since ath9k_sta_state was initializing the entry\ntoo late, it resulted in some spurious crashes.\n\nFixes: df3c6eb34da5 (\"ath9k: Use sta_state() callback\")\nCc: stable@vger.kernel.org\nSigned-off-by: Felix Fietkau <nbd@nbd.name>\nSigned-off-by: Kalle Valo <kvalo@qca.qualcomm.com>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/7711aaf08ad3fc4d0e937eec1de0a63620444ce7"},{"sha":"15dacf880e49ce3ecee05eb1a0c6b8e363dbacdc","author":{"name":"mhiramat@kernel.org","email":"5ab6ef7bee6728a5bff222670b7ceb5278b7ee85@kernel.org"},"message":"brcmfmac: Check rtnl_lock is locked when removing interface\n\nCheck rtnl_lock is locked in brcmf_p2p_ifp_removed() by passing\nrtnl_locked flag. Actually the caller brcmf_del_if() checks whether\nthe rtnl_lock is locked, but doesn't pass it to brcmf_p2p_ifp_removed().\n\nWithout this fix, wpa_supplicant goes softlockup with rtnl_lock\nholding (this means all other process using netlink are locked up too)\n\ne.g.\n[ 4495.876627] INFO: task wpa_supplicant:7307 blocked for more than 10 seconds.\n[ 4495.876632]       Tainted: G        W       4.8.0-rc1+ #8\n[ 4495.876635] \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n[ 4495.876638] wpa_supplicant  D ffff974c647b39a0     0  7307      1 0x00000000\n[ 4495.876644]  ffff974c647b39a0 0000000000000000 ffff974c00000000 ffff974c7dc59c58\n[ 4495.876651]  ffff974c6b7417c0 ffff974c645017c0 ffff974c647b4000 ffffffff86f16c08\n[ 4495.876657]  ffff974c645017c0 0000000000000246 00000000ffffffff ffff974c647b39b8\n[ 4495.876664] Call Trace:\n[ 4495.876671]  [<ffffffff868aeccc>] schedule+0x3c/0x90\n[ 4495.876676]  [<ffffffff868af065>] schedule_preempt_disabled+0x15/0x20\n[ 4495.876682]  [<ffffffff868b0996>] mutex_lock_nested+0x176/0x3b0\n[ 4495.876686]  [<ffffffff867a2067>] ? rtnl_lock+0x17/0x20\n[ 4495.876690]  [<ffffffff867a2067>] rtnl_lock+0x17/0x20\n[ 4495.876720]  [<ffffffffc0ae9a5d>] brcmf_p2p_ifp_removed+0x4d/0x70 [brcmfmac]\n[ 4495.876741]  [<ffffffffc0aebde6>] brcmf_remove_interface+0x196/0x1b0 [brcmfmac]\n[ 4495.876760]  [<ffffffffc0ae9901>] brcmf_p2p_del_vif+0x111/0x220 [brcmfmac]\n[ 4495.876777]  [<ffffffffc0adefab>] brcmf_cfg80211_del_iface+0x21b/0x270 [brcmfmac]\n[ 4495.876820]  [<ffffffffc097b39e>] nl80211_del_interface+0xfe/0x3a0 [cfg80211]\n[ 4495.876825]  [<ffffffff867ca335>] genl_family_rcv_msg+0x1b5/0x370\n[ 4495.876832]  [<ffffffff860e5d8d>] ? trace_hardirqs_on+0xd/0x10\n[ 4495.876836]  [<ffffffff867ca56d>] genl_rcv_msg+0x7d/0xb0\n[ 4495.876839]  [<ffffffff867ca4f0>] ? genl_family_rcv_msg+0x370/0x370\n[ 4495.876846]  [<ffffffff867c9a47>] netlink_rcv_skb+0x97/0xb0\n[ 4495.876849]  [<ffffffff867ca168>] genl_rcv+0x28/0x40\n[ 4495.876854]  [<ffffffff867c93c3>] netlink_unicast+0x1d3/0x2f0\n[ 4495.876860]  [<ffffffff867c933b>] ? netlink_unicast+0x14b/0x2f0\n[ 4495.876866]  [<ffffffff867c97cb>] netlink_sendmsg+0x2eb/0x3a0\n[ 4495.876870]  [<ffffffff8676dad8>] sock_sendmsg+0x38/0x50\n[ 4495.876874]  [<ffffffff8676e4df>] ___sys_sendmsg+0x27f/0x290\n[ 4495.876882]  [<ffffffff8628b935>] ? mntput_no_expire+0x5/0x3f0\n[ 4495.876888]  [<ffffffff8628b9be>] ? mntput_no_expire+0x8e/0x3f0\n[ 4495.876894]  [<ffffffff8628b935>] ? mntput_no_expire+0x5/0x3f0\n[ 4495.876899]  [<ffffffff8628bd44>] ? mntput+0x24/0x40\n[ 4495.876904]  [<ffffffff86267830>] ? __fput+0x190/0x200\n[ 4495.876909]  [<ffffffff8676f125>] __sys_sendmsg+0x45/0x80\n[ 4495.876914]  [<ffffffff8676f172>] SyS_sendmsg+0x12/0x20\n[ 4495.876918]  [<ffffffff868b5680>] entry_SYSCALL_64_fastpath+0x23/0xc1\n[ 4495.876924]  [<ffffffff860e2b8f>] ? trace_hardirqs_off_caller+0x1f/0xc0\n\nSigned-off-by: Masami Hiramatsu <mhiramat@kernel.org>\nAcked-by: Rafał Miłecki <rafal@milecki.pl>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/15dacf880e49ce3ecee05eb1a0c6b8e363dbacdc"},{"sha":"b64abcb7dae6060c67ab0e548da3ef923c49641d","author":{"name":"mhiramat@kernel.org","email":"5ab6ef7bee6728a5bff222670b7ceb5278b7ee85@kernel.org"},"message":"brcmfmac: Change vif_event_lock to spinlock\n\nChange vif_event_lock to spinlock from mutex, since this lock is\nused in wait_event_timeout() via vif_event_equals(). This caused\na warning report as below.\n\nAs far as I can see, this lock protects regions where updating\nstructure members, not function calls. Also, since those\nregions are not called from interrupt handlers (of course, it\nwas a mutex), spin_lock is used instead of spin_lock_irqsave.\n\n[  186.678550] ------------[ cut here ]------------\n[  186.678556] WARNING: CPU: 2 PID: 7140 at /home/mhiramat/ksrc/linux/kernel/sched/core.c:7545 __might_sleep+0x7c/0x80\n[  186.678560] do not call blocking ops when !TASK_RUNNING; state=2 set at [<ffffffff980d9090>] prepare_to_wait_event+0x60/0x100\n[  186.678560] Modules linked in: brcmfmac xt_CHECKSUM rfcomm ipt_MASQUERADE nf_nat_masquerade_ipv4 xt_addrtype br_netfilter xt_tcpudp ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_raw ip6table_security ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_filter ip6_tables iptable_raw iptable_security iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_filter ip_tables x_tables bnep nls_iso8859_1 i2c_designware_platform i2c_designware_core snd_hda_codec_hdmi snd_hda_codec_realtek dcdbas snd_hda_codec_generic snd_hda_intel snd_hda_codec intel_rapl snd_hda_core x86_pkg_temp_thermal intel_powerclamp coretemp\n[  186.678594]  snd_pcm crct10dif_pclmul crc32_pclmul aesni_intel aes_x86_64 joydev glue_helper snd_hwdep lrw gf128mul uvcvideo ablk_helper snd_seq_midi cryptd snd_seq_midi_event snd_rawmidi videobuf2_vmalloc videobuf2_memops snd_seq input_leds videobuf2_v4l2 cfg80211 videobuf2_core snd_timer videodev serio_raw btusb snd_seq_device media btrtl rtsx_pci_ms snd mei_me memstick hid_multitouch mei soundcore brcmutil idma64 virt_dma intel_lpss_pci processor_thermal_device intel_soc_dts_iosf hci_uart btbcm btqca btintel bluetooth int3403_thermal dell_smo8800 intel_lpss_acpi intel_lpss int3402_thermal int340x_thermal_zone intel_hid mac_hid int3400_thermal shpchp sparse_keymap acpi_pad acpi_thermal_rel acpi_als kfifo_buf industrialio kvm_intel kvm irqbypass parport_pc ppdev lp parport autofs4 btrfs xor raid6_pq\n[  186.678631]  usbhid nouveau ttm i915 rtsx_pci_sdmmc mxm_wmi i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops psmouse drm ahci rtsx_pci nvme nvme_core libahci i2c_hid hid pinctrl_sunrisepoint video wmi pinctrl_intel fjes [last unloaded: brcmfmac]\n[  186.678646] CPU: 2 PID: 7140 Comm: wpa_supplicant Not tainted 4.8.0-rc1+ #8\n[  186.678647] Hardware name: Dell Inc. XPS 15 9550/0N7TVV, BIOS 01.02.00 04/07/2016\n[  186.678648]  0000000000000000 ffff9d8c64b5b900 ffffffff98442f23 ffff9d8c64b5b950\n[  186.678651]  0000000000000000 ffff9d8c64b5b940 ffffffff9808b22b 00001d790000000d\n[  186.678653]  ffffffff98c75e78 000000000000026c 0000000000000000 ffff9d8c2706d058\n[  186.678655] Call Trace:\n[  186.678659]  [<ffffffff98442f23>] dump_stack+0x85/0xc2\n[  186.678666]  [<ffffffff9808b22b>] __warn+0xcb/0xf0\n[  186.678668]  [<ffffffff9808b29f>] warn_slowpath_fmt+0x4f/0x60\n[  186.678671]  [<ffffffff980d9090>] ? prepare_to_wait_event+0x60/0x100\n[  186.678672]  [<ffffffff980d9090>] ? prepare_to_wait_event+0x60/0x100\n[  186.678674]  [<ffffffff980b922c>] __might_sleep+0x7c/0x80\n[  186.678680]  [<ffffffff988b0853>] mutex_lock_nested+0x33/0x3b0\n[  186.678682]  [<ffffffff980e5d8d>] ? trace_hardirqs_on+0xd/0x10\n[  186.678689]  [<ffffffffc0c57d2d>] brcmf_cfg80211_wait_vif_event+0xcd/0x130 [brcmfmac]\n[  186.678691]  [<ffffffff980d9190>] ? wake_atomic_t_function+0x60/0x60\n[  186.678697]  [<ffffffffc0c628e9>] brcmf_p2p_del_vif+0xf9/0x220 [brcmfmac]\n[  186.678702]  [<ffffffffc0c57fab>] brcmf_cfg80211_del_iface+0x21b/0x270 [brcmfmac]\n[  186.678716]  [<ffffffffc0b0539e>] nl80211_del_interface+0xfe/0x3a0 [cfg80211]\n[  186.678718]  [<ffffffff987ca335>] genl_family_rcv_msg+0x1b5/0x370\n[  186.678720]  [<ffffffff980e5d8d>] ? trace_hardirqs_on+0xd/0x10\n[  186.678721]  [<ffffffff987ca56d>] genl_rcv_msg+0x7d/0xb0\n[  186.678722]  [<ffffffff987ca4f0>] ? genl_family_rcv_msg+0x370/0x370\n[  186.678724]  [<ffffffff987c9a47>] netlink_rcv_skb+0x97/0xb0\n[  186.678726]  [<ffffffff987ca168>] genl_rcv+0x28/0x40\n[  186.678727]  [<ffffffff987c93c3>] netlink_unicast+0x1d3/0x2f0\n[  186.678729]  [<ffffffff987c933b>] ? netlink_unicast+0x14b/0x2f0\n[  186.678731]  [<ffffffff987c97cb>] netlink_sendmsg+0x2eb/0x3a0\n[  186.678733]  [<ffffffff9876dad8>] sock_sendmsg+0x38/0x50\n[  186.678734]  [<ffffffff9876e4df>] ___sys_sendmsg+0x27f/0x290\n[  186.678737]  [<ffffffff9828b935>] ? mntput_no_expire+0x5/0x3f0\n[  186.678739]  [<ffffffff9828b9be>] ? mntput_no_expire+0x8e/0x3f0\n[  186.678741]  [<ffffffff9828b935>] ? mntput_no_expire+0x5/0x3f0\n[  186.678743]  [<ffffffff9828bd44>] ? mntput+0x24/0x40\n[  186.678744]  [<ffffffff98267830>] ? __fput+0x190/0x200\n[  186.678746]  [<ffffffff9876f125>] __sys_sendmsg+0x45/0x80\n[  186.678748]  [<ffffffff9876f172>] SyS_sendmsg+0x12/0x20\n[  186.678749]  [<ffffffff988b5680>] entry_SYSCALL_64_fastpath+0x23/0xc1\n[  186.678751]  [<ffffffff980e2b8f>] ? trace_hardirqs_off_caller+0x1f/0xc0\n[  186.678752] ---[ end trace e224d66c5d8408b5 ]---\n\nSigned-off-by: Masami Hiramatsu <mhiramat@kernel.org>\nAcked-by: Arend van Spriel <arend.vanspriel@broadcom.com>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/b64abcb7dae6060c67ab0e548da3ef923c49641d"},{"sha":"89e1f6d2b956649fbe0704d543a90b8e0cf872b0","author":{"name":"Liping Zhang","email":"cd9ff7151e14549b0101e304a06236e97f6942de@spreadtrum.com"},"message":"netfilter: nft_reject: restrict to INPUT/FORWARD/OUTPUT\n\nAfter I add the nft rule \"nft add rule filter prerouting reject\nwith tcp reset\", kernel panic happened on my system:\n  NULL pointer dereference at ...\n  IP: [<ffffffff81b9db2f>] nf_send_reset+0xaf/0x400\n  Call Trace:\n  [<ffffffff81b9da80>] ? nf_reject_ip_tcphdr_get+0x160/0x160\n  [<ffffffffa0928061>] nft_reject_ipv4_eval+0x61/0xb0 [nft_reject_ipv4]\n  [<ffffffffa08e836a>] nft_do_chain+0x1fa/0x890 [nf_tables]\n  [<ffffffffa08e8170>] ? __nft_trace_packet+0x170/0x170 [nf_tables]\n  [<ffffffffa06e0900>] ? nf_ct_invert_tuple+0xb0/0xc0 [nf_conntrack]\n  [<ffffffffa07224d4>] ? nf_nat_setup_info+0x5d4/0x650 [nf_nat]\n  [...]\n\nBecause in the PREROUTING chain, routing information is not exist,\nthen we will dereference the NULL pointer and oops happen.\n\nSo we restrict reject expression to INPUT, FORWARD and OUTPUT chain.\nThis is consistent with iptables REJECT target.\n\nSigned-off-by: Liping Zhang <liping.zhang@spreadtrum.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/89e1f6d2b956649fbe0704d543a90b8e0cf872b0"},{"sha":"93fac10b99d78eb2c50a739cba2e590c7332d539","author":{"name":"Liping Zhang","email":"cd9ff7151e14549b0101e304a06236e97f6942de@spreadtrum.com"},"message":"netfilter: nfnetlink: use list_for_each_entry_safe to delete all objects\n\ncttimeout and acct objects are deleted from the list while traversing\nit, so use list_for_each_entry is unsafe here.\n\nSigned-off-by: Liping Zhang <liping.zhang@spreadtrum.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/93fac10b99d78eb2c50a739cba2e590c7332d539"},{"sha":"23aaba5ad55547db62bada5066c8fb6412d5b1c2","author":{"name":"Liping Zhang","email":"cd9ff7151e14549b0101e304a06236e97f6942de@spreadtrum.com"},"message":"netfilter: cttimeout: put back l4proto when replacing timeout policy\n\nWe forget to call nf_ct_l4proto_put when replacing the existing\ntimeout policy. Acctually, there's no need to get ct l4proto\nbefore doing replace, so we can move it to a later position.\n\nSigned-off-by: Liping Zhang <liping.zhang@spreadtrum.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/23aaba5ad55547db62bada5066c8fb6412d5b1c2"},{"sha":"533e33009897c7dd1b0424c0d4b3331b222d5681","author":{"name":"Liping Zhang","email":"cd9ff7151e14549b0101e304a06236e97f6942de@spreadtrum.com"},"message":"netfilter: cttimeout: unlink timeout objs in the unconfirmed ct lists\n\nKASAN reported this bug:\n  BUG: KASAN: use-after-free in icmp_packet+0x25/0x50 [nf_conntrack_ipv4] at\n  addr ffff880002db08c8\n  Read of size 4 by task lt-nf-queue/19041\n  Call Trace:\n  <IRQ>  [<ffffffff815eeebb>] dump_stack+0x63/0x88\n  [<ffffffff813386f8>] kasan_report_error+0x528/0x560\n  [<ffffffff81338cc8>] kasan_report+0x58/0x60\n  [<ffffffffa07393f5>] ? icmp_packet+0x25/0x50 [nf_conntrack_ipv4]\n  [<ffffffff81337551>] __asan_load4+0x61/0x80\n  [<ffffffffa07393f5>] icmp_packet+0x25/0x50 [nf_conntrack_ipv4]\n  [<ffffffffa06ecaa0>] nf_conntrack_in+0x550/0x980 [nf_conntrack]\n  [<ffffffffa06ec550>] ? __nf_conntrack_confirm+0xb10/0xb10 [nf_conntrack]\n  [ ... ]\n\nThe main reason is that we missed to unlink the timeout objects in the\nunconfirmed ct lists, so we will access the timeout objects that have\nalready been freed.\n\nSigned-off-by: Liping Zhang <liping.zhang@spreadtrum.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/OpenPhoenux/gta04-kernel/commits/533e33009897c7dd1b0424c0d4b3331b222d5681"}]}
{"actor":{"display_login":"op-mirror"}}