{"push_id":1122228587,"size":103,"distinct_size":0,"ref":"refs/heads/grsec-4.5","head":"b3b17759c116e4c75c5252f66b0f740cf6e73311","before":"08c46846ac8f9131c4ca2e6b10d140bea428c95a","commits":[{"sha":"ec176528312064f611a7d1ac3bbe16675e2ab97e","author":{"email":"f2c659f01951776204a6c5b902787d9019fbeebd@arndb.de","name":"Arnd Bergmann"},"message":"staging: wilc1000: remove extraneous variable\n\ncommit ce7b516f3f9e11fe4ee06fad0d7e853bb6e8f160 upstream.\n\nBuilding wilc1000 with clang currently fails in the staging-next branch:\n\ndrivers/staging/wilc1000/wilc_spi.c:123:34: warning: tentative definition of variable with internal linkage has incomplete non-array type 'const struct wilc1000_ops' [-Wtentative-definition-incomplete-type]\nstatic const struct wilc1000_ops wilc1000_spi_ops;\n\nThe reason is that wilc1000_ops was left behind after a recent cleanup,\nand is completely unused and also uninitialized and const and has an\nincomplete type.\n\nRemoving the variable is obviously correct, and gets rid of the warning.\nNo idea why gcc does not complain about it though.\n\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/ec176528312064f611a7d1ac3bbe16675e2ab97e"},{"sha":"7f4c2607942a70f47ea754c8c9d1a5b3244d2359","author":{"email":"fe08d3c717adf2ae63592e4c9aec6e3e404d8e3e@davemloft.net","name":"David S. Miller"},"message":"decnet: Do not build routes to devices without decnet private data.\n\n[ Upstream commit a36a0d4008488fa545c74445d69eaf56377d5d4e ]\n\nIn particular, make sure we check for decnet private presence\nfor loopback devices.\n\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/7f4c2607942a70f47ea754c8c9d1a5b3244d2359"},{"sha":"992ce0a3636c20b6399fdb6d83cf0c14fff4f815","author":{"email":"9a1dbcaaa599ef6209c13452baffa9a8bc42d893@windriver.com","name":"Chris Friesen"},"message":"route: do not cache fib route info on local routes with oif\n\n[ Upstream commit d6d5e999e5df67f8ec20b6be45e2229455ee3699 ]\n\nFor local routes that require a particular output interface we do not want\nto cache the result.  Caching the result causes incorrect behaviour when\nthere are multiple source addresses on the interface.  The end result\nbeing that if the intended recipient is waiting on that interface for the\npacket he won't receive it because it will be delivered on the loopback\ninterface and the IP_PKTINFO ipi_ifindex will be set to the loopback\ninterface as well.\n\nThis can be tested by running a program such as \"dhcp_release\" which\nattempts to inject a packet on a particular interface so that it is\nreceived by another program on the same board.  The receiving process\nshould see an IP_PKTINFO ipi_ifndex value of the source interface\n(e.g., eth1) instead of the loopback interface (e.g., lo).  The packet\nwill still appear on the loopback interface in tcpdump but the important\naspect is that the CMSG info is correct.\n\nSample dhcp_release command line:\n\n   dhcp_release eth1 192.168.204.222 02:11:33:22:44:66\n\nSigned-off-by: Allain Legacy <allain.legacy@windriver.com>\nSigned off-by: Chris Friesen <chris.friesen@windriver.com>\nReviewed-by: Julian Anastasov <ja@ssi.bg>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/992ce0a3636c20b6399fdb6d83cf0c14fff4f815"},{"sha":"555694a8f03fae56a5952436c21defd1b072150b","author":{"email":"64568d9183dcfcdd0a6fb47964820a1cdaf94ecc@googlemail.com","name":"Mathias Krause"},"message":"packet: fix heap info leak in PACKET_DIAG_MCLIST sock_diag interface\n\n[ Upstream commit 309cf37fe2a781279b7675d4bb7173198e532867 ]\n\nBecause we miss to wipe the remainder of i->addr[] in packet_mc_add(),\npdiag_put_mclist() leaks uninitialized heap bytes via the\nPACKET_DIAG_MCLIST netlink attribute.\n\nFix this by explicitly memset(0)ing the remaining bytes in i->addr[].\n\nFixes: eea68e2f1a00 (\"packet: Report socket mclist info via diag module\")\nSigned-off-by: Mathias Krause <minipli@googlemail.com>\nCc: Eric W. Biederman <ebiederm@xmission.com>\nCc: Pavel Emelyanov <xemul@parallels.com>\nAcked-by: Pavel Emelyanov <xemul@virtuozzo.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/555694a8f03fae56a5952436c21defd1b072150b"},{"sha":"e4bb8baf1c4dabce8e704704c46701051988bd9d","author":{"email":"1d97cfc5fb388c4688c33bd5725768599fb08430@axis.com","name":"Lars Persson"},"message":"net: sched: do not requeue a NULL skb\n\n[ Upstream commit 3dcd493fbebfd631913df6e2773cc295d3bf7d22 ]\n\nA failure in validate_xmit_skb_list() triggered an unconditional call\nto dev_requeue_skb with skb=NULL. This slowly grows the queue\ndiscipline's qlen count until all traffic through the queue stops.\n\nWe take the optimistic approach and continue running the queue after a\nfailure since it is unknown if later packets also will fail in the\nvalidate path.\n\nFixes: 55a93b3ea780 (\"qdisc: validate skb without holding lock\")\nSigned-off-by: Lars Persson <larper@axis.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/e4bb8baf1c4dabce8e704704c46701051988bd9d"},{"sha":"682c5a13beec6c33d8b65fa4ae612f1c74033d63","author":{"email":"c24c0248770ae98831f8a654310d4c2e07514c61@fb.com","name":"Alexei Starovoitov"},"message":"bpf/verifier: reject invalid LD_ABS | BPF_DW instruction\n\n[ Upstream commit d82bccc69041a51f7b7b9b4a36db0772f4cdba21 ]\n\nverifier must check for reserved size bits in instruction opcode and\nreject BPF_LD | BPF_ABS | BPF_DW and BPF_LD | BPF_IND | BPF_DW instructions,\notherwise interpreter will WARN_RATELIMIT on them during execution.\n\nFixes: ddd872bc3098 (\"bpf: verifier: add checks for BPF_ABS | BPF_IND instructions\")\nSigned-off-by: Alexei Starovoitov <ast@kernel.org>\nAcked-by: Daniel Borkmann <daniel@iogearbox.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/682c5a13beec6c33d8b65fa4ae612f1c74033d63"},{"sha":"62862f1047561038739d9ee09a92b554fc3da6d3","author":{"email":"8a2957e0063f2abf61bd145b6236a74a3708ac54@mork.no","name":"Bjørn Mork"},"message":"cdc_mbim: apply \"NDP to end\" quirk to all Huawei devices\n\n[ Upstream commit c5b5343cfbc9f46af65033fa4f407d7b7d98371d ]\n\nWe now have a positive report of another Huawei device needing\nthis quirk: The ME906s-158 (12d1:15c1).  This is an m.2 form\nfactor modem with no obvious relationship to the E3372 (12d1:157d)\nwe already have a quirk entry for.  This is reason enough to\nbelieve the quirk might be necessary for any number of current\nand future Huawei devices.\n\nApplying the quirk to all Huawei devices, since it is crucial\nto any device affected by the firmware bug, while the impact\non non-affected devices is negligible.\n\nThe quirk can if necessary be disabled per-device by writing\nN to /sys/class/net/<iface>/cdc_ncm/ndp_to_end\n\nReported-by: Andreas Fett <andreas.fett@secunet.com>\nSigned-off-by: Bjørn Mork <bjorn@mork.no>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/62862f1047561038739d9ee09a92b554fc3da6d3"},{"sha":"5ac8f80af2fb18f1db0afacae3276901e17809ea","author":{"email":"7ade005bf5e28e902b430bf86b336fa577fceee8@google.com","name":"Craig Gallek"},"message":"soreuseport: fix ordering for mixed v4/v6 sockets\n\n[ Upstream commit d894ba18d4e449b3a7f6eb491f16c9e02933736e ]\n\nWith the SO_REUSEPORT socket option, it is possible to create sockets\nin the AF_INET and AF_INET6 domains which are bound to the same IPv4 address.\nThis is only possible with SO_REUSEPORT and when not using IPV6_V6ONLY on\nthe AF_INET6 sockets.\n\nPrior to the commits referenced below, an incoming IPv4 packet would\nalways be routed to a socket of type AF_INET when this mixed-mode was used.\nAfter those changes, the same packet would be routed to the most recently\nbound socket (if this happened to be an AF_INET6 socket, it would\nhave an IPv4 mapped IPv6 address).\n\nThe change in behavior occurred because the recent SO_REUSEPORT optimizations\nshort-circuit the socket scoring logic as soon as they find a match.  They\ndid not take into account the scoring logic that favors AF_INET sockets\nover AF_INET6 sockets in the event of a tie.\n\nTo fix this problem, this patch changes the insertion order of AF_INET\nand AF_INET6 addresses in the TCP and UDP socket lists when the sockets\nhave SO_REUSEPORT set.  AF_INET sockets will be inserted at the head of the\nlist and AF_INET6 sockets with SO_REUSEPORT set will always be inserted at\nthe tail of the list.  This will force AF_INET sockets to always be\nconsidered first.\n\nFixes: e32ea7e74727 (\"soreuseport: fast reuseport UDP socket selection\")\nFixes: 125e80b88687 (\"soreuseport: fast reuseport TCP socket selection\")\n\nReported-by: Maciej Żenczykowski <maze@google.com>\nSigned-off-by: Craig Gallek <kraig@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/5ac8f80af2fb18f1db0afacae3276901e17809ea"},{"sha":"9a11c27b88032a88b882a2ff6b2265f975145197","author":{"email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@iogearbox.net","name":"Daniel Borkmann"},"message":"net: use skb_postpush_rcsum instead of own implementations\n\n[ Upstream commit 6b83d28a55a891a9d70fc61ccb1c138e47dcbe74 ]\n\nReplace individual implementations with the recently introduced\nskb_postpush_rcsum() helper.\n\nSigned-off-by: Daniel Borkmann <daniel@iogearbox.net>\nAcked-by: Tom Herbert <tom@herbertland.com>\nAcked-by: Alexei Starovoitov <ast@kernel.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/9a11c27b88032a88b882a2ff6b2265f975145197"},{"sha":"2b1e1a75e30807a9d767f28e85a01acb0a521049","author":{"email":"3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@iogearbox.net","name":"Daniel Borkmann"},"message":"vlan: pull on __vlan_insert_tag error path and fix csum correction\n\n[ Upstream commit 9241e2df4fbc648a92ea0752918e05c26255649e ]\n\nWhen __vlan_insert_tag() fails from skb_vlan_push() path due to the\nskb_cow_head(), we need to undo the __skb_push() in the error path\nas well that was done earlier to move skb->data pointer to mac header.\n\nMoreover, I noticed that when in the non-error path the __skb_pull()\nis done and the original offset to mac header was non-zero, we fixup\nfrom a wrong skb->data offset in the checksum complete processing.\n\nSo the skb_postpush_rcsum() really needs to be done before __skb_pull()\nwhere skb->data still points to the mac header start and thus operates\nunder the same conditions as in __vlan_insert_tag().\n\nFixes: 93515d53b133 (\"net: move vlan pop/push functions into common code\")\nSigned-off-by: Daniel Borkmann <daniel@iogearbox.net>\nReviewed-by: Jiri Pirko <jiri@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/2b1e1a75e30807a9d767f28e85a01acb0a521049"},{"sha":"a8be898cdbd0094677c5c908d37447c51b113c37","author":{"email":"16a9a54ddf4259952e3c118c763138e83693d7fd@ovn.org","name":"Joe Stringer"},"message":"openvswitch: Orphan skbs before IPv6 defrag\n\n[ Upstream commit 49e261a8a21e0960a3f7ff187a453ba1c1149053 ]\n\nThis is the IPv6 counterpart to commit 8282f27449bf (\"inet: frag: Always\norphan skbs inside ip_defrag()\").\n\nPrior to commit 029f7f3b8701 (\"netfilter: ipv6: nf_defrag: avoid/free\nclone operations\"), ipv6 fragments sent to nf_ct_frag6_gather() would be\ncloned (implicitly orphaning) prior to queueing for reassembly. As such,\nwhen the IPv6 message is eventually reassembled, the skb->sk for all\nfragments would be NULL. After that commit was introduced, rather than\ncloning, the original skbs were queued directly without orphaning. The\nend result is that all frags except for the first and last may have a\nsocket attached.\n\nThis commit explicitly orphans such skbs during nf_ct_frag6_gather() to\nprevent BUG_ON(skb->sk) during a later call to ip6_fragment().\n\nkernel BUG at net/ipv6/ip6_output.c:631!\n[...]\nCall Trace:\n <IRQ>\n [<ffffffff810be8f7>] ? __lock_acquire+0x927/0x20a0\n [<ffffffffa042c7c0>] ? do_output.isra.28+0x1b0/0x1b0 [openvswitch]\n [<ffffffff810bb8a2>] ? __lock_is_held+0x52/0x70\n [<ffffffffa042c587>] ovs_fragment+0x1f7/0x280 [openvswitch]\n [<ffffffff810bdab5>] ? mark_held_locks+0x75/0xa0\n [<ffffffff817be416>] ? _raw_spin_unlock_irqrestore+0x36/0x50\n [<ffffffff81697ea0>] ? dst_discard_out+0x20/0x20\n [<ffffffff81697e80>] ? dst_ifdown+0x80/0x80\n [<ffffffffa042c703>] do_output.isra.28+0xf3/0x1b0 [openvswitch]\n [<ffffffffa042d279>] do_execute_actions+0x709/0x12c0 [openvswitch]\n [<ffffffffa04340a4>] ? ovs_flow_stats_update+0x74/0x1e0 [openvswitch]\n [<ffffffffa04340d1>] ? ovs_flow_stats_update+0xa1/0x1e0 [openvswitch]\n [<ffffffff817be387>] ? _raw_spin_unlock+0x27/0x40\n [<ffffffffa042de75>] ovs_execute_actions+0x45/0x120 [openvswitch]\n [<ffffffffa0432d65>] ovs_dp_process_packet+0x85/0x150 [openvswitch]\n [<ffffffff817be387>] ? _raw_spin_unlock+0x27/0x40\n [<ffffffffa042def4>] ovs_execute_actions+0xc4/0x120 [openvswitch]\n [<ffffffffa0432d65>] ovs_dp_process_packet+0x85/0x150 [openvswitch]\n [<ffffffffa04337f2>] ? key_extract+0x442/0xc10 [openvswitch]\n [<ffffffffa043b26d>] ovs_vport_receive+0x5d/0xb0 [openvswitch]\n [<ffffffff810be8f7>] ? __lock_acquire+0x927/0x20a0\n [<ffffffff810be8f7>] ? __lock_acquire+0x927/0x20a0\n [<ffffffff810be8f7>] ? __lock_acquire+0x927/0x20a0\n [<ffffffff817be416>] ? _raw_spin_unlock_irqrestore+0x36/0x50\n [<ffffffffa043c11d>] internal_dev_xmit+0x6d/0x150 [openvswitch]\n [<ffffffffa043c0b5>] ? internal_dev_xmit+0x5/0x150 [openvswitch]\n [<ffffffff8168fb5f>] dev_hard_start_xmit+0x2df/0x660\n [<ffffffff8168f5ea>] ? validate_xmit_skb.isra.105.part.106+0x1a/0x2b0\n [<ffffffff81690925>] __dev_queue_xmit+0x8f5/0x950\n [<ffffffff81690080>] ? __dev_queue_xmit+0x50/0x950\n [<ffffffff810bdab5>] ? mark_held_locks+0x75/0xa0\n [<ffffffff81690990>] dev_queue_xmit+0x10/0x20\n [<ffffffff8169a418>] neigh_resolve_output+0x178/0x220\n [<ffffffff81752759>] ? ip6_finish_output2+0x219/0x7b0\n [<ffffffff81752759>] ip6_finish_output2+0x219/0x7b0\n [<ffffffff817525a5>] ? ip6_finish_output2+0x65/0x7b0\n [<ffffffff816cde2b>] ? ip_idents_reserve+0x6b/0x80\n [<ffffffff8175488f>] ? ip6_fragment+0x93f/0xc50\n [<ffffffff81754af1>] ip6_fragment+0xba1/0xc50\n [<ffffffff81752540>] ? ip6_flush_pending_frames+0x40/0x40\n [<ffffffff81754c6b>] ip6_finish_output+0xcb/0x1d0\n [<ffffffff81754dcf>] ip6_output+0x5f/0x1a0\n [<ffffffff81754ba0>] ? ip6_fragment+0xc50/0xc50\n [<ffffffff81797fbd>] ip6_local_out+0x3d/0x80\n [<ffffffff817554df>] ip6_send_skb+0x2f/0xc0\n [<ffffffff817555bd>] ip6_push_pending_frames+0x4d/0x50\n [<ffffffff817796cc>] icmpv6_push_pending_frames+0xac/0xe0\n [<ffffffff8177a4be>] icmpv6_echo_reply+0x42e/0x500\n [<ffffffff8177acbf>] icmpv6_rcv+0x4cf/0x580\n [<ffffffff81755ac7>] ip6_input_finish+0x1a7/0x690\n [<ffffffff81755925>] ? ip6_input_finish+0x5/0x690\n [<ffffffff817567a0>] ip6_input+0x30/0xa0\n [<ffffffff81755920>] ? ip6_rcv_finish+0x1a0/0x1a0\n [<ffffffff817557ce>] ip6_rcv_finish+0x4e/0x1a0\n [<ffffffff8175640f>] ipv6_rcv+0x45f/0x7c0\n [<ffffffff81755fe6>] ? ipv6_rcv+0x36/0x7c0\n [<ffffffff81755780>] ? ip6_make_skb+0x1c0/0x1c0\n [<ffffffff8168b649>] __netif_receive_skb_core+0x229/0xb80\n [<ffffffff810bdab5>] ? mark_held_locks+0x75/0xa0\n [<ffffffff8168c07f>] ? process_backlog+0x6f/0x230\n [<ffffffff8168bfb6>] __netif_receive_skb+0x16/0x70\n [<ffffffff8168c088>] process_backlog+0x78/0x230\n [<ffffffff8168c0ed>] ? process_backlog+0xdd/0x230\n [<ffffffff8168db43>] net_rx_action+0x203/0x480\n [<ffffffff810bdab5>] ? mark_held_locks+0x75/0xa0\n [<ffffffff817c156e>] __do_softirq+0xde/0x49f\n [<ffffffff81752768>] ? ip6_finish_output2+0x228/0x7b0\n [<ffffffff817c070c>] do_softirq_own_stack+0x1c/0x30\n <EOI>\n [<ffffffff8106f88b>] do_softirq.part.18+0x3b/0x40\n [<ffffffff8106f946>] __local_bh_enable_ip+0xb6/0xc0\n [<ffffffff81752791>] ip6_finish_output2+0x251/0x7b0\n [<ffffffff81754af1>] ? ip6_fragment+0xba1/0xc50\n [<ffffffff816cde2b>] ? ip_idents_reserve+0x6b/0x80\n [<ffffffff8175488f>] ? ip6_fragment+0x93f/0xc50\n [<ffffffff81754af1>] ip6_fragment+0xba1/0xc50\n [<ffffffff81752540>] ? ip6_flush_pending_frames+0x40/0x40\n [<ffffffff81754c6b>] ip6_finish_output+0xcb/0x1d0\n [<ffffffff81754dcf>] ip6_output+0x5f/0x1a0\n [<ffffffff81754ba0>] ? ip6_fragment+0xc50/0xc50\n [<ffffffff81797fbd>] ip6_local_out+0x3d/0x80\n [<ffffffff817554df>] ip6_send_skb+0x2f/0xc0\n [<ffffffff817555bd>] ip6_push_pending_frames+0x4d/0x50\n [<ffffffff81778558>] rawv6_sendmsg+0xa28/0xe30\n [<ffffffff81719097>] ? inet_sendmsg+0xc7/0x1d0\n [<ffffffff817190d6>] inet_sendmsg+0x106/0x1d0\n [<ffffffff81718fd5>] ? inet_sendmsg+0x5/0x1d0\n [<ffffffff8166d078>] sock_sendmsg+0x38/0x50\n [<ffffffff8166d4d6>] SYSC_sendto+0xf6/0x170\n [<ffffffff8100201b>] ? trace_hardirqs_on_thunk+0x1b/0x1d\n [<ffffffff8166e38e>] SyS_sendto+0xe/0x10\n [<ffffffff817bebe5>] entry_SYSCALL_64_fastpath+0x18/0xa8\nCode: 06 48 83 3f 00 75 26 48 8b 87 d8 00 00 00 2b 87 d0 00 00 00 48 39 d0 72 14 8b 87 e4 00 00 00 83 f8 01 75 09 48 83 7f 18 00 74 9a <0f> 0b 41 8b 86 cc 00 00 00 49 8#\nRIP  [<ffffffff8175468a>] ip6_fragment+0x73a/0xc50\n RSP <ffff880072803120>\n\nFixes: 029f7f3b8701 (\"netfilter: ipv6: nf_defrag: avoid/free clone\noperations\")\nReported-by: Daniele Di Proietto <diproiettod@vmware.com>\nSigned-off-by: Joe Stringer <joe@ovn.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/a8be898cdbd0094677c5c908d37447c51b113c37"},{"sha":"11236cf9aef1402ddc1734409d89d3ad76e5eddc","author":{"email":"73675debcd8a436be48ec22211dcf44fe0df0a64@decadent.org.uk","name":"Ben Hutchings"},"message":"atl2: Disable unimplemented scatter/gather feature\n\n[ Upstream commit f43bfaeddc79effbf3d0fcb53ca477cca66f3db8 ]\n\natl2 includes NETIF_F_SG in hw_features even though it has no support\nfor non-linear skbs.  This bug was originally harmless since the\ndriver does not claim to implement checksum offload and that used to\nbe a requirement for SG.\n\nNow that SG and checksum offload are independent features, if you\nexplicitly enable SG *and* use one of the rare protocols that can use\nSG without checkusm offload, this potentially leaks sensitive\ninformation (before you notice that it just isn't working).  Therefore\nthis obscure bug has been designated CVE-2016-2117.\n\nReported-by: Justin Yackoski <jyackoski@crypto-nite.com>\nSigned-off-by: Ben Hutchings <ben@decadent.org.uk>\nFixes: ec5f06156423 (\"net: Kill link between CSUM and SG features.\")\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/11236cf9aef1402ddc1734409d89d3ad76e5eddc"},{"sha":"0c056cfb4195db32a96a82640dd3f0f6ac48131a","author":{"email":"3292324943adc2eb4010fbebf00756fa1d724198@netronome.com","name":"Simon Horman"},"message":"openvswitch: use flow protocol when recalculating ipv6 checksums\n\n[ Upstream commit b4f70527f052b0c00be4d7cac562baa75b212df5 ]\n\nWhen using masked actions the ipv6_proto field of an action\nto set IPv6 fields may be zero rather than the prevailing protocol\nwhich will result in skipping checksum recalculation.\n\nThis patch resolves the problem by relying on the protocol\nin the flow key rather than that in the set field action.\n\nFixes: 83d2b9ba1abc (\"net: openvswitch: Support masked set actions.\")\nCc: Jarno Rajahalme <jrajahalme@nicira.com>\nSigned-off-by: Simon Horman <simon.horman@netronome.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/0c056cfb4195db32a96a82640dd3f0f6ac48131a"},{"sha":"2eeed9d5da7c144c9e1dda81094b9cb711333cb2","author":{"email":"0ef294d941b45c360068d83f3bb3543c1c5a43da@mellanox.com","name":"Maor Gottlieb"},"message":"net/mlx5_core: Fix soft lockup in steering error flow\n\n[ Upstream commit c3f9bf628bc7edda298897d952f5e761137229c9 ]\n\nIn the error flow of adding flow rule to auto-grouped flow\ntable, we call to tree_remove_node.\n\ntree_remove_node locks the node's parent, however the node's parent\nis already locked by mlx5_add_flow_rule and this causes a deadlock.\nAfter this patch, if we failed to add the flow rule, we unlock the\nflow table before calling to tree_remove_node.\n\nfixes: f0d22d187473 ('net/mlx5_core: Introduce flow steering autogrouped\nflow table')\nSigned-off-by: Maor Gottlieb <maorg@mellanox.com>\nReported-by: Amir Vadai <amir@vadai.me>\nSigned-off-by: Saeed Mahameed <saeedm@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/2eeed9d5da7c144c9e1dda81094b9cb711333cb2"},{"sha":"88e2d2d2eb82a0f3c96a19868dbe30dac219cd47","author":{"email":"0a17f7549b0bac96abb27a38bc47f122efaba664@mellanox.com","name":"Saeed Mahameed"},"message":"net/mlx5e: Device's mtu field is u16 and not int\n\n[ Upstream commit 046339eaab26804f52f6604877f5674f70815b26 ]\n\nFor set/query MTU port firmware commands the MTU field\nis 16 bits, here I changed all the \"int mtu\" parameters\nof the functions wrapping those firmware commands to be u16.\n\nSigned-off-by: Saeed Mahameed <saeedm@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/88e2d2d2eb82a0f3c96a19868dbe30dac219cd47"},{"sha":"99d966897d7b50279297aeeb25d6f32b84109879","author":{"email":"0a17f7549b0bac96abb27a38bc47f122efaba664@mellanox.com","name":"Saeed Mahameed"},"message":"net/mlx5e: Fix minimum MTU\n\n[ Upstream commit d8edd2469ace550db707798180d1c84d81f93bca ]\n\nMinimum MTU that can be set in Connectx4 device is 68.\n\nThis fixes the case where a user wants to set invalid MTU,\nthe driver will fail to satisfy this request and the interface\nwill stay down.\n\nIt is better to report an error and continue working with old\nmtu.\n\nSigned-off-by: Saeed Mahameed <saeedm@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/99d966897d7b50279297aeeb25d6f32b84109879"},{"sha":"186654f41a99acbedef6f77c673f1a28636b29e4","author":{"email":"0a17f7549b0bac96abb27a38bc47f122efaba664@mellanox.com","name":"Saeed Mahameed"},"message":"net/mlx5e: Use vport MTU rather than physical port MTU\n\n[ Upstream commit cd255efff9baadd654d6160e52d17ae7c568c9d3 ]\n\nSet and report vport MTU rather than physical MTU,\nDriver will set both vport and physical port mtu and will\nrely on the query of vport mtu.\n\nSRIOV VFs have to report their MTU to their vport manager (PF),\nand this will allow them to work with any MTU they need\nwithout failing the request.\n\nAlso for some cases where the PF is not a port owner, PF can\nwork with MTU less than the physical port mtu if set physical\nport mtu didn't take effect.\n\nSigned-off-by: Saeed Mahameed <saeedm@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/186654f41a99acbedef6f77c673f1a28636b29e4"},{"sha":"698faa8f415febe9fa6231ab55fb4aa5a78d9b28","author":{"email":"6e4ffc2e3438feb7acb34f6b67e6ae17e700099c@redhat.com","name":"Paolo Abeni"},"message":"ipv4/fib: don't warn when primary address is missing if in_dev is dead\n\n[ Upstream commit 391a20333b8393ef2e13014e6e59d192c5594471 ]\n\nAfter commit fbd40ea0180a (\"ipv4: Don't do expensive useless work\nduring inetdev destroy.\") when deleting an interface,\nfib_del_ifaddr() can be executed without any primary address\npresent on the dead interface.\n\nThe above is safe, but triggers some \"bug: prim == NULL\" warnings.\n\nThis commit avoids warning if the in_dev is dead\n\nSigned-off-by: Paolo Abeni <pabeni@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/698faa8f415febe9fa6231ab55fb4aa5a78d9b28"},{"sha":"7d57af4f11f18b6aa48e5f083ada67fac917612e","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"net/mlx4_en: fix spurious timestamping callbacks\n\n[ Upstream commit fc96256c906362e845d848d0f6a6354450059e81 ]\n\nWhen multiple skb are TX-completed in a row, we might incorrectly keep\na timestamp of a prior skb and cause extra work.\n\nFixes: ec693d47010e8 (\"net/mlx4_en: Add HW timestamping (TS) support\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Willem de Bruijn <willemb@google.com>\nReviewed-by: Eran Ben Elisha <eranbe@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/7d57af4f11f18b6aa48e5f083ada67fac917612e"},{"sha":"2ffd01aa8d12c83c43b611a74a09852ea4dd0111","author":{"email":"0fcb39c6619aeb747ed6898bfde644ba26b24452@google.com","name":"Jann Horn"},"message":"bpf: fix double-fdput in replace_map_fd_with_map_ptr()\n\n[ Upstream commit 8358b02bf67d3a5d8a825070e1aa73f25fb2e4c7 ]\n\nWhen bpf(BPF_PROG_LOAD, ...) was invoked with a BPF program whose bytecode\nreferences a non-map file descriptor as a map file descriptor, the error\nhandling code called fdput() twice instead of once (in __bpf_map_get() and\nin replace_map_fd_with_map_ptr()). If the file descriptor table of the\ncurrent task is shared, this causes f_count to be decremented too much,\nallowing the struct file to be freed while it is still in use\n(use-after-free). This can be exploited to gain root privileges by an\nunprivileged user.\n\nThis bug was introduced in\ncommit 0246e64d9a5f (\"bpf: handle pseudo BPF_LD_IMM64 insn\"), but is only\nexploitable since\ncommit 1be7f75d1668 (\"bpf: enable non-root eBPF programs\") because\npreviously, CAP_SYS_ADMIN was required to reach the vulnerable code.\n\n(posted publicly according to request by maintainer)\n\nSigned-off-by: Jann Horn <jannh@google.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nAcked-by: Alexei Starovoitov <ast@kernel.org>\nAcked-by: Daniel Borkmann <daniel@iogearbox.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/linux-scraping/linux-grsecurity/commits/2ffd01aa8d12c83c43b611a74a09852ea4dd0111"}]}
{"actor":{"display_login":"scrapenbump"}}