{"push_id":1013913101,"size":119,"distinct_size":119,"ref":"refs/heads/3.12","head":"eb5b249d679c3204622c91d6e81d2cfd49d7ef50","before":"6c85c95cb36319078dc79ad4e1c5777202c54567","commits":[{"sha":"fa69c2b418d7aaae8d14810caecc9bfe3f44b4e5","author":{"email":"d5d4cd07616a542891b7ec2d0257b3a24b69856e@pobox.com","name":"Corey Wright"},"message":"proc: Fix ptrace-based permission checks for accessing task maps\n\nModify mm_access() calls in fs/proc/task_mmu.c and fs/proc/task_nommu.c to\nhave the mode include PTRACE_MODE_FSCREDS so accessing /proc/pid/maps and\n/proc/pid/pagemap is not denied to all users.\n\nIn backporting upstream commit caaee623 to pre-3.18 kernel versions it was\noverlooked that mm_access() is used in fs/proc/task_*mmu.c as those calls\nwere removed in 3.18 (by upstream commit 29a40ace) and did not exist at the\ntime of the original commit.\n\nFixes: caaee6234d (\"ptrace: use fsuid, fsgid, effective creds for fs access checks\")\nSigned-off-by: Corey Wright <undefined@pobox.com>\nAcked-by: Jann Horn <jann@thejh.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/fa69c2b418d7aaae8d14810caecc9bfe3f44b4e5"},{"sha":"6308e3add5288c1eb1b7ee2654d9a251cc487ab2","author":{"email":"80e886ddfd1f0046841c2d07e66ecf430023b0ba@ti.com","name":"Bin Liu"},"message":"usb: musb: cppi41: correct the macro name EP_MODE_AUTOREG_*\n\ncommit 0149b07a9e28b0d8bd2fc1c238ffe7d530c2673f upstream.\n\nThe macro EP_MODE_AUTOREG_* should be called EP_MODE_AUTOREQ_*, as they\nare used for register AUTOREQ.\n\nSigned-off-by: Bin Liu <b-liu@ti.com>\nSigned-off-by: Felipe Balbi <balbi@ti.com>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/6308e3add5288c1eb1b7ee2654d9a251cc487ab2"},{"sha":"28103f2f1fb676a2b305ed6e15f83a8a84906d45","author":{"email":"3498481c3b1fee38251ffe7b781cda34b574142e@de.ibm.com","name":"Ursula Braun"},"message":"af_iucv: Validate socket address length in iucv_sock_bind()\n\n[ Upstream commit 52a82e23b9f2a9e1d429c5207f8575784290d008 ]\n\nSigned-off-by: Ursula Braun <ursula.braun@de.ibm.com>\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nReviewed-by: Evgeny Cherkashin <Eugene.Crosser@ru.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/28103f2f1fb676a2b305ed6e15f83a8a84906d45"},{"sha":"5e67dbf09bb4dc9c7745e1d94d67e9e857d1ff7c","author":{"email":"e17b48251daf63f9206dd189a54029599746ec67@omicron.at","name":"Manfred Rudigier"},"message":"net: dp83640: Fix tx timestamp overflow handling.\n\n[ Upstream commit 81e8f2e930fe76b9814c71b9d87c30760b5eb705 ]\n\nPHY status frames are not reliable, the PHY may not be able to send them\nduring heavy receive traffic. This overflow condition is signaled by the\nPHY in the next status frame, but the driver did not make use of it.\nInstead it always reported wrong tx timestamps to user space after an\noverflow happened because it assigned newly received tx timestamps to old\npackets in the queue.\n\nThis commit fixes this issue by clearing the tx timestamp queue every time\nan overflow happens, so that no timestamps are delivered for overflow\npackets. This way time stamping will continue correctly after an overflow.\n\nSigned-off-by: Manfred Rudigier <manfred.rudigier@omicron.at>\nAcked-by: Richard Cochran <richardcochran@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/5e67dbf09bb4dc9c7745e1d94d67e9e857d1ff7c"},{"sha":"dd5626c81b249bbef45c4c4af2753a8f2ab1f1f6","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"tcp: fix NULL deref in tcp_v4_send_ack()\n\n[ Upstream commit e62a123b8ef7c5dc4db2c16383d506860ad21b47 ]\n\nNeal reported crashes with this stack trace :\n\n RIP: 0010:[<ffffffff8c57231b>] tcp_v4_send_ack+0x41/0x20f\n...\n CR2: 0000000000000018 CR3: 000000044005c000 CR4: 00000000001427e0\n...\n  [<ffffffff8c57258e>] tcp_v4_reqsk_send_ack+0xa5/0xb4\n  [<ffffffff8c1a7caa>] tcp_check_req+0x2ea/0x3e0\n  [<ffffffff8c19e420>] tcp_rcv_state_process+0x850/0x2500\n  [<ffffffff8c1a6d21>] tcp_v4_do_rcv+0x141/0x330\n  [<ffffffff8c56cdb2>] sk_backlog_rcv+0x21/0x30\n  [<ffffffff8c098bbd>] tcp_recvmsg+0x75d/0xf90\n  [<ffffffff8c0a8700>] inet_recvmsg+0x80/0xa0\n  [<ffffffff8c17623e>] sock_aio_read+0xee/0x110\n  [<ffffffff8c066fcf>] do_sync_read+0x6f/0xa0\n  [<ffffffff8c0673a1>] SyS_read+0x1e1/0x290\n  [<ffffffff8c5ca262>] system_call_fastpath+0x16/0x1b\n\nThe problem here is the skb we provide to tcp_v4_send_ack() had to\nbe parked in the backlog of a new TCP fastopen child because this child\nwas owned by the user at the time an out of window packet arrived.\n\nBefore queuing a packet, TCP has to set skb->dev to NULL as the device\ncould disappear before packet is removed from the queue.\n\nFix this issue by using the net pointer provided by the socket (being a\ntimewait or a request socket).\n\nIPv6 is immune to the bug : tcp_v6_send_response() already gets the net\npointer from the socket if provided.\n\nFixes: 168a8f58059a (\"tcp: TCP Fast Open Server - main code path\")\nReported-by: Neal Cardwell <ncardwell@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Jerry Chu <hkchu@google.com>\nCc: Yuchung Cheng <ycheng@google.com>\nAcked-by: Neal Cardwell <ncardwell@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/dd5626c81b249bbef45c4c4af2753a8f2ab1f1f6"},{"sha":"45c4c852c8ab5fb7e879892afa665dc47e55956d","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"af_unix: fix struct pid memory leak\n\n[ Upstream commit fa0dc04df259ba2df3ce1920e9690c7842f8fa4b ]\n\nDmitry reported a struct pid leak detected by a syzkaller program.\n\nBug happens in unix_stream_recvmsg() when we break the loop when a\nsignal is pending, without properly releasing scm.\n\nFixes: b3ca9b02b007 (\"net: fix multithreaded signal handling in unix recv routines\")\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Rainer Weikusat <rweikusat@mobileactivedefense.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/45c4c852c8ab5fb7e879892afa665dc47e55956d"},{"sha":"977abf5d26c2697f09c72efc579a759dcc6a4808","author":{"email":"331be22c6b63ca3e0a03d408c2d906b1b02cd5f2@stressinduktion.org","name":"Hannes Frederic Sowa"},"message":"pptp: fix illegal memory access caused by multiple bind()s\n\n[ Upstream commit 9a368aff9cb370298fa02feeffa861f2db497c18 ]\n\nSeveral times already this has been reported as kasan reports caused by\nsyzkaller and trinity and people always looked at RCU races, but it is\nmuch more simple. :)\n\nIn case we bind a pptp socket multiple times, we simply add it to\nthe callid_sock list but don't remove the old binding. Thus the old\nsocket stays in the bucket with unused call_id indexes and doesn't get\ncleaned up. This causes various forms of kasan reports which were hard\nto pinpoint.\n\nSimply don't allow multiple binds and correct error handling in\npptp_bind. Also keep sk_state bits in place in pptp_connect.\n\nFixes: 00959ade36acad (\"PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)\")\nCc: Dmitry Kozlov <xeb@mail.ru>\nCc: Sasha Levin <sasha.levin@oracle.com>\nCc: Dmitry Vyukov <dvyukov@google.com>\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nCc: Dave Jones <davej@codemonkey.org.uk>\nReported-by: Dave Jones <davej@codemonkey.org.uk>\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/977abf5d26c2697f09c72efc579a759dcc6a4808"},{"sha":"63593b05a47bd00a5dd843f836762829791bbc92","author":{"email":"7fc7fc98bf391a9b9f95a773bac29e7d60cc65b5@gmail.com","name":"Marcelo Ricardo Leitner"},"message":"sctp: allow setting SCTP_SACK_IMMEDIATELY by the application\n\n[ Upstream commit 27f7ed2b11d42ab6d796e96533c2076ec220affc ]\n\nThis patch extends commit b93d6471748d (\"sctp: implement the sender side\nfor SACK-IMMEDIATELY extension\") as it didn't white list\nSCTP_SACK_IMMEDIATELY on sctp_msghdr_parse(), causing it to be\nunderstood as an invalid flag and returning -EINVAL to the application.\n\nNote that the actual handling of the flag is already there in\nsctp_datamsg_from_user().\n\nhttps://tools.ietf.org/html/rfc7053#section-7\n\nFixes: b93d6471748d (\"sctp: implement the sender side for SACK-IMMEDIATELY extension\")\nSigned-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>\nAcked-by: Vlad Yasevich <vyasevich@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/63593b05a47bd00a5dd843f836762829791bbc92"},{"sha":"22d310aa03b6009f252c1c53fe2adb5b0919f330","author":{"email":"6e4ffc2e3438feb7acb34f6b67e6ae17e700099c@redhat.com","name":"Paolo Abeni"},"message":"ipv6/udp: use sticky pktinfo egress ifindex on connect()\n\n[ Upstream commit 1cdda91871470f15e79375991bd2eddc6e86ddb1 ]\n\nCurrently, the egress interface index specified via IPV6_PKTINFO\nis ignored by __ip6_datagram_connect(), so that RFC 3542 section 6.7\ncan be subverted when the user space application calls connect()\nbefore sendmsg().\nFix it by initializing properly flowi6_oif in connect() before\nperforming the route lookup.\n\nSigned-off-by: Paolo Abeni <pabeni@redhat.com>\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/22d310aa03b6009f252c1c53fe2adb5b0919f330"},{"sha":"e16f537864eb9cf68683d9e107706d1b31fcaa76","author":{"email":"f18dd0be96fb7338348dc2439a86c9a4ef8ef3b9@gmail.com","name":"Hangbin Liu"},"message":"net/ipv6: add sysctl option accept_ra_min_hop_limit\n\n[ Upstream commit 8013d1d7eafb0589ca766db6b74026f76b7f5cb4 ]\n\nCommit 6fd99094de2b (\"ipv6: Don't reduce hop limit for an interface\")\ndisabled accept hop limit from RA if it is smaller than the current hop\nlimit for security stuff. But this behavior kind of break the RFC definition.\n\nRFC 4861, 6.3.4.  Processing Received Router Advertisements\n   A Router Advertisement field (e.g., Cur Hop Limit, Reachable Time,\n   and Retrans Timer) may contain a value denoting that it is\n   unspecified.  In such cases, the parameter should be ignored and the\n   host should continue using whatever value it is already using.\n\n   If the received Cur Hop Limit value is non-zero, the host SHOULD set\n   its CurHopLimit variable to the received value.\n\nSo add sysctl option accept_ra_min_hop_limit to let user choose the minimum\nhop limit value they can accept from RA. And set default to 1 to meet RFC\nstandards.\n\nSigned-off-by: Hangbin Liu <liuhangbin@gmail.com>\nAcked-by: YOSHIFUJI Hideaki <hideaki.yoshifuji@miraclelinux.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/e16f537864eb9cf68683d9e107706d1b31fcaa76"},{"sha":"a8837e30e3eece2c8c02345035c14b32f695bfcf","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"ipv6: fix a lockdep splat\n\n[ Upstream commit 44c3d0c1c0a880354e9de5d94175742e2c7c9683 ]\n\nSilence lockdep false positive about rcu_dereference() being\nused in the wrong context.\n\nFirst one should use rcu_dereference_protected() as we own the spinlock.\n\nSecond one should be a normal assignation, as no barrier is needed.\n\nFixes: 18367681a10bd (\"ipv6 flowlabel: Convert np->ipv6_fl_list to RCU.\")\nReported-by: Dave Jones <davej@codemonkey.org.uk>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/a8837e30e3eece2c8c02345035c14b32f695bfcf"},{"sha":"1ad3dfa534e42404edcca40e440b78976f8f99c3","author":{"email":"0507967f3b488e922fa3774e181b66ecdd5f9993@oracle.com","name":"Hans Westgaard Ry"},"message":"net:Add sysctl_max_skb_frags\n\n[ Upstream commit 5f74f82ea34c0da80ea0b49192bb5ea06e063593 ]\n\nDevices may have limits on the number of fragments in an skb they support.\nCurrent codebase uses a constant as maximum for number of fragments one\nskb can hold and use.\nWhen enabling scatter/gather and running traffic with many small messages\nthe codebase uses the maximum number of fragments and may thereby violate\nthe max for certain devices.\nThe patch introduces a global variable as max number of fragments.\n\nSigned-off-by: Hans Westgaard Ry <hans.westgaard.ry@oracle.com>\nReviewed-by: Håkon Bugge <haakon.bugge@oracle.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/1ad3dfa534e42404edcca40e440b78976f8f99c3"},{"sha":"e03e0613e6333d3cd5c322f6486273b98e007882","author":{"email":"152dd442537d9b53464fb22bfe7c9a0089599008@broadcom.com","name":"Siva Reddy Kallam"},"message":"tg3: Fix for tg3 transmit queue 0 timed out when too many gso_segs\n\n[ Upstream commit b7d987295c74500b733a0ba07f9a9bcc4074fa83 ]\n\ntg3_tso_bug() can hit a condition where the entire tx ring is not big\nenough to segment the GSO packet. For example, if MSS is very small,\ngso_segs can exceed the tx ring size. When we hit the condition, it\nwill cause tx timeout.\n\ntg3_tso_bug() is called to handle TSO and DMA hardware bugs.\nFor TSO bugs, if tg3_tso_bug() cannot succeed, we have to drop the packet.\nFor DMA bugs, we can still fall back to linearize the SKB and let the\nhardware transmit the TSO packet.\n\nThis patch adds a function tg3_tso_bug_gso_check() to check if there\nare enough tx descriptors for GSO before calling tg3_tso_bug().\nThe caller will then handle the error appropriately - drop or\nlineraize the SKB.\n\nv2: Corrected patch description to avoid confusion.\n\nSigned-off-by: Siva Reddy Kallam <siva.kallam@broadcom.com>\nSigned-off-by: Michael Chan <mchan@broadcom.com>\nAcked-by: Prashant Sreedharan <prashant@broadcom.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/e03e0613e6333d3cd5c322f6486273b98e007882"},{"sha":"cccf7a00505a2fe33e23599bdedc4c3993e28a10","author":{"email":"ed9bd6f22d2a1e0b1507d3ddc300dc248265d19a@gmail.com","name":"Xin Long"},"message":"sctp: translate network order to host order when users get a hmacid\n\n[ Upstream commit 7a84bd46647ff181eb2659fdc99590e6f16e501d ]\n\nCommit ed5a377d87dc (\"sctp: translate host order to network order when\nsetting a hmacid\") corrected the hmacid byte-order when setting a hmacid.\nbut the same issue also exists on getting a hmacid.\n\nWe fix it by changing hmacids to host order when users get them with\ngetsockopt.\n\nFixes: Commit ed5a377d87dc (\"sctp: translate host order to network order when setting a hmacid\")\nSigned-off-by: Xin Long <lucien.xin@gmail.com>\nAcked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/cccf7a00505a2fe33e23599bdedc4c3993e28a10"},{"sha":"a5e5ae1321c6edc6a2ce7d32e28e66336d3b530a","author":{"email":"13e4c2c2c15eff98ad47d02f3ccee2d83dc7015d@redhat.com","name":"Veaceslav Falico"},"message":"bonding: fix bond_arp_rcv() race of curr_active_slave\n\ncommit 010d3c3989706d800ae72253773fa6537cc9f74c upstream.\n\nbond->curr_active_slave can be changed between its deferences, even to\nNULL, and thus we might panic.\n\nWe're always holding the rcu (rx_handler->bond_handle_frame()->bond_arp_rcv())\nso fix this by rcu_dereferencing() it and using the saved.\n\nReported-by: Ding Tianhong <dingtianhong@huawei.com>\nFixes: aeea64a (\"bonding: don't trust arp requests unless active slave really works\")\nCC: Jay Vosburgh <fubar@us.ibm.com>\nCC: Andy Gospodarek <andy@greyhouse.net>\nSigned-off-by: Veaceslav Falico <vfalico@redhat.com>\nAcked-by: Ding Tianhong <dingtianhong@huawei.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/a5e5ae1321c6edc6a2ce7d32e28e66336d3b530a"},{"sha":"127e53abeede72da8d8d58b67b26f931737791ff","author":{"email":"e90b70171c6829bb48b48028157765080875cd1f@canonical.com","name":"Jay Vosburgh"},"message":"bonding: Fix ARP monitor validation\n\n[ Upstream commit 21a75f0915dde8674708b39abfcda113911c49b1 ]\n\nThe current logic in bond_arp_rcv will accept an incoming ARP for\nvalidation if (a) the receiving slave is either \"active\" (which includes\nthe currently active slave, or the current ARP slave) or, (b) there is a\ncurrently active slave, and it has received an ARP since it became active.\nFor case (b), the receiving slave isn't the currently active slave, and is\nreceiving the original broadcast ARP request, not an ARP reply from the\ntarget.\n\n\tThis logic can fail if there is no currently active slave.  In\nthis situation, the ARP probe logic cycles through all slaves, assigning\neach in turn as the \"current_arp_slave\" for one arp_interval, then setting\nthat one as \"active,\" and sending an ARP probe from that slave.  The\ncurrent logic expects the ARP reply to arrive on the sending\ncurrent_arp_slave, however, due to switch FDB updating delays, the reply\nmay be directed to another slave.\n\n\tThis can arise if the bonding slaves and switch are working, but\nthe ARP target is not responding.  When the ARP target recovers, a\ncondition may result wherein the ARP target host replies faster than the\nswitch can update its forwarding table, causing each ARP reply to be sent\nto the previous current_arp_slave.  This will never pass the logic in\nbond_arp_rcv, as neither of the above conditions (a) or (b) are met.\n\n\tSome experimentation on a LAN shows ARP reply round trips in the\n200 usec range, but my available switches never update their FDB in less\nthan 4000 usec.\n\n\tThis patch changes the logic in bond_arp_rcv to additionally\naccept an ARP reply for validation on any slave if there is a current ARP\nslave and it sent an ARP probe during the previous arp_interval.\n\nFixes: aeea64ac717a (\"bonding: don't trust arp requests unless active slave really works\")\nCc: Veaceslav Falico <vfalico@gmail.com>\nCc: Andy Gospodarek <gospo@cumulusnetworks.com>\nSigned-off-by: Jay Vosburgh <jay.vosburgh@canonical.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/127e53abeede72da8d8d58b67b26f931737791ff"},{"sha":"d1c560183199c55cfe50bd176dffdc16e5f55b6b","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"ipv4: fix memory leaks in ip_cmsg_send() callers\n\n[ Upstream commit 919483096bfe75dda338e98d56da91a263746a0a ]\n\nDmitry reported memory leaks of IP options allocated in\nip_cmsg_send() when/if this function returns an error.\n\nCallers are responsible for the freeing.\n\nMany thanks to Dmitry for the report and diagnostic.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/d1c560183199c55cfe50bd176dffdc16e5f55b6b"},{"sha":"6126da76d00e981cca46080c464f9c309067b022","author":{"email":"80f00641739f38c98bb00f0549e05479f80b50fb@mobileactivedefense.com","name":"Rainer Weikusat"},"message":"af_unix: Guard against other == sk in unix_dgram_sendmsg\n\n[ Upstream commit a5527dda344fff0514b7989ef7a755729769daa1 ]\n\nThe unix_dgram_sendmsg routine use the following test\n\nif (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {\n\nto determine if sk and other are in an n:1 association (either\nestablished via connect or by using sendto to send messages to an\nunrelated socket identified by address). This isn't correct as the\nspecified address could have been bound to the sending socket itself or\nbecause this socket could have been connected to itself by the time of\nthe unix_peer_get but disconnected before the unix_state_lock(other). In\nboth cases, the if-block would be entered despite other == sk which\nmight either block the sender unintentionally or lead to trying to unlock\nthe same spin lock twice for a non-blocking send. Add a other != sk\ncheck to guard against this.\n\nFixes: 7d267278a9ec (\"unix: avoid use-after-free in ep_remove_wait_queue\")\nReported-By: Philipp Hahn <pmhahn@pmhahn.de>\nSigned-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com>\nTested-by: Philipp Hahn <pmhahn@pmhahn.de>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/6126da76d00e981cca46080c464f9c309067b022"},{"sha":"82b090a896afa204ba1877f35e2897f23cafde22","author":{"email":"8a2957e0063f2abf61bd145b6236a74a3708ac54@mork.no","name":"Bjørn Mork"},"message":"qmi_wwan: add \"4G LTE usb-modem U901\"\n\n[ Upstream commit aac8d3c282e024c344c5b86dc1eab7af88bb9716 ]\n\nThomas reports:\n\nT:  Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#=  4 Spd=480 MxCh= 0\nD:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1\nP:  Vendor=05c6 ProdID=6001 Rev=00.00\nS:  Manufacturer=USB Modem\nS:  Product=USB Modem\nS:  SerialNumber=1234567890ABCDEF\nC:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA\nI:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option\nI:  If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option\nI:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option\nI:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan\nI:  If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage\n\nReported-by: Thomas Schäfer <tschaefer@t-online.de>\nSigned-off-by: Bjørn Mork <bjorn@mork.no>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/82b090a896afa204ba1877f35e2897f23cafde22"},{"sha":"866a0f55010d2d2c93c06cc3be423cd37ab12531","author":{"email":"1dd89e5367785ba89076cd264daac0464fdf0d7b@vadai.me","name":"Amir Vadai"},"message":"net/mlx4_en: Count HW buffer overrun only once\n\n[ Upstream commit 281e8b2fdf8e4ef366b899453cae50e09b577ada ]\n\nRdropOvflw counts overrun of HW buffer, therefore should\nbe used for rx_fifo_errors only.\n\nCurrently RdropOvflw counter is mistakenly also set into\nrx_missed_errors and rx_over_errors too, which makes the\ndevice total dropped packets accounting to show wrong results.\n\nFix that. Use it for rx_fifo_errors only.\n\nFixes: c27a02cd94d6 ('mlx4_en: Add driver for Mellanox ConnectX 10GbE NIC')\nSigned-off-by: Amir Vadai <amir@vadai.me>\nSigned-off-by: Eugenia Emantayev <eugenia@mellanox.com>\nSigned-off-by: Or Gerlitz <ogerlitz@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Jiri Slaby <jslaby@suse.cz>","distinct":true,"url":"https://api.github.com/repos/Sabayon/kernel/commits/866a0f55010d2d2c93c06cc3be423cd37ab12531"}]}