{"push_id":926105491,"size":21,"distinct_size":0,"ref":"refs/heads/linux-master","head":"b06f3a168cdcd80026276898fd1fee443ef25743","before":"ee9a7d2cb0cf1a1498478bc923d911f3d9c910ac","commits":[{"sha":"472b444eef934eb7e90334efdd7fc7954cfe5132","author":{"email":"ac73eed4b8a8c9127255a2696c52b2e7503720b8@gmail.com","name":"Brian Norris"},"message":"mtd: fix cmdlinepart parser, early naming for auto-filled MTD\n\nCommit 807f16d4db95 (\"mtd: core: set some defaults when dev.parent is\nset\") attempted to provide some default settings for MTDs that\n (a) assign the parent device and\n (b) don't provide their own name or owner\n\nHowever, this isn't a perfect drop-in replacement for the boilerplate\nfound in some drivers, because the MTD name is used by partition\nparsers like cmdlinepart, but the name isn't set until add_mtd_device(),\nafter the parsing is completed. This means cmdlinepart sees a NULL name\nand therefore will not work properly.\n\nFix this by moving the default name and owner assignment to be first in\nthe MTD registration process.\n\n[Note: this does not fix all reported issues, particularly with NAND\ndrivers. Will require an additional fix for drivers/mtd/nand/]\n\nFixes: 807f16d4db95 (\"mtd: core: set some defaults when dev.parent is set\")\nReported-by: Heiko Schocher <hs@denx.de>\nSigned-off-by: Brian Norris <computersforpeace@gmail.com>\nCc: Heiko Schocher <hs@denx.de>\nCc: Frans Klaver <fransklaver@gmail.com>","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/472b444eef934eb7e90334efdd7fc7954cfe5132"},{"sha":"b77357b69225a8e68d222451911feab50f2c6652","author":{"email":"e189e0339ff175cb87102353f9f5280f5ec6332b@gmail.com","name":"Insu Yun"},"message":"qlcnic: correctly handle qlcnic_alloc_mbx_args\n\nSince qlcnic_alloc_mbx_args can be failed,\nreturn value should be checked.\n\nSigned-off-by: Insu Yun <wuninsu@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/b77357b69225a8e68d222451911feab50f2c6652"},{"sha":"3934aa4c1f7f4ccdff25f530b0e37d776ac453e2","author":{"email":"e189e0339ff175cb87102353f9f5280f5ec6332b@gmail.com","name":"Insu Yun"},"message":"cxgb4: correctly handling failed allocation\n\nSince t4_alloc_mem can be failed in memory pressure,\nif not properly handled, NULL dereference could be happened.\n\nSigned-off-by: Insu Yun <wuninsu@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/3934aa4c1f7f4ccdff25f530b0e37d776ac453e2"},{"sha":"55285bf09427c5abf43ee1d54e892f352092b1f1","author":{"email":"cef439e78636cdab99cd2923826c5065a0743e5b@strlen.de","name":"Florian Westphal"},"message":"connector: bump skb->users before callback invocation\n\nDmitry reports memleak with syskaller program.\nProblem is that connector bumps skb usecount but might not invoke callback.\n\nSo move skb_get to where we invoke the callback.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/55285bf09427c5abf43ee1d54e892f352092b1f1"},{"sha":"7ec2541aa7a026874930d6117e86fe2e76fb1587","author":{"email":"2e4abddca5cd1005ec71becebc17a5257b0bced7@realtek.com","name":"hayeswang"},"message":"r8152: add reset_resume function\n\nWhen the reset_resume() is called, the flag of SELECTIVE_SUSPEND should be\ncleared and reinitialize the device, whether the SELECTIVE_SUSPEND is set\nor not. If reset_resume() is called, it means the power supply is cut or the\ndevice is reset. That is, the device wouldn't be in runtime suspend state and\nthe reinitialization is necessary.\n\nSigned-off-by: Hayes Wang <hayeswang@realtek.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/7ec2541aa7a026874930d6117e86fe2e76fb1587"},{"sha":"b5bdacf3bb027ba0af4d61b38ec289bfc8b64372","author":{"email":"e908389d4bbf30e8dc72dc47cdf6b45d89e8b2a0@cumulusnetworks.com","name":"David Ahern"},"message":"net: Propagate lookup failure in l3mdev_get_saddr to caller\n\nCommands run in a vrf context are not failing as expected on a route lookup:\n    root@kenny:~# ip ro ls table vrf-red\n    unreachable default\n\n    root@kenny:~# ping -I vrf-red -c1 -w1 10.100.1.254\n    ping: Warning: source address might be selected on device other than vrf-red.\n    PING 10.100.1.254 (10.100.1.254) from 0.0.0.0 vrf-red: 56(84) bytes of data.\n\n    --- 10.100.1.254 ping statistics ---\n    2 packets transmitted, 0 received, 100% packet loss, time 999ms\n\nSince the vrf table does not have a route for 10.100.1.254 the ping\nshould have failed. The saddr lookup causes a full VRF table lookup.\nPropogating a lookup failure to the user allows the command to fail as\nexpected:\n\n    root@kenny:~# ping -I vrf-red -c1 -w1 10.100.1.254\n    connect: No route to host\n\nSigned-off-by: David Ahern <dsa@cumulusnetworks.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/b5bdacf3bb027ba0af4d61b38ec289bfc8b64372"},{"sha":"c845acb324aa85a39650a14e7696982ceea75dc1","author":{"email":"80f00641739f38c98bb00f0549e05479f80b50fb@mobileactivedefense.com","name":"Rainer Weikusat"},"message":"af_unix: Fix splice-bind deadlock\n\nOn 2015/11/06, Dmitry Vyukov reported a deadlock involving the splice\nsystem call and AF_UNIX sockets,\n\nhttp://lists.openwall.net/netdev/2015/11/06/24\n\nThe situation was analyzed as\n\n(a while ago) A: socketpair()\nB: splice() from a pipe to /mnt/regular_file\n\tdoes sb_start_write() on /mnt\nC: try to freeze /mnt\n\twait for B to finish with /mnt\nA: bind() try to bind our socket to /mnt/new_socket_name\n\tlock our socket, see it not bound yet\n\tdecide that it needs to create something in /mnt\n\ttry to do sb_start_write() on /mnt, block (it's\n\twaiting for C).\nD: splice() from the same pipe to our socket\n\tlock the pipe, see that socket is connected\n\ttry to lock the socket, block waiting for A\nB:\tget around to actually feeding a chunk from\n\tpipe to file, try to lock the pipe.  Deadlock.\n\non 2015/11/10 by Al Viro,\n\nhttp://lists.openwall.net/netdev/2015/11/10/4\n\nThe patch fixes this by removing the kern_path_create related code from\nunix_mknod and executing it as part of unix_bind prior acquiring the\nreadlock of the socket in question. This means that A (as used above)\nwill sb_start_write on /mnt before it acquires the readlock, hence, it\nwon't indirectly block B which first did a sb_start_write and then\nwaited for a thread trying to acquire the readlock. Consequently, A\nbeing blocked by C waiting for B won't cause a deadlock anymore\n(effectively, both A and B acquire two locks in opposite order in the\nsituation described above).\n\nDmitry Vyukov(<dvyukov@google.com>) tested the original patch.\n\nSigned-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/c845acb324aa85a39650a14e7696982ceea75dc1"},{"sha":"ff62198553e43cdffa9d539f6165d3e83f8a42bc","author":{"email":"331be22c6b63ca3e0a03d408c2d906b1b02cd5f2@stressinduktion.org","name":"Hannes Frederic Sowa"},"message":"bridge: Only call /sbin/bridge-stp for the initial network namespace\n\n[I stole this patch from Eric Biederman. He wrote:]\n\n> There is no defined mechanism to pass network namespace information\n> into /sbin/bridge-stp therefore don't even try to invoke it except\n> for bridge devices in the initial network namespace.\n>\n> It is possible for unprivileged users to cause /sbin/bridge-stp to be\n> invoked for any network device name which if /sbin/bridge-stp does not\n> guard against unreasonable arguments or being invoked twice on the\n> same network device could cause problems.\n\n[Hannes: changed patch using netns_eq]\n\nCc: Eric W. Biederman <ebiederm@xmission.com>\nSigned-off-by: Eric W. Biederman <ebiederm@xmission.com>\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/ff62198553e43cdffa9d539f6165d3e83f8a42bc"},{"sha":"67b9bcd36906e12a15ffec19463afbbd6a41660e","author":{"email":"ac73eed4b8a8c9127255a2696c52b2e7503720b8@gmail.com","name":"Brian Norris"},"message":"mtd: spi-nor: fix Spansion regressions (aliased with Winbond)\n\nSpansion and Winbond have occasionally used the same manufacturer ID,\nand they don't support the same features. Particularly, writing SR=0\nseems to break read access for Spansion's s25fl064k. Unfortunately, we\ndon't currently have a way to differentiate these Spansion and Winbond\nparts, so rather than regressing support for these Spansion flash, let's\ndrop the new Winbond lock/unlock support for now. We can try to address\nWinbond support during the next release cycle.\n\nOriginal discussion:\n\nhttp://patchwork.ozlabs.org/patch/549173/\nhttp://patchwork.ozlabs.org/patch/553683/\n\nFixes: 357ca38d4751 (\"mtd: spi-nor: support lock/unlock/is_locked for Winbond\")\nFixes: c6fc2171b249 (\"mtd: spi-nor: disable protection for Winbond flash at startup\")\nSigned-off-by: Brian Norris <computersforpeace@gmail.com>\nReported-by: Felix Fietkau <nbd@openwrt.org>\nCc: Felix Fietkau <nbd@openwrt.org>","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/67b9bcd36906e12a15ffec19463afbbd6a41660e"},{"sha":"a32d5b726ff8cf32bf491522b0ac8ae2545a063e","author":{"email":"ac73eed4b8a8c9127255a2696c52b2e7503720b8@gmail.com","name":"Brian Norris"},"message":"mtd: spi-nor: fix stm_is_locked_sr() parameters\n\nstm_is_locked_sr() takes the status register (SR) value as the last\nparameter, not the second.\n\nReported-by: Bayi Cheng <bayi.cheng@mediatek.com>\nSigned-off-by: Brian Norris <computersforpeace@gmail.com>\nCc: Bayi Cheng <bayi.cheng@mediatek.com>","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/a32d5b726ff8cf32bf491522b0ac8ae2545a063e"},{"sha":"55795ef5469290f89f04e12e662ded604909e462","author":{"email":"6bd3f43fd5b2b5689bccc97f6d09e3eb28307598@rab.in","name":"Rabin Vincent"},"message":"net: filter: make JITs zero A for SKF_AD_ALU_XOR_X\n\nThe SKF_AD_ALU_XOR_X ancillary is not like the other ancillary data\ninstructions since it XORs A with X while all the others replace A with\nsome loaded value.  All the BPF JITs fail to clear A if this is used as\nthe first instruction in a filter.  This was found using american fuzzy\nlop.\n\nAdd a helper to determine if A needs to be cleared given the first\ninstruction in a filter, and use this in the JITs.  Except for ARM, the\nrest have only been compile-tested.\n\nFixes: 3480593131e0 (\"net: filter: get rid of BPF_S_* enum\")\nSigned-off-by: Rabin Vincent <rabin@rab.in>\nAcked-by: Daniel Borkmann <daniel@iogearbox.net>\nAcked-by: Alexei Starovoitov <ast@kernel.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/55795ef5469290f89f04e12e662ded604909e462"},{"sha":"60aa3b080a3d2b408af2ca114edb3efc84ad1838","author":{"email":"71add150d99de1bd5a1ceb2e3464b76ba775ecb5@lxorguk.ukuu.org.uk","name":"One Thousand Gnomes"},"message":"6pack: fix free memory scribbles\n\ncommit acf673a3187edf72068ee2f92f4dc47d66baed47 fixed a user triggerable free\nmemory scribble but in doing so replaced it with a different one that allows\nthe user to control the data and scribble even more.\n\nsixpack_close is called by the tty layer in tty context. The tty context is\nprotected by sp_get() and sp_put(). However network layer activity via\nsp_xmit() is not protected this way. We must therefore stop the queue\notherwise the user gets to dump a buffer mostly of their choice into freed\nkernel pages.\n\nSigned-off-by: Alan Cox <alan@linux.intel.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/60aa3b080a3d2b408af2ca114edb3efc84ad1838"},{"sha":"f941461c925832fbeb7876b794ab9fbec6a7a8af","author":{"email":"6bd3f43fd5b2b5689bccc97f6d09e3eb28307598@rab.in","name":"Rabin Vincent"},"message":"ARM: net: bpf: fix zero right shift\n\nThe LSR instruction cannot be used to perform a zero right shift since a\n0 as the immediate value (imm5) in the LSR instruction encoding means\nthat a shift of 32 is perfomed.  See DecodeIMMShift() in the ARM ARM.\n\nMake the JIT skip generation of the LSR if a zero-shift is requested.\n\nThis was found using american fuzzy lop.\n\nSigned-off-by: Rabin Vincent <rabin@rab.in>\nAcked-by: Alexei Starovoitov <ast@kernel.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/f941461c925832fbeb7876b794ab9fbec6a7a8af"},{"sha":"73c20a8b7245273125cfe92c4b46e6fdb568a801","author":{"email":"ee461b60978bea1c76b3018c0b89685175b248e2@gmail.com","name":"John Fastabend"},"message":"net: sched: fix missing free per cpu on qstats\n\nWhen a qdisc is using per cpu stats (currently just the ingress\nqdisc) only the bstats are being freed. This also free's the qstats.\n\nFixes: b0ab6f92752b9f9d8 (\"net: sched: enable per cpu qstats\")\nSigned-off-by: John Fastabend <john.r.fastabend@intel.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nAcked-by: Daniel Borkmann <daniel@iogearbox.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/73c20a8b7245273125cfe92c4b46e6fdb568a801"},{"sha":"07a5d38453599052aff0877b16bb9c1585f08609","author":{"email":"249bdc93f9f8abfcf4ddf63de47ffa120fa34333@aristanetworks.com","name":"Francesco Ruggeri"},"message":"net: possible use after free in dst_release\n\ndst_release should not access dst->flags after decrementing\n__refcnt to 0. The dst_entry may be in dst_busy_list and\ndst_gc_task may dst_destroy it before dst_release gets a chance\nto access dst->flags.\n\nFixes: d69bbf88c8d0 (\"net: fix a race in dst_release()\")\nFixes: 27b75c95f10d (\"net: avoid RCU for NOCACHE dst\")\nSigned-off-by: Francesco Ruggeri <fruggeri@arista.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/07a5d38453599052aff0877b16bb9c1585f08609"},{"sha":"fde55c45d2175bd3e33aa28ee31e4ea6efa354e1","author":{"email":"71add150d99de1bd5a1ceb2e3464b76ba775ecb5@lxorguk.ukuu.org.uk","name":"Alan"},"message":"mkiss: fix scribble on freed memory\n\ncommit d79f16c046086f4fe0d42184a458e187464eb83e fixed a user triggerable\nscribble on free memory but added a new one which allows the user to\nscribble even more and user controlled data into freed space.\n\nAs with 6pack we need to halt the queue before we free the buffers, because\nthe transmit logic is not protected by the semaphore.\n\nSigned-off-by: Alan Cox <alan@linux.intel.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/fde55c45d2175bd3e33aa28ee31e4ea6efa354e1"},{"sha":"e439bd4a4fdeb29488f48f14845ad35607e6302c","author":{"email":"ed4b9e36d7b45c95d901f5fd73a0ec1ecb6083b0@gmail.com","name":"Kristian Evensen"},"message":"net: qmi_wwan: Add WeTelecom-WPD600N\n\nThe WeTelecom-WPD600N is an LTE module that, in addition to supporting most\n\"normal\" bands, also supports LTE over 450MHz. Manual testing showed that\nonly interface number three replies to QMI messages.\n\nCc: Bjørn Mork <bjorn@mork.no>\nSigned-off-by: Kristian Evensen <kristian.evensen@gmail.com>\nAcked-by: Bjørn Mork <bjorn@mork.no>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/e439bd4a4fdeb29488f48f14845ad35607e6302c"},{"sha":"58caf637365fef97c8e84ea5699a8e34d68fce93","author":{"email":"f10d102361c3f99a52d0b4ac397fb18e80b7b891@vmware.com","name":"Shrikrishna Khare"},"message":"Driver: Vmxnet3: Fix regression caused by 5738a09\n\nReported-by: Bingkuo Liu <bingkuol@vmware.com>\nSigned-off-by: Shrikrishna Khare <skhare@vmware.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/58caf637365fef97c8e84ea5699a8e34d68fce93"},{"sha":"8b8a321ff72c785ed5e8b4cf6eda20b35d427390","author":{"email":"5b5a0a360fa35167ac197fe6359c229fde284cf2@google.com","name":"Yuchung Cheng"},"message":"tcp: fix zero cwnd in tcp_cwnd_reduction\n\nPatch 3759824da87b (\"tcp: PRR uses CRB mode by default and SS mode\nconditionally\") introduced a bug that cwnd may become 0 when both\ninflight and sndcnt are 0 (cwnd = inflight + sndcnt). This may lead\nto a div-by-zero if the connection starts another cwnd reduction\nphase by setting tp->prior_cwnd to the current cwnd (0) in\ntcp_init_cwnd_reduction().\n\nTo prevent this we skip PRR operation when nothing is acked or\nsacked. Then cwnd must be positive in all cases as long as ssthresh\nis positive:\n\n1) The proportional reduction mode\n   inflight > ssthresh > 0\n\n2) The reduction bound mode\n  a) inflight == ssthresh > 0\n\n  b) inflight < ssthresh\n     sndcnt > 0 since newly_acked_sacked > 0 and inflight < ssthresh\n\nTherefore in all cases inflight and sndcnt can not both be 0.\nWe check invalid tp->prior_cwnd to avoid potential div0 bugs.\n\nIn reality this bug is triggered only with a sequence of less common\nevents.  For example, the connection is terminating an ECN-triggered\ncwnd reduction with an inflight 0, then it receives reordered/old\nACKs or DSACKs from prior transmission (which acks nothing). Or the\nconnection is in fast recovery stage that marks everything lost,\nbut fails to retransmit due to local issues, then receives data\npackets from other end which acks nothing.\n\nFixes: 3759824da87b (\"tcp: PRR uses CRB mode by default and SS mode conditionally\")\nReported-by: Oleksandr Natalenko <oleksandr@natalenko.name>\nSigned-off-by: Yuchung Cheng <ycheng@google.com>\nSigned-off-by: Neal Cardwell <ncardwell@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/8b8a321ff72c785ed5e8b4cf6eda20b35d427390"},{"sha":"51cb67c0b0fcb91581b15bd2e85f29af4d4b2df6","author":{"email":"69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org","name":"Linus Torvalds"},"message":"Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nPull networking fixes from David Miller:\n \"As usual, there are a couple straggler bug fixes:\n\n   1) qlcnic_alloc_mbx_args() error returns are not checked in qlcnic\n      driver.  Fix from Insu Yun.\n\n   2) SKB refcounting bug in connector, from Florian Westphal.\n\n   3) vrf_get_saddr() has to propagate fib_lookup() errors to it's\n      callers, from David Ahern.\n\n   4) Fix AF_UNIX splice/bind deadlock, from Rainer Weikusat.\n\n   5) qdisc_rcu_free() fails to free the per-cpu qstats.  Fix from John\n      Fastabend.\n\n   6) vmxnet3 driver passes wrong page to dma_map_page(), fix from\n     Shrikrishna Khare.\n\n   7) Don't allow zero cwnd in tcp_cwnd_reduction(), from Yuchung Cheng\"\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:\n  tcp: fix zero cwnd in tcp_cwnd_reduction\n  Driver: Vmxnet3: Fix regression caused by 5738a09\n  net: qmi_wwan: Add WeTelecom-WPD600N\n  mkiss: fix scribble on freed memory\n  net: possible use after free in dst_release\n  net: sched: fix missing free per cpu on qstats\n  ARM: net: bpf: fix zero right shift\n  6pack: fix free memory scribbles\n  net: filter: make JITs zero A for SKF_AD_ALU_XOR_X\n  bridge: Only call /sbin/bridge-stp for the initial network namespace\n  af_unix: Fix splice-bind deadlock\n  net: Propagate lookup failure in l3mdev_get_saddr to caller\n  r8152: add reset_resume function\n  connector: bump skb->users before callback invocation\n  cxgb4: correctly handling failed allocation\n  qlcnic: correctly handle qlcnic_alloc_mbx_args","distinct":false,"url":"https://api.github.com/repos/RobertCNelson/ti-linux-kernel/commits/51cb67c0b0fcb91581b15bd2e85f29af4d4b2df6"}]}