{"push_id":1411445764,"size":38,"distinct_size":38,"ref":"refs/heads/SLE12-SP2","head":"2f06368a02027b5d2adbca50761dab4f3e45c3d8","before":"278089c195e6e71c1a551daac65c86c7c66cef87","commits":[{"sha":"a35ce624a3ae06894db065727d33c17aff5cdaec","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"tcp: fix overflow in __tcp_retransmit_skb()\n\n[ Upstream commit ffb4d6c8508657824bcef68a36b2a0f9d8c09d10 ]\n\nIf a TCP socket gets a large write queue, an overflow can happen\nin a test in __tcp_retransmit_skb() preventing all retransmits.\n\nThe flow then stalls and resets after timeouts.\n\nTested:\n\nsysctl -w net.core.wmem_max=1000000000\nnetperf -H dest -- -s 1000000000\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/a35ce624a3ae06894db065727d33c17aff5cdaec"},{"sha":"d2e01b15657c394085fd810f4da6b5ef6574e14b","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"net: avoid sk_forward_alloc overflows\n\n[ Upstream commit 20c64d5cd5a2bdcdc8982a06cb05e5e1bd851a3d ]\n\nA malicious TCP receiver, sending SACK, can force the sender to split\nskbs in write queue and increase its memory usage.\n\nThen, when socket is closed and its write queue purged, we might\noverflow sk_forward_alloc (It becomes negative)\n\nsk_mem_reclaim() does nothing in this case, and more than 2GB\nare leaked from TCP perspective (tcp_memory_allocated is not changed)\n\nThen warnings trigger from inet_sock_destruct() and\nsk_stream_kill_queues() seeing a not zero sk_forward_alloc\n\nAll TCP stack can be stuck because TCP is under memory pressure.\n\nA simple fix is to preemptively reclaim from sk_mem_uncharge().\n\nThis makes sure a socket wont have more than 2 MB forward allocated,\nafter burst and idle period.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/d2e01b15657c394085fd810f4da6b5ef6574e14b"},{"sha":"ac40148543c5f04093c95462861cf49cf9af5648","author":{"name":"Douglas Caetano dos Santos","email":"377843afb517f10c5d64c4b70fd8588c69e7c258@taghos.com.br"},"message":"tcp: fix wrong checksum calculation on MTU probing\n\n[ Upstream commit 2fe664f1fcf7c4da6891f95708a7a56d3c024354 ]\n\nWith TCP MTU probing enabled and offload TX checksumming disabled,\ntcp_mtu_probe() calculated the wrong checksum when a fragment being copied\ninto the probe's SKB had an odd length. This was caused by the direct use\nof skb_copy_and_csum_bits() to calculate the checksum, as it pads the\nfragment being copied, if needed. When this fragment was not the last, a\nsubsequent call used the previous checksum without considering this\npadding.\n\nThe effect was a stale connection in one way, as even retransmissions\nwouldn't solve the problem, because the checksum was never recalculated for\nthe full SKB length.\n\nSigned-off-by: Douglas Caetano dos Santos <douglascs@taghos.com.br>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/ac40148543c5f04093c95462861cf49cf9af5648"},{"sha":"aadcd6a96010ce933c96d97a0c086a4da6110eec","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"tcp: fix a compile error in DBGUNDO()\n\n[ Upstream commit 019b1c9fe32a2a32c1153e31375f87ec3e591273 ]\n\nIf DBGUNDO() is enabled (FASTRETRANS_DEBUG > 1), a compile\nerror will happen, since inet6_sk(sk)->daddr became sk->sk_v6_daddr\n\nFixes: efe4208f47f9 (\"ipv6: make lookups simpler and faster\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/aadcd6a96010ce933c96d97a0c086a4da6110eec"},{"sha":"4f312a802994e2bb7439262fdc43a0b8bd535697","author":{"name":"Lance Richardson","email":"529d81928dd60beeaf299499acfc13e39cc028fb@redhat.com"},"message":"ip6_gre: fix flowi6_proto value in ip6gre_xmit_other()\n\n[ Upstream commit db32e4e49ce2b0e5fcc17803d011a401c0a637f6 ]\n\nSimilar to commit 3be07244b733 (\"ip6_gre: fix flowi6_proto value in\nxmit path\"), set flowi6_proto to IPPROTO_GRE for output route lookup.\n\nUp until now, ip6gre_xmit_other() has set flowi6_proto to a bogus value.\nThis affected output route lookup for packets sent on an ip6gretap device\nin cases where routing was dependent on the value of flowi6_proto.\n\nSince the correct proto is already set in the tunnel flowi6 template via\ncommit 252f3f5a1189 (\"ip6_gre: Set flowi6_proto as IPPROTO_GRE in xmit\npath.\"), simply delete the line setting the incorrect flowi6_proto value.\n\nSuggested-by: Jiri Benc <jbenc@redhat.com>\nFixes: c12b395a4664 (\"gre: Support GRE over IPv6\")\nReviewed-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>\nSigned-off-by: Lance Richardson <lrichard@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/4f312a802994e2bb7439262fdc43a0b8bd535697"},{"sha":"6eb0061fa630ae97c733a4dcbe3e23333ebe8626","author":{"name":"Nikolay Aleksandrov","email":"64c6133501914790fe0371388ffd86301bcc142b@cumulusnetworks.com"},"message":"ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route\n\n[ Upstream commit 2cf750704bb6d7ed8c7d732e071dd1bc890ea5e8 ]\n\nSince the commit below the ipmr/ip6mr rtnl_unicast() code uses the portid\ninstead of the previous dst_pid which was copied from in_skb's portid.\nSince the skb is new the portid is 0 at that point so the packets are sent\nto the kernel and we get scheduling while atomic or a deadlock (depending\non where it happens) by trying to acquire rtnl two times.\nAlso since this is RTM_GETROUTE, it can be triggered by a normal user.\n\nHere's the sleeping while atomic trace:\n[ 7858.212557] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:620\n[ 7858.212748] in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper/0\n[ 7858.212881] 2 locks held by swapper/0/0:\n[ 7858.213013]  #0:  (((&mrt->ipmr_expire_timer))){+.-...}, at: [<ffffffff810fbbf5>] call_timer_fn+0x5/0x350\n[ 7858.213422]  #1:  (mfc_unres_lock){+.....}, at: [<ffffffff8161e005>] ipmr_expire_process+0x25/0x130\n[ 7858.213807] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.8.0-rc7+ #179\n[ 7858.213934] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014\n[ 7858.214108]  0000000000000000 ffff88005b403c50 ffffffff813a7804 0000000000000000\n[ 7858.214412]  ffffffff81a1338e ffff88005b403c78 ffffffff810a4a72 ffffffff81a1338e\n[ 7858.214716]  000000000000026c 0000000000000000 ffff88005b403ca8 ffffffff810a4b9f\n[ 7858.215251] Call Trace:\n[ 7858.215412]  <IRQ>  [<ffffffff813a7804>] dump_stack+0x85/0xc1\n[ 7858.215662]  [<ffffffff810a4a72>] ___might_sleep+0x192/0x250\n[ 7858.215868]  [<ffffffff810a4b9f>] __might_sleep+0x6f/0x100\n[ 7858.216072]  [<ffffffff8165bea3>] mutex_lock_nested+0x33/0x4d0\n[ 7858.216279]  [<ffffffff815a7a5f>] ? netlink_lookup+0x25f/0x460\n[ 7858.216487]  [<ffffffff8157474b>] rtnetlink_rcv+0x1b/0x40\n[ 7858.216687]  [<ffffffff815a9a0c>] netlink_unicast+0x19c/0x260\n[ 7858.216900]  [<ffffffff81573c70>] rtnl_unicast+0x20/0x30\n[ 7858.217128]  [<ffffffff8161cd39>] ipmr_destroy_unres+0xa9/0xf0\n[ 7858.217351]  [<ffffffff8161e06f>] ipmr_expire_process+0x8f/0x130\n[ 7858.217581]  [<ffffffff8161dfe0>] ? ipmr_net_init+0x180/0x180\n[ 7858.217785]  [<ffffffff8161dfe0>] ? ipmr_net_init+0x180/0x180\n[ 7858.217990]  [<ffffffff810fbc95>] call_timer_fn+0xa5/0x350\n[ 7858.218192]  [<ffffffff810fbbf5>] ? call_timer_fn+0x5/0x350\n[ 7858.218415]  [<ffffffff8161dfe0>] ? ipmr_net_init+0x180/0x180\n[ 7858.218656]  [<ffffffff810fde10>] run_timer_softirq+0x260/0x640\n[ 7858.218865]  [<ffffffff8166379b>] ? __do_softirq+0xbb/0x54f\n[ 7858.219068]  [<ffffffff816637c8>] __do_softirq+0xe8/0x54f\n[ 7858.219269]  [<ffffffff8107a948>] irq_exit+0xb8/0xc0\n[ 7858.219463]  [<ffffffff81663452>] smp_apic_timer_interrupt+0x42/0x50\n[ 7858.219678]  [<ffffffff816625bc>] apic_timer_interrupt+0x8c/0xa0\n[ 7858.219897]  <EOI>  [<ffffffff81055f16>] ? native_safe_halt+0x6/0x10\n[ 7858.220165]  [<ffffffff810d64dd>] ? trace_hardirqs_on+0xd/0x10\n[ 7858.220373]  [<ffffffff810298e3>] default_idle+0x23/0x190\n[ 7858.220574]  [<ffffffff8102a20f>] arch_cpu_idle+0xf/0x20\n[ 7858.220790]  [<ffffffff810c9f8c>] default_idle_call+0x4c/0x60\n[ 7858.221016]  [<ffffffff810ca33b>] cpu_startup_entry+0x39b/0x4d0\n[ 7858.221257]  [<ffffffff8164f995>] rest_init+0x135/0x140\n[ 7858.221469]  [<ffffffff81f83014>] start_kernel+0x50e/0x51b\n[ 7858.221670]  [<ffffffff81f82120>] ? early_idt_handler_array+0x120/0x120\n[ 7858.221894]  [<ffffffff81f8243f>] x86_64_start_reservations+0x2a/0x2c\n[ 7858.222113]  [<ffffffff81f8257c>] x86_64_start_kernel+0x13b/0x14a\n\nFixes: 2942e9005056 (\"[RTNETLINK]: Use rtnl_unicast() for rtnetlink unicasts\")\nSigned-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/6eb0061fa630ae97c733a4dcbe3e23333ebe8626"},{"sha":"0ee4acb7b3bedfe264aabe4a7c47762e2cbdc97c","author":{"name":"Milton Miller","email":"1dac7e73b1083de80c589704e625ff41b72bed66@us.ibm.com"},"message":"tg3: Avoid NULL pointer dereference in tg3_io_error_detected()\n\n[ Upstream commit 1b0ff89852d79354e8a091c81a88df21f5aa9f0a ]\n\nWhile the driver is probing the adapter, an error may occur before the\nnetdev structure is allocated and attached to pci_dev. In this case,\nnot only netdev isn't available, but the tg3 private structure is also\nnot available as it is just math from the NULL pointer, so dereferences\nmust be skipped.\n\nThe following trace is seen when the error is triggered:\n\n  [1.402247] Unable to handle kernel paging request for data at address 0x00001a99\n  [1.402410] Faulting instruction address: 0xc0000000007e33f8\n  [1.402450] Oops: Kernel access of bad area, sig: 11 [#1]\n  [1.402481] SMP NR_CPUS=2048 NUMA PowerNV\n  [1.402513] Modules linked in:\n  [1.402545] CPU: 0 PID: 651 Comm: eehd Not tainted 4.4.0-36-generic #55-Ubuntu\n  [1.402591] task: c000001fe4e42a20 ti: c000001fe4e88000 task.ti: c000001fe4e88000\n  [1.402742] NIP: c0000000007e33f8 LR: c0000000007e3164 CTR: c000000000595ea0\n  [1.402787] REGS: c000001fe4e8b790 TRAP: 0300   Not tainted  (4.4.0-36-generic)\n  [1.402832] MSR: 9000000100009033 <SF,HV,EE,ME,IR,DR,RI,LE>  CR: 28000422  XER: 20000000\n  [1.403058] CFAR: c000000000008468 DAR: 0000000000001a99 DSISR: 42000000 SOFTE: 1\n  GPR00: c0000000007e3164 c000001fe4e8ba10 c0000000015c5e00 0000000000000000\n  GPR04: 0000000000000001 0000000000000000 0000000000000039 0000000000000299\n  GPR08: 0000000000000000 0000000000000001 c000001fe4e88000 0000000000000006\n  GPR12: 0000000000000000 c00000000fb40000 c0000000000e6558 c000003ca1bffd00\n  GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000\n  GPR20: 0000000000000000 0000000000000000 0000000000000000 c000000000d52768\n  GPR24: c000000000d52740 0000000000000100 c000003ca1b52000 0000000000000002\n  GPR28: 0000000000000900 0000000000000000 c00000000152a0c0 c000003ca1b52000\n  [1.404226] NIP [c0000000007e33f8] tg3_io_error_detected+0x308/0x340\n  [1.404265] LR [c0000000007e3164] tg3_io_error_detected+0x74/0x340\n\nThis patch avoids the NULL pointer dereference by moving the access after\nthe netdev NULL pointer check on tg3_io_error_detected(). Also, we add a\ncheck for netdev being NULL on tg3_io_resume() [suggested by Michael Chan].\n\nFixes: 0486a063b1ff (\"tg3: prevent ifup/ifdown during PCI error recovery\")\nFixes: dfc8f370316b (\"net/tg3: Release IRQs on permanent error\")\nTested-by: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>\nSigned-off-by: Milton Miller <miltonm@us.ibm.com>\nSigned-off-by: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>\nAcked-by: Michael Chan <michael.chan@broadcom.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/0ee4acb7b3bedfe264aabe4a7c47762e2cbdc97c"},{"sha":"bc5d8ced3c9848bdcddcc575083bf50bbe04f03d","author":{"name":"Gavin Schenk","email":"2bbe43b385e606ca0d288a946313dee6eacd7ceb@eckelmann.de"},"message":"net: fec: set mac address unconditionally\n\n[ Upstream commit b82d44d78480faff7456e9e0999acb9d38666057 ]\n\nIf the mac address origin is not dt, you can only safely assign a mac\naddress after \"link up\" of the device. If the link is off the clocks are\ndisabled and because of issues assigning registers when clocks are off the\nnew mac address cannot be written in .ndo_set_mac_address() on some soc's.\nThis fix sets the mac address unconditionally in fec_restart(...) and\nensures consistency between fec registers and the network layer.\n\nSigned-off-by: Gavin Schenk <g.schenk@eckelmann.de>\nAcked-by: Fugang Duan <fugang.duan@nxp.com>\nAcked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>\nFixes: 9638d19e4816 (\"net: fec: add netif status check before set mac address\")\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/bc5d8ced3c9848bdcddcc575083bf50bbe04f03d"},{"sha":"bb7ffb6b68a9be3ecdd3ce8ae333c4c0ce04cce7","author":{"name":"Paolo Abeni","email":"760d0d6fcadb77e1b4c1d3c7879788c2b4ed8bbe@redhat.com"},"message":"net: pktgen: fix pkt_size\n\n[ Upstream commit 63d75463c91a5b5be7c0aca11ceb45ea5a0ae81d ]\n\nThe commit 879c7220e828 (\"net: pktgen: Observe needed_headroom\nof the device\") increased the 'pkt_overhead' field value by\nLL_RESERVED_SPACE.\nAs a side effect the generated packet size, computed as:\n\n\t/* Eth + IPh + UDPh + mpls */\n\tdatalen = pkt_dev->cur_pkt_size - 14 - 20 - 8 -\n\t\t  pkt_dev->pkt_overhead;\n\nis decreased by the same value.\nThe above changed slightly the behavior of existing pktgen users,\nand made the procfs interface somewhat inconsistent.\nFix it by restoring the previous pkt_overhead value and using\nLL_RESERVED_SPACE as extralen in skb allocation.\nAlso, change pktgen_alloc_skb() to only partially reserve\nthe headroom to allow the caller to prefetch from ll header\nstart.\n\nv1 -> v2:\n - fixed some typos in the comments\n\nFixes: 879c7220e828 (\"net: pktgen: Observe needed_headroom of the device\")\nSuggested-by: Ben Greear <greearb@candelatech.com>\nSigned-off-by: Paolo Abeni <pabeni@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/bb7ffb6b68a9be3ecdd3ce8ae333c4c0ce04cce7"},{"sha":"9edbf4a0b60b62a1fb5f57248f6c9b9ffb30c328","author":{"name":"Shmulik Ladkani","email":"0f22133883cc23dc960c397003e8595770c40863@gmail.com"},"message":"net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions\n\n[ Upstream commit f39acc84aad10710e89835c60d3b6694c43a8dd9 ]\n\nGeneric skb_vlan_push/skb_vlan_pop functions don't properly handle the\ncase where the input skb data pointer does not point at the mac header:\n\n- They're doing push/pop, but fail to properly unwind data back to its\n  original location.\n  For example, in the skb_vlan_push case, any subsequent\n  'skb_push(skb, skb->mac_len)' calls make the skb->data point 4 bytes\n  BEFORE start of frame, leading to bogus frames that may be transmitted.\n\n- They update rcsum per the added/removed 4 bytes tag.\n  Alas if data is originally after the vlan/eth headers, then these\n  bytes were already pulled out of the csum.\n\nOTOH calling skb_vlan_push/skb_vlan_pop with skb->data at mac_header\npresent no issues.\n\nact_vlan is the only caller to skb_vlan_*() that has skb->data pointing\nat network header (upon ingress).\nOther calles (ovs, bpf) already adjust skb->data at mac_header.\n\nThis patch fixes act_vlan to point to the mac_header prior calling\nskb_vlan_*() functions, as other callers do.\n\nSigned-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>\nCc: Daniel Borkmann <daniel@iogearbox.net>\nCc: Pravin Shelar <pshelar@ovn.org>\nCc: Jiri Pirko <jiri@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/9edbf4a0b60b62a1fb5f57248f6c9b9ffb30c328"},{"sha":"63091b2c1deae0a7f1347a74097de8ccc9db3359","author":{"name":"Andrew Collins","email":"7d13601456d872fd7380b21e66c482fe5761085a@cradlepoint.com"},"message":"net: Add netdev all_adj_list refcnt propagation to fix panic\n\n[ Upstream commit 93409033ae653f1c9a949202fb537ab095b2092f ]\n\nThis is a respin of a patch to fix a relatively easily reproducible kernel\npanic related to the all_adj_list handling for netdevs in recent kernels.\n\nThe following sequence of commands will reproduce the issue:\n\nip link add link eth0 name eth0.100 type vlan id 100\nip link add link eth0 name eth0.200 type vlan id 200\nip link add name testbr type bridge\nip link set eth0.100 master testbr\nip link set eth0.200 master testbr\nip link add link testbr mac0 type macvlan\nip link delete dev testbr\n\nThis creates an upper/lower tree of (excuse the poor ASCII art):\n\n            /---eth0.100-eth0\nmac0-testbr-\n            \\---eth0.200-eth0\n\nWhen testbr is deleted, the all_adj_lists are walked, and eth0 is deleted twice from\nthe mac0 list. Unfortunately, during setup in __netdev_upper_dev_link, only one\nreference to eth0 is added, so this results in a panic.\n\nThis change adds reference count propagation so things are handled properly.\n\nMatthias Schiffer reported a similar crash in batman-adv:\n\nhttps://github.com/freifunk-gluon/gluon/issues/680\nhttps://www.open-mesh.org/issues/247\n\nwhich this patch also seems to resolve.\n\nSigned-off-by: Andrew Collins <acollins@cradlepoint.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/63091b2c1deae0a7f1347a74097de8ccc9db3359"},{"sha":"d72cb5fb36bdc75cc3640b86409c68f1f1cbbe2a","author":{"name":"Anoob Soman","email":"2640d4e27f6da8ddaf8ae32fbf727becd620a9fb@citrix.com"},"message":"packet: call fanout_release, while UNREGISTERING a netdev\n\n[ Upstream commit 6664498280cf17a59c3e7cf1a931444c02633ed1 ]\n\nIf a socket has FANOUT sockopt set, a new proto_hook is registered\nas part of fanout_add(). When processing a NETDEV_UNREGISTER event in\naf_packet, __fanout_unlink is called for all sockets, but prot_hook which was\nregistered as part of fanout_add is not removed. Call fanout_release, on a\nNETDEV_UNREGISTER, which removes prot_hook and removes fanout from the\nfanout_list.\n\nThis fixes BUG_ON(!list_empty(&dev->ptype_specific)) in netdev_run_todo()\n\nSigned-off-by: Anoob Soman <anoob.soman@citrix.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/d72cb5fb36bdc75cc3640b86409c68f1f1cbbe2a"},{"sha":"6d123f1d396b50abd51e67eb9171e2ae8b3501ec","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"netlink: do not enter direct reclaim from netlink_dump()\n\n[ Upstream commit d35c99ff77ecb2eb239731b799386f3b3637a31e ]\n\nSince linux-3.15, netlink_dump() can use up to 16384 bytes skb\nallocations.\n\nDue to struct skb_shared_info ~320 bytes overhead, we end up using\norder-3 (on x86) page allocations, that might trigger direct reclaim and\nadd stress.\n\nThe intent was really to attempt a large allocation but immediately\nfallback to a smaller one (order-1 on x86) in case of memory stress.\n\nOn recent kernels (linux-4.4), we can remove __GFP_DIRECT_RECLAIM to\nmeet the goal. Old kernels would need to remove __GFP_WAIT\n\nWhile we are at it, since we do an order-3 allocation, allow to use\nall the allocated bytes instead of 16384 to reduce syscalls during\nlarge dumps.\n\niproute2 already uses 32KB recvmsg() buffer sizes.\n\nAlexei provided an initial patch downsizing to SKB_WITH_OVERHEAD(16384)\n\nFixes: 9063e21fb026 (\"netlink: autosize skb lengthes\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Alexei Starovoitov <ast@kernel.org>\nCc: Greg Thelen <gthelen@google.com>\nReviewed-by: Greg Rose <grose@lightfleet.com>\nAcked-by: Alexei Starovoitov <ast@kernel.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/6d123f1d396b50abd51e67eb9171e2ae8b3501ec"},{"sha":"705b5aca17c3a30ff93c53eb51368c8fcc9b49b8","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"ipv6: tcp: restore IP6CB for pktoptions skbs\n\n[ Upstream commit 8ce48623f0cf3d632e32448411feddccb693d351 ]\n\nBaozeng Ding reported following KASAN splat :\n\nBUG: KASAN: use-after-free in ip6_datagram_recv_specific_ctl+0x13f1/0x15c0 at addr ffff880029c84ec8\nRead of size 1 by task poc/25548\nCall Trace:\n [<ffffffff82cf43c9>] dump_stack+0x12e/0x185 /lib/dump_stack.c:15\n [<     inline     >] print_address_description /mm/kasan/report.c:204\n [<ffffffff817ced3b>] kasan_report_error+0x48b/0x4b0 /mm/kasan/report.c:283\n [<     inline     >] kasan_report /mm/kasan/report.c:303\n [<ffffffff817ced9e>] __asan_report_load1_noabort+0x3e/0x40 /mm/kasan/report.c:321\n [<ffffffff85c71da1>] ip6_datagram_recv_specific_ctl+0x13f1/0x15c0 /net/ipv6/datagram.c:687\n [<ffffffff85c734c3>] ip6_datagram_recv_ctl+0x33/0x40\n [<ffffffff85c0b07c>] do_ipv6_getsockopt.isra.4+0xaec/0x2150\n [<ffffffff85c0c7f6>] ipv6_getsockopt+0x116/0x230\n [<ffffffff859b5a12>] tcp_getsockopt+0x82/0xd0 /net/ipv4/tcp.c:3035\n [<ffffffff855fb385>] sock_common_getsockopt+0x95/0xd0 /net/core/sock.c:2647\n [<     inline     >] SYSC_getsockopt /net/socket.c:1776\n [<ffffffff855f8ba2>] SyS_getsockopt+0x142/0x230 /net/socket.c:1758\n [<ffffffff8685cdc5>] entry_SYSCALL_64_fastpath+0x23/0xc6\nMemory state around the buggy address:\n ffff880029c84d80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff880029c84e00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n> ffff880029c84e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n                                              ^\n ffff880029c84f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff880029c84f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n\nHe also provided a syzkaller reproducer.\n\nIssue is that ip6_datagram_recv_specific_ctl() expects to find IP6CB\ndata that was moved at a different place in tcp_v6_rcv()\n\nThis patch moves tcp_v6_restore_cb() up and calls it from\ntcp_v6_do_rcv() when np->pktoptions is set.\n\nFixes: 971f10eca186 (\"tcp: better TCP_SKB_CB layout to reduce cache line misses\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Baozeng Ding <sploving1@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/705b5aca17c3a30ff93c53eb51368c8fcc9b49b8"},{"sha":"f9d4850af3c89934620f3f0363167da9cbb3f167","author":{"name":"Vadim Fedorenko","email":"4500c3a3138beea25b1ff6a4a8733456d9e55790@yandex-team.ru"},"message":"ip6_tunnel: fix ip6_tnl_lookup\n\n[ Upstream commit 68d00f332e0ba7f60f212be74ede290c9f873bc5 ]\n\nThe commit ea3dc9601bda (\"ip6_tunnel: Add support for wildcard tunnel\nendpoints.\") introduces support for wildcards in tunnels endpoints,\nbut in some rare circumstances ip6_tnl_lookup selects wrong tunnel\ninterface relying only on source or destination address of the packet\nand not checking presence of wildcard in tunnels endpoints. Later in\nip6_tnl_rcv this packets can be dicarded because of difference in\nipproto even if fallback device have proper ipproto configuration.\n\nThis patch adds checks of wildcard endpoint in tunnel avoiding such\nbehavior\n\nFixes: ea3dc9601bda (\"ip6_tunnel: Add support for wildcard tunnel endpoints.\")\nSigned-off-by: Vadim Fedorenko <junk@yandex-team.ru>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/f9d4850af3c89934620f3f0363167da9cbb3f167"},{"sha":"e635b4766174381572b95f8fae153e7f1f36cf65","author":{"name":"Nicolas Dichtel","email":"6738a2db8b42127254341bdb65a9775d52a2feaa@6wind.com"},"message":"ipv6: correctly add local routes when lo goes up\n\n[ Upstream commit a220445f9f4382c36a53d8ef3e08165fa27f7e2c ]\n\nThe goal of the patch is to fix this scenario:\n ip link add dummy1 type dummy\n ip link set dummy1 up\n ip link set lo down ; ip link set lo up\n\nAfter that sequence, the local route to the link layer address of dummy1 is\nnot there anymore.\n\nWhen the loopback is set down, all local routes are deleted by\naddrconf_ifdown()/rt6_ifdown(). At this time, the rt6_info entry still\nexists, because the corresponding idev has a reference on it. After the rcu\ngrace period, dst_rcu_free() is called, and thus ___dst_free(), which will\nset obsolete to DST_OBSOLETE_DEAD.\n\nIn this case, init_loopback() is called before dst_rcu_free(), thus\nobsolete is still sets to something <= 0. So, the function doesn't add the\nroute again. To avoid that race, let's check the rt6 refcnt instead.\n\nFixes: 25fb6ca4ed9c (\"net IPv6 : Fix broken IPv6 routing table after loopback down-up\")\nFixes: a881ae1f625c (\"ipv6: don't call addrconf_dst_alloc again when enable lo\")\nFixes: 33d99113b110 (\"ipv6: reallocate addrconf router for ipv6 address when lo device up\")\nReported-by: Francesco Santoro <francesco.santoro@6wind.com>\nReported-by: Samuel Gauthier <samuel.gauthier@6wind.com>\nCC: Balakumaran Kannan <Balakumaran.Kannan@ap.sony.com>\nCC: Maruthi Thotad <Maruthi.Thotad@ap.sony.com>\nCC: Sabrina Dubroca <sd@queasysnail.net>\nCC: Hannes Frederic Sowa <hannes@stressinduktion.org>\nCC: Weilong Chen <chenweilong@huawei.com>\nCC: Gao feng <gaofeng@cn.fujitsu.com>\nSigned-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/e635b4766174381572b95f8fae153e7f1f36cf65"},{"sha":"f467184e2323db21d014ff72c65e3967b42e122a","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"net: pktgen: remove rcu locking in pktgen_change_name()\n\n[ Upstream commit 9a0b1e8ba4061778897b544afc898de2163382f7 ]\n\nAfter Jesper commit back in linux-3.18, we trigger a lockdep\nsplat in proc_create_data() while allocating memory from\npktgen_change_name().\n\nThis patch converts t->if_lock to a mutex, since it is now only\nused from control path, and adds proper locking to pktgen_change_name()\n\n1) pktgen_thread_lock to protect the outer loop (iterating threads)\n2) t->if_lock to protect the inner loop (iterating devices)\n\nNote that before Jesper patch, pktgen_change_name() was lacking proper\nprotection, but lockdep was not able to detect the problem.\n\nFixes: 8788370a1d4b (\"pktgen: RCU-ify \"if_list\" to remove lock in next_to_run()\")\nReported-by: John Sperbeck <jsperbeck@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Jesper Dangaard Brouer <brouer@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/f467184e2323db21d014ff72c65e3967b42e122a"},{"sha":"ebfbfc2e4df89c0fbeda64262a5a651e03f14274","author":{"name":"Nikolay Aleksandrov","email":"64c6133501914790fe0371388ffd86301bcc142b@cumulusnetworks.com"},"message":"bridge: multicast: restore perm router ports on multicast enable\n\n[ Upstream commit 7cb3f9214dfa443c1ccc2be637dcc6344cc203f0 ]\n\nSatish reported a problem with the perm multicast router ports not getting\nreenabled after some series of events, in particular if it happens that the\nmulticast snooping has been disabled and the port goes to disabled state\nthen it will be deleted from the router port list, but if it moves into\nnon-disabled state it will not be re-added because the mcast snooping is\nstill disabled, and enabling snooping later does nothing.\n\nHere are the steps to reproduce, setup br0 with snooping enabled and eth1\nadded as a perm router (multicast_router = 2):\n1. $ echo 0 > /sys/class/net/br0/bridge/multicast_snooping\n2. $ ip l set eth1 down\n^ This step deletes the interface from the router list\n3. $ ip l set eth1 up\n^ This step does not add it again because mcast snooping is disabled\n4. $ echo 1 > /sys/class/net/br0/bridge/multicast_snooping\n5. $ bridge -d -s mdb show\n<empty>\n\nAt this point we have mcast enabled and eth1 as a perm router (value = 2)\nbut it is not in the router list which is incorrect.\n\nAfter this change:\n1. $ echo 0 > /sys/class/net/br0/bridge/multicast_snooping\n2. $ ip l set eth1 down\n^ This step deletes the interface from the router list\n3. $ ip l set eth1 up\n^ This step does not add it again because mcast snooping is disabled\n4. $ echo 1 > /sys/class/net/br0/bridge/multicast_snooping\n5. $ bridge -d -s mdb show\nrouter ports on br0: eth1\n\nNote: we can directly do br_multicast_enable_port for all because the\nquerier timer already has checks for the port state and will simply\nexpire if it's in blocking/disabled. See the comment added by\ncommit 9aa66382163e7 (\"bridge: multicast: add a comment to\nbr_port_state_selection about blocking state\")\n\nFixes: 561f1103a2b7 (\"bridge: Add multicast_snooping sysfs toggle\")\nReported-by: Satish Ashok <sashok@cumulusnetworks.com>\nSigned-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/ebfbfc2e4df89c0fbeda64262a5a651e03f14274"},{"sha":"02558fa0e061c74c37bdb786694025f70582aaca","author":{"name":"Jiri Pirko","email":"a7e702c6c67814648a4f7569508b76ff202ca280@mellanox.com"},"message":"rtnetlink: Add rtnexthop offload flag to compare mask\n\n[ Upstream commit 85dda4e5b0ee1f5b4e8cc93d39e475006bc61ccd ]\n\nThe offload flag is a status flag and should not be used by\nFIB semantics for comparison.\n\nFixes: 37ed9493699c (\"rtnetlink: add RTNH_F_EXTERNAL flag for fib offload\")\nSigned-off-by: Jiri Pirko <jiri@mellanox.com>\nReviewed-by: Andy Gospodarek <andy@greyhouse.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/02558fa0e061c74c37bdb786694025f70582aaca"},{"sha":"3cb00b90e8b1bd59382f5e1304dd751f9674f027","author":{"name":"Sabrina Dubroca","email":"4970d9e510e008c61ce99b43933c9aaa332864d8@queasysnail.net"},"message":"net: add recursion limit to GRO\n\n[ Upstream commit fcd91dd449867c6bfe56a81cabba76b829fd05cd ]\n\nCurrently, GRO can do unlimited recursion through the gro_receive\nhandlers.  This was fixed for tunneling protocols by limiting tunnel GRO\nto one level with encap_mark, but both VLAN and TEB still have this\nproblem.  Thus, the kernel is vulnerable to a stack overflow, if we\nreceive a packet composed entirely of VLAN headers.\n\nThis patch adds a recursion counter to the GRO layer to prevent stack\noverflow.  When a gro_receive function hits the recursion limit, GRO is\naborted for this skb and it is processed normally.  This recursion\ncounter is put in the GRO CB, but could be turned into a percpu counter\nif we run out of space in the CB.\n\nThanks to Vladimír Beneš <vbenes@redhat.com> for the initial bug report.\n\nFixes: CVE-2016-7039\nFixes: 9b174d88c257 (\"net: Add Transparent Ethernet Bridging GRO support.\")\nFixes: 66e5133f19e9 (\"vlan: Add GRO support for non hardware accelerated vlan\")\nSigned-off-by: Sabrina Dubroca <sd@queasysnail.net>\nReviewed-by: Jiri Benc <jbenc@redhat.com>\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nAcked-by: Tom Herbert <tom@herbertland.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/openSUSE/kernel/commits/3cb00b90e8b1bd59382f5e1304dd751f9674f027"}]}
{"actor":{"display_login":"michal42"}}