{"push_id":1018061825,"size":87,"distinct_size":87,"ref":"refs/heads/aosp-6.0","head":"1a08e1de8bd701719629c04921cce1cbdd9af7e2","before":"79db905b3a1e562a828867a92c8ac9dc132c29cf","commits":[{"sha":"bbe1a6c076cf22b9e7b735c3f97ff98840895548","author":{"email":"9ff04a02a69f376b2b9aeec27187017cbf3cf5f9@redhat.com","name":"Daniel Borkmann"},"message":"random32: fix off-by-one in seeding requirement\n\n[ Upstream commit 51c37a70aaa3f95773af560e6db3073520513912 ]\n\nFor properly initialising the Tausworthe generator [1], we have\na strict seeding requirement, that is, s1 > 1, s2 > 7, s3 > 15.\n\nCommit 697f8d0348 (\"random32: seeding improvement\") introduced\na __seed() function that imposes boundary checks proposed by the\nerrata paper [2] to properly ensure above conditions.\n\nHowever, we're off by one, as the function is implemented as:\n\"return (x < m) ? x + m : x;\", and called with __seed(X, 1),\n__seed(X, 7), __seed(X, 15). Thus, an unwanted seed of 1, 7, 15\nwould be possible, whereas the lower boundary should actually\nbe of at least 2, 8, 16, just as GSL does. Fix this, as otherwise\nan initialization with an unwanted seed could have the effect\nthat Tausworthe's PRNG properties cannot not be ensured.\n\nNote that this PRNG is *not* used for cryptography in the kernel.\n\n [1] http://www.iro.umontreal.ca/~lecuyer/myftp/papers/tausme.ps\n [2] http://www.iro.umontreal.ca/~lecuyer/myftp/papers/tausme2.ps\n\nJoint work with Hannes Frederic Sowa.\n\nFixes: 697f8d0348a6 (\"random32: seeding improvement\")\nCc: Stephen Hemminger <stephen@networkplumber.org>\nCc: Florian Weimer <fweimer@redhat.com>\nCc: Theodore Ts'o <tytso@mit.edu>\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/bbe1a6c076cf22b9e7b735c3f97ff98840895548"},{"sha":"e745523e45b5f64ac179c1c5ea156c159bab1b8d","author":{"email":"13e4c2c2c15eff98ad47d02f3ccee2d83dc7015d@redhat.com","name":"Veaceslav Falico"},"message":"bonding: don't permit to use ARP monitoring in 802.3ad mode\n\n[ Upstream commit ec9f1d15db8185f63a2c3143dc1e90ba18541b08 ]\n\nCurrently the ARP monitoring is not supported with 802.3ad, and it's\nprohibited to use it via the module params.\n\nHowever we still can set it afterwards via sysfs, cause we only check for\n*LB modes there.\n\nTo fix this - add a check for 802.3ad mode in bonding_store_arp_interval.\n\nSigned-off-by: Veaceslav Falico <vfalico@redhat.com>\nCC: Jay Vosburgh <fubar@us.ibm.com>\nCC: Andy Gospodarek <andy@greyhouse.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/e745523e45b5f64ac179c1c5ea156c159bab1b8d"},{"sha":"cda30475722784749de1a9039f86a7303fcfe69e","author":{"email":"f9f077d1da4c7aa947f9864fa5a28c3588f6a45d@linux.intel.com","name":"Jukka Rissanen"},"message":"6lowpan: Uncompression of traffic class field was incorrect\n\n[ Upstream commit 1188f05497e7bd2f2614b99c54adfbe7413d5749 ]\n\nIf priority/traffic class field in IPv6 header is set (seen when\nusing ssh), the uncompression sets the TC and Flow fields incorrectly.\n\nExample:\n\nThis is IPv6 header of a sent packet. Note the priority/TC (=1) in\nthe first byte.\n\n00000000: 61 00 00 00 00 2c 06 40 fe 80 00 00 00 00 00 00\n00000010: 02 02 72 ff fe c6 42 10 fe 80 00 00 00 00 00 00\n00000020: 02 1e ab ff fe 4c 52 57\n\nThis gets compressed like this in the sending side\n\n00000000: 72 31 04 06 02 1e ab ff fe 4c 52 57 ec c2 00 16\n00000010: aa 2d fe 92 86 4e be c6 ....\n\nIn the receiving end, the packet gets uncompressed to this\nIPv6 header\n\n00000000: 60 06 06 02 00 2a 1e 40 fe 80 00 00 00 00 00 00\n00000010: 02 02 72 ff fe c6 42 10 fe 80 00 00 00 00 00 00\n00000020: ab ff fe 4c 52 57 ec c2\n\nFirst four bytes are set incorrectly and we have also lost\ntwo bytes from destination address.\n\nThe fix is to switch the case values in switch statement\nwhen checking the TC field.\n\nSigned-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/cda30475722784749de1a9039f86a7303fcfe69e"},{"sha":"7af42ab14efdc05a4b26473d82878d24592f8afb","author":{"email":"262b42b771725e3ebec40395f2b058e593df7462@redhat.com","name":"Nikolay Aleksandrov"},"message":"bonding: fix two race conditions in bond_store_updelay/downdelay\n\n[ Upstream commit b869ccfab1e324507fa3596e3e1308444fb68227 ]\n\nThis patch fixes two race conditions between bond_store_updelay/downdelay\nand bond_store_miimon which could lead to division by zero as miimon can\nbe set to 0 while either updelay/downdelay are being set and thus miss the\nzero check in the beginning, the zero div happens because updelay/downdelay\nare stored as new_value / bond->params.miimon. Use rtnl to synchronize with\nmiimon setting.\n\nSigned-off-by: Nikolay Aleksandrov <nikolay@redhat.com>\nCC: Jay Vosburgh <fubar@us.ibm.com>\nCC: Andy Gospodarek <andy@greyhouse.net>\nCC: Veaceslav Falico <vfalico@redhat.com>\nAcked-by: Veaceslav Falico <vfalico@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/7af42ab14efdc05a4b26473d82878d24592f8afb"},{"sha":"804bb6356f7777e13ea642ddfa038f5157641530","author":{"email":"ff341aa343d564f9e53e9dcb6996be8c04859a66@oracle.com","name":"Dan Carpenter"},"message":"isdnloop: use strlcpy() instead of strcpy()\n\n[ Upstream commit f9a23c84486ed350cce7bb1b2828abd1f6658796 ]\n\nThese strings come from a copy_from_user() and there is no way to be\nsure they are NUL terminated.\n\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/804bb6356f7777e13ea642ddfa038f5157641530"},{"sha":"9473b5abdf21c3af068fa341e58f89d4cbe0d7c3","author":{"email":"074881f6f5da4d3b5278870ff234d1077ee622c0@tilera.com","name":"Chris Metcalf"},"message":"connector: improved unaligned access error fix\n\n[ Upstream commit 1ca1a4cf59ea343a1a70084fe7cc96f37f3cf5b1 ]\n\nIn af3e095a1fb4, Erik Jacobsen fixed one type of unaligned access\nbug for ia64 by converting a 64-bit write to use put_unaligned().\nUnfortunately, since gcc will convert a short memset() to a series\nof appropriately-aligned stores, the problem is now visible again\non tilegx, where the memset that zeros out proc_event is converted\nto three 64-bit stores, causing an unaligned access panic.\n\nA better fix for the original problem is to ensure that proc_event\nis aligned to 8 bytes here.  We can do that relatively easily by\narranging to start the struct cn_msg aligned to 8 bytes and then\noffset by 4 bytes.  Doing so means that the immediately following\nproc_event structure is then correctly aligned to 8 bytes.\n\nThe result is that the memset() stores are now aligned, and as an\nadded benefit, we can remove the put_unaligned() calls in the code.\n\nSigned-off-by: Chris Metcalf <cmetcalf@tilera.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/9473b5abdf21c3af068fa341e58f89d4cbe0d7c3"},{"sha":"379a5243c62960d34054a6fdf6b9d2d25eca2292","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"ipv4: fix possible seqlock deadlock\n\n[ Upstream commit c9e9042994d37cbc1ee538c500e9da1bb9d1bcdf ]\n\nip4_datagram_connect() being called from process context,\nit should use IP_INC_STATS() instead of IP_INC_STATS_BH()\notherwise we can deadlock on 32bit arches, or get corruptions of\nSNMP counters.\n\nFixes: 584bdf8cbdf6 (\"[IPV4]: Fix \"ipOutNoRoutes\" counter error for TCP and UDP\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Dave Jones <davej@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/379a5243c62960d34054a6fdf6b9d2d25eca2292"},{"sha":"df98eae880bafb4296da274bfa87f78eb56838f5","author":{"email":"331be22c6b63ca3e0a03d408c2d906b1b02cd5f2@stressinduktion.org","name":"Hannes Frederic Sowa"},"message":"net: rework recvmsg handler msg_name and msg_namelen logic\n\n[ Upstream commit f3d3342602f8bcbf37d7c46641cb9bca7618eb1c ]\n\nThis patch now always passes msg->msg_namelen as 0. recvmsg handlers must\nset msg_namelen to the proper size <= sizeof(struct sockaddr_storage)\nto return msg_name to the user.\n\nThis prevents numerous uninitialized memory leaks we had in the\nrecvmsg handlers and makes it harder for new code to accidentally leak\nuninitialized memory.\n\nOptimize for the case recvfrom is called with NULL as address. We don't\nneed to copy the address at all, so set it to NULL before invoking the\nrecvmsg handler. We can do so, because all the recvmsg handlers must\ncope with the case a plain read() is called on them. read() also sets\nmsg_name to NULL.\n\nAlso document these changes in include/linux/net.h as suggested by David\nMiller.\n\nChanges since RFC:\n\nSet msg->msg_name = NULL if user specified a NULL in msg_name but had a\nnon-null msg_namelen in verify_iovec/verify_compat_iovec. This doesn't\naffect sendto as it would bail out earlier while trying to copy-in the\naddress. It also more naturally reflects the logic by the callers of\nverify_iovec.\n\nWith this change in place I could remove \"\nif (!uaddr || msg_sys->msg_namelen == 0)\n\tmsg->msg_name = NULL\n\".\n\nThis change does not alter the user visible error logic as we ignore\nmsg_namelen as long as msg_name is NULL.\n\nAlso remove two unnecessary curly brackets in ___sys_recvmsg and change\ncomments to netdev style.\n\nCc: David Miller <davem@davemloft.net>\nSuggested-by: Eric Dumazet <eric.dumazet@gmail.com>\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/df98eae880bafb4296da274bfa87f78eb56838f5"},{"sha":"fe9de99c0f595e5d70d686c5867e6d2b271b976f","author":{"email":"331be22c6b63ca3e0a03d408c2d906b1b02cd5f2@stressinduktion.org","name":"Hannes Frederic Sowa"},"message":"net: add BUG_ON if kernel advertises msg_namelen > sizeof(struct sockaddr_storage)\n\n[ Upstream commit 68c6beb373955da0886d8f4f5995b3922ceda4be ]\n\nIn that case it is probable that kernel code overwrote part of the\nstack. So we should bail out loudly here.\n\nThe BUG_ON may be removed in future if we are sure all protocols are\nconformant.\n\nSuggested-by: Eric Dumazet <eric.dumazet@gmail.com>\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/fe9de99c0f595e5d70d686c5867e6d2b271b976f"},{"sha":"d618142d39242a07eee05abf32f3690bf5942dfb","author":{"email":"ff341aa343d564f9e53e9dcb6996be8c04859a66@oracle.com","name":"Dan Carpenter"},"message":"net: clamp ->msg_namelen instead of returning an error\n\n[ Upstream commit db31c55a6fb245fdbb752a2ca4aefec89afabb06 ]\n\nIf kmsg->msg_namelen > sizeof(struct sockaddr_storage) then in the\noriginal code that would lead to memory corruption in the kernel if you\nhad audit configured.  If you didn't have audit configured it was\nharmless.\n\nThere are some programs such as beta versions of Ruby which use too\nlarge of a buffer and returning an error code breaks them.  We should\nclamp the ->msg_namelen value instead.\n\nFixes: 1661bf364ae9 (\"net: heap overflow in __audit_sockaddr()\")\nReported-by: Eric Wong <normalperson@yhbt.net>\nSigned-off-by: Dan Carpenter <dan.carpenter@oracle.com>\nTested-by: Eric Wong <normalperson@yhbt.net>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/d618142d39242a07eee05abf32f3690bf5942dfb"},{"sha":"ecfea8bc4f0294604f095fb02d02aab4aa3b413e","author":{"email":"331be22c6b63ca3e0a03d408c2d906b1b02cd5f2@stressinduktion.org","name":"Hannes Frederic Sowa"},"message":"ipv6: fix leaking uninitialized port number of offender sockaddr\n\n[ Upstream commit 1fa4c710b6fe7b0aac9907240291b6fe6aafc3b8 ]\n\nOffenders don't have port numbers, so set it to 0.\n\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/ecfea8bc4f0294604f095fb02d02aab4aa3b413e"},{"sha":"f8d7a67522d7b7a7bf5f5bef637886147bdde787","author":{"email":"c1cbb87de349443b90fa63f6d2cc5403843bc133@windriver.com","name":"Ying Xue"},"message":"atm: idt77252: fix dev refcnt leak\n\n[ Upstream commit b5de4a22f157ca345cdb3575207bf46402414bc1 ]\n\ninit_card() calls dev_get_by_name() to get a network deceive. But it\ndoesn't decrease network device reference count after the device is\nused.\n\nSigned-off-by: Ying Xue <ying.xue@windriver.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/f8d7a67522d7b7a7bf5f5bef637886147bdde787"},{"sha":"0cfd023929fe0e574adaafcf5e4c3c53d5bb3d3c","author":{"email":"cbd80080413a7dff621bc5de2d3d61903bde20a2@redhat.com","name":"Vlad Yasevich"},"message":"net: core: Always propagate flag changes to interfaces\n\n[ Upstream commit d2615bf450694c1302d86b9cc8a8958edfe4c3a4 ]\n\nThe following commit:\n    b6c40d68ff6498b7f63ddf97cf0aa818d748dee7\n    net: only invoke dev->change_rx_flags when device is UP\n\ntried to fix a problem with VLAN devices and promiscuouse flag setting.\nThe issue was that VLAN device was setting a flag on an interface that\nwas down, thus resulting in bad promiscuity count.\nThis commit blocked flag propagation to any device that is currently\ndown.\n\nA later commit:\n    deede2fabe24e00bd7e246eb81cd5767dc6fcfc7\n    vlan: Don't propagate flag changes on down interfaces\n\nfixed VLAN code to only propagate flags when the VLAN interface is up,\nthus fixing the same issue as above, only localized to VLAN.\n\nThe problem we have now is that if we have create a complex stack\ninvolving multiple software devices like bridges, bonds, and vlans,\nthen it is possible that the flags would not propagate properly to\nthe physical devices.  A simple examle of the scenario is the\nfollowing:\n\n  eth0----> bond0 ----> bridge0 ---> vlan50\n\nIf bond0 or eth0 happen to be down at the time bond0 is added to\nthe bridge, then eth0 will never have promisc mode set which is\ncurrently required for operation as part of the bridge.  As a\nresult, packets with vlan50 will be dropped by the interface.\n\nThe only 2 devices that implement the special flag handling are\nVLAN and DSA and they both have required code to prevent incorrect\nflag propagation.  As a result we can remove the generic solution\nintroduced in b6c40d68ff6498b7f63ddf97cf0aa818d748dee7 and leave\nit to the individual devices to decide whether they will block\nflag propagation or not.\n\nReported-by: Stefan Priebe <s.priebe@profihost.ag>\nSuggested-by: Veaceslav Falico <vfalico@redhat.com>\nSigned-off-by: Vlad Yasevich <vyasevic@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/0cfd023929fe0e574adaafcf5e4c3c53d5bb3d3c"},{"sha":"106a7a48396ccaac7fb8b2f7452fcb1f8437bac9","author":{"email":"6319509b12a56ad4c8f781f7750eb8df2374d4fd@huawei.com","name":"Ding Tianhong"},"message":"bridge: flush br's address entry in fdb when remove the bridge dev\n\n[ Upstream commit f873042093c0b418d2351fe142222b625c740149 ]\n\nWhen the following commands are executed:\n\nbrctl addbr br0\nifconfig br0 hw ether <addr>\nrmmod bridge\n\nThe calltrace will occur:\n\n[  563.312114] device eth1 left promiscuous mode\n[  563.312188] br0: port 1(eth1) entered disabled state\n[  563.468190] kmem_cache_destroy bridge_fdb_cache: Slab cache still has objects\n[  563.468197] CPU: 6 PID: 6982 Comm: rmmod Tainted: G           O 3.12.0-0.7-default+ #9\n[  563.468199] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007\n[  563.468200]  0000000000000880 ffff88010f111e98 ffffffff814d1c92 ffff88010f111eb8\n[  563.468204]  ffffffff81148efd ffff88010f111eb8 0000000000000000 ffff88010f111ec8\n[  563.468206]  ffffffffa062a270 ffff88010f111ed8 ffffffffa063ac76 ffff88010f111f78\n[  563.468209] Call Trace:\n[  563.468218]  [<ffffffff814d1c92>] dump_stack+0x6a/0x78\n[  563.468234]  [<ffffffff81148efd>] kmem_cache_destroy+0xfd/0x100\n[  563.468242]  [<ffffffffa062a270>] br_fdb_fini+0x10/0x20 [bridge]\n[  563.468247]  [<ffffffffa063ac76>] br_deinit+0x4e/0x50 [bridge]\n[  563.468254]  [<ffffffff810c7dc9>] SyS_delete_module+0x199/0x2b0\n[  563.468259]  [<ffffffff814e0922>] system_call_fastpath+0x16/0x1b\n[  570.377958] Bridge firewalling registered\n\n--------------------------- cut here -------------------------------\n\nThe reason is that when the bridge dev's address is changed, the\nbr_fdb_change_mac_address() will add new address in fdb, but when\nthe bridge was removed, the address entry in the fdb did not free,\nthe bridge_fdb_cache still has objects when destroy the cache, Fix\nthis by flushing the bridge address entry when removing the bridge.\n\nv2: according to the Toshiaki Makita and Vlad's suggestion, I only\n    delete the vlan0 entry, it still have a leak here if the vlan id\n    is other number, so I need to call fdb_delete_by_port(br, NULL, 1)\n    to flush all entries whose dst is NULL for the bridge.\n\nSuggested-by: Toshiaki Makita <toshiaki.makita1@gmail.com>\nSuggested-by: Vlad Yasevich <vyasevich@gmail.com>\nSigned-off-by: Ding Tianhong <dingtianhong@huawei.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/106a7a48396ccaac7fb8b2f7452fcb1f8437bac9"},{"sha":"ca6c58f70efe1dc5918d1d585b0acc032f6c947f","author":{"email":"9ff04a02a69f376b2b9aeec27187017cbf3cf5f9@redhat.com","name":"Daniel Borkmann"},"message":"packet: fix use after free race in send path when dev is released\n\n[ Upstream commit e40526cb20b5ee53419452e1f03d97092f144418 ]\n\nSalam reported a use after free bug in PF_PACKET that occurs when\nwe're sending out frames on a socket bound device and suddenly the\nnet device is being unregistered. It appears that commit 827d9780\nintroduced a possible race condition between {t,}packet_snd() and\npacket_notifier(). In the case of a bound socket, packet_notifier()\ncan drop the last reference to the net_device and {t,}packet_snd()\nmight end up suddenly sending a packet over a freed net_device.\n\nTo avoid reverting 827d9780 and thus introducing a performance\nregression compared to the current state of things, we decided to\nhold a cached RCU protected pointer to the net device and maintain\nit on write side via bind spin_lock protected register_prot_hook()\nand __unregister_prot_hook() calls.\n\nIn {t,}packet_snd() path, we access this pointer under rcu_read_lock\nthrough packet_cached_dev_get() that holds reference to the device\nto prevent it from being freed through packet_notifier() while\nwe're in send path. This is okay to do as dev_put()/dev_hold() are\nper-cpu counters, so this should not be a performance issue. Also,\nthe code simplifies a bit as we don't need need_rls_dev anymore.\n\nFixes: 827d978037d7 (\"af-packet: Use existing netdev reference for bound sockets.\")\nReported-by: Salam Noureddine <noureddine@aristanetworks.com>\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nSigned-off-by: Salam Noureddine <noureddine@aristanetworks.com>\nCc: Ben Greear <greearb@candelatech.com>\nCc: Eric Dumazet <eric.dumazet@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/ca6c58f70efe1dc5918d1d585b0acc032f6c947f"},{"sha":"e95cfa9db02214ce9b3ea972e8b649928977df44","author":{"email":"13e4c2c2c15eff98ad47d02f3ccee2d83dc7015d@redhat.com","name":"Veaceslav Falico"},"message":"af_packet: block BH in prb_shutdown_retire_blk_timer()\n\n[ Upstream commit ec6f809ff6f19fafba3212f6aff0dda71dfac8e8 ]\n\nCurrently we're using plain spin_lock() in prb_shutdown_retire_blk_timer(),\nhowever the timer might fire right in the middle and thus try to re-aquire\nthe same spinlock, leaving us in a endless loop.\n\nTo fix that, use the spin_lock_bh() to block it.\n\nFixes: f6fb8f100b80 (\"af-packet: TPACKET_V3 flexible buffer implementation.\")\nCC: \"David S. Miller\" <davem@davemloft.net>\nCC: Daniel Borkmann <dborkman@redhat.com>\nCC: Willem de Bruijn <willemb@google.com>\nCC: Phil Sutter <phil@nwl.cc>\nCC: Eric Dumazet <edumazet@google.com>\nReported-by: Jan Stancek <jstancek@redhat.com>\nTested-by: Jan Stancek <jstancek@redhat.com>\nSigned-off-by: Veaceslav Falico <vfalico@redhat.com>\nAcked-by: Daniel Borkmann <dborkman@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/e95cfa9db02214ce9b3ea972e8b649928977df44"},{"sha":"ff985b026b8d6a09e18e179f04b181d5fde75d19","author":{"email":"443646d156d0e0db4e143fd54251ca15b42bcccb@churchofgit.com","name":"Shawn Landden"},"message":"net: update consumers of MSG_MORE to recognize MSG_SENDPAGE_NOTLAST\n\n[ Upstream commit d3f7d56a7a4671d395e8af87071068a195257bf6 ]\n\nCommit 35f9c09fe (tcp: tcp_sendpages() should call tcp_push() once)\nadded an internal flag MSG_SENDPAGE_NOTLAST, similar to\nMSG_MORE.\n\nalgif_hash, algif_skcipher, and udp used MSG_MORE from tcp_sendpages()\nand need to see the new flag as identical to MSG_MORE.\n\nThis fixes sendfile() on AF_ALG.\n\nv3: also fix udp\n\nReported-and-tested-by: Shawn Landden <shawnlandden@gmail.com>\nCc: Tom Herbert <therbert@google.com>\nCc: Eric Dumazet <eric.dumazet@gmail.com>\nCc: David S. Miller <davem@davemloft.net>\nOriginal-patch: Richard Weinberger <richard@nod.at>\nSigned-off-by: Shawn Landden <shawn@churchofgit.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/ff985b026b8d6a09e18e179f04b181d5fde75d19"},{"sha":"5a52ca7a69af8d93c52dff53c87caffad63ee7ef","author":{"email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com","name":"Eric Dumazet"},"message":"inet: fix possible seqlock deadlocks\n\n[ Upstream commit f1d8cba61c3c4b1eb88e507249c4cb8d635d9a76 ]\n\nIn commit c9e9042994d3 (\"ipv4: fix possible seqlock deadlock\") I left\nanother places where IP_INC_STATS_BH() were improperly used.\n\nudp_sendmsg(), ping_v4_sendmsg() and tcp_v4_connect() are called from\nprocess context, not from softirq context.\n\nThis was detected by lockdep seqlock support.\n\nReported-by: jongman heo <jongman.heo@samsung.com>\nFixes: 584bdf8cbdf6 (\"[IPV4]: Fix \"ipOutNoRoutes\" counter error for TCP and UDP\")\nFixes: c319b4d76b9e (\"net: ipv4: add IPPROTO_ICMP socket kind\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Hannes Frederic Sowa <hannes@stressinduktion.org>\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/5a52ca7a69af8d93c52dff53c87caffad63ee7ef"},{"sha":"2e6a4123c1dccb7c26277d90e661351464d1be16","author":{"email":"331be22c6b63ca3e0a03d408c2d906b1b02cd5f2@stressinduktion.org","name":"Hannes Frederic Sowa"},"message":"ipv6: fix possible seqlock deadlock in ip6_finish_output2\n\n[ Upstream commit 7f88c6b23afbd31545c676dea77ba9593a1a14bf ]\n\nIPv6 stats are 64 bits and thus are protected with a seqlock. By not\ndisabling bottom-half we could deadlock here if we don't disable bh and\na softirq reentrantly updates the same mib.\n\nCc: Eric Dumazet <eric.dumazet@gmail.com>\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/2e6a4123c1dccb7c26277d90e661351464d1be16"},{"sha":"2aeb38835fd5e5b5216530223f8c3abfb93a15dd","author":{"email":"98b5df125785ddebbf642f8cf9f43d3980ddc694@windriver.com","name":"fan.du"},"message":"{pktgen, xfrm} Update IPv4 header total len and checksum after tranformation\n\n[ Upstream commit 3868204d6b89ea373a273e760609cb08020beb1a ]\n\ncommit a553e4a6317b2cfc7659542c10fe43184ffe53da (\"[PKTGEN]: IPSEC support\")\ntried to support IPsec ESP transport transformation for pktgen, but acctually\nthis doesn't work at all for two reasons(The orignal transformed packet has\nbad IPv4 checksum value, as well as wrong auth value, reported by wireshark)\n\n- After transpormation, IPv4 header total length needs update,\n  because encrypted payload's length is NOT same as that of plain text.\n\n- After transformation, IPv4 checksum needs re-caculate because of payload\n  has been changed.\n\nWith this patch, armmed pktgen with below cofiguration, Wireshark is able to\ndecrypted ESP packet generated by pktgen without any IPv4 checksum error or\nauth value error.\n\npgset \"flag IPSEC\"\npgset \"flows 1\"\n\nSigned-off-by: Fan Du <fan.du@windriver.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/aospcus/android_kernel_asus_grouper/commits/2aeb38835fd5e5b5216530223f8c3abfb93a15dd"}]}