{"push_id":1461379311,"size":260,"distinct_size":3,"ref":"refs/heads/rpi-4.8.y-regulator","head":"f5a5a6ebacf7cc7ece9751f2d80f06b2a02b9846","before":"67e80fef3863d6a5f1b3a0fe55f3e6b011fd084e","commits":[{"sha":"8070f33be6c4f7a947db40658a116ef135b54e74","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"gro_cells: mark napi struct as not busy poll candidates\n\n[ Upstream commit e88a2766143a27bfe6704b4493b214de4094cf29 ]\n\nRolf Neugebauer reported very long delays at netns dismantle.\n\nEric W. Biederman was kind enough to look at this problem\nand noticed synchronize_net() occurring from netif_napi_del() that was\nadded in linux-4.5\n\nBusy polling makes no sense for tunnels NAPI.\nIf busy poll is used for sessions over tunnels, the poller will need to\npoll the physical device queue anyway.\n\nnetif_tx_napi_add() could be used here, but function name is misleading,\nand renaming it is not stable material, so set NAPI_STATE_NO_BUSY_POLL\nbit directly.\n\nThis will avoid inserting gro_cells napi structures in napi_hash[]\nand avoid the problematic synchronize_net() (per possible cpu) that\nRolf reported.\n\nFixes: 93d05d4a320c (\"net: provide generic busy polling to all NAPI drivers\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Rolf Neugebauer <rolf.neugebauer@docker.com>\nReported-by: Eric W. Biederman <ebiederm@xmission.com>\nAcked-by: Cong Wang <xiyou.wangcong@gmail.com>\nTested-by: Rolf Neugebauer <rolf.neugebauer@docker.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/8070f33be6c4f7a947db40658a116ef135b54e74"},{"sha":"f959eb5074396852a4f366de3bee4793149f4c63","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"virtio-net: add a missing synchronize_net()\n\n[ Upstream commit 963abe5c8a0273a1cf5913556da1b1189de0e57a ]\n\nIt seems many drivers do not respect napi_hash_del() contract.\n\nWhen napi_hash_del() is used before netif_napi_del(), an RCU grace\nperiod is needed before freeing NAPI object.\n\nFixes: 91815639d880 (\"virtio-net: rx busy polling support\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Jason Wang <jasowang@redhat.com>\nCc: Michael S. Tsirkin <mst@redhat.com>\nAcked-by: Michael S. Tsirkin <mst@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/f959eb5074396852a4f366de3bee4793149f4c63"},{"sha":"65dfc8b4547fdc4077ab563359767ea5ace020f5","author":{"name":"Florian Fainelli","email":"244da8ca84c0b82369d8dd3f15015e61f28f6fe5@gmail.com"},"message":"net: dsa: b53: Fix VLAN usage and how we treat CPU port\n\n[ Upstream commit e47112d9d6009bf6b7438cedc0270316d6b0370d ]\n\nWe currently have a fundamental problem in how we treat the CPU port and\nits VLAN membership. As soon as a second VLAN is configured to be\nuntagged, the CPU automatically becomes untagged for that VLAN as well,\nand yet, we don't gracefully make sure that the CPU becomes tagged in\nthe other VLANs it could be a member of. This results in only one VLAN\nbeing effectively usable from the CPU's perspective.\n\nInstead of having some pretty complex logic which tries to maintain the\nCPU port's default VLAN and its untagged properties, just do something\nvery simple which consists in neither altering the CPU port's PVID\nsettings, nor its untagged settings:\n\n- whenever a VLAN is added, the CPU is automatically a member of this\n  VLAN group, as a tagged member\n- PVID settings for downstream ports do not alter the CPU port's PVID\n  since it now is part of all VLANs in the system\n\nThis means that a typical example where e.g: LAN ports are in VLAN1, and\nWAN port is in VLAN2, now require having two VLAN interfaces for the\nhost to properly terminate and send traffic from/to.\n\nFixes: Fixes: a2482d2ce349 (\"net: dsa: b53: Plug in VLAN support\")\nReported-by: Hartmut Knaack <knaack.h@gmx.de>\nSigned-off-by: Florian Fainelli <f.fainelli@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/65dfc8b4547fdc4077ab563359767ea5ace020f5"},{"sha":"1b079d5b9fc18b8af94f415f637b13be77ff04b5","author":{"name":"WANG Cong","email":"3f5d79d28d6d48052800caba9df0b30e06fefe41@gmail.com"},"message":"net: check dead netns for peernet2id_alloc()\n\n[ Upstream commit cfc44a4d147ea605d66ccb917cc24467d15ff867 ]\n\nAndrei reports we still allocate netns ID from idr after we destroy\nit in cleanup_net().\n\ncleanup_net():\n  ...\n  idr_destroy(&net->netns_ids);\n  ...\n  list_for_each_entry_reverse(ops, &pernet_list, list)\n    ops_exit_list(ops, &net_exit_list);\n      -> rollback_registered_many()\n        -> rtmsg_ifinfo_build_skb()\n         -> rtnl_fill_ifinfo()\n           -> peernet2id_alloc()\n\nAfter that point we should not even access net->netns_ids, we\nshould check the death of the current netns as early as we can in\npeernet2id_alloc().\n\nFor net-next we can consider to avoid sending rtmsg totally,\nit is a good optimization for netns teardown path.\n\nFixes: 0c7aecd4bde4 (\"netns: add rtnl cmd to add and get peer netns ids\")\nReported-by: Andrei Vagin <avagin@gmail.com>\nCc: Nicolas Dichtel <nicolas.dichtel@6wind.com>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nAcked-by: Andrei Vagin <avagin@openvz.org>\nSigned-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/1b079d5b9fc18b8af94f415f637b13be77ff04b5"},{"sha":"a75684ab7a128a88918d3bebada03b0348903952","author":{"name":"Paolo Abeni","email":"760d0d6fcadb77e1b4c1d3c7879788c2b4ed8bbe@redhat.com"},"message":"ip6_tunnel: disable caching when the traffic class is inherited\n\n[ Upstream commit b5c2d49544e5930c96e2632a7eece3f4325a1888 ]\n\nIf an ip6 tunnel is configured to inherit the traffic class from\nthe inner header, the dst_cache must be disabled or it will foul\nthe policy routing.\n\nThe issue is apprently there since at leat Linux-2.6.12-rc2.\n\nReported-by: Liam McBirnie <liam.mcbirnie@boeing.com>\nCc: Liam McBirnie <liam.mcbirnie@boeing.com>\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: Paolo Abeni <pabeni@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/a75684ab7a128a88918d3bebada03b0348903952"},{"sha":"bdc5c63e4b38eba5fa4765bc24234cb6554e6430","author":{"name":"Jeremy Linton","email":"bcb290b2b92971fec4d7fe0f8143af8a8a8da744@arm.com"},"message":"net: sky2: Fix shutdown crash\n\n[ Upstream commit 06ba3b2133dc203e1e9bc36cee7f0839b79a9e8b ]\n\nThe sky2 frequently crashes during machine shutdown with:\n\nsky2_get_stats+0x60/0x3d8 [sky2]\ndev_get_stats+0x68/0xd8\nrtnl_fill_stats+0x54/0x140\nrtnl_fill_ifinfo+0x46c/0xc68\nrtmsg_ifinfo_build_skb+0x7c/0xf0\nrtmsg_ifinfo.part.22+0x3c/0x70\nrtmsg_ifinfo+0x50/0x5c\nnetdev_state_change+0x4c/0x58\nlinkwatch_do_dev+0x50/0x88\n__linkwatch_run_queue+0x104/0x1a4\nlinkwatch_event+0x30/0x3c\nprocess_one_work+0x140/0x3e0\nworker_thread+0x60/0x44c\nkthread+0xdc/0xf0\nret_from_fork+0x10/0x50\n\nThis is caused by the sky2 being called after it has been shutdown.\nA previous thread about this can be found here:\n\nhttps://lkml.org/lkml/2016/4/12/410\n\nAn alternative fix is to assure that IFF_UP gets cleared by\ncalling dev_close() during shutdown. This is similar to what the\nbnx2/tg3/xgene and maybe others are doing to assure that the driver\nisn't being called following _shutdown().\n\nSigned-off-by: Jeremy Linton <jeremy.linton@arm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/bdc5c63e4b38eba5fa4765bc24234cb6554e6430"},{"sha":"c39caa8f80c0f927963f4b8470a8b4ae2d2064ee","author":{"name":"WANG Cong","email":"3f5d79d28d6d48052800caba9df0b30e06fefe41@gmail.com"},"message":"af_unix: conditionally use freezable blocking calls in read\n\n[ Upstream commit 06a77b07e3b44aea2b3c0e64de420ea2cfdcbaa9 ]\n\nCommit 2b15af6f95 (\"af_unix: use freezable blocking calls in read\")\nconverts schedule_timeout() to its freezable version, it was probably\ncorrect at that time, but later, commit 2b514574f7e8\n(\"net: af_unix: implement splice for stream af_unix sockets\") breaks\nthe strong requirement for a freezable sleep, according to\ncommit 0f9548ca1091:\n\n    We shouldn't try_to_freeze if locks are held.  Holding a lock can cause a\n    deadlock if the lock is later acquired in the suspend or hibernate path\n    (e.g.  by dpm).  Holding a lock can also cause a deadlock in the case of\n    cgroup_freezer if a lock is held inside a frozen cgroup that is later\n    acquired by a process outside that group.\n\nThe pipe_lock is still held at that point.\n\nSo use freezable version only for the recvmsg call path, avoid impact for\nAndroid.\n\nFixes: 2b514574f7e8 (\"net: af_unix: implement splice for stream af_unix sockets\")\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nCc: Tejun Heo <tj@kernel.org>\nCc: Colin Cross <ccross@android.com>\nCc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>\nCc: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/c39caa8f80c0f927963f4b8470a8b4ae2d2064ee"},{"sha":"7f8b251a09859816e52a21b3f77eeb0dc579cd1a","author":{"name":"Sabrina Dubroca","email":"4970d9e510e008c61ce99b43933c9aaa332864d8@queasysnail.net"},"message":"rtnetlink: fix FDB size computation\n\n[ Upstream commit f82ef3e10a870acc19fa04f80ef5877eaa26f41e ]\n\nAdd missing NDA_VLAN attribute's size.\n\nFixes: 1e53d5bb8878 (\"net: Pass VLAN ID to rtnl_fdb_notify.\")\nSigned-off-by: Sabrina Dubroca <sd@queasysnail.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/7f8b251a09859816e52a21b3f77eeb0dc579cd1a"},{"sha":"84df56749f48aed274bbfd2db6b6fb9dd540ff6b","author":{"name":"Guillaume Nault","email":"3f2beb9890afcf959ec304431b991035a559d9bd@alphalink.fr"},"message":"l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind()\n\n[ Upstream commit 32c231164b762dddefa13af5a0101032c70b50ef ]\n\nLock socket before checking the SOCK_ZAPPED flag in l2tp_ip6_bind().\nWithout lock, a concurrent call could modify the socket flags between\nthe sock_flag(sk, SOCK_ZAPPED) test and the lock_sock() call. This way,\na socket could be inserted twice in l2tp_ip6_bind_table. Releasing it\nwould then leave a stale pointer there, generating use-after-free\nerrors when walking through the list or modifying adjacent entries.\n\nBUG: KASAN: use-after-free in l2tp_ip6_close+0x22e/0x290 at addr ffff8800081b0ed8\nWrite of size 8 by task syz-executor/10987\nCPU: 0 PID: 10987 Comm: syz-executor Not tainted 4.8.0+ #39\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014\n ffff880031d97838 ffffffff829f835b ffff88001b5a1640 ffff8800081b0ec0\n ffff8800081b15a0 ffff8800081b6d20 ffff880031d97860 ffffffff8174d3cc\n ffff880031d978f0 ffff8800081b0e80 ffff88001b5a1640 ffff880031d978e0\nCall Trace:\n [<ffffffff829f835b>] dump_stack+0xb3/0x118 lib/dump_stack.c:15\n [<ffffffff8174d3cc>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:156\n [<     inline     >] print_address_description mm/kasan/report.c:194\n [<ffffffff8174d666>] kasan_report_error+0x1f6/0x4d0 mm/kasan/report.c:283\n [<     inline     >] kasan_report mm/kasan/report.c:303\n [<ffffffff8174db7e>] __asan_report_store8_noabort+0x3e/0x40 mm/kasan/report.c:329\n [<     inline     >] __write_once_size ./include/linux/compiler.h:249\n [<     inline     >] __hlist_del ./include/linux/list.h:622\n [<     inline     >] hlist_del_init ./include/linux/list.h:637\n [<ffffffff8579047e>] l2tp_ip6_close+0x22e/0x290 net/l2tp/l2tp_ip6.c:239\n [<ffffffff850b2dfd>] inet_release+0xed/0x1c0 net/ipv4/af_inet.c:415\n [<ffffffff851dc5a0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:422\n [<ffffffff84c4581d>] sock_release+0x8d/0x1d0 net/socket.c:570\n [<ffffffff84c45976>] sock_close+0x16/0x20 net/socket.c:1017\n [<ffffffff817a108c>] __fput+0x28c/0x780 fs/file_table.c:208\n [<ffffffff817a1605>] ____fput+0x15/0x20 fs/file_table.c:244\n [<ffffffff813774f9>] task_work_run+0xf9/0x170\n [<ffffffff81324aae>] do_exit+0x85e/0x2a00\n [<ffffffff81326dc8>] do_group_exit+0x108/0x330\n [<ffffffff81348cf7>] get_signal+0x617/0x17a0 kernel/signal.c:2307\n [<ffffffff811b49af>] do_signal+0x7f/0x18f0\n [<ffffffff810039bf>] exit_to_usermode_loop+0xbf/0x150 arch/x86/entry/common.c:156\n [<     inline     >] prepare_exit_to_usermode arch/x86/entry/common.c:190\n [<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0 arch/x86/entry/common.c:259\n [<ffffffff85e4d726>] entry_SYSCALL_64_fastpath+0xc4/0xc6\nObject at ffff8800081b0ec0, in cache L2TP/IPv6 size: 1448\nAllocated:\nPID = 10987\n [ 1116.897025] [<ffffffff811ddcb6>] save_stack_trace+0x16/0x20\n [ 1116.897025] [<ffffffff8174c736>] save_stack+0x46/0xd0\n [ 1116.897025] [<ffffffff8174c9ad>] kasan_kmalloc+0xad/0xe0\n [ 1116.897025] [<ffffffff8174cee2>] kasan_slab_alloc+0x12/0x20\n [ 1116.897025] [<     inline     >] slab_post_alloc_hook mm/slab.h:417\n [ 1116.897025] [<     inline     >] slab_alloc_node mm/slub.c:2708\n [ 1116.897025] [<     inline     >] slab_alloc mm/slub.c:2716\n [ 1116.897025] [<ffffffff817476a8>] kmem_cache_alloc+0xc8/0x2b0 mm/slub.c:2721\n [ 1116.897025] [<ffffffff84c4f6a9>] sk_prot_alloc+0x69/0x2b0 net/core/sock.c:1326\n [ 1116.897025] [<ffffffff84c58ac8>] sk_alloc+0x38/0xae0 net/core/sock.c:1388\n [ 1116.897025] [<ffffffff851ddf67>] inet6_create+0x2d7/0x1000 net/ipv6/af_inet6.c:182\n [ 1116.897025] [<ffffffff84c4af7b>] __sock_create+0x37b/0x640 net/socket.c:1153\n [ 1116.897025] [<     inline     >] sock_create net/socket.c:1193\n [ 1116.897025] [<     inline     >] SYSC_socket net/socket.c:1223\n [ 1116.897025] [<ffffffff84c4b46f>] SyS_socket+0xef/0x1b0 net/socket.c:1203\n [ 1116.897025] [<ffffffff85e4d685>] entry_SYSCALL_64_fastpath+0x23/0xc6\nFreed:\nPID = 10987\n [ 1116.897025] [<ffffffff811ddcb6>] save_stack_trace+0x16/0x20\n [ 1116.897025] [<ffffffff8174c736>] save_stack+0x46/0xd0\n [ 1116.897025] [<ffffffff8174cf61>] kasan_slab_free+0x71/0xb0\n [ 1116.897025] [<     inline     >] slab_free_hook mm/slub.c:1352\n [ 1116.897025] [<     inline     >] slab_free_freelist_hook mm/slub.c:1374\n [ 1116.897025] [<     inline     >] slab_free mm/slub.c:2951\n [ 1116.897025] [<ffffffff81748b28>] kmem_cache_free+0xc8/0x330 mm/slub.c:2973\n [ 1116.897025] [<     inline     >] sk_prot_free net/core/sock.c:1369\n [ 1116.897025] [<ffffffff84c541eb>] __sk_destruct+0x32b/0x4f0 net/core/sock.c:1444\n [ 1116.897025] [<ffffffff84c5aca4>] sk_destruct+0x44/0x80 net/core/sock.c:1452\n [ 1116.897025] [<ffffffff84c5ad33>] __sk_free+0x53/0x220 net/core/sock.c:1460\n [ 1116.897025] [<ffffffff84c5af23>] sk_free+0x23/0x30 net/core/sock.c:1471\n [ 1116.897025] [<ffffffff84c5cb6c>] sk_common_release+0x28c/0x3e0 ./include/net/sock.h:1589\n [ 1116.897025] [<ffffffff8579044e>] l2tp_ip6_close+0x1fe/0x290 net/l2tp/l2tp_ip6.c:243\n [ 1116.897025] [<ffffffff850b2dfd>] inet_release+0xed/0x1c0 net/ipv4/af_inet.c:415\n [ 1116.897025] [<ffffffff851dc5a0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:422\n [ 1116.897025] [<ffffffff84c4581d>] sock_release+0x8d/0x1d0 net/socket.c:570\n [ 1116.897025] [<ffffffff84c45976>] sock_close+0x16/0x20 net/socket.c:1017\n [ 1116.897025] [<ffffffff817a108c>] __fput+0x28c/0x780 fs/file_table.c:208\n [ 1116.897025] [<ffffffff817a1605>] ____fput+0x15/0x20 fs/file_table.c:244\n [ 1116.897025] [<ffffffff813774f9>] task_work_run+0xf9/0x170\n [ 1116.897025] [<ffffffff81324aae>] do_exit+0x85e/0x2a00\n [ 1116.897025] [<ffffffff81326dc8>] do_group_exit+0x108/0x330\n [ 1116.897025] [<ffffffff81348cf7>] get_signal+0x617/0x17a0 kernel/signal.c:2307\n [ 1116.897025] [<ffffffff811b49af>] do_signal+0x7f/0x18f0\n [ 1116.897025] [<ffffffff810039bf>] exit_to_usermode_loop+0xbf/0x150 arch/x86/entry/common.c:156\n [ 1116.897025] [<     inline     >] prepare_exit_to_usermode arch/x86/entry/common.c:190\n [ 1116.897025] [<ffffffff81006060>] syscall_return_slowpath+0x1a0/0x1e0 arch/x86/entry/common.c:259\n [ 1116.897025] [<ffffffff85e4d726>] entry_SYSCALL_64_fastpath+0xc4/0xc6\nMemory state around the buggy address:\n ffff8800081b0d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff8800081b0e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n>ffff8800081b0e80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb\n                                                    ^\n ffff8800081b0f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff8800081b0f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\n==================================================================\n\nThe same issue exists with l2tp_ip_bind() and l2tp_ip_bind_table.\n\nFixes: c51ce49735c1 (\"l2tp: fix oops in L2TP IP sockets for connect() AF_UNSPEC case\")\nReported-by: Baozeng Ding <sploving1@gmail.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Baozeng Ding <sploving1@gmail.com>\nSigned-off-by: Guillaume Nault <g.nault@alphalink.fr>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/84df56749f48aed274bbfd2db6b6fb9dd540ff6b"},{"sha":"58c8cc33de6caa707cec2008782f918432668962","author":{"name":"Zhang Shengju","email":"81dbfb17f3a802b8999d25d07872acb1e3c55600@cmss.chinamobile.com"},"message":"rtnl: fix the loop index update error in rtnl_dump_ifinfo()\n\n[ Upstream commit 3f0ae05d6fea0ed5b19efdbc9c9f8e02685a3af3 ]\n\nIf the link is filtered out, loop index should also be updated. If not,\nloop index will not be correct.\n\nFixes: dc599f76c22b0 (\"net: Add support for filtering link dump by master device and kind\")\nSigned-off-by: Zhang Shengju <zhangshengju@cmss.chinamobile.com>\nAcked-by: David Ahern <dsa@cumulusnetworks.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/58c8cc33de6caa707cec2008782f918432668962"},{"sha":"7b0aa75be3abfdef8ed39377b4f7f925d8c04ab5","author":{"name":"Paolo Abeni","email":"760d0d6fcadb77e1b4c1d3c7879788c2b4ed8bbe@redhat.com"},"message":"ipv6: bump genid when the IFA_F_TENTATIVE flag is clear\n\n[ Upstream commit 764d3be6e415b40056834bfd29b994dc3f837606 ]\n\nWhen an ipv6 address has the tentative flag set, it can't be\nused as source for egress traffic, while the associated route,\nif any, can be looked up and even stored into some dst_cache.\n\nIn the latter scenario, the source ipv6 address selected and\nstored in the cache is most probably wrong (e.g. with\nlink-local scope) and the entity using the dst_cache will\nexperience lack of ipv6 connectivity until said cache is\ncleared or invalidated.\n\nOverall this may cause lack of connectivity over most IPv6 tunnels\n(comprising geneve and vxlan), if the first egress packet reaches\nthe tunnel before the DaD is completed for the used ipv6\naddress.\n\nThis patch bumps a new genid after that the IFA_F_TENTATIVE flag\nis cleared, so that dst_cache will be invalidated on\nnext lookup and ipv6 connectivity restored.\n\nFixes: 0c1d70af924b (\"net: use dst_cache for vxlan device\")\nFixes: 468dfffcd762 (\"geneve: add dst caching support\")\nAcked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: Paolo Abeni <pabeni@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/7b0aa75be3abfdef8ed39377b4f7f925d8c04ab5"},{"sha":"ddf053431efe305992af23ae733927d0e9e6b461","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"udplite: call proper backlog handlers\n\n[ Upstream commit 30c7be26fd3587abcb69587f781098e3ca2d565b ]\n\nIn commits 93821778def10 (\"udp: Fix rcv socket locking\") and\nf7ad74fef3af (\"net/ipv6/udp: UDP encapsulation: break backlog_rcv into\n__udpv6_queue_rcv_skb\") UDP backlog handlers were renamed, but UDPlite\nwas forgotten.\n\nThis leads to crashes if UDPlite header is pulled twice, which happens\nstarting from commit e6afc8ace6dd (\"udp: remove headers from UDP packets\nbefore queueing\")\n\nBug found by syzkaller team, thanks a lot guys !\n\nNote that backlog use in UDP/UDPlite is scheduled to be removed starting\nfrom linux-4.10, so this patch is only needed up to linux-4.9\n\nFixes: 93821778def1 (\"udp: Fix rcv socket locking\")\nFixes: f7ad74fef3af (\"net/ipv6/udp: UDP encapsulation: break backlog_rcv into __udpv6_queue_rcv_skb\")\nFixes: e6afc8ace6dd (\"udp: remove headers from UDP packets before queueing\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nCc: Benjamin LaHaise <bcrl@kvack.org>\nCc: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/ddf053431efe305992af23ae733927d0e9e6b461"},{"sha":"a9437ebc69f5962670153ed653c6c9499aee643d","author":{"name":"Florian Fainelli","email":"244da8ca84c0b82369d8dd3f15015e61f28f6fe5@gmail.com"},"message":"net: dsa: bcm_sf2: Ensure we re-negotiate EEE during after link change\n\n[ Upstream commit 76da8706d90d8641eeb9b8e579942ed80b6c0880 ]\n\nIn case the link change and EEE is enabled or disabled, always try to\nre-negotiate this with the link partner.\n\nFixes: 450b05c15f9c (\"net: dsa: bcm_sf2: add support for controlling EEE\")\nSigned-off-by: Florian Fainelli <f.fainelli@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/a9437ebc69f5962670153ed653c6c9499aee643d"},{"sha":"9a747927394998cab12a8462dbd735e8b1f9670d","author":{"name":"Daniel Borkmann","email":"4b94a04674ad2c69d990e94ab196ac3f8e9e03d4@iogearbox.net"},"message":"net, sched: respect rcu grace period on cls destruction\n\n[ Upstream commit d936377414fadbafb4d17148d222fe45ca5442d4 ]\n\nRoi reported a crash in flower where tp->root was NULL in ->classify()\ncallbacks. Reason is that in ->destroy() tp->root is set to NULL via\nRCU_INIT_POINTER(). It's problematic for some of the classifiers, because\nthis doesn't respect RCU grace period for them, and as a result, still\noutstanding readers from tc_classify() will try to blindly dereference\na NULL tp->root.\n\nThe tp->root object is strictly private to the classifier implementation\nand holds internal data the core such as tc_ctl_tfilter() doesn't know\nabout. Within some classifiers, such as cls_bpf, cls_basic, etc, tp->root\nis only checked for NULL in ->get() callback, but nowhere else. This is\nmisleading and seemed to be copied from old classifier code that was not\ncleaned up properly. For example, d3fa76ee6b4a (\"[NET_SCHED]: cls_basic:\nfix NULL pointer dereference\") moved tp->root initialization into ->init()\nroutine, where before it was part of ->change(), so ->get() had to deal\nwith tp->root being NULL back then, so that was indeed a valid case, after\nd3fa76ee6b4a, not really anymore. We used to set tp->root to NULL long\nago in ->destroy(), see 47a1a1d4be29 (\"pkt_sched: remove unnecessary xchg()\nin packet classifiers\"); but the NULLifying was reintroduced with the\nRCUification, but it's not correct for every classifier implementation.\n\nIn the cases that are fixed here with one exception of cls_cgroup, tp->root\nobject is allocated and initialized inside ->init() callback, which is always\nperformed at a point in time after we allocate a new tp, which means tp and\nthus tp->root was not globally visible in the tp chain yet (see tc_ctl_tfilter()).\nAlso, on destruction tp->root is strictly kfree_rcu()'ed in ->destroy()\nhandler, same for the tp which is kfree_rcu()'ed right when we return\nfrom ->destroy() in tcf_destroy(). This means, the head object's lifetime\nfor such classifiers is always tied to the tp lifetime. The RCU callback\ninvocation for the two kfree_rcu() could be out of order, but that's fine\nsince both are independent.\n\nDropping the RCU_INIT_POINTER(tp->root, NULL) for these classifiers here\nmeans that 1) we don't need a useless NULL check in fast-path and, 2) that\noutstanding readers of that tp in tc_classify() can still execute under\nrespect with RCU grace period as it is actually expected.\n\nThings that haven't been touched here: cls_fw and cls_route. They each\nhandle tp->root being NULL in ->classify() path for historic reasons, so\ntheir ->destroy() implementation can stay as is. If someone actually\ncares, they could get cleaned up at some point to avoid the test in fast\npath. cls_u32 doesn't set tp->root to NULL. For cls_rsvp, I just added a\n!head should anyone actually be using/testing it, so it at least aligns with\ncls_fw and cls_route. For cls_flower we additionally need to defer rhashtable\ndestruction (to a sleepable context) after RCU grace period as concurrent\nreaders might still access it. (Note that in this case we need to hold module\nreference to keep work callback address intact, since we only wait on module\nunload for all call_rcu()s to finish.)\n\nThis fixes one race to bring RCU grace period guarantees back. Next step\nas worked on by Cong however is to fix 1e052be69d04 (\"net_sched: destroy\nproto tp when all filters are gone\") to get the order of unlinking the tp\nin tc_ctl_tfilter() for the RTM_DELTFILTER case right by moving\nRCU_INIT_POINTER() before tcf_destroy() and let the notification for\nremoval be done through the prior ->delete() callback. Both are independant\nissues. Once we have that right, we can then clean tp->root up for a number\nof classifiers by not making them RCU pointers, which requires a new callback\n(->uninit) that is triggered from tp's RCU callback, where we just kfree()\ntp->root from there.\n\nFixes: 1f947bf151e9 (\"net: sched: rcu'ify cls_bpf\")\nFixes: 9888faefe132 (\"net: sched: cls_basic use RCU\")\nFixes: 70da9f0bf999 (\"net: sched: cls_flow use RCU\")\nFixes: 77b9900ef53a (\"tc: introduce Flower classifier\")\nFixes: bf3994d2ed31 (\"net/sched: introduce Match-all classifier\")\nFixes: 952313bd6258 (\"net: sched: cls_cgroup use RCU\")\nReported-by: Roi Dayan <roid@mellanox.com>\nSigned-off-by: Daniel Borkmann <daniel@iogearbox.net>\nCc: Cong Wang <xiyou.wangcong@gmail.com>\nCc: John Fastabend <john.fastabend@gmail.com>\nCc: Roi Dayan <roid@mellanox.com>\nCc: Jiri Pirko <jiri@mellanox.com>\nAcked-by: John Fastabend <john.r.fastabend@intel.com>\nAcked-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/9a747927394998cab12a8462dbd735e8b1f9670d"},{"sha":"aa239369bdfa73290be0f743a22c637cfee1967b","author":{"name":"Nikita Yushchenko","email":"851b129ba07cfd88a0fbe1d62404ff5673efeaad@cogentembedded.com"},"message":"net: dsa: fix unbalanced dsa_switch_tree reference counting\n\n[ Upstream commit 7a99cd6e213685b78118382e6a8fed506c82ccb2 ]\n\n_dsa_register_switch() gets a dsa_switch_tree object either via\ndsa_get_dst() or via dsa_add_dst(). Former path does not increase kref\nin returned object (resulting into caller not owning a reference),\nwhile later path does create a new object (resulting into caller owning\na reference).\n\nThe rest of _dsa_register_switch() assumes that it owns a reference, and\ncalls dsa_put_dst().\n\nThis causes a memory breakage if first switch in the tree initialized\nsuccessfully, but second failed to initialize. In particular, freed\ndsa_swith_tree object is left referenced by switch that was initialized,\nand later access to sysfs attributes of that switch cause OOPS.\n\nTo fix, need to add kref_get() call to dsa_get_dst().\n\nFixes: 83c0afaec7b7 (\"net: dsa: Add new binding implementation\")\nSigned-off-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com>\nReviewed-by: Andrew Lunn <andrew@lunn.ch>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/aa239369bdfa73290be0f743a22c637cfee1967b"},{"sha":"360d6a23e79d68c570a9346c1ad07854d1abb434","author":{"name":"Amir Vadai","email":"0b738364b8ca3a28da789d34dc90511d1baa1175@vadai.me"},"message":"net/sched: pedit: make sure that offset is valid\n\n[ Upstream commit 95c2027bfeda21a28eb245121e6a249f38d0788e ]\n\nAdd a validation function to make sure offset is valid:\n1. Not below skb head (could happen when offset is negative).\n2. Validate both 'offset' and 'at'.\n\nSigned-off-by: Amir Vadai <amir@vadai.me>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/360d6a23e79d68c570a9346c1ad07854d1abb434"},{"sha":"f5dad3473d83e7b45eee4e9cc017a65b904cc38c","author":{"name":"Herbert Xu","email":"b06c1e85ee1d40a691f7eaf317640579555a220e@gondor.apana.org.au"},"message":"netlink: Call cb->done from a worker thread\n\n[ Upstream commit 707693c8a498697aa8db240b93eb76ec62e30892 ]\n\nThe cb->done interface expects to be called in process context.\nThis was broken by the netlink RCU conversion.  This patch fixes\nit by adding a worker struct to make the cb->done call where\nnecessary.\n\nFixes: 21e4902aea80 (\"netlink: Lockless lookup with RCU grace...\")\nReported-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nAcked-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/f5dad3473d83e7b45eee4e9cc017a65b904cc38c"},{"sha":"25d9b4bb64ea964769087fc5ae09aee9c838d759","author":{"name":"Herbert Xu","email":"b06c1e85ee1d40a691f7eaf317640579555a220e@gondor.apana.org.au"},"message":"netlink: Do not schedule work from sk_destruct\n\n[ Upstream commit ed5d7788a934a4b6d6d025e948ed4da496b4f12e ]\n\nIt is wrong to schedule a work from sk_destruct using the socket\nas the memory reserve because the socket will be freed immediately\nafter the return from sk_destruct.\n\nInstead we should do the deferral prior to sk_free.\n\nThis patch does just that.\n\nFixes: 707693c8a498 (\"netlink: Call cb->done from a worker thread\")\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/25d9b4bb64ea964769087fc5ae09aee9c838d759"},{"sha":"023cd33ece3751b5c265331f5ceb45e69dc62189","author":{"name":"Cyrille Pitchen","email":"2bb0821fa0a16c75c8ba5428a51aba440d8ce458@atmel.com"},"message":"net: macb: fix the RX queue reset in macb_rx()\n\n[ Upstream commit a0b44eea372b449ef9744fb1d90491cc063289b8 ]\n\nOn macb only (not gem), when a RX queue corruption was detected from\nmacb_rx(), the RX queue was reset: during this process the RX ring\nbuffer descriptor was initialized by macb_init_rx_ring() but we forgot\nto also set bp->rx_tail to 0.\n\nIndeed, when processing the received frames, bp->rx_tail provides the\nmacb driver with the index in the RX ring buffer of the next buffer to\nprocess. So when the whole ring buffer is reset we must also reset\nbp->rx_tail so the driver is synchronized again with the hardware.\n\nSince macb_init_rx_ring() is called from many locations, currently from\nmacb_rx() and macb_init_rings(), we'd rather add the \"bp->rx_tail = 0;\"\nline inside macb_init_rx_ring() than add the very same line after each\ncall of this function.\n\nWithout this fix, the rx queue is not reset properly to recover from\nqueue corruption and connection drop may occur.\n\nSigned-off-by: Cyrille Pitchen <cyrille.pitchen@atmel.com>\nFixes: 9ba723b081a2 (\"net: macb: remove BUG_ON() and reset the queue to handle RX errors\")\nAcked-by: Nicolas Ferre <nicolas.ferre@atmel.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/023cd33ece3751b5c265331f5ceb45e69dc62189"},{"sha":"ff0d7874078d27f4b52275de997882e070ad96f4","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"net/dccp: fix use-after-free in dccp_invalid_packet\n\n[ Upstream commit 648f0c28df282636c0c8a7a19ca3ce5fc80a39c3 ]\n\npskb_may_pull() can reallocate skb->head, we need to reload dh pointer\nin dccp_invalid_packet() or risk use after free.\n\nBug found by Andrey Konovalov using syzkaller.\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/HiassofT/rpi-linux/commits/ff0d7874078d27f4b52275de997882e070ad96f4"}]}
{"actor":{"display_login":"HiassofT"}}