{"push_id":2342371325,"size":228,"distinct_size":0,"ref":"refs/heads/caf/3.10/caf/korg/linux-4.15.y","head":"bb61956d9d9fec64e6619470faafe10dadc43ecb","before":"db22ec452bb4ab9f3ecff00fe935da17d048f14d","commits":[{"sha":"6555d5440ba27956907f16405e87674e43762616","author":{"name":"Nikolay Aleksandrov","email":"64c6133501914790fe0371388ffd86301bcc142b@cumulusnetworks.com"},"message":"ip6mr: fix stale iterator\n\n\n[ Upstream commit 4adfa79fc254efb7b0eb3cd58f62c2c3f805f1ba ]\n\nWhen we dump the ip6mr mfc entries via proc, we initialize an iterator\nwith the table to dump but we don't clear the cache pointer which might\nbe initialized from a prior read on the same descriptor that ended. This\ncan result in lock imbalance (an unnecessary unlock) leading to other\ncrashes and hangs. Clear the cache pointer like ipmr does to fix the issue.\nThanks for the reliable reproducer.\n\nHere's syzbot's trace:\n WARNING: bad unlock balance detected!\n 4.15.0-rc3+ #128 Not tainted\n syzkaller971460/3195 is trying to release lock (mrt_lock) at:\n [<000000006898068d>] ipmr_mfc_seq_stop+0xe1/0x130 net/ipv6/ip6mr.c:553\n but there are no more locks to release!\n\n other info that might help us debug this:\n 1 lock held by syzkaller971460/3195:\n  #0:  (&p->lock){+.+.}, at: [<00000000744a6565>] seq_read+0xd5/0x13d0\n fs/seq_file.c:165\n\n stack backtrace:\n CPU: 1 PID: 3195 Comm: syzkaller971460 Not tainted 4.15.0-rc3+ #128\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS\n Google 01/01/2011\n Call Trace:\n  __dump_stack lib/dump_stack.c:17 [inline]\n  dump_stack+0x194/0x257 lib/dump_stack.c:53\n  print_unlock_imbalance_bug+0x12f/0x140 kernel/locking/lockdep.c:3561\n  __lock_release kernel/locking/lockdep.c:3775 [inline]\n  lock_release+0x5f9/0xda0 kernel/locking/lockdep.c:4023\n  __raw_read_unlock include/linux/rwlock_api_smp.h:225 [inline]\n  _raw_read_unlock+0x1a/0x30 kernel/locking/spinlock.c:255\n  ipmr_mfc_seq_stop+0xe1/0x130 net/ipv6/ip6mr.c:553\n  traverse+0x3bc/0xa00 fs/seq_file.c:135\n  seq_read+0x96a/0x13d0 fs/seq_file.c:189\n  proc_reg_read+0xef/0x170 fs/proc/inode.c:217\n  do_loop_readv_writev fs/read_write.c:673 [inline]\n  do_iter_read+0x3db/0x5b0 fs/read_write.c:897\n  compat_readv+0x1bf/0x270 fs/read_write.c:1140\n  do_compat_preadv64+0xdc/0x100 fs/read_write.c:1189\n  C_SYSC_preadv fs/read_write.c:1209 [inline]\n  compat_SyS_preadv+0x3b/0x50 fs/read_write.c:1203\n  do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline]\n  do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389\n  entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:125\n RIP: 0023:0xf7f73c79\n RSP: 002b:00000000e574a15c EFLAGS: 00000292 ORIG_RAX: 000000000000014d\n RAX: ffffffffffffffda RBX: 000000000000000f RCX: 0000000020a3afb0\n RDX: 0000000000000001 RSI: 0000000000000067 RDI: 0000000000000000\n RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\n R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n BUG: sleeping function called from invalid context at lib/usercopy.c:25\n in_atomic(): 1, irqs_disabled(): 0, pid: 3195, name: syzkaller971460\n INFO: lockdep is turned off.\n CPU: 1 PID: 3195 Comm: syzkaller971460 Not tainted 4.15.0-rc3+ #128\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS\n Google 01/01/2011\n Call Trace:\n  __dump_stack lib/dump_stack.c:17 [inline]\n  dump_stack+0x194/0x257 lib/dump_stack.c:53\n  ___might_sleep+0x2b2/0x470 kernel/sched/core.c:6060\n  __might_sleep+0x95/0x190 kernel/sched/core.c:6013\n  __might_fault+0xab/0x1d0 mm/memory.c:4525\n  _copy_to_user+0x2c/0xc0 lib/usercopy.c:25\n  copy_to_user include/linux/uaccess.h:155 [inline]\n  seq_read+0xcb4/0x13d0 fs/seq_file.c:279\n  proc_reg_read+0xef/0x170 fs/proc/inode.c:217\n  do_loop_readv_writev fs/read_write.c:673 [inline]\n  do_iter_read+0x3db/0x5b0 fs/read_write.c:897\n  compat_readv+0x1bf/0x270 fs/read_write.c:1140\n  do_compat_preadv64+0xdc/0x100 fs/read_write.c:1189\n  C_SYSC_preadv fs/read_write.c:1209 [inline]\n  compat_SyS_preadv+0x3b/0x50 fs/read_write.c:1203\n  do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline]\n  do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389\n  entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:125\n RIP: 0023:0xf7f73c79\n RSP: 002b:00000000e574a15c EFLAGS: 00000292 ORIG_RAX: 000000000000014d\n RAX: ffffffffffffffda RBX: 000000000000000f RCX: 0000000020a3afb0\n RDX: 0000000000000001 RSI: 0000000000000067 RDI: 0000000000000000\n RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\n R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n WARNING: CPU: 1 PID: 3195 at lib/usercopy.c:26 _copy_to_user+0xb5/0xc0\n lib/usercopy.c:26\n\nReported-by: syzbot <bot+eceb3204562c41a438fa1f2335e0fe4f6886d669@syzkaller.appspotmail.com>\nSigned-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/6555d5440ba27956907f16405e87674e43762616"},{"sha":"ca89dee1eb41a479001c1bdf98d2807a168dbaa6","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"net: igmp: add a missing rcu locking section\n\n\n[ Upstream commit e7aadb27a5415e8125834b84a74477bfbee4eff5 ]\n\nNewly added igmpv3_get_srcaddr() needs to be called under rcu lock.\n\nTimer callbacks do not ensure this locking.\n\n=============================\nWARNING: suspicious RCU usage\n4.15.0+ #200 Not tainted\n-----------------------------\n./include/linux/inetdevice.h:216 suspicious rcu_dereference_check() usage!\n\nother info that might help us debug this:\n\nrcu_scheduler_active = 2, debug_locks = 1\n3 locks held by syzkaller616973/4074:\n #0:  (&mm->mmap_sem){++++}, at: [<00000000bfce669e>] __do_page_fault+0x32d/0xc90 arch/x86/mm/fault.c:1355\n #1:  ((&im->timer)){+.-.}, at: [<00000000619d2f71>] lockdep_copy_map include/linux/lockdep.h:178 [inline]\n #1:  ((&im->timer)){+.-.}, at: [<00000000619d2f71>] call_timer_fn+0x1c6/0x820 kernel/time/timer.c:1316\n #2:  (&(&im->lock)->rlock){+.-.}, at: [<000000005f833c5c>] spin_lock_bh include/linux/spinlock.h:315 [inline]\n #2:  (&(&im->lock)->rlock){+.-.}, at: [<000000005f833c5c>] igmpv3_send_report+0x98/0x5b0 net/ipv4/igmp.c:600\n\nstack backtrace:\nCPU: 0 PID: 4074 Comm: syzkaller616973 Not tainted 4.15.0+ #200\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n <IRQ>\n __dump_stack lib/dump_stack.c:17 [inline]\n dump_stack+0x194/0x257 lib/dump_stack.c:53\n lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4592\n __in_dev_get_rcu include/linux/inetdevice.h:216 [inline]\n igmpv3_get_srcaddr net/ipv4/igmp.c:329 [inline]\n igmpv3_newpack+0xeef/0x12e0 net/ipv4/igmp.c:389\n add_grhead.isra.27+0x235/0x300 net/ipv4/igmp.c:432\n add_grec+0xbd3/0x1170 net/ipv4/igmp.c:565\n igmpv3_send_report+0xd5/0x5b0 net/ipv4/igmp.c:605\n igmp_send_report+0xc43/0x1050 net/ipv4/igmp.c:722\n igmp_timer_expire+0x322/0x5c0 net/ipv4/igmp.c:831\n call_timer_fn+0x228/0x820 kernel/time/timer.c:1326\n expire_timers kernel/time/timer.c:1363 [inline]\n __run_timers+0x7ee/0xb70 kernel/time/timer.c:1666\n run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692\n __do_softirq+0x2d7/0xb85 kernel/softirq.c:285\n invoke_softirq kernel/softirq.c:365 [inline]\n irq_exit+0x1cc/0x200 kernel/softirq.c:405\n exiting_irq arch/x86/include/asm/apic.h:541 [inline]\n smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052\n apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:938\n\nFixes: a46182b00290 (\"net: igmp: Use correct source address on IGMPv3 reports\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\n\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/ca89dee1eb41a479001c1bdf98d2807a168dbaa6"},{"sha":"da1761bde55fd7f3613908f74ebf4b7253785188","author":{"name":"Junxiao Bi","email":"0fbee7a611321671a74f8b0002ae086f6befb26d@oracle.com"},"message":"qlcnic: fix deadlock bug\n\n\n[ Upstream commit 233ac3891607f501f08879134d623b303838f478 ]\n\nThe following soft lockup was caught. This is a deadlock caused by\nrecusive locking.\n\nProcess kworker/u40:1:28016 was holding spin lock \"mbx->queue_lock\" in\nqlcnic_83xx_mailbox_worker(), while a softirq came in and ask the same spin\nlock in qlcnic_83xx_enqueue_mbx_cmd(). This lock should be hold by disable\nbh..\n\n[161846.962125] NMI watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [kworker/u40:1:28016]\n[161846.962367] Modules linked in: tun ocfs2 xen_netback xen_blkback xen_gntalloc xen_gntdev xen_evtchn xenfs xen_privcmd autofs4 ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs bnx2fc fcoe libfcoe libfc sunrpc 8021q mrp garp bridge stp llc bonding dm_round_robin dm_multipath iTCO_wdt iTCO_vendor_support pcspkr sb_edac edac_core i2c_i801 shpchp lpc_ich mfd_core ioatdma ipmi_devintf ipmi_si ipmi_msghandler sg ext4 jbd2 mbcache2 sr_mod cdrom sd_mod igb i2c_algo_bit i2c_core ahci libahci megaraid_sas ixgbe dca ptp pps_core vxlan udp_tunnel ip6_udp_tunnel qla2xxx scsi_transport_fc qlcnic crc32c_intel be2iscsi bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi ipv6 cxgb3 mdio libiscsi_tcp qla4xxx iscsi_boot_sysfs libiscsi scsi_transport_iscsi dm_mirror dm_region_hash dm_log dm_mod\n[161846.962454]\n[161846.962460] CPU: 1 PID: 28016 Comm: kworker/u40:1 Not tainted 4.1.12-94.5.9.el6uek.x86_64 #2\n[161846.962463] Hardware name: Oracle Corporation SUN SERVER X4-2L      /ASSY,MB,X4-2L         , BIOS 26050100 09/19/2017\n[161846.962489] Workqueue: qlcnic_mailbox qlcnic_83xx_mailbox_worker [qlcnic]\n[161846.962493] task: ffff8801f2e34600 ti: ffff88004ca5c000 task.ti: ffff88004ca5c000\n[161846.962496] RIP: e030:[<ffffffff810013aa>]  [<ffffffff810013aa>] xen_hypercall_sched_op+0xa/0x20\n[161846.962506] RSP: e02b:ffff880202e43388  EFLAGS: 00000206\n[161846.962509] RAX: 0000000000000000 RBX: ffff8801f6996b70 RCX: ffffffff810013aa\n[161846.962511] RDX: ffff880202e433cc RSI: ffff880202e433b0 RDI: 0000000000000003\n[161846.962513] RBP: ffff880202e433d0 R08: 0000000000000000 R09: ffff8801fe893200\n[161846.962516] R10: ffff8801fe400538 R11: 0000000000000206 R12: ffff880202e4b000\n[161846.962518] R13: 0000000000000050 R14: 0000000000000001 R15: 000000000000020d\n[161846.962528] FS:  0000000000000000(0000) GS:ffff880202e40000(0000) knlGS:ffff880202e40000\n[161846.962531] CS:  e033 DS: 0000 ES: 0000 CR0: 0000000080050033\n[161846.962533] CR2: 0000000002612640 CR3: 00000001bb796000 CR4: 0000000000042660\n[161846.962536] Stack:\n[161846.962538]  ffff880202e43608 0000000000000000 ffffffff813f0442 ffff880202e433b0\n[161846.962543]  0000000000000000 ffff880202e433cc ffffffff00000001 0000000000000000\n[161846.962547]  00000009813f03d6 ffff880202e433e0 ffffffff813f0460 ffff880202e43440\n[161846.962552] Call Trace:\n[161846.962555]  <IRQ>\n[161846.962565]  [<ffffffff813f0442>] ? xen_poll_irq_timeout+0x42/0x50\n[161846.962570]  [<ffffffff813f0460>] xen_poll_irq+0x10/0x20\n[161846.962578]  [<ffffffff81014222>] xen_lock_spinning+0xe2/0x110\n[161846.962583]  [<ffffffff81013f01>] __raw_callee_save_xen_lock_spinning+0x11/0x20\n[161846.962592]  [<ffffffff816e5c57>] ? _raw_spin_lock+0x57/0x80\n[161846.962609]  [<ffffffffa028acfc>] qlcnic_83xx_enqueue_mbx_cmd+0x7c/0xe0 [qlcnic]\n[161846.962623]  [<ffffffffa028e008>] qlcnic_83xx_issue_cmd+0x58/0x210 [qlcnic]\n[161846.962636]  [<ffffffffa028caf2>] qlcnic_83xx_sre_macaddr_change+0x162/0x1d0 [qlcnic]\n[161846.962649]  [<ffffffffa028cb8b>] qlcnic_83xx_change_l2_filter+0x2b/0x30 [qlcnic]\n[161846.962657]  [<ffffffff8160248b>] ? __skb_flow_dissect+0x18b/0x650\n[161846.962670]  [<ffffffffa02856e5>] qlcnic_send_filter+0x205/0x250 [qlcnic]\n[161846.962682]  [<ffffffffa0285c77>] qlcnic_xmit_frame+0x547/0x7b0 [qlcnic]\n[161846.962691]  [<ffffffff8160ac22>] xmit_one+0x82/0x1a0\n[161846.962696]  [<ffffffff8160ad90>] dev_hard_start_xmit+0x50/0xa0\n[161846.962701]  [<ffffffff81630112>] sch_direct_xmit+0x112/0x220\n[161846.962706]  [<ffffffff8160b80f>] __dev_queue_xmit+0x1df/0x5e0\n[161846.962710]  [<ffffffff8160bc33>] dev_queue_xmit_sk+0x13/0x20\n[161846.962721]  [<ffffffffa0575bd5>] bond_dev_queue_xmit+0x35/0x80 [bonding]\n[161846.962729]  [<ffffffffa05769fb>] __bond_start_xmit+0x1cb/0x210 [bonding]\n[161846.962736]  [<ffffffffa0576a71>] bond_start_xmit+0x31/0x60 [bonding]\n[161846.962740]  [<ffffffff8160ac22>] xmit_one+0x82/0x1a0\n[161846.962745]  [<ffffffff8160ad90>] dev_hard_start_xmit+0x50/0xa0\n[161846.962749]  [<ffffffff8160bb1e>] __dev_queue_xmit+0x4ee/0x5e0\n[161846.962754]  [<ffffffff8160bc33>] dev_queue_xmit_sk+0x13/0x20\n[161846.962760]  [<ffffffffa05cfa72>] vlan_dev_hard_start_xmit+0xb2/0x150 [8021q]\n[161846.962764]  [<ffffffff8160ac22>] xmit_one+0x82/0x1a0\n[161846.962769]  [<ffffffff8160ad90>] dev_hard_start_xmit+0x50/0xa0\n[161846.962773]  [<ffffffff8160bb1e>] __dev_queue_xmit+0x4ee/0x5e0\n[161846.962777]  [<ffffffff8160bc33>] dev_queue_xmit_sk+0x13/0x20\n[161846.962789]  [<ffffffffa05adf74>] br_dev_queue_push_xmit+0x54/0xa0 [bridge]\n[161846.962797]  [<ffffffffa05ae4ff>] br_forward_finish+0x2f/0x90 [bridge]\n[161846.962807]  [<ffffffff810b0dad>] ? ttwu_do_wakeup+0x1d/0x100\n[161846.962811]  [<ffffffff815f929b>] ? __alloc_skb+0x8b/0x1f0\n[161846.962818]  [<ffffffffa05ae04d>] __br_forward+0x8d/0x120 [bridge]\n[161846.962822]  [<ffffffff815f613b>] ? __kmalloc_reserve+0x3b/0xa0\n[161846.962829]  [<ffffffff810be55e>] ? update_rq_runnable_avg+0xee/0x230\n[161846.962836]  [<ffffffffa05ae176>] br_forward+0x96/0xb0 [bridge]\n[161846.962845]  [<ffffffffa05af85e>] br_handle_frame_finish+0x1ae/0x420 [bridge]\n[161846.962853]  [<ffffffffa05afc4f>] br_handle_frame+0x17f/0x260 [bridge]\n[161846.962862]  [<ffffffffa05afad0>] ? br_handle_frame_finish+0x420/0x420 [bridge]\n[161846.962867]  [<ffffffff8160d057>] __netif_receive_skb_core+0x1f7/0x870\n[161846.962872]  [<ffffffff8160d6f2>] __netif_receive_skb+0x22/0x70\n[161846.962877]  [<ffffffff8160d913>] netif_receive_skb_internal+0x23/0x90\n[161846.962884]  [<ffffffffa07512ea>] ? xenvif_idx_release+0xea/0x100 [xen_netback]\n[161846.962889]  [<ffffffff816e5a10>] ? _raw_spin_unlock_irqrestore+0x20/0x50\n[161846.962893]  [<ffffffff8160e624>] netif_receive_skb_sk+0x24/0x90\n[161846.962899]  [<ffffffffa075269a>] xenvif_tx_submit+0x2ca/0x3f0 [xen_netback]\n[161846.962906]  [<ffffffffa0753f0c>] xenvif_tx_action+0x9c/0xd0 [xen_netback]\n[161846.962915]  [<ffffffffa07567f5>] xenvif_poll+0x35/0x70 [xen_netback]\n[161846.962920]  [<ffffffff8160e01b>] napi_poll+0xcb/0x1e0\n[161846.962925]  [<ffffffff8160e1c0>] net_rx_action+0x90/0x1c0\n[161846.962931]  [<ffffffff8108aaba>] __do_softirq+0x10a/0x350\n[161846.962938]  [<ffffffff8108ae75>] irq_exit+0x125/0x130\n[161846.962943]  [<ffffffff813f03a9>] xen_evtchn_do_upcall+0x39/0x50\n[161846.962950]  [<ffffffff816e7ffe>] xen_do_hypervisor_callback+0x1e/0x40\n[161846.962952]  <EOI>\n[161846.962959]  [<ffffffff816e5c4a>] ? _raw_spin_lock+0x4a/0x80\n[161846.962964]  [<ffffffff816e5b1e>] ? _raw_spin_lock_irqsave+0x1e/0xa0\n[161846.962978]  [<ffffffffa028e279>] ? qlcnic_83xx_mailbox_worker+0xb9/0x2a0 [qlcnic]\n[161846.962991]  [<ffffffff810a14e1>] ? process_one_work+0x151/0x4b0\n[161846.962995]  [<ffffffff8100c3f2>] ? check_events+0x12/0x20\n[161846.963001]  [<ffffffff810a1960>] ? worker_thread+0x120/0x480\n[161846.963005]  [<ffffffff816e187b>] ? __schedule+0x30b/0x890\n[161846.963010]  [<ffffffff810a1840>] ? process_one_work+0x4b0/0x4b0\n[161846.963015]  [<ffffffff810a1840>] ? process_one_work+0x4b0/0x4b0\n[161846.963021]  [<ffffffff810a6b3e>] ? kthread+0xce/0xf0\n[161846.963025]  [<ffffffff810a6a70>] ? kthread_freezable_should_stop+0x70/0x70\n[161846.963031]  [<ffffffff816e6522>] ? ret_from_fork+0x42/0x70\n[161846.963035]  [<ffffffff810a6a70>] ? kthread_freezable_should_stop+0x70/0x70\n[161846.963037] Code: cc 51 41 53 b8 1c 00 00 00 0f 05 41 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 51 41 53 b8 1d 00 00 00 0f 05 <41> 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc\n\nSigned-off-by: Junxiao Bi <junxiao.bi@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/da1761bde55fd7f3613908f74ebf4b7253785188"},{"sha":"514377344c30f6ffaca52ed279fa35a022ed9e43","author":{"name":"Kristian Evensen","email":"87b7c52de30bb25d2a0b914fd0b03c514e6a7b59@gmail.com"},"message":"qmi_wwan: Add support for Quectel EP06\n\n\n[ Upstream commit c0b91a56a2e57a5a370655b25d677ae0ebf8a2d0 ]\n\nThe Quectel EP06 is a Cat. 6 LTE modem. It uses the same interface as\nthe EC20/EC25 for QMI, and requires the same \"set DTR\"-quirk to work.\n\nSigned-off-by: Kristian Evensen <kristian.evensen@gmail.com>\nAcked-by: Bjørn Mork <bjorn@mork.no>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/514377344c30f6ffaca52ed279fa35a022ed9e43"},{"sha":"b0acbef9edb2204fa65388fd703b24da702c6ce3","author":{"name":"Chunhao Lin","email":"a6fdec0ff56b2022f60393e7b8dbe0ba7ade7e02@realtek.com"},"message":"r8169: fix RTL8168EP take too long to complete driver initialization.\n\n\n[ Upstream commit 086ca23d03c0d2f4088f472386778d293e15c5f6 ]\n\nDriver check the wrong register bit in rtl_ocp_tx_cond() that keep driver\nwaiting until timeout.\n\nFix this by waiting for the right register bit.\n\nSigned-off-by: Chunhao Lin <hau@realtek.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/b0acbef9edb2204fa65388fd703b24da702c6ce3"},{"sha":"f76c9a0fbf5b54792313904e015b90e3ff25d343","author":{"name":"Li RongQing","email":"2237470b0bc593ba0082e1950f7d1ef11354a9d9@baidu.com"},"message":"tcp: release sk_frag.page in tcp_disconnect\n\n\n[ Upstream commit 9b42d55a66d388e4dd5550107df051a9637564fc ]\n\nsocket can be disconnected and gets transformed back to a listening\nsocket, if sk_frag.page is not released, which will be cloned into\na new socket by sk_clone_lock, but the reference count of this page\nis increased, lead to a use after free or double free issue\n\nSigned-off-by: Li RongQing <lirongqing@baidu.com>\nCc: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/f76c9a0fbf5b54792313904e015b90e3ff25d343"},{"sha":"cb0fddba20816e811d4b567fa3da650f3d8b8ba7","author":{"name":"Jason Wang","email":"74f299602f66bf37e22877b931fc5996e932eb30@redhat.com"},"message":"vhost_net: stop device during reset owner\n\n\n[ Upstream commit 4cd879515d686849eec5f718aeac62a70b067d82 ]\n\nWe don't stop device before reset owner, this means we could try to\nserve any virtqueue kick before reset dev->worker. This will result a\nwarn since the work was pending at llist during owner resetting. Fix\nthis by stopping device during owner reset.\n\nReported-by: syzbot+eb17c6162478cc50632c@syzkaller.appspotmail.com\nFixes: 3a4d5c94e9593 (\"vhost_net: a kernel-level virtio server\")\nSigned-off-by: Jason Wang <jasowang@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/cb0fddba20816e811d4b567fa3da650f3d8b8ba7"},{"sha":"513f3cc3d1d344634f26c12ad3d445c962f1a85a","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"ipv6: addrconf: break critical section in addrconf_verify_rtnl()\n\n\n[ Upstream commit e64e469b9a2c22d41b3dd7172118760cec22d473 ]\n\nHeiner reported a lockdep splat [1]\n\nThis is caused by attempting GFP_KERNEL allocation while RCU lock is\nheld and BH blocked.\n\nWe believe that addrconf_verify_rtnl() could run for a long period,\nso instead of using GFP_ATOMIC here as Ido suggested, we should break\nthe critical section and restart it after the allocation.\n\n[1]\n[86220.125562] =============================\n[86220.125586] WARNING: suspicious RCU usage\n[86220.125612] 4.15.0-rc7-next-20180110+ #7 Not tainted\n[86220.125641] -----------------------------\n[86220.125666] kernel/sched/core.c:6026 Illegal context switch in RCU-bh read-side critical section!\n[86220.125711]\n               other info that might help us debug this:\n\n[86220.125755]\n               rcu_scheduler_active = 2, debug_locks = 1\n[86220.125792] 4 locks held by kworker/0:2/1003:\n[86220.125817]  #0:  ((wq_completion)\"%s\"(\"ipv6_addrconf\")){+.+.}, at: [<00000000da8e9b73>] process_one_work+0x1de/0x680\n[86220.125895]  #1:  ((addr_chk_work).work){+.+.}, at: [<00000000da8e9b73>] process_one_work+0x1de/0x680\n[86220.125959]  #2:  (rtnl_mutex){+.+.}, at: [<00000000b06d9510>] rtnl_lock+0x12/0x20\n[86220.126017]  #3:  (rcu_read_lock_bh){....}, at: [<00000000aef52299>] addrconf_verify_rtnl+0x1e/0x510 [ipv6]\n[86220.126111]\n               stack backtrace:\n[86220.126142] CPU: 0 PID: 1003 Comm: kworker/0:2 Not tainted 4.15.0-rc7-next-20180110+ #7\n[86220.126185] Hardware name: ZOTAC ZBOX-CI321NANO/ZBOX-CI321NANO, BIOS B246P105 06/01/2015\n[86220.126250] Workqueue: ipv6_addrconf addrconf_verify_work [ipv6]\n[86220.126288] Call Trace:\n[86220.126312]  dump_stack+0x70/0x9e\n[86220.126337]  lockdep_rcu_suspicious+0xce/0xf0\n[86220.126365]  ___might_sleep+0x1d3/0x240\n[86220.126390]  __might_sleep+0x45/0x80\n[86220.126416]  kmem_cache_alloc_trace+0x53/0x250\n[86220.126458]  ? ipv6_add_addr+0xfe/0x6e0 [ipv6]\n[86220.126498]  ipv6_add_addr+0xfe/0x6e0 [ipv6]\n[86220.126538]  ipv6_create_tempaddr+0x24d/0x430 [ipv6]\n[86220.126580]  ? ipv6_create_tempaddr+0x24d/0x430 [ipv6]\n[86220.126623]  addrconf_verify_rtnl+0x339/0x510 [ipv6]\n[86220.126664]  ? addrconf_verify_rtnl+0x339/0x510 [ipv6]\n[86220.126708]  addrconf_verify_work+0xe/0x20 [ipv6]\n[86220.126738]  process_one_work+0x258/0x680\n[86220.126765]  worker_thread+0x35/0x3f0\n[86220.126790]  kthread+0x124/0x140\n[86220.126813]  ? process_one_work+0x680/0x680\n[86220.126839]  ? kthread_create_worker_on_cpu+0x40/0x40\n[86220.126869]  ? umh_complete+0x40/0x40\n[86220.126893]  ? call_usermodehelper_exec_async+0x12a/0x160\n[86220.126926]  ret_from_fork+0x4b/0x60\n[86220.126999] BUG: sleeping function called from invalid context at mm/slab.h:420\n[86220.127041] in_atomic(): 1, irqs_disabled(): 0, pid: 1003, name: kworker/0:2\n[86220.127082] 4 locks held by kworker/0:2/1003:\n[86220.127107]  #0:  ((wq_completion)\"%s\"(\"ipv6_addrconf\")){+.+.}, at: [<00000000da8e9b73>] process_one_work+0x1de/0x680\n[86220.127179]  #1:  ((addr_chk_work).work){+.+.}, at: [<00000000da8e9b73>] process_one_work+0x1de/0x680\n[86220.127242]  #2:  (rtnl_mutex){+.+.}, at: [<00000000b06d9510>] rtnl_lock+0x12/0x20\n[86220.127300]  #3:  (rcu_read_lock_bh){....}, at: [<00000000aef52299>] addrconf_verify_rtnl+0x1e/0x510 [ipv6]\n[86220.127414] CPU: 0 PID: 1003 Comm: kworker/0:2 Not tainted 4.15.0-rc7-next-20180110+ #7\n[86220.127463] Hardware name: ZOTAC ZBOX-CI321NANO/ZBOX-CI321NANO, BIOS B246P105 06/01/2015\n[86220.127528] Workqueue: ipv6_addrconf addrconf_verify_work [ipv6]\n[86220.127568] Call Trace:\n[86220.127591]  dump_stack+0x70/0x9e\n[86220.127616]  ___might_sleep+0x14d/0x240\n[86220.127644]  __might_sleep+0x45/0x80\n[86220.127672]  kmem_cache_alloc_trace+0x53/0x250\n[86220.127717]  ? ipv6_add_addr+0xfe/0x6e0 [ipv6]\n[86220.127762]  ipv6_add_addr+0xfe/0x6e0 [ipv6]\n[86220.127807]  ipv6_create_tempaddr+0x24d/0x430 [ipv6]\n[86220.127854]  ? ipv6_create_tempaddr+0x24d/0x430 [ipv6]\n[86220.127903]  addrconf_verify_rtnl+0x339/0x510 [ipv6]\n[86220.127950]  ? addrconf_verify_rtnl+0x339/0x510 [ipv6]\n[86220.127998]  addrconf_verify_work+0xe/0x20 [ipv6]\n[86220.128032]  process_one_work+0x258/0x680\n[86220.128063]  worker_thread+0x35/0x3f0\n[86220.128091]  kthread+0x124/0x140\n[86220.128117]  ? process_one_work+0x680/0x680\n[86220.128146]  ? kthread_create_worker_on_cpu+0x40/0x40\n[86220.128180]  ? umh_complete+0x40/0x40\n[86220.128207]  ? call_usermodehelper_exec_async+0x12a/0x160\n[86220.128243]  ret_from_fork+0x4b/0x60\n\nFixes: f3d9832e56c4 (\"ipv6: addrconf: cleanup locking in ipv6_add_addr\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: Heiner Kallweit <hkallweit1@gmail.com>\nReviewed-by: Ido Schimmel <idosch@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/513f3cc3d1d344634f26c12ad3d445c962f1a85a"},{"sha":"81259f3592f8bc36f146034663a27184966c9e62","author":{"name":"Wei Wang","email":"f5e441d9376675c1080c91dfcb46bb84ae267df0@google.com"},"message":"ipv6: change route cache aging logic\n\n\n[ Upstream commit 31afeb425f7fad8bcf9561aeb0b8405479f97a98 ]\n\nIn current route cache aging logic, if a route has both RTF_EXPIRE and\nRTF_GATEWAY set, the route will only be removed if the neighbor cache\nhas no NTF_ROUTER flag. Otherwise, even if the route has expired, it\nwon't get deleted.\nFix this logic to always check if the route has expired first and then\ndo the gateway neighbor cache check if previous check decide to not\nremove the exception entry.\n\nFixes: 1859bac04fb6 (\"ipv6: remove from fib tree aged out RTF_CACHE dst\")\nSigned-off-by: Wei Wang <weiwan@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nAcked-by: Martin KaFai Lau <kafai@fb.com>\nAcked-by: Paolo Abeni <pabeni@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/81259f3592f8bc36f146034663a27184966c9e62"},{"sha":"b22b76fbd802e8cdcd70b9e95f2755b8ee36705d","author":{"name":"Roman Gushchin","email":"151f32cf45872ed97ae4b743f92193d7783d3cfe@fb.com"},"message":"Revert \"defer call to mem_cgroup_sk_alloc()\"\n\n\n[ Upstream commit edbe69ef2c90fc86998a74b08319a01c508bd497 ]\n\nThis patch effectively reverts commit 9f1c2674b328 (\"net: memcontrol:\ndefer call to mem_cgroup_sk_alloc()\").\n\nMoving mem_cgroup_sk_alloc() to the inet_csk_accept() completely breaks\nmemcg socket memory accounting, as packets received before memcg\npointer initialization are not accounted and are causing refcounting\nunderflow on socket release.\n\nActually the free-after-use problem was fixed by\ncommit c0576e397508 (\"net: call cgroup_sk_alloc() earlier in\nsk_clone_lock()\") for the cgroup pointer.\n\nSo, let's revert it and call mem_cgroup_sk_alloc() just before\ncgroup_sk_alloc(). This is safe, as we hold a reference to the socket\nwe're cloning, and it holds a reference to the memcg.\n\nAlso, let's drop BUG_ON(mem_cgroup_is_root()) check from\nmem_cgroup_sk_alloc(). I see no reasons why bumping the root\nmemcg counter is a good reason to panic, and there are no realistic\nways to hit it.\n\nSigned-off-by: Roman Gushchin <guro@fb.com>\nCc: Eric Dumazet <edumazet@google.com>\nCc: David S. Miller <davem@davemloft.net>\nCc: Johannes Weiner <hannes@cmpxchg.org>\nCc: Tejun Heo <tj@kernel.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/b22b76fbd802e8cdcd70b9e95f2755b8ee36705d"},{"sha":"d19a4d19ccab5061ae589a670d2e2a28a5e83eba","author":{"name":"David Ahern","email":"e0d419a0ba2bdeef0ad5e59f7813befeb3252a55@gmail.com"},"message":"net: ipv6: send unsolicited NA after DAD\n\n\n[ Upstream commit c76fe2d98c726224a975a0d0198c3fb50406d325 ]\n\nUnsolicited IPv6 neighbor advertisements should be sent after DAD\ncompletes. Update ndisc_send_unsol_na to skip tentative, non-optimistic\naddresses and have those sent by addrconf_dad_completed after DAD.\n\nFixes: 4a6e3c5def13c (\"net: ipv6: send unsolicited NA on admin up\")\nReported-by: Vivek Venkatraman <vivek@cumulusnetworks.com>\nSigned-off-by: David Ahern <dsahern@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/d19a4d19ccab5061ae589a670d2e2a28a5e83eba"},{"sha":"759f8b0b3ad8374b7f5750e53690804d9dd7e482","author":{"name":"Jiri Pirko","email":"a7e702c6c67814648a4f7569508b76ff202ca280@mellanox.com"},"message":"rocker: fix possible null pointer dereference in rocker_router_fib_event_work\n\n\n[ Upstream commit a83165f00f16c0e0ef5b7cec3cbd0d4788699265 ]\n\nCurrently, rocker user may experience following null pointer\nderefence bug:\n\n[    3.062141] BUG: unable to handle kernel NULL pointer dereference at 00000000000000d0\n[    3.065163] IP: rocker_router_fib_event_work+0x36/0x110 [rocker]\n\nThe problem is uninitialized rocker->wops pointer that is initialized\nonly with the first initialized port. So move the port initialization\nbefore registering the fib events.\n\nFixes: 936bd486564a (\"rocker: use FIB notifications instead of switchdev calls\")\nSigned-off-by: Jiri Pirko <jiri@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/759f8b0b3ad8374b7f5750e53690804d9dd7e482"},{"sha":"a742a89695ce06f064406ab6fcd64110b12b9917","author":{"name":"Neal Cardwell","email":"6eb0de8c52d8a3fcaae13b97cd10ce8592d0bd4f@google.com"},"message":"tcp_bbr: fix pacing_gain to always be unity when using lt_bw\n\n\n[ Upstream commit 3aff3b4b986e51bcf4ab249e5d48d39596e0df6a ]\n\nThis commit fixes the pacing_gain to remain at BBR_UNIT (1.0) when\nusing lt_bw and returning from the PROBE_RTT state to PROBE_BW.\n\nPreviously, when using lt_bw, upon exiting PROBE_RTT and entering\nPROBE_BW the bbr_reset_probe_bw_mode() code could sometimes randomly\nend up with a cycle_idx of 0 and hence have bbr_advance_cycle_phase()\nset a pacing gain above 1.0. In such cases this would result in a\npacing rate that is 1.25x higher than intended, potentially resulting\nin a high loss rate for a little while until we stop using the lt_bw a\nbit later.\n\nThis commit is a stable candidate for kernels back as far as 4.9.\n\nFixes: 0f8782ea1497 (\"tcp_bbr: add BBR congestion control\")\nSigned-off-by: Neal Cardwell <ncardwell@google.com>\nSigned-off-by: Yuchung Cheng <ycheng@google.com>\nSigned-off-by: Soheil Hassas Yeganeh <soheil@google.com>\nReported-by: Beyers Cronje <bcronje@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/a742a89695ce06f064406ab6fcd64110b12b9917"},{"sha":"ce6fa12a7ba5f685ab6a5833f5d5c04b3da25df5","author":{"name":"Paolo Abeni","email":"760d0d6fcadb77e1b4c1d3c7879788c2b4ed8bbe@redhat.com"},"message":"cls_u32: add missing RCU annotation.\n\n\n[ Upstream commit 058a6c033488494a6b1477b05fe8e1a16e344462 ]\n\nIn a couple of points of the control path, n->ht_down is currently\naccessed without the required RCU annotation. The accesses are\nsafe, but sparse complaints. Since we already held the\nrtnl lock, let use rtnl_dereference().\n\nFixes: a1b7c5fd7fe9 (\"net: sched: add cls_u32 offload hooks for netdevs\")\nFixes: de5df63228fc (\"net: sched: cls_u32 changes to knode must appear atomic to readers\")\nSigned-off-by: Paolo Abeni <pabeni@redhat.com>\nAcked-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/ce6fa12a7ba5f685ab6a5833f5d5c04b3da25df5"},{"sha":"07055dd6c806e714d50680940a9cdb1ae393722a","author":{"name":"Martin KaFai Lau","email":"3d2baff522d22333e98f2faf29cb570c7ef8b986@fb.com"},"message":"ipv6: Fix SO_REUSEPORT UDP socket with implicit sk_ipv6only\n\n\n[ Upstream commit 7ece54a60ee2ba7a386308cae73c790bd580589c ]\n\nIf a sk_v6_rcv_saddr is !IPV6_ADDR_ANY and !IPV6_ADDR_MAPPED, it\nimplicitly implies it is an ipv6only socket.  However, in inet6_bind(),\nthis addr_type checking and setting sk->sk_ipv6only to 1 are only done\nafter sk->sk_prot->get_port(sk, snum) has been completed successfully.\n\nThis inconsistency between sk_v6_rcv_saddr and sk_ipv6only confuses\nthe 'get_port()'.\n\nIn particular, when binding SO_REUSEPORT UDP sockets,\nudp_reuseport_add_sock(sk,...) is called.  udp_reuseport_add_sock()\nchecks \"ipv6_only_sock(sk2) == ipv6_only_sock(sk)\" before adding sk to\nsk2->sk_reuseport_cb.  In this case, ipv6_only_sock(sk2) could be\n1 while ipv6_only_sock(sk) is still 0 here.  The end result is,\nreuseport_alloc(sk) is called instead of adding sk to the existing\nsk2->sk_reuseport_cb.\n\nIt can be reproduced by binding two SO_REUSEPORT UDP sockets on an\nIPv6 address (!ANY and !MAPPED).  Only one of the socket will\nreceive packet.\n\nThe fix is to set the implicit sk_ipv6only before calling get_port().\nThe original sk_ipv6only has to be saved such that it can be restored\nin case get_port() failed.  The situation is similar to the\ninet_reset_saddr(sk) after get_port() has failed.\n\nThanks to Calvin Owens <calvinowens@fb.com> who created an easy\nreproduction which leads to a fix.\n\nFixes: e32ea7e74727 (\"soreuseport: fast reuseport UDP socket selection\")\nSigned-off-by: Martin KaFai Lau <kafai@fb.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/07055dd6c806e714d50680940a9cdb1ae393722a"},{"sha":"4c92abe86a20e74e76ac47938275e12a7ffad0c5","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"soreuseport: fix mem leak in reuseport_add_sock()\n\n\n[ Upstream commit 4db428a7c9ab07e08783e0fcdc4ca0f555da0567 ]\n\nreuseport_add_sock() needs to deal with attaching a socket having\nits own sk_reuseport_cb, after a prior\nsetsockopt(SO_ATTACH_REUSEPORT_?BPF)\n\nWithout this fix, not only a WARN_ONCE() was issued, but we were also\nleaking memory.\n\nThanks to sysbot and Eric Biggers for providing us nice C repros.\n\n------------[ cut here ]------------\nsocket already in reuseport group\nWARNING: CPU: 0 PID: 3496 at net/core/sock_reuseport.c:119  \nreuseport_add_sock+0x742/0x9b0 net/core/sock_reuseport.c:117\nKernel panic - not syncing: panic_on_warn set ...\n\nCPU: 0 PID: 3496 Comm: syzkaller869503 Not tainted 4.15.0-rc6+ #245\nHardware name: Google Google Compute Engine/Google Compute Engine,\nBIOS  \nGoogle 01/01/2011\nCall Trace:\n  __dump_stack lib/dump_stack.c:17 [inline]\n  dump_stack+0x194/0x257 lib/dump_stack.c:53\n  panic+0x1e4/0x41c kernel/panic.c:183\n  __warn+0x1dc/0x200 kernel/panic.c:547\n  report_bug+0x211/0x2d0 lib/bug.c:184\n  fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178\n  fixup_bug arch/x86/kernel/traps.c:247 [inline]\n  do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296\n  do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315\n  invalid_op+0x22/0x40 arch/x86/entry/entry_64.S:1079\n\nFixes: ef456144da8e (\"soreuseport: define reuseport groups\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot+c0ea2226f77a42936bf7@syzkaller.appspotmail.com\nAcked-by: Craig Gallek <kraig@google.com>\n\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/4c92abe86a20e74e76ac47938275e12a7ffad0c5"},{"sha":"41551c14bf0d519f464daf4ff81a4109b5b92f09","author":{"name":"Cong Wang","email":"3f5d79d28d6d48052800caba9df0b30e06fefe41@gmail.com"},"message":"net_sched: get rid of rcu_barrier() in tcf_block_put_ext()\n\n\n[ Upstream commit efbf78973978b0d25af59bc26c8013a942af6e64 ]\n\nBoth Eric and Paolo noticed the rcu_barrier() we use in\ntcf_block_put_ext() could be a performance bottleneck when\nwe have a lot of tc classes.\n\nPaolo provided the following to demonstrate the issue:\n\ntc qdisc add dev lo root htb\nfor I in `seq 1 1000`; do\n        tc class add dev lo parent 1: classid 1:$I htb rate 100kbit\n        tc qdisc add dev lo parent 1:$I handle $((I + 1)): htb\n        for J in `seq 1 10`; do\n                tc filter add dev lo parent $((I + 1)): u32 match ip src 1.1.1.$J\n        done\ndone\ntime tc qdisc del dev root\n\nreal    0m54.764s\nuser    0m0.023s\nsys     0m0.000s\n\nThe rcu_barrier() there is to ensure we free the block after all chains\nare gone, that is, to queue tcf_block_put_final() at the tail of workqueue.\nWe can achieve this ordering requirement by refcnt'ing tcf block instead,\nthat is, the tcf block is freed only when the last chain in this block is\ngone. This also simplifies the code.\n\nPaolo reported after this patch we get:\n\nreal    0m0.017s\nuser    0m0.000s\nsys     0m0.017s\n\nTested-by: Paolo Abeni <pabeni@redhat.com>\nCc: Eric Dumazet <edumazet@google.com>\nCc: Jiri Pirko <jiri@mellanox.com>\nCc: Jamal Hadi Salim <jhs@mojatatu.com>\nSigned-off-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/41551c14bf0d519f464daf4ff81a4109b5b92f09"},{"sha":"25de2482a958f54e8497de4eb69884af1fa9fe68","author":{"name":"Jiri Pirko","email":"a7e702c6c67814648a4f7569508b76ff202ca280@mellanox.com"},"message":"net: sched: fix use-after-free in tcf_block_put_ext\n\n\n[ Upstream commit df45bf84e4f5a48f23d4b1a07d21d566e8b587b2 ]\n\nSince the block is freed with last chain being put, once we reach the\nend of iteration of list_for_each_entry_safe, the block may be\nalready freed. I'm hitting this only by creating and deleting clsact:\n\n[  202.171952] ==================================================================\n[  202.180182] BUG: KASAN: use-after-free in tcf_block_put_ext+0x240/0x390\n[  202.187590] Read of size 8 at addr ffff880225539a80 by task tc/796\n[  202.194508]\n[  202.196185] CPU: 0 PID: 796 Comm: tc Not tainted 4.15.0-rc2jiri+ #5\n[  202.203200] Hardware name: Mellanox Technologies Ltd. \"MSN2100-CB2F\"/\"SA001017\", BIOS 5.6.5 06/07/2016\n[  202.213613] Call Trace:\n[  202.216369]  dump_stack+0xda/0x169\n[  202.220192]  ? dma_virt_map_sg+0x147/0x147\n[  202.224790]  ? show_regs_print_info+0x54/0x54\n[  202.229691]  ? tcf_chain_destroy+0x1dc/0x250\n[  202.234494]  print_address_description+0x83/0x3d0\n[  202.239781]  ? tcf_block_put_ext+0x240/0x390\n[  202.244575]  kasan_report+0x1ba/0x460\n[  202.248707]  ? tcf_block_put_ext+0x240/0x390\n[  202.253518]  tcf_block_put_ext+0x240/0x390\n[  202.258117]  ? tcf_chain_flush+0x290/0x290\n[  202.262708]  ? qdisc_hash_del+0x82/0x1a0\n[  202.267111]  ? qdisc_hash_add+0x50/0x50\n[  202.271411]  ? __lock_is_held+0x5f/0x1a0\n[  202.275843]  clsact_destroy+0x3d/0x80 [sch_ingress]\n[  202.281323]  qdisc_destroy+0xcb/0x240\n[  202.285445]  qdisc_graft+0x216/0x7b0\n[  202.289497]  tc_get_qdisc+0x260/0x560\n\nFix this by holding the block also by chain 0 and put chain 0\nexplicitly, out of the list_for_each_entry_safe loop at the very\nend of tcf_block_put_ext.\n\nFixes: efbf78973978 (\"net_sched: get rid of rcu_barrier() in tcf_block_put_ext()\")\nSigned-off-by: Jiri Pirko <jiri@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/25de2482a958f54e8497de4eb69884af1fa9fe68"},{"sha":"fe70ce28670e01d02169b2bc3b595b6ee5c8d19d","author":{"name":"Jesse Chan","email":"6b3cf6f314263a52d028bd1a1c381fb1c2b231cc@linux.com"},"message":"media: mtk-vcodec: add missing MODULE_LICENSE/DESCRIPTION\n\ncommit ccbc1e3876d5476fc23429690a683294ef0f755b upstream.\n\nThis change resolves a new compile-time warning\nwhen built as a loadable module:\n\nWARNING: modpost: missing MODULE_LICENSE() in drivers/media/platform/mtk-vcodec/mtk-vcodec-common.o\nsee include/linux/module.h for more information\n\nThis adds the license as \"GPL v2\", which matches the header of the file.\n\nMODULE_DESCRIPTION is also added.\n\nSigned-off-by: Jesse Chan <jc@linux.com>\nSigned-off-by: Hans Verkuil <hans.verkuil@cisco.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/fe70ce28670e01d02169b2bc3b595b6ee5c8d19d"},{"sha":"bc87735cb0050cd92f10d0e72e56dd34bf8f4c42","author":{"name":"Jesse Chan","email":"6b3cf6f314263a52d028bd1a1c381fb1c2b231cc@linux.com"},"message":"media: soc_camera: soc_scale_crop: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE\n\ncommit 5331aec1bf9c9da557668174e0a4bfcee39f1121 upstream.\n\nThis change resolves a new compile-time warning\nwhen built as a loadable module:\n\nWARNING: modpost: missing MODULE_LICENSE() in drivers/media/platform/soc_camera/soc_scale_crop.o\nsee include/linux/module.h for more information\n\nThis adds the license as \"GPL\", which matches the header of the file.\n\nMODULE_DESCRIPTION and MODULE_AUTHOR are also added.\n\nSigned-off-by: Jesse Chan <jc@linux.com>\nSigned-off-by: Hans Verkuil <hans.verkuil@cisco.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm-3.18/commits/bc87735cb0050cd92f10d0e72e56dd34bf8f4c42"}]}
{"actor":{"display_login":"Jackeagle"}}