{"push_id":2597194838,"size":93,"distinct_size":93,"ref":"refs/heads/PPR1.180412.048_CAF","head":"8ca6d481d60e928c9c663c3777a0ba1662d0a062","before":"7a3f6fd9fdd0eb1b5609c86caea318122cee0769","commits":[{"sha":"a221a0c1db1e343ba64a41e21a39aea73d35ab7f","author":{"name":"Ingo Molnar","email":"9dbbbf0688fedc85ad4da37637f1a64b8c718ee2@elte.hu"},"message":"8139too: Use disable_irq_nosync() in rtl8139_poll_controller()\n\n[ Upstream commit af3e0fcf78879f718c5f73df0814951bd7057d34 ]\n\nUse disable_irq_nosync() instead of disable_irq() as this might be\ncalled in atomic context with netpoll.\n\nSigned-off-by: Ingo Molnar <mingo@elte.hu>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/a221a0c1db1e343ba64a41e21a39aea73d35ab7f"},{"sha":"2a188d15b21814af58d6a038023d0d8cbd9d6065","author":{"name":"Hangbin Liu","email":"f18dd0be96fb7338348dc2439a86c9a4ef8ef3b9@gmail.com"},"message":"bridge: check iface upper dev when setting master via ioctl\n\n[ Upstream commit e8238fc2bd7b4c3c7554fa2df067e796610212fc ]\n\nWhen we set a bond slave's master to bridge via ioctl, we only check\nthe IFF_BRIDGE_PORT flag. Although we will find the slave's real master\nat netdev_master_upper_dev_link() later, it already does some settings\nand allocates some resources. It would be better to return as early\nas possible.\n\nv1 -> v2:\nuse netdev_master_upper_dev_get() instead of netdev_has_any_upper_dev()\nto check if we have a master, because not all upper devs are masters,\ne.g. vlan device.\n\nReported-by: syzbot+de73361ee4971b6e6f75@syzkaller.appspotmail.com\nSigned-off-by: Hangbin Liu <liuhangbin@gmail.com>\nAcked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/2a188d15b21814af58d6a038023d0d8cbd9d6065"},{"sha":"7233fad00faa51a04a074a6ed7e507f408c034ec","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"dccp: fix tasklet usage\n\n[ Upstream commit a8d7aa17bbc970971ccdf71988ea19230ab368b1 ]\n\nsyzbot reported a crash in tasklet_action_common() caused by dccp.\n\ndccp needs to make sure socket wont disappear before tasklet handler\nhas completed.\n\nThis patch takes a reference on the socket when arming the tasklet,\nand moves the sock_put() from dccp_write_xmit_timer() to dccp_write_xmitlet()\n\nkernel BUG at kernel/softirq.c:514!\ninvalid opcode: 0000 [#1] SMP KASAN\nDumping ftrace buffer:\n   (ftrace buffer empty)\nModules linked in:\nCPU: 1 PID: 17 Comm: ksoftirqd/1 Not tainted 4.17.0-rc3+ #30\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:tasklet_action_common.isra.19+0x6db/0x700 kernel/softirq.c:515\nRSP: 0018:ffff8801d9b3faf8 EFLAGS: 00010246\ndccp_close: ABORT with 65423 bytes unread\nRAX: 1ffff1003b367f6b RBX: ffff8801daf1f3f0 RCX: 0000000000000000\nRDX: ffff8801cf895498 RSI: 0000000000000004 RDI: 0000000000000000\nRBP: ffff8801d9b3fc40 R08: ffffed0039f12a95 R09: ffffed0039f12a94\ndccp_close: ABORT with 65423 bytes unread\nR10: ffffed0039f12a94 R11: ffff8801cf8954a3 R12: 0000000000000000\nR13: ffff8801d9b3fc18 R14: dffffc0000000000 R15: ffff8801cf895490\nFS:  0000000000000000(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b2bc28000 CR3: 00000001a08a9000 CR4: 00000000001406e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n tasklet_action+0x1d/0x20 kernel/softirq.c:533\n __do_softirq+0x2e0/0xaf5 kernel/softirq.c:285\ndccp_close: ABORT with 65423 bytes unread\n run_ksoftirqd+0x86/0x100 kernel/softirq.c:646\n smpboot_thread_fn+0x417/0x870 kernel/smpboot.c:164\n kthread+0x345/0x410 kernel/kthread.c:238\n ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412\nCode: 48 8b 85 e8 fe ff ff 48 8b 95 f0 fe ff ff e9 94 fb ff ff 48 89 95 f0 fe ff ff e8 81 53 6e 00 48 8b 95 f0 fe ff ff e9 62 fb ff ff <0f> 0b 48 89 cf 48 89 8d e8 fe ff ff e8 64 53 6e 00 48 8b 8d e8\nRIP: tasklet_action_common.isra.19+0x6db/0x700 kernel/softirq.c:515 RSP: ffff8801d9b3faf8\n\nFixes: dc841e30eaea (\"dccp: Extend CCID packet dequeueing interface\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nCc: Gerrit Renker <gerrit@erg.abdn.ac.uk>\nCc: dccp@vger.kernel.org\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/7233fad00faa51a04a074a6ed7e507f408c034ec"},{"sha":"87bd2aca94cc3a3d0a48fa75a7532ff19f1549cc","author":{"name":"Andrey Ignatov","email":"3a9edd153d9b65bce4a8ad804ccb94de5957b299@fb.com"},"message":"ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg\n\n[ Upstream commit 1b97013bfb11d66f041de691de6f0fec748ce016 ]\n\nFix more memory leaks in ip_cmsg_send() callers. Part of them were fixed\nearlier in 919483096bfe.\n\n* udp_sendmsg one was there since the beginning when linux sources were\n  first added to git;\n* ping_v4_sendmsg one was copy/pasted in c319b4d76b9e.\n\nWhenever return happens in udp_sendmsg() or ping_v4_sendmsg() IP options\nhave to be freed if they were allocated previously.\n\nAdd label so that future callers (if any) can use it instead of kfree()\nbefore return that is easy to forget.\n\nFixes: c319b4d76b9e (net: ipv4: add IPPROTO_ICMP socket kind)\nSigned-off-by: Andrey Ignatov <rdna@fb.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/87bd2aca94cc3a3d0a48fa75a7532ff19f1549cc"},{"sha":"418e529ef418ecf31019de0034d63b226dd92937","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"llc: better deal with too small mtu\n\n[ Upstream commit 2c5d5b13c6eb79f5677e206b8aad59b3a2097f60 ]\n\nsyzbot loves to set very small mtu on devices, since it brings joy.\nWe must make llc_ui_sendmsg() fool proof.\n\nusercopy: Kernel memory overwrite attempt detected to wrapped address (offset 0, size 18446612139802320068)!\n\nkernel BUG at mm/usercopy.c:100!\ninvalid opcode: 0000 [#1] SMP KASAN\nDumping ftrace buffer:\n   (ftrace buffer empty)\nModules linked in:\nCPU: 0 PID: 17464 Comm: syz-executor1 Not tainted 4.17.0-rc3+ #36\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:usercopy_abort+0xbb/0xbd mm/usercopy.c:88\nRSP: 0018:ffff8801868bf800 EFLAGS: 00010282\nRAX: 000000000000006c RBX: ffffffff87d2fb00 RCX: 0000000000000000\nRDX: 000000000000006c RSI: ffffffff81610731 RDI: ffffed0030d17ef6\nRBP: ffff8801868bf858 R08: ffff88018daa4200 R09: ffffed003b5c4fb0\nR10: ffffed003b5c4fb0 R11: ffff8801dae27d87 R12: ffffffff87d2f8e0\nR13: ffffffff87d2f7a0 R14: ffffffff87d2f7a0 R15: ffffffff87d2f7a0\nFS:  00007f56a14ac700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b2bc21000 CR3: 00000001abeb1000 CR4: 00000000001426f0\nDR0: 0000000020000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000030602\nCall Trace:\n check_bogus_address mm/usercopy.c:153 [inline]\n __check_object_size+0x5d9/0x5d9 mm/usercopy.c:256\n check_object_size include/linux/thread_info.h:108 [inline]\n check_copy_size include/linux/thread_info.h:139 [inline]\n copy_from_iter_full include/linux/uio.h:121 [inline]\n memcpy_from_msg include/linux/skbuff.h:3305 [inline]\n llc_ui_sendmsg+0x4b1/0x1530 net/llc/af_llc.c:941\n sock_sendmsg_nosec net/socket.c:629 [inline]\n sock_sendmsg+0xd5/0x120 net/socket.c:639\n __sys_sendto+0x3d7/0x670 net/socket.c:1789\n __do_sys_sendto net/socket.c:1801 [inline]\n __se_sys_sendto net/socket.c:1797 [inline]\n __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1797\n do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\nRIP: 0033:0x455979\nRSP: 002b:00007f56a14abc68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 00007f56a14ac6d4 RCX: 0000000000455979\nRDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000018\nRBP: 000000000072bea0 R08: 00000000200012c0 R09: 0000000000000010\nR10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff\nR13: 0000000000000548 R14: 00000000006fbf60 R15: 0000000000000000\nCode: 55 c0 e8 c0 55 bb ff ff 75 c8 48 8b 55 c0 4d 89 f9 ff 75 d0 4d 89 e8 48 89 d9 4c 89 e6 41 56 48 c7 c7 80 fa d2 87 e8 a0 0b a3 ff <0f> 0b e8 95 55 bb ff e8 c0 a8 f7 ff 8b 95 14 ff ff ff 4d 89 e8\nRIP: usercopy_abort+0xbb/0xbd mm/usercopy.c:88 RSP: ffff8801868bf800\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/418e529ef418ecf31019de0034d63b226dd92937"},{"sha":"c9264b0a7e133df20e6c9d27d5cc08b2a01f2575","author":{"name":"Rob Taglang","email":"7e09c9d3e96378bf549fc283fd6e1e5b7014cc33@taglang.io"},"message":"net: ethernet: sun: niu set correct packet size in skb\n\n[ Upstream commit 14224923c3600bae2ac4dcae3bf0c3d4dc2812be ]\n\nCurrently, skb->len and skb->data_len are set to the page size, not\nthe packet size. This causes the frame check sequence to not be\nlocated at the \"end\" of the packet resulting in ethernet frame check\nerrors. The driver does work currently, but stricter kernel facing\nnetworking solutions like OpenVSwitch will drop these packets as\ninvalid.\n\nThese changes set the packet size correctly so that these errors no\nlonger occur. The length does not include the frame check sequence, so\nthat subtraction was removed.\n\nTested on Oracle/SUN Multithreaded 10-Gigabit Ethernet Network\nController [108e:abcd] and validated in wireshark.\n\nSigned-off-by: Rob Taglang <rob@taglang.io>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/c9264b0a7e133df20e6c9d27d5cc08b2a01f2575"},{"sha":"7e2d8aef33e46adf2b588a588980a505ab5f8c76","author":{"name":"Moshe Shemesh","email":"4525a3495491b98d246cf922709358670bcfcdfb@mellanox.com"},"message":"net/mlx4_en: Verify coalescing parameters are in range\n\n[ Upstream commit 6ad4e91c6d796b38a7f0e724db1de28eeb122bad ]\n\nAdd check of coalescing parameters received through ethtool are within\nrange of values supported by the HW.\nDriver gets the coalescing rx/tx-usecs and rx/tx-frames as set by the\nusers through ethtool. The ethtool support up to 32 bit value for each.\nHowever, mlx4 modify cq limits the coalescing time parameter and\ncoalescing frames parameters to 16 bits.\nReturn out of range error if user tries to set these parameters to\nhigher values.\nChange type of sample-interval and adaptive_rx_coal parameters in mlx4\ndriver to u32 as the ethtool holds them as u32 and these parameters are\nnot limited due to mlx4 HW.\n\nFixes: c27a02cd94d6 ('mlx4_en: Add driver for Mellanox ConnectX 10GbE NIC')\nSigned-off-by: Moshe Shemesh <moshe@mellanox.com>\nSigned-off-by: Tariq Toukan <tariqt@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/7e2d8aef33e46adf2b588a588980a505ab5f8c76"},{"sha":"541d81ab682aed633052e7312e104d99cdeb1554","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"net_sched: fq: take care of throttled flows before reuse\n\n[ Upstream commit 7df40c2673a1307c3260aab6f9d4b9bf97ca8fd7 ]\n\nNormally, a socket can not be freed/reused unless all its TX packets\nleft qdisc and were TX-completed. However connect(AF_UNSPEC) allows\nthis to happen.\n\nWith commit fc59d5bdf1e3 (\"pkt_sched: fq: clear time_next_packet for\nreused flows\") we cleared f->time_next_packet but took no special\naction if the flow was still in the throttled rb-tree.\n\nSince f->time_next_packet is the key used in the rb-tree searches,\nblindly clearing it might break rb-tree integrity. We need to make\nsure the flow is no longer in the rb-tree to avoid this problem.\n\nFixes: fc59d5bdf1e3 (\"pkt_sched: fq: clear time_next_packet for reused flows\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/541d81ab682aed633052e7312e104d99cdeb1554"},{"sha":"b19f6e41a3db6f5e547545537430bc7305f82a73","author":{"name":"Lance Richardson","email":"4173e1eb8e8cf2570ee846a656633d3de8385f2d@gmail.com"},"message":"net: support compat 64-bit time in {s,g}etsockopt\n\n[ Upstream commit 988bf7243e03ef69238381594e0334a79cef74a6 ]\n\nFor the x32 ABI, struct timeval has two 64-bit fields. However\nthe kernel currently interprets the user-space values used for\nthe SO_RCVTIMEO and SO_SNDTIMEO socket options as having a pair\nof 32-bit fields.\n\nWhen the seconds portion of the requested timeout is less than 2**32,\nthe seconds portion of the effective timeout is correct but the\nmicroseconds portion is zero.  When the seconds portion of the\nrequested timeout is zero and the microseconds portion is non-zero,\nthe kernel interprets the timeout as zero (never timeout).\n\nFix by using 64-bit time for SO_RCVTIMEO/SO_SNDTIMEO as required\nfor the ABI.\n\nThe code included below demonstrates the problem.\n\nResults before patch:\n    $ gcc -m64 -Wall -O2 -o socktmo socktmo.c && ./socktmo\n    recv time: 2.008181 seconds\n    send time: 2.015985 seconds\n\n    $ gcc -m32 -Wall -O2 -o socktmo socktmo.c && ./socktmo\n    recv time: 2.016763 seconds\n    send time: 2.016062 seconds\n\n    $ gcc -mx32 -Wall -O2 -o socktmo socktmo.c && ./socktmo\n    recv time: 1.007239 seconds\n    send time: 1.023890 seconds\n\nResults after patch:\n    $ gcc -m64 -O2 -Wall -o socktmo socktmo.c && ./socktmo\n    recv time: 2.010062 seconds\n    send time: 2.015836 seconds\n\n    $ gcc -m32 -O2 -Wall -o socktmo socktmo.c && ./socktmo\n    recv time: 2.013974 seconds\n    send time: 2.015981 seconds\n\n    $ gcc -mx32 -O2 -Wall -o socktmo socktmo.c && ./socktmo\n    recv time: 2.030257 seconds\n    send time: 2.013383 seconds\n\n #include <stdio.h>\n #include <stdlib.h>\n #include <sys/socket.h>\n #include <sys/types.h>\n #include <sys/time.h>\n\n void checkrc(char *str, int rc)\n {\n         if (rc >= 0)\n                 return;\n\n         perror(str);\n         exit(1);\n }\n\n static char buf[1024];\n int main(int argc, char **argv)\n {\n         int rc;\n         int socks[2];\n         struct timeval tv;\n         struct timeval start, end, delta;\n\n         rc = socketpair(AF_UNIX, SOCK_STREAM, 0, socks);\n         checkrc(\"socketpair\", rc);\n\n         /* set timeout to 1.999999 seconds */\n         tv.tv_sec = 1;\n         tv.tv_usec = 999999;\n         rc = setsockopt(socks[0], SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof tv);\n         rc = setsockopt(socks[0], SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof tv);\n         checkrc(\"setsockopt\", rc);\n\n         /* measure actual receive timeout */\n         gettimeofday(&start, NULL);\n         rc = recv(socks[0], buf, sizeof buf, 0);\n         gettimeofday(&end, NULL);\n         timersub(&end, &start, &delta);\n\n         printf(\"recv time: %ld.%06ld seconds\\n\",\n                (long)delta.tv_sec, (long)delta.tv_usec);\n\n         /* fill send buffer */\n         do {\n                 rc = send(socks[0], buf, sizeof buf, 0);\n         } while (rc > 0);\n\n         /* measure actual send timeout */\n         gettimeofday(&start, NULL);\n         rc = send(socks[0], buf, sizeof buf, 0);\n         gettimeofday(&end, NULL);\n         timersub(&end, &start, &delta);\n\n         printf(\"send time: %ld.%06ld seconds\\n\",\n                (long)delta.tv_sec, (long)delta.tv_usec);\n         exit(0);\n }\n\nFixes: 515c7af85ed9 (\"x32: Use compat shims for {g,s}etsockopt\")\nReported-by: Gopal RajagopalSai <gopalsr83@gmail.com>\nSigned-off-by: Lance Richardson <lance.richardson.net@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/b19f6e41a3db6f5e547545537430bc7305f82a73"},{"sha":"02ce46ba5c009d926c7a07fb9f79d39d7aa89fbc","author":{"name":"Stefano Brivio","email":"efa1d7a1f7e06da157cba8418bde1140b06b0968@redhat.com"},"message":"openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found\n\n[ Upstream commit 72f17baf2352ded6a1d3f4bb2d15da8c678cd2cb ]\n\nIf an OVS_ATTR_NESTED attribute type is found while walking\nthrough netlink attributes, we call nlattr_set() recursively\npassing the length table for the following nested attributes, if\ndifferent from the current one.\n\nHowever, once we're done with those sub-nested attributes, we\nshould continue walking through attributes using the current\ntable, instead of using the one related to the sub-nested\nattributes.\n\nFor example, given this sequence:\n\n1  OVS_KEY_ATTR_PRIORITY\n2  OVS_KEY_ATTR_TUNNEL\n3\tOVS_TUNNEL_KEY_ATTR_ID\n4\tOVS_TUNNEL_KEY_ATTR_IPV4_SRC\n5\tOVS_TUNNEL_KEY_ATTR_IPV4_DST\n6\tOVS_TUNNEL_KEY_ATTR_TTL\n7\tOVS_TUNNEL_KEY_ATTR_TP_SRC\n8\tOVS_TUNNEL_KEY_ATTR_TP_DST\n9  OVS_KEY_ATTR_IN_PORT\n10 OVS_KEY_ATTR_SKB_MARK\n11 OVS_KEY_ATTR_MPLS\n\nwe switch to the 'ovs_tunnel_key_lens' table on attribute #3,\nand we don't switch back to 'ovs_key_lens' while setting\nattributes #9 to #11 in the sequence. As OVS_KEY_ATTR_MPLS\nevaluates to 21, and the array size of 'ovs_tunnel_key_lens' is\n15, we also get this kind of KASan splat while accessing the\nwrong table:\n\n[ 7654.586496] ==================================================================\n[ 7654.594573] BUG: KASAN: global-out-of-bounds in nlattr_set+0x164/0xde9 [openvswitch]\n[ 7654.603214] Read of size 4 at addr ffffffffc169ecf0 by task handler29/87430\n[ 7654.610983]\n[ 7654.612644] CPU: 21 PID: 87430 Comm: handler29 Kdump: loaded Not tainted 3.10.0-866.el7.test.x86_64 #1\n[ 7654.623030] Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.1.7 06/16/2016\n[ 7654.631379] Call Trace:\n[ 7654.634108]  [<ffffffffb65a7c50>] dump_stack+0x19/0x1b\n[ 7654.639843]  [<ffffffffb53ff373>] print_address_description+0x33/0x290\n[ 7654.647129]  [<ffffffffc169b37b>] ? nlattr_set+0x164/0xde9 [openvswitch]\n[ 7654.654607]  [<ffffffffb53ff812>] kasan_report.part.3+0x242/0x330\n[ 7654.661406]  [<ffffffffb53ff9b4>] __asan_report_load4_noabort+0x34/0x40\n[ 7654.668789]  [<ffffffffc169b37b>] nlattr_set+0x164/0xde9 [openvswitch]\n[ 7654.676076]  [<ffffffffc167ef68>] ovs_nla_get_match+0x10c8/0x1900 [openvswitch]\n[ 7654.684234]  [<ffffffffb61e9cc8>] ? genl_rcv+0x28/0x40\n[ 7654.689968]  [<ffffffffb61e7733>] ? netlink_unicast+0x3f3/0x590\n[ 7654.696574]  [<ffffffffc167dea0>] ? ovs_nla_put_tunnel_info+0xb0/0xb0 [openvswitch]\n[ 7654.705122]  [<ffffffffb4f41b50>] ? unwind_get_return_address+0xb0/0xb0\n[ 7654.712503]  [<ffffffffb65d9355>] ? system_call_fastpath+0x1c/0x21\n[ 7654.719401]  [<ffffffffb4f41d79>] ? update_stack_state+0x229/0x370\n[ 7654.726298]  [<ffffffffb4f41d79>] ? update_stack_state+0x229/0x370\n[ 7654.733195]  [<ffffffffb53fe4b5>] ? kasan_unpoison_shadow+0x35/0x50\n[ 7654.740187]  [<ffffffffb53fe62a>] ? kasan_kmalloc+0xaa/0xe0\n[ 7654.746406]  [<ffffffffb53fec32>] ? kasan_slab_alloc+0x12/0x20\n[ 7654.752914]  [<ffffffffb53fe711>] ? memset+0x31/0x40\n[ 7654.758456]  [<ffffffffc165bf92>] ovs_flow_cmd_new+0x2b2/0xf00 [openvswitch]\n\n[snip]\n\n[ 7655.132484] The buggy address belongs to the variable:\n[ 7655.138226]  ovs_tunnel_key_lens+0xf0/0xffffffffffffd400 [openvswitch]\n[ 7655.145507]\n[ 7655.147166] Memory state around the buggy address:\n[ 7655.152514]  ffffffffc169eb80: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa\n[ 7655.160585]  ffffffffc169ec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[ 7655.168644] >ffffffffc169ec80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa\n[ 7655.176701]                                                              ^\n[ 7655.184372]  ffffffffc169ed00: fa fa fa fa 00 00 00 00 fa fa fa fa 00 00 00 05\n[ 7655.192431]  ffffffffc169ed80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00\n[ 7655.200490] ==================================================================\n\nReported-by: Hangbin Liu <liuhangbin@gmail.com>\nFixes: 982b52700482 (\"openvswitch: Fix mask generation for nested attributes.\")\nSigned-off-by: Stefano Brivio <sbrivio@redhat.com>\nReviewed-by: Sabrina Dubroca <sd@queasysnail.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/02ce46ba5c009d926c7a07fb9f79d39d7aa89fbc"},{"sha":"10bffef7fb2614f17319198146feee1769270f1e","author":{"name":"Bjørn Mork","email":"8a2957e0063f2abf61bd145b6236a74a3708ac54@mork.no"},"message":"qmi_wwan: do not steal interfaces from class drivers\n\n[ Upstream commit 5697db4a696c41601a1d15c1922150b4dbf5726c ]\n\nThe USB_DEVICE_INTERFACE_NUMBER matching macro assumes that\nthe { vendorid, productid, interfacenumber } set uniquely\nidentifies one specific function.  This has proven to fail\nfor some configurable devices. One example is the Quectel\nEM06/EP06 where the same interface number can be either\nQMI or MBIM, without the device ID changing either.\n\nFix by requiring the vendor-specific class for interface number\nbased matching.  Functions of other classes can and should use\nclass based matching instead.\n\nFixes: 03304bcb5ec4 (\"net: qmi_wwan: use fixed interface number matching\")\nSigned-off-by: Bjørn Mork <bjorn@mork.no>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/10bffef7fb2614f17319198146feee1769270f1e"},{"sha":"cd59b55080f5fa48a9cf7049dd3dcccb492a50d7","author":{"name":"Heiner Kallweit","email":"688f3b22cb68c85c90f972acb3bbdba2c5ca2ae1@gmail.com"},"message":"r8169: fix powering up RTL8168h\n\n[ Upstream commit 3148dedfe79e422f448a10250d3e2cdf8b7ee617 ]\n\nSince commit a92a08499b1f \"r8169: improve runtime pm in general and\nsuspend unused ports\" interfaces w/o link are runtime-suspended after\n10s. On systems where drivers take longer to load this can lead to the\nsituation that the interface is runtime-suspended already when it's\ninitially brought up.\nThis shouldn't be a problem because rtl_open() resumes MAC/PHY.\nHowever with at least one chip version the interface doesn't properly\ncome up, as reported here:\nhttps://bugzilla.kernel.org/show_bug.cgi?id=199549\n\nThe vendor driver uses a delay to give certain chip versions some\ntime to resume before starting the PHY configuration. So let's do\nthe same. I don't know which chip versions may be affected,\ntherefore apply this delay always.\n\nThis patch was reported to fix the issue for RTL8168h.\nI was able to reproduce the issue on an Asus H310I-Plus which also\nuses a RTL8168h. Also in my case the patch fixed the issue.\n\nReported-by: Slava Kardakov <ojab@ojab.ru>\nTested-by: Slava Kardakov <ojab@ojab.ru>\nSigned-off-by: Heiner Kallweit <hkallweit1@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/cd59b55080f5fa48a9cf7049dd3dcccb492a50d7"},{"sha":"9982c6090d7e23782542f919ebbfdb2f72c1c1d1","author":{"name":"Xin Long","email":"ed9bd6f22d2a1e0b1507d3ddc300dc248265d19a@gmail.com"},"message":"sctp: handle two v4 addrs comparison in sctp_inet6_cmp_addr\n\n[ Upstream commit d625329b06e46bd20baf9ee40847d11982569204 ]\n\nSince sctp ipv6 socket also supports v4 addrs, it's possible to\ncompare two v4 addrs in pf v6 .cmp_addr, sctp_inet6_cmp_addr.\n\nHowever after Commit 1071ec9d453a (\"sctp: do not check port in\nsctp_inet6_cmp_addr\"), it no longer calls af1->cmp_addr, which\nin this case is sctp_v4_cmp_addr, but calls __sctp_v6_cmp_addr\nwhere it handles them as two v6 addrs. It would cause a out of\nbounds crash.\n\nsyzbot found this crash when trying to bind two v4 addrs to a\nv6 socket.\n\nThis patch fixes it by adding the process for two v4 addrs in\nsctp_inet6_cmp_addr.\n\nFixes: 1071ec9d453a (\"sctp: do not check port in sctp_inet6_cmp_addr\")\nReported-by: syzbot+cd494c1dd681d4d93ebb@syzkaller.appspotmail.com\nSigned-off-by: Xin Long <lucien.xin@gmail.com>\nAcked-by: Neil Horman <nhorman@tuxdriver.com>\nAcked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/9982c6090d7e23782542f919ebbfdb2f72c1c1d1"},{"sha":"00002fa69ffdfc0038e7277bf9de1662098f85cc","author":{"name":"Xin Long","email":"ed9bd6f22d2a1e0b1507d3ddc300dc248265d19a@gmail.com"},"message":"sctp: use the old asoc when making the cookie-ack chunk in dupcook_d\n\n[ Upstream commit 46e16d4b956867013e0bbd7f2bad206f4aa55752 ]\n\nWhen processing a duplicate cookie-echo chunk, for case 'D', sctp will\nnot process the param from this chunk. It means old asoc has nothing\nto be updated, and the new temp asoc doesn't have the complete info.\n\nSo there's no reason to use the new asoc when creating the cookie-ack\nchunk. Otherwise, like when auth is enabled for cookie-ack, the chunk\ncan not be set with auth, and it will definitely be dropped by peer.\n\nThis issue is there since very beginning, and we fix it by using the\nold asoc instead.\n\nSigned-off-by: Xin Long <lucien.xin@gmail.com>\nAcked-by: Neil Horman <nhorman@tuxdriver.com>\nAcked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/00002fa69ffdfc0038e7277bf9de1662098f85cc"},{"sha":"afad8f840026e7011d58f75a0c2c30772b27ed96","author":{"name":"Michael Chan","email":"3f2e970908f19805ed8a131f8c48f96300c6323e@broadcom.com"},"message":"tg3: Fix vunmap() BUG_ON() triggered from tg3_free_consistent().\n\n[ Upstream commit d89a2adb8bfe6f8949ff389acdb9fa298b6e8e12 ]\n\ntg3_free_consistent() calls dma_free_coherent() to free tp->hw_stats\nunder spinlock and can trigger BUG_ON() in vunmap() because vunmap()\nmay sleep.  Fix it by removing the spinlock and relying on the\nTG3_FLAG_INIT_COMPLETE flag to prevent race conditions between\ntg3_get_stats64() and tg3_free_consistent().  TG3_FLAG_INIT_COMPLETE\nis always cleared under tp->lock before tg3_free_consistent()\nand therefore tg3_get_stats64() can safely access tp->hw_stats\nunder tp->lock if TG3_FLAG_INIT_COMPLETE is set.\n\nFixes: f5992b72ebe0 (\"tg3: Fix race condition in tg3_get_stats64().\")\nReported-by: Zumeng Chen <zumeng.chen@gmail.com>\nSigned-off-by: Michael Chan <michael.chan@broadcom.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/afad8f840026e7011d58f75a0c2c30772b27ed96"},{"sha":"8ff936814817daeefceeb1ce26e80b46439a137d","author":{"name":"Debabrata Banerjee","email":"8416239a43cab9c6f46deec338e1a206a5c77021@akamai.com"},"message":"bonding: do not allow rlb updates to invalid mac\n\n[ Upstream commit 4fa8667ca3989ce14cf66301fa251544fbddbdd0 ]\n\nMake sure multicast, broadcast, and zero mac's cannot be the output of rlb\nupdates, which should all be directed arps. Receive load balancing will be\ncollapsed if any of these happen, as the switch will broadcast.\n\nSigned-off-by: Debabrata Banerjee <dbanerje@akamai.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/8ff936814817daeefceeb1ce26e80b46439a137d"},{"sha":"fc36a2a38f1e87ad0c1d753bbb00bd03ceb75bf1","author":{"name":"Yuchung Cheng","email":"5b5a0a360fa35167ac197fe6359c229fde284cf2@google.com"},"message":"tcp: ignore Fast Open on repair mode\n\n[ Upstream commit 16ae6aa1705299789f71fdea59bfb119c1fbd9c0 ]\n\nThe TCP repair sequence of operation is to first set the socket in\nrepair mode, then inject the TCP stats into the socket with repair\nsocket options, then call connect() to re-activate the socket. The\nconnect syscall simply returns and set state to ESTABLISHED\nmode. As a result Fast Open is meaningless for TCP repair.\n\nHowever allowing sendto() system call with MSG_FASTOPEN flag half-way\nduring the repair operation could unexpectedly cause data to be\nsent, before the operation finishes changing the internal TCP stats\n(e.g. MSS).  This in turn triggers TCP warnings on inconsistent\npacket accounting.\n\nThe fix is to simply disallow Fast Open operation once the socket\nis in the repair mode.\n\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: Yuchung Cheng <ycheng@google.com>\nReviewed-by: Neal Cardwell <ncardwell@google.com>\nReviewed-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/fc36a2a38f1e87ad0c1d753bbb00bd03ceb75bf1"},{"sha":"e0a532d3d4562da65cac8bf74bac3f4190d73a57","author":{"name":"Xin Long","email":"ed9bd6f22d2a1e0b1507d3ddc300dc248265d19a@gmail.com"},"message":"sctp: fix the issue that the cookie-ack with auth can't get processed\n\n[ Upstream commit ce402f044e4e432c296f90eaabb8dbe8f3624391 ]\n\nWhen auth is enabled for cookie-ack chunk, in sctp_inq_pop, sctp\nprocesses auth chunk first, then continues to the next chunk in\nthis packet if chunk_end + chunk_hdr size < skb_tail_pointer().\nOtherwise, it will go to the next packet or discard this chunk.\n\nHowever, it missed the fact that cookie-ack chunk's size is equal\nto chunk_hdr size, which couldn't match that check, and thus this\nchunk would not get processed.\n\nThis patch fixes it by changing the check to chunk_end + chunk_hdr\nsize <= skb_tail_pointer().\n\nFixes: 26b87c788100 (\"net: sctp: fix remote memory pressure from excessive queueing\")\nSigned-off-by: Xin Long <lucien.xin@gmail.com>\nAcked-by: Neil Horman <nhorman@tuxdriver.com>\nAcked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/e0a532d3d4562da65cac8bf74bac3f4190d73a57"},{"sha":"957adaae7d228f5be44ed0e4ea926dc8e3d45caf","author":{"name":"Xin Long","email":"ed9bd6f22d2a1e0b1507d3ddc300dc248265d19a@gmail.com"},"message":"sctp: delay the authentication for the duplicated cookie-echo chunk\n\n[ Upstream commit 59d8d4434f429b4fa8a346fd889058bda427a837 ]\n\nNow sctp only delays the authentication for the normal cookie-echo\nchunk by setting chunk->auth_chunk in sctp_endpoint_bh_rcv(). But\nfor the duplicated one with auth, in sctp_assoc_bh_rcv(), it does\nauthentication first based on the old asoc, which will definitely\nfail due to the different auth info in the old asoc.\n\nThe duplicated cookie-echo chunk will create a new asoc with the\nauth info from this chunk, and the authentication should also be\ndone with the new asoc's auth info for all of the collision 'A',\n'B' and 'D'. Otherwise, the duplicated cookie-echo chunk with auth\nwill never pass the authentication and create the new connection.\n\nThis issue exists since very beginning, and this fix is to make\nsctp_assoc_bh_rcv() follow the way sctp_endpoint_bh_rcv() does\nfor the normal cookie-echo chunk to delay the authentication.\n\nWhile at it, remove the unused params from sctp_sf_authenticate()\nand define sctp_auth_chunk_verify() used for all the places that\ndo the delayed authentication.\n\nv1->v2:\n  fix the typo in changelog as Marcelo noticed.\n\nAcked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>\nSigned-off-by: Xin Long <lucien.xin@gmail.com>\nAcked-by: Neil Horman <nhorman@tuxdriver.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/957adaae7d228f5be44ed0e4ea926dc8e3d45caf"},{"sha":"bea8a671cee74232bbeef3980354cb9b305f6a9f","author":{"name":"Takashi Iwai","email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de"},"message":"ALSA: timer: Call notifier in the same spinlock\n\ncommit f65e0d299807d8a11812845c972493c3f9a18e10 upstream.\n\nsnd_timer_notify1() is called outside the spinlock and it retakes the\nlock after the unlock.  This is rather racy, and it's safer to move\nsnd_timer_notify() call inside the main spinlock.\n\nThe patch also contains a slight refactoring / cleanup of the code.\nNow all start/stop/continue/pause look more symmetric and a bit better\nreadable.\n\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nCc: Ben Hutchings <ben.hutchings@codethink.co.uk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/0ctobot/neutrino_staging/commits/bea8a671cee74232bbeef3980354cb9b305f6a9f"}]}
{"actor":{"display_login":"0ctobot"}}