{"push_id":2447791679,"size":22,"distinct_size":1,"ref":"refs/heads/oneplus/QC8998_O_8.0","head":"9cccfa981b7924fb7b56458f01c9efad5e64c140","before":"5696851f8f32e12293c5785a39624b6552d6ae33","commits":[{"sha":"cf7a1cf58580521e17ce882d3bb04308ccd6b04a","author":{"name":"Johannes Thumshirn","email":"d9c2033816690d520874e8fc0d5751e487468597@suse.de"},"message":"scsi: sg: don't return bogus Sg_requests\n\ncommit 48ae8484e9fc324b4968d33c585e54bc98e44d61 upstream.\n\nIf the list search in sg_get_rq_mark() fails to find a valid request, we\nreturn a bogus element. This then can later lead to a GPF in\nsg_remove_scat().\n\nSo don't return bogus Sg_requests in sg_get_rq_mark() but NULL in case\nthe list search doesn't find a valid request.\n\nSigned-off-by: Johannes Thumshirn <jthumshirn@suse.de>\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nCc: Hannes Reinecke <hare@suse.de>\nCc: Christoph Hellwig <hch@lst.de>\nCc: Doug Gilbert <dgilbert@interlog.com>\nReviewed-by: Hannes Reinecke <hare@suse.de>\nAcked-by: Doug Gilbert <dgilbert@interlog.com>\nSigned-off-by: Martin K. Petersen <martin.petersen@oracle.com>\nCc: Tony Battersby <tonyb@cybernetics.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/cf7a1cf58580521e17ce882d3bb04308ccd6b04a"},{"sha":"6f879697d6393aa6918537c4c46e44c8579dd2a1","author":{"name":"Greg Kroah-Hartman","email":"4931344b09d7a7d3573e8b1ebec918e229ead9bf@linuxfoundation.org"},"message":"Revert \"genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs\"\n\nThis reverts commit 9d0273bb1c4b645817eccfe5c5975ea29add3300 which is\ncommit 382bd4de61827dbaaf5fb4fb7b1f4be4a86505e7 upstream.\n\nIt causes too many problems with the stable tree, and would require too\nmany other things to be backported, so just revert it.\n\nReported-by: Guenter Roeck <linux@roeck-us.net>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Hans de Goede <hdegoede@redhat.com>\nCc: Marc Zyngier <marc.zyngier@arm.com>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/6f879697d6393aa6918537c4c46e44c8579dd2a1"},{"sha":"51b4111f7212d488cb081e287396c369dd20cb9c","author":{"name":"Kirill Tkhai","email":"d13947db9d9913cf8285f84b7d54ebf76b2f1bbe@virtuozzo.com"},"message":"net: Fix hlist corruptions in inet_evict_bucket()\n\n\n[ Upstream commit a560002437d3646dafccecb1bf32d1685112ddda ]\n\ninet_evict_bucket() iterates global list, and\nseveral tasks may call it in parallel. All of\nthem hash the same fq->list_evictor to different\nlists, which leads to list corruption.\n\nThis patch makes fq be hashed to expired list\nonly if this has not been made yet by another\ntask. Since inet_frag_alloc() allocates fq\nusing kmem_cache_zalloc(), we may rely on\nlist_evictor is initially unhashed.\n\nThe problem seems to exist before async\npernet_operations, as there was possible to have\nexit method to be executed in parallel with\ninet_frags::frags_work, so I add two Fixes tags.\nThis also may go to stable.\n\nFixes: d1fe19444d82 \"inet: frag: don't re-use chainlist for evictor\"\nFixes: f84c6821aa54 \"net: Convert pernet_subsys, registered from inet_init()\"\nSigned-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/51b4111f7212d488cb081e287396c369dd20cb9c"},{"sha":"de31c391673aeb2c1d09552ac75a6b7ee96d65ac","author":{"name":"Alexey Kodanev","email":"9f3808f0a12da1be5378a18211ea35dc74f98ef4@oracle.com"},"message":"dccp: check sk for closed state in dccp_sendmsg()\n\n\n[ Upstream commit 67f93df79aeefc3add4e4b31a752600f834236e2 ]\n\ndccp_disconnect() sets 'dp->dccps_hc_tx_ccid' tx handler to NULL,\ntherefore if DCCP socket is disconnected and dccp_sendmsg() is\ncalled after it, it will cause a NULL pointer dereference in\ndccp_write_xmit().\n\nThis crash and the reproducer was reported by syzbot. Looks like\nit is reproduced if commit 69c64866ce07 (\"dccp: CVE-2017-8824:\nuse-after-free in DCCP code\") is applied.\n\nReported-by: syzbot+f99ab3887ab65d70f816@syzkaller.appspotmail.com\nSigned-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/de31c391673aeb2c1d09552ac75a6b7ee96d65ac"},{"sha":"466c797f1f73f86fe1c28d81cab45d74e8f44cb6","author":{"name":"Lorenzo Bianconi","email":"3d2946b2d0a157a9e7d63368d3bb0db4e4dd16ba@redhat.com"},"message":"ipv6: fix access to non-linear packet in ndisc_fill_redirect_hdr_option()\n\n\n[ Upstream commit 9f62c15f28b0d1d746734666d88a79f08ba1e43e ]\n\nFix the following slab-out-of-bounds kasan report in\nndisc_fill_redirect_hdr_option when the incoming ipv6 packet is not\nlinear and the accessed data are not in the linear data region of orig_skb.\n\n[ 1503.122508] ==================================================================\n[ 1503.122832] BUG: KASAN: slab-out-of-bounds in ndisc_send_redirect+0x94e/0x990\n[ 1503.123036] Read of size 1184 at addr ffff8800298ab6b0 by task netperf/1932\n\n[ 1503.123220] CPU: 0 PID: 1932 Comm: netperf Not tainted 4.16.0-rc2+ #124\n[ 1503.123347] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.10.2-2.fc27 04/01/2014\n[ 1503.123527] Call Trace:\n[ 1503.123579]  <IRQ>\n[ 1503.123638]  print_address_description+0x6e/0x280\n[ 1503.123849]  kasan_report+0x233/0x350\n[ 1503.123946]  memcpy+0x1f/0x50\n[ 1503.124037]  ndisc_send_redirect+0x94e/0x990\n[ 1503.125150]  ip6_forward+0x1242/0x13b0\n[...]\n[ 1503.153890] Allocated by task 1932:\n[ 1503.153982]  kasan_kmalloc+0x9f/0xd0\n[ 1503.154074]  __kmalloc_track_caller+0xb5/0x160\n[ 1503.154198]  __kmalloc_reserve.isra.41+0x24/0x70\n[ 1503.154324]  __alloc_skb+0x130/0x3e0\n[ 1503.154415]  sctp_packet_transmit+0x21a/0x1810\n[ 1503.154533]  sctp_outq_flush+0xc14/0x1db0\n[ 1503.154624]  sctp_do_sm+0x34e/0x2740\n[ 1503.154715]  sctp_primitive_SEND+0x57/0x70\n[ 1503.154807]  sctp_sendmsg+0xaa6/0x1b10\n[ 1503.154897]  sock_sendmsg+0x68/0x80\n[ 1503.154987]  ___sys_sendmsg+0x431/0x4b0\n[ 1503.155078]  __sys_sendmsg+0xa4/0x130\n[ 1503.155168]  do_syscall_64+0x171/0x3f0\n[ 1503.155259]  entry_SYSCALL_64_after_hwframe+0x42/0xb7\n\n[ 1503.155436] Freed by task 1932:\n[ 1503.155527]  __kasan_slab_free+0x134/0x180\n[ 1503.155618]  kfree+0xbc/0x180\n[ 1503.155709]  skb_release_data+0x27f/0x2c0\n[ 1503.155800]  consume_skb+0x94/0xe0\n[ 1503.155889]  sctp_chunk_put+0x1aa/0x1f0\n[ 1503.155979]  sctp_inq_pop+0x2f8/0x6e0\n[ 1503.156070]  sctp_assoc_bh_rcv+0x6a/0x230\n[ 1503.156164]  sctp_inq_push+0x117/0x150\n[ 1503.156255]  sctp_backlog_rcv+0xdf/0x4a0\n[ 1503.156346]  __release_sock+0x142/0x250\n[ 1503.156436]  release_sock+0x80/0x180\n[ 1503.156526]  sctp_sendmsg+0xbb0/0x1b10\n[ 1503.156617]  sock_sendmsg+0x68/0x80\n[ 1503.156708]  ___sys_sendmsg+0x431/0x4b0\n[ 1503.156799]  __sys_sendmsg+0xa4/0x130\n[ 1503.156889]  do_syscall_64+0x171/0x3f0\n[ 1503.156980]  entry_SYSCALL_64_after_hwframe+0x42/0xb7\n\n[ 1503.157158] The buggy address belongs to the object at ffff8800298ab600\n                which belongs to the cache kmalloc-1024 of size 1024\n[ 1503.157444] The buggy address is located 176 bytes inside of\n                1024-byte region [ffff8800298ab600, ffff8800298aba00)\n[ 1503.157702] The buggy address belongs to the page:\n[ 1503.157820] page:ffffea0000a62a00 count:1 mapcount:0 mapping:0000000000000000 index:0x0 compound_mapcount: 0\n[ 1503.158053] flags: 0x4000000000008100(slab|head)\n[ 1503.158171] raw: 4000000000008100 0000000000000000 0000000000000000 00000001800e000e\n[ 1503.158350] raw: dead000000000100 dead000000000200 ffff880036002600 0000000000000000\n[ 1503.158523] page dumped because: kasan: bad access detected\n\n[ 1503.158698] Memory state around the buggy address:\n[ 1503.158816]  ffff8800298ab900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[ 1503.158988]  ffff8800298ab980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[ 1503.159165] >ffff8800298aba00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 1503.159338]                    ^\n[ 1503.159436]  ffff8800298aba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n[ 1503.159610]  ffff8800298abb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n[ 1503.159785] ==================================================================\n[ 1503.159964] Disabling lock debugging due to kernel taint\n\nThe test scenario to trigger the issue consists of 4 devices:\n- H0: data sender, connected to LAN0\n- H1: data receiver, connected to LAN1\n- GW0 and GW1: routers between LAN0 and LAN1. Both of them have an\n  ethernet connection on LAN0 and LAN1\nOn H{0,1} set GW0 as default gateway while on GW0 set GW1 as next hop for\ndata from LAN0 to LAN1.\nMoreover create an ip6ip6 tunnel between H0 and H1 and send 3 concurrent\ndata streams (TCP/UDP/SCTP) from H0 to H1 through ip6ip6 tunnel (send\nbuffer size is set to 16K). While data streams are active flush the route\ncache on HA multiple times.\nI have not been able to identify a given commit that introduced the issue\nsince, using the reproducer described above, the kasan report has been\ntriggered from 4.14 and I have not gone back further.\n\nReported-by: Jianlin Shi <jishi@redhat.com>\nReviewed-by: Stefano Brivio <sbrivio@redhat.com>\nReviewed-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/466c797f1f73f86fe1c28d81cab45d74e8f44cb6"},{"sha":"bdb1a295ee5897b938b0decf360236e40bbe3a1c","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"l2tp: do not accept arbitrary sockets\n\n\n[ Upstream commit 17cfe79a65f98abe535261856c5aef14f306dff7 ]\n\nsyzkaller found an issue caused by lack of sufficient checks\nin l2tp_tunnel_create()\n\nRAW sockets can not be considered as UDP ones for instance.\n\nIn another patch, we shall replace all pr_err() by less intrusive\npr_debug() so that syzkaller can find other bugs faster.\nAcked-by: Guillaume Nault <g.nault@alphalink.fr>\nAcked-by: James Chapman <jchapman@katalix.com>\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in setup_udp_tunnel_sock+0x3ee/0x5f0 net/ipv4/udp_tunnel.c:69\ndst_release: dst:00000000d53d0d0f refcnt:-1\nWrite of size 1 at addr ffff8801d013b798 by task syz-executor3/6242\n\nCPU: 1 PID: 6242 Comm: syz-executor3 Not tainted 4.16.0-rc2+ #253\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:17 [inline]\n dump_stack+0x194/0x24d lib/dump_stack.c:53\n print_address_description+0x73/0x250 mm/kasan/report.c:256\n kasan_report_error mm/kasan/report.c:354 [inline]\n kasan_report+0x23b/0x360 mm/kasan/report.c:412\n __asan_report_store1_noabort+0x17/0x20 mm/kasan/report.c:435\n setup_udp_tunnel_sock+0x3ee/0x5f0 net/ipv4/udp_tunnel.c:69\n l2tp_tunnel_create+0x1354/0x17f0 net/l2tp/l2tp_core.c:1596\n pppol2tp_connect+0x14b1/0x1dd0 net/l2tp/l2tp_ppp.c:707\n SYSC_connect+0x213/0x4a0 net/socket.c:1640\n SyS_connect+0x24/0x30 net/socket.c:1621\n do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x42/0xb7\n\nFixes: fd558d186df2 (\"l2tp: Split pppol2tp patch into separate l2tp and ppp parts\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/bdb1a295ee5897b938b0decf360236e40bbe3a1c"},{"sha":"527f39d8cdc566d9c0703d88fbebbaeafc4e598f","author":{"name":"Christophe JAILLET","email":"37dad06b5adae86647eb31988fda7e3e669b78d5@wanadoo.fr"},"message":"net: ethernet: arc: Fix a potential memory leak if an optional regulator is deferred\n\n\n[ Upstream commit 00777fac28ba3e126b9e63e789a613e8bd2cab25 ]\n\nIf the optional regulator is deferred, we must release some resources.\nThey will be re-allocated when the probe function will be called again.\n\nFixes: 6eacf31139bf (\"ethernet: arc: Add support for Rockchip SoC layer device tree bindings\")\nSigned-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/527f39d8cdc566d9c0703d88fbebbaeafc4e598f"},{"sha":"c24c42114df3544c26f6a6cf4dba349e62758014","author":{"name":"SZ Lin (林上智)","email":"6e8cfbad74ccaa75b0176c009f1ae803aba8f8b3@moxa.com"},"message":"net: ethernet: ti: cpsw: add check for in-band mode setting with RGMII PHY interface\n\n\n[ Upstream commit f9db50691db4a7d860fce985f080bb3fc23a7ede ]\n\nAccording to AM335x TRM[1] 14.3.6.2, AM437x TRM[2] 15.3.6.2 and\nDRA7 TRM[3] 24.11.4.8.7.3.3, in-band mode in EXT_EN(bit18) register is only\navailable when PHY is configured in RGMII mode with 10Mbps speed. It will\ncause some networking issues without RGMII mode, such as carrier sense\nerrors and low throughput. TI also mentioned this issue in their forum[4].\n\nThis patch adds the check mechanism for PHY interface with RGMII interface\ntype, the in-band mode can only be set in RGMII mode with 10Mbps speed.\n\nReferences:\n[1]: https://www.ti.com/lit/ug/spruh73p/spruh73p.pdf\n[2]: http://www.ti.com/lit/ug/spruhl7h/spruhl7h.pdf\n[3]: http://www.ti.com/lit/ug/spruic2b/spruic2b.pdf\n[4]: https://e2e.ti.com/support/arm/sitara_arm/f/791/p/640765/2392155\n\nSuggested-by: Holsety Chen (陳憲輝) <Holsety.Chen@moxa.com>\nSigned-off-by: SZ Lin (林上智) <sz.lin@moxa.com>\nSigned-off-by: Schuyler Patton <spatton@ti.com>\nReviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/c24c42114df3544c26f6a6cf4dba349e62758014"},{"sha":"800c5054a3742b00f1dc0f244a33e0c2f7035b88","author":{"name":"Arvind Yadav","email":"1650c5a66df99aba40094ad382bcfb9e3d7811e6@gmail.com"},"message":"net/iucv: Free memory obtained by kzalloc\n\n\n[ Upstream commit fa6a91e9b907231d2e38ea5ed89c537b3525df3d ]\n\nFree memory by calling put_device(), if afiucv_iucv_init is not\nsuccessful.\n\nSigned-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>\nReviewed-by: Cornelia Huck <cohuck@redhat.com>\nSigned-off-by: Ursula Braun <ursula.braun@de.ibm.com>\nSigned-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/800c5054a3742b00f1dc0f244a33e0c2f7035b88"},{"sha":"335079e853133da6d757cef1db084981a615e533","author":{"name":"Nicolas Dichtel","email":"6738a2db8b42127254341bdb65a9775d52a2feaa@6wind.com"},"message":"netlink: avoid a double skb free in genlmsg_mcast()\n\n\n[ Upstream commit 02a2385f37a7c6594c9d89b64c4a1451276f08eb ]\n\nnlmsg_multicast() consumes always the skb, thus the original skb must be\nfreed only when this function is called with a clone.\n\nFixes: cb9f7a9a5c96 (\"netlink: ensure to loop over all netns in genlmsg_multicast_allns()\")\nReported-by: Ben Hutchings <ben.hutchings@codethink.co.uk>\nSigned-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/335079e853133da6d757cef1db084981a615e533"},{"sha":"e582bbb7b4f0932c3289fe6fe63d7f5ed1822af9","author":{"name":"David Ahern","email":"e0d419a0ba2bdeef0ad5e59f7813befeb3252a55@gmail.com"},"message":"net: Only honor ifindex in IP_PKTINFO if non-0\n\n\n[ Upstream commit 2cbb4ea7de167b02ffa63e9cdfdb07a7e7094615 ]\n\nOnly allow ifindex from IP_PKTINFO to override SO_BINDTODEVICE settings\nif the index is actually set in the message.\n\nSigned-off-by: David Ahern <dsahern@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/e582bbb7b4f0932c3289fe6fe63d7f5ed1822af9"},{"sha":"32b36066cddf491d0d282c875ec5f538e782412d","author":{"name":"Vinicius Costa Gomes","email":"270ace918b410501ccb97667872574d4c4f6f019@intel.com"},"message":"skbuff: Fix not waking applications when errors are enqueued\n\n\n[ Upstream commit 6e5d58fdc9bedd0255a8781b258f10bbdc63e975 ]\n\nWhen errors are enqueued to the error queue via sock_queue_err_skb()\nfunction, it is possible that the waiting application is not notified.\n\nCalling 'sk->sk_data_ready()' would not notify applications that\nselected only POLLERR events in poll() (for example).\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Randy E. Witt <randy.e.witt@intel.com>\nReviewed-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/32b36066cddf491d0d282c875ec5f538e782412d"},{"sha":"24b90c696f9793501140892802a9e564e9330b4e","author":{"name":"Arkadi Sharshevsky","email":"5d72bf432060a410169d32b3c28a3855cf117654@mellanox.com"},"message":"team: Fix double free in error path\n\n\n[ Upstream commit cbcc607e18422555db569b593608aec26111cb0b ]\n\nThe __send_and_alloc_skb() receives a skb ptr as a parameter but in\ncase it fails the skb is not valid:\n- Send failed and released the skb internally.\n- Allocation failed.\n\nThe current code tries to release the skb in case of failure which\ncauses redundant freeing.\n\nFixes: 9b00cf2d1024 (\"team: implement multipart netlink messages for options transfers\")\nSigned-off-by: Arkadi Sharshevsky <arkadis@mellanox.com>\nAcked-by: Jiri Pirko <jiri@mellanox.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/24b90c696f9793501140892802a9e564e9330b4e"},{"sha":"a45300dd7dc58adaa3a2046f145445c7b4157a4d","author":{"name":"Julian Wiedmann","email":"174a9fc5b810c717cf9467d55c8d87e214886168@linux.vnet.ibm.com"},"message":"s390/qeth: free netdevice when removing a card\n\n\n[ Upstream commit 6be687395b3124f002a653c1a50b3260222b3cd7 ]\n\nOn removal, a qeth card's netdevice is currently not properly freed\nbecause the call chain looks as follows:\n\nqeth_core_remove_device(card)\n\tlx_remove_device(card)\n\t\tunregister_netdev(card->dev)\n\t\tcard->dev = NULL\t\t\t!!!\n\tqeth_core_free_card(card)\n\t\tif (card->dev)\t\t\t\t!!!\n\t\t\tfree_netdev(card->dev)\n\nFix it by free'ing the netdev straight after unregistering. This also\nfixes the sysfs-driven layer switch case (qeth_dev_layer2_store()),\nwhere the need to free the current netdevice was not considered at all.\n\nNote that free_netdev() takes care of the netif_napi_del() for us too.\n\nFixes: 4a71df50047f (\"qeth: new qeth device driver\")\nSigned-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>\nReviewed-by: Ursula Braun <ubraun@linux.vnet.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/a45300dd7dc58adaa3a2046f145445c7b4157a4d"},{"sha":"f9b4ec9fb686daa1d312b16b5bf50a6f760e93b8","author":{"name":"Julian Wiedmann","email":"174a9fc5b810c717cf9467d55c8d87e214886168@linux.vnet.ibm.com"},"message":"s390/qeth: when thread completes, wake up all waiters\n\n\n[ Upstream commit 1063e432bb45be209427ed3f1ca3908e4aa3c7d7 ]\n\nqeth_wait_for_threads() is potentially called by multiple users, make\nsure to notify all of them after qeth_clear_thread_running_bit()\nadjusted the thread_running_mask. With no timeout, callers would\notherwise stall.\n\nSigned-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/f9b4ec9fb686daa1d312b16b5bf50a6f760e93b8"},{"sha":"e960fa03f95d68400af2a32808cc43072005ff53","author":{"name":"Julian Wiedmann","email":"174a9fc5b810c717cf9467d55c8d87e214886168@linux.vnet.ibm.com"},"message":"s390/qeth: lock read device while queueing next buffer\n\n\n[ Upstream commit 17bf8c9b3d499d5168537c98b61eb7a1fcbca6c2 ]\n\nFor calling ccw_device_start(), issue_next_read() needs to hold the\ndevice's ccwlock.\nThis is satisfied for the IRQ handler path (where qeth_irq() gets called\nunder the ccwlock), but we need explicit locking for the initial call by\nthe MPC initialization.\n\nSigned-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/e960fa03f95d68400af2a32808cc43072005ff53"},{"sha":"bd01dd8b1036a6d55247e0a04a09e376c6d4bd9a","author":{"name":"Julian Wiedmann","email":"174a9fc5b810c717cf9467d55c8d87e214886168@linux.vnet.ibm.com"},"message":"s390/qeth: on channel error, reject further cmd requests\n\n\n[ Upstream commit a6c3d93963e4b333c764fde69802c3ea9eaa9d5c ]\n\nWhen the IRQ handler determines that one of the cmd IO channels has\nfailed and schedules recovery, block any further cmd requests from\nbeing submitted. The request would inevitably stall, and prevent the\nrecovery from making progress until the request times out.\n\nThis sort of error was observed after Live Guest Relocation, where\nthe pending IO on the READ channel intentionally gets terminated to\nkick-start recovery. Simultaneously the guest executed SIOCETHTOOL,\ntriggering qeth to issue a QUERY CARD INFO command. The command\nthen stalled in the inoperabel WRITE channel.\n\nSigned-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/bd01dd8b1036a6d55247e0a04a09e376c6d4bd9a"},{"sha":"41462e8f610c3b0056e89fbc2a2d1b37416466aa","author":{"name":"Eric Dumazet","email":"b3d77ad2db30f558882cc0c038be5a3cf96611f9@google.com"},"message":"ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()\n\n\n[ Upstream commit ca0edb131bdf1e6beaeb2b8289fd6b374b74147d ]\n\nA tun device type can trivially be set to arbitrary value using\nTUNSETLINK ioctl().\n\nTherefore, lowpan_device_event() must really check that ieee802154_ptr\nis not NULL.\n\nFixes: 2c88b5283f60d (\"ieee802154: 6lowpan: remove check on null\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Alexander Aring <alex.aring@gmail.com>\nCc: Stefan Schmidt <stefan@osg.samsung.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nAcked-by: Stefan Schmidt <stefan@osg.samsung.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/41462e8f610c3b0056e89fbc2a2d1b37416466aa"},{"sha":"5ebbc4521c15caa6a36a8df01d0642b58130df95","author":{"name":"Florian Fainelli","email":"244da8ca84c0b82369d8dd3f15015e61f28f6fe5@gmail.com"},"message":"net: fec: Fix unbalanced PM runtime calls\n\n\n[ Upstream commit a069215cf5985f3aa1bba550264907d6bd05c5f7 ]\n\nWhen unbinding/removing the driver, we will run into the following warnings:\n\n[  259.655198] fec 400d1000.ethernet: 400d1000.ethernet supply phy not found, using dummy regulator\n[  259.665065] fec 400d1000.ethernet: Unbalanced pm_runtime_enable!\n[  259.672770] fec 400d1000.ethernet (unnamed net_device) (uninitialized): Invalid MAC address: 00:00:00:00:00:00\n[  259.683062] fec 400d1000.ethernet (unnamed net_device) (uninitialized): Using random MAC address: f2:3e:93:b7:29:c1\n[  259.696239] libphy: fec_enet_mii_bus: probed\n\nAvoid these warnings by balancing the runtime PM calls during fec_drv_remove().\n\nSigned-off-by: Florian Fainelli <f.fainelli@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/5ebbc4521c15caa6a36a8df01d0642b58130df95"},{"sha":"cff88ba2a0935294a23f3f6c94960e2c2e79d66b","author":{"name":"Florian Fainelli","email":"244da8ca84c0b82369d8dd3f15015e61f28f6fe5@gmail.com"},"message":"net: systemport: Rewrite __bcm_sysport_tx_reclaim()\n\n\n[ Upstream commit 484d802d0f2f29c335563fcac2a8facf174a1bbc ]\n\nThere is no need for complex checking between the last consumed index\nand current consumed index, a simple subtraction will do.\n\nThis also eliminates the possibility of a permanent transmit queue stall\nunder the following conditions:\n\n- one CPU bursts ring->size worth of traffic (up to 256 buffers), to the\n  point where we run out of free descriptors, so we stop the transmit\n  queue at the end of bcm_sysport_xmit()\n\n- because of our locking, we have the transmit process disable\n  interrupts which means we can be blocking the TX reclamation process\n\n- when TX reclamation finally runs, we will be computing the difference\n  between ring->c_index (last consumed index by SW) and what the HW\n  reports through its register\n\n- this register is masked with (ring->size - 1) = 0xff, which will lead\n  to stripping the upper bits of the index (register is 16-bits wide)\n\n- we will be computing last_tx_cn as 0, which means there is no work to\n  be done, and we never wake-up the transmit queue, leaving it\n  permanently disabled\n\nA practical example is e.g: ring->c_index aka last_c_index = 12, we\npushed 256 entries, HW consumer index = 268, we mask it with 0xff = 12,\nso last_tx_cn == 0, nothing happens.\n\nFixes: 80105befdb4b (\"net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver\")\nSigned-off-by: Florian Fainelli <f.fainelli@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/android-linux-stable/op5/commits/cff88ba2a0935294a23f3f6c94960e2c2e79d66b"}]}
{"actor":{"display_login":"nathanchance"}}