{"push_id":2975447151,"size":111,"distinct_size":1,"ref":"refs/heads/aosp-common/android-4.14","head":"0ff0788d6a6663c683c687695409af26d06ba369","before":"6d46bcc5a74730c0a90682289d56f3fc60e8a798","commits":[{"sha":"67d1ee6c7b76f1b1de9c6e217df8ee5894902aaf","author":{"name":"Michael Chan","email":"3f2e970908f19805ed8a131f8c48f96300c6323e@broadcom.com"},"message":"bnxt_en: Fix TX timeout during netpoll.\n\n[ Upstream commit 73f21c653f930f438d53eed29b5e4c65c8a0f906 ]\n\nThe current netpoll implementation in the bnxt_en driver has problems\nthat may miss TX completion events.  bnxt_poll_work() in effect is\nonly handling at most 1 TX packet before exiting.  In addition,\nthere may be in flight TX completions that ->poll() may miss even\nafter we fix bnxt_poll_work() to handle all visible TX completions.\nnetpoll may not call ->poll() again and HW may not generate IRQ\nbecause the driver does not ARM the IRQ when the budget (0 for netpoll)\nis reached.\n\nWe fix it by handling all TX completions and to always ARM the IRQ\nwhen we exit ->poll() with 0 budget.\n\nAlso, the logic to ACK the completion ring in case it is almost filled\nwith TX completions need to be adjusted to take care of the 0 budget\ncase, as discussed with Eric Dumazet <edumazet@google.com>\n\nReported-by: Song Liu <songliubraving@fb.com>\nReviewed-by: Song Liu <songliubraving@fb.com>\nTested-by: Song Liu <songliubraving@fb.com>\nSigned-off-by: Michael Chan <michael.chan@broadcom.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/67d1ee6c7b76f1b1de9c6e217df8ee5894902aaf"},{"sha":"e73b51a995ac55aa207b693dc6830784efa6c41c","author":{"name":"Venkat Duvvuru","email":"48b8ea0e77f20d44c3ea07c37bda62dfebd795d9@broadcom.com"},"message":"bnxt_en: free hwrm resources, if driver probe fails.\n\n[ Upstream commit a2bf74f4e1b82395dad2b08d2a911d9151db71c1 ]\n\nWhen the driver probe fails, all the resources that were allocated prior\nto the failure must be freed. However, hwrm dma response memory is not\ngetting freed.\n\nThis patch fixes the problem described above.\n\nFixes: c0c050c58d84 (\"bnxt_en: New Broadcom ethernet driver.\")\nSigned-off-by: Venkat Duvvuru <venkatkumar.duvvuru@broadcom.com>\nSigned-off-by: Michael Chan <michael.chan@broadcom.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/e73b51a995ac55aa207b693dc6830784efa6c41c"},{"sha":"94402f23659fa9005776a1500f61953c825c3420","author":{"name":"Mahesh Bandewar","email":"e1eb0c20b48013d29bfb9c87ceffd3fac35d1e96@google.com"},"message":"bonding: avoid possible dead-lock\n\n[ Upstream commit d4859d749aa7090ffb743d15648adb962a1baeae ]\n\nSyzkaller reported this on a slightly older kernel but it's still\napplicable to the current kernel -\n\n======================================================\nWARNING: possible circular locking dependency detected\n4.18.0-next-20180823+ #46 Not tainted\n------------------------------------------------------\nsyz-executor4/26841 is trying to acquire lock:\n00000000dd41ef48 ((wq_completion)bond_dev->name){+.+.}, at: flush_workqueue+0x2db/0x1e10 kernel/workqueue.c:2652\n\nbut task is already holding lock:\n00000000768ab431 (rtnl_mutex){+.+.}, at: rtnl_lock net/core/rtnetlink.c:77 [inline]\n00000000768ab431 (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x412/0xc30 net/core/rtnetlink.c:4708\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-> #2 (rtnl_mutex){+.+.}:\n       __mutex_lock_common kernel/locking/mutex.c:925 [inline]\n       __mutex_lock+0x171/0x1700 kernel/locking/mutex.c:1073\n       mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1088\n       rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77\n       bond_netdev_notify drivers/net/bonding/bond_main.c:1310 [inline]\n       bond_netdev_notify_work+0x44/0xd0 drivers/net/bonding/bond_main.c:1320\n       process_one_work+0xc73/0x1aa0 kernel/workqueue.c:2153\n       worker_thread+0x189/0x13c0 kernel/workqueue.c:2296\n       kthread+0x35a/0x420 kernel/kthread.c:246\n       ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415\n\n-> #1 ((work_completion)(&(&nnw->work)->work)){+.+.}:\n       process_one_work+0xc0b/0x1aa0 kernel/workqueue.c:2129\n       worker_thread+0x189/0x13c0 kernel/workqueue.c:2296\n       kthread+0x35a/0x420 kernel/kthread.c:246\n       ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415\n\n-> #0 ((wq_completion)bond_dev->name){+.+.}:\n       lock_acquire+0x1e4/0x4f0 kernel/locking/lockdep.c:3901\n       flush_workqueue+0x30a/0x1e10 kernel/workqueue.c:2655\n       drain_workqueue+0x2a9/0x640 kernel/workqueue.c:2820\n       destroy_workqueue+0xc6/0x9d0 kernel/workqueue.c:4155\n       __alloc_workqueue_key+0xef9/0x1190 kernel/workqueue.c:4138\n       bond_init+0x269/0x940 drivers/net/bonding/bond_main.c:4734\n       register_netdevice+0x337/0x1100 net/core/dev.c:8410\n       bond_newlink+0x49/0xa0 drivers/net/bonding/bond_netlink.c:453\n       rtnl_newlink+0xef4/0x1d50 net/core/rtnetlink.c:3099\n       rtnetlink_rcv_msg+0x46e/0xc30 net/core/rtnetlink.c:4711\n       netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2454\n       rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4729\n       netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]\n       netlink_unicast+0x5a0/0x760 net/netlink/af_netlink.c:1343\n       netlink_sendmsg+0xa18/0xfc0 net/netlink/af_netlink.c:1908\n       sock_sendmsg_nosec net/socket.c:622 [inline]\n       sock_sendmsg+0xd5/0x120 net/socket.c:632\n       ___sys_sendmsg+0x7fd/0x930 net/socket.c:2115\n       __sys_sendmsg+0x11d/0x290 net/socket.c:2153\n       __do_sys_sendmsg net/socket.c:2162 [inline]\n       __se_sys_sendmsg net/socket.c:2160 [inline]\n       __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2160\n       do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290\n       entry_SYSCALL_64_after_hwframe+0x49/0xbe\n\nother info that might help us debug this:\n\nChain exists of:\n  (wq_completion)bond_dev->name --> (work_completion)(&(&nnw->work)->work) --> rtnl_mutex\n\n Possible unsafe locking scenario:\n\n       CPU0                    CPU1\n       ----                    ----\n  lock(rtnl_mutex);\n                               lock((work_completion)(&(&nnw->work)->work));\n                               lock(rtnl_mutex);\n  lock((wq_completion)bond_dev->name);\n\n *** DEADLOCK ***\n\n1 lock held by syz-executor4/26841:\n\nstack backtrace:\nCPU: 1 PID: 26841 Comm: syz-executor4 Not tainted 4.18.0-next-20180823+ #46\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113\n print_circular_bug.isra.34.cold.55+0x1bd/0x27d kernel/locking/lockdep.c:1222\n check_prev_add kernel/locking/lockdep.c:1862 [inline]\n check_prevs_add kernel/locking/lockdep.c:1975 [inline]\n validate_chain kernel/locking/lockdep.c:2416 [inline]\n __lock_acquire+0x3449/0x5020 kernel/locking/lockdep.c:3412\n lock_acquire+0x1e4/0x4f0 kernel/locking/lockdep.c:3901\n flush_workqueue+0x30a/0x1e10 kernel/workqueue.c:2655\n drain_workqueue+0x2a9/0x640 kernel/workqueue.c:2820\n destroy_workqueue+0xc6/0x9d0 kernel/workqueue.c:4155\n __alloc_workqueue_key+0xef9/0x1190 kernel/workqueue.c:4138\n bond_init+0x269/0x940 drivers/net/bonding/bond_main.c:4734\n register_netdevice+0x337/0x1100 net/core/dev.c:8410\n bond_newlink+0x49/0xa0 drivers/net/bonding/bond_netlink.c:453\n rtnl_newlink+0xef4/0x1d50 net/core/rtnetlink.c:3099\n rtnetlink_rcv_msg+0x46e/0xc30 net/core/rtnetlink.c:4711\n netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2454\n rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4729\n netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]\n netlink_unicast+0x5a0/0x760 net/netlink/af_netlink.c:1343\n netlink_sendmsg+0xa18/0xfc0 net/netlink/af_netlink.c:1908\n sock_sendmsg_nosec net/socket.c:622 [inline]\n sock_sendmsg+0xd5/0x120 net/socket.c:632\n ___sys_sendmsg+0x7fd/0x930 net/socket.c:2115\n __sys_sendmsg+0x11d/0x290 net/socket.c:2153\n __do_sys_sendmsg net/socket.c:2162 [inline]\n __se_sys_sendmsg net/socket.c:2160 [inline]\n __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2160\n do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\nRIP: 0033:0x457089\nCode: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00\nRSP: 002b:00007f2df20a5c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f2df20a66d4 RCX: 0000000000457089\nRDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000003\nRBP: 0000000000930140 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff\nR13: 00000000004d40b8 R14: 00000000004c8ad8 R15: 0000000000000001\n\nSigned-off-by: Mahesh Bandewar <maheshb@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/94402f23659fa9005776a1500f61953c825c3420"},{"sha":"18bf9a724362a3feff649f529178f49b11e877e4","author":{"name":"Paolo Abeni","email":"6e4ffc2e3438feb7acb34f6b67e6ae17e700099c@redhat.com"},"message":"ip6_tunnel: be careful when accessing the inner header\n\n[ Upstream commit 76c0ddd8c3a683f6e2c6e60e11dc1a1558caf4bc ]\n\nthe ip6 tunnel xmit ndo assumes that the processed skb always\ncontains an ip[v6] header, but syzbot has found a way to send\nframes that fall short of this assumption, leading to the following splat:\n\nBUG: KMSAN: uninit-value in ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1307\n[inline]\nBUG: KMSAN: uninit-value in ip6_tnl_start_xmit+0x7d2/0x1ef0\nnet/ipv6/ip6_tunnel.c:1390\nCPU: 0 PID: 4504 Comm: syz-executor558 Not tainted 4.16.0+ #87\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS\nGoogle 01/01/2011\nCall Trace:\n  __dump_stack lib/dump_stack.c:17 [inline]\n  dump_stack+0x185/0x1d0 lib/dump_stack.c:53\n  kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067\n  __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683\n  ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1307 [inline]\n  ip6_tnl_start_xmit+0x7d2/0x1ef0 net/ipv6/ip6_tunnel.c:1390\n  __netdev_start_xmit include/linux/netdevice.h:4066 [inline]\n  netdev_start_xmit include/linux/netdevice.h:4075 [inline]\n  xmit_one net/core/dev.c:3026 [inline]\n  dev_hard_start_xmit+0x5f1/0xc70 net/core/dev.c:3042\n  __dev_queue_xmit+0x27ee/0x3520 net/core/dev.c:3557\n  dev_queue_xmit+0x4b/0x60 net/core/dev.c:3590\n  packet_snd net/packet/af_packet.c:2944 [inline]\n  packet_sendmsg+0x7c70/0x8a30 net/packet/af_packet.c:2969\n  sock_sendmsg_nosec net/socket.c:630 [inline]\n  sock_sendmsg net/socket.c:640 [inline]\n  ___sys_sendmsg+0xec0/0x1310 net/socket.c:2046\n  __sys_sendmmsg+0x42d/0x800 net/socket.c:2136\n  SYSC_sendmmsg+0xc4/0x110 net/socket.c:2167\n  SyS_sendmmsg+0x63/0x90 net/socket.c:2162\n  do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287\n  entry_SYSCALL_64_after_hwframe+0x3d/0xa2\nRIP: 0033:0x441819\nRSP: 002b:00007ffe58ee8268 EFLAGS: 00000213 ORIG_RAX: 0000000000000133\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441819\nRDX: 0000000000000002 RSI: 0000000020000100 RDI: 0000000000000003\nRBP: 00000000006cd018 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000213 R12: 0000000000402510\nR13: 00000000004025a0 R14: 0000000000000000 R15: 0000000000000000\n\nUninit was created at:\n  kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]\n  kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188\n  kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314\n  kmsan_slab_alloc+0x11/0x20 mm/kmsan/kmsan.c:321\n  slab_post_alloc_hook mm/slab.h:445 [inline]\n  slab_alloc_node mm/slub.c:2737 [inline]\n  __kmalloc_node_track_caller+0xaed/0x11c0 mm/slub.c:4369\n  __kmalloc_reserve net/core/skbuff.c:138 [inline]\n  __alloc_skb+0x2cf/0x9f0 net/core/skbuff.c:206\n  alloc_skb include/linux/skbuff.h:984 [inline]\n  alloc_skb_with_frags+0x1d4/0xb20 net/core/skbuff.c:5234\n  sock_alloc_send_pskb+0xb56/0x1190 net/core/sock.c:2085\n  packet_alloc_skb net/packet/af_packet.c:2803 [inline]\n  packet_snd net/packet/af_packet.c:2894 [inline]\n  packet_sendmsg+0x6454/0x8a30 net/packet/af_packet.c:2969\n  sock_sendmsg_nosec net/socket.c:630 [inline]\n  sock_sendmsg net/socket.c:640 [inline]\n  ___sys_sendmsg+0xec0/0x1310 net/socket.c:2046\n  __sys_sendmmsg+0x42d/0x800 net/socket.c:2136\n  SYSC_sendmmsg+0xc4/0x110 net/socket.c:2167\n  SyS_sendmmsg+0x63/0x90 net/socket.c:2162\n  do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287\n  entry_SYSCALL_64_after_hwframe+0x3d/0xa2\n\nThis change addresses the issue adding the needed check before\naccessing the inner header.\n\nThe ipv4 side of the issue is apparently there since the ipv4 over ipv6\ninitial support, and the ipv6 side predates git history.\n\nFixes: c4d3efafcc93 (\"[IPV6] IP6TUNNEL: Add support to IPv4 over IPv6 tunnel.\")\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: syzbot+3fde91d4d394747d6db4@syzkaller.appspotmail.com\nTested-by: Alexander Potapenko <glider@google.com>\nSigned-off-by: Paolo Abeni <pabeni@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/18bf9a724362a3feff649f529178f49b11e877e4"},{"sha":"deb33b68f40e788c974acf61bc220dc077cb8032","author":{"name":"Paolo Abeni","email":"6e4ffc2e3438feb7acb34f6b67e6ae17e700099c@redhat.com"},"message":"ip_tunnel: be careful when accessing the inner header\n\n[ Upstream commit ccfec9e5cb2d48df5a955b7bf47f7782157d3bc2]\n\nCong noted that we need the same checks introduced by commit 76c0ddd8c3a6\n(\"ip6_tunnel: be careful when accessing the inner header\")\neven for ipv4 tunnels.\n\nFixes: c54419321455 (\"GRE: Refactor GRE tunneling code.\")\nSuggested-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: Paolo Abeni <pabeni@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/deb33b68f40e788c974acf61bc220dc077cb8032"},{"sha":"32b193216e185a3ba817a179f29a53a9973665a9","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"ipv4: fix use-after-free in ip_cmsg_recv_dstaddr()\n\n[ Upstream commit 64199fc0a46ba211362472f7f942f900af9492fd ]\n\nCaching ip_hdr(skb) before a call to pskb_may_pull() is buggy,\ndo not do it.\n\nFixes: 2efd4fca703a (\"ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nCc: Willem de Bruijn <willemb@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nAcked-by: Willem de Bruijn <willemb@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/32b193216e185a3ba817a179f29a53a9973665a9"},{"sha":"48c14f2ea5c58268f4ea59da6467c74cdec9e6f2","author":{"name":"Wei Wang","email":"d1a14547fbd57d80de0d744a7697de0d1b6e7be3@google.com"},"message":"ipv6: take rcu lock in rawv6_send_hdrinc()\n\n[ Upstream commit a688caa34beb2fd2a92f1b6d33e40cde433ba160 ]\n\nIn rawv6_send_hdrinc(), in order to avoid an extra dst_hold(), we\ndirectly assign the dst to skb and set passed in dst to NULL to avoid\ndouble free.\nHowever, in error case, we free skb and then do stats update with the\ndst pointer passed in. This causes use-after-free on the dst.\nFix it by taking rcu read lock right before dst could get released to\nmake sure dst does not get freed until the stats update is done.\nNote: we don't have this issue in ipv4 cause dst is not used for stats\nupdate in v4.\n\nSyzkaller reported following crash:\nBUG: KASAN: use-after-free in rawv6_send_hdrinc net/ipv6/raw.c:692 [inline]\nBUG: KASAN: use-after-free in rawv6_sendmsg+0x4421/0x4630 net/ipv6/raw.c:921\nRead of size 8 at addr ffff8801d95ba730 by task syz-executor0/32088\n\nCPU: 1 PID: 32088 Comm: syz-executor0 Not tainted 4.19.0-rc2+ #93\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113\n print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256\n kasan_report_error mm/kasan/report.c:354 [inline]\n kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412\n __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433\n rawv6_send_hdrinc net/ipv6/raw.c:692 [inline]\n rawv6_sendmsg+0x4421/0x4630 net/ipv6/raw.c:921\n inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798\n sock_sendmsg_nosec net/socket.c:621 [inline]\n sock_sendmsg+0xd5/0x120 net/socket.c:631\n ___sys_sendmsg+0x7fd/0x930 net/socket.c:2114\n __sys_sendmsg+0x11d/0x280 net/socket.c:2152\n __do_sys_sendmsg net/socket.c:2161 [inline]\n __se_sys_sendmsg net/socket.c:2159 [inline]\n __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2159\n do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\nRIP: 0033:0x457099\nCode: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00\nRSP: 002b:00007f83756edc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f83756ee6d4 RCX: 0000000000457099\nRDX: 0000000000000000 RSI: 0000000020003840 RDI: 0000000000000004\nRBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff\nR13: 00000000004d4b30 R14: 00000000004c90b1 R15: 0000000000000000\n\nAllocated by task 32088:\n save_stack+0x43/0xd0 mm/kasan/kasan.c:448\n set_track mm/kasan/kasan.c:460 [inline]\n kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553\n kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490\n kmem_cache_alloc+0x12e/0x730 mm/slab.c:3554\n dst_alloc+0xbb/0x1d0 net/core/dst.c:105\n ip6_dst_alloc+0x35/0xa0 net/ipv6/route.c:353\n ip6_rt_cache_alloc+0x247/0x7b0 net/ipv6/route.c:1186\n ip6_pol_route+0x8f8/0xd90 net/ipv6/route.c:1895\n ip6_pol_route_output+0x54/0x70 net/ipv6/route.c:2093\n fib6_rule_lookup+0x277/0x860 net/ipv6/fib6_rules.c:122\n ip6_route_output_flags+0x2c5/0x350 net/ipv6/route.c:2121\n ip6_route_output include/net/ip6_route.h:88 [inline]\n ip6_dst_lookup_tail+0xe27/0x1d60 net/ipv6/ip6_output.c:951\n ip6_dst_lookup_flow+0xc8/0x270 net/ipv6/ip6_output.c:1079\n rawv6_sendmsg+0x12d9/0x4630 net/ipv6/raw.c:905\n inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798\n sock_sendmsg_nosec net/socket.c:621 [inline]\n sock_sendmsg+0xd5/0x120 net/socket.c:631\n ___sys_sendmsg+0x7fd/0x930 net/socket.c:2114\n __sys_sendmsg+0x11d/0x280 net/socket.c:2152\n __do_sys_sendmsg net/socket.c:2161 [inline]\n __se_sys_sendmsg net/socket.c:2159 [inline]\n __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2159\n do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\n\nFreed by task 5356:\n save_stack+0x43/0xd0 mm/kasan/kasan.c:448\n set_track mm/kasan/kasan.c:460 [inline]\n __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521\n kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528\n __cache_free mm/slab.c:3498 [inline]\n kmem_cache_free+0x83/0x290 mm/slab.c:3756\n dst_destroy+0x267/0x3c0 net/core/dst.c:141\n dst_destroy_rcu+0x16/0x19 net/core/dst.c:154\n __rcu_reclaim kernel/rcu/rcu.h:236 [inline]\n rcu_do_batch kernel/rcu/tree.c:2576 [inline]\n invoke_rcu_callbacks kernel/rcu/tree.c:2880 [inline]\n __rcu_process_callbacks kernel/rcu/tree.c:2847 [inline]\n rcu_process_callbacks+0xf23/0x2670 kernel/rcu/tree.c:2864\n __do_softirq+0x30b/0xad8 kernel/softirq.c:292\n\nFixes: 1789a640f556 (\"raw: avoid two atomics in xmit\")\nSigned-off-by: Wei Wang <weiwan@google.com>\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/48c14f2ea5c58268f4ea59da6467c74cdec9e6f2"},{"sha":"8193b775247a2c38294fd9d1fee5084b5c1b3de8","author":{"name":"Florian Fainelli","email":"59190c1867e3222b932a0de3c668eb2d980d69a2@gmail.com"},"message":"net: dsa: bcm_sf2: Call setup during switch resume\n\n[ Upstream commit 54baca096386d862d19c10f58f34bf787c6b3cbe ]\n\nThere is no reason to open code what the switch setup function does, in\nfact, because we just issued a switch reset, we would make all the\nregister get their default values, including for instance, having unused\nport be enabled again and wasting power and leading to an inappropriate\nswitch core clock being selected.\n\nFixes: 8cfa94984c9c (\"net: dsa: bcm_sf2: add suspend/resume callbacks\")\nSigned-off-by: Florian Fainelli <f.fainelli@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/8193b775247a2c38294fd9d1fee5084b5c1b3de8"},{"sha":"6c61dae979ae39850a3a9945f93e83e5b5baf31c","author":{"name":"Yunsheng Lin","email":"b47b1a4424998367370e7c5e15207fdc98906019@huawei.com"},"message":"net: hns: fix for unmapping problem when SMMU is on\n\n[ Upstream commit 2e9361efa707e186d91b938e44f9e326725259f7 ]\n\nIf SMMU is on, there is more likely that skb_shinfo(skb)->frags[i]\ncan not send by a single BD. when this happen, the\nhns_nic_net_xmit_hw function map the whole data in a frags using\nskb_frag_dma_map, but unmap each BD' data individually when tx is\ndone, which causes problem when SMMU is on.\n\nThis patch fixes this problem by ummapping the whole data in a\nfrags when tx is done.\n\nSigned-off-by: Yunsheng Lin <linyunsheng@huawei.com>\nSigned-off-by: Peng Li <lipeng321@huawei.com>\nReviewed-by: Yisen Zhuang <yisen.zhuang@huawei.com>\nSigned-off-by: Salil Mehta <salil.mehta@huawei.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/6c61dae979ae39850a3a9945f93e83e5b5baf31c"},{"sha":"9b4869cf385aa16f89c0f019eed4ec4e36aa441c","author":{"name":"Sabrina Dubroca","email":"4452d71687b6bc2c9389c3349fdc17fbd73b833b@queasysnail.net"},"message":"net: ipv4: update fnhe_pmtu when first hop's MTU changes\n\n[ Upstream commit af7d6cce53694a88d6a1bb60c9a239a6a5144459 ]\n\nSince commit 5aad1de5ea2c (\"ipv4: use separate genid for next hop\nexceptions\"), exceptions get deprecated separately from cached\nroutes. In particular, administrative changes don't clear PMTU anymore.\n\nAs Stefano described in commit e9fa1495d738 (\"ipv6: Reflect MTU changes\non PMTU of exceptions for MTU-less routes\"), the PMTU discovered before\nthe local MTU change can become stale:\n - if the local MTU is now lower than the PMTU, that PMTU is now\n   incorrect\n - if the local MTU was the lowest value in the path, and is increased,\n   we might discover a higher PMTU\n\nSimilarly to what commit e9fa1495d738 did for IPv6, update PMTU in those\ncases.\n\nIf the exception was locked, the discovered PMTU was smaller than the\nminimal accepted PMTU. In that case, if the new local MTU is smaller\nthan the current PMTU, let PMTU discovery figure out if locking of the\nexception is still needed.\n\nTo do this, we need to know the old link MTU in the NETDEV_CHANGEMTU\nnotifier. By the time the notifier is called, dev->mtu has been\nchanged. This patch adds the old MTU as additional information in the\nnotifier structure, and a new call_netdevice_notifiers_u32() function.\n\nFixes: 5aad1de5ea2c (\"ipv4: use separate genid for next hop exceptions\")\nSigned-off-by: Sabrina Dubroca <sd@queasysnail.net>\nReviewed-by: Stefano Brivio <sbrivio@redhat.com>\nReviewed-by: David Ahern <dsahern@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/9b4869cf385aa16f89c0f019eed4ec4e36aa441c"},{"sha":"335c37612f9fec84f8e361e2ce8148b7cd156d22","author":{"name":"Jeff Barnhill","email":"6990780b619fbc2c277198012efc384361a92920@gmail.com"},"message":"net/ipv6: Display all addresses in output of /proc/net/if_inet6\n\n[ Upstream commit 86f9bd1ff61c413a2a251fa736463295e4e24733 ]\n\nThe backend handling for /proc/net/if_inet6 in addrconf.c doesn't properly\nhandle starting/stopping the iteration.  The problem is that at some point\nduring the iteration, an overflow is detected and the process is\nsubsequently stopped.  The item being shown via seq_printf() when the\noverflow occurs is not actually shown, though.  When start() is\nsubsequently called to resume iterating, it returns the next item, and\nthus the item that was being processed when the overflow occurred never\ngets printed.\n\nAlter the meaning of the private data member \"offset\".  Currently, when it\nis not 0 (which only happens at the very beginning), \"offset\" represents\nthe next hlist item to be printed.  After this change, \"offset\" always\nrepresents the current item.\n\nThis is also consistent with the private data member \"bucket\", which\nrepresents the current bucket, and also the use of \"pos\" as defined in\nseq_file.txt:\n    The pos passed to start() will always be either zero, or the most\n    recent pos used in the previous session.\n\nSigned-off-by: Jeff Barnhill <0xeffeff@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/335c37612f9fec84f8e361e2ce8148b7cd156d22"},{"sha":"19c5e73c745cac1ff3c54526335f16c515a1e3a7","author":{"name":"Sean Tranchetti","email":"571e0db99464eba93fabd8eb087bcaf9178c708c@codeaurora.org"},"message":"netlabel: check for IPV4MASK in addrinfo_get\n\n[ Upstream commit f88b4c01b97e09535505cf3c327fdbce55c27f00 ]\n\nnetlbl_unlabel_addrinfo_get() assumes that if it finds the\nNLBL_UNLABEL_A_IPV4ADDR attribute, it must also have the\nNLBL_UNLABEL_A_IPV4MASK attribute as well. However, this is\nnot necessarily the case as the current checks in\nnetlbl_unlabel_staticadd() and friends are not sufficent to\nenforce this.\n\nIf passed a netlink message with NLBL_UNLABEL_A_IPV4ADDR,\nNLBL_UNLABEL_A_IPV6ADDR, and NLBL_UNLABEL_A_IPV6MASK attributes,\nthese functions will all call netlbl_unlabel_addrinfo_get() which\nwill then attempt dereference NULL when fetching the non-existent\nNLBL_UNLABEL_A_IPV4MASK attribute:\n\nUnable to handle kernel NULL pointer dereference at virtual address 0\nProcess unlab (pid: 31762, stack limit = 0xffffff80502d8000)\nCall trace:\n\tnetlbl_unlabel_addrinfo_get+0x44/0xd8\n\tnetlbl_unlabel_staticremovedef+0x98/0xe0\n\tgenl_rcv_msg+0x354/0x388\n\tnetlink_rcv_skb+0xac/0x118\n\tgenl_rcv+0x34/0x48\n\tnetlink_unicast+0x158/0x1f0\n\tnetlink_sendmsg+0x32c/0x338\n\tsock_sendmsg+0x44/0x60\n\t___sys_sendmsg+0x1d0/0x2a8\n\t__sys_sendmsg+0x64/0xb4\n\tSyS_sendmsg+0x34/0x4c\n\tel0_svc_naked+0x34/0x38\nCode: 51001149 7100113f 540000a0 f9401508 (79400108)\n---[ end trace f6438a488e737143 ]---\nKernel panic - not syncing: Fatal exception\n\nSigned-off-by: Sean Tranchetti <stranche@codeaurora.org>\n\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/19c5e73c745cac1ff3c54526335f16c515a1e3a7"},{"sha":"d9bf6699aee863044cbb8c2b5d2de5e1db4fd7d8","author":{"name":"Maxime Chevallier","email":"4d075fc8e96710be3ebe6e88a3241012ff91e096@bootlin.com"},"message":"net: mvpp2: Extract the correct ethtype from the skb for tx csum offload\n\n[ Upstream commit 35f3625c21852ad839f20c91c7d81c4c1101e207 ]\n\nWhen offloading the L3 and L4 csum computation on TX, we need to extract\nthe l3_proto from the ethtype, independently of the presence of a vlan\ntag.\n\nThe actual driver uses skb->protocol as-is, resulting in packets with\nthe wrong L4 checksum being sent when there's a vlan tag in the packet\nheader and checksum offloading is enabled.\n\nThis commit makes use of vlan_protocol_get() to get the correct ethtype\nregardless the presence of a vlan tag.\n\nFixes: 3f518509dedc (\"ethernet: Add new driver for Marvell Armada 375 network unit\")\nSigned-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/d9bf6699aee863044cbb8c2b5d2de5e1db4fd7d8"},{"sha":"85ebbc5a2543f3ffcc535dbeb9842af542f3edb1","author":{"name":"Antoine Tenart","email":"7fc24f17b07747ca12864f96f551beca43e4577d@bootlin.com"},"message":"net: mvpp2: fix a txq_done race condition\n\n[ Upstream commit 774268f3e51b53ed432a1ec516574fd5ba469398 ]\n\nWhen no Tx IRQ is available, the txq_done() routine (called from\ntx_done()) shouldn't be called from the polling function, as in such\ncase it is already called in the Tx path thanks to an hrtimer. This\nmostly occurred when using PPv2.1, as the engine then do not have Tx\nIRQs.\n\nFixes: edc660fa09e2 (\"net: mvpp2: replace TX coalescing interrupts with hrtimer\")\nReported-by: Stefan Chulski <stefanc@marvell.com>\nSigned-off-by: Antoine Tenart <antoine.tenart@bootlin.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/85ebbc5a2543f3ffcc535dbeb9842af542f3edb1"},{"sha":"d9057423312e9d12f02290cb97f14300330a729e","author":{"name":"David Ahern","email":"b80c1600f604d3b0d768f26f90a76757e76005dd@gmail.com"},"message":"net: sched: Add policy validation for tc attributes\n\n[ Upstream commit 8b4c3cdd9dd8290343ce959a132d3b334062c5b9 ]\n\nA number of TC attributes are processed without proper validation\n(e.g., length checks). Add a tca policy for all input attributes and use\nwhen invoking nlmsg_parse.\n\nThe 2 Fixes tags below cover the latest additions. The other attributes\nare a string (KIND), nested attribute (OPTIONS which does seem to have\nvalidation in most cases), for dumps only or a flag.\n\nFixes: 5bc1701881e39 (\"net: sched: introduce multichain support for filters\")\nFixes: d47a6b0e7c492 (\"net: sched: introduce ingress/egress block index attributes for qdisc\")\nSigned-off-by: David Ahern <dsahern@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/d9057423312e9d12f02290cb97f14300330a729e"},{"sha":"3e80ad8cbf228d74666a862fdf2c38f5b6b3c8aa","author":{"name":"Florian Fainelli","email":"59190c1867e3222b932a0de3c668eb2d980d69a2@gmail.com"},"message":"net: systemport: Fix wake-up interrupt race during resume\n\n[ Upstream commit 45ec318578c0c22a11f5b9927d064418e1ab1905 ]\n\nThe AON_PM_L2 is normally used to trigger and identify the source of a\nwake-up event. Since the RX_SYS clock is no longer turned off, we also\nhave an interrupt being sent to the SYSTEMPORT INTRL_2_0 controller, and\nthat interrupt remains active up until the magic packet detector is\ndisabled which happens much later during the driver resumption.\n\nThe race happens if we have a CPU that is entering the SYSTEMPORT\nINTRL2_0 handler during resume, and another CPU has managed to clear the\nwake-up interrupt during bcm_sysport_resume_from_wol(). In that case, we\nhave the first CPU stuck in the interrupt handler with an interrupt\ncause that has been cleared under its feet, and so we keep returning\nIRQ_NONE and we never make any progress.\n\nThis was not a problem before because we would always turn off the\nRX_SYS clock during WoL, so the SYSTEMPORT INTRL2_0 would also be turned\noff as well, thus not latching the interrupt.\n\nThe fix is to make sure we do not enable either the MPD or\nBRCM_TAG_MATCH interrupts since those are redundant with what the\nAON_PM_L2 interrupt controller already processes and they would cause\nsuch a race to occur.\n\nFixes: bb9051a2b230 (\"net: systemport: Add support for WAKE_FILTER\")\nFixes: 83e82f4c706b (\"net: systemport: add Wake-on-LAN support\")\nSigned-off-by: Florian Fainelli <f.fainelli@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/3e80ad8cbf228d74666a862fdf2c38f5b6b3c8aa"},{"sha":"133aea0f2108f5c3b68a621f20caf275f7e90e64","author":{"name":"Yu Zhao","email":"9640a31789aee25cf713d8aa6fe964eb05bab72b@google.com"},"message":"net/usb: cancel pending work when unbinding smsc75xx\n\n[ Upstream commit f7b2a56e1f3dcbdb4cf09b2b63e859ffe0e09df8 ]\n\nCancel pending work before freeing smsc75xx private data structure\nduring binding. This fixes the following crash in the driver:\n\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000050\nIP: mutex_lock+0x2b/0x3f\n<snipped>\nWorkqueue: events smsc75xx_deferred_multicast_write [smsc75xx]\ntask: ffff8caa83e85700 task.stack: ffff948b80518000\nRIP: 0010:mutex_lock+0x2b/0x3f\n<snipped>\nCall Trace:\n smsc75xx_deferred_multicast_write+0x40/0x1af [smsc75xx]\n process_one_work+0x18d/0x2fc\n worker_thread+0x1a2/0x269\n ? pr_cont_work+0x58/0x58\n kthread+0xfa/0x10a\n ? pr_cont_work+0x58/0x58\n ? rcu_read_unlock_sched_notrace+0x48/0x48\n ret_from_fork+0x22/0x40\n\nSigned-off-by: Yu Zhao <yuzhao@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/133aea0f2108f5c3b68a621f20caf275f7e90e64"},{"sha":"0d5b9edea99531145d4cade061ad6c7238654c48","author":{"name":"Shahed Shaikh","email":"c3f28edf146fff1d494c60280c6c601216e56491@cavium.com"},"message":"qlcnic: fix Tx descriptor corruption on 82xx devices\n\n[ Upstream commit c333fa0c4f220f8f7ea5acd6b0ebf3bf13fd684d ]\n\nIn regular NIC transmission flow, driver always configures MAC using\nTx queue zero descriptor as a part of MAC learning flow.\nBut with multi Tx queue supported NIC, regular transmission can occur on\nany non-zero Tx queue and from that context it uses\nTx queue zero descriptor to configure MAC, at the same time TX queue\nzero could be used by another CPU for regular transmission\nwhich could lead to Tx queue zero descriptor corruption and cause FW\nabort.\n\nThis patch fixes this in such a way that driver always configures\nlearned MAC address from the same Tx queue which is used for\nregular transmission.\n\nFixes: 7e2cf4feba05 (\"qlcnic: change driver hardware interface mechanism\")\nSigned-off-by: Shahed Shaikh <shahed.shaikh@cavium.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/0d5b9edea99531145d4cade061ad6c7238654c48"},{"sha":"72675512fb1a823326d8c26ffa5a9a59ecb54bbb","author":{"name":"Giacinto Cifelli","email":"2e93a8fc7e275ae70eecf67fb42bef0d5c1f7049@gmail.com"},"message":"qmi_wwan: Added support for Gemalto's Cinterion ALASxx WWAN interface\n\n[ Upstream commit 4f7617705bfff84d756fe4401a1f4f032f374984 ]\n\nAdded support for Gemalto's Cinterion ALASxx WWAN interfaces\nby adding QMI_FIXED_INTF with Cinterion's VID and PID.\n\nSigned-off-by: Giacinto Cifelli <gciofono@gmail.com>\nAcked-by: Bjørn Mork <bjorn@mork.no>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/72675512fb1a823326d8c26ffa5a9a59ecb54bbb"},{"sha":"5f999abba33f6788f52cdadae3432f5e731c09bc","author":{"name":"Mauricio Faria de Oliveira","email":"8a2bda6ff19e18a6e113624dcf83fdbe4b1bbe78@canonical.com"},"message":"rtnetlink: fix rtnl_fdb_dump() for ndmsg header\n\n[ Upstream commit bd961c9bc66497f0c63f4ba1d02900bb85078366 ]\n\nCurrently, rtnl_fdb_dump() assumes the family header is 'struct ifinfomsg',\nwhich is not always true -- 'struct ndmsg' is used by iproute2 ('ip neigh').\n\nThe problem is, the function bails out early if nlmsg_parse() fails, which\ndoes occur for iproute2 usage of 'struct ndmsg' because the payload length\nis shorter than the family header alone (as 'struct ifinfomsg' is assumed).\n\nThis breaks backward compatibility with userspace -- nothing is sent back.\n\nSome examples with iproute2 and netlink library for go [1]:\n\n 1) $ bridge fdb show\n    33:33:00:00:00:01 dev ens3 self permanent\n    01:00:5e:00:00:01 dev ens3 self permanent\n    33:33:ff:15:98:30 dev ens3 self permanent\n\n      This one works, as it uses 'struct ifinfomsg'.\n\n      fdb_show() @ iproute2/bridge/fdb.c\n        \"\"\"\n        .n.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifinfomsg)),\n        ...\n        if (rtnl_dump_request(&rth, RTM_GETNEIGH, [...]\n        \"\"\"\n\n 2) $ ip --family bridge neigh\n    RTNETLINK answers: Invalid argument\n    Dump terminated\n\n      This one fails, as it uses 'struct ndmsg'.\n\n      do_show_or_flush() @ iproute2/ip/ipneigh.c\n        \"\"\"\n        .n.nlmsg_type = RTM_GETNEIGH,\n        .n.nlmsg_len = NLMSG_LENGTH(sizeof(struct ndmsg)),\n        \"\"\"\n\n 3) $ ./neighlist\n    < no output >\n\n      This one fails, as it uses 'struct ndmsg'-based.\n\n      neighList() @ netlink/neigh_linux.go\n        \"\"\"\n        req := h.newNetlinkRequest(unix.RTM_GETNEIGH, [...]\n        msg := Ndmsg{\n        \"\"\"\n\nThe actual breakage was introduced by commit 0ff50e83b512 (\"net: rtnetlink:\nbail out from rtnl_fdb_dump() on parse error\"), because nlmsg_parse() fails\nif the payload length (with the _actual_ family header) is less than the\nfamily header length alone (which is assumed, in parameter 'hdrlen').\nThis is true in the examples above with struct ndmsg, with size and payload\nlength shorter than struct ifinfomsg.\n\nHowever, that commit just intends to fix something under the assumption the\nfamily header is indeed an 'struct ifinfomsg' - by preventing access to the\npayload as such (via 'ifm' pointer) if the payload length is not sufficient\nto actually contain it.\n\nThe assumption was introduced by commit 5e6d24358799 (\"bridge: netlink dump\ninterface at par with brctl\"), to support iproute2's 'bridge fdb' command\n(not 'ip neigh') which indeed uses 'struct ifinfomsg', thus is not broken.\n\nSo, in order to unbreak the 'struct ndmsg' family headers and still allow\n'struct ifinfomsg' to continue to work, check for the known message sizes\nused with 'struct ndmsg' in iproute2 (with zero or one attribute which is\nnot used in this function anyway) then do not parse the data as ifinfomsg.\n\nSame examples with this patch applied (or revert/before the original fix):\n\n    $ bridge fdb show\n    33:33:00:00:00:01 dev ens3 self permanent\n    01:00:5e:00:00:01 dev ens3 self permanent\n    33:33:ff:15:98:30 dev ens3 self permanent\n\n    $ ip --family bridge neigh\n    dev ens3 lladdr 33:33:00:00:00:01 PERMANENT\n    dev ens3 lladdr 01:00:5e:00:00:01 PERMANENT\n    dev ens3 lladdr 33:33:ff:15:98:30 PERMANENT\n\n    $ ./neighlist\n    netlink.Neigh{LinkIndex:2, Family:7, State:128, Type:0, Flags:2, IP:net.IP(nil), HardwareAddr:net.HardwareAddr{0x33, 0x33, 0x0, 0x0, 0x0, 0x1}, LLIPAddr:net.IP(nil), Vlan:0, VNI:0}\n    netlink.Neigh{LinkIndex:2, Family:7, State:128, Type:0, Flags:2, IP:net.IP(nil), HardwareAddr:net.HardwareAddr{0x1, 0x0, 0x5e, 0x0, 0x0, 0x1}, LLIPAddr:net.IP(nil), Vlan:0, VNI:0}\n    netlink.Neigh{LinkIndex:2, Family:7, State:128, Type:0, Flags:2, IP:net.IP(nil), HardwareAddr:net.HardwareAddr{0x33, 0x33, 0xff, 0x15, 0x98, 0x30}, LLIPAddr:net.IP(nil), Vlan:0, VNI:0}\n\nTested on mainline (v4.19-rc6) and net-next (3bd09b05b068).\n\nReferences:\n\n[1] netlink library for go (test-case)\n    https://github.com/vishvananda/netlink\n\n    $ cat ~/go/src/neighlist/main.go\n    package main\n    import (\"fmt\"; \"syscall\"; \"github.com/vishvananda/netlink\")\n    func main() {\n        neighs, _ := netlink.NeighList(0, syscall.AF_BRIDGE)\n        for _, neigh := range neighs { fmt.Printf(\"%#v\\n\", neigh) }\n    }\n\n    $ export GOPATH=~/go\n    $ go get github.com/vishvananda/netlink\n    $ go build neighlist\n    $ ~/go/src/neighlist/neighlist\n\nThanks to David Ahern for suggestions to improve this patch.\n\nFixes: 0ff50e83b512 (\"net: rtnetlink: bail out from rtnl_fdb_dump() on parse error\")\nFixes: 5e6d24358799 (\"bridge: netlink dump interface at par with brctl\")\nReported-by: Aidan Obley <aobley@pivotal.io>\nSigned-off-by: Mauricio Faria de Oliveira <mfo@canonical.com>\nReviewed-by: David Ahern <dsahern@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/5f999abba33f6788f52cdadae3432f5e731c09bc"}]}
{"actor":{"display_login":"blissgerrit"}}