{"push_id":2930267611,"size":138,"distinct_size":138,"ref":"refs/heads/master","head":"cec4de302c5ff2c5eb3bfcb0c4845a095f5149b9","before":"95773dc0862717ab9612d69bc07d0386bd104603","commits":[{"sha":"07bf7908950a8b14e81aa1807e3c667eab39287a","author":{"name":"Steffen Klassert","email":"66deb1d63f85161cc287ce2bac0c65cb5ae958a7@secunet.com"},"message":"xfrm: Validate address prefix lengths in the xfrm selector.\n\nWe don't validate the address prefix lengths in the xfrm\nselector we got from userspace. This can lead to undefined\nbehaviour in the address matching functions if the prefix\nis too big for the given address family. Fix this by checking\nthe prefixes and refuse SA/policy insertation when a prefix\nis invalid.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Air Icy <icytxw@gmail.com>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/07bf7908950a8b14e81aa1807e3c667eab39287a"},{"sha":"215ab0f021c9fea3c18b75e7d522400ee6a49990","author":{"name":"Thadeu Lima de Souza Cascardo","email":"c8883472cb5fbead63941b41bccc869c7deaf90f@canonical.com"},"message":"xfrm6: call kfree_skb when skb is toobig\n\nAfter commit d6990976af7c5d8f55903bfb4289b6fb030bf754 (\"vti6: fix PMTU caching\nand reporting on xmit\"), some too big skbs might be potentially passed down to\n__xfrm6_output, causing it to fail to transmit but not free the skb, causing a\nleak of skb, and consequentially a leak of dst references.\n\nAfter running pmtu.sh, that shows as failure to unregister devices in a namespace:\n\n[  311.397671] unregister_netdevice: waiting for veth_b to become free. Usage count = 1\n\nThe fix is to call kfree_skb in case of transmit failures.\n\nFixes: dd767856a36e (\"xfrm6: Don't call icmpv6_send on local error\")\nSigned-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>\nReviewed-by: Sabrina Dubroca <sd@queasysnail.net>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/215ab0f021c9fea3c18b75e7d522400ee6a49990"},{"sha":"bfc0698bebcb16d19ecfc89574ad4d696955e5d3","author":{"name":"Sowmini Varadhan","email":"1a53202f7826b15a582486d4ea9c371e05720251@oracle.com"},"message":"xfrm: reset transport header back to network header after all input transforms ahave been applied\n\nA policy may have been set up with multiple transforms (e.g., ESP\nand ipcomp). In this situation, the ingress IPsec processing\niterates in xfrm_input() and applies each transform in turn,\nprocessing the nexthdr to find any additional xfrm that may apply.\n\nThis patch resets the transport header back to network header\nonly after the last transformation so that subsequent xfrms\ncan find the correct transport header.\n\nFixes: 7785bba299a8 (\"esp: Add a software GRO codepath\")\nSuggested-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/bfc0698bebcb16d19ecfc89574ad4d696955e5d3"},{"sha":"782710e333a526780d65918d669cb96646983ba2","author":{"name":"Sowmini Varadhan","email":"1a53202f7826b15a582486d4ea9c371e05720251@oracle.com"},"message":"xfrm: reset crypto_done when iterating over multiple input xfrms\n\nWe only support one offloaded xfrm (we do not have devices that\ncan handle more than one offload), so reset crypto_done in\nxfrm_input() when iterating over multiple transforms in xfrm_input,\nso that we can invoke the appropriate x->type->input for the\nnon-offloaded transforms\n\nFixes: d77e38e612a0 (\"xfrm: Add an IPsec hardware offloading API\")\nSigned-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/782710e333a526780d65918d669cb96646983ba2"},{"sha":"8682250b3c1b75a45feb7452bc413d004cfe3778","author":{"name":"Andrei Otcheretianski","email":"52b10305096e64ebe056ebf56ccad6d200c051a9@intel.com"},"message":"mac80211: Always report TX status\n\nIf a frame is dropped for any reason, mac80211 wouldn't report the TX\nstatus back to user space.\n\nAs the user space may rely on the TX_STATUS to kick its state\nmachines, resends etc, it's better to just report this frame as not\nacked instead.\n\nSigned-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>\nSigned-off-by: Luca Coelho <luciano.coelho@intel.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/8682250b3c1b75a45feb7452bc413d004cfe3778"},{"sha":"94a5b3acd0aef83c0e38b5117eda7b2abf4a05a4","author":{"name":"Andrei Otcheretianski","email":"52b10305096e64ebe056ebf56ccad6d200c051a9@intel.com"},"message":"mac80211: Don't wake up from PS for offchannel TX\n\nOtherwise the offchannel frame might be queued due to\nIEEE80211_QUEUE_STOP_REASON_PS and later dropped (in\nieee80211_tx_frags()).  Anyway, it doesn't make much sense to wake up\nthe device during ROC.\n\nSigned-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>\nSigned-off-by: Luca Coelho <luciano.coelho@intel.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/94a5b3acd0aef83c0e38b5117eda7b2abf4a05a4"},{"sha":"24f33e64fcd0d50a4b1a8e5b41bd0257aa66b0e8","author":{"name":"Andrei Otcheretianski","email":"52b10305096e64ebe056ebf56ccad6d200c051a9@intel.com"},"message":"cfg80211: reg: Init wiphy_idx in regulatory_hint_core()\n\nCore regulatory hints didn't set wiphy_idx to WIPHY_IDX_INVALID. Since\nthe regulatory request is zeroed, wiphy_idx was always implicitly set to\n0. This resulted in updating only phy #0.\nFix that.\n\nFixes: 806a9e39670b (\"cfg80211: make regulatory_request use wiphy_idx instead of wiphy\")\nSigned-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>\nSigned-off-by: Luca Coelho <luciano.coelho@intel.com>\n[add fixes tag]\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/24f33e64fcd0d50a4b1a8e5b41bd0257aa66b0e8"},{"sha":"6eae4a6c2be387fec41b0d2782c4fffb57159498","author":{"name":"Bob Copeland","email":"b1c1d8736f20db3fb6c1c66bb1455ed43909f0d8@bobcopeland.com"},"message":"mac80211: fix pending queue hang due to TX_DROP\n\nIn our environment running lots of mesh nodes, we are seeing the\npending queue hang periodically, with the debugfs queues file showing\nlines such as:\n\n    00: 0x00000000/348\n\ni.e. there are a large number of frames but no stop reason set.\n\nOne way this could happen is if queue processing from the pending\ntasklet exited early without processing all frames, and without having\nsome future event (incoming frame, stop reason flag, ...) to reschedule\nit.\n\nExactly this can occur today if ieee80211_tx() returns false due to\npacket drops or power-save buffering in the tx handlers.  In the\npast, this function would return true in such cases, and the change\nto false doesn't seem to be intentional.  Fix this case by reverting\nto the previous behavior.\n\nFixes: bb42f2d13ffc (\"mac80211: Move reorder-sensitive TX handlers to after TXQ dequeue\")\nSigned-off-by: Bob Copeland <bobcopeland@fb.com>\nAcked-by: Toke Høiland-Jørgensen <toke@toke.dk>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/6eae4a6c2be387fec41b0d2782c4fffb57159498"},{"sha":"119f94a6fefcc76d47075b83d2b73d04c895df78","author":{"name":"Jouni Malinen","email":"60fc0a3d472aaa2d436c869c504a67f76c906ae8@codeaurora.org"},"message":"cfg80211: Address some corner cases in scan result channel updating\n\ncfg80211_get_bss_channel() is used to update the RX channel based on the\navailable frame payload information (channel number from DSSS Parameter\nSet element or HT Operation element). This is needed on 2.4 GHz channels\nwhere frames may be received on neighboring channels due to overlapping\nfrequency range.\n\nThis might of some use on the 5 GHz band in some corner cases, but\nthings are more complex there since there is no n:1 or 1:n mapping\nbetween channel numbers and frequencies due to multiple different\nstarting frequencies in different operating classes. This could result\nin ieee80211_channel_to_frequency() returning incorrect frequency and\nieee80211_get_channel() returning incorrect channel information (or\nindication of no match). In the previous implementation, this could\nresult in some scan results being dropped completely, e.g., for the 4.9\nGHz channels. That prevented connection to such BSSs.\n\nFix this by using the driver-provided channel pointer if\nieee80211_get_channel() does not find matching channel data for the\nchannel number in the frame payload and if the scan is done with 5 MHz\nor 10 MHz channel bandwidth. While doing this, also add comments\ndescribing what the function is trying to achieve to make it easier to\nunderstand what happens here and why.\n\nSigned-off-by: Jouni Malinen <jouni@codeaurora.org>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/119f94a6fefcc76d47075b83d2b73d04c895df78"},{"sha":"cb59bc14e830028d2244861216df038165d7625d","author":{"name":"Johannes Berg","email":"bff32994ff0f8d048f262a8388145a71b6071bfe@intel.com"},"message":"mac80211: TDLS: fix skb queue/priority assignment\n\nIf the TDLS setup happens over a connection to an AP that\ndoesn't have QoS, we nevertheless assign a non-zero TID\n(skb->priority) and queue mapping, which may confuse us or\ndrivers later.\n\nFix it by just assigning the special skb->priority and then\nusing ieee80211_select_queue() just like other data frames\nwould go through.\n\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/cb59bc14e830028d2244861216df038165d7625d"},{"sha":"c42055105785580563535e6d3143cad95c7ac7ee","author":{"name":"Yuan-Chi Pang","email":"c23685774829e333643ce538a9b9476811fc0dd7@gmail.com"},"message":"mac80211: fix TX status reporting for ieee80211s\n\nTX status reporting to ieee80211s is through ieee80211s_update_metric.\nThere are two problems about ieee80211s_update_metric:\n\n1. The purpose is to estimate the fail probability\nto a specific link. No need to restrict to data frame.\n\n2. Current implementation does not work if wireless driver does not\npass tx_status with skb.\n\nFix this by removing ieee80211_is_data condition, passing\nieee80211_tx_status directly to ieee80211s_update_metric, and\nputting it in both __ieee80211_tx_status and ieee80211_tx_status_ext.\n\nSigned-off-by: Yuan-Chi Pang <fu3mo6goo@gmail.com>\nSigned-off-by: Johannes Berg <johannes.berg@intel.com>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/c42055105785580563535e6d3143cad95c7ac7ee"},{"sha":"9e1437937807b0122e8da1ca8765be2adca9aee6","author":{"name":"Steffen Klassert","email":"66deb1d63f85161cc287ce2bac0c65cb5ae958a7@secunet.com"},"message":"xfrm: Fix NULL pointer dereference when skb_dst_force clears the dst_entry.\n\nSince commit 222d7dbd258d (\"net: prevent dst uses after free\")\nskb_dst_force() might clear the dst_entry attached to the skb.\nThe xfrm code don't expect this to happen, so we crash with\na NULL pointer dereference in this case. Fix it by checking\nskb_dst(skb) for NULL after skb_dst_force() and drop the packet\nin cast the dst_entry was cleared.\n\nFixes: 222d7dbd258d (\"net: prevent dst uses after free\")\nReported-by: Tobias Hommel <netdev-list@genoetigt.de>\nReported-by: Kristian Evensen <kristian.evensen@gmail.com>\nReported-by: Wolfgang Walter <linux@stwm.de>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/9e1437937807b0122e8da1ca8765be2adca9aee6"},{"sha":"3341ba9f0f2637a51738ef5de5114e13a1cd3eca","author":{"name":"Stanislaw Gruszka","email":"1542dc81552e668e197a396f69e655c1621c300d@redhat.com"},"message":"mt76x0: fix remove_interface\n\nWe wrongly use wcid_mask instead of vif_mask. This creates problems\nwhen the interface is removed more than 8 times, for example with iw:\n\niw dev <devname> interface add <name> type <type>\niw dev <name> del\n\nThis caused 'ifconfig up' to fail with error:\n\nSIOCSIFFLAGS: No space left on device\n\nFixes: 95e444098a7b (\"mt76x0: main file\")\nReported-and-tested-by: Sid Hayn <sidhayn@gmail.com>\nSigned-off-by: Stanislaw Gruszka <sgruszka@redhat.com>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/3341ba9f0f2637a51738ef5de5114e13a1cd3eca"},{"sha":"32bf94fb5c2ec4ec842152d0e5937cd4bb6738fa","author":{"name":"Sean Tranchetti","email":"571e0db99464eba93fabd8eb087bcaf9178c708c@codeaurora.org"},"message":"xfrm: validate template mode\n\nXFRM mode parameters passed as part of the user templates\nin the IP_XFRM_POLICY are never properly validated. Passing\nvalues other than valid XFRM modes can cause stack-out-of-bounds\nreads to occur later in the XFRM processing:\n\n[  140.535608] ================================================================\n[  140.543058] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x17e4/0x1cc4\n[  140.550306] Read of size 4 at addr ffffffc0238a7a58 by task repro/5148\n[  140.557369]\n[  140.558927] Call trace:\n[  140.558936] dump_backtrace+0x0/0x388\n[  140.558940] show_stack+0x24/0x30\n[  140.558946] __dump_stack+0x24/0x2c\n[  140.558949] dump_stack+0x8c/0xd0\n[  140.558956] print_address_description+0x74/0x234\n[  140.558960] kasan_report+0x240/0x264\n[  140.558963] __asan_report_load4_noabort+0x2c/0x38\n[  140.558967] xfrm_state_find+0x17e4/0x1cc4\n[  140.558971] xfrm_resolve_and_create_bundle+0x40c/0x1fb8\n[  140.558975] xfrm_lookup+0x238/0x1444\n[  140.558977] xfrm_lookup_route+0x48/0x11c\n[  140.558984] ip_route_output_flow+0x88/0xc4\n[  140.558991] raw_sendmsg+0xa74/0x266c\n[  140.558996] inet_sendmsg+0x258/0x3b0\n[  140.559002] sock_sendmsg+0xbc/0xec\n[  140.559005] SyS_sendto+0x3a8/0x5a8\n[  140.559008] el0_svc_naked+0x34/0x38\n[  140.559009]\n[  140.592245] page dumped because: kasan: bad access detected\n[  140.597981] page_owner info is not active (free page?)\n[  140.603267]\n[  140.653503] ================================================================\n\nSigned-off-by: Sean Tranchetti <stranche@codeaurora.org>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/32bf94fb5c2ec4ec842152d0e5937cd4bb6738fa"},{"sha":"2823c8716c687d6c7e261a3a02b3cab43809fe9c","author":{"name":"Larry Finger","email":"ed0f1d78b8c21b2970494a178da4bdfa8beba2a7@lwfinger.net"},"message":"b43: fix DMA error related regression with proprietary firmware\n\nIn commit 66cffd6daab7 (\"b43: fix transmit failure when VT is switched\"),\na condition is noted where the network controller needs to be reset. Note\nthat this situation happens when running the open-source firmware\n(http://netweb.ing.unibs.it/~openfwwf/), plus a number of other special\nconditions.\n\nfor a different card model, it is reported that this change breaks\noperation running the proprietary firmware\n(https://marc.info/?l=linux-wireless&m=153504546924558&w=2). Rather\nthan reverting the previous patch, the code is tweaked to avoid the\nreset unless the open-source firmware is being used.\n\nFixes: 66cffd6daab7 (\"b43: fix transmit failure when VT is switched\")\nCc: Stable <stable@vger.kernel.org> # 4.18+\nCc: Taketo Kabe <kabe@sra-tohoku.co.jp>\nReported-and-tested-by: D. Prabhu <d.praabhu@gmail.com>\nSigned-off-by: Larry Finger <Larry.Finger@lwfinger.net>\nSigned-off-by: Kalle Valo <kvalo@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/2823c8716c687d6c7e261a3a02b3cab43809fe9c"},{"sha":"a173f066c7cfc031acb8f541708041e009fc9812","author":{"name":"David Ahern","email":"b80c1600f604d3b0d768f26f90a76757e76005dd@gmail.com"},"message":"netfilter: bridge: Don't sabotage nf_hook calls from an l3mdev\n\nFor starters, the bridge netfilter code registers operations that\nare invoked any time nh_hook is called. Specifically, ip_sabotage_in\nwatches for nested calls for NF_INET_PRE_ROUTING when a bridge is in\nthe stack.\n\nPacket wise, the bridge netfilter hook runs first. br_nf_pre_routing\nallocates nf_bridge, sets in_prerouting to 1 and calls NF_HOOK for\nNF_INET_PRE_ROUTING. It's finish function, br_nf_pre_routing_finish,\nthen resets in_prerouting flag to 0 and the packet continues up the\nstack. The packet eventually makes it to the VRF driver and it invokes\nnf_hook for NF_INET_PRE_ROUTING in case any rules have been added against\nthe vrf device.\n\nBecause of the registered operations the call to nf_hook causes\nip_sabotage_in to be invoked. That function sees the nf_bridge on the\nskb and that in_prerouting is not set. Thinking it is an invalid nested\ncall it steals (drops) the packet.\n\nUpdate ip_sabotage_in to recognize that the bridge or one of its upper\ndevices (e.g., vlan) can be enslaved to a VRF (L3 master device) and\nallow the packet to go through the nf_hook a second time.\n\nFixes: 73e20b761acf (\"net: vrf: Add support for PREROUTING rules on vrf device\")\nReported-by: D'Souza, Nelson <ndsouza@ciena.com>\nSigned-off-by: David Ahern <dsahern@gmail.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/a173f066c7cfc031acb8f541708041e009fc9812"},{"sha":"bab4344975fe2c719eda32de59298d6de26fe126","author":{"name":"Stefan Agner","email":"eb0877843acc39f8ef6f7269937dee931c372d23@agner.ch"},"message":"netfilter: nft_osf: use enum nft_data_types for nft_validate_register_store\n\nThe function nft_validate_register_store requires a struct of type\nstruct nft_data_types. NFTA_DATA_VALUE is of type enum\nnft_verdict_attributes. Pass the correct enum type.\n\nThis fixes a warning seen with Clang:\n  net/netfilter/nft_osf.c:52:8: warning: implicit conversion from\n    enumeration type 'enum nft_data_attributes' to different enumeration\n    type 'enum nft_data_types' [-Wenum-conversion]\n                                          NFTA_DATA_VALUE, NFT_OSF_MAXGENRELEN);\n                                          ^~~~~~~~~~~~~~~\n\nFixes: b96af92d6eaf (\"netfilter: nf_tables: implement Passive OS fingerprint module in nft_osf\")\nLink: https://github.com/ClangBuiltLinux/linux/issues/103\nSigned-off-by: Stefan Agner <stefan@agner.ch>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/bab4344975fe2c719eda32de59298d6de26fe126"},{"sha":"346fa83d10934cf206e2fd0f514bf8ce186f08fe","author":{"name":"zhong jiang","email":"e00b852f945f8ed516726e617fc62ab2ed3a16a5@huawei.com"},"message":"netfilter: conntrack: get rid of double sizeof\n\nsizeof(sizeof()) is quite strange and does not seem to be what\nis wanted here.\n\nThe issue is detected with the help of Coccinelle.\n\nFixes: 39215846740a (\"netfilter: conntrack: remove nlattr_size pointer from l4proto trackers\")\nSigned-off-by: zhong jiang <zhongjiang@huawei.com>\nAcked-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/346fa83d10934cf206e2fd0f514bf8ce186f08fe"},{"sha":"5b3686c7aaade973b8806dba4ecc99bec8c988f3","author":{"name":"YueHaibing","email":"87ef4e6170d5e1d30adb7567acad1fcb98f93b6e@huawei.com"},"message":"ieee802154: Use kmemdup instead of duplicating it in ca8210_test_int_driver_write\n\nReplace calls to kmalloc followed by a memcpy with a direct call to\nkmemdup.\n\nSigned-off-by: YueHaibing <yuehaibing@huawei.com>\nSigned-off-by: Stefan Schmidt <stefan@datenfreihafen.org>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/5b3686c7aaade973b8806dba4ecc99bec8c988f3"},{"sha":"98e616fe7c94f9c787092b6364405d99bdf42153","author":{"name":"zhong jiang","email":"e00b852f945f8ed516726e617fc62ab2ed3a16a5@huawei.com"},"message":"ieee802154: remove unecessary condition check before debugfs_remove_recursive\n\ndebugfs_remove_recursive has taken IS_ERR_OR_NULL into account. So just\nremove the condition check before debugfs_remove_recursive.\n\nSigned-off-by: zhong jiang <zhongjiang@huawei.com>\nSigned-off-by: Stefan Schmidt <stefan@datenfreihafen.org>","distinct":true,"url":"https://api.github.com/repos/PKRoma/linux/commits/98e616fe7c94f9c787092b6364405d99bdf42153"}]}
{"actor":{"display_login":"PKRoma"}}