{"push_id":2597459129,"size":370,"distinct_size":0,"ref":"refs/heads/korg/linux-4.14.y","head":"102b97d6241d938ac153193504a5936fc0be27ed","before":"fc72a4171174dd6b7ddefe5eeaa12cec9a162704","commits":[{"sha":"88c43b469db5d4c39fba20c293b44cbe78b66e3a","author":{"name":"Julian Anastasov","email":"84572ef2253ef81e2d8cd8c65849f4d9a3881f47@ssi.bg"},"message":"ipvs: fix rtnl_lock lockups caused by start_sync_thread\n\ncommit 5c64576a77894a50be80be0024bed27171b55989 upstream.\n\nsyzkaller reports for wrong rtnl_lock usage in sync code [1] and [2]\n\nWe have 2 problems in start_sync_thread if error path is\ntaken, eg. on memory allocation error or failure to configure\nsockets for mcast group or addr/port binding:\n\n1. recursive locking: holding rtnl_lock while calling sock_release\nwhich in turn calls again rtnl_lock in ip_mc_drop_socket to leave\nthe mcast group, as noticed by Florian Westphal. Additionally,\nsock_release can not be called while holding sync_mutex (ABBA\ndeadlock).\n\n2. task hung: holding rtnl_lock while calling kthread_stop to\nstop the running kthreads. As the kthreads do the same to leave\nthe mcast group (sock_release -> ip_mc_drop_socket -> rtnl_lock)\nthey hang.\n\nFix the problems by calling rtnl_unlock early in the error path,\nnow sock_release is called after unlocking both mutexes.\n\nProblem 3 (task hung reported by syzkaller [2]) is variant of\nproblem 2: use _trylock to prevent one user to call rtnl_lock and\nthen while waiting for sync_mutex to block kthreads that execute\nsock_release when they are stopped by stop_sync_thread.\n\n[1]\nIPVS: stopping backup sync thread 4500 ...\nWARNING: possible recursive locking detected\n4.16.0-rc7+ #3 Not tainted\n--------------------------------------------\nsyzkaller688027/4497 is trying to acquire lock:\n  (rtnl_mutex){+.+.}, at: [<00000000bb14d7fb>] rtnl_lock+0x17/0x20\nnet/core/rtnetlink.c:74\n\nbut task is already holding lock:\nIPVS: stopping backup sync thread 4495 ...\n  (rtnl_mutex){+.+.}, at: [<00000000bb14d7fb>] rtnl_lock+0x17/0x20\nnet/core/rtnetlink.c:74\n\nother info that might help us debug this:\n  Possible unsafe locking scenario:\n\n        CPU0\n        ----\n   lock(rtnl_mutex);\n   lock(rtnl_mutex);\n\n  *** DEADLOCK ***\n\n  May be due to missing lock nesting notation\n\n2 locks held by syzkaller688027/4497:\n  #0:  (rtnl_mutex){+.+.}, at: [<00000000bb14d7fb>] rtnl_lock+0x17/0x20\nnet/core/rtnetlink.c:74\n  #1:  (ipvs->sync_mutex){+.+.}, at: [<00000000703f78e3>]\ndo_ip_vs_set_ctl+0x10f8/0x1cc0 net/netfilter/ipvs/ip_vs_ctl.c:2388\n\nstack backtrace:\nCPU: 1 PID: 4497 Comm: syzkaller688027 Not tainted 4.16.0-rc7+ #3\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS\nGoogle 01/01/2011\nCall Trace:\n  __dump_stack lib/dump_stack.c:17 [inline]\n  dump_stack+0x194/0x24d lib/dump_stack.c:53\n  print_deadlock_bug kernel/locking/lockdep.c:1761 [inline]\n  check_deadlock kernel/locking/lockdep.c:1805 [inline]\n  validate_chain kernel/locking/lockdep.c:2401 [inline]\n  __lock_acquire+0xe8f/0x3e00 kernel/locking/lockdep.c:3431\n  lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920\n  __mutex_lock_common kernel/locking/mutex.c:756 [inline]\n  __mutex_lock+0x16f/0x1a80 kernel/locking/mutex.c:893\n  mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908\n  rtnl_lock+0x17/0x20 net/core/rtnetlink.c:74\n  ip_mc_drop_socket+0x88/0x230 net/ipv4/igmp.c:2643\n  inet_release+0x4e/0x1c0 net/ipv4/af_inet.c:413\n  sock_release+0x8d/0x1e0 net/socket.c:595\n  start_sync_thread+0x2213/0x2b70 net/netfilter/ipvs/ip_vs_sync.c:1924\n  do_ip_vs_set_ctl+0x1139/0x1cc0 net/netfilter/ipvs/ip_vs_ctl.c:2389\n  nf_sockopt net/netfilter/nf_sockopt.c:106 [inline]\n  nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115\n  ip_setsockopt+0x97/0xa0 net/ipv4/ip_sockglue.c:1261\n  udp_setsockopt+0x45/0x80 net/ipv4/udp.c:2406\n  sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2975\n  SYSC_setsockopt net/socket.c:1849 [inline]\n  SyS_setsockopt+0x189/0x360 net/socket.c:1828\n  do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287\n  entry_SYSCALL_64_after_hwframe+0x42/0xb7\nRIP: 0033:0x446a69\nRSP: 002b:00007fa1c3a64da8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000446a69\nRDX: 000000000000048b RSI: 0000000000000000 RDI: 0000000000000003\nRBP: 00000000006e29fc R08: 0000000000000018 R09: 0000000000000000\nR10: 00000000200000c0 R11: 0000000000000246 R12: 00000000006e29f8\nR13: 00676e697279656b R14: 00007fa1c3a659c0 R15: 00000000006e2b60\n\n[2]\nIPVS: sync thread started: state = BACKUP, mcast_ifn = syz_tun, syncid = 4,\nid = 0\nIPVS: stopping backup sync thread 25415 ...\nINFO: task syz-executor7:25421 blocked for more than 120 seconds.\n       Not tainted 4.16.0-rc6+ #284\n\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\nsyz-executor7   D23688 25421   4408 0x00000004\nCall Trace:\n  context_switch kernel/sched/core.c:2862 [inline]\n  __schedule+0x8fb/0x1ec0 kernel/sched/core.c:3440\n  schedule+0xf5/0x430 kernel/sched/core.c:3499\n  schedule_timeout+0x1a3/0x230 kernel/time/timer.c:1777\n  do_wait_for_common kernel/sched/completion.c:86 [inline]\n  __wait_for_common kernel/sched/completion.c:107 [inline]\n  wait_for_common kernel/sched/completion.c:118 [inline]\n  wait_for_completion+0x415/0x770 kernel/sched/completion.c:139\n  kthread_stop+0x14a/0x7a0 kernel/kthread.c:530\n  stop_sync_thread+0x3d9/0x740 net/netfilter/ipvs/ip_vs_sync.c:1996\n  do_ip_vs_set_ctl+0x2b1/0x1cc0 net/netfilter/ipvs/ip_vs_ctl.c:2394\n  nf_sockopt net/netfilter/nf_sockopt.c:106 [inline]\n  nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115\n  ip_setsockopt+0x97/0xa0 net/ipv4/ip_sockglue.c:1253\n  sctp_setsockopt+0x2ca/0x63e0 net/sctp/socket.c:4154\n  sock_common_setsockopt+0x95/0xd0 net/core/sock.c:3039\n  SYSC_setsockopt net/socket.c:1850 [inline]\n  SyS_setsockopt+0x189/0x360 net/socket.c:1829\n  do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287\n  entry_SYSCALL_64_after_hwframe+0x42/0xb7\nRIP: 0033:0x454889\nRSP: 002b:00007fc927626c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 00007fc9276276d4 RCX: 0000000000454889\nRDX: 000000000000048c RSI: 0000000000000000 RDI: 0000000000000017\nRBP: 000000000072bf58 R08: 0000000000000018 R09: 0000000000000000\nR10: 0000000020000000 R11: 0000000000000246 R12: 00000000ffffffff\nR13: 000000000000051c R14: 00000000006f9b40 R15: 0000000000000001\n\nShowing all locks held in the system:\n2 locks held by khungtaskd/868:\n  #0:  (rcu_read_lock){....}, at: [<00000000a1a8f002>]\ncheck_hung_uninterruptible_tasks kernel/hung_task.c:175 [inline]\n  #0:  (rcu_read_lock){....}, at: [<00000000a1a8f002>] watchdog+0x1c5/0xd60\nkernel/hung_task.c:249\n  #1:  (tasklist_lock){.+.+}, at: [<0000000037c2f8f9>]\ndebug_show_all_locks+0xd3/0x3d0 kernel/locking/lockdep.c:4470\n1 lock held by rsyslogd/4247:\n  #0:  (&f->f_pos_lock){+.+.}, at: [<000000000d8d6983>]\n__fdget_pos+0x12b/0x190 fs/file.c:765\n2 locks held by getty/4338:\n  #0:  (&tty->ldisc_sem){++++}, at: [<00000000bee98654>]\nldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365\n  #1:  (&ldata->atomic_read_lock){+.+.}, at: [<00000000c1d180aa>]\nn_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131\n2 locks held by getty/4339:\n  #0:  (&tty->ldisc_sem){++++}, at: [<00000000bee98654>]\nldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365\n  #1:  (&ldata->atomic_read_lock){+.+.}, at: [<00000000c1d180aa>]\nn_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131\n2 locks held by getty/4340:\n  #0:  (&tty->ldisc_sem){++++}, at: [<00000000bee98654>]\nldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365\n  #1:  (&ldata->atomic_read_lock){+.+.}, at: [<00000000c1d180aa>]\nn_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131\n2 locks held by getty/4341:\n  #0:  (&tty->ldisc_sem){++++}, at: [<00000000bee98654>]\nldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365\n  #1:  (&ldata->atomic_read_lock){+.+.}, at: [<00000000c1d180aa>]\nn_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131\n2 locks held by getty/4342:\n  #0:  (&tty->ldisc_sem){++++}, at: [<00000000bee98654>]\nldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365\n  #1:  (&ldata->atomic_read_lock){+.+.}, at: [<00000000c1d180aa>]\nn_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131\n2 locks held by getty/4343:\n  #0:  (&tty->ldisc_sem){++++}, at: [<00000000bee98654>]\nldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365\n  #1:  (&ldata->atomic_read_lock){+.+.}, at: [<00000000c1d180aa>]\nn_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131\n2 locks held by getty/4344:\n  #0:  (&tty->ldisc_sem){++++}, at: [<00000000bee98654>]\nldsem_down_read+0x37/0x40 drivers/tty/tty_ldsem.c:365\n  #1:  (&ldata->atomic_read_lock){+.+.}, at: [<00000000c1d180aa>]\nn_tty_read+0x2ef/0x1a40 drivers/tty/n_tty.c:2131\n3 locks held by kworker/0:5/6494:\n  #0:  ((wq_completion)\"%s\"(\"ipv6_addrconf\")){+.+.}, at:\n[<00000000a062b18e>] work_static include/linux/workqueue.h:198 [inline]\n  #0:  ((wq_completion)\"%s\"(\"ipv6_addrconf\")){+.+.}, at:\n[<00000000a062b18e>] set_work_data kernel/workqueue.c:619 [inline]\n  #0:  ((wq_completion)\"%s\"(\"ipv6_addrconf\")){+.+.}, at:\n[<00000000a062b18e>] set_work_pool_and_clear_pending kernel/workqueue.c:646\n[inline]\n  #0:  ((wq_completion)\"%s\"(\"ipv6_addrconf\")){+.+.}, at:\n[<00000000a062b18e>] process_one_work+0xb12/0x1bb0 kernel/workqueue.c:2084\n  #1:  ((addr_chk_work).work){+.+.}, at: [<00000000278427d5>]\nprocess_one_work+0xb89/0x1bb0 kernel/workqueue.c:2088\n  #2:  (rtnl_mutex){+.+.}, at: [<00000000066e35ac>] rtnl_lock+0x17/0x20\nnet/core/rtnetlink.c:74\n1 lock held by syz-executor7/25421:\n  #0:  (ipvs->sync_mutex){+.+.}, at: [<00000000d414a689>]\ndo_ip_vs_set_ctl+0x277/0x1cc0 net/netfilter/ipvs/ip_vs_ctl.c:2393\n2 locks held by syz-executor7/25427:\n  #0:  (rtnl_mutex){+.+.}, at: [<00000000066e35ac>] rtnl_lock+0x17/0x20\nnet/core/rtnetlink.c:74\n  #1:  (ipvs->sync_mutex){+.+.}, at: [<00000000e6d48489>]\ndo_ip_vs_set_ctl+0x10f8/0x1cc0 net/netfilter/ipvs/ip_vs_ctl.c:2388\n1 lock held by syz-executor7/25435:\n  #0:  (rtnl_mutex){+.+.}, at: [<00000000066e35ac>] rtnl_lock+0x17/0x20\nnet/core/rtnetlink.c:74\n1 lock held by ipvs-b:2:0/25415:\n  #0:  (rtnl_mutex){+.+.}, at: [<00000000066e35ac>] rtnl_lock+0x17/0x20\nnet/core/rtnetlink.c:74\n\nReported-and-tested-by: syzbot+a46d6abf9d56b1365a72@syzkaller.appspotmail.com\nReported-and-tested-by: syzbot+5fe074c01b2032ce9618@syzkaller.appspotmail.com\nFixes: e0b26cc997d5 (\"ipvs: call rtnl_lock early\")\nSigned-off-by: Julian Anastasov <ja@ssi.bg>\nSigned-off-by: Simon Horman <horms@verge.net.au>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nCc: Zubin Mithra <zsm@chromium.org>\nCc: Guenter Roeck <groeck@chromium.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/88c43b469db5d4c39fba20c293b44cbe78b66e3a"},{"sha":"725f5ae1a6953143101c4e4b963bb5221aa5c466","author":{"name":"Florian Westphal","email":"cef439e78636cdab99cd2923826c5065a0743e5b@strlen.de"},"message":"netfilter: ebtables: don't attempt to allocate 0-sized compat array\n\ncommit 3f1e53abff84cf40b1adb3455d480dd295bf42e8 upstream.\n\nDmitry reports 32bit ebtables on 64bit kernel got broken by\na recent change that returns -EINVAL when ruleset has no entries.\n\nebtables however only counts user-defined chains, so for the\ninitial table nentries will be 0.\n\nDon't try to allocate the compat array in this case, as no user\ndefined rules exist no rule will need 64bit translation.\n\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nFixes: 7d7d7e02111e9 (\"netfilter: compat: reject huge allocation requests\")\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/725f5ae1a6953143101c4e4b963bb5221aa5c466"},{"sha":"19042316b9e12c93bf334a04d4dd7a4e846c7311","author":{"name":"Tom Herbert","email":"96835dd8bfa718bd6447ccc87af89ae1675daeca@quantonium.net"},"message":"kcm: Call strp_stop before strp_done in kcm_attach\n\ncommit dff8baa261174de689a44572d0ea182d7aa70598 upstream.\n\nIn kcm_attach strp_done is called when sk_user_data is already\nset to fail the attach. strp_done needs the strp to be stopped and\nwarns if it isn't. Call strp_stop in this case to eliminate the\nwarning message.\n\nReported-by: syzbot+88dfb55e4c8b770d86e3@syzkaller.appspotmail.com\nFixes: e5571240236c5652f (\"kcm: Check if sk_user_data already set in kcm_attach\"\nSigned-off-by: Tom Herbert <tom@quantonium.net>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/19042316b9e12c93bf334a04d4dd7a4e846c7311"},{"sha":"1b6d0db7ed22902dee6cdbf253eed1fe46294abc","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"crypto: af_alg - fix possible uninit-value in alg_bind()\n\ncommit a466856e0b7ab269cdf9461886d007e88ff575b0 upstream.\n\nsyzbot reported :\n\nBUG: KMSAN: uninit-value in alg_bind+0xe3/0xd90 crypto/af_alg.c:162\n\nWe need to check addr_len before dereferencing sa (or uaddr)\n\nFixes: bb30b8848c85 (\"crypto: af_alg - whitelist mask and type\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nCc: Stephan Mueller <smueller@chronox.de>\nCc: Herbert Xu <herbert@gondor.apana.org.au>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/1b6d0db7ed22902dee6cdbf253eed1fe46294abc"},{"sha":"bf2ecb934603cf56d6cdc6fb4b91c9fa942f8ca7","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"netlink: fix uninit-value in netlink_sendmsg\n\ncommit 6091f09c2f79730d895149bcfe3d66140288cd0e upstream.\n\nsyzbot reported :\n\nBUG: KMSAN: uninit-value in ffs arch/x86/include/asm/bitops.h:432 [inline]\nBUG: KMSAN: uninit-value in netlink_sendmsg+0xb26/0x1310 net/netlink/af_netlink.c:1851\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/bf2ecb934603cf56d6cdc6fb4b91c9fa942f8ca7"},{"sha":"ced9763b911d66ab4da4a9edf2a8d3ce29238af8","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"net: fix rtnh_ok()\n\ncommit b1993a2de12c9e75c35729e2ffbc3a92d50c0d31 upstream.\n\nsyzbot reported :\n\nBUG: KMSAN: uninit-value in rtnh_ok include/net/nexthop.h:11 [inline]\nBUG: KMSAN: uninit-value in fib_count_nexthops net/ipv4/fib_semantics.c:469 [inline]\nBUG: KMSAN: uninit-value in fib_create_info+0x554/0x8d20 net/ipv4/fib_semantics.c:1091\n\n@remaining is an integer, coming from user space.\nIf it is negative we want rtnh_ok() to return false.\n\nFixes: 4e902c57417c (\"[IPv4]: FIB configuration using struct fib_config\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/ced9763b911d66ab4da4a9edf2a8d3ce29238af8"},{"sha":"5652aed1de29c6e977608effa94ce217f3b959e7","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"net: initialize skb->peeked when cloning\n\ncommit b13dda9f9aa7caceeee61c080c2e544d5f5d85e5 upstream.\n\nsyzbot reported __skb_try_recv_from_queue() was using skb->peeked\nwhile it was potentially unitialized.\n\nWe need to clear it in __skb_clone()\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/5652aed1de29c6e977608effa94ce217f3b959e7"},{"sha":"f9327803193a9cef1522ee5fd25711fcd67c1d04","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"net: fix uninit-value in __hw_addr_add_ex()\n\ncommit 77d36398d99f2565c0a8d43a86fd520a82e64bb8 upstream.\n\nsyzbot complained :\n\nBUG: KMSAN: uninit-value in memcmp+0x119/0x180 lib/string.c:861\nCPU: 0 PID: 3 Comm: kworker/0:0 Not tainted 4.16.0+ #82\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nWorkqueue: ipv6_addrconf addrconf_dad_work\nCall Trace:\n __dump_stack lib/dump_stack.c:17 [inline]\n dump_stack+0x185/0x1d0 lib/dump_stack.c:53\n kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067\n __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:676\n memcmp+0x119/0x180 lib/string.c:861\n __hw_addr_add_ex net/core/dev_addr_lists.c:60 [inline]\n __dev_mc_add+0x1c2/0x8e0 net/core/dev_addr_lists.c:670\n dev_mc_add+0x6d/0x80 net/core/dev_addr_lists.c:687\n igmp6_group_added+0x2db/0xa00 net/ipv6/mcast.c:662\n ipv6_dev_mc_inc+0xe9e/0x1130 net/ipv6/mcast.c:914\n addrconf_join_solict net/ipv6/addrconf.c:2078 [inline]\n addrconf_dad_begin net/ipv6/addrconf.c:3828 [inline]\n addrconf_dad_work+0x427/0x2150 net/ipv6/addrconf.c:3954\n process_one_work+0x12c6/0x1f60 kernel/workqueue.c:2113\n worker_thread+0x113c/0x24f0 kernel/workqueue.c:2247\n kthread+0x539/0x720 kernel/kthread.c:239\n\nFixes: f001fde5eadd (\"net: introduce a list of device addresses dev_addr_list (v6)\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/f9327803193a9cef1522ee5fd25711fcd67c1d04"},{"sha":"09e45996b3e716693333b998f9fe77df8bc6de50","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"dccp: initialize ireq->ir_mark\n\ncommit b855ff827476adbdc2259e9895681d82b7b26065 upstream.\n\nsyzbot reported an uninit-value read of skb->mark in iptable_mangle_hook()\n\nThanks to the nice report, I tracked the problem to dccp not caring\nof ireq->ir_mark for passive sessions.\n\nBUG: KMSAN: uninit-value in ipt_mangle_out net/ipv4/netfilter/iptable_mangle.c:66 [inline]\nBUG: KMSAN: uninit-value in iptable_mangle_hook+0x5e5/0x720 net/ipv4/netfilter/iptable_mangle.c:84\nCPU: 0 PID: 5300 Comm: syz-executor3 Not tainted 4.16.0+ #81\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:17 [inline]\n dump_stack+0x185/0x1d0 lib/dump_stack.c:53\n kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067\n __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:676\n ipt_mangle_out net/ipv4/netfilter/iptable_mangle.c:66 [inline]\n iptable_mangle_hook+0x5e5/0x720 net/ipv4/netfilter/iptable_mangle.c:84\n nf_hook_entry_hookfn include/linux/netfilter.h:120 [inline]\n nf_hook_slow+0x158/0x3d0 net/netfilter/core.c:483\n nf_hook include/linux/netfilter.h:243 [inline]\n __ip_local_out net/ipv4/ip_output.c:113 [inline]\n ip_local_out net/ipv4/ip_output.c:122 [inline]\n ip_queue_xmit+0x1d21/0x21c0 net/ipv4/ip_output.c:504\n dccp_transmit_skb+0x15eb/0x1900 net/dccp/output.c:142\n dccp_xmit_packet+0x814/0x9e0 net/dccp/output.c:281\n dccp_write_xmit+0x20f/0x480 net/dccp/output.c:363\n dccp_sendmsg+0x12ca/0x12d0 net/dccp/proto.c:818\n inet_sendmsg+0x48d/0x740 net/ipv4/af_inet.c:764\n sock_sendmsg_nosec net/socket.c:630 [inline]\n sock_sendmsg net/socket.c:640 [inline]\n ___sys_sendmsg+0xec0/0x1310 net/socket.c:2046\n __sys_sendmsg net/socket.c:2080 [inline]\n SYSC_sendmsg+0x2a3/0x3d0 net/socket.c:2091\n SyS_sendmsg+0x54/0x80 net/socket.c:2087\n do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x3d/0xa2\nRIP: 0033:0x455259\nRSP: 002b:00007f1a4473dc68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f1a4473e6d4 RCX: 0000000000455259\nRDX: 0000000000000000 RSI: 0000000020b76fc8 RDI: 0000000000000015\nRBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff\nR13: 00000000000004f0 R14: 00000000006fa720 R15: 0000000000000000\n\nUninit was stored to memory at:\n kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]\n kmsan_save_stack mm/kmsan/kmsan.c:293 [inline]\n kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:684\n __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:521\n ip_queue_xmit+0x1e35/0x21c0 net/ipv4/ip_output.c:502\n dccp_transmit_skb+0x15eb/0x1900 net/dccp/output.c:142\n dccp_xmit_packet+0x814/0x9e0 net/dccp/output.c:281\n dccp_write_xmit+0x20f/0x480 net/dccp/output.c:363\n dccp_sendmsg+0x12ca/0x12d0 net/dccp/proto.c:818\n inet_sendmsg+0x48d/0x740 net/ipv4/af_inet.c:764\n sock_sendmsg_nosec net/socket.c:630 [inline]\n sock_sendmsg net/socket.c:640 [inline]\n ___sys_sendmsg+0xec0/0x1310 net/socket.c:2046\n __sys_sendmsg net/socket.c:2080 [inline]\n SYSC_sendmsg+0x2a3/0x3d0 net/socket.c:2091\n SyS_sendmsg+0x54/0x80 net/socket.c:2087\n do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x3d/0xa2\nUninit was stored to memory at:\n kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]\n kmsan_save_stack mm/kmsan/kmsan.c:293 [inline]\n kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:684\n __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:521\n inet_csk_clone_lock+0x503/0x580 net/ipv4/inet_connection_sock.c:797\n dccp_create_openreq_child+0x7f/0x890 net/dccp/minisocks.c:92\n dccp_v4_request_recv_sock+0x22c/0xe90 net/dccp/ipv4.c:408\n dccp_v6_request_recv_sock+0x290/0x2000 net/dccp/ipv6.c:414\n dccp_check_req+0x7b9/0x8f0 net/dccp/minisocks.c:197\n dccp_v4_rcv+0x12e4/0x2630 net/dccp/ipv4.c:840\n ip_local_deliver_finish+0x6ed/0xd40 net/ipv4/ip_input.c:216\n NF_HOOK include/linux/netfilter.h:288 [inline]\n ip_local_deliver+0x43c/0x4e0 net/ipv4/ip_input.c:257\n dst_input include/net/dst.h:449 [inline]\n ip_rcv_finish+0x1253/0x16d0 net/ipv4/ip_input.c:397\n NF_HOOK include/linux/netfilter.h:288 [inline]\n ip_rcv+0x119d/0x16f0 net/ipv4/ip_input.c:493\n __netif_receive_skb_core+0x47cf/0x4a80 net/core/dev.c:4562\n __netif_receive_skb net/core/dev.c:4627 [inline]\n process_backlog+0x62d/0xe20 net/core/dev.c:5307\n napi_poll net/core/dev.c:5705 [inline]\n net_rx_action+0x7c1/0x1a70 net/core/dev.c:5771\n __do_softirq+0x56d/0x93d kernel/softirq.c:285\nUninit was created at:\n kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]\n kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188\n kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314\n kmem_cache_alloc+0xaab/0xb90 mm/slub.c:2756\n reqsk_alloc include/net/request_sock.h:88 [inline]\n inet_reqsk_alloc+0xc4/0x7f0 net/ipv4/tcp_input.c:6145\n dccp_v4_conn_request+0x5cc/0x1770 net/dccp/ipv4.c:600\n dccp_v6_conn_request+0x299/0x1880 net/dccp/ipv6.c:317\n dccp_rcv_state_process+0x2ea/0x2410 net/dccp/input.c:612\n dccp_v4_do_rcv+0x229/0x340 net/dccp/ipv4.c:682\n dccp_v6_do_rcv+0x16d/0x1220 net/dccp/ipv6.c:578\n sk_backlog_rcv include/net/sock.h:908 [inline]\n __sk_receive_skb+0x60e/0xf20 net/core/sock.c:513\n dccp_v4_rcv+0x24d4/0x2630 net/dccp/ipv4.c:874\n ip_local_deliver_finish+0x6ed/0xd40 net/ipv4/ip_input.c:216\n NF_HOOK include/linux/netfilter.h:288 [inline]\n ip_local_deliver+0x43c/0x4e0 net/ipv4/ip_input.c:257\n dst_input include/net/dst.h:449 [inline]\n ip_rcv_finish+0x1253/0x16d0 net/ipv4/ip_input.c:397\n NF_HOOK include/linux/netfilter.h:288 [inline]\n ip_rcv+0x119d/0x16f0 net/ipv4/ip_input.c:493\n __netif_receive_skb_core+0x47cf/0x4a80 net/core/dev.c:4562\n __netif_receive_skb net/core/dev.c:4627 [inline]\n process_backlog+0x62d/0xe20 net/core/dev.c:5307\n napi_poll net/core/dev.c:5705 [inline]\n net_rx_action+0x7c1/0x1a70 net/core/dev.c:5771\n __do_softirq+0x56d/0x93d kernel/softirq.c:285\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/09e45996b3e716693333b998f9fe77df8bc6de50"},{"sha":"154ff3e040157fe869a60f316ce56d9ba0e7468c","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"ipv4: fix uninit-value in ip_route_output_key_hash_rcu()\n\ncommit d0ea2b12500543535be3f54e17920fffc9bb45f6 upstream.\n\nsyzbot complained that res.type could be used while not initialized.\n\nUsing RTN_UNSPEC as initial value seems better than using garbage.\n\nBUG: KMSAN: uninit-value in __mkroute_output net/ipv4/route.c:2200 [inline]\nBUG: KMSAN: uninit-value in ip_route_output_key_hash_rcu+0x31f0/0x3940 net/ipv4/route.c:2493\nCPU: 1 PID: 12207 Comm: syz-executor0 Not tainted 4.16.0+ #81\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:17 [inline]\n dump_stack+0x185/0x1d0 lib/dump_stack.c:53\n kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067\n __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:676\n __mkroute_output net/ipv4/route.c:2200 [inline]\n ip_route_output_key_hash_rcu+0x31f0/0x3940 net/ipv4/route.c:2493\n ip_route_output_key_hash net/ipv4/route.c:2322 [inline]\n __ip_route_output_key include/net/route.h:126 [inline]\n ip_route_output_flow+0x1eb/0x3c0 net/ipv4/route.c:2577\n raw_sendmsg+0x1861/0x3ed0 net/ipv4/raw.c:653\n inet_sendmsg+0x48d/0x740 net/ipv4/af_inet.c:764\n sock_sendmsg_nosec net/socket.c:630 [inline]\n sock_sendmsg net/socket.c:640 [inline]\n SYSC_sendto+0x6c3/0x7e0 net/socket.c:1747\n SyS_sendto+0x8a/0xb0 net/socket.c:1715\n do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x3d/0xa2\nRIP: 0033:0x455259\nRSP: 002b:00007fdc0625dc68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 00007fdc0625e6d4 RCX: 0000000000455259\nRDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000013\nRBP: 000000000072bea0 R08: 0000000020000080 R09: 0000000000000010\nR10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff\nR13: 00000000000004f7 R14: 00000000006fa7c8 R15: 0000000000000000\n\nLocal variable description: ----res.i.i@ip_route_output_flow\nVariable was created at:\n ip_route_output_flow+0x75/0x3c0 net/ipv4/route.c:2576\n raw_sendmsg+0x1861/0x3ed0 net/ipv4/raw.c:653\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/154ff3e040157fe869a60f316ce56d9ba0e7468c"},{"sha":"566804864cd98ea75c6792d9c4da015057980d66","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"soreuseport: initialise timewait reuseport field\n\ncommit 3099a52918937ab86ec47038ad80d377ba16c531 upstream.\n\nsyzbot reported an uninit-value in inet_csk_bind_conflict() [1]\n\nIt turns out we never propagated sk->sk_reuseport into timewait socket.\n\n[1]\nBUG: KMSAN: uninit-value in inet_csk_bind_conflict+0x5f9/0x990 net/ipv4/inet_connection_sock.c:151\nCPU: 1 PID: 3589 Comm: syzkaller008242 Not tainted 4.16.0+ #82\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:17 [inline]\n dump_stack+0x185/0x1d0 lib/dump_stack.c:53\n kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067\n __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:676\n inet_csk_bind_conflict+0x5f9/0x990 net/ipv4/inet_connection_sock.c:151\n inet_csk_get_port+0x1d28/0x1e40 net/ipv4/inet_connection_sock.c:320\n inet6_bind+0x121c/0x1820 net/ipv6/af_inet6.c:399\n SYSC_bind+0x3f2/0x4b0 net/socket.c:1474\n SyS_bind+0x54/0x80 net/socket.c:1460\n do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x3d/0xa2\nRIP: 0033:0x4416e9\nRSP: 002b:00007ffce6d15c88 EFLAGS: 00000217 ORIG_RAX: 0000000000000031\nRAX: ffffffffffffffda RBX: 0100000000000000 RCX: 00000000004416e9\nRDX: 000000000000001c RSI: 0000000020402000 RDI: 0000000000000004\nRBP: 0000000000000000 R08: 00000000e6d15e08 R09: 00000000e6d15e08\nR10: 0000000000000004 R11: 0000000000000217 R12: 0000000000009478\nR13: 00000000006cd448 R14: 0000000000000000 R15: 0000000000000000\n\nUninit was stored to memory at:\n kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]\n kmsan_save_stack mm/kmsan/kmsan.c:293 [inline]\n kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:684\n __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:521\n tcp_time_wait+0xf17/0xf50 net/ipv4/tcp_minisocks.c:283\n tcp_rcv_state_process+0xebe/0x6490 net/ipv4/tcp_input.c:6003\n tcp_v6_do_rcv+0x11dd/0x1d90 net/ipv6/tcp_ipv6.c:1331\n sk_backlog_rcv include/net/sock.h:908 [inline]\n __release_sock+0x2d6/0x680 net/core/sock.c:2271\n release_sock+0x97/0x2a0 net/core/sock.c:2786\n tcp_close+0x277/0x18f0 net/ipv4/tcp.c:2269\n inet_release+0x240/0x2a0 net/ipv4/af_inet.c:427\n inet6_release+0xaf/0x100 net/ipv6/af_inet6.c:435\n sock_release net/socket.c:595 [inline]\n sock_close+0xe0/0x300 net/socket.c:1149\n __fput+0x49e/0xa10 fs/file_table.c:209\n ____fput+0x37/0x40 fs/file_table.c:243\n task_work_run+0x243/0x2c0 kernel/task_work.c:113\n exit_task_work include/linux/task_work.h:22 [inline]\n do_exit+0x10e1/0x38d0 kernel/exit.c:867\n do_group_exit+0x1a0/0x360 kernel/exit.c:970\n SYSC_exit_group+0x21/0x30 kernel/exit.c:981\n SyS_exit_group+0x25/0x30 kernel/exit.c:979\n do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x3d/0xa2\nUninit was stored to memory at:\n kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]\n kmsan_save_stack mm/kmsan/kmsan.c:293 [inline]\n kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:684\n __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:521\n inet_twsk_alloc+0xaef/0xc00 net/ipv4/inet_timewait_sock.c:182\n tcp_time_wait+0xd9/0xf50 net/ipv4/tcp_minisocks.c:258\n tcp_rcv_state_process+0xebe/0x6490 net/ipv4/tcp_input.c:6003\n tcp_v6_do_rcv+0x11dd/0x1d90 net/ipv6/tcp_ipv6.c:1331\n sk_backlog_rcv include/net/sock.h:908 [inline]\n __release_sock+0x2d6/0x680 net/core/sock.c:2271\n release_sock+0x97/0x2a0 net/core/sock.c:2786\n tcp_close+0x277/0x18f0 net/ipv4/tcp.c:2269\n inet_release+0x240/0x2a0 net/ipv4/af_inet.c:427\n inet6_release+0xaf/0x100 net/ipv6/af_inet6.c:435\n sock_release net/socket.c:595 [inline]\n sock_close+0xe0/0x300 net/socket.c:1149\n __fput+0x49e/0xa10 fs/file_table.c:209\n ____fput+0x37/0x40 fs/file_table.c:243\n task_work_run+0x243/0x2c0 kernel/task_work.c:113\n exit_task_work include/linux/task_work.h:22 [inline]\n do_exit+0x10e1/0x38d0 kernel/exit.c:867\n do_group_exit+0x1a0/0x360 kernel/exit.c:970\n SYSC_exit_group+0x21/0x30 kernel/exit.c:981\n SyS_exit_group+0x25/0x30 kernel/exit.c:979\n do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x3d/0xa2\nUninit was created at:\n kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]\n kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188\n kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314\n kmem_cache_alloc+0xaab/0xb90 mm/slub.c:2756\n inet_twsk_alloc+0x13b/0xc00 net/ipv4/inet_timewait_sock.c:163\n tcp_time_wait+0xd9/0xf50 net/ipv4/tcp_minisocks.c:258\n tcp_rcv_state_process+0xebe/0x6490 net/ipv4/tcp_input.c:6003\n tcp_v6_do_rcv+0x11dd/0x1d90 net/ipv6/tcp_ipv6.c:1331\n sk_backlog_rcv include/net/sock.h:908 [inline]\n __release_sock+0x2d6/0x680 net/core/sock.c:2271\n release_sock+0x97/0x2a0 net/core/sock.c:2786\n tcp_close+0x277/0x18f0 net/ipv4/tcp.c:2269\n inet_release+0x240/0x2a0 net/ipv4/af_inet.c:427\n inet6_release+0xaf/0x100 net/ipv6/af_inet6.c:435\n sock_release net/socket.c:595 [inline]\n sock_close+0xe0/0x300 net/socket.c:1149\n __fput+0x49e/0xa10 fs/file_table.c:209\n ____fput+0x37/0x40 fs/file_table.c:243\n task_work_run+0x243/0x2c0 kernel/task_work.c:113\n exit_task_work include/linux/task_work.h:22 [inline]\n do_exit+0x10e1/0x38d0 kernel/exit.c:867\n do_group_exit+0x1a0/0x360 kernel/exit.c:970\n SYSC_exit_group+0x21/0x30 kernel/exit.c:981\n SyS_exit_group+0x25/0x30 kernel/exit.c:979\n do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x3d/0xa2\n\nFixes: da5e36308d9f (\"soreuseport: TCP/IPv4 implementation\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/566804864cd98ea75c6792d9c4da015057980d66"},{"sha":"ac91ff2a5f12309dc90404042e3ad788fab3cfdb","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"inetpeer: fix uninit-value in inet_getpeer\n\ncommit b6a37e5e25414df4b8e9140a5c6f5ee0ec6f3b90 upstream.\n\nsyzbot/KMSAN reported that p->dtime was read while it was\nnot yet initialized in :\n\n\tdelta = (__u32)jiffies - p->dtime;\n\tif (delta < ttl || !refcount_dec_if_one(&p->refcnt))\n\t\tgc_stack[i] = NULL;\n\nThis is a false positive, because the inetpeer wont be erased\nfrom rb-tree if the refcount_dec_if_one(&p->refcnt) does not\nsucceed. And this wont happen before first inet_putpeer() call\nfor this inetpeer has been done, and ->dtime field is written\nexactly before the refcount_dec_and_test(&p->refcnt).\n\nThe KMSAN report was :\n\nBUG: KMSAN: uninit-value in inet_peer_gc net/ipv4/inetpeer.c:163 [inline]\nBUG: KMSAN: uninit-value in inet_getpeer+0x1567/0x1e70 net/ipv4/inetpeer.c:228\nCPU: 0 PID: 9494 Comm: syz-executor5 Not tainted 4.16.0+ #82\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:17 [inline]\n dump_stack+0x185/0x1d0 lib/dump_stack.c:53\n kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067\n __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:676\n inet_peer_gc net/ipv4/inetpeer.c:163 [inline]\n inet_getpeer+0x1567/0x1e70 net/ipv4/inetpeer.c:228\n inet_getpeer_v4 include/net/inetpeer.h:110 [inline]\n icmpv4_xrlim_allow net/ipv4/icmp.c:330 [inline]\n icmp_send+0x2b44/0x3050 net/ipv4/icmp.c:725\n ip_options_compile+0x237c/0x29f0 net/ipv4/ip_options.c:472\n ip_rcv_options net/ipv4/ip_input.c:284 [inline]\n ip_rcv_finish+0xda8/0x16d0 net/ipv4/ip_input.c:365\n NF_HOOK include/linux/netfilter.h:288 [inline]\n ip_rcv+0x119d/0x16f0 net/ipv4/ip_input.c:493\n __netif_receive_skb_core+0x47cf/0x4a80 net/core/dev.c:4562\n __netif_receive_skb net/core/dev.c:4627 [inline]\n netif_receive_skb_internal+0x49d/0x630 net/core/dev.c:4701\n netif_receive_skb+0x230/0x240 net/core/dev.c:4725\n tun_rx_batched drivers/net/tun.c:1555 [inline]\n tun_get_user+0x6d88/0x7580 drivers/net/tun.c:1962\n tun_chr_write_iter+0x1d4/0x330 drivers/net/tun.c:1990\n do_iter_readv_writev+0x7bb/0x970 include/linux/fs.h:1776\n do_iter_write+0x30d/0xd40 fs/read_write.c:932\n vfs_writev fs/read_write.c:977 [inline]\n do_writev+0x3c9/0x830 fs/read_write.c:1012\n SYSC_writev+0x9b/0xb0 fs/read_write.c:1085\n SyS_writev+0x56/0x80 fs/read_write.c:1082\n do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x3d/0xa2\nRIP: 0033:0x455111\nRSP: 002b:00007fae0365cba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000014\nRAX: ffffffffffffffda RBX: 000000000000002e RCX: 0000000000455111\nRDX: 0000000000000001 RSI: 00007fae0365cbf0 RDI: 00000000000000fc\nRBP: 0000000020000040 R08: 00000000000000fc R09: 0000000000000000\nR10: 000000000000002e R11: 0000000000000293 R12: 00000000ffffffff\nR13: 0000000000000658 R14: 00000000006fc8e0 R15: 0000000000000000\n\nUninit was created at:\n kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]\n kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188\n kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314\n kmem_cache_alloc+0xaab/0xb90 mm/slub.c:2756\n inet_getpeer+0xed8/0x1e70 net/ipv4/inetpeer.c:210\n inet_getpeer_v4 include/net/inetpeer.h:110 [inline]\n ip4_frag_init+0x4d1/0x740 net/ipv4/ip_fragment.c:153\n inet_frag_alloc net/ipv4/inet_fragment.c:369 [inline]\n inet_frag_create net/ipv4/inet_fragment.c:385 [inline]\n inet_frag_find+0x7da/0x1610 net/ipv4/inet_fragment.c:418\n ip_find net/ipv4/ip_fragment.c:275 [inline]\n ip_defrag+0x448/0x67a0 net/ipv4/ip_fragment.c:676\n ip_check_defrag+0x775/0xda0 net/ipv4/ip_fragment.c:724\n packet_rcv_fanout+0x2a8/0x8d0 net/packet/af_packet.c:1447\n deliver_skb net/core/dev.c:1897 [inline]\n deliver_ptype_list_skb net/core/dev.c:1912 [inline]\n __netif_receive_skb_core+0x314a/0x4a80 net/core/dev.c:4545\n __netif_receive_skb net/core/dev.c:4627 [inline]\n netif_receive_skb_internal+0x49d/0x630 net/core/dev.c:4701\n netif_receive_skb+0x230/0x240 net/core/dev.c:4725\n tun_rx_batched drivers/net/tun.c:1555 [inline]\n tun_get_user+0x6d88/0x7580 drivers/net/tun.c:1962\n tun_chr_write_iter+0x1d4/0x330 drivers/net/tun.c:1990\n do_iter_readv_writev+0x7bb/0x970 include/linux/fs.h:1776\n do_iter_write+0x30d/0xd40 fs/read_write.c:932\n vfs_writev fs/read_write.c:977 [inline]\n do_writev+0x3c9/0x830 fs/read_write.c:1012\n SYSC_writev+0x9b/0xb0 fs/read_write.c:1085\n SyS_writev+0x56/0x80 fs/read_write.c:1082\n do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287\n entry_SYSCALL_64_after_hwframe+0x3d/0xa2\n\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/ac91ff2a5f12309dc90404042e3ad788fab3cfdb"},{"sha":"17ffa29c355658c8e9b19f56cbf0388500ca7905","author":{"name":"Michal Hocko","email":"829500b200af6c2a0eca4dfd5c388e6b8fbe8dc6@suse.com"},"message":"memcg: fix per_node_info cleanup\n\ncommit 4eaf431f6f71bbed40a4c733ffe93a7e8cedf9d9 upstream.\n\nsyzbot has triggered a NULL ptr dereference when allocation fault\ninjection enforces a failure and alloc_mem_cgroup_per_node_info\ninitializes memcg->nodeinfo only half way through.\n\nBut __mem_cgroup_free still tries to free all per-node data and\ndereferences pn->lruvec_stat_cpu unconditioanlly even if the specific\nper-node data hasn't been initialized.\n\nThe bug is quite unlikely to hit because small allocations do not fail\nand we would need quite some numa nodes to make struct\nmem_cgroup_per_node large enough to cross the costly order.\n\nLink: http://lkml.kernel.org/r/20180406100906.17790-1-mhocko@kernel.org\nReported-by: syzbot+8a5de3cce7cdc70e9ebe@syzkaller.appspotmail.com\nFixes: 00f3ca2c2d66 (\"mm: memcontrol: per-lruvec stats infrastructure\")\nSigned-off-by: Michal Hocko <mhocko@suse.com>\nReviewed-by: Andrey Ryabinin <aryabinin@virtuozzo.com>\nCc: Johannes Weiner <hannes@cmpxchg.org>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/17ffa29c355658c8e9b19f56cbf0388500ca7905"},{"sha":"108cd022c59b551e0849489750ab26e3f28af07d","author":{"name":"Jiri Olsa","email":"2c6594f608aa3d41e98d48846a6328831f7084ad@kernel.org"},"message":"perf: Remove superfluous allocation error check\n\ncommit bfb3d7b8b906b66551424d7636182126e1d134c8 upstream.\n\nIf the get_callchain_buffers fails to allocate the buffer it will\ndecrease the nr_callchain_events right away.\n\nThere's no point of checking the allocation error for\nnr_callchain_events > 1. Removing that check.\n\nSigned-off-by: Jiri Olsa <jolsa@kernel.org>\nTested-by: Arnaldo Carvalho de Melo <acme@redhat.com>\nCc: Alexander Shishkin <alexander.shishkin@linux.intel.com>\nCc: Andi Kleen <andi@firstfloor.org>\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: Namhyung Kim <namhyung@kernel.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: syzkaller-bugs@googlegroups.com\nCc: x86@kernel.org\nLink: http://lkml.kernel.org/r/20180415092352.12403-3-jolsa@kernel.org\nSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/108cd022c59b551e0849489750ab26e3f28af07d"},{"sha":"8c12bd91b59746140466e03d53049ae0c1b3f858","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"tcp: fix TCP_REPAIR_QUEUE bound checking\n\ncommit bf2acc943a45d2b2e8a9f1a5ddff6b6e43cc69d9 upstream.\n\nsyzbot is able to produce a nasty WARN_ON() in tcp_verify_left_out()\nwith following C-repro :\n\nsocket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3\nsetsockopt(3, SOL_TCP, TCP_REPAIR, [1], 4) = 0\nsetsockopt(3, SOL_TCP, TCP_REPAIR_QUEUE, [-1], 4) = 0\nbind(3, {sa_family=AF_INET, sin_port=htons(20002), sin_addr=inet_addr(\"0.0.0.0\")}, 16) = 0\nsendto(3, \"\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\"...,\n\t1242, MSG_FASTOPEN, {sa_family=AF_INET, sin_port=htons(20002), sin_addr=inet_addr(\"127.0.0.1\")}, 16) = 1242\nsetsockopt(3, SOL_TCP, TCP_REPAIR_WINDOW, \"\\4\\0\\0@+\\205\\0\\0\\377\\377\\0\\0\\377\\377\\377\\177\\0\\0\\0\\0\", 20) = 0\nwritev(3, [{\"\\270\", 1}], 1)             = 1\nsetsockopt(3, SOL_TCP, TCP_REPAIR_OPTIONS, \"\\10\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0|\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\"..., 386) = 0\nwritev(3, [{\"\\210v\\r[\\226\\320t\\231qwQ\\204\\264l\\254\\t\\1\\20\\245\\214p\\350H\\223\\254;\\\\\\37\\345\\307p$\"..., 3144}], 1) = 3144\n\nThe 3rd system call looks odd :\nsetsockopt(3, SOL_TCP, TCP_REPAIR_QUEUE, [-1], 4) = 0\n\nThis patch makes sure bound checking is using an unsigned compare.\n\nFixes: ee9952831cfd (\"tcp: Initial repair mode\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nCc: Pavel Emelyanov <xemul@parallels.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/8c12bd91b59746140466e03d53049ae0c1b3f858"},{"sha":"6b5a99167a79f9a24e96eb2b0342505826534007","author":{"name":"Tetsuo Handa","email":"3d00b54ad717112934d0b63b7ac2975b44022a61@I-love.SAKURA.ne.jp"},"message":"bdi: wake up concurrent wb_shutdown() callers.\n\ncommit 8236b0ae31c837d2b3a2565c5f8d77f637e824cc upstream.\n\nsyzbot is reporting hung tasks at wait_on_bit(WB_shutting_down) in\nwb_shutdown() [1]. This seems to be because commit 5318ce7d46866e1d (\"bdi:\nShutdown writeback on all cgwbs in cgwb_bdi_destroy()\") forgot to call\nwake_up_bit(WB_shutting_down) after clear_bit(WB_shutting_down).\n\nIntroduce a helper function clear_and_wake_up_bit() and use it, in order\nto avoid similar errors in future.\n\n[1] https://syzkaller.appspot.com/bug?id=b297474817af98d5796bc544e1bb806fc3da0e5e\n\nSigned-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>\nReported-by: syzbot <syzbot+c0cf869505e03bdf1a24@syzkaller.appspotmail.com>\nFixes: 5318ce7d46866e1d (\"bdi: Shutdown writeback on all cgwbs in cgwb_bdi_destroy()\")\nCc: Tejun Heo <tj@kernel.org>\nReviewed-by: Jan Kara <jack@suse.cz>\nSuggested-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Jens Axboe <axboe@kernel.dk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/6b5a99167a79f9a24e96eb2b0342505826534007"},{"sha":"683b4520d07e4f2e22d5ccab96f67f87b18b98f1","author":{"name":"Jan Kara","email":"596727c8a0ea4db3ba2ceceedccbacd3d7b371b8@suse.cz"},"message":"bdi: Fix oops in wb_workfn()\n\ncommit b8b784958eccbf8f51ebeee65282ca3fd59ea391 upstream.\n\nSyzbot has reported that it can hit a NULL pointer dereference in\nwb_workfn() due to wb->bdi->dev being NULL. This indicates that\nwb_workfn() was called for an already unregistered bdi which should not\nhappen as wb_shutdown() called from bdi_unregister() should make sure\nall pending writeback works are completed before bdi is unregistered.\nExcept that wb_workfn() itself can requeue the work with:\n\n\tmod_delayed_work(bdi_wq, &wb->dwork, 0);\n\nand if this happens while wb_shutdown() is waiting in:\n\n\tflush_delayed_work(&wb->dwork);\n\nthe dwork can get executed after wb_shutdown() has finished and\nbdi_unregister() has cleared wb->bdi->dev.\n\nMake wb_workfn() use wakeup_wb() for requeueing the work which takes all\nthe necessary precautions against racing with bdi unregistration.\n\nCC: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>\nCC: Tejun Heo <tj@kernel.org>\nFixes: 839a8e8660b6777e7fe4e80af1a048aebe2b5977\nReported-by: syzbot <syzbot+9873874c735f2892e7e9@syzkaller.appspotmail.com>\nReviewed-by: Dave Chinner <dchinner@redhat.com>\nSigned-off-by: Jan Kara <jack@suse.cz>\nSigned-off-by: Jens Axboe <axboe@kernel.dk>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/683b4520d07e4f2e22d5ccab96f67f87b18b98f1"},{"sha":"c51eb7379dfaeedde0e467bd1d9a48eea78b7a1d","author":{"name":"Paul Mackerras","email":"19a0ba370c443ba08d20b5061586430ab449ee8c@ozlabs.org"},"message":"KVM: PPC: Book3S HV: Fix trap number return from __kvmppc_vcore_entry\n\ncommit a8b48a4dccea77e29462e59f1dbf0d5aa1ff167c upstream.\n\nThis fixes a bug where the trap number that is returned by\n__kvmppc_vcore_entry gets corrupted.  The effect of the corruption\nis that IPIs get ignored on POWER9 systems when the IPI is sent via\na doorbell interrupt to a CPU which is executing in a KVM guest.\nThe effect of the IPI being ignored is often that another CPU locks\nup inside smp_call_function_many() (and if that CPU is holding a\nspinlock, other CPUs then lock up inside raw_spin_lock()).\n\nThe trap number is currently held in register r12 for most of the\nassembly-language part of the guest exit path.  In that path, we\ncall kvmppc_subcore_exit_guest(), which is a C function, without\nrestoring r12 afterwards.  Depending on the kernel config and the\ncompiler, it may modify r12 or it may not, so some config/compiler\ncombinations see the bug and others don't.\n\nTo fix this, we arrange for the trap number to be stored on the\nstack from the 'guest_bypass:' label until the end of the function,\nthen the trap number is loaded and returned in r12 as before.\n\nCc: stable@vger.kernel.org # v4.8+\nFixes: fd7bacbca47a (\"KVM: PPC: Book3S HV: Fix TB corruption in guest exit path on HMI interrupt\")\nSigned-off-by: Paul Mackerras <paulus@ozlabs.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/c51eb7379dfaeedde0e467bd1d9a48eea78b7a1d"},{"sha":"f768d0f981e614a6e2bd5da9c7613cb2908b875d","author":{"name":"Laurent Vivier","email":"240b731be4efaffb85b5d13af681c07e7ef8ddcb@redhat.com"},"message":"KVM: PPC: Book3S HV: Fix guest time accounting with VIRT_CPU_ACCOUNTING_GEN\n\ncommit 61bd0f66ff92d5ce765ff9850fd3cbfec773c560 upstream.\n\nSince commit 8b24e69fc47e (\"KVM: PPC: Book3S HV: Close race with testing\nfor signals on guest entry\"), if CONFIG_VIRT_CPU_ACCOUNTING_GEN is set, the\nguest time is not accounted to guest time and user time, but instead to\nsystem time.\n\nThis is because guest_enter()/guest_exit() are called while interrupts\nare disabled and the tick counter cannot be updated between them.\n\nTo fix that, move guest_exit() after local_irq_enable(), and as\nguest_enter() is called with IRQ disabled, call guest_enter_irqoff()\ninstead.\n\nFixes: 8b24e69fc47e (\"KVM: PPC: Book3S HV: Close race with testing for signals on guest entry\")\nSigned-off-by: Laurent Vivier <lvivier@redhat.com>\nReviewed-by: Paolo Bonzini <pbonzini@redhat.com>\nSigned-off-by: Paul Mackerras <paulus@ozlabs.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/f768d0f981e614a6e2bd5da9c7613cb2908b875d"},{"sha":"ca0ecba3ddf3c81db6e0b082c8851fc1e4eb50a6","author":{"name":"Paul Mackerras","email":"19a0ba370c443ba08d20b5061586430ab449ee8c@ozlabs.org"},"message":"KVM: PPC: Book3S HV: Fix VRMA initialization with 2MB or 1GB memory backing\n\ncommit debd574f4195e205ba505b25e19b2b797f4bcd94 upstream.\n\nThe current code for initializing the VRMA (virtual real memory area)\nfor HPT guests requires the page size of the backing memory to be one\nof 4kB, 64kB or 16MB.  With a radix host we have the possibility that\nthe backing memory page size can be 2MB or 1GB.  In these cases, if the\nguest switches to HPT mode, KVM will not initialize the VRMA and the\nguest will fail to run.\n\nIn fact it is not necessary that the VRMA page size is the same as the\nbacking memory page size; any VRMA page size less than or equal to the\nbacking memory page size is acceptable.  Therefore we now choose the\nlargest page size out of the set {4k, 64k, 16M} which is not larger\nthan the backing memory page size.\n\nSigned-off-by: Paul Mackerras <paulus@ozlabs.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":false,"url":"https://api.github.com/repos/Jackeagle/kernel_msm/commits/ca0ecba3ddf3c81db6e0b082c8851fc1e4eb50a6"}]}
{"actor":{"display_login":"Jackeagle"}}