{"push_id":3037483262,"size":144,"distinct_size":144,"ref":"refs/heads/linux-3.18.y","head":"78e0897dd8b321ba1b4a2137778ab7ae7d400af5","before":"0d63979c1bc9c85578be4c589768a13dc0a7c5eb","commits":[{"sha":"616aaa4386494423bd04ddc200a358479da5c1cb","author":{"name":"Lei Yang","email":"b69c9714a444324d3daa75d28b05586886d9bd88@windriver.com"},"message":"selftests/efivarfs: add required kernel configs\n\n[ Upstream commit 53cf59d6c0ad3edc4f4449098706a8f8986258b6 ]\n\nadd config file\n\nSigned-off-by: Lei Yang <Lei.Yang@windriver.com>\nSigned-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/616aaa4386494423bd04ddc200a358479da5c1cb"},{"sha":"e3a7fb0bf8a816f56346fcd1176419246bcc8d58","author":{"name":"Tony Lindgren","email":"1001e8702733cced254345e193c88aaa47a4f5de@atomide.com"},"message":"mfd: omap-usb-host: Fix dts probe of children\n\n[ Upstream commit 10492ee8ed9188d6d420e1f79b2b9bdbc0624e65 ]\n\nIt currently only works if the parent bus uses \"simple-bus\". We\ncurrently try to probe children with non-existing compatible values.\nAnd we're missing .probe.\n\nI noticed this while testing devices configured to probe using ti-sysc\ninterconnect target module driver. For that we also may want to rebind\nthe driver, so let's remove __init and __exit.\n\nSigned-off-by: Tony Lindgren <tony@atomide.com>\nAcked-by: Roger Quadros <rogerq@ti.com>\nSigned-off-by: Lee Jones <lee.jones@linaro.org>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/e3a7fb0bf8a816f56346fcd1176419246bcc8d58"},{"sha":"31f4ac07c941fbb487cb329dac0f6c63f8641c62","author":{"name":"Jongsung Kim","email":"87d5ff42521d093adbc8fc7ad0d45a53decc0241@lge.com"},"message":"stmmac: fix valid numbers of unicast filter entries\n\n[ Upstream commit edf2ef7242805e53ec2e0841db26e06d8bc7da70 ]\n\nSynopsys DWC Ethernet MAC can be configured to have 1..32, 64, or\n128 unicast filter entries. (Table 7-8 MAC Address Registers from\ndatabook) Fix dwmac1000_validate_ucast_entries() to accept values\nbetween 1 and 32 in addition.\n\nSigned-off-by: Jongsung Kim <neidhard.kim@lge.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/31f4ac07c941fbb487cb329dac0f6c63f8641c62"},{"sha":"4013d3597375b3ff183c420289357713fce93d2d","author":{"name":"Mikulas Patocka","email":"52f8f9962b7f38d8269c63c0859d68147c8d10f0@redhat.com"},"message":"mach64: detect the dot clock divider correctly on sparc\n\ncommit 76ebebd2464c5c8a4453c98b6dbf9c95a599e810 upstream.\n\nOn Sun Ultra 5, it happens that the dot clock is not set up properly for\nsome videomodes. For example, if we set the videomode \"r1024x768x60\" in\nthe firmware, Linux would incorrectly set a videomode with refresh rate\n180Hz when booting (suprisingly, my LCD monitor can display it, although\ndisplay quality is very low).\n\nThe reason is this: Older mach64 cards set the divider in the register\nVCLK_POST_DIV. The register has four 2-bit fields (the field that is\nactually used is specified in the lowest two bits of the register\nCLOCK_CNTL). The 2 bits select divider \"1, 2, 4, 8\". On newer mach64 cards,\nthere's another bit added - the top four bits of PLL_EXT_CNTL extend the\ndivider selection, so we have possible dividers \"1, 2, 4, 8, 3, 5, 6, 12\".\nThe Linux driver clears the top four bits of PLL_EXT_CNTL and never sets\nthem, so it can work regardless if the card supports them. However, the\nsparc64 firmware may set these extended dividers during boot - and the\nmach64 driver detects incorrect dot clock in this case.\n\nThis patch makes the driver read the additional divider bit from\nPLL_EXT_CNTL and calculate the initial refresh rate properly.\n\nSigned-off-by: Mikulas Patocka <mpatocka@redhat.com>\nCc: stable@vger.kernel.org\nAcked-by: David S. Miller <davem@davemloft.net>\nReviewed-by: Ville Syrjälä <syrjala@sci.fi>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/4013d3597375b3ff183c420289357713fce93d2d"},{"sha":"ef67fc876f2832c87dd0be7c190edcdf99008711","author":{"name":"Edgar Cherkasov","email":"0656fb5e337bf08c63bc98dd8983e6e8cea10a8e@dev.rtsoft.ru"},"message":"i2c: i2c-scmi: fix for i2c_smbus_write_block_data\n\ncommit 08d9db00fe0e300d6df976e6c294f974988226dd upstream.\n\nThe i2c-scmi driver crashes when the SMBus Write Block transaction is\nexecuted:\n\nWARNING: CPU: 9 PID: 2194 at mm/page_alloc.c:3931 __alloc_pages_slowpath+0x9db/0xec0\n Call Trace:\n  ? get_page_from_freelist+0x49d/0x11f0\n  ? alloc_pages_current+0x6a/0xe0\n  ? new_slab+0x499/0x690\n  __alloc_pages_nodemask+0x265/0x280\n  alloc_pages_current+0x6a/0xe0\n  kmalloc_order+0x18/0x40\n  kmalloc_order_trace+0x24/0xb0\n  ? acpi_ut_allocate_object_desc_dbg+0x62/0x10c\n  __kmalloc+0x203/0x220\n  acpi_os_allocate_zeroed+0x34/0x36\n  acpi_ut_copy_eobject_to_iobject+0x266/0x31e\n  acpi_evaluate_object+0x166/0x3b2\n  acpi_smbus_cmi_access+0x144/0x530 [i2c_scmi]\n  i2c_smbus_xfer+0xda/0x370\n  i2cdev_ioctl_smbus+0x1bd/0x270\n  i2cdev_ioctl+0xaa/0x250\n  do_vfs_ioctl+0xa4/0x600\n  SyS_ioctl+0x79/0x90\n  do_syscall_64+0x73/0x130\n  entry_SYSCALL_64_after_hwframe+0x3d/0xa2\nACPI Error: Evaluating _SBW: 4 (20170831/smbus_cmi-185)\n\nThis problem occurs because the length of ACPI Buffer object is not\ndefined/initialized in the code before a corresponding ACPI method is\ncalled. The obvious patch below fixes this issue.\n\nSigned-off-by: Edgar Cherkasov <echerkasov@dev.rtsoft.ru>\nAcked-by: Viktor Krasnov <vkrasnov@dev.rtsoft.ru>\nAcked-by: Michael Brunner <Michael.Brunner@kontron.com>\nSigned-off-by: Wolfram Sang <wsa@the-dreams.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/ef67fc876f2832c87dd0be7c190edcdf99008711"},{"sha":"de2bc23651a8fb09d7f44664ab1d6aa4fb659c3a","author":{"name":"Mathias Nyman","email":"2d4473c5e67eb83655334d4e9a7757f781607241@linux.intel.com"},"message":"xhci: Don't print a warning when setting link state for disabled ports\n\ncommit 1208d8a84fdcae6b395c57911cdf907450d30e70 upstream.\n\nWhen disabling a USB3 port the hub driver will set the port link state to\nU3 to prevent \"ejected\" or \"safely removed\" devices that are still\nphysically connected from immediately re-enumerating.\n\nIf the device was really unplugged, then error messages were printed\nas the hub tries to set the U3 link state for a port that is no longer\nenabled.\n\nxhci-hcd ee000000.usb: Cannot set link state.\nusb usb8-port1: cannot disable (err = -32)\n\nDon't print error message in xhci-hub if hub tries to set port link state\nfor a disabled port. Return -ENODEV instead which also silences hub driver.\n\nSigned-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>\nTested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>\nSigned-off-by: Ross Zwisler <zwisler@google.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/de2bc23651a8fb09d7f44664ab1d6aa4fb659c3a"},{"sha":"a9ec42fb3d86a5f4268cedbc7b81adf43080164d","author":{"name":"Paolo Abeni","email":"6e4ffc2e3438feb7acb34f6b67e6ae17e700099c@redhat.com"},"message":"ip_tunnel: be careful when accessing the inner header\n\n[ Upstream commit ccfec9e5cb2d48df5a955b7bf47f7782157d3bc2]\n\nCong noted that we need the same checks introduced by commit 76c0ddd8c3a6\n(\"ip6_tunnel: be careful when accessing the inner header\")\neven for ipv4 tunnels.\n\nFixes: c54419321455 (\"GRE: Refactor GRE tunneling code.\")\nSuggested-by: Cong Wang <xiyou.wangcong@gmail.com>\nSigned-off-by: Paolo Abeni <pabeni@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/a9ec42fb3d86a5f4268cedbc7b81adf43080164d"},{"sha":"4c439968df9a1e5d89d09cb5b4ddd5d4573f4d4b","author":{"name":"Jeff Barnhill","email":"6990780b619fbc2c277198012efc384361a92920@gmail.com"},"message":"net/ipv6: Display all addresses in output of /proc/net/if_inet6\n\n[ Upstream commit 86f9bd1ff61c413a2a251fa736463295e4e24733 ]\n\nThe backend handling for /proc/net/if_inet6 in addrconf.c doesn't properly\nhandle starting/stopping the iteration.  The problem is that at some point\nduring the iteration, an overflow is detected and the process is\nsubsequently stopped.  The item being shown via seq_printf() when the\noverflow occurs is not actually shown, though.  When start() is\nsubsequently called to resume iterating, it returns the next item, and\nthus the item that was being processed when the overflow occurred never\ngets printed.\n\nAlter the meaning of the private data member \"offset\".  Currently, when it\nis not 0 (which only happens at the very beginning), \"offset\" represents\nthe next hlist item to be printed.  After this change, \"offset\" always\nrepresents the current item.\n\nThis is also consistent with the private data member \"bucket\", which\nrepresents the current bucket, and also the use of \"pos\" as defined in\nseq_file.txt:\n    The pos passed to start() will always be either zero, or the most\n    recent pos used in the previous session.\n\nSigned-off-by: Jeff Barnhill <0xeffeff@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/4c439968df9a1e5d89d09cb5b4ddd5d4573f4d4b"},{"sha":"634d658dcc717cb29227d890005f596105186bb3","author":{"name":"Sean Tranchetti","email":"571e0db99464eba93fabd8eb087bcaf9178c708c@codeaurora.org"},"message":"netlabel: check for IPV4MASK in addrinfo_get\n\n[ Upstream commit f88b4c01b97e09535505cf3c327fdbce55c27f00 ]\n\nnetlbl_unlabel_addrinfo_get() assumes that if it finds the\nNLBL_UNLABEL_A_IPV4ADDR attribute, it must also have the\nNLBL_UNLABEL_A_IPV4MASK attribute as well. However, this is\nnot necessarily the case as the current checks in\nnetlbl_unlabel_staticadd() and friends are not sufficent to\nenforce this.\n\nIf passed a netlink message with NLBL_UNLABEL_A_IPV4ADDR,\nNLBL_UNLABEL_A_IPV6ADDR, and NLBL_UNLABEL_A_IPV6MASK attributes,\nthese functions will all call netlbl_unlabel_addrinfo_get() which\nwill then attempt dereference NULL when fetching the non-existent\nNLBL_UNLABEL_A_IPV4MASK attribute:\n\nUnable to handle kernel NULL pointer dereference at virtual address 0\nProcess unlab (pid: 31762, stack limit = 0xffffff80502d8000)\nCall trace:\n\tnetlbl_unlabel_addrinfo_get+0x44/0xd8\n\tnetlbl_unlabel_staticremovedef+0x98/0xe0\n\tgenl_rcv_msg+0x354/0x388\n\tnetlink_rcv_skb+0xac/0x118\n\tgenl_rcv+0x34/0x48\n\tnetlink_unicast+0x158/0x1f0\n\tnetlink_sendmsg+0x32c/0x338\n\tsock_sendmsg+0x44/0x60\n\t___sys_sendmsg+0x1d0/0x2a8\n\t__sys_sendmsg+0x64/0xb4\n\tSyS_sendmsg+0x34/0x4c\n\tel0_svc_naked+0x34/0x38\nCode: 51001149 7100113f 540000a0 f9401508 (79400108)\n---[ end trace f6438a488e737143 ]---\nKernel panic - not syncing: Fatal exception\n\nSigned-off-by: Sean Tranchetti <stranche@codeaurora.org>\n\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/634d658dcc717cb29227d890005f596105186bb3"},{"sha":"706a680f49f47a25b8fba4d9e001a9d660ea1974","author":{"name":"Yu Zhao","email":"9640a31789aee25cf713d8aa6fe964eb05bab72b@google.com"},"message":"net/usb: cancel pending work when unbinding smsc75xx\n\n[ Upstream commit f7b2a56e1f3dcbdb4cf09b2b63e859ffe0e09df8 ]\n\nCancel pending work before freeing smsc75xx private data structure\nduring binding. This fixes the following crash in the driver:\n\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000050\nIP: mutex_lock+0x2b/0x3f\n<snipped>\nWorkqueue: events smsc75xx_deferred_multicast_write [smsc75xx]\ntask: ffff8caa83e85700 task.stack: ffff948b80518000\nRIP: 0010:mutex_lock+0x2b/0x3f\n<snipped>\nCall Trace:\n smsc75xx_deferred_multicast_write+0x40/0x1af [smsc75xx]\n process_one_work+0x18d/0x2fc\n worker_thread+0x1a2/0x269\n ? pr_cont_work+0x58/0x58\n kthread+0xfa/0x10a\n ? pr_cont_work+0x58/0x58\n ? rcu_read_unlock_sched_notrace+0x48/0x48\n ret_from_fork+0x22/0x40\n\nSigned-off-by: Yu Zhao <yuzhao@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/706a680f49f47a25b8fba4d9e001a9d660ea1974"},{"sha":"59db42a89e87f6f0ed85b9da7e7f7dc72088c3db","author":{"name":"Shahed Shaikh","email":"c3f28edf146fff1d494c60280c6c601216e56491@cavium.com"},"message":"qlcnic: fix Tx descriptor corruption on 82xx devices\n\n[ Upstream commit c333fa0c4f220f8f7ea5acd6b0ebf3bf13fd684d ]\n\nIn regular NIC transmission flow, driver always configures MAC using\nTx queue zero descriptor as a part of MAC learning flow.\nBut with multi Tx queue supported NIC, regular transmission can occur on\nany non-zero Tx queue and from that context it uses\nTx queue zero descriptor to configure MAC, at the same time TX queue\nzero could be used by another CPU for regular transmission\nwhich could lead to Tx queue zero descriptor corruption and cause FW\nabort.\n\nThis patch fixes this in such a way that driver always configures\nlearned MAC address from the same Tx queue which is used for\nregular transmission.\n\nFixes: 7e2cf4feba05 (\"qlcnic: change driver hardware interface mechanism\")\nSigned-off-by: Shahed Shaikh <shahed.shaikh@cavium.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/59db42a89e87f6f0ed85b9da7e7f7dc72088c3db"},{"sha":"07ac7b4c443933f295f285c433b31c14859eb248","author":{"name":"Ido Schimmel","email":"1b0ab106fb837225790a9df447125d75029db946@mellanox.com"},"message":"team: Forbid enslaving team device to itself\n\n[ Upstream commit 471b83bd8bbe4e89743683ef8ecb78f7029d8288 ]\n\nteam's ndo_add_slave() acquires 'team->lock' and later tries to open the\nnewly enslaved device via dev_open(). This emits a 'NETDEV_UP' event\nthat causes the VLAN driver to add VLAN 0 on the team device. team's\nndo_vlan_rx_add_vid() will also try to acquire 'team->lock' and\ndeadlock.\n\nFix this by checking early at the enslavement function that a team\ndevice is not being enslaved to itself.\n\nA similar check was added to the bond driver in commit 09a89c219baf\n(\"bonding: disallow enslaving a bond to itself\").\n\nWARNING: possible recursive locking detected\n4.18.0-rc7+ #176 Not tainted\n--------------------------------------------\nsyz-executor4/6391 is trying to acquire lock:\n(____ptrval____) (&team->lock){+.+.}, at: team_vlan_rx_add_vid+0x3b/0x1e0 drivers/net/team/team.c:1868\n\nbut task is already holding lock:\n(____ptrval____) (&team->lock){+.+.}, at: team_add_slave+0xdb/0x1c30 drivers/net/team/team.c:1947\n\nother info that might help us debug this:\n Possible unsafe locking scenario:\n\n       CPU0\n       ----\n  lock(&team->lock);\n  lock(&team->lock);\n\n *** DEADLOCK ***\n\n May be due to missing lock nesting notation\n\n2 locks held by syz-executor4/6391:\n #0: (____ptrval____) (rtnl_mutex){+.+.}, at: rtnl_lock net/core/rtnetlink.c:77 [inline]\n #0: (____ptrval____) (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x412/0xc30 net/core/rtnetlink.c:4662\n #1: (____ptrval____) (&team->lock){+.+.}, at: team_add_slave+0xdb/0x1c30 drivers/net/team/team.c:1947\n\nstack backtrace:\nCPU: 1 PID: 6391 Comm: syz-executor4 Not tainted 4.18.0-rc7+ #176\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113\n print_deadlock_bug kernel/locking/lockdep.c:1765 [inline]\n check_deadlock kernel/locking/lockdep.c:1809 [inline]\n validate_chain kernel/locking/lockdep.c:2405 [inline]\n __lock_acquire.cold.64+0x1fb/0x486 kernel/locking/lockdep.c:3435\n lock_acquire+0x1e4/0x540 kernel/locking/lockdep.c:3924\n __mutex_lock_common kernel/locking/mutex.c:757 [inline]\n __mutex_lock+0x176/0x1820 kernel/locking/mutex.c:894\n mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:909\n team_vlan_rx_add_vid+0x3b/0x1e0 drivers/net/team/team.c:1868\n vlan_add_rx_filter_info+0x14a/0x1d0 net/8021q/vlan_core.c:210\n __vlan_vid_add net/8021q/vlan_core.c:278 [inline]\n vlan_vid_add+0x63e/0x9d0 net/8021q/vlan_core.c:308\n vlan_device_event.cold.12+0x2a/0x2f net/8021q/vlan.c:381\n notifier_call_chain+0x180/0x390 kernel/notifier.c:93\n __raw_notifier_call_chain kernel/notifier.c:394 [inline]\n raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401\n call_netdevice_notifiers_info+0x3f/0x90 net/core/dev.c:1735\n call_netdevice_notifiers net/core/dev.c:1753 [inline]\n dev_open+0x173/0x1b0 net/core/dev.c:1433\n team_port_add drivers/net/team/team.c:1219 [inline]\n team_add_slave+0xa8b/0x1c30 drivers/net/team/team.c:1948\n do_set_master+0x1c9/0x220 net/core/rtnetlink.c:2248\n do_setlink+0xba4/0x3e10 net/core/rtnetlink.c:2382\n rtnl_setlink+0x2a9/0x400 net/core/rtnetlink.c:2636\n rtnetlink_rcv_msg+0x46e/0xc30 net/core/rtnetlink.c:4665\n netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2455\n rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4683\n netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]\n netlink_unicast+0x5a0/0x760 net/netlink/af_netlink.c:1343\n netlink_sendmsg+0xa18/0xfd0 net/netlink/af_netlink.c:1908\n sock_sendmsg_nosec net/socket.c:642 [inline]\n sock_sendmsg+0xd5/0x120 net/socket.c:652\n ___sys_sendmsg+0x7fd/0x930 net/socket.c:2126\n __sys_sendmsg+0x11d/0x290 net/socket.c:2164\n __do_sys_sendmsg net/socket.c:2173 [inline]\n __se_sys_sendmsg net/socket.c:2171 [inline]\n __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2171\n do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\nRIP: 0033:0x456b29\nCode: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00\nRSP: 002b:00007f9706bf8c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f9706bf96d4 RCX: 0000000000456b29\nRDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000004\nRBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff\nR13: 00000000004d3548 R14: 00000000004c8227 R15: 0000000000000000\n\nFixes: 87002b03baab (\"net: introduce vlan_vid_[add/del] and use them instead of direct [add/kill]_vid ndo calls\")\nSigned-off-by: Ido Schimmel <idosch@mellanox.com>\nReported-and-tested-by: syzbot+bd051aba086537515cdb@syzkaller.appspotmail.com\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/07ac7b4c443933f295f285c433b31c14859eb248"},{"sha":"3fdf90829b620e22116855a94e5df9bce7955cb5","author":{"name":"Maxime Chevallier","email":"4d075fc8e96710be3ebe6e88a3241012ff91e096@bootlin.com"},"message":"net: mvpp2: Extract the correct ethtype from the skb for tx csum offload\n\n[ Upstream commit 35f3625c21852ad839f20c91c7d81c4c1101e207 ]\n\nWhen offloading the L3 and L4 csum computation on TX, we need to extract\nthe l3_proto from the ethtype, independently of the presence of a vlan\ntag.\n\nThe actual driver uses skb->protocol as-is, resulting in packets with\nthe wrong L4 checksum being sent when there's a vlan tag in the packet\nheader and checksum offloading is enabled.\n\nThis commit makes use of vlan_protocol_get() to get the correct ethtype\nregardless the presence of a vlan tag.\n\nFixes: 3f518509dedc (\"ethernet: Add new driver for Marvell Armada 375 network unit\")\nSigned-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/3fdf90829b620e22116855a94e5df9bce7955cb5"},{"sha":"0685db34ceff2863687ec4fa41583bc63ee5c0a3","author":{"name":"Florian Fainelli","email":"59190c1867e3222b932a0de3c668eb2d980d69a2@gmail.com"},"message":"net: systemport: Fix wake-up interrupt race during resume\n\n[ Upstream commit 45ec318578c0c22a11f5b9927d064418e1ab1905 ]\n\nThe AON_PM_L2 is normally used to trigger and identify the source of a\nwake-up event. Since the RX_SYS clock is no longer turned off, we also\nhave an interrupt being sent to the SYSTEMPORT INTRL_2_0 controller, and\nthat interrupt remains active up until the magic packet detector is\ndisabled which happens much later during the driver resumption.\n\nThe race happens if we have a CPU that is entering the SYSTEMPORT\nINTRL2_0 handler during resume, and another CPU has managed to clear the\nwake-up interrupt during bcm_sysport_resume_from_wol(). In that case, we\nhave the first CPU stuck in the interrupt handler with an interrupt\ncause that has been cleared under its feet, and so we keep returning\nIRQ_NONE and we never make any progress.\n\nThis was not a problem before because we would always turn off the\nRX_SYS clock during WoL, so the SYSTEMPORT INTRL2_0 would also be turned\noff as well, thus not latching the interrupt.\n\nThe fix is to make sure we do not enable either the MPD or\nBRCM_TAG_MATCH interrupts since those are redundant with what the\nAON_PM_L2 interrupt controller already processes and they would cause\nsuch a race to occur.\n\nFixes: bb9051a2b230 (\"net: systemport: Add support for WAKE_FILTER\")\nFixes: 83e82f4c706b (\"net: systemport: add Wake-on-LAN support\")\nSigned-off-by: Florian Fainelli <f.fainelli@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/0685db34ceff2863687ec4fa41583bc63ee5c0a3"},{"sha":"bae41f256cc6816d135b966df99ab6ae389d5e4e","author":{"name":"Eric Dumazet","email":"312c7d941f03386814be517ffdb3e0eb6624e275@google.com"},"message":"rtnl: limit IFLA_NUM_TX_QUEUES and IFLA_NUM_RX_QUEUES to 4096\n\n[ Upstream commit 0e1d6eca5113858ed2caea61a5adc03c595f6096 ]\n\nWe have an impressive number of syzkaller bugs that are linked\nto the fact that syzbot was able to create a networking device\nwith millions of TX (or RX) queues.\n\nLet's limit the number of RX/TX queues to 4096, this really should\ncover all known cases.\n\nA separate patch will add various cond_resched() in the loops\nhandling sysfs entries at device creation and dismantle.\n\nTested:\n\nlpaa6:~# ip link add gre-4097 numtxqueues 4097 numrxqueues 4097 type ip6gretap\nRTNETLINK answers: Invalid argument\n\nlpaa6:~# time ip link add gre-4096 numtxqueues 4096 numrxqueues 4096 type ip6gretap\n\nreal\t0m0.180s\nuser\t0m0.000s\nsys\t0m0.107s\n\nFixes: 76ff5cc91935 (\"rtnl: allow to specify number of rx and tx queues on device creation\")\nSigned-off-by: Eric Dumazet <edumazet@google.com>\nReported-by: syzbot <syzkaller@googlegroups.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/bae41f256cc6816d135b966df99ab6ae389d5e4e"},{"sha":"9ff42401379844c306238cb488ed69dd20748268","author":{"name":"Paolo Abeni","email":"6e4ffc2e3438feb7acb34f6b67e6ae17e700099c@redhat.com"},"message":"ip6_tunnel: be careful when accessing the inner header\n\n[ Upstream commit 76c0ddd8c3a683f6e2c6e60e11dc1a1558caf4bc ]\n\nthe ip6 tunnel xmit ndo assumes that the processed skb always\ncontains an ip[v6] header, but syzbot has found a way to send\nframes that fall short of this assumption, leading to the following splat:\n\nBUG: KMSAN: uninit-value in ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1307\n[inline]\nBUG: KMSAN: uninit-value in ip6_tnl_start_xmit+0x7d2/0x1ef0\nnet/ipv6/ip6_tunnel.c:1390\nCPU: 0 PID: 4504 Comm: syz-executor558 Not tainted 4.16.0+ #87\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS\nGoogle 01/01/2011\nCall Trace:\n  __dump_stack lib/dump_stack.c:17 [inline]\n  dump_stack+0x185/0x1d0 lib/dump_stack.c:53\n  kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067\n  __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683\n  ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1307 [inline]\n  ip6_tnl_start_xmit+0x7d2/0x1ef0 net/ipv6/ip6_tunnel.c:1390\n  __netdev_start_xmit include/linux/netdevice.h:4066 [inline]\n  netdev_start_xmit include/linux/netdevice.h:4075 [inline]\n  xmit_one net/core/dev.c:3026 [inline]\n  dev_hard_start_xmit+0x5f1/0xc70 net/core/dev.c:3042\n  __dev_queue_xmit+0x27ee/0x3520 net/core/dev.c:3557\n  dev_queue_xmit+0x4b/0x60 net/core/dev.c:3590\n  packet_snd net/packet/af_packet.c:2944 [inline]\n  packet_sendmsg+0x7c70/0x8a30 net/packet/af_packet.c:2969\n  sock_sendmsg_nosec net/socket.c:630 [inline]\n  sock_sendmsg net/socket.c:640 [inline]\n  ___sys_sendmsg+0xec0/0x1310 net/socket.c:2046\n  __sys_sendmmsg+0x42d/0x800 net/socket.c:2136\n  SYSC_sendmmsg+0xc4/0x110 net/socket.c:2167\n  SyS_sendmmsg+0x63/0x90 net/socket.c:2162\n  do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287\n  entry_SYSCALL_64_after_hwframe+0x3d/0xa2\nRIP: 0033:0x441819\nRSP: 002b:00007ffe58ee8268 EFLAGS: 00000213 ORIG_RAX: 0000000000000133\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000441819\nRDX: 0000000000000002 RSI: 0000000020000100 RDI: 0000000000000003\nRBP: 00000000006cd018 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000213 R12: 0000000000402510\nR13: 00000000004025a0 R14: 0000000000000000 R15: 0000000000000000\n\nUninit was created at:\n  kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline]\n  kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188\n  kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314\n  kmsan_slab_alloc+0x11/0x20 mm/kmsan/kmsan.c:321\n  slab_post_alloc_hook mm/slab.h:445 [inline]\n  slab_alloc_node mm/slub.c:2737 [inline]\n  __kmalloc_node_track_caller+0xaed/0x11c0 mm/slub.c:4369\n  __kmalloc_reserve net/core/skbuff.c:138 [inline]\n  __alloc_skb+0x2cf/0x9f0 net/core/skbuff.c:206\n  alloc_skb include/linux/skbuff.h:984 [inline]\n  alloc_skb_with_frags+0x1d4/0xb20 net/core/skbuff.c:5234\n  sock_alloc_send_pskb+0xb56/0x1190 net/core/sock.c:2085\n  packet_alloc_skb net/packet/af_packet.c:2803 [inline]\n  packet_snd net/packet/af_packet.c:2894 [inline]\n  packet_sendmsg+0x6454/0x8a30 net/packet/af_packet.c:2969\n  sock_sendmsg_nosec net/socket.c:630 [inline]\n  sock_sendmsg net/socket.c:640 [inline]\n  ___sys_sendmsg+0xec0/0x1310 net/socket.c:2046\n  __sys_sendmmsg+0x42d/0x800 net/socket.c:2136\n  SYSC_sendmmsg+0xc4/0x110 net/socket.c:2167\n  SyS_sendmmsg+0x63/0x90 net/socket.c:2162\n  do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287\n  entry_SYSCALL_64_after_hwframe+0x3d/0xa2\n\nThis change addresses the issue adding the needed check before\naccessing the inner header.\n\nThe ipv4 side of the issue is apparently there since the ipv4 over ipv6\ninitial support, and the ipv6 side predates git history.\n\nFixes: c4d3efafcc93 (\"[IPV6] IP6TUNNEL: Add support to IPv4 over IPv6 tunnel.\")\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: syzbot+3fde91d4d394747d6db4@syzkaller.appspotmail.com\nTested-by: Alexander Potapenko <glider@google.com>\nSigned-off-by: Paolo Abeni <pabeni@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/9ff42401379844c306238cb488ed69dd20748268"},{"sha":"5deaaf487b1b0b46b15309d4085053eb5c2137ae","author":{"name":"Jozef Balga","email":"851c5dc26e790f53453d32d126c7c89ca80777ae@gmail.com"},"message":"media: af9035: prevent buffer overflow on write\n\n[ Upstream commit 312f73b648626a0526a3aceebb0a3192aaba05ce ]\n\nWhen less than 3 bytes are written to the device, memcpy is called with\nnegative array size which leads to buffer overflow and kernel panic. This\npatch adds a condition and returns -EOPNOTSUPP instead.\nFixes bugzilla issue 64871\n\n[mchehab+samsung@kernel.org: fix a merge conflict and changed the\n condition to match the patch's comment, e. g. len == 3 could\n also be valid]\nSigned-off-by: Jozef Balga <jozef.balga@gmail.com>\nSigned-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/5deaaf487b1b0b46b15309d4085053eb5c2137ae"},{"sha":"43a111eceaa68910d6b297c2305a70466d46b1b7","author":{"name":"Michael Neuling","email":"7b0ab45a730e48a69239010b5b8fe5fa4e8eaac6@neuling.org"},"message":"powerpc/tm: Fix userspace r13 corruption\n\n[ Upstream commit cf13435b730a502e814c63c84d93db131e563f5f ]\n\nWhen we treclaim we store the userspace checkpointed r13 to a scratch\nSPR and then later save the scratch SPR to the user thread struct.\n\nUnfortunately, this doesn't work as accessing the user thread struct\ncan take an SLB fault and the SLB fault handler will write the same\nscratch SPRG that now contains the userspace r13.\n\nTo fix this, we store r13 to the kernel stack (which can't fault)\nbefore we access the user thread struct.\n\nFound by running P8 guest + powervm + disable_1tb_segments + TM. Seen\nas a random userspace segfault with r13 looking like a kernel address.\n\nSigned-off-by: Michael Neuling <mikey@neuling.org>\nReviewed-by: Breno Leitao <leitao@debian.org>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/43a111eceaa68910d6b297c2305a70466d46b1b7"},{"sha":"d623e2510f704cd99b1e7f88f6d4d06f719b86c9","author":{"name":"Michael Neuling","email":"7b0ab45a730e48a69239010b5b8fe5fa4e8eaac6@neuling.org"},"message":"powerpc/tm: Avoid possible userspace r1 corruption on reclaim\n\n[ Upstream commit 96dc89d526ef77604376f06220e3d2931a0bfd58 ]\n\nCurrent we store the userspace r1 to PACATMSCRATCH before finally\nsaving it to the thread struct.\n\nIn theory an exception could be taken here (like a machine check or\nSLB miss) that could write PACATMSCRATCH and hence corrupt the\nuserspace r1. The SLB fault currently doesn't touch PACATMSCRATCH, but\nothers do.\n\nWe've never actually seen this happen but it's theoretically\npossible. Either way, the code is fragile as it is.\n\nThis patch saves r1 to the kernel stack (which can't fault) before we\nturn MSR[RI] back on. PACATMSCRATCH is still used but only with\nMSR[RI] off. We then copy r1 from the kernel stack to the thread\nstruct once we have MSR[RI] back on.\n\nSuggested-by: Breno Leitao <leitao@debian.org>\nSigned-off-by: Michael Neuling <mikey@neuling.org>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>\nSigned-off-by: Sasha Levin <alexander.levin@microsoft.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/d623e2510f704cd99b1e7f88f6d4d06f719b86c9"},{"sha":"a8833baacdd87ea11dfd0964fe26eea64bfa5962","author":{"name":"Steffen Klassert","email":"66deb1d63f85161cc287ce2bac0c65cb5ae958a7@secunet.com"},"message":"xfrm: Validate address prefix lengths in the xfrm selector.\n\n[ Upstream commit 07bf7908950a8b14e81aa1807e3c667eab39287a ]\n\nWe don't validate the address prefix lengths in the xfrm\nselector we got from userspace. This can lead to undefined\nbehaviour in the address matching functions if the prefix\nis too big for the given address family. Fix this by checking\nthe prefixes and refuse SA/policy insertation when a prefix\nis invalid.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Air Icy <icytxw@gmail.com>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>\nSigned-off-by: Sasha Levin <sashal@kernel.org>","distinct":true,"url":"https://api.github.com/repos/woodsts/linux-stable/commits/a8833baacdd87ea11dfd0964fe26eea64bfa5962"}]}
{"actor":{"display_login":"woodsts"}}