)]}' { "log": [ { "commit": "60b548237fed4b4164bab13c994dd9615f6c4323", "tree": "84a10a314422af5a7cca05e2e70235d635346793", "parents": [ "b26b2b24b1d8cc6e24d81872e6e18c0d76382a81", "d78a5ebd8b18d3809fd9d6bbaeb64d78a332204f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 28 12:53:48 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 28 12:53:48 2018 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nPull networking fixes from David Miller:\n\n 1) ARM64 JIT fixes for subprog handling from Daniel Borkmann.\n\n 2) Various sparc64 JIT bug fixes (fused branch convergance, frame\n pointer usage detection logic, PSEODU call argument handling).\n\n 3) Fix to use BH locking in nf_conncount, from Taehee Yoo.\n\n 4) Fix race of TX skb freeing in ipheth driver, from Bernd Eckstein.\n\n 5) Handle return value of TX NAPI completion properly in lan743x\n driver, from Bryan Whitehead.\n\n 6) MAC filter deletion in i40e driver clears wrong state bit, from\n Lihong Yang.\n\n 7) Fix use after free in rionet driver, from Pan Bian.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (53 commits)\n s390/qeth: fix length check in SNMP processing\n net: hisilicon: remove unexpected free_netdev\n rapidio/rionet: do not free skb before reading its length\n i40e: fix kerneldoc for xsk methods\n ixgbe: recognize 1000BaseLX SFP modules as 1Gbps\n i40e: Fix deletion of MAC filters\n igb: fix uninitialized variables\n netfilter: nf_tables: deactivate expressions in rule replecement routine\n lan743x: Enable driver to work with LAN7431\n tipc: fix lockdep warning during node delete\n lan743x: fix return value for lan743x_tx_napi_poll\n net: via: via-velocity: fix spelling mistake \"alignement\" -\u003e \"alignment\"\n qed: fix spelling mistake \"attnetion\" -\u003e \"attention\"\n net: thunderx: fix NULL pointer dereference in nic_remove\n sctp: increase sk_wmem_alloc when head-\u003etruesize is increased\n firestream: fix spelling mistake: \"Inititing\" -\u003e \"Initializing\"\n net: phy: add workaround for issue where PHY driver doesn\u0027t bind to the device\n usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2\n sparc: Adjust bpf JIT prologue for PSEUDO calls.\n bpf, doc: add entries of who looks over which jits\n ...\n" }, { "commit": "b26b2b24b1d8cc6e24d81872e6e18c0d76382a81", "tree": "090ce94ee37c7959bc839e150e8ec8d82e381d72", "parents": [ "121b018f8c74b4e0ba81b4b8ee73a82db3f24b7b", "38a35a78c5e270cbe53c4fef6b0d3c2da90dd849" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 28 12:51:10 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 28 12:51:10 2018 -0800" }, "message": "Merge tag \u0027xtensa-20181128\u0027 of git://github.com/jcmvbkbc/linux-xtensa\n\nPull Xtensa fixes from Max Filippov:\n\n - fix kernel exception on userspace access to a currently disabled\n coprocessor\n\n - fix coprocessor data saving/restoring in configurations with multiple\n coprocessors\n\n - fix ptrace access to coprocessor data on configurations with multiple\n coprocessors with high alignment requirements\n\n* tag \u0027xtensa-20181128\u0027 of git://github.com/jcmvbkbc/linux-xtensa:\n xtensa: fix coprocessor part of ptrace_{get,set}xregs\n xtensa: fix coprocessor context offset definitions\n xtensa: enable coprocessors that are being flushed\n" }, { "commit": "d78a5ebd8b18d3809fd9d6bbaeb64d78a332204f", "tree": "6c2bb7065ce57268d8b525b7787d8e0b6189a02f", "parents": [ "9a764c1e59684c0358e16ccaafd870629f2cfe67", "529eb362a3477189224e7b7d24983d49448a85db" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Nov 28 11:33:35 2018 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Nov 28 11:33:35 2018 -0800" }, "message": "Merge branch \u00271GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue\n\nJeff Kirsher says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Fixes 2018-11-28\n\nThis series contains fixes to igb, ixgbe and i40e.\n\nYunjian Wang from Huawei resolves a variable that could potentially be\nNULL before it is used.\n\nLihong fixes an i40e issue which goes back to 4.17 kernels, where\ndeleting any of the MAC filters was causing the incorrect syncing for\nthe PF.\n\nJosh Elsasser caught that there were missing enum values in the link\ncapabilities for x550 devices, which was preventing link for 1000BaseLX\nSFP modules.\n\nJan fixes the function header comments for XSK methods.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9a764c1e59684c0358e16ccaafd870629f2cfe67", "tree": "2af9ac65e1285e7883a3b3d2a7877c416fed00d5", "parents": [ "e9d8faf93d273374dc6ae073a35e2fbcbcd97305" ], "author": { "name": "Julian Wiedmann", "email": "jwi@linux.ibm.com", "time": "Wed Nov 28 16:20:50 2018 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Nov 28 11:16:54 2018 -0800" }, "message": "s390/qeth: fix length check in SNMP processing\n\nThe response for a SNMP request can consist of multiple parts, which\nthe cmd callback stages into a kernel buffer until all parts have been\nreceived. If the callback detects that the staging buffer provides\ninsufficient space, it bails out with error.\nThis processing is buggy for the first part of the response - while it\ninitially checks for a length of \u0027data_len\u0027, it later copies an\nadditional amount of \u0027offsetof(struct qeth_snmp_cmd, data)\u0027 bytes.\n\nFix the calculation of \u0027data_len\u0027 for the first part of the response.\nThis also nicely cleans up the memcpy code.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Julian Wiedmann \u003cjwi@linux.ibm.com\u003e\nReviewed-by: Ursula Braun \u003cubraun@linux.ibm.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e9d8faf93d273374dc6ae073a35e2fbcbcd97305", "tree": "8b53cf2d8304bc5132d623c39ad7dc38d7f795fd", "parents": [ "c758940158bf29fe14e9d0f89d5848f227b48134", "ca08987885a147643817d02bf260bc4756ce8cd4" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Nov 28 11:02:45 2018 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Nov 28 11:02:45 2018 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf\n\nPablo Neira Ayuso says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nNetfilter fixes for net\n\nThe following patchset contains Netfilter fixes for net:\n\n1) Disable BH while holding list spinlock in nf_conncount, from\n Taehee Yoo.\n\n2) List corruption in nf_conncount, also from Taehee.\n\n3) Fix race that results in leaving around an empty list node in\n nf_conncount, from Taehee Yoo.\n\n4) Proper chain handling for inactive chains from the commit path,\n from Florian Westphal. This includes a selftest for this.\n\n5) Do duplicate rule handles when replacing rules, also from Florian.\n\n6) Remove net_exit path in xt_RATEEST that results in splat, from Taehee.\n\n7) Possible use-after-free in nft_compat when releasing extensions.\n From Florian.\n\n8) Memory leak in xt_hashlimit, from Taehee.\n\n9) Call ip_vs_dst_notifier after ipv6_dev_notf, from Xin Long.\n\n10) Fix cttimeout with udplite and gre, from Florian.\n\n11) Preserve oif for IPv6 link-local generated traffic from mangle\n table, from Alin Nastac.\n\n12) Missing error handling in masquerade notifiers, from Taehee Yoo.\n\n13) Use mutex to protect registration/unregistration of masquerade\n extensions in order to prevent a race, from Taehee.\n\n14) Incorrect condition check in tree_nodes_free(), also from Taehee.\n\n15) Fix chain counter leak in rule replacement path, from Taehee.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c758940158bf29fe14e9d0f89d5848f227b48134", "tree": "fd0e70a0fbe5f1b8d0522b921deb3fe197574616", "parents": [ "cfc435198f53a6fa1f656d98466b24967ff457d0" ], "author": { "name": "Pan Bian", "email": "bianpan2016@163.com", "time": "Wed Nov 28 15:30:24 2018 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Nov 28 10:41:15 2018 -0800" }, "message": "net: hisilicon: remove unexpected free_netdev\n\nThe net device ndev is freed via free_netdev when failing to register\nthe device. The control flow then jumps to the error handling code\nblock. ndev is used and freed again. Resulting in a use-after-free bug.\n\nSigned-off-by: Pan Bian \u003cbianpan2016@163.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "cfc435198f53a6fa1f656d98466b24967ff457d0", "tree": "fcdc35233ab6cbfa602bd55da168c397587f4698", "parents": [ "4df5ce9bc03e47d05f400e64aa32a82ec4cef419" ], "author": { "name": "Pan Bian", "email": "bianpan2016@163.com", "time": "Wed Nov 28 14:53:19 2018 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Nov 28 10:38:48 2018 -0800" }, "message": "rapidio/rionet: do not free skb before reading its length\n\nskb is freed via dev_kfree_skb_any, however, skb-\u003elen is read then. This\nmay result in a use-after-free bug.\n\nFixes: e6161d64263 (\"rapidio/rionet: rework driver initialization and removal\")\nSigned-off-by: Pan Bian \u003cbianpan2016@163.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "529eb362a3477189224e7b7d24983d49448a85db", "tree": "89ad44a36cbd72de4fee76c10b6042a5c1b69539", "parents": [ "a8bf879af7b1999eba36303ce9cc60e0e7dd816c" ], "author": { "name": "Jan Sokolowski", "email": "jan.sokolowski@intel.com", "time": "Tue Nov 27 09:35:35 2018 -0800" }, "committer": { "name": "Jeff Kirsher", "email": "jeffrey.t.kirsher@intel.com", "time": "Wed Nov 28 08:45:00 2018 -0800" }, "message": "i40e: fix kerneldoc for xsk methods\n\nOne method, xsk_umem_setup, had an incorrect kernel doc\ndescription, which has been corrected.\n\nAlso fixes small typos found in the comments.\n\nSigned-off-by: Jan Sokolowski \u003cjan.sokolowski@intel.com\u003e\nTested-by: Andrew Bowers \u003candrewx.bowers@intel.com\u003e\nSigned-off-by: Jeff Kirsher \u003cjeffrey.t.kirsher@intel.com\u003e\n" }, { "commit": "121b018f8c74b4e0ba81b4b8ee73a82db3f24b7b", "tree": "e24661e4183017aa0b4dcb40a6b035359e19f4ad", "parents": [ "5b26f7180cdb3406404e6da78741e4e57f9a999e", "42a657f57628402c73237547f0134e083e2f6764" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 28 08:38:20 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 28 08:38:20 2018 -0800" }, "message": "Merge tag \u0027for-4.20-rc4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n \"Some of these bugs are being hit during testing so we\u0027d like to get\n them merged, otherwise there are usual stability fixes for stable\n trees\"\n\n* tag \u0027for-4.20-rc4-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: relocation: set trans to be NULL after ending transaction\n Btrfs: fix race between enabling quotas and subvolume creation\n Btrfs: send, fix infinite loop due to directory rename dependencies\n Btrfs: ensure path name is null terminated at btrfs_control_ioctl\n Btrfs: fix rare chances for data loss when doing a fast fsync\n btrfs: Always try all copies when reading extent buffers\n" }, { "commit": "5b26f7180cdb3406404e6da78741e4e57f9a999e", "tree": "717fc98075040c7decb8c7622f3bbd90982f045a", "parents": [ "d8242d22d501b8403c780f306762fbdf889ec0c5", "91b9deefedf4c35a01027ce38bed7299605026a3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 28 08:33:55 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 28 08:33:55 2018 -0800" }, "message": "Merge tag \u0027spi-fix-v4.20-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi\n\nPull spi fixes from Mark Brown:\n \"A few driver specific fixes here, nothing big or that stands out for\n anyone other than the driver users.\n\n The omap2-mcspi fix is for issues that started showing up with a\n change in defconfig in this release to make cpuidle get turned on by\n default\"\n\n* tag \u0027spi-fix-v4.20-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:\n spi: omap2-mcspi: Add missing suspend and resume calls\n spi: mediatek: use correct mata-\u003exfer_len when in fifo transfer\n spi: uniphier: fix incorrect property items\n" }, { "commit": "a8bf879af7b1999eba36303ce9cc60e0e7dd816c", "tree": "8356060aec8411c0533f65ac2a31d98799a54f4b", "parents": [ "eab077aa84331afbda071a213925d4cdbca58941" ], "author": { "name": "Josh Elsasser", "email": "jelsasser@appneta.com", "time": "Sat Nov 24 12:57:33 2018 -0800" }, "committer": { "name": "Jeff Kirsher", "email": "jeffrey.t.kirsher@intel.com", "time": "Wed Nov 28 08:29:49 2018 -0800" }, "message": "ixgbe: recognize 1000BaseLX SFP modules as 1Gbps\n\nAdd the two 1000BaseLX enum values to the X550\u0027s check for 1Gbps modules,\nallowing the core driver code to establish a link over this SFP type.\n\nThis is done by the out-of-tree driver but the fix wasn\u0027t in mainline.\n\nFixes: e23f33367882 (\"ixgbe: Fix 1G and 10G link stability for X550EM_x SFP+”)\nFixes: 6a14ee0cfb19 (\"ixgbe: Add X550 support function pointers\")\nSigned-off-by: Josh Elsasser \u003cjelsasser@appneta.com\u003e\nTested-by: Andrew Bowers \u003candrewx.bowers@intel.com\u003e\nSigned-off-by: Jeff Kirsher \u003cjeffrey.t.kirsher@intel.com\u003e\n" }, { "commit": "d8242d22d501b8403c780f306762fbdf889ec0c5", "tree": "150c51e656a7f2391822167fc801d30ff69c2c66", "parents": [ "ef78e5ec9214376c5cb989f5da70b02d0c117b66", "fd65d3142f734bc4376053c8d75670041903134d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 28 08:29:18 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Nov 28 08:29:18 2018 -0800" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull kvm fixes from Paolo Bonzini:\n \"Bugfixes, many of them reported by syzkaller and mostly predating the\n merge window\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm:\n kvm: svm: Ensure an IBPB on all affected CPUs when freeing a vmcb\n kvm: mmu: Fix race in emulated page table writes\n KVM: nVMX: vmcs12 revision_id is always VMCS12_REVISION even when copied from eVMCS\n KVM: nVMX: Verify eVMCS revision id match supported eVMCS version on eVMCS VMPTRLD\n KVM: nVMX/nSVM: Fix bug which sets vcpu-\u003earch.tsc_offset to L1 tsc_offset\n x86/kvm/vmx: fix old-style function declaration\n KVM: x86: fix empty-body warnings\n KVM: VMX: Update shared MSRs to be saved/restored on MSR_EFER.LMA changes\n KVM: x86: Fix kernel info-leak in KVM_HC_CLOCK_PAIRING hypercall\n KVM: nVMX: Fix kernel info-leak when enabling KVM_CAP_HYPERV_ENLIGHTENED_VMCS more than once\n svm: Add mutex_lock to protect apic_access_page_done on AMD systems\n KVM: X86: Fix scan ioapic use-before-initialization\n KVM: LAPIC: Fix pv ipis use-before-initialization\n KVM: VMX: re-add ple_gap module parameter\n KVM: PPC: Book3S HV: Fix handling for interrupted H_ENTER_NESTED\n" }, { "commit": "eab077aa84331afbda071a213925d4cdbca58941", "tree": "023ec31c5ced4c0bb70d8da5a8bae3e4f11e18d4", "parents": [ "e4c39f7926b4de355f7df75651d75003806aae09" ], "author": { "name": "Lihong Yang", "email": "lihong.yang@intel.com", "time": "Wed Nov 21 09:15:37 2018 -0800" }, "committer": { "name": "Jeff Kirsher", "email": "jeffrey.t.kirsher@intel.com", "time": "Wed Nov 28 08:27:47 2018 -0800" }, "message": "i40e: Fix deletion of MAC filters\n\nIn __i40e_del_filter function, the flag __I40E_MACVLAN_SYNC_PENDING for\nthe PF state is wrongly set for the VSI. Deleting any of the MAC filters\nhas caused the incorrect syncing for the PF. Fix it by setting this state\nflag to the intended PF.\n\nCC: stable \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Lihong Yang \u003clihong.yang@intel.com\u003e\nTested-by: Andrew Bowers \u003candrewx.bowers@intel.com\u003e\nSigned-off-by: Jeff Kirsher \u003cjeffrey.t.kirsher@intel.com\u003e\n" }, { "commit": "e4c39f7926b4de355f7df75651d75003806aae09", "tree": "0ef19f17bf5cb1580e600c2577c7482fd9daafc5", "parents": [ "4df5ce9bc03e47d05f400e64aa32a82ec4cef419" ], "author": { "name": "Yunjian Wang", "email": "wangyunjian@huawei.com", "time": "Tue Nov 06 16:27:12 2018 +0800" }, "committer": { "name": "Jeff Kirsher", "email": "jeffrey.t.kirsher@intel.com", "time": "Wed Nov 28 08:27:47 2018 -0800" }, "message": "igb: fix uninitialized variables\n\nThis patch fixes the variable \u0027phy_word\u0027 may be used uninitialized.\n\nSigned-off-by: Yunjian Wang \u003cwangyunjian@huawei.com\u003e\nTested-by: Aaron Brown \u003caaron.f.brown@intel.com\u003e\nSigned-off-by: Jeff Kirsher \u003cjeffrey.t.kirsher@intel.com\u003e\n" }, { "commit": "ca08987885a147643817d02bf260bc4756ce8cd4", "tree": "9ecc75fc4a5bf8047c365e844e5c337093878e0d", "parents": [ "53ca0f2fec39c80ccd19e6e3f30cc8daef174b70" ], "author": { "name": "Taehee Yoo", "email": "ap420073@gmail.com", "time": "Wed Nov 28 11:27:28 2018 +0900" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Nov 28 10:56:40 2018 +0100" }, "message": "netfilter: nf_tables: deactivate expressions in rule replecement routine\n\nThere is no expression deactivation call from the rule replacement path,\nhence, chain counter is not decremented. A few steps to reproduce the\nproblem:\n\n %nft add table ip filter\n %nft add chain ip filter c1\n %nft add chain ip filter c1\n %nft add rule ip filter c1 jump c2\n %nft replace rule ip filter c1 handle 3 accept\n %nft flush ruleset\n\n\u003cjump c2\u003e expression means immediate NFT_JUMP to chain c2.\nReference count of chain c2 is increased when the rule is added.\n\nWhen rule is deleted or replaced, the reference counter of c2 should be\ndecreased via nft_rule_expr_deactivate() which calls\nnft_immediate_deactivate().\n\nSplat looks like:\n[ 214.396453] WARNING: CPU: 1 PID: 21 at net/netfilter/nf_tables_api.c:1432 nf_tables_chain_destroy.isra.38+0x2f9/0x3a0 [nf_tables]\n[ 214.398983] Modules linked in: nf_tables nfnetlink\n[ 214.398983] CPU: 1 PID: 21 Comm: kworker/1:1 Not tainted 4.20.0-rc2+ #44\n[ 214.398983] Workqueue: events nf_tables_trans_destroy_work [nf_tables]\n[ 214.398983] RIP: 0010:nf_tables_chain_destroy.isra.38+0x2f9/0x3a0 [nf_tables]\n[ 214.398983] Code: 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 8e 00 00 00 48 8b 7b 58 e8 e1 2c 4e c6 48 89 df e8 d9 2c 4e c6 eb 9a \u003c0f\u003e 0b eb 96 0f 0b e9 7e fe ff ff e8 a7 7e 4e c6 e9 a4 fe ff ff e8\n[ 214.398983] RSP: 0018:ffff8881152874e8 EFLAGS: 00010202\n[ 214.398983] RAX: 0000000000000001 RBX: ffff88810ef9fc28 RCX: ffff8881152876f0\n[ 214.398983] RDX: dffffc0000000000 RSI: 1ffff11022a50ede RDI: ffff88810ef9fc78\n[ 214.398983] RBP: 1ffff11022a50e9d R08: 0000000080000000 R09: 0000000000000000\n[ 214.398983] R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff11022a50eba\n[ 214.398983] R13: ffff888114446e08 R14: ffff8881152876f0 R15: ffffed1022a50ed6\n[ 214.398983] FS: 0000000000000000(0000) GS:ffff888116400000(0000) knlGS:0000000000000000\n[ 214.398983] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 214.398983] CR2: 00007fab9bb5f868 CR3: 000000012aa16000 CR4: 00000000001006e0\n[ 214.398983] Call Trace:\n[ 214.398983] ? nf_tables_table_destroy.isra.37+0x100/0x100 [nf_tables]\n[ 214.398983] ? __kasan_slab_free+0x145/0x180\n[ 214.398983] ? nf_tables_trans_destroy_work+0x439/0x830 [nf_tables]\n[ 214.398983] ? kfree+0xdb/0x280\n[ 214.398983] nf_tables_trans_destroy_work+0x5f5/0x830 [nf_tables]\n[ ... ]\n\nFixes: bb7b40aecbf7 (\"netfilter: nf_tables: bogus EBUSY in chain deletions\")\nReported by: Christoph Anton Mitterer \u003ccalestyo@scientia.net\u003e\nLink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug\u003d914505\nLink: https://bugzilla.kernel.org/show_bug.cgi?id\u003d201791\nSigned-off-by: Taehee Yoo \u003cap420073@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "4df5ce9bc03e47d05f400e64aa32a82ec4cef419", "tree": "5e56af1ff0285f4846e3f268806fa44e2bf91fb1", "parents": [ "ec835f891232d7763dea9da0358f31e24ca6dfb7" ], "author": { "name": "Bryan Whitehead", "email": "Bryan.Whitehead@microchip.com", "time": "Mon Nov 26 12:27:10 2018 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Nov 27 16:32:07 2018 -0800" }, "message": "lan743x: Enable driver to work with LAN7431\n\nThis driver was designed to work with both LAN7430 and LAN7431.\nThe only difference between the two is the LAN7431 has support\nfor external phy.\n\nThis change adds LAN7431 to the list of recognized devices\nsupported by this driver.\n\nUpdates for v2:\n changed \u0027fixes\u0027 tag to match defined format\n\nfixes: 23f0703c125b (\"lan743x: Add main source files for new lan743x driver\")\nSigned-off-by: Bryan Whitehead \u003cBryan.Whitehead@microchip.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ec835f891232d7763dea9da0358f31e24ca6dfb7", "tree": "3e7c7e6caee06163b89789bccf52f3a1f9d2e21a", "parents": [ "cc5922054131f9abefdc0622ae64fc55e6b2671d" ], "author": { "name": "Jon Maloy", "email": "donmalo99@gmail.com", "time": "Mon Nov 26 12:26:14 2018 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Nov 27 16:30:39 2018 -0800" }, "message": "tipc: fix lockdep warning during node delete\n\nWe see the following lockdep warning:\n\n[ 2284.078521] \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n[ 2284.078604] WARNING: possible circular locking dependency detected\n[ 2284.078604] 4.19.0+ #42 Tainted: G E\n[ 2284.078604] ------------------------------------------------------\n[ 2284.078604] rmmod/254 is trying to acquire lock:\n[ 2284.078604] 00000000acd94e28 ((\u0026n-\u003etimer)#2){+.-.}, at: del_timer_sync+0x5/0xa0\n[ 2284.078604]\n[ 2284.078604] but task is already holding lock:\n[ 2284.078604] 00000000f997afc0 (\u0026(\u0026tn-\u003enode_list_lock)-\u003erlock){+.-.}, at: tipc_node_stop+0xac/0x190 [tipc]\n[ 2284.078604]\n[ 2284.078604] which lock already depends on the new lock.\n[ 2284.078604]\n[ 2284.078604]\n[ 2284.078604] the existing dependency chain (in reverse order) is:\n[ 2284.078604]\n[ 2284.078604] -\u003e #1 (\u0026(\u0026tn-\u003enode_list_lock)-\u003erlock){+.-.}:\n[ 2284.078604] tipc_node_timeout+0x20a/0x330 [tipc]\n[ 2284.078604] call_timer_fn+0xa1/0x280\n[ 2284.078604] run_timer_softirq+0x1f2/0x4d0\n[ 2284.078604] __do_softirq+0xfc/0x413\n[ 2284.078604] irq_exit+0xb5/0xc0\n[ 2284.078604] smp_apic_timer_interrupt+0xac/0x210\n[ 2284.078604] apic_timer_interrupt+0xf/0x20\n[ 2284.078604] default_idle+0x1c/0x140\n[ 2284.078604] do_idle+0x1bc/0x280\n[ 2284.078604] cpu_startup_entry+0x19/0x20\n[ 2284.078604] start_secondary+0x187/0x1c0\n[ 2284.078604] secondary_startup_64+0xa4/0xb0\n[ 2284.078604]\n[ 2284.078604] -\u003e #0 ((\u0026n-\u003etimer)#2){+.-.}:\n[ 2284.078604] del_timer_sync+0x34/0xa0\n[ 2284.078604] tipc_node_delete+0x1a/0x40 [tipc]\n[ 2284.078604] tipc_node_stop+0xcb/0x190 [tipc]\n[ 2284.078604] tipc_net_stop+0x154/0x170 [tipc]\n[ 2284.078604] tipc_exit_net+0x16/0x30 [tipc]\n[ 2284.078604] ops_exit_list.isra.8+0x36/0x70\n[ 2284.078604] unregister_pernet_operations+0x87/0xd0\n[ 2284.078604] unregister_pernet_subsys+0x1d/0x30\n[ 2284.078604] tipc_exit+0x11/0x6f2 [tipc]\n[ 2284.078604] __x64_sys_delete_module+0x1df/0x240\n[ 2284.078604] do_syscall_64+0x66/0x460\n[ 2284.078604] entry_SYSCALL_64_after_hwframe+0x49/0xbe\n[ 2284.078604]\n[ 2284.078604] other info that might help us debug this:\n[ 2284.078604]\n[ 2284.078604] Possible unsafe locking scenario:\n[ 2284.078604]\n[ 2284.078604] CPU0 CPU1\n[ 2284.078604] ---- ----\n[ 2284.078604] lock(\u0026(\u0026tn-\u003enode_list_lock)-\u003erlock);\n[ 2284.078604] lock((\u0026n-\u003etimer)#2);\n[ 2284.078604] lock(\u0026(\u0026tn-\u003enode_list_lock)-\u003erlock);\n[ 2284.078604] lock((\u0026n-\u003etimer)#2);\n[ 2284.078604]\n[ 2284.078604] *** DEADLOCK ***\n[ 2284.078604]\n[ 2284.078604] 3 locks held by rmmod/254:\n[ 2284.078604] #0: 000000003368be9b (pernet_ops_rwsem){+.+.}, at: unregister_pernet_subsys+0x15/0x30\n[ 2284.078604] #1: 0000000046ed9c86 (rtnl_mutex){+.+.}, at: tipc_net_stop+0x144/0x170 [tipc]\n[ 2284.078604] #2: 00000000f997afc0 (\u0026(\u0026tn-\u003enode_list_lock)-\u003erlock){+.-.}, at: tipc_node_stop+0xac/0x19\n[...}\n\nThe reason is that the node timer handler sometimes needs to delete a\nnode which has been disconnected for too long. To do this, it grabs\nthe lock \u0027node_list_lock\u0027, which may at the same time be held by the\ngeneric node cleanup function, tipc_node_stop(), during module removal.\nSince the latter is calling del_timer_sync() inside the same lock, we\nhave a potential deadlock.\n\nWe fix this letting the timer cleanup function use spin_trylock()\ninstead of just spin_lock(), and when it fails to grab the lock it\njust returns so that the timer handler can terminate its execution.\nThis is safe to do, since tipc_node_stop() anyway is about to\ndelete both the timer and the node instance.\n\nFixes: 6a939f365bdb (\"tipc: Auto removal of peer down node instance\")\nAcked-by: Ying Xue \u003cying.xue@windriver.com\u003e\nSigned-off-by: Jon Maloy \u003cjon.maloy@ericsson.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "cc5922054131f9abefdc0622ae64fc55e6b2671d", "tree": "dc9375e8b4961a9a8855faf1146bc4c72b8ff4bd", "parents": [ "4b5adba07c945e191ac2ecd83627dd520dca152f" ], "author": { "name": "Bryan Whitehead", "email": "Bryan.Whitehead@microchip.com", "time": "Mon Nov 26 12:04:57 2018 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Nov 27 16:29:24 2018 -0800" }, "message": "lan743x: fix return value for lan743x_tx_napi_poll\n\nThe lan743x driver, when under heavy traffic load, has been noticed\nto sometimes hang, or cause a kernel panic.\n\nDebugging reveals that the TX napi poll routine was returning\nthe wrong value, \u0027weight\u0027. Most other drivers return 0.\nAnd call napi_complete, instead of napi_complete_done.\n\nAdditionally when creating the tx napi poll routine.\nChanged netif_napi_add, to netif_tx_napi_add.\n\nUpdates for v3:\n changed \u0027fixes\u0027 tag to match defined format\n\nUpdates for v2:\nuse napi_complete, instead of napi_complete_done in\n lan743x_tx_napi_poll\nuse netif_tx_napi_add, instead of netif_napi_add for\n registration of tx napi poll routine\n\nfixes: 23f0703c125b (\"lan743x: Add main source files for new lan743x driver\")\nSigned-off-by: Bryan Whitehead \u003cBryan.Whitehead@microchip.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "4b5adba07c945e191ac2ecd83627dd520dca152f", "tree": "13d27c1497f1e4392b6efe5fb53929dd7fd7e69b", "parents": [ "1d510657ac7e486dd443cabbbd0677253aeb705f" ], "author": { "name": "Colin Ian King", "email": "colin.king@canonical.com", "time": "Mon Nov 26 15:34:01 2018 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Nov 27 16:22:23 2018 -0800" }, "message": "net: via: via-velocity: fix spelling mistake \"alignement\" -\u003e \"alignment\"\n\nThe text in array velocity_gstrings contains a spelling mistake,\nrename rx_frame_alignement_errors to rx_frame_alignment_errors.\n\nSigned-off-by: Colin Ian King \u003ccolin.king@canonical.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "1d510657ac7e486dd443cabbbd0677253aeb705f", "tree": "f6c82e3b7b88b2af63a05778e07be196051d6b74", "parents": [ "24a6d2dd263bc910de018c78d1148b3e33b94512" ], "author": { "name": "Colin Ian King", "email": "colin.king@canonical.com", "time": "Mon Nov 26 15:53:54 2018 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Nov 27 16:22:23 2018 -0800" }, "message": "qed: fix spelling mistake \"attnetion\" -\u003e \"attention\"\n\nThe text in array s_igu_fifo_error_strs contains a spelling mistake,\nfix it.\n\nSigned-off-by: Colin Ian King \u003ccolin.king@canonical.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "24a6d2dd263bc910de018c78d1148b3e33b94512", "tree": "0b627aa7ff96fdfa85a092653e3f36b830d4cf7d", "parents": [ "0d32f17717e65e76cbdb248374dd162acdfe2fff" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo.bianconi@redhat.com", "time": "Mon Nov 26 15:07:16 2018 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Nov 27 16:18:53 2018 -0800" }, "message": "net: thunderx: fix NULL pointer dereference in nic_remove\n\nFix a possible NULL pointer dereference in nic_remove routine\nremoving the nicpf module if nic_probe fails.\nThe issue can be triggered with the following reproducer:\n\n$rmmod nicvf\n$rmmod nicpf\n\n[ 521.412008] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000014\n[ 521.422777] Mem abort info:\n[ 521.425561] ESR \u003d 0x96000004\n[ 521.428624] Exception class \u003d DABT (current EL), IL \u003d 32 bits\n[ 521.434535] SET \u003d 0, FnV \u003d 0\n[ 521.437579] EA \u003d 0, S1PTW \u003d 0\n[ 521.440730] Data abort info:\n[ 521.443603] ISV \u003d 0, ISS \u003d 0x00000004\n[ 521.447431] CM \u003d 0, WnR \u003d 0\n[ 521.450417] user pgtable: 4k pages, 48-bit VAs, pgdp \u003d 0000000072a3da42\n[ 521.457022] [0000000000000014] pgd\u003d0000000000000000\n[ 521.461916] Internal error: Oops: 96000004 [#1] SMP\n[ 521.511801] Hardware name: GIGABYTE H270-T70/MT70-HD0, BIOS T49 02/02/2018\n[ 521.518664] pstate: 80400005 (Nzcv daif +PAN -UAO)\n[ 521.523451] pc : nic_remove+0x24/0x88 [nicpf]\n[ 521.527808] lr : pci_device_remove+0x48/0xd8\n[ 521.532066] sp : ffff000013433cc0\n[ 521.535370] x29: ffff000013433cc0 x28: ffff810f6ac50000\n[ 521.540672] x27: 0000000000000000 x26: 0000000000000000\n[ 521.545974] x25: 0000000056000000 x24: 0000000000000015\n[ 521.551274] x23: ffff8007ff89a110 x22: ffff000001667070\n[ 521.556576] x21: ffff8007ffb170b0 x20: ffff8007ffb17000\n[ 521.561877] x19: 0000000000000000 x18: 0000000000000025\n[ 521.567178] x17: 0000000000000000 x16: 000000000000010ffc33ff98 x8 : 0000000000000000\n[ 521.593683] x7 : 0000000000000000 x6 : 0000000000000001\n[ 521.598983] x5 : 0000000000000002 x4 : 0000000000000003\n[ 521.604284] x3 : ffff8007ffb17184 x2 : ffff8007ffb17184\n[ 521.609585] x1 : ffff000001662118 x0 : ffff000008557be0\n[ 521.614887] Process rmmod (pid: 1897, stack limit \u003d 0x00000000859535c3)\n[ 521.621490] Call trace:\n[ 521.623928] nic_remove+0x24/0x88 [nicpf]\n[ 521.627927] pci_device_remove+0x48/0xd8\n[ 521.631847] device_release_driver_internal+0x1b0/0x248\n[ 521.637062] driver_detach+0x50/0xc0\n[ 521.640628] bus_remove_driver+0x60/0x100\n[ 521.644627] driver_unregister+0x34/0x60\n[ 521.648538] pci_unregister_driver+0x24/0xd8\n[ 521.652798] nic_cleanup_module+0x14/0x111c [nicpf]\n[ 521.657672] __arm64_sys_delete_module+0x150/0x218\n[ 521.662460] el0_svc_handler+0x94/0x110\n[ 521.666287] el0_svc+0x8/0xc\n[ 521.669160] Code: aa1e03e0 9102c295 d503201f f9404eb3 (b9401660)\n\nFixes: 4863dea3fab0 (\"net: Adding support for Cavium ThunderX network controller\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo.bianconi@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0d32f17717e65e76cbdb248374dd162acdfe2fff", "tree": "6fe60c6c6116598809bcc587d3f94919899f0443", "parents": [ "a8842e975503191e4982efb886299fc19972c97f" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Mon Nov 26 14:52:44 2018 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Nov 27 15:42:31 2018 -0800" }, "message": "sctp: increase sk_wmem_alloc when head-\u003etruesize is increased\n\nI changed to count sk_wmem_alloc by skb truesize instead of 1 to\nfix the sk_wmem_alloc leak caused by later truesize\u0027s change in\nxfrm in Commit 02968ccf0125 (\"sctp: count sk_wmem_alloc by skb\ntruesize in sctp_packet_transmit\").\n\nBut I should have also increased sk_wmem_alloc when head-\u003etruesize\nis increased in sctp_packet_gso_append() as xfrm does. Otherwise,\nsctp gso packet will cause sk_wmem_alloc underflow.\n\nFixes: 02968ccf0125 (\"sctp: count sk_wmem_alloc by skb truesize in sctp_packet_transmit\")\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nAcked-by: Marcelo Ricardo Leitner \u003cmarcelo.leitner@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a8842e975503191e4982efb886299fc19972c97f", "tree": "76dac6e681e0d69a459faa118134429085f0c9bc", "parents": [ "c85ddecae6e5e82ca3ae6f20c63f1d865e2ff5ea" ], "author": { "name": "Colin Ian King", "email": "colin.king@canonical.com", "time": "Sun Nov 25 23:21:08 2018 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Nov 27 15:32:06 2018 -0800" }, "message": "firestream: fix spelling mistake: \"Inititing\" -\u003e \"Initializing\"\n\nThere are spelling mistakes in debug messages, fix them.\n\nSigned-off-by: Colin Ian King \u003ccolin.king@canonical.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c85ddecae6e5e82ca3ae6f20c63f1d865e2ff5ea", "tree": "c30780a2c28e7ab09d6d72fa5865d21553ffb8a9", "parents": [ "45611c61dd503454b2edae00aabe1e429ec49ebe" ], "author": { "name": "Heiner Kallweit", "email": "hkallweit1@gmail.com", "time": "Fri Nov 23 19:41:29 2018 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Nov 27 15:00:24 2018 -0800" }, "message": "net: phy: add workaround for issue where PHY driver doesn\u0027t bind to the device\n\nAfter switching the r8169 driver to use phylib some user reported that\ntheir network is broken. This was caused by the genphy PHY driver being\nused instead of the dedicated PHY driver for the RTL8211B. Users\nreported that loading the Realtek PHY driver module upfront fixes the\nissue. See also this mail thread:\nhttps://marc.info/?t\u003d154279781800003\u0026r\u003d1\u0026w\u003d2\nThe issue is quite weird and the root cause seems to be somewhere in\nthe base driver core. The patch works around the issue and may be\nremoved once the actual issue is fixed.\n\nThe Fixes tag refers to the first reported occurrence of the issue.\nThe issue itself may have been existing much longer and it may affect\nusers of other network chips as well. Users typically will recognize\nthis issue only if their PHY stops working when being used with the\ngenphy driver.\n\nFixes: f1e911d5d0df (\"r8169: add basic phylib support\")\nSigned-off-by: Heiner Kallweit \u003chkallweit1@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "45611c61dd503454b2edae00aabe1e429ec49ebe", "tree": "40bcd7850b6bd30602a1b6808c54ed6cca007611", "parents": [ "93143f846b2728d81b000740acfdbbd52ab41e46" ], "author": { "name": "Bernd Eckstein", "email": "3erndeckstein@gmail.com", "time": "Fri Nov 23 13:51:26 2018 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Nov 27 14:57:16 2018 -0800" }, "message": "usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2\n\nThe bug is not easily reproducable, as it may occur very infrequently\n(we had machines with 20minutes heavy downloading before it occurred)\nHowever, on a virual machine (VMWare on Windows 10 host) it occurred\npretty frequently (1-2 seconds after a speedtest was started)\n\ndev-\u003etx_skb mab be freed via dev_kfree_skb_irq on a callback\nbefore it is set.\n\nThis causes the following problems:\n- double free of the skb or potential memory leak\n- in dmesg: \u0027recvmsg bug\u0027 and \u0027recvmsg bug 2\u0027 and eventually\n general protection fault\n\nExample dmesg output:\n[ 134.841986] ------------[ cut here ]------------\n[ 134.841987] recvmsg bug: copied 9C24A555 seq 9C24B557 rcvnxt 9C25A6B3 fl 0\n[ 134.841993] WARNING: CPU: 7 PID: 2629 at /build/linux-hwe-On9fm7/linux-hwe-4.15.0/net/ipv4/tcp.c:1865 tcp_recvmsg+0x44d/0xab0\n[ 134.841994] Modules linked in: ipheth(OE) kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd glue_helper cryptd vmw_balloon intel_rapl_perf joydev input_leds serio_raw vmw_vsock_vmci_transport vsock shpchp i2c_piix4 mac_hid binfmt_misc vmw_vmci parport_pc ppdev lp parport autofs4 vmw_pvscsi vmxnet3 hid_generic usbhid hid vmwgfx ttm drm_kms_helper syscopyarea sysfillrect mptspi mptscsih sysimgblt ahci psmouse fb_sys_fops pata_acpi mptbase libahci e1000 drm scsi_transport_spi\n[ 134.842046] CPU: 7 PID: 2629 Comm: python Tainted: G W OE 4.15.0-34-generic #37~16.04.1-Ubuntu\n[ 134.842046] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/19/2017\n[ 134.842048] RIP: 0010:tcp_recvmsg+0x44d/0xab0\n[ 134.842048] RSP: 0018:ffffa6630422bcc8 EFLAGS: 00010286\n[ 134.842049] RAX: 0000000000000000 RBX: ffff997616f4f200 RCX: 0000000000000006\n[ 134.842049] RDX: 0000000000000007 RSI: 0000000000000082 RDI: ffff9976257d6490\n[ 134.842050] RBP: ffffa6630422bd98 R08: 0000000000000001 R09: 000000000004bba4\n[ 134.842050] R10: 0000000001e00c6f R11: 000000000004bba4 R12: ffff99760dee3000\n[ 134.842051] R13: 0000000000000000 R14: ffff99760dee3514 R15: 0000000000000000\n[ 134.842051] FS: 00007fe332347700(0000) GS:ffff9976257c0000(0000) knlGS:0000000000000000\n[ 134.842052] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 134.842053] CR2: 0000000001e41000 CR3: 000000020e9b4006 CR4: 00000000003606e0\n[ 134.842055] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 134.842055] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 134.842057] Call Trace:\n[ 134.842060] ? aa_sk_perm+0x53/0x1a0\n[ 134.842064] inet_recvmsg+0x51/0xc0\n[ 134.842066] sock_recvmsg+0x43/0x50\n[ 134.842070] SYSC_recvfrom+0xe4/0x160\n[ 134.842072] ? __schedule+0x3de/0x8b0\n[ 134.842075] ? ktime_get_ts64+0x4c/0xf0\n[ 134.842079] SyS_recvfrom+0xe/0x10\n[ 134.842082] do_syscall_64+0x73/0x130\n[ 134.842086] entry_SYSCALL_64_after_hwframe+0x3d/0xa2\n[ 134.842086] RIP: 0033:0x7fe331f5a81d\n[ 134.842088] RSP: 002b:00007ffe8da98398 EFLAGS: 00000246 ORIG_RAX: 000000000000002d\n[ 134.842090] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00007fe331f5a81d\n[ 134.842094] RDX: 00000000000003fb RSI: 0000000001e00874 RDI: 0000000000000003\n[ 134.842095] RBP: 00007fe32f642c70 R08: 0000000000000000 R09: 0000000000000000\n[ 134.842097] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe332347698\n[ 134.842099] R13: 0000000001b7e0a0 R14: 0000000001e00874 R15: 0000000000000000\n[ 134.842103] Code: 24 fd ff ff e9 cc fe ff ff 48 89 d8 41 8b 8c 24 10 05 00 00 44 8b 45 80 48 c7 c7 08 bd 59 8b 48 89 85 68 ff ff ff e8 b3 c4 7d ff \u003c0f\u003e 0b 48 8b 85 68 ff ff ff e9 e9 fe ff ff 41 8b 8c 24 10 05 00\n[ 134.842126] ---[ end trace b7138fc08c83147f ]---\n[ 134.842144] general protection fault: 0000 [#1] SMP PTI\n[ 134.842145] Modules linked in: ipheth(OE) kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd glue_helper cryptd vmw_balloon intel_rapl_perf joydev input_leds serio_raw vmw_vsock_vmci_transport vsock shpchp i2c_piix4 mac_hid binfmt_misc vmw_vmci parport_pc ppdev lp parport autofs4 vmw_pvscsi vmxnet3 hid_generic usbhid hid vmwgfx ttm drm_kms_helper syscopyarea sysfillrect mptspi mptscsih sysimgblt ahci psmouse fb_sys_fops pata_acpi mptbase libahci e1000 drm scsi_transport_spi\n[ 134.842161] CPU: 7 PID: 2629 Comm: python Tainted: G W OE 4.15.0-34-generic #37~16.04.1-Ubuntu\n[ 134.842162] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/19/2017\n[ 134.842164] RIP: 0010:tcp_close+0x2c6/0x440\n[ 134.842165] RSP: 0018:ffffa6630422bde8 EFLAGS: 00010202\n[ 134.842167] RAX: 0000000000000000 RBX: ffff99760dee3000 RCX: 0000000180400034\n[ 134.842168] RDX: 5c4afd407207a6c4 RSI: ffffe868495bd300 RDI: ffff997616f4f200\n[ 134.842169] RBP: ffffa6630422be08 R08: 0000000016f4d401 R09: 0000000180400034\n[ 134.842169] R10: ffffa6630422bd98 R11: 0000000000000000 R12: 000000000000600c\n[ 134.842170] R13: 0000000000000000 R14: ffff99760dee30c8 R15: ffff9975bd44fe00\n[ 134.842171] FS: 00007fe332347700(0000) GS:ffff9976257c0000(0000) knlGS:0000000000000000\n[ 134.842173] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 134.842174] CR2: 0000000001e41000 CR3: 000000020e9b4006 CR4: 00000000003606e0\n[ 134.842177] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 134.842178] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 134.842179] Call Trace:\n[ 134.842181] inet_release+0x42/0x70\n[ 134.842183] __sock_release+0x42/0xb0\n[ 134.842184] sock_close+0x15/0x20\n[ 134.842187] __fput+0xea/0x220\n[ 134.842189] ____fput+0xe/0x10\n[ 134.842191] task_work_run+0x8a/0xb0\n[ 134.842193] exit_to_usermode_loop+0xc4/0xd0\n[ 134.842195] do_syscall_64+0xf4/0x130\n[ 134.842197] entry_SYSCALL_64_after_hwframe+0x3d/0xa2\n[ 134.842197] RIP: 0033:0x7fe331f5a560\n[ 134.842198] RSP: 002b:00007ffe8da982e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003\n[ 134.842200] RAX: 0000000000000000 RBX: 00007fe32f642c70 RCX: 00007fe331f5a560\n[ 134.842201] RDX: 00000000008f5320 RSI: 0000000001cd4b50 RDI: 0000000000000003\n[ 134.842202] RBP: 00007fe32f6500f8 R08: 000000000000003c R09: 00000000009343c0\n[ 134.842203] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe32f6500d0\n[ 134.842204] R13: 00000000008f5320 R14: 00000000008f5320 R15: 0000000001cd4770\n[ 134.842205] Code: c8 00 00 00 45 31 e4 49 39 fe 75 4d eb 50 83 ab d8 00 00 00 01 48 8b 17 48 8b 47 08 48 c7 07 00 00 00 00 48 c7 47 08 00 00 00 00 \u003c48\u003e 89 42 08 48 89 10 0f b6 57 34 8b 47 2c 2b 47 28 83 e2 01 80\n[ 134.842226] RIP: tcp_close+0x2c6/0x440 RSP: ffffa6630422bde8\n[ 134.842227] ---[ end trace b7138fc08c831480 ]---\n\nThe proposed patch eliminates a potential racing condition.\nBefore, usb_submit_urb was called and _after_ that, the skb was attached\n(dev-\u003etx_skb). So, on a callback it was possible, however unlikely that the\nskb was freed before it was set. That way (because dev-\u003etx_skb was not set\nto NULL after it was freed), it could happen that a skb from a earlier\ntransmission was freed a second time (and the skb we should have freed did\nnot get freed at all)\n\nNow we free the skb directly in ipheth_tx(). It is not passed to the\ncallback anymore, eliminating the posibility of a double free of the same\nskb. Depending on the retval of usb_submit_urb() we use dev_kfree_skb_any()\nrespectively dev_consume_skb_any() to free the skb.\n\nSigned-off-by: Oliver Zweigle \u003cOliver.Zweigle@faro.com\u003e\nSigned-off-by: Bernd Eckstein \u003c3ernd.Eckstein@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "93143f846b2728d81b000740acfdbbd52ab41e46", "tree": "b7013eec3efdf782371a429bbfa698b2cc5d43d4", "parents": [ "69500127424cd90ff2cf8191256b2ac3b0a4af56", "2b9034b5eaddc09c0e9529b93446eb975f97f814" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Nov 27 09:52:05 2018 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Nov 27 09:52:05 2018 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nDaniel Borkmann says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull-request: bpf 2018-11-27\n\nThe following pull-request contains BPF updates for your *net* tree.\n\nThe main changes are:\n\n1) Fix several bugs in BPF sparc JIT, that is, convergence for fused\n branches, initialization of frame pointer register, and moving all\n arguments into output registers from input registers in prologue\n to fix BPF to BPF calls, from David.\n\n2) Fix a bug in arm64 JIT for fetching BPF to BPF call addresses where\n they are not guaranteed to fit into imm field and therefore must be\n retrieved through prog aux data, from Daniel.\n\n3) Explicitly add all JITs to MAINTAINERS file with developers able to\n help out in feature development, fixes, review, etc.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "fd65d3142f734bc4376053c8d75670041903134d", "tree": "cc54b20e91a008463389cb74b4e4dd02252ee29a", "parents": [ "0e0fee5c539b61fdd098332e0e2cc375d9073706" ], "author": { "name": "Jim Mattson", "email": "jmattson@google.com", "time": "Tue May 22 09:54:20 2018 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Tue Nov 27 12:50:42 2018 +0100" }, "message": "kvm: svm: Ensure an IBPB on all affected CPUs when freeing a vmcb\n\nPreviously, we only called indirect_branch_prediction_barrier on the\nlogical CPU that freed a vmcb. This function should be called on all\nlogical CPUs that last loaded the vmcb in question.\n\nFixes: 15d45071523d (\"KVM/x86: Add IBPB support\")\nReported-by: Neel Natu \u003cneelnatu@google.com\u003e\nSigned-off-by: Jim Mattson \u003cjmattson@google.com\u003e\nReviewed-by: Konrad Rzeszutek Wilk \u003ckonrad.wilk@oracle.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "0e0fee5c539b61fdd098332e0e2cc375d9073706", "tree": "a5788edffb775ef66019c86b430c8f6a6015e66b", "parents": [ "52ad7eb3d668867f9ee2e34d715cfb4860d36a93" ], "author": { "name": "Junaid Shahid", "email": "junaids@google.com", "time": "Wed Oct 31 14:53:57 2018 -0700" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Tue Nov 27 12:50:31 2018 +0100" }, "message": "kvm: mmu: Fix race in emulated page table writes\n\nWhen a guest page table is updated via an emulated write,\nkvm_mmu_pte_write() is called to update the shadow PTE using the just\nwritten guest PTE value. But if two emulated guest PTE writes happened\nconcurrently, it is possible that the guest PTE and the shadow PTE end\nup being out of sync. Emulated writes do not mark the shadow page as\nunsync-ed, so this inconsistency will not be resolved even by a guest TLB\nflush (unless the page was marked as unsync-ed at some other point).\n\nThis is fixed by re-reading the current value of the guest PTE after the\nMMU lock has been acquired instead of just using the value that was\nwritten prior to calling kvm_mmu_pte_write().\n\nSigned-off-by: Junaid Shahid \u003cjunaids@google.com\u003e\nReviewed-by: Wanpeng Li \u003cwanpengli@tencent.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "52ad7eb3d668867f9ee2e34d715cfb4860d36a93", "tree": "98b16b079ee9c6e7b54b0556781b294a5a4220c2", "parents": [ "72aeb60c52bf74a0eeec77d6b41ce40145697d76" ], "author": { "name": "Liran Alon", "email": "liran.alon@oracle.com", "time": "Tue Nov 13 17:44:46 2018 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Tue Nov 27 12:50:30 2018 +0100" }, "message": "KVM: nVMX: vmcs12 revision_id is always VMCS12_REVISION even when copied from eVMCS\n\nvmcs12 represents the per-CPU cache of L1 active vmcs12.\n\nThis cache can be loaded by one of the following:\n1) Guest making a vmcs12 active by exeucting VMPTRLD\n2) Guest specifying eVMCS in VP assist page and executing\nVMLAUNCH/VMRESUME.\n\nEither way, vmcs12 should have revision_id of VMCS12_REVISION.\nWhich is not equal to eVMCS revision_id which specifies used\nVersionNumber of eVMCS struct (e.g. KVM_EVMCS_VERSION).\n\nSpecifically, this causes an issue in restoring a nested VM state\nbecause vmx_set_nested_state() verifies that vmcs12-\u003erevision_id\nis equal to VMCS12_REVISION which was not true in case vmcs12\nwas populated from an eVMCS by vmx_get_nested_state() which calls\ncopy_enlightened_to_vmcs12().\n\nReviewed-by: Darren Kenny \u003cdarren.kenny@oracle.com\u003e\nSigned-off-by: Liran Alon \u003cliran.alon@oracle.com\u003e\nReviewed-by: Vitaly Kuznetsov \u003cvkuznets@redhat.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "72aeb60c52bf74a0eeec77d6b41ce40145697d76", "tree": "7bbcf4b6e159b0f122776e1c05fd18467d765b40", "parents": [ "326e742533bf0a23f0127d8ea62fb558ba665f08" ], "author": { "name": "Liran Alon", "email": "liran.alon@oracle.com", "time": "Thu Nov 01 10:57:39 2018 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Tue Nov 27 12:50:29 2018 +0100" }, "message": "KVM: nVMX: Verify eVMCS revision id match supported eVMCS version on eVMCS VMPTRLD\n\nAccording to TLFS section 16.11.2 Enlightened VMCS, the first u32\nfield of eVMCS should specify eVMCS VersionNumber.\n\nThis version should be in the range of supported eVMCS versions exposed\nto guest via CPUID.0x4000000A.EAX[0:15].\nThe range which KVM expose to guest in this CPUID field should be the\nsame as the value returned in vmcs_version by nested_enable_evmcs().\n\nAccording to the above, eVMCS VMPTRLD should verify that version specified\nin given eVMCS is in the supported range. However, current code\nmistakenly verfies this field against VMCS12_REVISION.\n\nOne can also see that when KVM use eVMCS, it makes sure that\nalloc_vmcs_cpu() sets allocated eVMCS revision_id to KVM_EVMCS_VERSION.\n\nObvious fix should just change eVMCS VMPTRLD to verify first u32 field\nof eVMCS is equal to KVM_EVMCS_VERSION.\nHowever, it turns out that Microsoft Hyper-V fails to comply to their\nown invented interface: When Hyper-V use eVMCS, it just sets first u32\nfield of eVMCS to revision_id specified in MSR_IA32_VMX_BASIC (In our\ncase: VMCS12_REVISION). Instead of used eVMCS version number which is\none of the supported versions specified in CPUID.0x4000000A.EAX[0:15].\nTo overcome Hyper-V bug, we accept either a supported eVMCS version\nor VMCS12_REVISION as valid values for first u32 field of eVMCS.\n\nCc: Vitaly Kuznetsov \u003cvkuznets@redhat.com\u003e\nReviewed-by: Nikita Leshenko \u003cnikita.leshchenko@oracle.com\u003e\nReviewed-by: Mark Kanda \u003cmark.kanda@oracle.com\u003e\nSigned-off-by: Liran Alon \u003cliran.alon@oracle.com\u003e\nReviewed-by: Vitaly Kuznetsov \u003cvkuznets@redhat.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "326e742533bf0a23f0127d8ea62fb558ba665f08", "tree": "e347b3ba50e3338957d9fca8971fe083b94065c1", "parents": [ "1e4329ee2c52692ea42cc677fb2133519718b34a" ], "author": { "name": "Leonid Shatz", "email": "leonid.shatz@oracle.com", "time": "Tue Nov 06 12:14:25 2018 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Tue Nov 27 12:50:10 2018 +0100" }, "message": "KVM: nVMX/nSVM: Fix bug which sets vcpu-\u003earch.tsc_offset to L1 tsc_offset\n\nSince commit e79f245ddec1 (\"X86/KVM: Properly update \u0027tsc_offset\u0027 to\nrepresent the running guest\"), vcpu-\u003earch.tsc_offset meaning was\nchanged to always reflect the tsc_offset value set on active VMCS.\nRegardless if vCPU is currently running L1 or L2.\n\nHowever, above mentioned commit failed to also change\nkvm_vcpu_write_tsc_offset() to set vcpu-\u003earch.tsc_offset correctly.\nThis is because vmx_write_tsc_offset() could set the tsc_offset value\nin active VMCS to given offset parameter *plus vmcs12-\u003etsc_offset*.\nHowever, kvm_vcpu_write_tsc_offset() just sets vcpu-\u003earch.tsc_offset\nto given offset parameter. Without taking into account the possible\naddition of vmcs12-\u003etsc_offset. (Same is true for SVM case).\n\nFix this issue by changing kvm_x86_ops-\u003ewrite_tsc_offset() to return\nactually set tsc_offset in active VMCS and modify\nkvm_vcpu_write_tsc_offset() to set returned value in\nvcpu-\u003earch.tsc_offset.\nIn addition, rename write_tsc_offset() callback to write_l1_tsc_offset()\nto make it clear that it is meant to set L1 TSC offset.\n\nFixes: e79f245ddec1 (\"X86/KVM: Properly update \u0027tsc_offset\u0027 to represent the running guest\")\nReviewed-by: Liran Alon \u003cliran.alon@oracle.com\u003e\nReviewed-by: Mihai Carabas \u003cmihai.carabas@oracle.com\u003e\nReviewed-by: Krish Sadhukhan \u003ckrish.sadhukhan@oracle.com\u003e\nSigned-off-by: Leonid Shatz \u003cleonid.shatz@oracle.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "1e4329ee2c52692ea42cc677fb2133519718b34a", "tree": "464a08290aad0b0b8a7a94f9a77d0476899c7837", "parents": [ "354cb410d87314e2eda344feea84809e4261570a" ], "author": { "name": "Yi Wang", "email": "wang.yi59@zte.com.cn", "time": "Thu Nov 08 11:22:21 2018 +0800" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Tue Nov 27 12:50:09 2018 +0100" }, "message": "x86/kvm/vmx: fix old-style function declaration\n\nThe inline keyword which is not at the beginning of the function\ndeclaration may trigger the following build warnings, so let\u0027s fix it:\n\narch/x86/kvm/vmx.c:1309:1: warning: ‘inline’ is not at beginning of declaration [-Wold-style-declaration]\narch/x86/kvm/vmx.c:5947:1: warning: ‘inline’ is not at beginning of declaration [-Wold-style-declaration]\narch/x86/kvm/vmx.c:5985:1: warning: ‘inline’ is not at beginning of declaration [-Wold-style-declaration]\narch/x86/kvm/vmx.c:6023:1: warning: ‘inline’ is not at beginning of declaration [-Wold-style-declaration]\n\nSigned-off-by: Yi Wang \u003cwang.yi59@zte.com.cn\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "354cb410d87314e2eda344feea84809e4261570a", "tree": "e268e1f121873eb78869e77479e78dad830df554", "parents": [ "f48b4711dd6e1cf282f9dfd159c14a305909c97c" ], "author": { "name": "Yi Wang", "email": "wang.yi59@zte.com.cn", "time": "Thu Nov 08 16:48:36 2018 +0800" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Tue Nov 27 12:50:09 2018 +0100" }, "message": "KVM: x86: fix empty-body warnings\n\nWe get the following warnings about empty statements when building\nwith \u0027W\u003d1\u0027:\n\narch/x86/kvm/lapic.c:632:53: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body]\narch/x86/kvm/lapic.c:1907:42: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body]\narch/x86/kvm/lapic.c:1936:65: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body]\narch/x86/kvm/lapic.c:1975:44: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body]\n\nRework the debug helper macro to get rid of these warnings.\n\nSigned-off-by: Yi Wang \u003cwang.yi59@zte.com.cn\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "f48b4711dd6e1cf282f9dfd159c14a305909c97c", "tree": "ab6d9062350fc920fdfcd69808f80fe120d3baa8", "parents": [ "bcbfbd8ec21096027f1ee13ce6c185e8175166f6" ], "author": { "name": "Liran Alon", "email": "liran.alon@oracle.com", "time": "Tue Nov 20 18:03:25 2018 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Tue Nov 27 12:50:08 2018 +0100" }, "message": "KVM: VMX: Update shared MSRs to be saved/restored on MSR_EFER.LMA changes\n\nWhen guest transitions from/to long-mode by modifying MSR_EFER.LMA,\nthe list of shared MSRs to be saved/restored on guest\u003c-\u003ehost\ntransitions is updated (See vmx_set_efer() call to setup_msrs()).\n\nOn every entry to guest, vcpu_enter_guest() calls\nvmx_prepare_switch_to_guest(). This function should also take care\nof setting the shared MSRs to be saved/restored. However, the\nfunction does nothing in case we are already running with loaded\nguest state (vmx-\u003eloaded_cpu_state !\u003d NULL).\n\nThis means that even when guest modifies MSR_EFER.LMA which results\nin updating the list of shared MSRs, it isn\u0027t being taken into account\nby vmx_prepare_switch_to_guest() because it happens while we are\nrunning with loaded guest state.\n\nTo fix above mentioned issue, add a flag to mark that the list of\nshared MSRs has been updated and modify vmx_prepare_switch_to_guest()\nto set shared MSRs when running with host state *OR* list of shared\nMSRs has been updated.\n\nNote that this issue was mistakenly introduced by commit\n678e315e78a7 (\"KVM: vmx: add dedicated utility to access guest\u0027s\nkernel_gs_base\") because previously vmx_set_efer() always called\nvmx_load_host_state() which resulted in vmx_prepare_switch_to_guest() to\nset shared MSRs.\n\nFixes: 678e315e78a7 (\"KVM: vmx: add dedicated utility to access guest\u0027s kernel_gs_base\")\nReported-by: Eyal Moscovici \u003ceyal.moscovici@oracle.com\u003e\nReviewed-by: Mihai Carabas \u003cmihai.carabas@oracle.com\u003e\nReviewed-by: Liam Merwick \u003cliam.merwick@oracle.com\u003e\nReviewed-by: Jim Mattson \u003cjmattson@google.com\u003e\nSigned-off-by: Liran Alon \u003cliran.alon@oracle.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "bcbfbd8ec21096027f1ee13ce6c185e8175166f6", "tree": "37f93e550fe07cf619662e165db685793e9ae347", "parents": [ "7f9ad1dfa3c768d1116c2dbacd7a09f9a871534e" ], "author": { "name": "Liran Alon", "email": "liran.alon@oracle.com", "time": "Thu Nov 08 00:43:06 2018 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Tue Nov 27 12:49:57 2018 +0100" }, "message": "KVM: x86: Fix kernel info-leak in KVM_HC_CLOCK_PAIRING hypercall\n\nkvm_pv_clock_pairing() allocates local var\n\"struct kvm_clock_pairing clock_pairing\" on stack and initializes\nall it\u0027s fields besides padding (clock_pairing.pad[]).\n\nBecause clock_pairing var is written completely (including padding)\nto guest memory, failure to init struct padding results in kernel\ninfo-leak.\n\nFix the issue by making sure to also init the padding with zeroes.\n\nFixes: 55dd00a73a51 (\"KVM: x86: add KVM_HC_CLOCK_PAIRING hypercall\")\nReported-by: syzbot+a8ef68d71211ba264f56@syzkaller.appspotmail.com\nReviewed-by: Mark Kanda \u003cmark.kanda@oracle.com\u003e\nSigned-off-by: Liran Alon \u003cliran.alon@oracle.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "7f9ad1dfa3c768d1116c2dbacd7a09f9a871534e", "tree": "0ff8d5efe19c1896b3a915da2eb94b8b485f25bc", "parents": [ "30510387a5e45bfcf8190e03ec7aa15b295828e2" ], "author": { "name": "Liran Alon", "email": "liran.alon@oracle.com", "time": "Sat Nov 17 14:05:06 2018 +0200" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Tue Nov 27 12:49:46 2018 +0100" }, "message": "KVM: nVMX: Fix kernel info-leak when enabling KVM_CAP_HYPERV_ENLIGHTENED_VMCS more than once\n\nConsider the case that userspace enables KVM_CAP_HYPERV_ENLIGHTENED_VMCS twice:\n1) kvm_vcpu_ioctl_enable_cap() is called to enable\nKVM_CAP_HYPERV_ENLIGHTENED_VMCS which calls nested_enable_evmcs().\n2) nested_enable_evmcs() sets enlightened_vmcs_enabled to true and fills\nvmcs_version which is then copied to userspace.\n3) kvm_vcpu_ioctl_enable_cap() is called again to enable\nKVM_CAP_HYPERV_ENLIGHTENED_VMCS which calls nested_enable_evmcs().\n4) This time nested_enable_evmcs() just returns 0 as\nenlightened_vmcs_enabled is already true. *Without filling\nvmcs_version*.\n5) kvm_vcpu_ioctl_enable_cap() continues as usual and copies\n*uninitialized* vmcs_version to userspace which leads to kernel info-leak.\n\nFix this issue by simply changing nested_enable_evmcs() to always fill\nvmcs_version output argument. Even when enlightened_vmcs_enabled is\nalready set to true.\n\nNote that SVM\u0027s nested_enable_evmcs() should not be modified because it\nalways returns a non-zero value (-ENODEV) which results in\nkvm_vcpu_ioctl_enable_cap() skipping the copy of vmcs_version to\nuserspace (as it should).\n\nFixes: 57b119da3594 (\"KVM: nVMX: add KVM_CAP_HYPERV_ENLIGHTENED_VMCS capability\")\nReported-by: syzbot+cfbc368e283d381f8cef@syzkaller.appspotmail.com\nReviewed-by: Krish Sadhukhan \u003ckrish.sadhukhan@oracle.com\u003e\nReviewed-by: Vitaly Kuznetsov \u003cvkuznets@redhat.com\u003e\nSigned-off-by: Liran Alon \u003cliran.alon@oracle.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "30510387a5e45bfcf8190e03ec7aa15b295828e2", "tree": "900b78639c8490d76590380358959afdb5d26c4c", "parents": [ "e97f852fd4561e77721bb9a4e0ea9d98305b1e93" ], "author": { "name": "Wei Wang", "email": "wawei@amazon.de", "time": "Mon Nov 12 12:23:14 2018 +0000" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Tue Nov 27 12:49:39 2018 +0100" }, "message": "svm: Add mutex_lock to protect apic_access_page_done on AMD systems\n\nThere is a race condition when accessing kvm-\u003earch.apic_access_page_done.\nDue to it, x86_set_memory_region will fail when creating the second vcpu\nfor a svm guest.\n\nAdd a mutex_lock to serialize the accesses to apic_access_page_done.\nThis lock is also used by vmx for the same purpose.\n\nSigned-off-by: Wei Wang \u003cwawei@amazon.de\u003e\nSigned-off-by: Amadeusz Juskowiak \u003cajusk@amazon.de\u003e\nSigned-off-by: Julian Stecklina \u003cjsteckli@amazon.de\u003e\nSigned-off-by: Suravee Suthikulpanit \u003csuravee.suthikulpanit@amd.com\u003e\nReviewed-by: Joerg Roedel \u003cjroedel@suse.de\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "e97f852fd4561e77721bb9a4e0ea9d98305b1e93", "tree": "49fc6202eb630d1c89b31ad4036f8131ba1d171d", "parents": [ "38ab012f109caf10f471db1adf284e620dd8d701" ], "author": { "name": "Wanpeng Li", "email": "wanpengli@tencent.com", "time": "Tue Nov 20 16:34:18 2018 +0800" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Tue Nov 27 12:49:20 2018 +0100" }, "message": "KVM: X86: Fix scan ioapic use-before-initialization\n\nReported by syzkaller:\n\n BUG: unable to handle kernel NULL pointer dereference at 00000000000001c8\n PGD 80000003ec4da067 P4D 80000003ec4da067 PUD 3f7bfa067 PMD 0\n Oops: 0000 [#1] PREEMPT SMP PTI\n CPU: 7 PID: 5059 Comm: debug Tainted: G OE 4.19.0-rc5 #16\n RIP: 0010:__lock_acquire+0x1a6/0x1990\n Call Trace:\n lock_acquire+0xdb/0x210\n _raw_spin_lock+0x38/0x70\n kvm_ioapic_scan_entry+0x3e/0x110 [kvm]\n vcpu_enter_guest+0x167e/0x1910 [kvm]\n kvm_arch_vcpu_ioctl_run+0x35c/0x610 [kvm]\n kvm_vcpu_ioctl+0x3e9/0x6d0 [kvm]\n do_vfs_ioctl+0xa5/0x690\n ksys_ioctl+0x6d/0x80\n __x64_sys_ioctl+0x1a/0x20\n do_syscall_64+0x83/0x6e0\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\n\nThe reason is that the testcase writes hyperv synic HV_X64_MSR_SINT6 msr\nand triggers scan ioapic logic to load synic vectors into EOI exit bitmap.\nHowever, irqchip is not initialized by this simple testcase, ioapic/apic\nobjects should not be accessed.\nThis can be triggered by the following program:\n\n #define _GNU_SOURCE\n\n #include \u003cendian.h\u003e\n #include \u003cstdint.h\u003e\n #include \u003cstdio.h\u003e\n #include \u003cstdlib.h\u003e\n #include \u003cstring.h\u003e\n #include \u003csys/syscall.h\u003e\n #include \u003csys/types.h\u003e\n #include \u003cunistd.h\u003e\n\n uint64_t r[3] \u003d {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};\n\n int main(void)\n {\n \tsyscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);\n \tlong res \u003d 0;\n \tmemcpy((void*)0x20000040, \"/dev/kvm\", 9);\n \tres \u003d syscall(__NR_openat, 0xffffffffffffff9c, 0x20000040, 0, 0);\n \tif (res !\u003d -1)\n \t\tr[0] \u003d res;\n \tres \u003d syscall(__NR_ioctl, r[0], 0xae01, 0);\n \tif (res !\u003d -1)\n \t\tr[1] \u003d res;\n \tres \u003d syscall(__NR_ioctl, r[1], 0xae41, 0);\n \tif (res !\u003d -1)\n \t\tr[2] \u003d res;\n \tmemcpy(\n \t\t\t(void*)0x20000080,\n \t\t\t\"\\x01\\x00\\x00\\x00\\x00\\x5b\\x61\\xbb\\x96\\x00\\x00\\x40\\x00\\x00\\x00\\x00\\x01\\x00\"\n \t\t\t\"\\x08\\x00\\x00\\x00\\x00\\x00\\x0b\\x77\\xd1\\x78\\x4d\\xd8\\x3a\\xed\\xb1\\x5c\\x2e\\x43\"\n \t\t\t\"\\xaa\\x43\\x39\\xd6\\xff\\xf5\\xf0\\xa8\\x98\\xf2\\x3e\\x37\\x29\\x89\\xde\\x88\\xc6\\x33\"\n \t\t\t\"\\xfc\\x2a\\xdb\\xb7\\xe1\\x4c\\xac\\x28\\x61\\x7b\\x9c\\xa9\\xbc\\x0d\\xa0\\x63\\xfe\\xfe\"\n \t\t\t\"\\xe8\\x75\\xde\\xdd\\x19\\x38\\xdc\\x34\\xf5\\xec\\x05\\xfd\\xeb\\x5d\\xed\\x2e\\xaf\\x22\"\n \t\t\t\"\\xfa\\xab\\xb7\\xe4\\x42\\x67\\xd0\\xaf\\x06\\x1c\\x6a\\x35\\x67\\x10\\x55\\xcb\",\n \t\t\t106);\n \tsyscall(__NR_ioctl, r[2], 0x4008ae89, 0x20000080);\n \tsyscall(__NR_ioctl, r[2], 0xae80, 0);\n \treturn 0;\n }\n\nThis patch fixes it by bailing out scan ioapic if ioapic is not initialized in\nkernel.\n\nReported-by: Wei Wu \u003cww9210@gmail.com\u003e\nCc: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nCc: Radim Krčmář \u003crkrcmar@redhat.com\u003e\nCc: Wei Wu \u003cww9210@gmail.com\u003e\nSigned-off-by: Wanpeng Li \u003cwanpengli@tencent.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "38ab012f109caf10f471db1adf284e620dd8d701", "tree": "202f205bab89f3e44ce3d4c9eab3fae0e5871fec", "parents": [ "a87c99e61236ba8ca962ce97a19fab5ebd588d35" ], "author": { "name": "Wanpeng Li", "email": "kernellwp@gmail.com", "time": "Tue Nov 20 09:39:30 2018 +0800" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Tue Nov 27 12:48:56 2018 +0100" }, "message": "KVM: LAPIC: Fix pv ipis use-before-initialization\n\nReported by syzkaller:\n\n BUG: unable to handle kernel NULL pointer dereference at 0000000000000014\n PGD 800000040410c067 P4D 800000040410c067 PUD 40410d067 PMD 0\n Oops: 0000 [#1] PREEMPT SMP PTI\n CPU: 3 PID: 2567 Comm: poc Tainted: G OE 4.19.0-rc5 #16\n RIP: 0010:kvm_pv_send_ipi+0x94/0x350 [kvm]\n Call Trace:\n kvm_emulate_hypercall+0x3cc/0x700 [kvm]\n handle_vmcall+0xe/0x10 [kvm_intel]\n vmx_handle_exit+0xc1/0x11b0 [kvm_intel]\n vcpu_enter_guest+0x9fb/0x1910 [kvm]\n kvm_arch_vcpu_ioctl_run+0x35c/0x610 [kvm]\n kvm_vcpu_ioctl+0x3e9/0x6d0 [kvm]\n do_vfs_ioctl+0xa5/0x690\n ksys_ioctl+0x6d/0x80\n __x64_sys_ioctl+0x1a/0x20\n do_syscall_64+0x83/0x6e0\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\n\nThe reason is that the apic map has not yet been initialized, the testcase\ntriggers pv_send_ipi interface by vmcall which results in kvm-\u003earch.apic_map\nis dereferenced. This patch fixes it by checking whether or not apic map is\nNULL and bailing out immediately if that is the case.\n\nFixes: 4180bf1b65 (KVM: X86: Implement \"send IPI\" hypercall)\nReported-by: Wei Wu \u003cww9210@gmail.com\u003e\nCc: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nCc: Radim Krčmář \u003crkrcmar@redhat.com\u003e\nCc: Wei Wu \u003cww9210@gmail.com\u003e\nSigned-off-by: Wanpeng Li \u003cwanpengli@tencent.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "a87c99e61236ba8ca962ce97a19fab5ebd588d35", "tree": "e72c66d830d00b4d23efb88b1a34ae133cd2755c", "parents": [ "caf54f59e57e1652e2460d3a45dce233d44d5884" ], "author": { "name": "Luiz Capitulino", "email": "lcapitulino@redhat.com", "time": "Fri Nov 23 12:02:14 2018 -0500" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Tue Nov 27 12:48:43 2018 +0100" }, "message": "KVM: VMX: re-add ple_gap module parameter\n\nApparently, the ple_gap parameter was accidentally removed\nby commit c8e88717cfc6b36bedea22368d97667446318291. Add it\nback.\n\nSigned-off-by: Luiz Capitulino \u003clcapitulino@redhat.com\u003e\nCc: stable@vger.kernel.org\nFixes: c8e88717cfc6b36bedea22368d97667446318291\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n" }, { "commit": "2b9034b5eaddc09c0e9529b93446eb975f97f814", "tree": "b7013eec3efdf782371a429bbfa698b2cc5d43d4", "parents": [ "fa1e0c9690bfa19eadd2adbaf511fb4fef9270e6" ], "author": { "name": "David Miller", "email": "davem@davemloft.net", "time": "Mon Nov 26 21:55:09 2018 -0800" }, "committer": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Tue Nov 27 09:46:52 2018 +0100" }, "message": "sparc: Adjust bpf JIT prologue for PSEUDO calls.\n\nMove all arguments into output registers from input registers.\n\nThis path is exercised by test_verifier.c\u0027s \"calls: two calls with\nargs\" test. Adjust BPF_TAILCALL_PROLOGUE_SKIP as needed.\n\nLet\u0027s also make the prologue length a constant size regardless of\nthe combination of -\u003esaw_frame_pointer and -\u003esaw_tail_call\nsettings.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\n" }, { "commit": "38a35a78c5e270cbe53c4fef6b0d3c2da90dd849", "tree": "558671a432f90f55aa6aaf273041ee6f904caab5", "parents": [ "03bc996af0cc71c7f30c384d8ce7260172423b34" ], "author": { "name": "Max Filippov", "email": "jcmvbkbc@gmail.com", "time": "Mon Nov 26 18:06:01 2018 -0800" }, "committer": { "name": "Max Filippov", "email": "jcmvbkbc@gmail.com", "time": "Mon Nov 26 18:37:51 2018 -0800" }, "message": "xtensa: fix coprocessor part of ptrace_{get,set}xregs\n\nLayout of coprocessor registers in the elf_xtregs_t and\nxtregs_coprocessor_t may be different due to alignment. Thus it is not\nalways possible to copy data between the xtregs_coprocessor_t structure\nand the elf_xtregs_t and get correct values for all registers.\nUse a table of offsets and sizes of individual coprocessor register\ngroups to do coprocessor context copying in the ptrace_getxregs and\nptrace_setxregs.\nThis fixes incorrect coprocessor register values reading from the user\nprocess by the native gdb on an xtensa core with multiple coprocessors\nand registers with high alignment requirements.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Max Filippov \u003cjcmvbkbc@gmail.com\u003e\n" }, { "commit": "03bc996af0cc71c7f30c384d8ce7260172423b34", "tree": "2fc71a59a6e40c8a5309336f7225f78987418bb5", "parents": [ "2958b66694e018c552be0b60521fec27e8d12988" ], "author": { "name": "Max Filippov", "email": "jcmvbkbc@gmail.com", "time": "Mon Nov 26 15:18:26 2018 -0800" }, "committer": { "name": "Max Filippov", "email": "jcmvbkbc@gmail.com", "time": "Mon Nov 26 18:37:49 2018 -0800" }, "message": "xtensa: fix coprocessor context offset definitions\n\nCoprocessor context offsets are used by the assembly code that moves\ncoprocessor context between the individual fields of the\nthread_info::xtregs_cp structure and coprocessor registers.\nThis fixes coprocessor context clobbering on flushing and reloading\nduring normal user code execution and user process debugging in the\npresence of more than one coprocessor in the core configuration.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Max Filippov \u003cjcmvbkbc@gmail.com\u003e\n" }, { "commit": "2958b66694e018c552be0b60521fec27e8d12988", "tree": "60b3cfc5e1aa1a7f91736874a919012fa45175a2", "parents": [ "2e6e902d185027f8e3cb8b7305238f7e35d6a436" ], "author": { "name": "Max Filippov", "email": "jcmvbkbc@gmail.com", "time": "Mon Nov 26 13:29:41 2018 -0800" }, "committer": { "name": "Max Filippov", "email": "jcmvbkbc@gmail.com", "time": "Mon Nov 26 18:37:47 2018 -0800" }, "message": "xtensa: enable coprocessors that are being flushed\n\ncoprocessor_flush_all may be called from a context of a thread that is\ndifferent from the thread being flushed. In that case contents of the\ncpenable special register may not match ti-\u003ecpenable of the target\nthread, resulting in unhandled coprocessor exception in the kernel\ncontext.\nSet cpenable special register to the ti-\u003ecpenable of the target register\nfor the duration of the flush and restore it afterwards.\nThis fixes the following crash caused by coprocessor register inspection\nin native gdb:\n\n (gdb) p/x $w0\n Illegal instruction in kernel: sig: 9 [#1] PREEMPT\n Call Trace:\n ___might_sleep+0x184/0x1a4\n __might_sleep+0x41/0xac\n exit_signals+0x14/0x218\n do_exit+0xc9/0x8b8\n die+0x99/0xa0\n do_illegal_instruction+0x18/0x6c\n common_exception+0x77/0x77\n coprocessor_flush+0x16/0x3c\n arch_ptrace+0x46c/0x674\n sys_ptrace+0x2ce/0x3b4\n system_call+0x54/0x80\n common_exception+0x77/0x77\n note: gdb[100] exited with preempt_count 1\n Killed\n\nCc: stable@vger.kernel.org\nSigned-off-by: Max Filippov \u003cjcmvbkbc@gmail.com\u003e\n" }, { "commit": "ef78e5ec9214376c5cb989f5da70b02d0c117b66", "tree": "d111e5e3d4565275b10f9394ac7da6a1389d1274", "parents": [ "6f8b52ba442ce1372a58df4e85f169686ef52a0d" ], "author": { "name": "Matias Bjørling", "email": "mb@lightnvm.io", "time": "Mon Nov 26 11:27:03 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Nov 26 18:30:40 2018 -0800" }, "message": "ia64: export node_distance function\n\nThe numa_slit variable used by node_distance is available to a\nmodule as long as it is linked at compile-time. However, it is\nnot available to loadable modules. Leading to errors such as:\n\n ERROR: \"numa_slit\" [drivers/nvme/host/nvme-core.ko] undefined!\n\nThe error above is caused by the nvme multipath code that makes\nuse of node_distance for its path calculation. When the patch was\nadded, the lightnvm subsystem would select nvme and always compile\nit in, leading to the node_distance call to always succeed.\nHowever, when this requirement was removed, nvme could be compiled\nin as a module, which exposed this bug.\n\nThis patch extracts node_distance to a function and exports it.\nSince ACPI is depending on node_distance being a simple lookup to\nnuma_slit, the previous behavior is exposed as slit_distance and its\nusers updated.\n\nFixes: f333444708f82 \"nvme: take node locality into account when selecting a path\"\nFixes: 73569e11032f \"lightnvm: remove dependencies on BLK_DEV_NVME and PCI\"\nSigned-off-by: Matias Bjøring \u003cmb@lightnvm.io\u003e\nSigned-off-by: Tony Luck \u003ctony.luck@intel.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "fa1e0c9690bfa19eadd2adbaf511fb4fef9270e6", "tree": "6d265a283dc0c0b2aa07fedfe62ed89768f3b77a", "parents": [ "e2ac579a7a18bcd9e8cf14cf42eac0b8a2ba6c4b" ], "author": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Tue Nov 27 01:21:00 2018 +0100" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Mon Nov 26 18:11:48 2018 -0800" }, "message": "bpf, doc: add entries of who looks over which jits\n\nMake the high-level BPF JIT entry a general \u0027catch-all\u0027 and add\narchitecture specific entries to make it more clear who actively\nmaintains which BPF JIT compiler. The list (L) address implies\nthat this eventually lands in the bpf patchwork bucket. Goal is\nthat this set of responsible developers listed here is always up\nto date and a point of contact for helping out in e.g. feature\ndevelopment, fixes, review or testing patches in order to help\nlong-term in ensuring quality of the BPF JITs and therefore BPF\ncore under a given architecture. Every new JIT in future /must/\nhave an entry here as well.\n\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nAcked-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nAcked-by: Naveen N. Rao \u003cnaveen.n.rao@linux.vnet.ibm.com\u003e\nAcked-by: Sandipan Das \u003csandipan@linux.ibm.com\u003e\nAcked-by: Martin Schwidefsky \u003cschwidefsky@de.ibm.com\u003e\nAcked-by: Heiko Carstens \u003cheiko.carstens@de.ibm.com\u003e\nAcked-by: David S. Miller \u003cdavem@davemloft.net\u003e\nAcked-by: Zi Shen Lim \u003czlim.lnx@gmail.com\u003e\nAcked-by: Paul Burton \u003cpaul.burton@mips.com\u003e\nAcked-by: Jakub Kicinski \u003cjakub.kicinski@netronome.com\u003e\nAcked-by: Wang YanQing \u003cudknight@gmail.com\u003e\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "e2ac579a7a18bcd9e8cf14cf42eac0b8a2ba6c4b", "tree": "75afa7eec4276f83a823baec06bffa6103283168", "parents": [ "c44768a33da81b4a0986e79bbf0588f1a0651dec" ], "author": { "name": "David Miller", "email": "davem@davemloft.net", "time": "Mon Nov 26 14:52:18 2018 -0800" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Mon Nov 26 17:52:29 2018 -0800" }, "message": "sparc: Correct ctx-\u003esaw_frame_pointer logic.\n\nWe need to initialize the frame pointer register not just if it is\nseen as a source operand, but also if it is seen as the destination\noperand of a store or an atomic instruction (which effectively is a\nsource operand).\n\nThis is exercised by test_verifier\u0027s \"non-invalid fp arithmetic\"\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "c44768a33da81b4a0986e79bbf0588f1a0651dec", "tree": "2a4e4f7f9205412e7f84e2d1101fa6ca78cd7931", "parents": [ "fdac315d705a97e9edff1a40889fefd2df594422" ], "author": { "name": "David Miller", "email": "davem@davemloft.net", "time": "Mon Nov 26 13:03:46 2018 -0800" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Mon Nov 26 17:48:36 2018 -0800" }, "message": "sparc: Fix JIT fused branch convergance.\n\nOn T4 and later sparc64 cpus we can use the fused compare and branch\ninstruction.\n\nHowever, it can only be used if the branch destination is in the range\nof a signed 10-bit immediate offset. This amounts to 1024\ninstructions forwards or backwards.\n\nAfter the commit referenced in the Fixes: tag, the largest possible\nsize program seen by the JIT explodes by a significant factor.\n\nAs a result of this convergance takes many more passes since the\nexpanded \"BPF_LDX | BPF_MSH | BPF_B\" code sequence, for example,\ncontains several embedded branch on condition instructions.\n\nOn each pass, as suddenly new fused compare and branch instances\nbecome valid, this makes thousands more in range for the next pass.\nAnd so on and so forth.\n\nThis is most greatly exemplified by \"BPF_MAXINSNS: exec all MSH\" which\ntakes 35 passes to converge, and shrinks the image by about 64K.\n\nTo decrease the cost of this number of convergance passes, do the\nconvergance pass before we have the program image allocated, just like\nother JITs (such as x86) do.\n\nFixes: e0cea7ce988c (\"bpf: implement ld_abs/ld_ind in native bpf\")\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "fdac315d705a97e9edff1a40889fefd2df594422", "tree": "eaa5f5849390692a575aa95280313f41b5475ebe", "parents": [ "69500127424cd90ff2cf8191256b2ac3b0a4af56", "8c11ea5ce13da0252fc92f91e90b0cb0c8fe5619" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Mon Nov 26 17:34:25 2018 -0800" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Mon Nov 26 17:34:25 2018 -0800" }, "message": "Merge branch \u0027arm64-jit-fixes\u0027\n\nDaniel Borkmann says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nThis set contains a fix for arm64 BPF JIT. First patch generalizes\nppc64 way of retrieving subprog into bpf_jit_get_func_addr() as core\ncode and uses the same on arm64 in second patch. Tested on both arm64\nand ppc64.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "8c11ea5ce13da0252fc92f91e90b0cb0c8fe5619", "tree": "eaa5f5849390692a575aa95280313f41b5475ebe", "parents": [ "e2c95a61656d29ceaac97b6a975c8a1f26e26f15" ], "author": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Mon Nov 26 14:05:39 2018 +0100" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Mon Nov 26 17:34:24 2018 -0800" }, "message": "bpf, arm64: fix getting subprog addr from aux for calls\n\nThe arm64 JIT has the same issue as ppc64 JIT in that the relative BPF\nto BPF call offset can be too far away from core kernel in that relative\nencoding into imm is not sufficient and could potentially be truncated,\nsee also fd045f6cd98e (\"arm64: add support for module PLTs\") which adds\nspill-over space for module_alloc() and therefore bpf_jit_binary_alloc().\nTherefore, use the recently added bpf_jit_get_func_addr() helper for\nproperly fetching the address through prog-\u003eaux-\u003efunc[off]-\u003ebpf_func\ninstead. This also has the benefit to optimize normal helper calls since\ntheir address can use the optimized emission. Tested on Cavium ThunderX\nCN8890.\n\nFixes: db496944fdaa (\"bpf: arm64: add JIT support for multi-function programs\")\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "e2c95a61656d29ceaac97b6a975c8a1f26e26f15", "tree": "8fb9a3cc00ef0b47edb7428d297bc921b39e1f2f", "parents": [ "69500127424cd90ff2cf8191256b2ac3b0a4af56" ], "author": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Mon Nov 26 14:05:38 2018 +0100" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Mon Nov 26 17:34:24 2018 -0800" }, "message": "bpf, ppc64: generalize fetching subprog into bpf_jit_get_func_addr\n\nMake fetching of the BPF call address from ppc64 JIT generic. ppc64\nwas using a slightly different variant rather than through the insns\u0027\nimm field encoding as the target address would not fit into that space.\nTherefore, the target subprog number was encoded into the insns\u0027 offset\nand fetched through fp-\u003eaux-\u003efunc[off]-\u003ebpf_func instead. Given there\nare other JITs with this issue and the mechanism of fetching the address\nis JIT-generic, move it into the core as a helper instead. On the JIT\nside, we get information on whether the retrieved address is a fixed\none, that is, not changing through JIT passes, or a dynamic one. For\nthe former, JITs can optimize their imm emission because this doesn\u0027t\nchange jump offsets throughout JIT process.\n\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nReviewed-by: Sandipan Das \u003csandipan@linux.ibm.com\u003e\nTested-by: Sandipan Das \u003csandipan@linux.ibm.com\u003e\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "53ca0f2fec39c80ccd19e6e3f30cc8daef174b70", "tree": "d143e0e9bdcb026745c358ad96e8853bdcfd2896", "parents": [ "095faf45e64be00bff4da2d6182dface3d69c9b7" ], "author": { "name": "Taehee Yoo", "email": "ap420073@gmail.com", "time": "Sun Nov 25 18:47:13 2018 +0900" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Nov 27 00:48:12 2018 +0100" }, "message": "netfilter: nf_conncount: remove wrong condition check routine\n\nAll lists that reach the tree_nodes_free() function have both zero\ncounter and true dead flag. The reason for this is that lists to be\nrelease are selected by nf_conncount_gc_list() which already decrements\nthe list counter and sets on the dead flag. Therefore, this if statement\nin tree_nodes_free() is unnecessary and wrong.\n\nFixes: 31568ec09ea0 (\"netfilter: nf_conncount: fix list_del corruption in conn_free\")\nSigned-off-by: Taehee Yoo \u003cap420073@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "095faf45e64be00bff4da2d6182dface3d69c9b7", "tree": "60033b5b6734ecac6f2dafd60cd37674bbf25555", "parents": [ "584eab291c67894cb17cc87544b9d086228ea70f" ], "author": { "name": "Taehee Yoo", "email": "ap420073@gmail.com", "time": "Thu Nov 22 19:59:57 2018 +0900" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Nov 27 00:36:46 2018 +0100" }, "message": "netfilter: nat: fix double register in masquerade modules\n\nThere is a reference counter to ensure that masquerade modules register\nnotifiers only once. However, the existing reference counter approach is\nnot safe, test commands are:\n\n while :\n do\n \t modprobe ip6t_MASQUERADE \u0026\n\t modprobe nft_masq_ipv6 \u0026\n\t modprobe -rv ip6t_MASQUERADE \u0026\n\t modprobe -rv nft_masq_ipv6 \u0026\n done\n\nnumbers below represent the reference counter.\n--------------------------------------------------------\nCPU0 CPU1 CPU2 CPU3 CPU4\n[insmod] [insmod] [rmmod] [rmmod] [insmod]\n--------------------------------------------------------\n0-\u003e1\nregister 1-\u003e2\n returns 2-\u003e1\n\t\t\treturns 1-\u003e0\n 0-\u003e1\n register \u003c--\n unregister\n--------------------------------------------------------\n\nThe unregistation of CPU3 should be processed before the\nregistration of CPU4.\n\nIn order to fix this, use a mutex instead of reference counter.\n\nsplat looks like:\n[ 323.869557] watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [modprobe:1381]\n[ 323.869574] Modules linked in: nf_tables(+) nf_nat_ipv6(-) nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 n]\n[ 323.869574] irq event stamp: 194074\n[ 323.898930] hardirqs last enabled at (194073): [\u003cffffffff90004a0d\u003e] trace_hardirqs_on_thunk+0x1a/0x1c\n[ 323.898930] hardirqs last disabled at (194074): [\u003cffffffff90004a29\u003e] trace_hardirqs_off_thunk+0x1a/0x1c\n[ 323.898930] softirqs last enabled at (182132): [\u003cffffffff922006ec\u003e] __do_softirq+0x6ec/0xa3b\n[ 323.898930] softirqs last disabled at (182109): [\u003cffffffff90193426\u003e] irq_exit+0x1a6/0x1e0\n[ 323.898930] CPU: 0 PID: 1381 Comm: modprobe Not tainted 4.20.0-rc2+ #27\n[ 323.898930] RIP: 0010:raw_notifier_chain_register+0xea/0x240\n[ 323.898930] Code: 3c 03 0f 8e f2 00 00 00 44 3b 6b 10 7f 4d 49 bc 00 00 00 00 00 fc ff df eb 22 48 8d 7b 10 488\n[ 323.898930] RSP: 0018:ffff888101597218 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13\n[ 323.898930] RAX: 0000000000000000 RBX: ffffffffc04361c0 RCX: 0000000000000000\n[ 323.898930] RDX: 1ffffffff26132ae RSI: ffffffffc04aa3c0 RDI: ffffffffc04361d0\n[ 323.898930] RBP: ffffffffc04361c8 R08: 0000000000000000 R09: 0000000000000001\n[ 323.898930] R10: ffff8881015972b0 R11: fffffbfff26132c4 R12: dffffc0000000000\n[ 323.898930] R13: 0000000000000000 R14: 1ffff110202b2e44 R15: ffffffffc04aa3c0\n[ 323.898930] FS: 00007f813ed41540(0000) GS:ffff88811ae00000(0000) knlGS:0000000000000000\n[ 323.898930] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 323.898930] CR2: 0000559bf2c9f120 CR3: 000000010bc80000 CR4: 00000000001006f0\n[ 323.898930] Call Trace:\n[ 323.898930] ? atomic_notifier_chain_register+0x2d0/0x2d0\n[ 323.898930] ? down_read+0x150/0x150\n[ 323.898930] ? sched_clock_cpu+0x126/0x170\n[ 323.898930] ? nf_tables_core_module_init+0xe4/0xe4 [nf_tables]\n[ 323.898930] ? nf_tables_core_module_init+0xe4/0xe4 [nf_tables]\n[ 323.898930] register_netdevice_notifier+0xbb/0x790\n[ 323.898930] ? __dev_close_many+0x2d0/0x2d0\n[ 323.898930] ? __mutex_unlock_slowpath+0x17f/0x740\n[ 323.898930] ? wait_for_completion+0x710/0x710\n[ 323.898930] ? nf_tables_core_module_init+0xe4/0xe4 [nf_tables]\n[ 323.898930] ? up_write+0x6c/0x210\n[ 323.898930] ? nf_tables_core_module_init+0xe4/0xe4 [nf_tables]\n[ 324.127073] ? nf_tables_core_module_init+0xe4/0xe4 [nf_tables]\n[ 324.127073] nft_chain_filter_init+0x1e/0xe8a [nf_tables]\n[ 324.127073] nf_tables_module_init+0x37/0x92 [nf_tables]\n[ ... ]\n\nFixes: 8dd33cc93ec9 (\"netfilter: nf_nat: generalize IPv4 masquerading support for nf_tables\")\nFixes: be6b635cd674 (\"netfilter: nf_nat: generalize IPv6 masquerading support for nf_tables\")\nSigned-off-by: Taehee Yoo \u003cap420073@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "584eab291c67894cb17cc87544b9d086228ea70f", "tree": "46e21a3a2d87392a04e3861c4a2a836085280b9f", "parents": [ "508b09046c0f21678652fb66fd1e9959d55591d2" ], "author": { "name": "Taehee Yoo", "email": "ap420073@gmail.com", "time": "Thu Nov 22 19:59:46 2018 +0900" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Nov 27 00:35:19 2018 +0100" }, "message": "netfilter: add missing error handling code for register functions\n\nregister_{netdevice/inetaddr/inet6addr}_notifier may return an error\nvalue, this patch adds the code to handle these error paths.\n\nSigned-off-by: Taehee Yoo \u003cap420073@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "508b09046c0f21678652fb66fd1e9959d55591d2", "tree": "c5e1d0164c2919c9b82ffc502195ef25b64a261d", "parents": [ "89259088c1b7fecb43e8e245dc931909132a4e03" ], "author": { "name": "Alin Nastac", "email": "alin.nastac@gmail.com", "time": "Wed Nov 21 14:00:30 2018 +0100" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Tue Nov 27 00:12:20 2018 +0100" }, "message": "netfilter: ipv6: Preserve link scope traffic original oif\n\nWhen ip6_route_me_harder is invoked, it resets outgoing interface of:\n - link-local scoped packets sent by neighbor discovery\n - multicast packets sent by MLD host\n - multicast packets send by MLD proxy daemon that sets outgoing\n interface through IPV6_PKTINFO ipi6_ifindex\n\nLink-local and multicast packets must keep their original oif after\nip6_route_me_harder is called.\n\nSigned-off-by: Alin Nastac \u003calin.nastac@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "6f8b52ba442ce1372a58df4e85f169686ef52a0d", "tree": "5dd92d4b683559ecbdbd905352f792f5de9637c2", "parents": [ "2e6e902d185027f8e3cb8b7305238f7e35d6a436", "09aaf6813cfca4c18034fda7a43e68763f34abb1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Nov 26 09:34:31 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Nov 26 09:34:31 2018 -0800" }, "message": "Merge tag \u0027hwmon-for-v4.20-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n\n - fix temp4_type attribute permissions in w83795 driver\n\n - fix tacho fault detection in mlxreg-fan driver\n\n - fix current value calculations in ina2xx driver\n\n - fix initial notification/warning in raspberrypi driver\n\n - fix a NULL pointer access in ina2xx\n\n* tag \u0027hwmon-for-v4.20-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n hwmon: (w83795) temp4_type has writable permission\n hwmon: (mlxreg-fan) Fix macros for tacho fault reading\n hwmon: (ina2xx) Fix current value calculation\n hwmon: (raspberrypi) Fix initial notify\n hwmon (ina2xx) Fix NULL id pointer in probe()\n" }, { "commit": "89259088c1b7fecb43e8e245dc931909132a4e03", "tree": "d861dbca5198ce5c47d46f9e01343fff00da034d", "parents": [ "2a31e4bd9ad255ee40809b5c798c4b1c2b09703b" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Sat Nov 17 11:32:29 2018 +0100" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Mon Nov 26 10:25:20 2018 +0100" }, "message": "netfilter: nfnetlink_cttimeout: fetch timeouts for udplite and gre, too\n\nsyzbot was able to trigger the WARN in cttimeout_default_get() by\npassing UDPLITE as l4protocol. Alias UDPLITE to UDP, both use\nsame timeout values.\n\nFurthermore, also fetch GRE timeouts. GRE is a bit more complicated,\nas it still can be a module and its netns_proto_gre struct layout isn\u0027t\nvisible outside of the gre module. Can\u0027t move timeouts around, it\nappears conntrack sysctl unregister assumes net_generic() returns\nnf_proto_net, so we get crash. Expose layout of netns_proto_gre instead.\n\nA followup nf-next patch could make gre tracker be built-in as well\nif needed, its not that large.\n\nLast, make the WARN() mention the missing protocol value in case\nanything else is missing.\n\nReported-by: syzbot+2fae8fa157dd92618cae@syzkaller.appspotmail.com\nFixes: 8866df9264a3 (\"netfilter: nfnetlink_cttimeout: pass default timeout policy to obj_to_nlattr\")\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "2a31e4bd9ad255ee40809b5c798c4b1c2b09703b", "tree": "0f68039155916d0e041f4a2f8ebc4afcdcbc7baa", "parents": [ "b4e955e9f372035361fbc6f07b21fe2cc6a5be4a" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Thu Nov 15 15:14:30 2018 +0800" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Mon Nov 26 10:23:42 2018 +0100" }, "message": "ipvs: call ip_vs_dst_notifier earlier than ipv6_dev_notf\n\nip_vs_dst_event is supposed to clean up all dst used in ipvs\u0027\ndestinations when a net dev is going down. But it works only\nwhen the dst\u0027s dev is the same as the dev from the event.\n\nNow with the same priority but late registration,\nip_vs_dst_notifier is always called later than ipv6_dev_notf\nwhere the dst\u0027s dev is set to lo for NETDEV_DOWN event.\n\nAs the dst\u0027s dev lo is not the same as the dev from the event\nin ip_vs_dst_event, ip_vs_dst_notifier doesn\u0027t actually work.\nAlso as these dst have to wait for dest_trash_timer to clean\nthem up. It would cause some non-permanent kernel warnings:\n\n unregister_netdevice: waiting for br0 to become free. Usage count \u003d 3\n\nTo fix it, call ip_vs_dst_notifier earlier than ipv6_dev_notf\nby increasing its priority to ADDRCONF_NOTIFY_PRIORITY + 5.\n\nNote that for ipv4 route fib_netdev_notifier doesn\u0027t set dst\u0027s\ndev to lo in NETDEV_DOWN event, so this fix is only needed when\nIP_VS_IPV6 is defined.\n\nFixes: 7a4f0761fce3 (\"IPVS: init and cleanup restructuring\")\nReported-by: Li Shuang \u003cshuali@redhat.com\u003e\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nAcked-by: Julian Anastasov \u003cja@ssi.bg\u003e\nAcked-by: Simon Horman \u003chorms@verge.net.au\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "69500127424cd90ff2cf8191256b2ac3b0a4af56", "tree": "0c28501d1b0ba294b0f63803eb72b4af1594d870", "parents": [ "aba36930a35e7f1fe1319b203f25c05d6c119936", "1efb6ee3edea57f57f9fb05dba8dcb3f7333f61f" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Nov 25 20:04:58 2018 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Nov 25 20:04:58 2018 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nDaniel Borkmann says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull-request: bpf 2018-11-25\n\nThe following pull-request contains BPF updates for your *net* tree.\n\nThe main changes are:\n\n1) Fix an off-by-one bug when adjusting subprog start offsets after\n patching, from Edward.\n\n2) Fix several bugs such as overflow in size allocation in queue /\n stack map creation, from Alexei.\n\n3) Fix wrong IPv6 destination port byte order in bpf_sk_lookup_udp\n helper, from Andrey.\n\n4) Fix several bugs in bpftool such as preventing an infinite loop\n in get_fdinfo, error handling and man page references, from Quentin.\n\n5) Fix a warning in bpf_trace_printk() that wasn\u0027t catching an\n invalid format string, from Martynas.\n\n6) Fix a bug in BPF cgroup local storage where non-atomic allocation\n was used in atomic context, from Roman.\n\n7) Fix a NULL pointer dereference bug in bpftool from reallocarray()\n error handling, from Jakub and Wen.\n\n8) Add a copy of pkt_cls.h and tc_bpf.h uapi headers to the tools\n include infrastructure so that bpftool compiles on older RHEL7-like\n user space which does not ship these headers, from Yonghong.\n\n9) Fix BPF kselftests for user space where to get ping test working\n with ping6 and ping -6, from Li.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "2e6e902d185027f8e3cb8b7305238f7e35d6a436", "tree": "9b3ba6d8ff82308734c5d57f7d3957f62466b304", "parents": [ "d6d460b89378b1bc6715574cdafd748ba59d5a27" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 25 14:19:31 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 25 14:19:31 2018 -0800" }, "message": "Linux 4.20-rc4\n" }, { "commit": "caf54f59e57e1652e2460d3a45dce233d44d5884", "tree": "074648942cb7877bb7e3b0295cca0f87f440db1a", "parents": [ "9ff01193a20d391e8dbce4403dd5ef87c7eaaca6", "6c08ec1216b7b2f84b9755f339d6009768599256" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sun Nov 25 18:56:32 2018 +0100" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sun Nov 25 18:56:32 2018 +0100" }, "message": "Merge tag \u0027kvm-ppc-fixes-4.20-1\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc into HEAD\n\nPPC KVM fixes for 4.20\n\nThis has a single 1-line patch which fixes a bug in the recently-merged\nnested HV KVM support.\n" }, { "commit": "d6d460b89378b1bc6715574cdafd748ba59d5a27", "tree": "b43a2f09bf1fa86264cc01c42f0650832c6619f0", "parents": [ "17c2f540863a6c0faa3f0ede3c785d9427bcaf80", "cb216b84d6ea24fa10f1e7aac35de77246841041" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 25 09:24:40 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 25 09:24:40 2018 -0800" }, "message": "Merge tag \u0027dma-mapping-4.20-3\u0027 of git://git.infradead.org/users/hch/dma-mapping\n\nPull dma-mapping fixes from Christoph Hellwig:\n \"Two dma-direct / swiotlb regressions fixes:\n\n - zero is a valid physical address on some arm boards, we can\u0027t use\n it as the error value\n\n - don\u0027t try to cache flush the error return value (no matter what it\n is)\"\n\n* tag \u0027dma-mapping-4.20-3\u0027 of git://git.infradead.org/users/hch/dma-mapping:\n swiotlb: Skip cache maintenance on map error\n dma-direct: Make DIRECT_MAPPING_ERROR viable for SWIOTLB\n" }, { "commit": "17c2f540863a6c0faa3f0ede3c785d9427bcaf80", "tree": "8c90950536b5bbbd63783b1b29b90f7e1907c647", "parents": [ "4e962ff6e34f44c400c548da0c1e2393053a691e", "bb21ce0ad227b69ec0f83279297ee44232105d96" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 25 09:19:58 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 25 09:19:58 2018 -0800" }, "message": "Merge tag \u0027nfs-for-4.20-4\u0027 of git://git.linux-nfs.org/projects/trondmy/linux-nfs\n\nPull NFS client bugfixes from Trond Myklebust:\n\n - Fix a NFSv4 state manager deadlock when returning a delegation\n\n - NFSv4.2 copy do not allocate memory under the lock\n\n - flexfiles: Use the correct stateid for IO in the tightly coupled case\n\n* tag \u0027nfs-for-4.20-4\u0027 of git://git.linux-nfs.org/projects/trondmy/linux-nfs:\n flexfiles: use per-mirror specified stateid for IO\n NFSv4.2 copy do not allocate memory under the lock\n NFSv4: Fix a NFSv4 state manager deadlock\n" }, { "commit": "4e962ff6e34f44c400c548da0c1e2393053a691e", "tree": "dc6750adfd23a9a12af5f74fcb59a43363afaee9", "parents": [ "e2125dac22f2c9c66c412cd8e049a7305af59f73" ], "author": { "name": "Luc Van Oostenryck", "email": "luc.vanoostenryck@gmail.com", "time": "Sun Nov 25 17:34:05 2018 +0100" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Nov 25 09:17:43 2018 -0800" }, "message": "MAINTAINERS: change Sparse\u0027s maintainer\n\nI\u0027m taking over the maintainance of Sparse so add myself as\nmaintainer and move Christopher\u0027s info to CREDITS.\n\nSigned-off-by: Luc Van Oostenryck \u003cluc.vanoostenryck@gmail.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "e2125dac22f2c9c66c412cd8e049a7305af59f73", "tree": "8584af248ee592622bd6e8a7f9cee0b041b784cc", "parents": [ "e195ca6cb6f21633e56322d5aa11ed59cdb22fb2", "fffc9a260e38acec3187515738122a3ecb24ac90" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 24 18:44:01 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 24 18:44:01 2018 -0800" }, "message": "Merge tag \u0027xarray-4.20-rc4\u0027 of git://git.infradead.org/users/willy/linux-dax\n\nPull XArray updates from Matthew Wilcox:\n \"We found some bugs in the DAX conversion to XArray (and one bug which\n predated the XArray conversion). There were a couple of bugs in some\n of the higher-level functions, which aren\u0027t actually being called in\n today\u0027s kernel, but surfaced as a result of converting existing radix\n tree \u0026 IDR users over to the XArray.\n\n Some of the other changes to how the higher-level APIs work were also\n motivated by converting various users; again, they\u0027re not in use in\n today\u0027s kernel, so changing them has a low probability of introducing\n a bug.\n\n Dan can still trigger a bug in the DAX code with hot-offline/online,\n and we\u0027re working on tracking that down\"\n\n* tag \u0027xarray-4.20-rc4\u0027 of git://git.infradead.org/users/willy/linux-dax:\n XArray tests: Add missing locking\n dax: Avoid losing wakeup in dax_lock_mapping_entry\n dax: Fix huge page faults\n dax: Fix dax_unlock_mapping_entry for PMD pages\n dax: Reinstate RCU protection of inode\n dax: Make sure the unlocking entry isn\u0027t locked\n dax: Remove optimisation from dax_lock_mapping_entry\n XArray tests: Correct some 64-bit assumptions\n XArray: Correct xa_store_range\n XArray: Fix Documentation\n XArray: Handle NULL pointers differently for allocation\n XArray: Unify xa_store and __xa_store\n XArray: Add xa_store_bh() and xa_store_irq()\n XArray: Turn xa_erase into an exported function\n XArray: Unify xa_cmpxchg and __xa_cmpxchg\n XArray: Regularise xa_reserve\n nilfs2: Use xa_erase_irq\n XArray: Export __xa_foo to non-GPL modules\n XArray: Fix xa_for_each with a single element at 0\n" }, { "commit": "aba36930a35e7f1fe1319b203f25c05d6c119936", "tree": "dc960b49f6616419375e9fec056022c0e8e14338", "parents": [ "9efdda4e3abed13f0903b7b6e4d4c2102019440a" ], "author": { "name": "Willem de Bruijn", "email": "willemb@google.com", "time": "Sat Nov 24 14:21:16 2018 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Nov 24 17:42:57 2018 -0800" }, "message": "net: always initialize pagedlen\n\nIn ip packet generation, pagedlen is initialized for each skb at the\nstart of the loop in __ip(6)_append_data, before label alloc_new_skb.\n\nDepending on compiler options, code can be generated that jumps to\nthis label, triggering use of an an uninitialized variable.\n\nIn practice, at -O2, the generated code moves the initialization below\nthe label. But the code should not rely on that for correctness.\n\nFixes: 15e36f5b8e98 (\"udp: paged allocation with gso\")\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9efdda4e3abed13f0903b7b6e4d4c2102019440a", "tree": "a65b654f1c7453e5554619e9501670319c8085c8", "parents": [ "d146194f31c96f9b260c5a1cf1592d2e7f82a2e2" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Sat Nov 24 09:12:24 2018 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sat Nov 24 17:41:37 2018 -0800" }, "message": "tcp: address problems caused by EDT misshaps\n\nWhen a qdisc setup including pacing FQ is dismantled and recreated,\nsome TCP packets are sent earlier than instructed by TCP stack.\n\nTCP can be fooled when ACK comes back, because the following\noperation can return a negative value.\n\n tcp_time_stamp(tp) - tp-\u003erx_opt.rcv_tsecr;\n\nSome paths in TCP stack were not dealing properly with this,\nthis patch addresses four of them.\n\nFixes: ab408b6dc744 (\"tcp: switch tcp and sch_fq to new earliest departure time model\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e195ca6cb6f21633e56322d5aa11ed59cdb22fb2", "tree": "63f4a3ccc0e16f9c4b3d86a1e487da41394af20d", "parents": [ "d146194f31c96f9b260c5a1cf1592d2e7f82a2e2", "ffe0e7cf290f5c9d1392134b4ef8da2a3761a4cd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 24 12:58:47 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 24 12:58:47 2018 -0800" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid\n\nPull HID fixes from Jiri Kosina:\n\n - revert of the high-resolution scrolling feature, as it breaks certain\n hardware due to incompatibilities between Logitech and Microsoft\n worlds. Peter Hutterer is working on a fixed implementation. Until\n that is finished, revert by Benjamin Tissoires.\n\n - revert of incorrect strncpy-\u003estrlcpy conversion in uhid, from David\n Herrmann\n\n - fix for buggy sendfile() implementation on uhid device node, from\n Eric Biggers\n\n - a few assorted device-ID specific quirks\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:\n Revert \"Input: Add the `REL_WHEEL_HI_RES` event code\"\n Revert \"HID: input: Create a utility class for counting scroll events\"\n Revert \"HID: logitech: Add function to enable HID++ 1.0 \"scrolling acceleration\"\"\n Revert \"HID: logitech: Enable high-resolution scrolling on Logitech mice\"\n Revert \"HID: logitech: Use LDJ_DEVICE macro for existing Logitech mice\"\n Revert \"HID: logitech: fix a used uninitialized GCC warning\"\n Revert \"HID: input: simplify/fix high-res scroll event handling\"\n HID: Add quirk for Primax PIXART OEM mice\n HID: i2c-hid: Disable runtime PM for LG touchscreen\n HID: multitouch: Add pointstick support for Cirque Touchpad\n HID: steam: remove input device when a hid client is running.\n Revert \"HID: uhid: use strlcpy() instead of strncpy()\"\n HID: uhid: forbid UHID_CREATE under KERNEL_DS or elevated privileges\n HID: input: Ignore battery reported by Symbol DS4308\n HID: Add quirk for Microsoft PIXART OEM mouse\n" }, { "commit": "d146194f31c96f9b260c5a1cf1592d2e7f82a2e2", "tree": "ff576fb60ffbe6d3bcc325b217aef65e05c1331a", "parents": [ "857fa628bbe93017c72ddd0d5304962a2608db07", "4f9f49646a5733c0c2bd49940673dde89a9c5add" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 24 09:42:32 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 24 09:42:32 2018 -0800" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Catalin Marinas::\n\n - Fix wrong conflict resolution around CONFIG_ARM64_SSBD\n\n - Fix sparse warning on unsigned long constant\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n arm64: cpufeature: Fix mismerge of CONFIG_ARM64_SSBD block\n arm64: sysreg: fix sparse warnings\n" }, { "commit": "857fa628bbe93017c72ddd0d5304962a2608db07", "tree": "30e0afe2865fb15b357559f342c18139347f24f0", "parents": [ "abe72ff4134028ff2189d29629c40a40bee0a989", "07093b76476903f820d83d56c3040e656fb4d9e3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 24 09:19:38 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 24 09:19:38 2018 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nPull networking fixes from David Miller:\n\n 1) Need to take mutex in ath9k_add_interface(), from Dan Carpenter.\n\n 2) Fix mt76 build without CONFIG_LEDS_CLASS, from Arnd Bergmann.\n\n 3) Fix socket wmem accounting in SCTP, from Xin Long.\n\n 4) Fix failed resume crash in ena driver, from Arthur Kiyanovski.\n\n 5) qed driver passes bytes instead of bits into second arg of\n bitmap_weight(). From Denis Bolotin.\n\n 6) Fix reset deadlock in ibmvnic, from Juliet Kim.\n\n 7) skb_scrube_packet() needs to scrub the fwd marks too, from Petr\n Machata.\n\n 8) Make sure older TCP stacks see enough dup ACKs, and avoid doing SACK\n compression during this period, from Eric Dumazet.\n\n 9) Add atomicity to SMC protocol cursor handling, from Ursula Braun.\n\n10) Don\u0027t leave dangling error pointer if bpf_prog_add() fails in\n thunderx driver, from Lorenzo Bianconi. Also, when we unmap TSO\n headers, set sq-\u003etso_hdrs to NULL.\n\n11) Fix race condition over state variables in act_police, from Davide\n Caratti.\n\n12) Disable guest csum in the presence of XDP in virtio_net, from Jason\n Wang.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (64 commits)\n net: gemini: Fix copy/paste error\n net: phy: mscc: fix deadlock in vsc85xx_default_config\n dt-bindings: dsa: Fix typo in \"probed\"\n net: thunderx: set tso_hdrs pointer to NULL in nicvf_free_snd_queue\n net: amd: add missing of_node_put()\n team: no need to do team_notify_peers or team_mcast_rejoin when disabling port\n virtio-net: fail XDP set if guest csum is negotiated\n virtio-net: disable guest csum during XDP set\n net/sched: act_police: add missing spinlock initialization\n net: don\u0027t keep lonely packets forever in the gro hash\n net/ipv6: re-do dad when interface has IFF_NOARP flag change\n packet: copy user buffers before orphan or clone\n ibmvnic: Update driver queues after change in ring size support\n ibmvnic: Fix RX queue buffer cleanup\n net: thunderx: set xdp_prog to NULL if bpf_prog_add fails\n net/dim: Update DIM start sample after each DIM iteration\n net: faraday: ftmac100: remove netif_running(netdev) check before disabling interrupts\n net/smc: use after free fix in smc_wr_tx_put_slot()\n net/smc: atomic SMCD cursor handling\n net/smc: add SMC-D shutdown signal\n ...\n" }, { "commit": "abe72ff4134028ff2189d29629c40a40bee0a989", "tree": "131d5cb0b4f091ac963c8a444098bec2025577cd", "parents": [ "7c98a42618271210c60b79128b220107d35938d9", "8c110d43c6bca4b24dd13272a9d4e0ba6f2ec957" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 24 09:11:52 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Nov 24 09:11:52 2018 -0800" }, "message": "Merge tag \u0027xfs-4.20-fixes-2\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fixes from Darrick Wong:\n \"Dave and I have continued our work fixing corruption problems that can\n be found when running long-term burn-in exercisers on xfs. Here are\n some patches fixing most of the problems, but there will likely be\n more. :/\n\n - Numerous corruption fixes for copy on write\n\n - Numerous corruption fixes for blocksize \u003c pagesize writes\n\n - Don\u0027t miscalculate AG reservations for small final AGs\n\n - Fix page cache truncation to work properly for reflink and extent\n shifting\n\n - Fix use-after-free when retrying failed inode/dquot buffer logging\n\n - Fix corruptions seen when using copy_file_range in directio mode\"\n\n* tag \u0027xfs-4.20-fixes-2\u0027 of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:\n iomap: readpages doesn\u0027t zero page tail beyond EOF\n vfs: vfs_dedupe_file_range() doesn\u0027t return EOPNOTSUPP\n iomap: dio data corruption and spurious errors when pipes fill\n iomap: sub-block dio needs to zeroout beyond EOF\n iomap: FUA is wrong for DIO O_DSYNC writes into unwritten extents\n xfs: delalloc -\u003e unwritten COW fork allocation can go wrong\n xfs: flush removing page cache in xfs_reflink_remap_prep\n xfs: extent shifting doesn\u0027t fully invalidate page cache\n xfs: finobt AG reserves don\u0027t consider last AG can be a runt\n xfs: fix transient reference count error in xfs_buf_resubmit_failed_buffers\n xfs: uncached buffer tracing needs to print bno\n xfs: make xfs_file_remap_range() static\n xfs: fix shared extent data corruption due to missing cow reservation\n" }, { "commit": "07093b76476903f820d83d56c3040e656fb4d9e3", "tree": "cd494c972b26cdc54ad16139935f80e9ee5c84a7", "parents": [ "3fa528b7682e73e906266bcd43728b8f923bf9b2" ], "author": { "name": "Andreas Fiedler", "email": "andreas.fiedler@gmx.net", "time": "Sat Nov 24 00:16:34 2018 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 23 22:35:38 2018 -0800" }, "message": "net: gemini: Fix copy/paste error\n\nThe TX stats should be started with the tx_stats_syncp,\nthere seems to be a copy/paste error in the driver.\n\nSigned-off-by: Andreas Fiedler \u003candreas.fiedler@gmx.net\u003e\nSigned-off-by: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "3fa528b7682e73e906266bcd43728b8f923bf9b2", "tree": "57494784e7f165aa9f445ecef2d202cb2f04e662", "parents": [ "e7b9fb4f545b1f7885e7c642643828f93d3d79c9" ], "author": { "name": "Quentin Schulz", "email": "quentin.schulz@bootlin.com", "time": "Fri Nov 23 19:01:51 2018 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 23 22:34:40 2018 -0800" }, "message": "net: phy: mscc: fix deadlock in vsc85xx_default_config\n\nThe vsc85xx_default_config function called in the vsc85xx_config_init\nfunction which is used by VSC8530, VSC8531, VSC8540 and VSC8541 PHYs\nmistakenly calls phy_read and phy_write in-between phy_select_page and\nphy_restore_page.\n\nphy_select_page and phy_restore_page actually take and release the MDIO\nbus lock and phy_write and phy_read take and release the lock to write\nor read to a PHY register.\n\nLet\u0027s fix this deadlock by using phy_modify_paged which handles\ncorrectly a read followed by a write in a non-standard page.\n\nFixes: 6a0bfbbe20b0 (\"net: phy: mscc: migrate to phy_select/restore_page functions\")\nSigned-off-by: Quentin Schulz \u003cquentin.schulz@bootlin.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e7b9fb4f545b1f7885e7c642643828f93d3d79c9", "tree": "79dc4755129d694242d76d4f1c5fda353ccad064", "parents": [ "ef2a7cf1d8831535b8991459567b385661eb4a36" ], "author": { "name": "Fabio Estevam", "email": "festevam@gmail.com", "time": "Fri Nov 23 15:46:50 2018 -0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 23 22:33:55 2018 -0800" }, "message": "dt-bindings: dsa: Fix typo in \"probed\"\n\nThe correct form is \"can be probed\", so fix the typo.\n\nSigned-off-by: Fabio Estevam \u003cfestevam@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ef2a7cf1d8831535b8991459567b385661eb4a36", "tree": "aec4ed1689b5ab2860c91d956813706a3a62842c", "parents": [ "c44c749d3b6fdfca39002e7e48e03fe9f9fe37a3" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo.bianconi@redhat.com", "time": "Fri Nov 23 18:28:01 2018 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 23 22:31:56 2018 -0800" }, "message": "net: thunderx: set tso_hdrs pointer to NULL in nicvf_free_snd_queue\n\nReset snd_queue tso_hdrs pointer to NULL in nicvf_free_snd_queue routine\nsince it is used to check if tso dma descriptor queue has been previously\nallocated. The issue can be triggered with the following reproducer:\n\n$ip link set dev enP2p1s0v0 xdpdrv obj xdp_dummy.o\n$ip link set dev enP2p1s0v0 xdpdrv off\n\n[ 341.467649] WARNING: CPU: 74 PID: 2158 at mm/vmalloc.c:1511 __vunmap+0x98/0xe0\n[ 341.515010] Hardware name: GIGABYTE H270-T70/MT70-HD0, BIOS T49 02/02/2018\n[ 341.521874] pstate: 60400005 (nZCv daif +PAN -UAO)\n[ 341.526654] pc : __vunmap+0x98/0xe0\n[ 341.530132] lr : __vunmap+0x98/0xe0\n[ 341.533609] sp : ffff00001c5db860\n[ 341.536913] x29: ffff00001c5db860 x28: 0000000000020000\n[ 341.542214] x27: ffff810feb5090b0 x26: ffff000017e57000\n[ 341.547515] x25: 0000000000000000 x24: 00000000fbd00000\n[ 341.552816] x23: 0000000000000000 x22: ffff810feb5090b0\n[ 341.558117] x21: 0000000000000000 x20: 0000000000000000\n[ 341.563418] x19: ffff000017e57000 x18: 0000000000000000\n[ 341.568719] x17: 0000000000000000 x16: 0000000000000000\n[ 341.574020] x15: 0000000000000010 x14: ffffffffffffffff\n[ 341.579321] x13: ffff00008985eb27 x12: ffff00000985eb2f\n[ 341.584622] x11: ffff0000096b3000 x10: ffff00001c5db510\n[ 341.589923] x9 : 00000000ffffffd0 x8 : ffff0000086868e8\n[ 341.595224] x7 : 3430303030303030 x6 : 00000000000006ef\n[ 341.600525] x5 : 00000000003fffff x4 : 0000000000000000\n[ 341.605825] x3 : 0000000000000000 x2 : ffffffffffffffff\n[ 341.611126] x1 : ffff0000096b3728 x0 : 0000000000000038\n[ 341.616428] Call trace:\n[ 341.618866] __vunmap+0x98/0xe0\n[ 341.621997] vunmap+0x3c/0x50\n[ 341.624961] arch_dma_free+0x68/0xa0\n[ 341.628534] dma_direct_free+0x50/0x80\n[ 341.632285] nicvf_free_resources+0x160/0x2d8 [nicvf]\n[ 341.637327] nicvf_config_data_transfer+0x174/0x5e8 [nicvf]\n[ 341.642890] nicvf_stop+0x298/0x340 [nicvf]\n[ 341.647066] __dev_close_many+0x9c/0x108\n[ 341.650977] dev_close_many+0xa4/0x158\n[ 341.654720] rollback_registered_many+0x140/0x530\n[ 341.659414] rollback_registered+0x54/0x80\n[ 341.663499] unregister_netdevice_queue+0x9c/0xe8\n[ 341.668192] unregister_netdev+0x28/0x38\n[ 341.672106] nicvf_remove+0xa4/0xa8 [nicvf]\n[ 341.676280] nicvf_shutdown+0x20/0x30 [nicvf]\n[ 341.680630] pci_device_shutdown+0x44/0x88\n[ 341.684720] device_shutdown+0x144/0x250\n[ 341.688640] kernel_restart_prepare+0x44/0x50\n[ 341.692986] kernel_restart+0x20/0x68\n[ 341.696638] __se_sys_reboot+0x210/0x238\n[ 341.700550] __arm64_sys_reboot+0x24/0x30\n[ 341.704555] el0_svc_handler+0x94/0x110\n[ 341.708382] el0_svc+0x8/0xc\n[ 341.711252] ---[ end trace 3f4019c8439959c9 ]---\n[ 341.715874] page:ffff7e0003ef4000 count:0 mapcount:0 mapping:0000000000000000 index:0x4\n[ 341.723872] flags: 0x1fffe000000000()\n[ 341.727527] raw: 001fffe000000000 ffff7e0003f1a008 ffff7e0003ef4048 0000000000000000\n[ 341.735263] raw: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000\n[ 341.742994] page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) \u003d\u003d 0)\n\nwhere xdp_dummy.c is a simple bpf program that forwards the incoming\nframes to the network stack (available here:\nhttps://github.com/altoor/xdp_walkthrough_examples/blob/master/sample_1/xdp_dummy.c)\n\nFixes: 05c773f52b96 (\"net: thunderx: Add basic XDP support\")\nFixes: 4863dea3fab0 (\"net: Adding support for Cavium ThunderX network controller\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo.bianconi@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c44c749d3b6fdfca39002e7e48e03fe9f9fe37a3", "tree": "8b1eeb5a4a237d74747834d76df2ad80ceb74a89", "parents": [ "5ed9dc99107144f83b6c1bb52a69b58875baf540" ], "author": { "name": "Yangtao Li", "email": "tiny.windzz@gmail.com", "time": "Thu Nov 22 07:34:41 2018 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 23 17:24:24 2018 -0800" }, "message": "net: amd: add missing of_node_put()\n\nof_find_node_by_path() acquires a reference to the node\nreturned by it and that reference needs to be dropped by its caller.\nThis place doesn\u0027t do that, so fix it.\n\nSigned-off-by: Yangtao Li \u003ctiny.windzz@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5ed9dc99107144f83b6c1bb52a69b58875baf540", "tree": "438ec2a7d4d3fc051ed9ecf1581439f59c081c70", "parents": [ "18ba58e1c234ea1a2d9835ac8c1735d965ce4640" ], "author": { "name": "Hangbin Liu", "email": "liuhangbin@gmail.com", "time": "Thu Nov 22 16:15:28 2018 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 23 17:18:15 2018 -0800" }, "message": "team: no need to do team_notify_peers or team_mcast_rejoin when disabling port\n\nteam_notify_peers() will send ARP and NA to notify peers. team_mcast_rejoin()\nwill send multicast join group message to notify peers. We should do this when\nenabling/changed to a new port. But it doesn\u0027t make sense to do it when a port\nis disabled.\n\nOn the other hand, when we set mcast_rejoin_count to 2, and do a failover,\nteam_port_disable() will increase mcast_rejoin.count_pending to 2 and then\nteam_port_enable() will increase mcast_rejoin.count_pending to 4. We will send\n4 mcast rejoin messages at latest, which will make user confused. The same\nwith notify_peers.count.\n\nFix it by deleting team_notify_peers() and team_mcast_rejoin() in\nteam_port_disable().\n\nReported-by: Liang Li \u003cliali@redhat.com\u003e\nFixes: fc423ff00df3a (\"team: add peer notification\")\nFixes: 492b200efdd20 (\"team: add support for sending multicast rejoins\")\nSigned-off-by: Hangbin Liu \u003cliuhangbin@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "1efb6ee3edea57f57f9fb05dba8dcb3f7333f61f", "tree": "cf6126f29233e979c5cf92c259ad59c315b6318e", "parents": [ "813961de3ee6474dd5703e883471fd941d6c8f69" ], "author": { "name": "Martynas Pumputis", "email": "m@lambda.lt", "time": "Fri Nov 23 17:43:26 2018 +0100" }, "committer": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Fri Nov 23 21:54:14 2018 +0100" }, "message": "bpf: fix check of allowed specifiers in bpf_trace_printk\n\nA format string consisting of \"%p\" or \"%s\" followed by an invalid\nspecifier (e.g. \"%p%\\n\" or \"%s%\") could pass the check which\nwould make format_decode (lib/vsprintf.c) to warn.\n\nFixes: 9c959c863f82 (\"tracing: Allow BPF programs to call bpf_trace_printk()\")\nReported-by: syzbot+1ec5c5ec949c4adaa0c4@syzkaller.appspotmail.com\nSigned-off-by: Martynas Pumputis \u003cm@lambda.lt\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\n" }, { "commit": "18ba58e1c234ea1a2d9835ac8c1735d965ce4640", "tree": "a6d6ca875bf06a4d3213108dbaddbcdee5c18f63", "parents": [ "e59ff2c49ae16e1d179de679aca81405829aee6c" ], "author": { "name": "Jason Wang", "email": "jasowang@redhat.com", "time": "Thu Nov 22 14:36:31 2018 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 23 11:59:40 2018 -0800" }, "message": "virtio-net: fail XDP set if guest csum is negotiated\n\nWe don\u0027t support partial csumed packet since its metadata will be lost\nor incorrect during XDP processing. So fail the XDP set if guest_csum\nfeature is negotiated.\n\nFixes: f600b6905015 (\"virtio_net: Add XDP support\")\nReported-by: Jesper Dangaard Brouer \u003cbrouer@redhat.com\u003e\nCc: Jesper Dangaard Brouer \u003cbrouer@redhat.com\u003e\nCc: Pavel Popa \u003cpashinho1990@gmail.com\u003e\nCc: David Ahern \u003cdsahern@gmail.com\u003e\nSigned-off-by: Jason Wang \u003cjasowang@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e59ff2c49ae16e1d179de679aca81405829aee6c", "tree": "d0da9016181e1806fc2efcca0c0a3b89c2fa9c1e", "parents": [ "484afd1bd3fc6f9f5347289fc8b285aa65f67054" ], "author": { "name": "Jason Wang", "email": "jasowang@redhat.com", "time": "Thu Nov 22 14:36:30 2018 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 23 11:59:40 2018 -0800" }, "message": "virtio-net: disable guest csum during XDP set\n\nWe don\u0027t disable VIRTIO_NET_F_GUEST_CSUM if XDP was set. This means we\ncan receive partial csumed packets with metadata kept in the\nvnet_hdr. This may have several side effects:\n\n- It could be overridden by header adjustment, thus is might be not\n correct after XDP processing.\n- There\u0027s no way to pass such metadata information through\n XDP_REDIRECT to another driver.\n- XDP does not support checksum offload right now.\n\nSo simply disable guest csum if possible in this the case of XDP.\n\nFixes: 3f93522ffab2d (\"virtio-net: switch off offloads on demand if possible on XDP set\")\nReported-by: Jesper Dangaard Brouer \u003cbrouer@redhat.com\u003e\nCc: Jesper Dangaard Brouer \u003cbrouer@redhat.com\u003e\nCc: Pavel Popa \u003cpashinho1990@gmail.com\u003e\nCc: David Ahern \u003cdsahern@gmail.com\u003e\nSigned-off-by: Jason Wang \u003cjasowang@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7c98a42618271210c60b79128b220107d35938d9", "tree": "79ae0c1ca1b98b94f700d28cd6cb50fc80d866ff", "parents": [ "3381918fec9278d14f776d1dabd68da85fd6822e", "7e241f647dc7087a0401418a187f3f5b527cc690" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 23 11:24:55 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 23 11:24:55 2018 -0800" }, "message": "Merge tag \u0027ceph-for-4.20-rc4\u0027 of https://github.com/ceph/ceph-client\n\nPullk ceph fix from Ilya Dryomov:\n \"A messenger fix, marked for stable\"\n\n* tag \u0027ceph-for-4.20-rc4\u0027 of https://github.com/ceph/ceph-client:\n libceph: fall back to sendmsg for slab pages\n" }, { "commit": "3381918fec9278d14f776d1dabd68da85fd6822e", "tree": "9ef5806b5ab9f7b941d5069fa9c7acd6d4f901c3", "parents": [ "d88783b9c8849d88c3a75b7b9071cba072b47eba", "14b04063cc994effc86f976625bf8f806d8d44cb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 23 11:20:14 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 23 11:20:14 2018 -0800" }, "message": "Merge tag \u0027for-linus-20181123\u0027 of git://git.kernel.dk/linux-block\n\nPull block fix from Jens Axboe:\n \"Just a single fix for this week, fixing an issue with nvme-fc\"\n\n* tag \u0027for-linus-20181123\u0027 of git://git.kernel.dk/linux-block:\n nvme-fc: resolve io failures during connect\n" }, { "commit": "484afd1bd3fc6f9f5347289fc8b285aa65f67054", "tree": "7ff88b693e002f56295a4b0d1878c749cf509fbf", "parents": [ "605108acfe6233b72e2f803aa1cb59a2af3001ca" ], "author": { "name": "Davide Caratti", "email": "dcaratti@redhat.com", "time": "Wed Nov 21 18:23:53 2018 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 23 11:20:02 2018 -0800" }, "message": "net/sched: act_police: add missing spinlock initialization\n\ncommit f2cbd4852820 (\"net/sched: act_police: fix race condition on state\nvariables\") introduces a new spinlock, but forgets its initialization.\nEnsure that tcf_police_init() initializes \u0027tcfp_lock\u0027 every time a \u0027police\u0027\naction is newly created, to avoid the following lockdep splat:\n\n INFO: trying to register non-static key.\n the code is fine but needs lockdep annotation.\n turning off the locking correctness validator.\n \u003c...\u003e\n Call Trace:\n dump_stack+0x85/0xcb\n register_lock_class+0x581/0x590\n __lock_acquire+0xd4/0x1330\n ? tcf_police_init+0x2fa/0x650 [act_police]\n ? lock_acquire+0x9e/0x1a0\n lock_acquire+0x9e/0x1a0\n ? tcf_police_init+0x2fa/0x650 [act_police]\n ? tcf_police_init+0x55a/0x650 [act_police]\n _raw_spin_lock_bh+0x34/0x40\n ? tcf_police_init+0x2fa/0x650 [act_police]\n tcf_police_init+0x2fa/0x650 [act_police]\n tcf_action_init_1+0x384/0x4c0\n tcf_action_init+0xf6/0x160\n tcf_action_add+0x73/0x170\n tc_ctl_action+0x122/0x160\n rtnetlink_rcv_msg+0x2a4/0x490\n ? netlink_deliver_tap+0x99/0x400\n ? validate_linkmsg+0x370/0x370\n netlink_rcv_skb+0x4d/0x130\n netlink_unicast+0x196/0x230\n netlink_sendmsg+0x2e5/0x3e0\n sock_sendmsg+0x36/0x40\n ___sys_sendmsg+0x280/0x2f0\n ? _raw_spin_unlock+0x24/0x30\n ? handle_pte_fault+0xafe/0xf30\n ? find_held_lock+0x2d/0x90\n ? syscall_trace_enter+0x1df/0x360\n ? __sys_sendmsg+0x5e/0xa0\n __sys_sendmsg+0x5e/0xa0\n do_syscall_64+0x60/0x210\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\n RIP: 0033:0x7f1841c7cf10\n Code: c3 48 8b 05 82 6f 2c 00 f7 db 64 89 18 48 83 cb ff eb dd 0f 1f 80 00 00 00 00 83 3d 8d d0 2c 00 00 75 10 b8 2e 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 ae cc 00 00 48 89 04 24\n RSP: 002b:00007ffcf9df4d68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\n RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f1841c7cf10\n RDX: 0000000000000000 RSI: 00007ffcf9df4dc0 RDI: 0000000000000003\n RBP: 000000005bf56105 R08: 0000000000000002 R09: 00007ffcf9df8edc\n R10: 00007ffcf9df47e0 R11: 0000000000000246 R12: 0000000000671be0\n R13: 00007ffcf9df4e84 R14: 0000000000000008 R15: 0000000000000000\n\nFixes: f2cbd4852820 (\"net/sched: act_police: fix race condition on state variables\")\nReported-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: Davide Caratti \u003cdcaratti@redhat.com\u003e\nAcked-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nAcked-by: Jiri Pirko \u003cjiri@mellanox.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "605108acfe6233b72e2f803aa1cb59a2af3001ca", "tree": "7176a1fdfdd38c73fcf4d40ed76db3dcfc337b9e", "parents": [ "896585d48e8e9ba44cd1754fbce8537feffcc1a5" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Nov 21 18:21:35 2018 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 23 11:18:53 2018 -0800" }, "message": "net: don\u0027t keep lonely packets forever in the gro hash\n\nEric noted that with UDP GRO and NAPI timeout, we could keep a single\nUDP packet inside the GRO hash forever, if the related NAPI instance\ncalls napi_gro_complete() at an higher frequency than the NAPI timeout.\nWillem noted that even TCP packets could be trapped there, till the\nnext retransmission.\nThis patch tries to address the issue, flushing the old packets -\nthose with a NAPI_GRO_CB age before the current jiffy - before scheduling\nthe NAPI timeout. The rationale is that such a timeout should be\nwell below a jiffy and we are not flushing packets eligible for sane GRO.\n\nv1 -\u003e v2:\n - clarified the commit message and comment\n\nRFC -\u003e v1:\n - added \u0027Fixes tags\u0027, cleaned-up the wording.\n\nReported-by: Eric Dumazet \u003ceric.dumazet@gmail.com\u003e\nFixes: 3b47d30396ba (\"net: gro: add a per device gro flush timer\")\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nAcked-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "896585d48e8e9ba44cd1754fbce8537feffcc1a5", "tree": "bd98bbe64436a9df917e395b81b53feb01e301ef", "parents": [ "5cd8d46ea1562be80063f53c7c6a5f40224de623" ], "author": { "name": "Hangbin Liu", "email": "liuhangbin@gmail.com", "time": "Wed Nov 21 21:52:33 2018 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 23 11:17:56 2018 -0800" }, "message": "net/ipv6: re-do dad when interface has IFF_NOARP flag change\n\nWhen we add a new IPv6 address, we should also join corresponding solicited-node\nmulticast address, unless the interface has IFF_NOARP flag, as function\naddrconf_join_solict() did. But if we remove IFF_NOARP flag later, we do\nnot do dad and add the mcast address. So we will drop corresponding neighbour\ndiscovery message that came from other nodes.\n\nA typical example is after creating a ipvlan with mode l3, setting up an ipv6\naddress and changing the mode to l2. Then we will not be able to ping this\naddress as the interface doesn\u0027t join related solicited-node mcast address.\n\nFix it by re-doing dad when interface changed IFF_NOARP flag. Then we will add\ncorresponding mcast group and check if there is a duplicate address on the\nnetwork.\n\nReported-by: Jianlin Shi \u003cjishi@redhat.com\u003e\nReviewed-by: Stefano Brivio \u003csbrivio@redhat.com\u003e\nSigned-off-by: Hangbin Liu \u003cliuhangbin@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d88783b9c8849d88c3a75b7b9071cba072b47eba", "tree": "1c1ddeaa694bb336b10dececd2b669da9dc60cb3", "parents": [ "a03bac580ae743d5900af626ac63f7f8cd85def9", "829383e183728dec7ed9150b949cd6de64127809" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 23 11:15:27 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 23 11:15:27 2018 -0800" }, "message": "Merge tag \u0027iommu-fixes-v4.20-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu\n\nPull IOMMU fixes from Joerg Roedel:\n\n - Two fixes for the Intel VT-d driver to fix a NULL-ptr dereference and\n an unbalance in an allocate/free path (allocated with memremap, freed\n with iounmap)\n\n - Fix for a crash in the Renesas IOMMU driver\n\n - Fix for the Advanced Virtual Interrupt Controler (AVIC) code in the\n AMD IOMMU driver\n\n* tag \u0027iommu-fixes-v4.20-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:\n iommu/vt-d: Use memunmap to free memremap\n amd/iommu: Fix Guest Virtual APIC Log Tail Address Register\n iommu/ipmmu-vmsa: Fix crash on early domain free\n iommu/vt-d: Fix NULL pointer dereference in prq_event_thread()\n" }, { "commit": "5cd8d46ea1562be80063f53c7c6a5f40224de623", "tree": "53ce4843c87bbbeed12992b26dc4e15cf8470eaf", "parents": [ "039e70a70c8417b5bf5878a60612ebd2c95f731e" ], "author": { "name": "Willem de Bruijn", "email": "willemb@google.com", "time": "Tue Nov 20 13:00:18 2018 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Nov 23 11:08:03 2018 -0800" }, "message": "packet: copy user buffers before orphan or clone\n\ntpacket_snd sends packets with user pages linked into skb frags. It\nnotifies that pages can be reused when the skb is released by setting\nskb-\u003edestructor to tpacket_destruct_skb.\n\nThis can cause data corruption if the skb is orphaned (e.g., on\ntransmit through veth) or cloned (e.g., on mirror to another psock).\n\nCreate a kernel-private copy of data in these cases, same as tun/tap\nzerocopy transmission. Reuse that infrastructure: mark the skb as\nSKBTX_ZEROCOPY_FRAG, which will trigger copy in skb_orphan_frags(_rx).\n\nUnlike other zerocopy packets, do not set shinfo destructor_arg to\nstruct ubuf_info. tpacket_destruct_skb already uses that ptr to notify\nwhen the original skb is released and a timestamp is recorded. Do not\nchange this timestamp behavior. The ubuf_info-\u003ecallback is not needed\nanyway, as no zerocopy notification is expected.\n\nMark destructor_arg as not-a-uarg by setting the lower bit to 1. The\nresulting value is not a valid ubuf_info pointer, nor a valid\ntpacket_snd frame address. Add skb_zcopy_.._nouarg helpers for this.\n\nThe fix relies on features introduced in commit 52267790ef52 (\"sock:\nadd MSG_ZEROCOPY\"), so can be backported as is only to 4.14.\n\nTested with from `./in_netns.sh ./txring_overwrite` from\nhttp://github.com/wdebruij/kerneltools/tests\n\nFixes: 69e3c75f4d54 (\"net: TX_RING and packet mmap\")\nReported-by: Anand H. Krishnan \u003canandhkrishnan@gmail.com\u003e\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "a03bac580ae743d5900af626ac63f7f8cd85def9", "tree": "fc6a805dd06558b6e3327d4b2ac2d61df04cffe1", "parents": [ "b88af994872418f0a98db6f4a9bae849315a99b0", "2bbb5fa37475d7aa5fa62f34db1623f3da2dfdfa" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 23 10:56:16 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 23 10:56:16 2018 -0800" }, "message": "Merge tag \u0027acpi-4.20-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI fix from Rafael Wysocki:\n \"Prevent the ACPI core from registering a platform device for the\n SMB0001 HID to avoid IRQ allocation issues (Hans de Goede)\"\n\n* tag \u0027acpi-4.20-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n ACPI / platform: Add SMB0001 HID to forbidden_id_list\n" }, { "commit": "b88af994872418f0a98db6f4a9bae849315a99b0", "tree": "abbfed29d2affe081769ed63eef57cbe0c1bffa8", "parents": [ "e6005d3c42336074de3745718ac85807dd6e1e6a", "1d50088ca3956e5dcd2751a658e7869b9af10bb4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 23 10:52:57 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 23 10:52:57 2018 -0800" }, "message": "Merge tag \u0027pm-4.20-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull power management fixes from Rafael Wysocki:\n \"These fix two issues in the Operating Performance Points (OPP)\n framework, one cpufreq driver issue, one problem related to the tasks\n freezer and a few build-related issues in the cpupower utility.\n\n Specifics:\n\n - Fix tasks freezer deadlock in de_thread() that occurs if one of its\n sub-threads has been frozen already (Chanho Min).\n\n - Avoid registering a platform device by the ti-cpufreq driver on\n platforms that cannot use it (Dave Gerlach).\n\n - Fix a mistake in the ti-opp-supply operating performance points\n (OPP) driver that caused an incorrect reference voltage to be used\n and make it adjust the minimum voltage dynamically to avoid hangs\n or crashes in some cases (Keerthy).\n\n - Fix issues related to compiler flags in the cpupower utility and\n correct a linking problem in it by renaming a file with a duplicate\n name (Jiri Olsa, Konstantin Khlebnikov)\"\n\n* tag \u0027pm-4.20-rc4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n exec: make de_thread() freezable\n cpufreq: ti-cpufreq: Only register platform_device when supported\n opp: ti-opp-supply: Correct the supply in _get_optimal_vdd_voltage call\n opp: ti-opp-supply: Dynamically update u_volt_min\n tools cpupower: Override CFLAGS assignments\n tools cpupower debug: Allow to use outside build flags\n tools/power/cpupower: fix compilation with STATIC\u003dtrue\n" }, { "commit": "4f9f49646a5733c0c2bd49940673dde89a9c5add", "tree": "8b97582d7df983e4a364554868a27b542e6c50d9", "parents": [ "b5d9a07ef7736b2456b9d3c90568de25e43d8ec3" ], "author": { "name": "Will Deacon", "email": "will.deacon@arm.com", "time": "Wed Nov 21 15:07:00 2018 +0000" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri Nov 23 18:44:16 2018 +0000" }, "message": "arm64: cpufeature: Fix mismerge of CONFIG_ARM64_SSBD block\n\nWhen merging support for SSBD and the CRC32 instructions, the conflict\nresolution for the new capability entries in arm64_features[]\ninadvertedly predicated the availability of the CRC32 instructions on\nCONFIG_ARM64_SSBD, despite the functionality being entirely unrelated.\n\nMove the #ifdef CONFIG_ARM64_SSBD down so that it only covers the SSBD\ncapability.\n\nSigned-off-by: Will Deacon \u003cwill.deacon@arm.com\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "e6005d3c42336074de3745718ac85807dd6e1e6a", "tree": "eefc7be37bc396627330eb5896022010e5e2f948", "parents": [ "dcd3aa31dcdd6d8eae8d4771c44aeb3b1fec995a", "10547d956d590fbb846a7bd053a1dfc30e8f9a68" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 23 10:40:19 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 23 10:40:19 2018 -0800" }, "message": "Merge tag \u0027gpio-v4.20-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio\n\nPull GPIO fixes from Linus Walleij:\n \"Minor stuff except the IDA leak which was kind of important to fix.\n Also new maintainers, yay.\n\n - Do not lose an IDA on the gpiochip register errorpath.\n\n - Fix the PXA non-pincontrol GPIO-using platforms.\n\n - Fix the direction on the mockup GPIO driver.\n\n - Add some MAINTAINERS stuff: Bartosz stepped up as GPIO\n co-maintainer, and Andy established an Intel git tree\"\n\n* tag \u0027gpio-v4.20-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:\n MAINTAINERS: Do maintain Intel GPIO drivers via separate tree\n gpio: mockup: fix indicated direction\n gpio: pxa: fix legacy non pinctrl aware builds again\n gpio: don\u0027t free unallocated ida on gpiochip_add_data_with_key() error path\n MAINTAINERS: add myself as co-maintainer of gpiolib\n" }, { "commit": "dcd3aa31dcdd6d8eae8d4771c44aeb3b1fec995a", "tree": "fa1331a82b46ff86356c2350b101288fffc5a9f3", "parents": [ "9b7c880c834c0a1c80a1dc6b8a0b19155361321f", "5305ec6a27b2dc7398a689e661a4a2e951026f09" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 23 10:36:02 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 23 10:36:02 2018 -0800" }, "message": "Merge tag \u0027mmc-v4.20-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc\n\nPull MMC fixes from Ulf Hansson:\n \"MMC host:\n\n - sdhci-pci: Fixup card detect lookup\n\n - sdhci-pci: Workaround GLK firmware bug for tuning\"\n\n* tag \u0027mmc-v4.20-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:\n mmc: sdhci-pci: Workaround GLK firmware failing to restore the tuning value\n mmc: sdhci-pci: Try \"cd\" for card-detect lookup before using NULL\n" }, { "commit": "9b7c880c834c0a1c80a1dc6b8a0b19155361321f", "tree": "5885d049cf091568e128be5de1a25e988d7a938b", "parents": [ "edeca3a769ad28a9477798c3b1d8e0701db728e4", "98c9cdfd34fbb62886e4c5a07e33661aa3352ef5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 23 10:03:08 2018 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Nov 23 10:03:08 2018 -0800" }, "message": "Merge tag \u0027drm-fixes-2018-11-23\u0027 of git://anongit.freedesktop.org/drm/drm\n\nPull drm fixes from Dave Airlie:\n \"Regular drm fixes:\n\n amdgpu:\n - Vega20 fixes\n - firmware loading fix\n - panel display fix\n - override fix\n\n i915:\n - Sandybridge lockup fix\n - fastboot DSI panel fix\n - GPU hang on Broxton\n - GPU reloc fixes on pineview/bearlake\n\n ast:\n - screen blurring fix\n - cursor appearance fix\n\n udmabuf:\n - mmap fix\n\n vc4:\n - NULL deref fix\n - async cursor update fix\n\n All seems pretty normal at this stage\"\n\n* tag \u0027drm-fixes-2018-11-23\u0027 of git://anongit.freedesktop.org/drm/drm:\n drm/ast: fixed cursor may disappear sometimes\n drm/ast: change resolution may cause screen blurred\n drm/i915: Add rotation readout for plane initial config\n drm/i915: Force a LUT update in intel_initial_commit()\n drm/fb-helper: Blacklist writeback when adding connectors to fbdev\n drm/i915: Write GPU relocs harder with gen3\n drm/amdgpu: Enable HDP memory light sleep\n drm/i915: Prevent machine hang from Broxton\u0027s vtd w/a and error capture\n drm/amd/pp: handle negative values when reading OD\n drm/amdgpu: Add missing firmware entry for HAINAN\n drm/amd/powerplay: disable Vega20 DS related features\n drm/amdgpu: Fix oops when pp_funcs-\u003eswitch_power_profile is unset\n drm/i915: Disable LP3 watermarks on all SNB machines\n drm/ast: Remove existing framebuffers before loading driver\n udmabuf: set read/write flag when exporting\n drm/amd/display: Support amdgpu \"max bpc\" connector property (v2)\n drm/amdgpu: Add amdgpu \"max bpc\" connector property (v2)\n drm/vc4: Set -\u003elegacy_cursor_update to false when doing non-async updates\n drm/vc4: Fix NULL pointer dereference in the async update path\n" }, { "commit": "b5d9a07ef7736b2456b9d3c90568de25e43d8ec3", "tree": "30c045c7573b3374a022ff24cc70339ffc0b71f4", "parents": [ "9ff01193a20d391e8dbce4403dd5ef87c7eaaca6" ], "author": { "name": "Sergey Matyukevich", "email": "geomatsi@gmail.com", "time": "Fri Nov 16 21:21:30 2018 +0300" }, "committer": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Fri Nov 23 17:33:27 2018 +0000" }, "message": "arm64: sysreg: fix sparse warnings\n\nSpecify correct type for the constants to avoid\nthe following sparse complaints:\n\n./arch/arm64/include/asm/sysreg.h:471:42: warning: constant 0xffffffffffffffff is so big it is unsigned long\n./arch/arm64/include/asm/sysreg.h:512:42: warning: constant 0xffffffffffffffff is so big it is unsigned long\n\nAcked-by: Will Deacon \u003cwill.deacon@arm.com\u003e\nAcked-by: Olof Johansson \u003colof@lixom.net\u003e\nAcked-by: Luc Van Oostenryck \u003cluc.vanoostenryck@gmail.com\u003e\nSigned-off-by: Sergey Matyukevich \u003cgeomatsi@gmail.com\u003e\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\n" }, { "commit": "42a657f57628402c73237547f0134e083e2f6764", "tree": "aa02b77126d89e53e9938401c5be448e87eb14b3", "parents": [ "552f0329c75b3e1d7f9bb8c9e421d37403f192cd" ], "author": { "name": "Pan Bian", "email": "bianpan2016@163.com", "time": "Fri Nov 23 18:10:15 2018 +0800" }, "committer": { "name": "David Sterba", "email": "dsterba@suse.com", "time": "Fri Nov 23 13:47:46 2018 +0100" }, "message": "btrfs: relocation: set trans to be NULL after ending transaction\n\nThe function relocate_block_group calls btrfs_end_transaction to release\ntrans when update_backref_cache returns 1, and then continues the loop\nbody. If btrfs_block_rsv_refill fails this time, it will jump out the\nloop and the freed trans will be accessed. This may result in a\nuse-after-free bug. The patch assigns NULL to trans after trans is\nreleased so that it will not be accessed.\n\nFixes: 0647bf564f1 (\"Btrfs: improve forever loop when doing balance relocation\")\nCC: stable@vger.kernel.org # 4.4+\nReviewed-by: Qu Wenruo \u003cwqu@suse.com\u003e\nSigned-off-by: Pan Bian \u003cbianpan2016@163.com\u003e\nReviewed-by: David Sterba \u003cdsterba@suse.com\u003e\nSigned-off-by: David Sterba \u003cdsterba@suse.com\u003e\n" }, { "commit": "1d50088ca3956e5dcd2751a658e7869b9af10bb4", "tree": "5acc5b25f946cde7b2621e61780365bcd8489577", "parents": [ "bec00cb5e97c19d2c8bd10db15d334cb40760000", "d98ccfc3948ab63152494bb6b9c17e15295c0310", "c22397888f1eed98cd59f0a88f2a5f6925f80e15" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Fri Nov 23 10:32:49 2018 +0100" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Fri Nov 23 10:32:49 2018 +0100" }, "message": "Merge branches \u0027pm-cpufreq\u0027 and \u0027pm-sleep\u0027\n\n* pm-cpufreq:\n cpufreq: ti-cpufreq: Only register platform_device when supported\n\n* pm-sleep:\n exec: make de_thread() freezable\n" }, { "commit": "bec00cb5e97c19d2c8bd10db15d334cb40760000", "tree": "bf6dfafe9390855b024109f5a6b433e3d2fb52e5", "parents": [ "6eb5c9b5edffe626d2df6a22f449dc7fab253841", "0db699f747cc24835af77a34852882a33b3e1fc6" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Fri Nov 23 10:32:22 2018 +0100" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Fri Nov 23 10:32:22 2018 +0100" }, "message": "Merge branches \u0027pm-opp\u0027 and \u0027pm-tools\u0027\n\n* pm-opp:\n opp: ti-opp-supply: Correct the supply in _get_optimal_vdd_voltage call\n opp: ti-opp-supply: Dynamically update u_volt_min\n\n* pm-tools:\n tools cpupower: Override CFLAGS assignments\n tools cpupower debug: Allow to use outside build flags\n tools/power/cpupower: fix compilation with STATIC\u003dtrue\n" }, { "commit": "98c9cdfd34fbb62886e4c5a07e33661aa3352ef5", "tree": "053ad46392d3d150f9dfb91632d57cffe799420a", "parents": [ "8cf6f361eb76bf7fca85bde15a0a9316fa124c0c", "f559156c399cfb11d53a128d210118fbea36816e" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Nov 23 11:03:20 2018 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Nov 23 11:03:21 2018 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2018-11-22\u0027 of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes\n\n- Fix for fastboot DSI panel boot time flicker regression, also fixes Bugzilla #108225\n- Fix Bugzilla #101269 to avoid GPU hangs on Sandybridge machines\n- Avoid GPU hang on error capture on Broxton with Vt-d enabled\n- Avoid missing GPU relocations on Pineview and Bearlake (Gen3)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\nFrom: Joonas Lahtinen \u003cjoonas.lahtinen@linux.intel.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20181122120555.GA18282@jlahtine-desk.ger.corp.intel.com\n" }, { "commit": "813961de3ee6474dd5703e883471fd941d6c8f69", "tree": "c96784f1ab86f2fcdf98c420fd1f7fcb714e7107", "parents": [ "dde7011a824cfa815b03f853ec985ff46b740939" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Thu Nov 22 10:49:56 2018 -0800" }, "committer": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Thu Nov 22 21:29:40 2018 +0100" }, "message": "bpf: fix integer overflow in queue_stack_map\n\nFix the following issues:\n\n- allow queue_stack_map for root only\n- fix u32 max_entries overflow\n- disallow value_size \u003d\u003d 0\n\nFixes: f1a2e44a3aec (\"bpf: add queue and stack maps\")\nReported-by: Wei Wu \u003cww9210@gmail.com\u003e\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nCc: Mauricio Vasquez B \u003cmauricio.vasquez@polito.it\u003e\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\n" }, { "commit": "039e70a70c8417b5bf5878a60612ebd2c95f731e", "tree": "fcd3293be5b650116d47c5f758a64acb75e2e625", "parents": [ "6d0f60b0f8588fd4380ea5df9601e12fddd55ce2", "5bf032ef08e6a110edc1e3bfb3c66a208fb55125" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Nov 22 11:53:26 2018 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Nov 22 11:53:26 2018 -0800" }, "message": "Merge branch \u0027ibmvnic-Fix-queue-and-buffer-accounting-errors\u0027\n\nThomas Falcon says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nibmvnic: Fix queue and buffer accounting errors\n\nThis series includes two small fixes. The first resolves a typo bug\nin the code to clean up unused RX buffers during device queue removal.\nThe second ensures that device queue memory is updated to reflect new\nsupported queue ring sizes after migration to other backing hardware.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" } ], "next": "5bf032ef08e6a110edc1e3bfb3c66a208fb55125" }