)]}' { "log": [ { "commit": "dd3ca4c5184ea98e40acb8eb293d85b88ea04ee2", "tree": "7b07b24f9a14ef261af912cb8200fd8535b71aa2", "parents": [ "d668769eb9c52b150753f1653f7f5a0aeb8239d2" ], "author": { "name": "Taehee Yoo", "email": "ap420073@gmail.com", "time": "Sun Jan 09 16:37:02 2022 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Sun Jan 09 16:36:12 2022 -0800" }, "message": "amt: fix wrong return type of amt_send_membership_update()\n\namt_send_membership_update() would return -1 but it\u0027s return type is bool.\nSo, it should be used TRUE instead of -1.\n\nFixes: cbc21dc1cfe9 (\"amt: add data plane of amt interface\")\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nSigned-off-by: Taehee Yoo \u003cap420073@gmail.com\u003e\nLink: https://lore.kernel.org/r/20220109163702.6331-1-ap420073@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d668769eb9c52b150753f1653f7f5a0aeb8239d2", "tree": "d7187210c707f5b0b4d76aee6c9fa484629310bf", "parents": [ "6f022c2ddbcefaee79502ce5386dfe351d457070" ], "author": { "name": "Pavel Skripkin", "email": "paskripkin@gmail.com", "time": "Fri Jan 07 01:57:16 2022 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Sun Jan 09 16:35:50 2022 -0800" }, "message": "net: mcs7830: handle usb read errors properly\n\nSyzbot reported uninit value in mcs7830_bind(). The problem was in\nmissing validation check for bytes read via usbnet_read_cmd().\n\nusbnet_read_cmd() internally calls usb_control_msg(), that returns\nnumber of bytes read. Code should validate that requested number of bytes\nwas actually read.\n\nSo, this patch adds missing size validation check inside\nmcs7830_get_reg() to prevent uninit value bugs\n\nReported-and-tested-by: syzbot+003c0a286b9af5412510@syzkaller.appspotmail.com\nFixes: 2a36d7083438 (\"USB: driver for mcs7830 (aka DeLOCK) USB ethernet adapter\")\nSigned-off-by: Pavel Skripkin \u003cpaskripkin@gmail.com\u003e\nReviewed-by: Arnd Bergmann \u003carnd@arndb.de\u003e\nLink: https://lore.kernel.org/r/20220106225716.7425-1-paskripkin@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6f022c2ddbcefaee79502ce5386dfe351d457070", "tree": "d551a30d87db083573f66dfc2756ce22c818fbed", "parents": [ "f4bb93a82f94a1e23e532f0b4b1859f1f4605968" ], "author": { "name": "Paul Blakey", "email": "paulb@nvidia.com", "time": "Thu Jan 06 17:38:04 2022 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Sun Jan 09 16:24:12 2022 -0800" }, "message": "net: openvswitch: Fix ct_state nat flags for conns arriving from tc\n\nNetfilter conntrack maintains NAT flags per connection indicating\nwhether NAT was configured for the connection. Openvswitch maintains\nNAT flags on the per packet flow key ct_state field, indicating\nwhether NAT was actually executed on the packet.\n\nWhen a packet misses from tc to ovs the conntrack NAT flags are set.\nHowever, NAT was not necessarily executed on the packet because the\nconnection\u0027s state might still be in NEW state. As such, openvswitch\nwrongly assumes that NAT was executed and sets an incorrect flow key\nNAT flags.\n\nFix this, by flagging to openvswitch which NAT was actually done in\nact_ct via tc_skb_ext and tc_skb_cb to the openvswitch module, so\nthe packet flow key NAT flags will be correctly set.\n\nFixes: b57dc7c13ea9 (\"net/sched: Introduce action ct\")\nSigned-off-by: Paul Blakey \u003cpaulb@nvidia.com\u003e\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://lore.kernel.org/r/20220106153804.26451-1-paulb@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f4bb93a82f94a1e23e532f0b4b1859f1f4605968", "tree": "6094e6e5c3cc7043256e47bd3a805f9959f5b8f5", "parents": [ "6dc9a23e29061e50c36523270de60039ccf536fa", "89d58aebe14a365c25ba6645414afdbf4e41cea4" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Sun Jan 09 14:00:49 2022 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Sun Jan 09 14:00:49 2022 -0800" }, "message": "Merge tag \u0027linux-can-fixes-for-5.16-20220109\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can\n\nMarc Kleine-Budde says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull-request: can 2022-01-09\n\nThe first patch is by Johan Hovold and fixes a mem leak in the error\npath of the softing_cs driver.\n\nThe next patch is by me and fixes a set but not used variable warning\nin the softing driver.\n\nJiasheng Jiang\u0027s patch for the xilinx_can driver adds the missing\nerror checking when getting the IRQ.\n\nLad Prabhakar contributes a patch for the rcar_canfd driver to fix a\nmem leak in the error path.\n\nThe last patch is by Brian Silverman and properly initializes the send\nUSB messages to avoid spurious CAN error frames.\n\n* tag \u0027linux-can-fixes-for-5.16-20220109\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:\n can: gs_usb: gs_can_start_xmit(): zero-initialize hf-\u003e{flags,reserved}\n can: rcar_canfd: rcar_canfd_channel_probe(): make sure we free CAN network device\n can: xilinx_can: xcan_probe(): check for error irq\n can: softing: softing_startstop(): fix set but not used variable warning\n can: softing_cs: softingcs_probe(): fix memleak on registration failure\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20220109134040.1945428-1-mkl@pengutronix.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "89d58aebe14a365c25ba6645414afdbf4e41cea4", "tree": "6094e6e5c3cc7043256e47bd3a805f9959f5b8f5", "parents": [ "72b1e360572f9fa7d08ee554f1da29abce23f288" ], "author": { "name": "Brian Silverman", "email": "brian.silverman@bluerivertech.com", "time": "Wed Jan 05 16:29:50 2022 -0800" }, "committer": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Sun Jan 09 13:32:28 2022 +0100" }, "message": "can: gs_usb: gs_can_start_xmit(): zero-initialize hf-\u003e{flags,reserved}\n\nNo information is deliberately sent in hf-\u003eflags in host -\u003e device\ncommunications, but the open-source candleLight firmware echoes it\nback, which can result in the GS_CAN_FLAG_OVERFLOW flag being set and\ngenerating spurious ERRORFRAMEs.\n\nWhile there also initialize the reserved member with 0.\n\nFixes: d08e973a77d1 (\"can: gs_usb: Added support for the GS_USB CAN devices\")\nLink: https://lore.kernel.org/all/20220106002952.25883-1-brian.silverman@bluerivertech.com\nLink: https://github.com/candle-usb/candleLight_fw/issues/87\nCc: stable@vger.kernel.org\nSigned-off-by: Brian Silverman \u003cbrian.silverman@bluerivertech.com\u003e\n[mkl: initialize the reserved member, too]\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n" }, { "commit": "72b1e360572f9fa7d08ee554f1da29abce23f288", "tree": "61c2fc8a2ad0be07b90f207690582043d2cfac2e", "parents": [ "c6564c13dae25cd7f8e1de5127b4da4500ee5844" ], "author": { "name": "Lad Prabhakar", "email": "prabhakar.mahadev-lad.rj@bp.renesas.com", "time": "Thu Jan 06 11:48:00 2022 +0000" }, "committer": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Sun Jan 09 13:32:28 2022 +0100" }, "message": "can: rcar_canfd: rcar_canfd_channel_probe(): make sure we free CAN network device\n\nMake sure we free CAN network device in the error path. There are\nseveral jumps to fail label after allocating the CAN network device\nsuccessfully. This patch places the free_candev() under fail label so\nthat in failure path a jump to fail label frees the CAN network\ndevice.\n\nFixes: 76e9353a80e9 (\"can: rcar_canfd: Add support for RZ/G2L family\")\nLink: https://lore.kernel.org/all/20220106114801.20563-1-prabhakar.mahadev-lad.rj@bp.renesas.com\nReported-by: Pavel Machek \u003cpavel@denx.de\u003e\nSigned-off-by: Lad Prabhakar \u003cprabhakar.mahadev-lad.rj@bp.renesas.com\u003e\nReviewed-by: Kieran Bingham \u003ckieran.bingham+renesas@ideasonboard.com\u003e\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n" }, { "commit": "c6564c13dae25cd7f8e1de5127b4da4500ee5844", "tree": "ab76e17189fe923fc531c10488ddd4759952b419", "parents": [ "370d988cc529598ebaec6487d4f84c2115dc696b" ], "author": { "name": "Jiasheng Jiang", "email": "jiasheng@iscas.ac.cn", "time": "Fri Dec 24 10:13:24 2021 +0800" }, "committer": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Sun Jan 09 13:32:28 2022 +0100" }, "message": "can: xilinx_can: xcan_probe(): check for error irq\n\nFor the possible failure of the platform_get_irq(), the returned irq\ncould be error number and will finally cause the failure of the\nrequest_irq().\n\nConsider that platform_get_irq() can now in certain cases return\n-EPROBE_DEFER, and the consequences of letting request_irq()\neffectively convert that into -EINVAL, even at probe time rather than\nlater on. So it might be better to check just now.\n\nFixes: b1201e44f50b (\"can: xilinx CAN controller support\")\nLink: https://lore.kernel.org/all/20211224021324.1447494-1-jiasheng@iscas.ac.cn\nSigned-off-by: Jiasheng Jiang \u003cjiasheng@iscas.ac.cn\u003e\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n" }, { "commit": "370d988cc529598ebaec6487d4f84c2115dc696b", "tree": "1af1fbde1ee4827202383d72b9ec60574a059940", "parents": [ "ced4913efb0acc844ed65cc01d091a85d83a2082" ], "author": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Sat Jan 08 21:57:51 2022 +0100" }, "committer": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Sun Jan 09 13:32:28 2022 +0100" }, "message": "can: softing: softing_startstop(): fix set but not used variable warning\n\nIn the function softing_startstop() the variable error_reporting is\nassigned but not used. The code that uses this variable is commented\nout. Its stated that the functionality is not finally verified.\n\nTo fix the warning:\n\n| drivers/net/can/softing/softing_fw.c:424:9: error: variable \u0027error_reporting\u0027 set but not used [-Werror,-Wunused-but-set-variable]\n\nremove the comment, activate the code, but add a \"0 \u0026\u0026\" to the if\nexpression and rely on the optimizer rather than the preprocessor to\nremove the code.\n\nLink: https://lore.kernel.org/all/20220109103126.1872833-1-mkl@pengutronix.de\nFixes: 03fd3cf5a179 (\"can: add driver for Softing card\")\nCc: Kurt Van Dijck \u003cdev.kurt@vandijck-laurijssen.be\u003e\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n" }, { "commit": "ced4913efb0acc844ed65cc01d091a85d83a2082", "tree": "5f559d4e218c79128616ddd81218cb2257b2faed", "parents": [ "6dc9a23e29061e50c36523270de60039ccf536fa" ], "author": { "name": "Johan Hovold", "email": "johan@kernel.org", "time": "Wed Dec 22 11:48:43 2021 +0100" }, "committer": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Sat Jan 08 22:46:10 2022 +0100" }, "message": "can: softing_cs: softingcs_probe(): fix memleak on registration failure\n\nIn case device registration fails during probe, the driver state and\nthe embedded platform device structure needs to be freed using\nplatform_device_put() to properly free all resources (e.g. the device\nname).\n\nFixes: 0a0b7a5f7a04 (\"can: add driver for Softing card\")\nLink: https://lore.kernel.org/all/20211222104843.6105-1-johan@kernel.org\nCc: stable@vger.kernel.org # 2.6.38\nSigned-off-by: Johan Hovold \u003cjohan@kernel.org\u003e\nReviewed-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n" }, { "commit": "6dc9a23e29061e50c36523270de60039ccf536fa", "tree": "a1e3da7edc222fc30c8b3157cb09cdd043a02b12", "parents": [ "dc35616e6c2907b0c0c391a205802d8880f7fd85" ], "author": { "name": "Sunil Goutham", "email": "sgoutham@marvell.com", "time": "Fri Jan 07 12:25:05 2022 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Jan 07 19:07:06 2022 -0800" }, "message": "octeontx2-af: Fix interrupt name strings\n\nFixed interrupt name string logic which currently results\nin wrong memory location being accessed while dumping\n/proc/interrupts.\n\nFixes: 4826090719d4 (\"octeontx2-af: Enable CPT HW interrupts\")\nSigned-off-by: Sunil Goutham \u003csgoutham@marvell.com\u003e\nSigned-off-by: Subbaraya Sundeep \u003csbhatta@marvell.com\u003e\nLink: https://lore.kernel.org/r/1641538505-28367-1-git-send-email-sbhatta@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dc35616e6c2907b0c0c391a205802d8880f7fd85", "tree": "8f97a488ad23d8336e8878ba3764ec66d4551f94", "parents": [ "9371937092d5fd502032c1bb4475b36b39b1f1b3" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Fri Jan 07 10:12:10 2022 +0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jan 07 14:11:05 2022 +0000" }, "message": "netrom: fix api breakage in nr_setsockopt()\n\nThis needs to copy an unsigned int from user space instead of a long to\navoid breaking user space with an API change.\n\nI have updated all the integer overflow checks from ULONG to UINT as\nwell. This is a slight API change but I do not expect it to affect\nanything in real life.\n\nFixes: 3087a6f36ee0 (\"netrom: fix copying in user data in nr_setsockopt\")\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9371937092d5fd502032c1bb4475b36b39b1f1b3", "tree": "0877e10b928746b1f3c0c09628475a6dd471e859", "parents": [ "b69c5b5886f3986f94ded29896211d520c57aea1" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Fri Jan 07 10:13:12 2022 +0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jan 07 14:10:26 2022 +0000" }, "message": "ax25: uninitialized variable in ax25_setsockopt()\n\nThe \"opt\" variable is unsigned long but we only copy 4 bytes from\nthe user so the lower 4 bytes are uninitialized.\n\nI have changed the integer overflow checks from ULONG to UINT as well.\nThis is a slight API change but I don\u0027t expect it to break anything.\n\nFixes: a7b75c5a8c41 (\"net: pass a sockptr_t into -\u003esetsockopt\")\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b69c5b5886f3986f94ded29896211d520c57aea1", "tree": "659b4b10e98987386949c0164267f809bcdec968", "parents": [ "fff63521cd6e197738db9297076d83b4081ac80f", "eabd0f88b0d2d433c5dfe88218d4ce1c11ef04b8" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jan 07 14:04:19 2022 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jan 07 14:04:19 2022 +0000" }, "message": "Merge branch \u0027octeontx2-ptp-bugs\u0027\n\nSubbaraya Sundeep says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nocteontx2: Fix PTP bugs\n\nThis patchset addresses two problems found when using\nptp.\nPatch 1 - Increases the refcount of ptp device before use\nwhich was missing and it lead to refcount increment after use\nbug when module is loaded and unloaded couple of times.\nPatch 2 - PTP resources allocated by VF are not being freed\nduring VF teardown. This patch fixes that.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "eabd0f88b0d2d433c5dfe88218d4ce1c11ef04b8", "tree": "659b4b10e98987386949c0164267f809bcdec968", "parents": [ "93440f4888cf049dbd22b41aaf94d2e2153b3eb8" ], "author": { "name": "Rakesh Babu Saladi", "email": "rsaladi2@marvell.com", "time": "Fri Jan 07 12:00:30 2022 +0530" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jan 07 14:04:19 2022 +0000" }, "message": "octeontx2-nicvf: Free VF PTP resources.\n\nWhen a VF is removed respective PTP resources are not\nbeing freed currently. This patch fixes it.\n\nFixes: 43510ef4ddad (\"octeontx2-nicvf: Add PTP hardware clock support to NIX VF\")\nSigned-off-by: Rakesh Babu Saladi \u003crsaladi2@marvell.com\u003e\nSigned-off-by: Subbaraya Sundeep \u003csbhatta@marvell.com\u003e\nSigned-off-by: Sunil Goutham \u003csgoutham@marvell.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "93440f4888cf049dbd22b41aaf94d2e2153b3eb8", "tree": "1f2ab2ca1767c78714a2fa83f8d897e9a89d99f4", "parents": [ "fff63521cd6e197738db9297076d83b4081ac80f" ], "author": { "name": "Subbaraya Sundeep", "email": "sbhatta@marvell.com", "time": "Fri Jan 07 12:00:29 2022 +0530" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jan 07 14:04:19 2022 +0000" }, "message": "octeontx2-af: Increment ptp refcount before use\n\nBefore using the ptp pci device by AF driver increment\nthe reference count of it.\n\nFixes: a8b90c9d26d6 (\"octeontx2-af: Add PTP device id for CN10K and 95O silcons\")\nSigned-off-by: Subbaraya Sundeep \u003csbhatta@marvell.com\u003e\nSigned-off-by: Sunil Goutham \u003csgoutham@marvell.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "fff63521cd6e197738db9297076d83b4081ac80f", "tree": "f1b43abcd3191f0c8ef1238b6e546bac231370a2", "parents": [ "14676c04783c6363b71072c01b42bb7838eb56eb", "269bda9e7da48eafb599d01c96199caa2f7547e5" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jan 07 11:29:45 2022 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jan 07 11:29:45 2022 +0000" }, "message": "Merge branch \u0027mptcp-fixes\u0027\n\nMat Martineau says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmptcp: Fixes for buffer reclaim and option writing\n\nHere are three fixes dealing with a syzkaller crash MPTCP triggers in\nthe memory manager in 5.16-rc8, and some option writing problems.\n\nPatches 1 and 2 fix some corner cases in MPTCP option writing.\n\nPatch 3 addresses a crash that syzkaller found a way to trigger in the mm\nsubsystem by passing an invalid value to __sk_mem_reduce_allocated().\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "269bda9e7da48eafb599d01c96199caa2f7547e5", "tree": "f1b43abcd3191f0c8ef1238b6e546bac231370a2", "parents": [ "110b6d1fe98fd7af9893992459b651594d789293" ], "author": { "name": "Mat Martineau", "email": "mathew.j.martineau@linux.intel.com", "time": "Thu Jan 06 14:06:38 2022 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jan 07 11:29:45 2022 +0000" }, "message": "mptcp: Check reclaim amount before reducing allocation\n\nsyzbot found a page counter underflow that was triggered by MPTCP\u0027s\nreclaim code:\n\npage_counter underflow: -4294964789 nr_pages\u003d4294967295\nWARNING: CPU: 2 PID: 3785 at mm/page_counter.c:56 page_counter_cancel+0xcf/0xe0 mm/page_counter.c:56\nModules linked in:\nCPU: 2 PID: 3785 Comm: kworker/2:6 Not tainted 5.16.0-rc1-syzkaller #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014\nWorkqueue: events mptcp_worker\n\nRIP: 0010:page_counter_cancel+0xcf/0xe0 mm/page_counter.c:56\nCode: c7 04 24 00 00 00 00 45 31 f6 eb 97 e8 2a 2b b5 ff 4c 89 ea 48 89 ee 48 c7 c7 00 9e b8 89 c6 05 a0 c1 ba 0b 01 e8 95 e4 4b 07 \u003c0f\u003e 0b eb a8 4c 89 e7 e8 25 5a fb ff eb c7 0f 1f 00 41 56 41 55 49\nRSP: 0018:ffffc90002d4f918 EFLAGS: 00010082\n\nRAX: 0000000000000000 RBX: ffff88806a494120 RCX: 0000000000000000\nRDX: ffff8880688c41c0 RSI: ffffffff815e8f28 RDI: fffff520005a9f15\nRBP: ffffffff000009cb R08: 0000000000000000 R09: 0000000000000000\nR10: ffffffff815e2cfe R11: 0000000000000000 R12: ffff88806a494120\nR13: 00000000ffffffff R14: 0000000000000000 R15: 0000000000000001\nFS: 0000000000000000(0000) GS:ffff88802cc00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b2de21000 CR3: 000000005ad59000 CR4: 0000000000150ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n page_counter_uncharge+0x2e/0x60 mm/page_counter.c:160\n drain_stock+0xc1/0x180 mm/memcontrol.c:2219\n refill_stock+0x139/0x2f0 mm/memcontrol.c:2271\n __sk_mem_reduce_allocated+0x24d/0x550 net/core/sock.c:2945\n __mptcp_rmem_reclaim net/mptcp/protocol.c:167 [inline]\n __mptcp_mem_reclaim_partial+0x124/0x410 net/mptcp/protocol.c:975\n mptcp_mem_reclaim_partial net/mptcp/protocol.c:982 [inline]\n mptcp_alloc_tx_skb net/mptcp/protocol.c:1212 [inline]\n mptcp_sendmsg_frag+0x18c6/0x2190 net/mptcp/protocol.c:1279\n __mptcp_push_pending+0x232/0x720 net/mptcp/protocol.c:1545\n mptcp_release_cb+0xfe/0x200 net/mptcp/protocol.c:2975\n release_sock+0xb4/0x1b0 net/core/sock.c:3306\n mptcp_worker+0x51e/0xc10 net/mptcp/protocol.c:2443\n process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298\n worker_thread+0x658/0x11f0 kernel/workqueue.c:2445\n kthread+0x405/0x4f0 kernel/kthread.c:327\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295\n \u003c/TASK\u003e\n\n__mptcp_mem_reclaim_partial() could call __mptcp_rmem_reclaim() with a\nnegative value, which passed that negative value to\n__sk_mem_reduce_allocated() and triggered the splat above.\n\nCheck for a reclaim amount that is positive and large enough for\n__mptcp_rmem_reclaim() to actually adjust rmem_fwd_alloc (much like\nthe sk_mem_reclaim_partial() code the function is based on).\n\nv2: Use \u0027\u003e\u0027 instead of \u0027\u003e\u003d\u0027, since SK_MEM_QUANTUM - 1 would get\nright-shifted into nothing by __mptcp_rmem_reclaim.\n\nFixes: 6511882cdd82 (\"mptcp: allocate fwd memory separately on the rx and tx path\")\nCloses: https://github.com/multipath-tcp/mptcp_net-next/issues/252\nReported-and-tested-by: syzbot+bc9e2d2dbcb347dd215a@syzkaller.appspotmail.com\nCc: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nAcked-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: Mat Martineau \u003cmathew.j.martineau@linux.intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "110b6d1fe98fd7af9893992459b651594d789293", "tree": "8b71f0a14275956c1a14f7a4c2a8beee888236ea", "parents": [ "04fac2cae9422a3401c172571afbcfdd58fa5c7e" ], "author": { "name": "Geliang Tang", "email": "geliang.tang@suse.com", "time": "Thu Jan 06 14:06:37 2022 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jan 07 11:29:45 2022 +0000" }, "message": "mptcp: fix a DSS option writing error\n\n\u0027ptr +\u003d 1;\u0027 was omitted in the original code.\n\nIf the DSS is the last option -- which is what we have most of the\ntime -- that\u0027s not an issue. But it is if we need to send something else\nafter like a RM_ADDR or an MP_PRIO.\n\nFixes: 1bff1e43a30e (\"mptcp: optimize out option generation\")\nReviewed-by: Matthieu Baerts \u003cmatthieu.baerts@tessares.net\u003e\nSigned-off-by: Geliang Tang \u003cgeliang.tang@suse.com\u003e\nSigned-off-by: Mat Martineau \u003cmathew.j.martineau@linux.intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "04fac2cae9422a3401c172571afbcfdd58fa5c7e", "tree": "e03c83d6246873450f13120417157fa1e032978f", "parents": [ "14676c04783c6363b71072c01b42bb7838eb56eb" ], "author": { "name": "Matthieu Baerts", "email": "matthieu.baerts@tessares.net", "time": "Thu Jan 06 14:06:36 2022 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jan 07 11:29:45 2022 +0000" }, "message": "mptcp: fix opt size when sending DSS + MP_FAIL\n\nWhen these two options had to be sent -- which is not common -- the DSS\nsize was not being taken into account in the remaining size.\n\nAdditionally in this situation, the reported size was only the one of\nthe MP_FAIL which can cause issue if at the end, we need to write more\nin the TCP options than previously said.\n\nHere we use a dedicated variable for MP_FAIL size to keep the\nWARN_ON_ONCE() just after.\n\nFixes: c25aeb4e0953 (\"mptcp: MP_FAIL suboption sending\")\nAcked-and-tested-by: Geliang Tang \u003cgeliang.tang@suse.com\u003e\nSigned-off-by: Matthieu Baerts \u003cmatthieu.baerts@tessares.net\u003e\nSigned-off-by: Mat Martineau \u003cmathew.j.martineau@linux.intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "14676c04783c6363b71072c01b42bb7838eb56eb", "tree": "16594ce2f2ca2698ac93fe85146498ae73d706ca", "parents": [ "29507144c99814cd5e1ed9873db21ffc634f6c95", "4f6626b0e140867fd6d5a2e9d4ceaef97f10f46a" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jan 07 11:09:37 2022 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Jan 07 11:09:37 2022 +0000" }, "message": "Merge tag \u0027mlx5-fixes-2022-01-06\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux\n\nSaeed Mahameed says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmlx5 fixes 2022-01-06\n\nThis series provides bug fixes to mlx5 driver.\nPlease pull and let me know if there is any problem.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "29507144c99814cd5e1ed9873db21ffc634f6c95", "tree": "523add432b3f0d3919d7b216b6e719fb6522d98a", "parents": [ "36595d8ad46d9e4c41cc7c48c4405b7c3322deac", "23c54263efd7cb605e2f7af72717a2a951999217" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 06 18:37:44 2022 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jan 06 18:37:45 2022 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf\n\nPablo Neira Ayuso says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nNetfilter fixes for net\n\nThe following patchset contains Netfilter fixes for net:\n\n1) Refcount leak in ipt_CLUSTERIP rule loading path, from Xin Xiong.\n\n2) Use socat in netfilter selftests, from Hangbin Liu.\n\n3) Skip layer checksum 4 update for IP fragments.\n\n4) Missing allocation of pcpu scratch maps on clone in\n nft_set_pipapo, from Florian Westphal.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf:\n netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone\n netfilter: nft_payload: do not update layer 4 checksum when mangling fragments\n selftests: netfilter: switch to socat for tests using -q option\n netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20220106215139.170824-1-pablo@netfilter.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4f6626b0e140867fd6d5a2e9d4ceaef97f10f46a", "tree": "b0221dcace65e27d73533675e09ca41cb0bb3e91", "parents": [ "8e715cd613a1e872b9d918e912d90b399785761a" ], "author": { "name": "Moshe Shemesh", "email": "moshe@nvidia.com", "time": "Sun Dec 05 11:20:59 2021 +0200" }, "committer": { "name": "Saeed Mahameed", "email": "saeedm@nvidia.com", "time": "Thu Jan 06 16:55:42 2022 -0800" }, "message": "Revert \"net/mlx5: Add retry mechanism to the command entry index allocation\"\n\nThis reverts commit 410bd754cd73c4a2ac3856d9a03d7b08f9c906bf.\n\nThe reverted commit had added a retry mechanism to the command entry\nindex allocation. The previous patch ensures that there is a free\ncommand entry index once the command work handler holds the command\nsemaphore. Thus the retry mechanism is not needed.\n\nFixes: 410bd754cd73 (\"net/mlx5: Add retry mechanism to the command entry index allocation\")\nSigned-off-by: Moshe Shemesh \u003cmoshe@nvidia.com\u003e\nReviewed-by: Eran Ben Elisha \u003ceranbe@nvidia.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@nvidia.com\u003e\n" }, { "commit": "8e715cd613a1e872b9d918e912d90b399785761a", "tree": "9a65392adb062c44fb0115461857b60d1906baa4", "parents": [ "07f6dc4024ea1d2314b9c8b81fd4e492864fcca1" ], "author": { "name": "Moshe Shemesh", "email": "moshe@nvidia.com", "time": "Sun Dec 05 12:07:49 2021 +0200" }, "committer": { "name": "Saeed Mahameed", "email": "saeedm@nvidia.com", "time": "Thu Jan 06 16:55:42 2022 -0800" }, "message": "net/mlx5: Set command entry semaphore up once got index free\n\nAvoid a race where command work handler may fail to allocate command\nentry index, by holding the command semaphore down till command entry\nindex is being freed.\n\nFixes: 410bd754cd73 (\"net/mlx5: Add retry mechanism to the command entry index allocation\")\nSigned-off-by: Moshe Shemesh \u003cmoshe@nvidia.com\u003e\nReviewed-by: Eran Ben Elisha \u003ceranbe@nvidia.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@nvidia.com\u003e\n" }, { "commit": "07f6dc4024ea1d2314b9c8b81fd4e492864fcca1", "tree": "60eb98887c78ff051bbfc6cd92b49dbd81128509", "parents": [ "a1c7c49c2091926962f8c1c866d386febffec5d8" ], "author": { "name": "Maor Dickman", "email": "maord@nvidia.com", "time": "Mon Jan 03 15:04:18 2022 +0200" }, "committer": { "name": "Saeed Mahameed", "email": "saeedm@nvidia.com", "time": "Thu Jan 06 16:55:41 2022 -0800" }, "message": "net/mlx5e: Sync VXLAN udp ports during uplink representor profile change\n\nCurrently during NIC profile disablement all VXLAN udp ports offloaded to the\nHW are flushed and during its enablement the driver send notification to\nthe stack to inform the core that the entire UDP tunnel port state has been\nlost, uplink representor doesn\u0027t have the same behavior which can cause\nVXLAN udp ports offload to be in bad state while moving between modes while\nVXLAN interface exist.\n\nFixed by aligning the uplink representor profile behavior to the NIC behavior.\n\nFixes: 84db66124714 (\"net/mlx5e: Move set vxlan nic info to profile init\")\nSigned-off-by: Maor Dickman \u003cmaord@nvidia.com\u003e\nReviewed-by: Roi Dayan \u003croid@nvidia.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@nvidia.com\u003e\n" }, { "commit": "a1c7c49c2091926962f8c1c866d386febffec5d8", "tree": "6ad44c9117108c583fcec37e96edf3be95e81d90", "parents": [ "b6dfff21a170af5c695ebaa153b7f5e297ddca03" ], "author": { "name": "Shay Drory", "email": "shayd@nvidia.com", "time": "Thu Dec 30 08:54:08 2021 +0200" }, "committer": { "name": "Saeed Mahameed", "email": "saeedm@nvidia.com", "time": "Thu Jan 06 16:55:41 2022 -0800" }, "message": "net/mlx5: Fix access to sf_dev_table on allocation failure\n\nEven when SF devices are supported, the SF device table allocation\ncan still fail.\nIn such case mlx5_sf_dev_supported still reports true, but SF device\ntable is invalid. This can result in NULL table access.\n\nHence, fix it by adding NULL table check.\n\nFixes: 1958fc2f0712 (\"net/mlx5: SF, Add auxiliary device driver\")\nSigned-off-by: Shay Drory \u003cshayd@nvidia.com\u003e\nReviewed-by: Parav Pandit \u003cparav@nvidia.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@nvidia.com\u003e\n" }, { "commit": "b6dfff21a170af5c695ebaa153b7f5e297ddca03", "tree": "293a4f86bc1519828ad1c698700a989a786448b5", "parents": [ "01c3fd113ef50490ffd43f78f347ef6bb008510b" ], "author": { "name": "Paul Blakey", "email": "paulb@nvidia.com", "time": "Wed Jun 16 10:55:56 2021 +0300" }, "committer": { "name": "Saeed Mahameed", "email": "saeedm@nvidia.com", "time": "Thu Jan 06 16:55:41 2022 -0800" }, "message": "net/mlx5e: Fix matching on modified inner ip_ecn bits\n\nTunnel device follows RFC 6040, and during decapsulation inner\nip_ecn might change depending on inner and outer ip_ecn as follows:\n\n +---------+----------------------------------------+\n |Arriving | Arriving Outer Header |\n | Inner +---------+---------+---------+----------+\n | Header | Not-ECT | ECT(0) | ECT(1) | CE |\n +---------+---------+---------+---------+----------+\n | Not-ECT | Not-ECT | Not-ECT | Not-ECT | \u003cdrop\u003e |\n | ECT(0) | ECT(0) | ECT(0) | ECT(1) | CE* |\n | ECT(1) | ECT(1) | ECT(1) | ECT(1)* | CE* |\n | CE | CE | CE | CE | CE |\n +---------+---------+---------+---------+----------+\n\nCells marked above are changed from original inner packet ip_ecn value.\n\nTc then matches on the modified inner ip_ecn, but hw offload which\nmatches the inner ip_ecn value before decap, will fail.\n\nFix that by mapping all the cases of outer and inner ip_ecn matching,\nand only supporting cases where we know inner wouldn\u0027t be changed by\ndecap, or in the outer ip_ecn\u003dCE case, inner ip_ecn didn\u0027t matter.\n\nFixes: bcef735c59f2 (\"net/mlx5e: Offload TC matching on tos/ttl for ip tunnels\")\nSigned-off-by: Paul Blakey \u003cpaulb@nvidia.com\u003e\nReviewed-by: Oz Shlomo \u003cozsh@nvidia.com\u003e\nReviewed-by: Eli Cohen \u003celic@nvidia.com\u003e\nReviewed-by: Roi Dayan \u003croid@nvidia.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@nvidia.com\u003e\n" }, { "commit": "01c3fd113ef50490ffd43f78f347ef6bb008510b", "tree": "298b6da768d4e5a99450d10e82ae351b35bd36b1", "parents": [ "64050cdad0983ad8060e33c3f4b5aee2366bcebd" ], "author": { "name": "Aya Levin", "email": "ayal@nvidia.com", "time": "Sun Oct 24 16:52:23 2021 +0300" }, "committer": { "name": "Saeed Mahameed", "email": "saeedm@nvidia.com", "time": "Thu Jan 06 16:55:40 2022 -0800" }, "message": "Revert \"net/mlx5e: Block offload of outer header csum for GRE tunnel\"\n\nThis reverts commit 54e1217b90486c94b26f24dcee1ee5ef5372f832.\n\nAlthough the NIC doesn\u0027t support offload of outer header CSUM, using\ngso_partial_features allows offloading the tunnel\u0027s segmentation. The\ndriver relies on the stack CSUM calculation of the outer header. For\nthis, NETIF_F_GSO_GRE_CSUM must be a member of the device\u0027s features.\n\nFixes: 54e1217b9048 (\"net/mlx5e: Block offload of outer header csum for GRE tunnel\")\nSigned-off-by: Aya Levin \u003cayal@nvidia.com\u003e\nReviewed-by: Gal Pressman \u003cgal@nvidia.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@nvidia.com\u003e\n" }, { "commit": "64050cdad0983ad8060e33c3f4b5aee2366bcebd", "tree": "1ea1ef494e8f260419e74db8c9b2882c669c8ac0", "parents": [ "9e72a55a3c9d54b38a704bb7292d984574a81d9d" ], "author": { "name": "Aya Levin", "email": "ayal@nvidia.com", "time": "Sun Oct 24 11:47:41 2021 +0300" }, "committer": { "name": "Saeed Mahameed", "email": "saeedm@nvidia.com", "time": "Thu Jan 06 16:55:40 2022 -0800" }, "message": "Revert \"net/mlx5e: Block offload of outer header csum for UDP tunnels\"\n\nThis reverts commit 6d6727dddc7f93fcc155cb8d0c49c29ae0e71122.\n\nAlthough the NIC doesn\u0027t support offload of outer header CSUM, using\ngso_partial_features allows offloading the tunnel\u0027s segmentation. The\ndriver relies on the stack CSUM calculation of the outer header. For\nthis, NETIF_F_GSO_UDP_TUNNEL_CSUM must be a member of the device\u0027s\nfeatures.\n\nFixes: 6d6727dddc7f (\"net/mlx5e: Block offload of outer header csum for UDP tunnels\")\nSigned-off-by: Aya Levin \u003cayal@nvidia.com\u003e\nReviewed-by: Gal Pressman \u003cgal@nvidia.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@nvidia.com\u003e\n" }, { "commit": "9e72a55a3c9d54b38a704bb7292d984574a81d9d", "tree": "ac2ca4b8c55337d30aff621d92b1b68efb2df840", "parents": [ "885751eb1b01d276e38f57d78c583e4ce006c5ed" ], "author": { "name": "Maor Dickman", "email": "maord@nvidia.com", "time": "Thu Dec 30 11:20:10 2021 +0200" }, "committer": { "name": "Saeed Mahameed", "email": "saeedm@nvidia.com", "time": "Thu Jan 06 16:55:40 2022 -0800" }, "message": "net/mlx5e: Don\u0027t block routes with nexthop objects in SW\n\nRoutes with nexthop objects is currently not supported by multipath offload\nand any attempts to use it is blocked, however this also block adding SW\nroutes with nexthop.\n\nResolve this by returning NOTIFY_DONE instead of an error which will allow such\na route to be created in SW but not offloaded.\n\nThis fix also solve an issue which block adding such routes on different devices\ndue to missing check if the route FIB device is one of multipath devices.\n\nFixes: 6a87afc072c3 (\"mlx5: Fail attempts to use routes with nexthop objects\")\nSigned-off-by: Maor Dickman \u003cmaord@nvidia.com\u003e\nReviewed-by: Roi Dayan \u003croid@nvidia.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@nvidia.com\u003e\n" }, { "commit": "885751eb1b01d276e38f57d78c583e4ce006c5ed", "tree": "bfe24335effa97c2d0efdc311c5eede17ebd68b0", "parents": [ "de31854ece175e12ff3c35d07f340988823aed34" ], "author": { "name": "Maor Dickman", "email": "maord@nvidia.com", "time": "Wed Dec 29 16:10:41 2021 +0200" }, "committer": { "name": "Saeed Mahameed", "email": "saeedm@nvidia.com", "time": "Thu Jan 06 16:55:39 2022 -0800" }, "message": "net/mlx5e: Fix wrong usage of fib_info_nh when routes with nexthop objects are used\n\nCreating routes with nexthop objects while in switchdev mode leads to access to\nun-allocated memory and trigger bellow call trace due to hitting WARN_ON.\nThis is caused due to illegal usage of fib_info_nh in TC tunnel FIB event handling to\nresolve the FIB device while fib_info built in with nexthop.\n\nFixed by ignoring attempts to use nexthop objects with routes until support can be\nproperly added.\n\nWARNING: CPU: 1 PID: 1724 at include/net/nexthop.h:468 mlx5e_tc_tun_fib_event+0x448/0x570 [mlx5_core]\nCPU: 1 PID: 1724 Comm: ip Not tainted 5.15.0_for_upstream_min_debug_2021_11_09_02_04 #1\nRIP: 0010:mlx5e_tc_tun_fib_event+0x448/0x570 [mlx5_core]\nRSP: 0018:ffff8881349f7910 EFLAGS: 00010202\nRAX: ffff8881492f1980 RBX: ffff8881349f79e8 RCX: 0000000000000000\nRDX: ffff8881349f79e8 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: ffff8881349f7950 R08: 00000000000000fe R09: 0000000000000001\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff88811e9d0000\nR13: ffff88810eb62000 R14: ffff888106710268 R15: 0000000000000018\nFS: 00007f1d5ca6e800(0000) GS:ffff88852c880000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ffedba44ff8 CR3: 0000000129808004 CR4: 0000000000370ea0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n atomic_notifier_call_chain+0x42/0x60\n call_fib_notifiers+0x21/0x40\n fib_table_insert+0x479/0x6d0\n ? try_charge_memcg+0x480/0x6d0\n inet_rtm_newroute+0x65/0xb0\n rtnetlink_rcv_msg+0x2af/0x360\n ? page_add_file_rmap+0x13/0x130\n ? do_set_pte+0xcd/0x120\n ? rtnl_calcit.isra.0+0x120/0x120\n netlink_rcv_skb+0x4e/0xf0\n netlink_unicast+0x1ee/0x2b0\n netlink_sendmsg+0x22e/0x460\n sock_sendmsg+0x33/0x40\n ____sys_sendmsg+0x1d1/0x1f0\n ___sys_sendmsg+0xab/0xf0\n ? __mod_memcg_lruvec_state+0x40/0x60\n ? __mod_lruvec_page_state+0x95/0xd0\n ? page_add_new_anon_rmap+0x4e/0xf0\n ? __handle_mm_fault+0xec6/0x1470\n __sys_sendmsg+0x51/0x90\n ? internal_get_user_pages_fast+0x480/0xa10\n do_syscall_64+0x3d/0x90\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nFixes: 8914add2c9e5 (\"net/mlx5e: Handle FIB events to update tunnel endpoint device\")\nSigned-off-by: Maor Dickman \u003cmaord@nvidia.com\u003e\nReviewed-by: Vlad Buslov \u003cvladbu@nvidia.com\u003e\nReviewed-by: Roi Dayan \u003croid@nvidia.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@nvidia.com\u003e\n" }, { "commit": "de31854ece175e12ff3c35d07f340988823aed34", "tree": "ae837f93d10616f345766c926b32e0ddeeaaddd6", "parents": [ "0b7cfa4082fbf550595bc0e40f05614bd83bf0cd" ], "author": { "name": "Dima Chumak", "email": "dchumak@nvidia.com", "time": "Wed Nov 24 09:37:26 2021 +0200" }, "committer": { "name": "Saeed Mahameed", "email": "saeedm@nvidia.com", "time": "Thu Jan 06 16:55:39 2022 -0800" }, "message": "net/mlx5e: Fix nullptr on deleting mirroring rule\n\nDeleting a Tc rule with multiple outputs, one of which is internal port,\nlike this one:\n\n tc filter del dev enp8s0f0_0 ingress protocol ip pref 5 flower \\\n dst_mac 0c:42:a1:d1:d0:88 \\\n src_mac e4:ea:09:08:00:02 \\\n action tunnel_key set \\\n src_ip 0.0.0.0 \\\n dst_ip 7.7.7.8 \\\n id 8 \\\n dst_port 4789 \\\n action mirred egress mirror dev vxlan_sys_4789 pipe \\\n action mirred egress redirect dev enp8s0f0_1\n\nTriggers a call trace:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000230\n RIP: 0010:del_sw_hw_rule+0x2b/0x1f0 [mlx5_core]\n Call Trace:\n tree_remove_node+0x16/0x30 [mlx5_core]\n mlx5_del_flow_rules+0x51/0x160 [mlx5_core]\n __mlx5_eswitch_del_rule+0x4b/0x170 [mlx5_core]\n mlx5e_tc_del_fdb_flow+0x295/0x550 [mlx5_core]\n mlx5e_flow_put+0x1f/0x70 [mlx5_core]\n mlx5e_delete_flower+0x286/0x390 [mlx5_core]\n tc_setup_cb_destroy+0xac/0x170\n fl_hw_destroy_filter+0x94/0xc0 [cls_flower]\n __fl_delete+0x15e/0x170 [cls_flower]\n fl_delete+0x36/0x80 [cls_flower]\n tc_del_tfilter+0x3a6/0x6e0\n rtnetlink_rcv_msg+0xe5/0x360\n ? rtnl_calcit.isra.0+0x110/0x110\n netlink_rcv_skb+0x46/0x110\n netlink_unicast+0x16b/0x200\n netlink_sendmsg+0x202/0x3d0\n sock_sendmsg+0x33/0x40\n ____sys_sendmsg+0x1c3/0x200\n ? copy_msghdr_from_user+0xd6/0x150\n ___sys_sendmsg+0x88/0xd0\n ? ___sys_recvmsg+0x88/0xc0\n ? do_futex+0x10c/0x460\n __sys_sendmsg+0x59/0xa0\n do_syscall_64+0x48/0x140\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nFix by disabling offloading for flows matching\nesw_is_chain_src_port_rewrite() which have more than one output.\n\nFixes: 10742efc20a4 (\"net/mlx5e: VF tunnel TX traffic offloading\")\nSigned-off-by: Dima Chumak \u003cdchumak@nvidia.com\u003e\nReviewed-by: Roi Dayan \u003croid@nvidia.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@nvidia.com\u003e\n" }, { "commit": "0b7cfa4082fbf550595bc0e40f05614bd83bf0cd", "tree": "e372e73b819d629440314fdb59ab87f88587ce6a", "parents": [ "36595d8ad46d9e4c41cc7c48c4405b7c3322deac" ], "author": { "name": "Aya Levin", "email": "ayal@nvidia.com", "time": "Thu Dec 23 14:38:28 2021 +0200" }, "committer": { "name": "Saeed Mahameed", "email": "saeedm@nvidia.com", "time": "Thu Jan 06 16:55:39 2022 -0800" }, "message": "net/mlx5e: Fix page DMA map/unmap attributes\n\nDriver initiates DMA sync, hence it may skip CPU sync. Add\nDMA_ATTR_SKIP_CPU_SYNC as input attribute both to dma_map_page and\ndma_unmap_page to avoid redundant sync with the CPU.\nWhen forcing the device to work with SWIOTLB, the extra sync might cause\ndata corruption. The driver unmaps the whole page while the hardware\nused just a part of the bounce buffer. So syncing overrides the entire\npage with bounce buffer that only partially contains real data.\n\nFixes: bc77b240b3c5 (\"net/mlx5e: Add fragmented memory support for RX multi packet WQE\")\nFixes: db05815b36cb (\"net/mlx5e: Add XSK zero-copy support\")\nSigned-off-by: Aya Levin \u003cayal@nvidia.com\u003e\nReviewed-by: Gal Pressman \u003cgal@nvidia.com\u003e\nSigned-off-by: Saeed Mahameed \u003csaeedm@nvidia.com\u003e\n" }, { "commit": "36595d8ad46d9e4c41cc7c48c4405b7c3322deac", "tree": "1acb7ddbaf531aa7199f74e1f7f6d3ce8f2e1404", "parents": [ "d5a73ec96cc57cf67e51b12820fc2354e7ca46f8" ], "author": { "name": "Wen Gu", "email": "guwen@linux.alibaba.com", "time": "Thu Jan 06 20:42:08 2022 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jan 06 13:54:06 2022 +0000" }, "message": "net/smc: Reset conn-\u003elgr when link group registration fails\n\nSMC connections might fail to be registered in a link group due to\nunable to find a usable link during its creation. As a result,\nsmc_conn_create() will return a failure and most resources related\nto the connection won\u0027t be applied or initialized, such as\nconn-\u003eabort_work or conn-\u003elnk.\n\nIf smc_conn_free() is invoked later, it will try to access the\nuninitialized resources related to the connection, thus causing\na warning or crash.\n\nThis patch tries to fix this by resetting conn-\u003elgr to NULL if an\nabnormal exit occurs in smc_lgr_register_conn(), thus avoiding the\naccess to uninitialized resources in smc_conn_free().\n\nMeanwhile, the new created link group should be terminated if smc\nconnections can\u0027t be registered in it. So smc_lgr_cleanup_early() is\nmodified to take care of link group only and invoked to terminate\nunusable link group by smc_conn_create(). The call to smc_conn_free()\nis moved out from smc_lgr_cleanup_early() to smc_conn_abort().\n\nFixes: 56bc3b2094b4 (\"net/smc: assign link to a new connection\")\nSuggested-by: Karsten Graul \u003ckgraul@linux.ibm.com\u003e\nSigned-off-by: Wen Gu \u003cguwen@linux.alibaba.com\u003e\nAcked-by: Karsten Graul \u003ckgraul@linux.ibm.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d5a73ec96cc57cf67e51b12820fc2354e7ca46f8", "tree": "fa88f40d1b198efad5308451ca00a29909c029a8", "parents": [ "43d012123122cc69feacab55b71369f386c19566" ], "author": { "name": "Jiasheng Jiang", "email": "jiasheng@iscas.ac.cn", "time": "Thu Jan 06 18:04:10 2022 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jan 06 13:51:05 2022 +0000" }, "message": "fsl/fman: Check for null pointer after calling devm_ioremap\n\nAs the possible failure of the allocation, the devm_ioremap() may return\nNULL pointer.\nTake tgec_initialization() as an example.\nIf allocation fails, the params-\u003ebase_addr will be NULL pointer and will\nbe assigned to tgec-\u003eregs in tgec_config().\nThen it will cause the dereference of NULL pointer in set_mac_address(),\nwhich is called by tgec_init().\nTherefore, it should be better to add the sanity check after the calling\nof the devm_ioremap().\n\nFixes: 3933961682a3 (\"fsl/fman: Add FMan MAC driver\")\nSigned-off-by: Jiasheng Jiang \u003cjiasheng@iscas.ac.cn\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "43d012123122cc69feacab55b71369f386c19566", "tree": "5abb1df59a3fa95399b577e054d20d5b55bb595b", "parents": [ "44073187990d5629804ce0627525f6ea5cfef171" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@oracle.com", "time": "Thu Jan 06 14:57:54 2022 +0300" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jan 06 13:45:02 2022 +0000" }, "message": "rocker: fix a sleeping in atomic bug\n\nThis code is holding the \u0026ofdpa-\u003eflow_tbl_lock spinlock so it is not\nallowed to sleep. That means we have to pass the OFDPA_OP_FLAG_NOWAIT\nflag to ofdpa_flow_tbl_del().\n\nFixes: 936bd486564a (\"rocker: use FIB notifications instead of switchdev calls\")\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "44073187990d5629804ce0627525f6ea5cfef171", "tree": "544724fc05e96dbb19dd39f82fa58a2eb8030ee1", "parents": [ "c4251db3b9d2ad4411f95e65ca00ea0f6800319b" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Jan 05 03:48:42 2022 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jan 06 12:30:02 2022 +0000" }, "message": "ppp: ensure minimum packet size in ppp_write()\n\nIt seems pretty clear ppp layer assumed user space\nwould always be kind to provide enough data\nin their write() to a ppp device.\n\nThis patch makes sure user provides at least\n2 bytes.\n\nIt adds PPP_PROTO_LEN macro that could replace\nin net-next many occurrences of hard-coded 2 value.\n\nI replaced only one occurrence to ease backports\nto stable kernels.\n\nThe bug manifests in the following report:\n\nBUG: KMSAN: uninit-value in ppp_send_frame+0x28d/0x27c0 drivers/net/ppp/ppp_generic.c:1740\n ppp_send_frame+0x28d/0x27c0 drivers/net/ppp/ppp_generic.c:1740\n __ppp_xmit_process+0x23e/0x4b0 drivers/net/ppp/ppp_generic.c:1640\n ppp_xmit_process+0x1fe/0x480 drivers/net/ppp/ppp_generic.c:1661\n ppp_write+0x5cb/0x5e0 drivers/net/ppp/ppp_generic.c:513\n do_iter_write+0xb0c/0x1500 fs/read_write.c:853\n vfs_writev fs/read_write.c:924 [inline]\n do_writev+0x645/0xe00 fs/read_write.c:967\n __do_sys_writev fs/read_write.c:1040 [inline]\n __se_sys_writev fs/read_write.c:1037 [inline]\n __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nUninit was created at:\n slab_post_alloc_hook mm/slab.h:524 [inline]\n slab_alloc_node mm/slub.c:3251 [inline]\n __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974\n kmalloc_reserve net/core/skbuff.c:354 [inline]\n __alloc_skb+0x545/0xf90 net/core/skbuff.c:426\n alloc_skb include/linux/skbuff.h:1126 [inline]\n ppp_write+0x11d/0x5e0 drivers/net/ppp/ppp_generic.c:501\n do_iter_write+0xb0c/0x1500 fs/read_write.c:853\n vfs_writev fs/read_write.c:924 [inline]\n do_writev+0x645/0xe00 fs/read_write.c:967\n __do_sys_writev fs/read_write.c:1040 [inline]\n __se_sys_writev fs/read_write.c:1037 [inline]\n __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Paul Mackerras \u003cpaulus@samba.org\u003e\nCc: linux-ppp@vger.kernel.org\nReported-by: syzbot \u003csyzkaller@googlegroups.com\u003e\nAcked-by: Guillaume Nault \u003cgnault@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c4251db3b9d2ad4411f95e65ca00ea0f6800319b", "tree": "5ea9d88c7d33ecfef80fe4cb6578d53d4e68cb5d", "parents": [ "502a2ce9cdf4225983a07c8d99ea2afd53f48837", "45a98ef4922def8c679ca7c454403d1957fe70e7" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jan 06 11:55:45 2022 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Jan 06 11:55:45 2022 +0000" }, "message": "Merge branch \u0027master\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec\n\nSteffen Klassert says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull request (net): ipsec 2022-01-06\n\n1) Fix xfrm policy lookups for ipv6 gre packets by initializing\n fl6_gre_key properly. From Ghalem Boudour.\n\n2) Fix the dflt policy check on forwarding when there is no\n policy configured. The check was done for the wrong direction.\n From Nicolas Dichtel.\n\n3) Use the correct \u0027struct xfrm_user_offload\u0027 when calculating\n netlink message lenghts in xfrm_sa_len(). From Eric Dumazet.\n\n4) Tread inserting xfrm interface id 0 as an error.\n From Antony Antony.\n\n5) Fail if xfrm state or policy is inserted with XFRMA_IF_ID 0,\n xfrm interfaces with id 0 are not allowed.\n From Antony Antony.\n\n6) Fix inner_ipproto setting in the sec_path for tunnel mode.\n From Raed Salem.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "23c54263efd7cb605e2f7af72717a2a951999217", "tree": "3557c86971631656b3b5b5012517af984bd90d2a", "parents": [ "4e1860a3863707e8177329c006d10f9e37e097a8" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Wed Jan 05 14:19:54 2022 +0100" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Thu Jan 06 10:43:24 2022 +0100" }, "message": "netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone\n\nThis is needed in case a new transaction is made that doesn\u0027t insert any\nnew elements into an already existing set.\n\nElse, after second \u0027nft -f ruleset.txt\u0027, lookups in such a set will fail\nbecause -\u003elookup() encounters raw_cpu_ptr(m-\u003escratch) \u003d\u003d NULL.\n\nFor the initial rule load, insertion of elements takes care of the\nallocation, but for rule reloads this isn\u0027t guaranteed: we might not\nhave additions to the set.\n\nFixes: 3c4287f62044a90e (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReported-by: etkaar \u003clists.netfilter.org@prvy.eu\u003e\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nReviewed-by: Stefano Brivio \u003csbrivio@redhat.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "4e1860a3863707e8177329c006d10f9e37e097a8", "tree": "c79eb1919de9ee6c97544aae1e9e6224f845ed0f", "parents": [ "1585f590a2e5dcae5833b05e030c47229299dd09" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Jan 05 16:09:57 2022 +0100" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Thu Jan 06 10:43:23 2022 +0100" }, "message": "netfilter: nft_payload: do not update layer 4 checksum when mangling fragments\n\nIP fragments do not come with the transport header, hence skip bogus\nlayer 4 checksum updates.\n\nFixes: 1814096980bb (\"netfilter: nft_payload: layer 4 checksum adjustment for pseudoheader fields\")\nReported-and-tested-by: Steffen Weinreich \u003csteve@weinreich.org\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "1585f590a2e5dcae5833b05e030c47229299dd09", "tree": "3c26f705511a0e1d56514a55081c395bc564860b", "parents": [ "d94a69cb2cfa77294921aae9afcfb866e723a2da" ], "author": { "name": "Hangbin Liu", "email": "liuhangbin@gmail.com", "time": "Mon Dec 27 11:52:53 2021 +0800" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Thu Jan 06 10:43:18 2022 +0100" }, "message": "selftests: netfilter: switch to socat for tests using -q option\n\nThe nc cmd(nmap-ncat) that distributed with Fedora/Red Hat does not have\noption -q. This make some tests failed with:\n\n\tnc: invalid option -- \u0027q\u0027\n\nLet\u0027s switch to socat which is far more dependable.\n\nSigned-off-by: Hangbin Liu \u003cliuhangbin@gmail.com\u003e\nAcked-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "502a2ce9cdf4225983a07c8d99ea2afd53f48837", "tree": "eda7cfdaac301a262f33632edd4a3f44d8e6762c", "parents": [ "75acfdb6fd922598a408a0d864486aeb167c1a97", "5f33a09e769a9da0482f20a6770a342842443776" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jan 05 17:04:32 2022 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jan 05 17:04:32 2022 -0800" }, "message": "Merge tag \u0027linux-can-fixes-for-5.16-20220105\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can\n\nMarc Kleine-Budde says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull-request: can 2022-01-05\n\nIt consists of 2 patches, both by me. The first one fixes the use of\nan uninitialized variable in the gs_usb driver the other one a\nskb_over_panic in the ISOTP stack in case of reception of too large\nISOTP messages.\n\n* tag \u0027linux-can-fixes-for-5.16-20220105\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:\n can: isotp: convert struct tpcon::{idx,len} to unsigned int\n can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20220105205443.1274709-1-mkl@pengutronix.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "75acfdb6fd922598a408a0d864486aeb167c1a97", "tree": "d3c1780a1f21bb9b1e740e12aa06472bf57df7aa", "parents": [ "49ef78e59b0749814d79eed156dcfc175fbd2f74", "db54c12a3d7e3eedd37aa08efc9362e905f07716" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jan 05 14:08:56 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jan 05 14:08:56 2022 -0800" }, "message": "Merge tag \u0027net-5.16-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski\"\n \"Networking fixes, including fixes from bpf, and WiFi. One last pull\n request, turns out some of the recent fixes did more harm than good.\n\n Current release - regressions:\n\n - Revert \"xsk: Do not sleep in poll() when need_wakeup set\", made the\n problem worse\n\n - Revert \"net: phy: fixed_phy: Fix NULL vs IS_ERR() checking in\n __fixed_phy_register\", broke EPROBE_DEFER handling\n\n - Revert \"net: usb: r8152: Add MAC pass-through support for more\n Lenovo Docks\", broke setups without a Lenovo dock\n\n Current release - new code bugs:\n\n - selftests: set amt.sh executable\n\n Previous releases - regressions:\n\n - batman-adv: mcast: don\u0027t send link-local multicast to mcast routers\n\n Previous releases - always broken:\n\n - ipv4/ipv6: check attribute length for RTA_FLOW / RTA_GATEWAY\n\n - sctp: hold endpoint before calling cb in\n sctp_transport_lookup_process\n\n - mac80211: mesh: embed mesh_paths and mpp_paths into\n ieee80211_if_mesh to avoid complicated handling of sub-object\n allocation failures\n\n - seg6: fix traceroute in the presence of SRv6\n\n - tipc: fix a kernel-infoleak in __tipc_sendmsg()\"\n\n* tag \u0027net-5.16-final\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (36 commits)\n selftests: set amt.sh executable\n Revert \"net: usb: r8152: Add MAC passthrough support for more Lenovo Docks\"\n sfc: The RX page_ring is optional\n iavf: Fix limit of total number of queues to active queues of VF\n i40e: Fix incorrect netdev\u0027s real number of RX/TX queues\n i40e: Fix for displaying message regarding NVM version\n i40e: fix use-after-free in i40e_sync_filters_subtask()\n i40e: Fix to not show opcode msg on unsuccessful VF MAC change\n ieee802154: atusb: fix uninit value in atusb_set_extended_addr\n mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh\n mac80211: initialize variable have_higher_than_11mbit\n sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc\n netrom: fix copying in user data in nr_setsockopt\n udp6: Use Segment Routing Header for dest address if present\n icmp: ICMPV6: Examine invoking packet for Segment Route Headers.\n seg6: export get_srh() for ICMP handling\n Revert \"net: phy: fixed_phy: Fix NULL vs IS_ERR() checking in __fixed_phy_register\"\n ipv6: Do cleanup if attribute validation fails in multipath route\n ipv6: Continue processing multipath route even if gateway attribute is invalid\n net/fsl: Remove leftover definition in xgmac_mdio\n ...\n" }, { "commit": "5f33a09e769a9da0482f20a6770a342842443776", "tree": "73823b454d66df7ecec4f32111df2905e5ec3528", "parents": [ "4a8737ff068724f509d583fef404d349adba80d6" ], "author": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Wed Jan 05 14:01:12 2022 +0100" }, "committer": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Wed Jan 05 21:49:47 2022 +0100" }, "message": "can: isotp: convert struct tpcon::{idx,len} to unsigned int\n\nIn isotp_rcv_ff() 32 bit of data received over the network is assigned\nto struct tpcon::len. Later in that function the length is checked for\nthe maximal supported length against MAX_MSG_LENGTH.\n\nAs struct tpcon::len is an \"int\" this check does not work, if the\nprovided length overflows the \"int\".\n\nLater on struct tpcon::idx is compared against struct tpcon::len.\n\nTo fix this problem this patch converts both struct tpcon::{idx,len}\nto unsigned int.\n\nFixes: e057dd3fc20f (\"can: add ISO 15765-2:2016 transport protocol\")\nLink: https://lore.kernel.org/all/20220105132429.1170627-1-mkl@pengutronix.de\nCc: stable@vger.kernel.org\nAcked-by: Oliver Hartkopp \u003csocketcan@hartkopp.net\u003e\nReported-by: syzbot+4c63f36709a642f801c5@syzkaller.appspotmail.com\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n" }, { "commit": "4a8737ff068724f509d583fef404d349adba80d6", "tree": "dbc6baa628ad4b247b773d97eaeb61df09f8e62e", "parents": [ "1d5a474240407c38ca8c7484a656ee39f585399c" ], "author": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Fri Dec 10 10:03:09 2021 +0100" }, "committer": { "name": "Marc Kleine-Budde", "email": "mkl@pengutronix.de", "time": "Wed Jan 05 21:49:06 2022 +0100" }, "message": "can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data\n\nThe received data contains the channel the received data is associated\nwith. If the channel number is bigger than the actual number of\nchannels assume broken or malicious USB device and shut it down.\n\nThis fixes the error found by clang:\n\n| drivers/net/can/usb/gs_usb.c:386:6: error: variable \u0027dev\u0027 is used\n| uninitialized whenever \u0027if\u0027 condition is true\n| if (hf-\u003echannel \u003e\u003d GS_MAX_INTF)\n| ^~~~~~~~~~~~~~~~~~~~~~~~~~\n| drivers/net/can/usb/gs_usb.c:474:10: note: uninitialized use occurs here\n| hf, dev-\u003egs_hf_size, gs_usb_receive_bulk_callback,\n| ^~~\n\nLink: https://lore.kernel.org/all/20211210091158.408326-1-mkl@pengutronix.de\nFixes: d08e973a77d1 (\"can: gs_usb: Added support for the GS_USB CAN devices\")\nCc: stable@vger.kernel.org\nSigned-off-by: Marc Kleine-Budde \u003cmkl@pengutronix.de\u003e\n" }, { "commit": "db54c12a3d7e3eedd37aa08efc9362e905f07716", "tree": "0037dd67c0852b52184008fbbeb71ea05c150b69", "parents": [ "00fcf8c7dd564c44448ff6a39728d2ca0c8efbd8" ], "author": { "name": "Taehee Yoo", "email": "ap420073@gmail.com", "time": "Wed Jan 05 14:44:36 2022 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jan 05 10:27:19 2022 -0800" }, "message": "selftests: set amt.sh executable\n\namt.sh test script will not work because it doesn\u0027t have execution\npermission. So, it adds execution permission.\n\nReported-by: Hangbin Liu \u003cliuhangbin@gmail.com\u003e\nFixes: c08e8baea78e (\"selftests: add amt interface selftest script\")\nSigned-off-by: Taehee Yoo \u003cap420073@gmail.com\u003e\nLink: https://lore.kernel.org/r/20220105144436.13415-1-ap420073@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "00fcf8c7dd564c44448ff6a39728d2ca0c8efbd8", "tree": "39be833a914d1efbb01a27656072282ebb88ad57", "parents": [ "af872b691926240fa5dcc6810acbdf053cd46ff2" ], "author": { "name": "Aaron Ma", "email": "aaron.ma@canonical.com", "time": "Wed Jan 05 23:51:02 2022 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jan 05 10:11:40 2022 -0800" }, "message": "Revert \"net: usb: r8152: Add MAC passthrough support for more Lenovo Docks\"\n\nThis reverts commit f77b83b5bbab53d2be339184838b19ed2c62c0a5.\n\nThis change breaks multiple usb to ethernet dongles attached on Lenovo\nUSB hub.\n\nFixes: f77b83b5bbab (\"net: usb: r8152: Add MAC passthrough support for more Lenovo Docks\")\nSigned-off-by: Aaron Ma \u003caaron.ma@canonical.com\u003e\nLink: https://lore.kernel.org/r/20220105155102.8557-1-aaron.ma@canonical.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "49ef78e59b0749814d79eed156dcfc175fbd2f74", "tree": "4dafdb84cf3c450d8fa69b1633ded9018f2d75d6", "parents": [ "c9e6606c7fe92b50a02ce51dda82586ebdf99b48", "32e246b02f53b2fdaa81ea9f2ca6ff068c017fcb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jan 05 09:30:10 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Jan 05 09:30:10 2022 -0800" }, "message": "Merge tag \u0027gpio-fixes-for-v5.16\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n \"Here are two last fixes for this release cycle from the GPIO\n subsystem:\n\n - fix irq offset calculation in gpio-aspeed-sgpio\n\n - update the MAINTAINERS entry for gpio-brcmstb\"\n\n* tag \u0027gpio-fixes-for-v5.16\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n MAINTAINERS: update gpio-brcmstb maintainers\n gpio: gpio-aspeed-sgpio: Fix wrong hwirq base in irq handler\n" }, { "commit": "af872b691926240fa5dcc6810acbdf053cd46ff2", "tree": "d05f87c318349f5b472a5196eb8002f29f8d080c", "parents": [ "b3c8e0de473e8c316ba32fa63c01e0ef497ed609", "754e4382354f7908923a1949d8dc8d05f82f09cb" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jan 05 09:00:11 2022 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Jan 05 09:00:12 2022 -0800" }, "message": "Merge tag \u0027ieee802154-for-net-2022-01-05\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan\n\nStefan Schmidt says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull-request: ieee802154 for net 2022-01-05\n\nBelow I have a last minute fix for the atusb driver.\n\nPavel fixes a KASAN uninit report for the driver. This version is the\nminimal impact fix to ease backporting. A bigger rework of the driver to\navoid potential similar problems is ongoing and will come through net-next\nwhen ready.\n\n* tag \u0027ieee802154-for-net-2022-01-05\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan:\n ieee802154: atusb: fix uninit value in atusb_set_extended_addr\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20220105153914.512305-1-stefan@datenfreihafen.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d94a69cb2cfa77294921aae9afcfb866e723a2da", "tree": "2eef0ccaf67ccb88ffef1dc24ca6a4bb58494669", "parents": [ "1d5a474240407c38ca8c7484a656ee39f585399c" ], "author": { "name": "Xin Xiong", "email": "xiongx18@fudan.edu.cn", "time": "Thu Dec 23 10:48:12 2021 +0800" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Jan 05 17:20:17 2022 +0100" }, "message": "netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check()\n\nThe issue takes place in one error path of clusterip_tg_check(). When\nmemcmp() returns nonzero, the function simply returns the error code,\nforgetting to decrease the reference count of a clusterip_config\nobject, which is bumped earlier by clusterip_config_find_get(). This\nmay incur reference count leak.\n\nFix this issue by decrementing the refcount of the object in specific\nerror path.\n\nFixes: 06aa151ad1fc74 (\"netfilter: ipt_CLUSTERIP: check MAC address when duplicate config is set\")\nSigned-off-by: Xin Xiong \u003cxiongx18@fudan.edu.cn\u003e\nSigned-off-by: Xiyu Yang \u003cxiyuyang19@fudan.edu.cn\u003e\nSigned-off-by: Xin Tan \u003ctanxin.ctf@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "b3c8e0de473e8c316ba32fa63c01e0ef497ed609", "tree": "71128b32ed4fc4c7615971ad1496a875ec097c6d", "parents": [ "1d5a474240407c38ca8c7484a656ee39f585399c", "b712941c8085e638bb92456e866ed3de4404e3d5" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jan 05 11:15:16 2022 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Jan 05 11:15:16 2022 +0000" }, "message": "Merge branch \u002740GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2022-01-04\n\nThis series contains updates to i40e and iavf drivers.\n\nMateusz adjusts displaying of failed VF MAC message when the failure is\nexpected as well as modifying an NVM info message to not confuse the user\nfor i40e.\n\nDi Zhu fixes a use-after-free issue MAC filters for i40e.\n\nJedrzej fixes an issue with misreporting of Rx and Tx queues during\nreinitialization for i40e.\n\nKaren correct checking of channel queue configuration to occur against\nactive queues for iavf.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "45a98ef4922def8c679ca7c454403d1957fe70e7", "tree": "848b3c400aed5932cedb0c7e91eb71b46e71d642", "parents": [ "68ac0f3810e76a853b5f7b90601a05c3048b8b54" ], "author": { "name": "Raed Salem", "email": "raeds@nvidia.com", "time": "Mon Jan 03 13:19:29 2022 +0200" }, "committer": { "name": "Steffen Klassert", "email": "steffen.klassert@secunet.com", "time": "Wed Jan 05 10:59:35 2022 +0100" }, "message": "net/xfrm: IPsec tunnel mode fix inner_ipproto setting in sec_path\n\nThe inner_ipproto saves the inner IP protocol of the plain\ntext packet. This allows vendor\u0027s IPsec feature making offload\ndecision at skb\u0027s features_check and configuring hardware at\nndo_start_xmit, current code implenetation did not handle the\ncase where IPsec is used in tunnel mode.\n\nFix by handling the case when IPsec is used in tunnel mode by\nreading the protocol of the plain text packet IP protocol.\n\nFixes: fa4535238fb5 (\"net/xfrm: Add inner_ipproto into sec_path\")\nSigned-off-by: Raed Salem \u003craeds@nvidia.com\u003e\nSigned-off-by: Steffen Klassert \u003csteffen.klassert@secunet.com\u003e\n" }, { "commit": "1d5a474240407c38ca8c7484a656ee39f585399c", "tree": "6bb4163e23d6bc889744f3dbca70c8d86a421274", "parents": [ "6f89ecf10af1396ddc34c303ae1168a11f3f04a3" ], "author": { "name": "Martin Habets", "email": "habetsm.xilinx@gmail.com", "time": "Sun Jan 02 08:41:22 2022 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jan 04 18:14:21 2022 -0800" }, "message": "sfc: The RX page_ring is optional\n\nThe RX page_ring is an optional feature that improves\nperformance. When allocation fails the driver can still\nfunction, but possibly with a lower bandwidth.\nGuard against dereferencing a NULL page_ring.\n\nFixes: 2768935a4660 (\"sfc: reuse pages to avoid DMA mapping/unmapping costs\")\nSigned-off-by: Martin Habets \u003chabetsm.xilinx@gmail.com\u003e\nReported-by: Jiasheng Jiang \u003cjiasheng@iscas.ac.cn\u003e\nLink: https://lore.kernel.org/r/164111288276.5798.10330502993729113868.stgit@palantir17.mph.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b712941c8085e638bb92456e866ed3de4404e3d5", "tree": "f4936702e57e9ab4106bc62ceff32d81dce1df65", "parents": [ "e738451d78b2f8a9635d66c6a87f304b4d965f7a" ], "author": { "name": "Karen Sornek", "email": "karen.sornek@intel.com", "time": "Wed Sep 01 09:21:46 2021 +0200" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Jan 04 14:12:52 2022 -0800" }, "message": "iavf: Fix limit of total number of queues to active queues of VF\n\nIn the absence of this validation, if the user requests to\nconfigure queues more than the enabled queues, it results in\nsending the requested number of queues to the kernel stack\n(due to the asynchronous nature of VF response), in which\ncase the stack might pick a queue to transmit that is not\nenabled and result in Tx hang. Fix this bug by\nlimiting the total number of queues allocated for VF to\nactive queues of VF.\n\nFixes: d5b33d024496 (\"i40evf: add ndo_setup_tc callback to i40evf\")\nSigned-off-by: Ashwin Vijayavel \u003cashwin.vijayavel@intel.com\u003e\nSigned-off-by: Karen Sornek \u003ckaren.sornek@intel.com\u003e\nTested-by: Konrad Jankowski \u003ckonrad0.jankowski@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "e738451d78b2f8a9635d66c6a87f304b4d965f7a", "tree": "7c410d7589d39cc857c3e2af22964ca90ae6a519", "parents": [ "40feded8a247f95957a0de9abd100085fb320a2f" ], "author": { "name": "Jedrzej Jagielski", "email": "jedrzej.jagielski@intel.com", "time": "Fri Dec 17 14:29:05 2021 +0000" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Jan 04 14:12:18 2022 -0800" }, "message": "i40e: Fix incorrect netdev\u0027s real number of RX/TX queues\n\nThere was a wrong queues representation in sysfs during\ndriver\u0027s reinitialization in case of online cpus number is\nless than combined queues. It was caused by stopped\nNetworkManager, which is responsible for calling vsi_open\nfunction during driver\u0027s initialization.\nIn specific situation (ex. 12 cpus online) there were 16 queues\nin /sys/class/net/\u003ciface\u003e/queues. In case of modifying queues with\nvalue higher, than number of online cpus, then it caused write\nerrors and other errors.\nAdd updating of sysfs\u0027s queues representation during driver\ninitialization.\n\nFixes: 41c445ff0f48 (\"i40e: main driver core\")\nSigned-off-by: Lukasz Cieplicki \u003clukaszx.cieplicki@intel.com\u003e\nSigned-off-by: Jedrzej Jagielski \u003cjedrzej.jagielski@intel.com\u003e\nTested-by: Gurucharan G \u003cgurucharanx.g@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "40feded8a247f95957a0de9abd100085fb320a2f", "tree": "1762967eb9cda64d58083545ed13f3cbe97baaa6", "parents": [ "3116f59c12bd24c513194cd3acb3ec1f7d468954" ], "author": { "name": "Mateusz Palczewski", "email": "mateusz.palczewski@intel.com", "time": "Thu Dec 09 11:04:35 2021 +0100" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Jan 04 14:10:48 2022 -0800" }, "message": "i40e: Fix for displaying message regarding NVM version\n\nWhen loading the i40e driver, it prints a message like: \u0027The driver for the\ndevice detected a newer version of the NVM image v1.x than expected v1.y.\nPlease install the most recent version of the network driver.\u0027 This is\nmisleading as the driver is working as expected.\n\nFix that by removing the second part of message and changing it from\ndev_info to dev_dbg.\n\nFixes: 4fb29bddb57f (\"i40e: The driver now prints the API version in error message\")\nSigned-off-by: Mateusz Palczewski \u003cmateusz.palczewski@intel.com\u003e\nTested-by: Gurucharan G \u003cgurucharanx.g@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "3116f59c12bd24c513194cd3acb3ec1f7d468954", "tree": "f8a19a71a1f4ead88adb5f044e6b8d84a514fa78", "parents": [ "01cbf50877e602e2376af89e4a51c30bc574c618" ], "author": { "name": "Di Zhu", "email": "zhudi2@huawei.com", "time": "Mon Nov 29 19:52:01 2021 +0600" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Jan 04 14:09:57 2022 -0800" }, "message": "i40e: fix use-after-free in i40e_sync_filters_subtask()\n\nUsing ifconfig command to delete the ipv6 address will cause\nthe i40e network card driver to delete its internal mac_filter and\ni40e_service_task kernel thread will concurrently access the mac_filter.\nThese two processes are not protected by lock\nso causing the following use-after-free problems.\n\n print_address_description+0x70/0x360\n ? vprintk_func+0x5e/0xf0\n kasan_report+0x1b2/0x330\n i40e_sync_vsi_filters+0x4f0/0x1850 [i40e]\n i40e_sync_filters_subtask+0xe3/0x130 [i40e]\n i40e_service_task+0x195/0x24c0 [i40e]\n process_one_work+0x3f5/0x7d0\n worker_thread+0x61/0x6c0\n ? process_one_work+0x7d0/0x7d0\n kthread+0x1c3/0x1f0\n ? kthread_park+0xc0/0xc0\n ret_from_fork+0x35/0x40\n\nAllocated by task 2279810:\n kasan_kmalloc+0xa0/0xd0\n kmem_cache_alloc_trace+0xf3/0x1e0\n i40e_add_filter+0x127/0x2b0 [i40e]\n i40e_add_mac_filter+0x156/0x190 [i40e]\n i40e_addr_sync+0x2d/0x40 [i40e]\n __hw_addr_sync_dev+0x154/0x210\n i40e_set_rx_mode+0x6d/0xf0 [i40e]\n __dev_set_rx_mode+0xfb/0x1f0\n __dev_mc_add+0x6c/0x90\n igmp6_group_added+0x214/0x230\n __ipv6_dev_mc_inc+0x338/0x4f0\n addrconf_join_solict.part.7+0xa2/0xd0\n addrconf_dad_work+0x500/0x980\n process_one_work+0x3f5/0x7d0\n worker_thread+0x61/0x6c0\n kthread+0x1c3/0x1f0\n ret_from_fork+0x35/0x40\n\nFreed by task 2547073:\n __kasan_slab_free+0x130/0x180\n kfree+0x90/0x1b0\n __i40e_del_filter+0xa3/0xf0 [i40e]\n i40e_del_mac_filter+0xf3/0x130 [i40e]\n i40e_addr_unsync+0x85/0xa0 [i40e]\n __hw_addr_sync_dev+0x9d/0x210\n i40e_set_rx_mode+0x6d/0xf0 [i40e]\n __dev_set_rx_mode+0xfb/0x1f0\n __dev_mc_del+0x69/0x80\n igmp6_group_dropped+0x279/0x510\n __ipv6_dev_mc_dec+0x174/0x220\n addrconf_leave_solict.part.8+0xa2/0xd0\n __ipv6_ifa_notify+0x4cd/0x570\n ipv6_ifa_notify+0x58/0x80\n ipv6_del_addr+0x259/0x4a0\n inet6_addr_del+0x188/0x260\n addrconf_del_ifaddr+0xcc/0x130\n inet6_ioctl+0x152/0x190\n sock_do_ioctl+0xd8/0x2b0\n sock_ioctl+0x2e5/0x4c0\n do_vfs_ioctl+0x14e/0xa80\n ksys_ioctl+0x7c/0xa0\n __x64_sys_ioctl+0x42/0x50\n do_syscall_64+0x98/0x2c0\n entry_SYSCALL_64_after_hwframe+0x65/0xca\n\nFixes: 41c445ff0f48 (\"i40e: main driver core\")\nSigned-off-by: Di Zhu \u003czhudi2@huawei.com\u003e\nSigned-off-by: Rui Zhang \u003czhangrui182@huawei.com\u003e\nTested-by: Gurucharan G \u003cgurucharanx.g@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "01cbf50877e602e2376af89e4a51c30bc574c618", "tree": "c5158f26ff871739641b95b8e229845949980466", "parents": [ "6f89ecf10af1396ddc34c303ae1168a11f3f04a3" ], "author": { "name": "Mateusz Palczewski", "email": "mateusz.palczewski@intel.com", "time": "Wed Mar 03 11:45:33 2021 +0000" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Jan 04 13:59:54 2022 -0800" }, "message": "i40e: Fix to not show opcode msg on unsuccessful VF MAC change\n\nHide i40e opcode information sent during response to VF in case when\nuntrusted VF tried to change MAC on the VF interface.\n\nThis is implemented by adding an additional parameter \u0027hide\u0027 to the\nresponse sent to VF function that hides the display of error\ninformation, but forwards the error code to VF.\n\nPreviously it was not possible to send response with some error code\nto VF without displaying opcode information.\n\nFixes: 5c3c48ac6bf5 (\"i40e: implement virtual device interface\")\nSigned-off-by: Grzegorz Szczurek \u003cgrzegorzx.szczurek@intel.com\u003e\nSigned-off-by: Mateusz Palczewski \u003cmateusz.palczewski@intel.com\u003e\nReviewed-by: Paul M Stillwell Jr \u003cpaul.m.stillwell.jr@intel.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nTested-by: Tony Brelinski \u003ctony.brelinski@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "754e4382354f7908923a1949d8dc8d05f82f09cb", "tree": "377b65b1c3153bc09d1dd724d8788582761bd278", "parents": [ "7d18a07897d07495ee140dd319b0e9265c0f68ba" ], "author": { "name": "Pavel Skripkin", "email": "paskripkin@gmail.com", "time": "Tue Jan 04 21:28:06 2022 +0300" }, "committer": { "name": "Stefan Schmidt", "email": "stefan@datenfreihafen.org", "time": "Tue Jan 04 20:10:04 2022 +0100" }, "message": "ieee802154: atusb: fix uninit value in atusb_set_extended_addr\n\nAlexander reported a use of uninitialized value in\natusb_set_extended_addr(), that is caused by reading 0 bytes via\nusb_control_msg().\n\nFix it by validating if the number of bytes transferred is actually\ncorrect, since usb_control_msg() may read less bytes, than was requested\nby caller.\n\nFail log:\n\nBUG: KASAN: uninit-cmp in ieee802154_is_valid_extended_unicast_addr include/linux/ieee802154.h:310 [inline]\nBUG: KASAN: uninit-cmp in atusb_set_extended_addr drivers/net/ieee802154/atusb.c:1000 [inline]\nBUG: KASAN: uninit-cmp in atusb_probe.cold+0x29f/0x14db drivers/net/ieee802154/atusb.c:1056\nUninit value used in comparison: 311daa649a2003bd stack handle: 000000009a2003bd\n ieee802154_is_valid_extended_unicast_addr include/linux/ieee802154.h:310 [inline]\n atusb_set_extended_addr drivers/net/ieee802154/atusb.c:1000 [inline]\n atusb_probe.cold+0x29f/0x14db drivers/net/ieee802154/atusb.c:1056\n usb_probe_interface+0x314/0x7f0 drivers/usb/core/driver.c:396\n\nFixes: 7490b008d123 (\"ieee802154: add support for atusb transceiver\")\nReported-by: Alexander Potapenko \u003cglider@google.com\u003e\nAcked-by: Alexander Aring \u003caahringo@redhat.com\u003e\nSigned-off-by: Pavel Skripkin \u003cpaskripkin@gmail.com\u003e\nLink: https://lore.kernel.org/r/20220104182806.7188-1-paskripkin@gmail.com\nSigned-off-by: Stefan Schmidt \u003cstefan@datenfreihafen.org\u003e\n" }, { "commit": "6f89ecf10af1396ddc34c303ae1168a11f3f04a3", "tree": "f4871a56ebd56639b80c1b395f8414c0052032f3", "parents": [ "7d18a07897d07495ee140dd319b0e9265c0f68ba", "8b5cb7e41d9d77ffca036b0239177de123394a55" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jan 04 07:18:27 2022 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Jan 04 07:18:28 2022 -0800" }, "message": "Merge tag \u0027mac80211-for-net-2022-01-04\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nTwo more changes:\n - mac80211: initialize a variable to avoid using it uninitialized\n - mac80211 mesh: put some data structures into the container to\n fix bugs with and not have to deal with allocation failures\n\n* tag \u0027mac80211-for-net-2022-01-04\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211:\n mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh\n mac80211: initialize variable have_higher_than_11mbit\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20220104144449.64937-1-johannes@sipsolutions.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8b5cb7e41d9d77ffca036b0239177de123394a55", "tree": "15c951e2a01fb183d595c874f35f0c4e2ef226f2", "parents": [ "68a18ad71378a56858141c4449e02a30c829763e" ], "author": { "name": "Pavel Skripkin", "email": "paskripkin@gmail.com", "time": "Thu Dec 30 22:55:47 2021 +0300" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Jan 04 15:11:49 2022 +0100" }, "message": "mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh\n\nSyzbot hit NULL deref in rhashtable_free_and_destroy(). The problem was\nin mesh_paths and mpp_paths being NULL.\n\nmesh_pathtbl_init() could fail in case of memory allocation failure, but\nnobody cared, since ieee80211_mesh_init_sdata() returns void. It led to\nleaving 2 pointers as NULL. Syzbot has found null deref on exit path,\nbut it could happen anywhere else, because code assumes these pointers are\nvalid.\n\nSince all ieee80211_*_setup_sdata functions are void and do not fail,\nlet\u0027s embedd mesh_paths and mpp_paths into parent struct to avoid\nadding error handling on higher levels and follow the pattern of others\nsetup_sdata functions\n\nFixes: 60854fd94573 (\"mac80211: mesh: convert path table to rhashtable\")\nReported-and-tested-by: syzbot+860268315ba86ea6b96b@syzkaller.appspotmail.com\nSigned-off-by: Pavel Skripkin \u003cpaskripkin@gmail.com\u003e\nLink: https://lore.kernel.org/r/20211230195547.23977-1-paskripkin@gmail.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "68a18ad71378a56858141c4449e02a30c829763e", "tree": "ddeb1c9618b9ecdca7842ee71004abc81567722a", "parents": [ "1ef5e1d0dca5b4ffd49d7dec4a83660882f1fda4" ], "author": { "name": "Tom Rix", "email": "trix@redhat.com", "time": "Thu Dec 23 08:28:48 2021 -0800" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Jan 04 15:02:52 2022 +0100" }, "message": "mac80211: initialize variable have_higher_than_11mbit\n\nClang static analysis reports this warnings\n\nmlme.c:5332:7: warning: Branch condition evaluates to a\n garbage value\n have_higher_than_11mbit)\n ^~~~~~~~~~~~~~~~~~~~~~~\n\nhave_higher_than_11mbit is only set to true some of the time in\nieee80211_get_rates() but is checked all of the time. So\nhave_higher_than_11mbit needs to be initialized to false.\n\nFixes: 5d6a1b069b7f (\"mac80211: set basic rates earlier\")\nSigned-off-by: Tom Rix \u003ctrix@redhat.com\u003e\nReviewed-by: Nick Desaulniers \u003cndesaulniers@google.com\u003e\nLink: https://lore.kernel.org/r/20211223162848.3243702-1-trix@redhat.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "7d18a07897d07495ee140dd319b0e9265c0f68ba", "tree": "ec88845d6e57cd74e313d41798cf903448dce905", "parents": [ "3087a6f36ee028ec095c04a8531d7d33899b7fed" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Jan 04 01:45:08 2022 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Jan 04 12:36:51 2022 +0000" }, "message": "sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc\n\ntx_queue_len can be set to ~0U, we need to be more\ncareful about overflows.\n\n__fls(0) is undefined, as this report shows:\n\nUBSAN: shift-out-of-bounds in net/sched/sch_qfq.c:1430:24\nshift exponent 51770272 is too large for 32-bit type \u0027int\u0027\nCPU: 0 PID: 25574 Comm: syz-executor.0 Not tainted 5.16.0-rc7-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x201/0x2d8 lib/dump_stack.c:106\n ubsan_epilogue lib/ubsan.c:151 [inline]\n __ubsan_handle_shift_out_of_bounds+0x494/0x530 lib/ubsan.c:330\n qfq_init_qdisc+0x43f/0x450 net/sched/sch_qfq.c:1430\n qdisc_create+0x895/0x1430 net/sched/sch_api.c:1253\n tc_modify_qdisc+0x9d9/0x1e20 net/sched/sch_api.c:1660\n rtnetlink_rcv_msg+0x934/0xe60 net/core/rtnetlink.c:5571\n netlink_rcv_skb+0x200/0x470 net/netlink/af_netlink.c:2496\n netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]\n netlink_unicast+0x814/0x9f0 net/netlink/af_netlink.c:1345\n netlink_sendmsg+0xaea/0xe60 net/netlink/af_netlink.c:1921\n sock_sendmsg_nosec net/socket.c:704 [inline]\n sock_sendmsg net/socket.c:724 [inline]\n ____sys_sendmsg+0x5b9/0x910 net/socket.c:2409\n ___sys_sendmsg net/socket.c:2463 [inline]\n __sys_sendmsg+0x280/0x370 net/socket.c:2492\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nFixes: 462dbc9101ac (\"pkt_sched: QFQ Plus: fair-queueing service at DRR cost\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReported-by: syzbot \u003csyzkaller@googlegroups.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "3087a6f36ee028ec095c04a8531d7d33899b7fed", "tree": "1343cf3615f8ef34ae0bffd9571eee9fc02aa47b", "parents": [ "d2d9a6d0b4c2b4d2cd07378e190469f030c7d126" ], "author": { "name": "Christoph Hellwig", "email": "hch@lst.de", "time": "Tue Jan 04 10:21:26 2022 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Jan 04 12:36:01 2022 +0000" }, "message": "netrom: fix copying in user data in nr_setsockopt\n\nThis code used to copy in an unsigned long worth of data before\nthe sockptr_t conversion, so restore that.\n\nFixes: a7b75c5a8c41 (\"net: pass a sockptr_t into -\u003esetsockopt\")\nReported-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSigned-off-by: Christoph Hellwig \u003chch@lst.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d2d9a6d0b4c2b4d2cd07378e190469f030c7d126", "tree": "af54a38b1570fc9bbade6c094f7b12d4151c86cb", "parents": [ "e8fe9e8308b227002d68d6a32bbd141386727328", "222a011efc839ca1f51bf89fe7a2b3705fa55ccd" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Jan 04 12:17:35 2022 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Jan 04 12:17:35 2022 +0000" }, "message": "Merge branch \u0027srv6-traceroute\u0027\n\nAndrew Lunn says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nFix traceroute in the presence of SRv6\n\nWhen using SRv6 the destination IP address in the IPv6 header is not\nalways the true destination, it can be a router along the path that\nSRv6 is using.\n\nWhen ICMP reports an error, e.g, time exceeded, which is what\ntraceroute uses, it included the packet which invoked the error into\nthe ICMP message body. Upon receiving such an ICMP packet, the\ninvoking packet is examined and an attempt is made to find the socket\nwhich sent the packet, so the error can be reported. Lookup is\nperformed using the source and destination address. If the\nintermediary router IP address from the IP header is used, the lookup\nfails. It is necessary to dig into the header and find the true\ndestination address in the Segment Router header, SRH.\n\nv2:\nPlay games with the skb-\u003enetwork_header rather than clone the skb\nv3:\nMove helpers into seg6.c\nv4:\nMove short helper into header file.\nRework getting SRH destination address\nv5:\nFix comment to describe function, not caller\n\nPatch 1 exports a helper which can find the SRH in a packet\nPatch 2 does the actual examination of the invoking packet\nPatch 3 makes use of the results when trying to find the socket.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "222a011efc839ca1f51bf89fe7a2b3705fa55ccd", "tree": "af54a38b1570fc9bbade6c094f7b12d4151c86cb", "parents": [ "e41294408c56c68ea0f269d757527bf33b39118a" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Mon Jan 03 18:11:32 2022 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Jan 04 12:17:35 2022 +0000" }, "message": "udp6: Use Segment Routing Header for dest address if present\n\nWhen finding the socket to report an error on, if the invoking packet\nis using Segment Routing, the IPv6 destination address is that of an\nintermediate router, not the end destination. Extract the ultimate\ndestination address from the segment address.\n\nThis change allows traceroute to function in the presence of Segment\nRouting.\n\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e41294408c56c68ea0f269d757527bf33b39118a", "tree": "0b7a2e236b66448215d2444f3dce59840191f30d", "parents": [ "fa55a7d745de2d10489295b0674a403e2a5d490d" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Mon Jan 03 18:11:31 2022 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Jan 04 12:17:35 2022 +0000" }, "message": "icmp: ICMPV6: Examine invoking packet for Segment Route Headers.\n\nRFC8754 says:\n\nICMP error packets generated within the SR domain are sent to source\nnodes within the SR domain. The invoking packet in the ICMP error\nmessage may contain an SRH. Since the destination address of a packet\nwith an SRH changes as each segment is processed, it may not be the\ndestination used by the socket or application that generated the\ninvoking packet.\n\nFor the source of an invoking packet to process the ICMP error\nmessage, the ultimate destination address of the IPv6 header may be\nrequired. The following logic is used to determine the destination\naddress for use by protocol-error handlers.\n\n* Walk all extension headers of the invoking IPv6 packet to the\n routing extension header preceding the upper-layer header.\n\n - If routing header is type 4 Segment Routing Header (SRH)\n\n o The SID at Segment List[0] may be used as the destination\n address of the invoking packet.\n\nMangle the skb so the network header points to the invoking packet\ninside the ICMP packet. The seg6 helpers can then be used on the skb\nto find any segment routing headers. If found, mark this fact in the\nIPv6 control block of the skb, and store the offset into the packet of\nthe SRH. Then restore the skb back to its old state.\n\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "fa55a7d745de2d10489295b0674a403e2a5d490d", "tree": "acc2231d961e34eea340484bacbf1bcc15539deb", "parents": [ "e8fe9e8308b227002d68d6a32bbd141386727328" ], "author": { "name": "Andrew Lunn", "email": "andrew@lunn.ch", "time": "Mon Jan 03 18:11:30 2022 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Tue Jan 04 12:17:35 2022 +0000" }, "message": "seg6: export get_srh() for ICMP handling\n\nAn ICMP error message can contain in its message body part of an IPv6\npacket which invoked the error. Such a packet might contain a segment\nrouter header. Export get_srh() so the ICMP code can make use of it.\n\nSince his changes the scope of the function from local to global, add\nthe seg6_ prefix to keep the namespace clean. And move it into seg6.c\nso it is always available, not just when IPV6_SEG6_LWTUNNEL is\nenabled.\n\nSigned-off-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e8fe9e8308b227002d68d6a32bbd141386727328", "tree": "7fa8a00345c0e861bbacc44b3dc6d5b5dde60336", "parents": [ "065e1ae02fbe5f56f4aa118414d45fc30647acd4", "938f2e0b57ffe8a6df71e1e177b2978b1b33fe5e" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 03 19:50:16 2022 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 03 19:50:17 2022 -0800" }, "message": "Merge tag \u0027batadv-net-pullrequest-20220103\u0027 of git://git.open-mesh.org/linux-merge\n\nSimon Wunderlich says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nHere is a batman-adv bugfix:\n\n - avoid sending link-local multicast to multicast routers,\n by Linus Lüssing\n\n* tag \u0027batadv-net-pullrequest-20220103\u0027 of git://git.open-mesh.org/linux-merge:\n batman-adv: mcast: don\u0027t send link-local multicast to mcast routers\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20220103171203.1124980-1-sw@simonwunderlich.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "065e1ae02fbe5f56f4aa118414d45fc30647acd4", "tree": "7bc427a703d8a4b239cf8e4cffc4e32c0663741b", "parents": [ "95bdba23b5b4aa75fe3e6c84335e638641c707bb" ], "author": { "name": "Florian Fainelli", "email": "f.fainelli@gmail.com", "time": "Mon Jan 03 11:34:52 2022 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 03 18:59:16 2022 -0800" }, "message": "Revert \"net: phy: fixed_phy: Fix NULL vs IS_ERR() checking in __fixed_phy_register\"\n\nThis reverts commit b45396afa4177f2b1ddfeff7185da733fade1dc3 (\"net: phy:\nfixed_phy: Fix NULL vs IS_ERR() checking in __fixed_phy_register\")\nsince it prevents any system that uses a fixed PHY without a GPIO\ndescriptor from properly working:\n\n[ 5.971952] brcm-systemport 9300000.ethernet: failed to register fixed PHY\n[ 5.978854] brcm-systemport: probe of 9300000.ethernet failed with error -22\n[ 5.986047] brcm-systemport 9400000.ethernet: failed to register fixed PHY\n[ 5.992947] brcm-systemport: probe of 9400000.ethernet failed with error -22\n\nFixes: b45396afa417 (\"net: phy: fixed_phy: Fix NULL vs IS_ERR() checking in __fixed_phy_register\")\nSigned-off-by: Florian Fainelli \u003cf.fainelli@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://lore.kernel.org/r/20220103193453.1214961-1-f.fainelli@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "95bdba23b5b4aa75fe3e6c84335e638641c707bb", "tree": "ae9accb45b617390b8a94e8db135ba8eeb550a73", "parents": [ "e30a845b0376eb51c9c94f56bbd53b2e08ba822f" ], "author": { "name": "David Ahern", "email": "dsahern@kernel.org", "time": "Mon Jan 03 10:05:55 2022 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 03 10:04:42 2022 -0800" }, "message": "ipv6: Do cleanup if attribute validation fails in multipath route\n\nAs Nicolas noted, if gateway validation fails walking the multipath\nattribute the code should jump to the cleanup to free previously\nallocated memory.\n\nFixes: 1ff15a710a86 (\"ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route\")\nSigned-off-by: David Ahern \u003cdsahern@kernel.org\u003e\nAcked-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nLink: https://lore.kernel.org/r/20220103170555.94638-1-dsahern@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e30a845b0376eb51c9c94f56bbd53b2e08ba822f", "tree": "9eaceefc901a50f6086f4e42dcb28f893abfc44a", "parents": [ "1ef5e1d0dca5b4ffd49d7dec4a83660882f1fda4" ], "author": { "name": "David Ahern", "email": "dsahern@kernel.org", "time": "Mon Jan 03 10:19:11 2022 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jan 03 10:02:00 2022 -0800" }, "message": "ipv6: Continue processing multipath route even if gateway attribute is invalid\n\nip6_route_multipath_del loop continues processing the multipath\nattribute even if delete of a nexthop path fails. For consistency,\ndo the same if the gateway attribute is invalid.\n\nFixes: 1ff15a710a86 (\"ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route\")\nSigned-off-by: David Ahern \u003cdsahern@kernel.org\u003e\nAcked-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nLink: https://lore.kernel.org/r/20220103171911.94739-1-dsahern@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "32e246b02f53b2fdaa81ea9f2ca6ff068c017fcb", "tree": "4dafdb84cf3c450d8fa69b1633ded9018f2d75d6", "parents": [ "e5a7431f5a2d6dcff7d516ee9d178a3254b17b87" ], "author": { "name": "Gregory Fong", "email": "gregory.0xf0@gmail.com", "time": "Mon Jan 03 10:53:02 2022 +0100" }, "committer": { "name": "Bartosz Golaszewski", "email": "brgl@bgdev.pl", "time": "Mon Jan 03 10:53:02 2022 +0100" }, "message": "MAINTAINERS: update gpio-brcmstb maintainers\n\nAdd Doug and Florian as maintainers for gpio-brcmstb, and remove myself.\n\nSigned-off-by: Gregory Fong \u003cgregory.0xf0@gmail.com\u003e\nSigned-off-by: Bartosz Golaszewski \u003cbrgl@bgdev.pl\u003e\n" }, { "commit": "e5a7431f5a2d6dcff7d516ee9d178a3254b17b87", "tree": "304bf0f03399622a453c459453d6734f96bacf46", "parents": [ "c9e6606c7fe92b50a02ce51dda82586ebdf99b48" ], "author": { "name": "Steven Lee", "email": "steven_lee@aspeedtech.com", "time": "Tue Dec 14 12:02:38 2021 +0800" }, "committer": { "name": "Bartosz Golaszewski", "email": "brgl@bgdev.pl", "time": "Mon Jan 03 10:50:12 2022 +0100" }, "message": "gpio: gpio-aspeed-sgpio: Fix wrong hwirq base in irq handler\n\nEach aspeed sgpio bank has 64 gpio pins(32 input pins and 32 output pins).\nThe hwirq base for each sgpio bank should be multiples of 64 rather than\nmultiples of 32.\n\nSigned-off-by: Steven Lee \u003csteven_lee@aspeedtech.com\u003e\nSigned-off-by: Bartosz Golaszewski \u003cbrgl@bgdev.pl\u003e\n" }, { "commit": "c9e6606c7fe92b50a02ce51dda82586ebdf99b48", "tree": "3d65a8d77615d3401b0f86cf3afb9519e31fa296", "parents": [ "24a0b2206134e17ec99d212c776f08f75a4bec23" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 02 14:23:25 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 02 14:23:25 2022 -0800" }, "message": "Linux 5.16-rc8\n" }, { "commit": "24a0b2206134e17ec99d212c776f08f75a4bec23", "tree": "4c4d4b6760d92c688e3db2baf671b5c9a0c74c6c", "parents": [ "859431ac11aef9b4cd7ffa75e94a92a6a41c8623", "64f18d2d043015b3f835ce4c9f3beb97cfd19b6e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 02 14:09:03 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 02 14:09:03 2022 -0800" }, "message": "Merge tag \u0027perf-tools-fixes-for-v5.16-2022-01-02\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux\n\nPull perf tools fixes from Arnaldo Carvalho de Melo:\n\n - Fix TUI exit screen refresh race condition in \u0027perf top\u0027.\n\n - Fix parsing of Intel PT VM time correlation arguments.\n\n - Honour CPU filtering command line request of a script\u0027s switch events\n in \u0027perf script\u0027.\n\n - Fix printing of switch events in Intel PT python script.\n\n - Fix duplicate alias events list printing in \u0027perf list\u0027, noticed on\n heterogeneous arm64 systems.\n\n - Fix return value of ids__new(), users expect NULL for failure, not\n ERR_PTR(-ENOMEM).\n\n* tag \u0027perf-tools-fixes-for-v5.16-2022-01-02\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux:\n perf top: Fix TUI exit screen refresh race condition\n perf pmu: Fix alias events list\n perf scripts python: intel-pt-events.py: Fix printing of switch events\n perf script: Fix CPU filtering of a script\u0027s switch events\n perf intel-pt: Fix parsing of VM time correlation arguments\n perf expr: Fix return value of ids__new()\n" }, { "commit": "1ef5e1d0dca5b4ffd49d7dec4a83660882f1fda4", "tree": "c57ab68c1e1000759b24634db5a6fb85bc3e361b", "parents": [ "29262e1f773b4b6a43711120be564c57fca07cfb" ], "author": { "name": "Markus Koch", "email": "markus@notsyncing.net", "time": "Sun Jan 02 17:54:08 2022 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Jan 02 18:43:42 2022 +0000" }, "message": "net/fsl: Remove leftover definition in xgmac_mdio\n\ncommit 26eee0210ad7 (\"net/fsl: fix a bug in xgmac_mdio\") fixed a bug in\nthe QorIQ mdio driver but left the (now unused) incorrect bit definition\nfor MDIO_DATA_BSY in the code. This commit removes it.\n\nSigned-off-by: Markus Koch \u003cmarkus@notsyncing.net\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "859431ac11aef9b4cd7ffa75e94a92a6a41c8623", "tree": "b2b6b812e7aba7c0159e05cfc972edde5e00658f", "parents": [ "1286cc4893cf356ad6c3a042116981e827dd3680", "c116fe1e1883ad3eda0a1938a9e3275a98aa51a5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 02 10:36:09 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 02 10:36:09 2022 -0800" }, "message": "Merge branch \u0027i2c/for-current\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c fixes from Wolfram Sang:\n \"Better input validation for compat ioctls and a documentation bugfix\n for 5.16\"\n\n* \u0027i2c/for-current\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n Docs: Fixes link to I2C specification\n i2c: validate user data in compat ioctl\n" }, { "commit": "1286cc4893cf356ad6c3a042116981e827dd3680", "tree": "d7dbb6724a3c4b1cf35eb37e2855be312a09a8d8", "parents": [ "278218f6778bc7d6f8b67199446c56cec7ebb841", "d6f12f83989bb356ac6880a954f62c7667e35066" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 02 09:02:54 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jan 02 09:02:54 2022 -0800" }, "message": "Merge tag \u0027x86_urgent_for_v5.16_rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fix from Borislav Petkov:\n\n - Use the proper CONFIG symbol in a preprocessor check.\n\n* tag \u0027x86_urgent_for_v5.16_rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/build: Use the proper name CONFIG_FW_LOADER\n" }, { "commit": "29262e1f773b4b6a43711120be564c57fca07cfb", "tree": "843f7265ccdd7f3d162b534d8d946da3cd03978e", "parents": [ "f9d31c4cf4c11ff10317f038b9c6f7c3bda6cdd4" ], "author": { "name": "Thomas Toye", "email": "thomas@toye.io", "time": "Sat Jan 01 18:22:07 2022 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Jan 02 16:12:45 2022 +0000" }, "message": "rndis_host: support Hytera digital radios\n\nHytera makes a range of digital (DMR) radios. These radios can be\nprogrammed to a allow a computer to control them over Ethernet over USB,\neither using NCM or RNDIS.\n\nThis commit adds support for RNDIS for Hytera radios. I tested with a\nHytera PD785 and a Hytera MD785G. When these radios are programmed to\nset up a Radio to PC Network using RNDIS, an USB interface will be added\nwith class 2 (Communications), subclass 2 (Abstract Modem Control) and\nan interface protocol of 255 (\"vendor specific\" - lsusb even hints \"MSFT\nRNDIS?\").\n\nThis patch is similar to the solution of this StackOverflow user, but\nthat only works for the Hytera MD785:\nhttps://stackoverflow.com/a/53550858\n\nTo use the \"Radio to PC Network\" functionality of Hytera DMR radios, the\nradios need to be programmed correctly in CPS (Hytera\u0027s Customer\nProgramming Software). \"Forward to PC\" should be checked in \"Network\"\n(under \"General Setting\" in \"Conventional\") and the \"USB Network\nCommunication Protocol\" should be set to RNDIS.\n\nSigned-off-by: Thomas Toye \u003cthomas@toye.io\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "64f18d2d043015b3f835ce4c9f3beb97cfd19b6e", "tree": "1462ec323da2f6b057091b2866100b4bf9d00842", "parents": [ "e0257a01d6689c273a019756ed5e13911cc1bfed" ], "author": { "name": "yaowenbin", "email": "yaowenbin1@huawei.com", "time": "Wed Dec 29 16:55:19 2021 +0800" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Sun Jan 02 11:46:44 2022 -0300" }, "message": "perf top: Fix TUI exit screen refresh race condition\n\nWhen the following command is executed several times, a coredump file is\ngenerated.\n\n\t$ timeout -k 9 5 perf top -e task-clock\n\t*******\n\t*******\n\t*******\n\t0.01% [kernel] [k] __do_softirq\n\t0.01% libpthread-2.28.so [.] __pthread_mutex_lock\n\t0.01% [kernel] [k] __ll_sc_atomic64_sub_return\n\tdouble free or corruption (!prev) perf top --sort comm,dso\n\ttimeout: the monitored command dumped core\n\nWhen we terminate \"perf top\" using sending signal method,\nSLsmg_reset_smg() called. SLsmg_reset_smg() resets the SLsmg screen\nmanagement routines by freeing all memory allocated while it was active.\n\nHowever SLsmg_reinit_smg() maybe be called by another thread.\n\nSLsmg_reinit_smg() will free the same memory accessed by\nSLsmg_reset_smg(), thus it results in a double free.\n\nSLsmg_reinit_smg() is called already protected by ui__lock, so we fix\nthe problem by adding pthread_mutex_trylock of ui__lock when calling\nSLsmg_reset_smg().\n\nSigned-off-by: Wenyu Liu \u003cliuwenyu7@huawei.com\u003e\nTested-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\nCc: Alexander Shishkin \u003calexander.shishkin@linux.intel.com\u003e\nCc: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Mark Rutland \u003cmark.rutland@arm.com\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: wuxu.wu@huawei.com\nLink: http://lore.kernel.org/lkml/a91e3943-7ddc-f5c0-a7f5-360f073c20e6@huawei.com\nSigned-off-by: Hewenliang \u003chewenliang4@huawei.com\u003e\nSigned-off-by: yaowenbin \u003cyaowenbin1@huawei.com\u003e\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "e0257a01d6689c273a019756ed5e13911cc1bfed", "tree": "5bdfcd017a55043e9816f95cfb3cd16703a35a30", "parents": [ "0f80bfbf4919e32f52fe1312c3900ff4fbb7eeb9" ], "author": { "name": "John Garry", "email": "john.garry@huawei.com", "time": "Wed Dec 22 00:11:30 2021 +0800" }, "committer": { "name": "Arnaldo Carvalho de Melo", "email": "acme@redhat.com", "time": "Sun Jan 02 11:29:05 2022 -0300" }, "message": "perf pmu: Fix alias events list\n\nCommit 0e0ae8742207c3b4 (\"perf list: Display hybrid PMU events with cpu\ntype\") changes the event list for uncore PMUs or arm64 heterogeneous CPU\nsystems, such that duplicate aliases are incorrectly listed per PMU\n(which they should not be), like:\n\n # perf list\n ...\n unc_cbo_cache_lookup.any_es\n [Unit: uncore_cbox L3 Lookup any request that access cache and found\n line in E or S-state]\n unc_cbo_cache_lookup.any_es\n [Unit: uncore_cbox L3 Lookup any request that access cache and found\n line in E or S-state]\n unc_cbo_cache_lookup.any_i\n [Unit: uncore_cbox L3 Lookup any request that access cache and found\n line in I-state]\n unc_cbo_cache_lookup.any_i\n [Unit: uncore_cbox L3 Lookup any request that access cache and found\n line in I-state]\n ...\n\nNotice how the events are listed twice.\n\nThe named commit changed how we remove duplicate events, in that events\nfor different PMUs are not treated as duplicates. I suppose this is to\nhandle how \"Each hybrid pmu event has been assigned with a pmu name\".\n\nFix PMU alias listing by restoring behaviour to remove duplicates for\nnon-hybrid PMUs.\n\nFixes: 0e0ae8742207c3b4 (\"perf list: Display hybrid PMU events with cpu type\")\nSigned-off-by: John Garry \u003cjohn.garry@huawei.com\u003e\nTested-by: Zhengjun Xing \u003czhengjun.xing@linux.intel.com\u003e\nCc: Alexander Shishkin \u003calexander.shishkin@linux.intel.com\u003e\nCc: Ian Rogers \u003cirogers@google.com\u003e\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Kan Liang \u003ckan.liang@linux.intel.com\u003e\nCc: Mark Rutland \u003cmark.rutland@arm.com\u003e\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: https://lore.kernel.org/r/1640103090-140490-1-git-send-email-john.garry@huawei.com\nSigned-off-by: Arnaldo Carvalho de Melo \u003cacme@redhat.com\u003e\n" }, { "commit": "f9d31c4cf4c11ff10317f038b9c6f7c3bda6cdd4", "tree": "b9773cb8cf506bcab4f94014afbb12becbe18e76", "parents": [ "5b40d10b604280a5bdf355b9d47ed238c92233dd" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Fri Dec 31 18:37:37 2021 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Jan 02 12:46:41 2022 +0000" }, "message": "sctp: hold endpoint before calling cb in sctp_transport_lookup_process\n\nThe same fix in commit 5ec7d18d1813 (\"sctp: use call_rcu to free endpoint\")\nis also needed for dumping one asoc and sock after the lookup.\n\nFixes: 86fdb3448cc1 (\"sctp: ensure ep is not destroyed before doing the dump\")\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5b40d10b604280a5bdf355b9d47ed238c92233dd", "tree": "1acec271fea5784bfbc23b2a5ce393efa5b83a59", "parents": [ "ae81de737885820616f9c67c2e7935998b523d58", "5055dc0348b8b7c168e3296044bccd724e1ae6cd" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Jan 02 12:45:13 2022 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Jan 02 12:45:13 2022 +0000" }, "message": "Merge branch \u0027ena-fixes\u0027\n\nArthur Kiyanovski says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nENA driver bug fixes\n\nPatchset V2 chages:\n-------------------\nUpdated SHA1 of Fixes tag in patch 3/3 to be 12 digits long\n\nOriginal cover letter:\n----------------------\nENA driver bug fixes\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5055dc0348b8b7c168e3296044bccd724e1ae6cd", "tree": "1acec271fea5784bfbc23b2a5ce393efa5b83a59", "parents": [ "cb3d4f98f0b26eafa0b913ac3716e4714254a747" ], "author": { "name": "Arthur Kiyanovski", "email": "akiyano@amazon.com", "time": "Sun Jan 02 07:37:28 2022 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Jan 02 12:45:13 2022 +0000" }, "message": "net: ena: Fix error handling when calculating max IO queues number\n\nThe role of ena_calc_max_io_queue_num() is to return the number\nof queues supported by the device, which means the return value\nshould be \u003e\u003d0.\n\nThe function that calls ena_calc_max_io_queue_num(), checks\nthe return value. If it is 0, it means the device reported\nit supports 0 IO queues. This case is considered an error\nand is handled by the calling function accordingly.\n\nHowever the current implementation of ena_calc_max_io_queue_num()\nis wrong, since when it detects the device supports 0 IO queues,\nit returns -EFAULT.\n\nIn such a case the calling function doesn\u0027t detect the error,\nand therefore doesn\u0027t handle it.\n\nThis commit changes ena_calc_max_io_queue_num() to return 0\nin case the device reported it supports 0 queues, allowing the\ncalling function to properly handle the error case.\n\nFixes: 736ce3f414cc (\"net: ena: make ethtool -l show correct max number of queues\")\nSigned-off-by: Shay Agroskin \u003cshayagr@amazon.com\u003e\nSigned-off-by: Arthur Kiyanovski \u003cakiyano@amazon.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "cb3d4f98f0b26eafa0b913ac3716e4714254a747", "tree": "bc7221f232d8fa2567822471118277a6b608e242", "parents": [ "c255a34e02efb1393d23ffb205ba1a11320aeffb" ], "author": { "name": "Arthur Kiyanovski", "email": "akiyano@amazon.com", "time": "Sun Jan 02 07:37:27 2022 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Jan 02 12:45:13 2022 +0000" }, "message": "net: ena: Fix wrong rx request id by resetting device\n\nA wrong request id received from the device is a sign that\nsomething is wrong with it, therefore trigger a device reset.\n\nAlso add some debug info to the \"Page is NULL\" print to make\nit easier to debug.\n\nFixes: 1738cd3ed342 (\"net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)\")\nSigned-off-by: Arthur Kiyanovski \u003cakiyano@amazon.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c255a34e02efb1393d23ffb205ba1a11320aeffb", "tree": "f18f9dfa275ea817b3d7513a895ee915a9c4d0e8", "parents": [ "ae81de737885820616f9c67c2e7935998b523d58" ], "author": { "name": "Arthur Kiyanovski", "email": "akiyano@amazon.com", "time": "Sun Jan 02 07:37:26 2022 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Jan 02 12:45:13 2022 +0000" }, "message": "net: ena: Fix undefined state when tx request id is out of bounds\n\nena_com_tx_comp_req_id_get() checks the req_id of a received completion,\nand if it is out of bounds returns -EINVAL. This is a sign that\nsomething is wrong with the device and it needs to be reset.\n\nThe current code does not reset the device in this case, which leaves\nthe driver in an undefined state, where this completion is not properly\nhandled.\n\nThis commit adds a call to handle_invalid_req_id() in ena_clean_tx_irq()\nand ena_clean_xdp_irq() which resets the device to fix the issue.\n\nThis commit also removes unnecessary request id checks from\nvalidate_tx_req_id() and validate_xdp_req_id(). This check is unneeded\nbecause it was already performed in ena_com_tx_comp_req_id_get(), which\nis called right before these functions.\n\nFixes: 548c4940b9f1 (\"net: ena: Implement XDP_TX action\")\nSigned-off-by: Shay Agroskin \u003cshayagr@amazon.com\u003e\nSigned-off-by: Arthur Kiyanovski \u003cakiyano@amazon.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "ae81de737885820616f9c67c2e7935998b523d58", "tree": "df6d03434788efdff770084a74c01372787ebe86", "parents": [ "d6d86830705f173fca6087a3e67ceaf68db80523" ], "author": { "name": "Gagan Kumar", "email": "gagan1kumar.cs@gmail.com", "time": "Sat Jan 01 11:11:25 2022 +0530" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Sun Jan 02 12:18:14 2022 +0000" }, "message": "mctp: Remove only static neighbour on RTM_DELNEIGH\n\nAdd neighbour source flag in mctp_neigh_remove(...) to allow removal of\nonly static neighbours.\n\nThis should be a no-op change and might be useful later when mctp can\nhave MCTP_NEIGH_DISCOVER neighbours.\n\nSigned-off-by: Gagan Kumar \u003cgagan1kumar.cs@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "938f2e0b57ffe8a6df71e1e177b2978b1b33fe5e", "tree": "af91fc2774265e82b9c76975cb0fca1aa79b921f", "parents": [ "66f4beaa6c1d28161f534471484b2daa2de1dce0" ], "author": { "name": "Linus Lüssing", "email": "linus.luessing@c0d3.blue", "time": "Sat Jan 01 06:27:13 2022 +0100" }, "committer": { "name": "Simon Wunderlich", "email": "sw@simonwunderlich.de", "time": "Sun Jan 02 09:31:17 2022 +0100" }, "message": "batman-adv: mcast: don\u0027t send link-local multicast to mcast routers\n\nThe addition of routable multicast TX handling introduced a\nbug/regression for packets with a link-local multicast destination:\nThese packets would be sent to all batman-adv nodes with a multicast\nrouter and to all batman-adv nodes with an old version without multicast\nrouter detection.\n\nThis even disregards the batman-adv multicast fanout setting, which can\npotentially lead to an unwanted, high number of unicast transmissions or\neven congestion.\n\nFixing this by avoiding to send link-local multicast packets to nodes in\nthe multicast router list.\n\nFixes: 11d458c1cb9b (\"batman-adv: mcast: apply optimizations for routable packets, too\")\nSigned-off-by: Linus Lüssing \u003clinus.luessing@c0d3.blue\u003e\nSigned-off-by: Sven Eckelmann \u003csven@narfation.org\u003e\nSigned-off-by: Simon Wunderlich \u003csw@simonwunderlich.de\u003e\n" }, { "commit": "278218f6778bc7d6f8b67199446c56cec7ebb841", "tree": "89438cfa6feb54021ba70f72d3013b81b1583b7f", "parents": [ "8008293888188c3923f5bd8a69370dae25ed14e5", "bc7ec91718c49d938849697cfad98fcd9877cc26" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 01 10:21:49 2022 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jan 01 10:21:49 2022 -0800" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input fixes from Dmitry Torokhov:\n \"Two small fixups for spaceball joystick driver and appletouch touchpad\n driver\"\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n Input: spaceball - fix parsing of movement data packets\n Input: appletouch - initialize work before device registration\n" }, { "commit": "d6d86830705f173fca6087a3e67ceaf68db80523", "tree": "f02d4b9d0be3173ae56eb90998db4da0d58b419e", "parents": [ "5e75d0b215b868337e7a193f28a543ec00e858b1" ], "author": { "name": "Haimin Zhang", "email": "tcs_kernel@tencent.com", "time": "Fri Dec 31 10:35:23 2021 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Dec 31 18:37:08 2021 -0800" }, "message": "net ticp:fix a kernel-infoleak in __tipc_sendmsg()\n\nstruct tipc_socket_addr.ref has a 4-byte hole,and __tipc_getname() currently\ncopying it to user space,causing kernel-infoleak.\n\nBUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline]\nBUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] lib/usercopy.c:33\nBUG: KMSAN: kernel-infoleak in _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 lib/usercopy.c:33\n instrument_copy_to_user include/linux/instrumented.h:121 [inline]\n instrument_copy_to_user include/linux/instrumented.h:121 [inline] lib/usercopy.c:33\n _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 lib/usercopy.c:33\n copy_to_user include/linux/uaccess.h:209 [inline]\n copy_to_user include/linux/uaccess.h:209 [inline] net/socket.c:287\n move_addr_to_user+0x3f6/0x600 net/socket.c:287 net/socket.c:287\n __sys_getpeername+0x470/0x6b0 net/socket.c:1987 net/socket.c:1987\n __do_sys_getpeername net/socket.c:1997 [inline]\n __se_sys_getpeername net/socket.c:1994 [inline]\n __do_sys_getpeername net/socket.c:1997 [inline] net/socket.c:1994\n __se_sys_getpeername net/socket.c:1994 [inline] net/socket.c:1994\n __x64_sys_getpeername+0xda/0x120 net/socket.c:1994 net/socket.c:1994\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c:82\n do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nUninit was stored to memory at:\n tipc_getname+0x575/0x5e0 net/tipc/socket.c:757 net/tipc/socket.c:757\n __sys_getpeername+0x3b3/0x6b0 net/socket.c:1984 net/socket.c:1984\n __do_sys_getpeername net/socket.c:1997 [inline]\n __se_sys_getpeername net/socket.c:1994 [inline]\n __do_sys_getpeername net/socket.c:1997 [inline] net/socket.c:1994\n __se_sys_getpeername net/socket.c:1994 [inline] net/socket.c:1994\n __x64_sys_getpeername+0xda/0x120 net/socket.c:1994 net/socket.c:1994\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c:82\n do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nUninit was stored to memory at:\n msg_set_word net/tipc/msg.h:212 [inline]\n msg_set_destport net/tipc/msg.h:619 [inline]\n msg_set_word net/tipc/msg.h:212 [inline] net/tipc/socket.c:1486\n msg_set_destport net/tipc/msg.h:619 [inline] net/tipc/socket.c:1486\n __tipc_sendmsg+0x44fa/0x5890 net/tipc/socket.c:1486 net/tipc/socket.c:1486\n tipc_sendmsg+0xeb/0x140 net/tipc/socket.c:1402 net/tipc/socket.c:1402\n sock_sendmsg_nosec net/socket.c:704 [inline]\n sock_sendmsg net/socket.c:724 [inline]\n sock_sendmsg_nosec net/socket.c:704 [inline] net/socket.c:2409\n sock_sendmsg net/socket.c:724 [inline] net/socket.c:2409\n ____sys_sendmsg+0xe11/0x12c0 net/socket.c:2409 net/socket.c:2409\n ___sys_sendmsg net/socket.c:2463 [inline]\n ___sys_sendmsg net/socket.c:2463 [inline] net/socket.c:2492\n __sys_sendmsg+0x704/0x840 net/socket.c:2492 net/socket.c:2492\n __do_sys_sendmsg net/socket.c:2501 [inline]\n __se_sys_sendmsg net/socket.c:2499 [inline]\n __do_sys_sendmsg net/socket.c:2501 [inline] net/socket.c:2499\n __se_sys_sendmsg net/socket.c:2499 [inline] net/socket.c:2499\n __x64_sys_sendmsg+0xe2/0x120 net/socket.c:2499 net/socket.c:2499\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c:82\n do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nLocal variable skaddr created at:\n __tipc_sendmsg+0x2d0/0x5890 net/tipc/socket.c:1419 net/tipc/socket.c:1419\n tipc_sendmsg+0xeb/0x140 net/tipc/socket.c:1402 net/tipc/socket.c:1402\n\nBytes 4-7 of 16 are uninitialized\nMemory access of size 16 starts at ffff888113753e00\nData copied to user address 0000000020000280\n\nReported-by: syzbot+cdbd40e0c3ca02cae3b7@syzkaller.appspotmail.com\nSigned-off-by: Haimin Zhang \u003ctcs_kernel@tencent.com\u003e\nAcked-by: Jon Maloy \u003cjmaloy@redhat.com\u003e\nLink: https://lore.kernel.org/r/1640918123-14547-1-git-send-email-tcs.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5e75d0b215b868337e7a193f28a543ec00e858b1", "tree": "ae6d85bf785dd865d27d461f6ca92261de579125", "parents": [ "0f1fe7b83ba0e47a7c57135420630e9f68e332a3" ], "author": { "name": "Jianguo Wu", "email": "wujianguo@chinatelecom.cn", "time": "Fri Dec 31 10:01:08 2021 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Dec 31 18:36:41 2021 -0800" }, "message": "selftests: net: udpgro_fwd.sh: explicitly checking the available ping feature\n\nAs Paolo pointed out, the result of ping IPv6 address depends on\nthe running distro. So explicitly checking the available ping feature,\nas e.g. do the bareudp.sh self-tests.\n\nFixes: 8b3170e07539 (\"selftests: net: using ping6 for IPv6 in udpgro_fwd.sh\")\nSigned-off-by: Jianguo Wu \u003cwujianguo@chinatelecom.cn\u003e\nLink: https://lore.kernel.org/r/825ee22b-4245-dbf7-d2f7-a230770d6e21@163.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0f1fe7b83ba0e47a7c57135420630e9f68e332a3", "tree": "84341d8bcf01a20f6c19d2b9c4dd2962d5b338b4", "parents": [ "4760abaac6844ebf87321403fbd36b72f8f1731a", "819d11507f6637731947836e6308f5966d64cf9d" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Dec 31 18:35:53 2021 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Dec 31 18:35:54 2021 -0800" }, "message": "Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nDaniel Borkmann says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull-request: bpf 2021-12-31\n\nWe\u0027ve added 2 non-merge commits during the last 14 day(s) which contain\na total of 2 files changed, 3 insertions(+), 3 deletions(-).\n\nThe main changes are:\n\n1) Revert of an earlier attempt to fix xsk\u0027s poll() behavior where it\n turned out that the fix for a rare problem made it much worse in\n general, from Magnus Karlsson. (Fyi, Magnus mentioned that a proper\n fix is coming early next year, so the revert is mainly to avoid\n slipping the behavior into 5.16.)\n\n2) Minor misc spell fix in BPF selftests, from Colin Ian King.\n\n* https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:\n bpf, selftests: Fix spelling mistake \"tained\" -\u003e \"tainted\"\n Revert \"xsk: Do not sleep in poll() when need_wakeup set\"\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://lore.kernel.org/r/20211231160050.16105-1-daniel@iogearbox.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8008293888188c3923f5bd8a69370dae25ed14e5", "tree": "4ddefd2eb46ae893bbf9a58fcf4b1b1747e80c65", "parents": [ "1b4e3f26f9f7553b260b8aed43967500961448a6" ], "author": { "name": "Mel Gorman", "email": "mgorman@techsingularity.net", "time": "Fri Dec 31 13:10:09 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 31 13:12:55 2021 -0800" }, "message": "mm: vmscan: reduce throttling due to a failure to make progress -fix\n\nHugh Dickins reported the following\n\n\tMy tmpfs swapping load (tweaked to use huge pages more heavily\n\tthan in real life) is far from being a realistic load: but it was\n\tnotably slowed down by your throttling mods in 5.16-rc, and this\n\tpatch makes it well again - thanks.\n\n\tBut: it very quickly hit NULL pointer until I changed that last\n\tline to\n\n if (first_pgdat)\n consider_reclaim_throttle(first_pgdat, sc);\n\nThe likely issue is that huge pages are a major component of the test\nworkload. When this is the case, first_pgdat may never get set if\ncompaction is ready to continue due to this check\n\n if (IS_ENABLED(CONFIG_COMPACTION) \u0026\u0026\n sc-\u003eorder \u003e PAGE_ALLOC_COSTLY_ORDER \u0026\u0026\n compaction_ready(zone, sc)) {\n sc-\u003ecompaction_ready \u003d true;\n continue;\n }\n\nIf this was true for every zone in the zonelist, first_pgdat would never\nget set resulting in a NULL pointer exception.\n\nLink: https://lkml.kernel.org/r/20211209095453.GM3366@techsingularity.net\nFixes: 1b4e3f26f9f75 (\"mm: vmscan: Reduce throttling due to a failure to make progress\")\nSigned-off-by: Mel Gorman \u003cmgorman@techsingularity.net\u003e\nReported-by: Hugh Dickins \u003chughd@google.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nCc: Rik van Riel \u003criel@surriel.com\u003e\nCc: Mike Galbraith \u003cefault@gmx.de\u003e\nCc: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nCc: Shakeel Butt \u003cshakeelb@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "1b4e3f26f9f7553b260b8aed43967500961448a6", "tree": "5e5875dee79302caf399f3f01a40a3f1ba071ee4", "parents": [ "f87bcc88f3028af584b0820bdf6e0e4cdc759d26" ], "author": { "name": "Mel Gorman", "email": "mgorman@techsingularity.net", "time": "Thu Dec 02 15:06:14 2021 +0000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 31 11:17:07 2021 -0800" }, "message": "mm: vmscan: Reduce throttling due to a failure to make progress\n\nMike Galbraith, Alexey Avramov and Darrick Wong all reported similar\nproblems due to reclaim throttling for excessive lengths of time. In\nAlexey\u0027s case, a memory hog that should go OOM quickly stalls for\nseveral minutes before stalling. In Mike and Darrick\u0027s cases, a small\nmemcg environment stalled excessively even though the system had enough\nmemory overall.\n\nCommit 69392a403f49 (\"mm/vmscan: throttle reclaim when no progress is\nbeing made\") introduced the problem although commit a19594ca4a8b\n(\"mm/vmscan: increase the timeout if page reclaim is not making\nprogress\") made it worse. Systems at or near an OOM state that cannot\nbe recovered must reach OOM quickly and memcg should kill tasks if a\nmemcg is near OOM.\n\nTo address this, only stall for the first zone in the zonelist, reduce\nthe timeout to 1 tick for VMSCAN_THROTTLE_NOPROGRESS and only stall if\nthe scan control nr_reclaimed is 0, kswapd is still active and there\nwere excessive pages pending for writeback. If kswapd has stopped\nreclaiming due to excessive failures, do not stall at all so that OOM\ntriggers relatively quickly. Similarly, if an LRU is simply congested,\nonly lightly throttle similar to NOPROGRESS.\n\nAlexey\u0027s original case was the most straight forward\n\n\tfor i in {1..3}; do tail /dev/zero; done\n\nOn vanilla 5.16-rc1, this test stalled heavily, after the patch the test\ncompletes in a few seconds similar to 5.15.\n\nAlexey\u0027s second test case added watching a youtube video while tail runs\n10 times. On 5.15, playback only jitters slightly, 5.16-rc1 stalls a\nlot with lots of frames missing and numerous audio glitches. With this\npatch applies, the video plays similarly to 5.15.\n\n[lkp@intel.com: Fix W\u003d1 build warning]\n\nLink: https://lore.kernel.org/r/99e779783d6c7fce96448a3402061b9dc1b3b602.camel@gmx.de\nLink: https://lore.kernel.org/r/20211124011954.7cab9bb4@mail.inbox.lv\nLink: https://lore.kernel.org/r/20211022144651.19914-1-mgorman@techsingularity.net\nLink: https://lore.kernel.org/r/20211202150614.22440-1-mgorman@techsingularity.net\nLink: https://linux-regtracking.leemhuis.info/regzbot/regression/20211124011954.7cab9bb4@mail.inbox.lv/\nReported-and-tested-by: Alexey Avramov \u003chakavlad@inbox.lv\u003e\nReported-and-tested-by: Mike Galbraith \u003cefault@gmx.de\u003e\nReported-and-tested-by: Darrick J. Wong \u003cdjwong@kernel.org\u003e\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nAcked-by: Hugh Dickins \u003chughd@google.com\u003e\nTracked-by: Thorsten Leemhuis \u003cregressions@leemhuis.info\u003e\nFixes: 69392a403f49 (\"mm/vmscan: throttle reclaim when no progress is being made\")\nSigned-off-by: Mel Gorman \u003cmgorman@techsingularity.net\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "f87bcc88f3028af584b0820bdf6e0e4cdc759d26", "tree": "fcca87bc48bd442275f135e3216acab269ef2873", "parents": [ "e46227bf3899eb21d738aa8ef2ec0f598dc70f7a", "ebb3f994dd92f8fb4d70c7541091216c1e10cb71" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 31 09:28:48 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 31 09:28:48 2021 -0800" }, "message": "Merge branch \u0027akpm\u0027 (patches from Andrew)\n\nMerge misc mm fixes from Andrew Morton:\n \"2 patches.\n\n Subsystems affected by this patch series: mm (userfaultfd and damon)\"\n\n* akpm:\n mm/damon/dbgfs: fix \u0027struct pid\u0027 leaks in \u0027dbgfs_target_ids_write()\u0027\n userfaultfd/selftests: fix hugetlb area allocations\n" }, { "commit": "e46227bf3899eb21d738aa8ef2ec0f598dc70f7a", "tree": "3f1e662c9ace7392dc1090409de615d3b8b47647", "parents": [ "4f3d93c6eaff6b84e43b63e0d7a119c5920e1020", "142c779d05d1fef75134c3cb63f52ccbc96d9e1f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 31 09:22:25 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 31 09:22:25 2021 -0800" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Three fixes, all in drivers. The lpfc one doesn\u0027t look exploitable,\n but nasty things could happen in string operations if mybuf ends up\n with an on stack unterminated string\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: vmw_pvscsi: Set residual data length conditionally\n scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()\n scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()\n" }, { "commit": "ebb3f994dd92f8fb4d70c7541091216c1e10cb71", "tree": "4b76bd68efb70f32a1f9b88935019d9070e2bc11", "parents": [ "f5c73297181c6b3ad76537bad98eaad6d29b9333" ], "author": { "name": "SeongJae Park", "email": "sj@kernel.org", "time": "Thu Dec 30 20:12:34 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 31 09:20:12 2021 -0800" }, "message": "mm/damon/dbgfs: fix \u0027struct pid\u0027 leaks in \u0027dbgfs_target_ids_write()\u0027\n\nDAMON debugfs interface increases the reference counts of \u0027struct pid\u0027s\nfor targets from the \u0027target_ids\u0027 file write callback\n(\u0027dbgfs_target_ids_write()\u0027), but decreases the counts only in DAMON\nmonitoring termination callback (\u0027dbgfs_before_terminate()\u0027).\n\nTherefore, when \u0027target_ids\u0027 file is repeatedly written without DAMON\nmonitoring start/termination, the reference count is not decreased and\ntherefore memory for the \u0027struct pid\u0027 cannot be freed. This commit\nfixes this issue by decreasing the reference counts when \u0027target_ids\u0027 is\nwritten.\n\nLink: https://lkml.kernel.org/r/20211229124029.23348-1-sj@kernel.org\nFixes: 4bc05954d007 (\"mm/damon: implement a debugfs-based user space interface\")\nSigned-off-by: SeongJae Park \u003csj@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[5.15+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "f5c73297181c6b3ad76537bad98eaad6d29b9333", "tree": "6a53493290234ff078b9306372ae3e13ff4b129e", "parents": [ "4f3d93c6eaff6b84e43b63e0d7a119c5920e1020" ], "author": { "name": "Mike Kravetz", "email": "mike.kravetz@oracle.com", "time": "Thu Dec 30 20:12:31 2021 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Dec 31 09:20:12 2021 -0800" }, "message": "userfaultfd/selftests: fix hugetlb area allocations\n\nCurrently, userfaultfd selftest for hugetlb as run from run_vmtests.sh\nor any environment where there are \u0027just enough\u0027 hugetlb pages will\nalways fail with:\n\n testing events (fork, remap, remove):\n\t\tERROR: UFFDIO_COPY error: -12 (errno\u003d12, line\u003d616)\n\nThe ENOMEM error code implies there are not enough hugetlb pages.\nHowever, there are free hugetlb pages but they are all reserved. There\nis a basic problem with the way the test allocates hugetlb pages which\nhas existed since the test was originally written.\n\nDue to the way \u0027cleanup\u0027 was done between different phases of the test,\nthis issue was masked until recently. The issue was uncovered by commit\n8ba6e8640844 (\"userfaultfd/selftests: reinitialize test context in each\ntest\").\n\nFor the hugetlb test, src and dst areas are allocated as PRIVATE\nmappings of a hugetlb file. This means that at mmap time, pages are\nreserved for the src and dst areas. At the start of event testing (and\nother tests) the src area is populated which results in allocation of\nhuge pages to fill the area and consumption of reserves associated with\nthe area. Then, a child is forked to fault in the dst area. Note that\nthe dst area was allocated in the parent and hence the parent owns the\nreserves associated with the mapping. The child has normal access to\nthe dst area, but can not use the reserves created/owned by the parent.\nThus, if there are no other huge pages available allocation of a page\nfor the dst by the child will fail.\n\nFix by not creating reserves for the dst area. In this way the child\ncan use free (non-reserved) pages.\n\nAlso, MAP_PRIVATE of a file only makes sense if you are interested in\nthe contents of the file before making a COW copy. The test does not do\nthis. So, just use MAP_ANONYMOUS | MAP_HUGETLB to create an anonymous\nhugetlb mapping. There is no need to create a hugetlb file in the\nnon-shared case.\n\nLink: https://lkml.kernel.org/r/20211217172919.7861-1-mike.kravetz@oracle.com\nSigned-off-by: Mike Kravetz \u003cmike.kravetz@oracle.com\u003e\nCc: Axel Rasmussen \u003caxelrasmussen@google.com\u003e\nCc: Peter Xu \u003cpeterx@redhat.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Mina Almasry \u003calmasrymina@google.com\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "4760abaac6844ebf87321403fbd36b72f8f1731a", "tree": "5958ffe90f2b20ab1471b611cea25a896ec98a3e", "parents": [ "74c78b4291b4466b44a57b3b7c3b98ad02628686", "8bda81a4d400cf8a72e554012f0d8c45e07a3904" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Dec 31 14:32:00 2021 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Dec 31 14:32:00 2021 +0000" }, "message": "Merge branch \u0027mpr-len-checks\u0027\nDavid Ahern says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: Length checks for attributes within multipath routes\n\nAdd length checks for attributes within a multipath route (attributes\nwithin RTA_MULTIPATH). Motivated by the syzbot report in patch 1 and\nthen expanded to other attributes as noted by Ido.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "8bda81a4d400cf8a72e554012f0d8c45e07a3904", "tree": "5958ffe90f2b20ab1471b611cea25a896ec98a3e", "parents": [ "1ff15a710a862db1101b97810af14aedc835a86a" ], "author": { "name": "David Ahern", "email": "dsahern@kernel.org", "time": "Thu Dec 30 17:36:35 2021 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Dec 31 14:31:59 2021 +0000" }, "message": "lwtunnel: Validate RTA_ENCAP_TYPE attribute length\n\nlwtunnel_valid_encap_type_attr is used to validate encap attributes\nwithin a multipath route. Add length validation checking to the type.\n\nlwtunnel_valid_encap_type_attr is called converting attributes to\nfib{6,}_config struct which means it is used before fib_get_nhs,\nip6_route_multipath_add, and ip6_route_multipath_del - other\nlocations that use rtnh_ok and then nla_get_u16 on RTA_ENCAP_TYPE\nattribute.\n\nFixes: 9ed59592e3e3 (\"lwtunnel: fix autoload of lwt modules\")\n\nSigned-off-by: David Ahern \u003cdsahern@kernel.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" } ], "next": "1ff15a710a862db1101b97810af14aedc835a86a" }