{"push_id":869609009,"size":108,"distinct_size":12,"ref":"refs/heads/uniphier-next","head":"3e6c26376da0c834a21a325c3ff2b9ed541b4ef9","before":"584e7075fcf99dc7fef6c47578548112a0088317","commits":[{"sha":"61b590b9ee4221173ad6990a1150c5c9db73564e","author":{"email":"cef439e78636cdab99cd2923826c5065a0743e5b@strlen.de","name":"Florian Westphal"},"message":"netfilter: ingress: don't use nf_hook_list_active\n\nnf_hook_list_active() always returns true once at least one device has\nNF_INGRESS hook enabled.\n\nThus, don't use this function. Instead, inverse the test and use the static\nkey to elide list_empty test if no NF_INGRESS hooks are active.\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/61b590b9ee4221173ad6990a1150c5c9db73564e"},{"sha":"b4865988eab598e56e6e628b9b32441acd142b28","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"netfilter: ingress: fix wrong input interface on hook\n\nThe input and output interfaces in nf_hook_state_init() are flipped.\nThis fixes iif matching on nftables.\n\nReported-by: Patrick McHardy <kaber@trash.net>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/b4865988eab598e56e6e628b9b32441acd142b28"},{"sha":"95ad1f4a9358dff1dcf84bf5c9cc84caa9215f7f","author":{"email":"5a7b97a838c5f3992292d1fd9e7ad830cc55ada6@blackhole.kfki.hu","name":"Jozsef Kadlecsik"},"message":"netfilter: ipset: Fix extension alignment\n\nThe data extensions in ipset lacked the proper memory alignment and\nthus could lead to kernel crash on several architectures. Therefore\nthe structures have been reorganized and alignment attributes added\nwhere needed. The patch was tested on armv7h by Gerhard Wiesinger and\non x86_64, sparc64 by Jozsef Kadlecsik.\n\nReported-by: Gerhard Wiesinger <lists@wiesinger.com>\nTested-by: Gerhard Wiesinger <lists@wiesinger.com>\nTested-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>\nSigned-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/95ad1f4a9358dff1dcf84bf5c9cc84caa9215f7f"},{"sha":"e9dfdc052d018268926ab769d5b7598226713d5a","author":{"email":"5a7b97a838c5f3992292d1fd9e7ad830cc55ada6@blackhole.kfki.hu","name":"Jozsef Kadlecsik"},"message":"netfilter: ipset: Fix hash:* type expiration\n\nIncorrect index was used when the data blob was shrinked at expiration,\nwhich could lead to falsely expired entries and memory leak when\nthe comment extension was used too.\n\nSigned-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/e9dfdc052d018268926ab769d5b7598226713d5a"},{"sha":"0aae24eb409fc429f54ca3809f904f1b91e295e0","author":{"email":"5a7b97a838c5f3992292d1fd9e7ad830cc55ada6@blackhole.kfki.hu","name":"Jozsef Kadlecsik"},"message":"netfilter: ipset: Fix hash type expire: release empty hash bucket block\n\nWhen all entries are expired/all slots are empty, release the bucket.\n\nSigned-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/0aae24eb409fc429f54ca3809f904f1b91e295e0"},{"sha":"e75cb467df29a428612c162e6f1451c5c0717091","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"Merge branch 'master' of git://blackhole.kfki.hu/nf\n\nJozsef Kadlecsik says:\n====================\nPlease apply the next bugfixes against the nf tree.\n\n- Fix extensions alignment in ipset: Gerhard Wiesinger reported\n  that the missing data aligments lead to crash on non-intel\n  architecture. The patch was tested on armv7h by Gerhard Wiesinger\n  and on x86_64 and sparc64 by me.\n- An incorrect index at the hash:* types could lead to\n  falsely early expired entries and memory leak when the comment\n  extension was used too.\n- Release empty hash bucket block when all entries are expired or\n  all slots are empty instead of shrinkig the data part to zero.\n====================\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/e75cb467df29a428612c162e6f1451c5c0717091"},{"sha":"c255cb2ed3c7960b2c68f45de1dc0ac2197c8f78","author":{"email":"45ec80249c2555620af0f1c21a1d7b1b621a30cd@alliedtelesis.co.nz","name":"Anthony Lineham"},"message":"netfilter: Fix removal of GRE expectation entries created by PPTP\n\nThe uninitialized tuple structure caused incorrect hash calculation\nand the lookup failed.\n\nLink: https://bugzilla.kernel.org/show_bug.cgi?id=106441\nSigned-off-by: Anthony Lineham <anthony.lineham@alliedtelesis.co.nz>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/c255cb2ed3c7960b2c68f45de1dc0ac2197c8f78"},{"sha":"c872a2d9e3627829591736ddd8e8710a0afb2f95","author":{"email":"f2c659f01951776204a6c5b902787d9019fbeebd@arndb.de","name":"Arnd Bergmann"},"message":"netfilter: nfnetlink_log: work around uninitialized variable warning\n\nAfter a recent (correct) change, gcc started warning about the use\nof the 'flags' variable in nfulnl_recv_config()\n\nnet/netfilter/nfnetlink_log.c: In function 'nfulnl_recv_config':\nnet/netfilter/nfnetlink_log.c:320:14: warning: 'flags' may be used uninitialized in this function [-Wmaybe-uninitialized]\nnet/netfilter/nfnetlink_log.c:828:6: note: 'flags' was declared here\n\nThe warning first shows up in ARM s3c2410_defconfig with gcc-4.3 or\nhigher (including 5.2.1, which is the latest version I checked) I\ntried working around it by rearranging the code but had no success\nwith that.\n\nAs a last resort, this initializes the variable to zero, which shuts\nup the warning, but means that we don't get a warning if the code\nis ever changed in a way that actually causes the variable to be\nused without first being written.\n\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nFixes: 8cbc870829ec (\"netfilter: nfnetlink_log: validate dependencies to avoid breaking atomicity\")\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/c872a2d9e3627829591736ddd8e8710a0afb2f95"},{"sha":"74ec4d55c4d243330d93fc52e23e37d2e76548ba","author":{"email":"f2c659f01951776204a6c5b902787d9019fbeebd@arndb.de","name":"Arnd Bergmann"},"message":"netfilter: fix xt_TEE and xt_TPROXY dependencies\n\nKconfig is too smart for its own good: a Kconfig line that states\n\n\tselect NF_DEFRAG_IPV6 if IP6_NF_IPTABLES\n\nmeans that if IP6_NF_IPTABLES is set to 'm', then NF_DEFRAG_IPV6 will\nalso be set to 'm', regardless of the state of the symbol from which\nit is selected. When the xt_TEE driver is built-in and nothing else\nforces NF_DEFRAG_IPV6 to be built-in, this causes a link-time error:\n\nnet/built-in.o: In function `tee_tg6':\nnet/netfilter/xt_TEE.c:46: undefined reference to `nf_dup_ipv6'\n\nThis works around that behavior by changing the dependency to\n'if IP6_NF_IPTABLES != n', which is interpreted as boolean expression\nrather than a tristate and causes the NF_DEFRAG_IPV6 symbol to\nbe built-in as well.\n\nThe bug only occurs once in thousands of 'randconfig' builds and\ndoes not really impact real users. From inspecting the other\nsurrounding Kconfig symbols, I am guessing that NETFILTER_XT_TARGET_TPROXY\nand NETFILTER_XT_MATCH_SOCKET have the same issue. If not, this\nchange should still be harmless.\n\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/74ec4d55c4d243330d93fc52e23e37d2e76548ba"},{"sha":"aabc92bbe3cfe4c545f8ccdaaeeea012a46f0abf","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"net: add __netdev_alloc_pcpu_stats() to indicate gfp flags\n\nnf_tables may create percpu counters from the packet path through its\ndynamic set instantiation infrastructure, so we need a way to allocate\nthis through GFP_ATOMIC.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nAcked-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/aabc92bbe3cfe4c545f8ccdaaeeea012a46f0abf"},{"sha":"086f332167d64b645d37405854f049b9ad7371ab","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"netfilter: nf_tables: add clone interface to expression operations\n\nWith the conversion of the counter expressions to make it percpu, we\nneed to clone the percpu memory area, otherwise we crash when using\ncounters from flow tables.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/086f332167d64b645d37405854f049b9ad7371ab"},{"sha":"39174291d8e8acfd1113214a943263aaa03c57c8","author":{"email":"b6456b24ae82a7595be3173ae585c7a827f25f37@fr.zoreil.com","name":"françois romieu"},"message":"r8169: fix kasan reported skb use-after-free.\n\nSigned-off-by: Francois Romieu <romieu@fr.zoreil.com>\nReported-by: Dave Jones <davej@codemonkey.org.uk>\nFixes: d7d2d89d4b0af (\"r8169: Add software counter for multicast packages\")\nAcked-by: Eric Dumazet <edumazet@google.com>\nAcked-by: Corinna Vinschen <vinschen@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/39174291d8e8acfd1113214a943263aaa03c57c8"},{"sha":"382a483e53fa9a84579aa92701d54801b37fb8fd","author":{"email":"fe08d3c717adf2ae63592e4c9aec6e3e404d8e3e@davemloft.net","name":"David S. Miller"},"message":"Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf\n\nPablo Neira Ayuso:\n\n====================\nNetfilter fixes for net\n\nThe following patchset contains Netfilter fixes for your net tree. This\nlarge batch that includes fixes for ipset, netfilter ingress, nf_tables\ndynamic set instantiation and a longstanding Kconfig dependency problem.\nMore specifically, they are:\n\n1) Add missing check for empty hook list at the ingress hook, from\n   Florian Westphal.\n\n2) Input and output interface are swapped at the ingress hook,\n   reported by Patrick McHardy.\n\n3) Resolve ipset extension alignment issues on ARM, patch from Jozsef\n   Kadlecsik.\n\n4) Fix bit check on bitmap in ipset hash type, also from Jozsef.\n\n5) Release buckets when all entries have expired in ipset hash type,\n   again from Jozsef.\n\n6) Oneliner to initialize conntrack tuple object in the PPTP helper,\n   otherwise the conntrack lookup may fail due to random bits in the\n   structure holes, patch from Anthony Lineham.\n\n7) Silence a bogus gcc warning in nfnetlink_log, from Arnd Bergmann.\n\n8) Fix Kconfig dependency problems with TPROXY, socket and dup, also\n   from Arnd.\n\n9) Add __netdev_alloc_pcpu_stats() to allow creating percpu counters\n   from atomic context, this is required by the follow up fix for\n   nf_tables.\n\n10) Fix crash from the dynamic set expression, we have to add new clone\n    operation that should be defined when a simple memcpy is not enough.\n    This resolves a crash when using per-cpu counters with new Patrick\n    McHardy's flow table nft support.\n====================\n\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/382a483e53fa9a84579aa92701d54801b37fb8fd"},{"sha":"49e4a2293035b420e807e739999d59c8ec1488e9","author":{"email":"f2c659f01951776204a6c5b902787d9019fbeebd@arndb.de","name":"Arnd Bergmann"},"message":"stmmac: avoid ipq806x constant overflow warning\n\nBuilding dwmac-ipq806x on a 64-bit architecture produces a harmless\nwarning from gcc:\n\nstmmac/dwmac-ipq806x.c: In function 'ipq806x_gmac_probe':\ninclude/linux/bitops.h:6:19: warning: overflow in implicit constant conversion [-Woverflow]\n  val = QSGMII_PHY_CDR_EN |\nstmmac/dwmac-ipq806x.c:333:8: note: in expansion of macro 'QSGMII_PHY_CDR_EN'\n #define QSGMII_PHY_CDR_EN   BIT(0)\n #define BIT(nr)   (1UL << (nr))\n\nThis is a result of the type conversion rules in C, when we take the\nlogical OR of multiple different types. In particular, we have\nand unsigned long\n\n\tQSGMII_PHY_CDR_EN == BIT(0) == (1ul << 0) == 0x0000000000000001ul\n\nand a signed int\n\n\t0xC << QSGMII_PHY_TX_DRV_AMP_OFFSET == 0xc0000000\n\nwhich together gives a signed long value\n\n\t0xffffffffc0000001l\n\nand when this is passed into a function that takes an unsigned int type,\ngcc warns about the signed overflow and the loss of the upper 32-bits that\nare all ones.\n\nThis patch adds 'ul' type modifiers to the literal numbers passed in\nhere, so now the expression remains an 'unsigned long' with the upper\nbits all zero, and that avoids the signed overflow and the warning.\n\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nFixes: b1c17215d718 (\"stmmac: add ipq806x glue layer\")\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/49e4a2293035b420e807e739999d59c8ec1488e9"},{"sha":"176155dac13f528e0a58c14dc322623219365d91","author":{"email":"ac7da5bc34fbda078ba4af5ef710d2a59a2316f5@intel.com","name":"Tadeusz Struk"},"message":"crypto: qat - don't use userspace pointer\n\nBugfix - don't dereference userspace pointer.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Tadeusz Struk <tadeusz.struk@intel.com>\nSigned-off-by: Herbert Xu <herbert@gondor.apana.org.au>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/176155dac13f528e0a58c14dc322623219365d91"},{"sha":"73ed5d25dce0354ea381d6dc93005c3085fae03d","author":{"email":"331be22c6b63ca3e0a03d408c2d906b1b02cd5f2@stressinduktion.org","name":"Hannes Frederic Sowa"},"message":"af-unix: fix use-after-free with concurrent readers while splicing\n\nDuring splicing an af-unix socket to a pipe we have to drop all\naf-unix socket locks. While doing so we allow another reader to enter\nunix_stream_read_generic which can read, copy and finally free another\nskb. If exactly this skb is just in process of being spliced we get a\nuse-after-free report by kasan.\n\nFirst, we must make sure to not have a free while the skb is used during\nthe splice operation. We simply increment its use counter before unlocking\nthe reader lock.\n\nStream sockets have the nice characteristic that we don't care about\nzero length writes and they never reach the peer socket's queue. That\nsaid, we can take the UNIXCB.consumed field as the indicator if the\nskb was already freed from the socket's receive queue. If the skb was\nfully consumed after we locked the reader side again we know it has been\ndropped by a second reader. We indicate a short read to user space and\nabort the current splice operation.\n\nThis bug has been found with syzkaller\n(http://github.com/google/syzkaller) by Dmitry Vyukov.\n\nFixes: 2b514574f7e8 (\"net: af_unix: implement splice for stream af_unix sockets\")\nReported-by: Dmitry Vyukov <dvyukov@google.com>\nCc: Dmitry Vyukov <dvyukov@google.com>\nCc: Eric Dumazet <eric.dumazet@gmail.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/73ed5d25dce0354ea381d6dc93005c3085fae03d"},{"sha":"9001d94dfd558f175bede9f847276f691cd9c164","author":{"email":"d100aa70785e45ee8deab668147d941941915c21@canonical.com","name":"Colin Ian King"},"message":"fjes: fix inconsistent indenting\n\nminor change, indenting is one tab out.\n\nSigned-off-by: Colin Ian King <colin.king@canonical.com>\nSigned-off-by: Taku Izumi <izumi.taku@jp.fujitsu.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/9001d94dfd558f175bede9f847276f691cd9c164"},{"sha":"0d3f6d297bfb7af24d0508460fdb3d1ec4903fa3","author":{"email":"2c0d8efbe28c4f7a45c3ab30c984ed2c126716bd@fb.com","name":"Martin KaFai Lau"},"message":"ipv6: Avoid creating RTF_CACHE from a rt that is not managed by fib6 tree\n\nThe original bug report:\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1272571\n\nThe setup has a IPv4 GRE tunnel running in a IPSec.  The bug\nhappens when ndisc starts sending router solicitation at the gre\ninterface.  The simplified oops stack is like:\n\n__lock_acquire+0x1b2/0x1c30\nlock_acquire+0xb9/0x140\n_raw_write_lock_bh+0x3f/0x50\n__ip6_ins_rt+0x2e/0x60\nip6_ins_rt+0x49/0x50\n~~~~~~~~\n__ip6_rt_update_pmtu.part.54+0x145/0x250\nip6_rt_update_pmtu+0x2e/0x40\n~~~~~~~~\nip_tunnel_xmit+0x1f1/0xf40\n__gre_xmit+0x7a/0x90\nipgre_xmit+0x15a/0x220\ndev_hard_start_xmit+0x2bd/0x480\n__dev_queue_xmit+0x696/0x730\ndev_queue_xmit+0x10/0x20\nneigh_direct_output+0x11/0x20\nip6_finish_output2+0x21f/0x770\nip6_finish_output+0xa7/0x1d0\nip6_output+0x56/0x190\n~~~~~~~~\nndisc_send_skb+0x1d9/0x400\nndisc_send_rs+0x88/0xc0\n~~~~~~~~\n\nThe rt passed to ip6_rt_update_pmtu() is created by\nicmp6_dst_alloc() and it is not managed by the fib6 tree,\nso its rt6i_table == NULL.  When __ip6_rt_update_pmtu() creates\na RTF_CACHE clone, the newly created clone also has rt6i_table == NULL\nand it causes the ip6_ins_rt() oops.\n\nDuring pmtu update, we only want to create a RTF_CACHE clone\nfrom a rt which is currently managed (or owned) by the\nfib6 tree.  It means either rt->rt6i_node != NULL or\nrt is a RTF_PCPU clone.\n\nIt is worth to note that rt6i_table may not be NULL even it is\nnot (yet) managed by the fib6 tree (e.g. addrconf_dst_alloc()).\nHence, rt6i_node is a better check instead of rt6i_table.\n\nFixes: 45e4fd26683c (\"ipv6: Only create RTF_CACHE routes after encountering pmtu\")\nSigned-off-by: Martin KaFai Lau <kafai@fb.com>\nReported-by: Chris Siebenmann <cks-rhbugzilla@cs.toronto.edu>\nCc: Chris Siebenmann <cks-rhbugzilla@cs.toronto.edu>\nCc: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/0d3f6d297bfb7af24d0508460fdb3d1ec4903fa3"},{"sha":"5973fb1e245086071bf71994c8b54d99526ded03","author":{"email":"2c0d8efbe28c4f7a45c3ab30c984ed2c126716bd@fb.com","name":"Martin KaFai Lau"},"message":"ipv6: Check expire on DST_NOCACHE route\n\nSince the expires of the DST_NOCACHE rt can be set during\nthe ip6_rt_update_pmtu(), we also need to consider the expires\nvalue when doing ip6_dst_check().\n\nThis patches creates __rt6_check_expired() to only\ncheck the expire value (if one exists) of the current rt.\n\nIn rt6_dst_from_check(), it adds __rt6_check_expired() as\none of the condition check.\n\nSigned-off-by: Martin KaFai Lau <kafai@fb.com>\nCc: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/5973fb1e245086071bf71994c8b54d99526ded03"},{"sha":"02bcf4e082e4dc634409a6a6cb7def8806d6e5e6","author":{"email":"2c0d8efbe28c4f7a45c3ab30c984ed2c126716bd@fb.com","name":"Martin KaFai Lau"},"message":"ipv6: Check rt->dst.from for the DST_NOCACHE route\n\nAll DST_NOCACHE rt6_info used to have rt->dst.from set to\nits parent.\n\nAfter commit 8e3d5be73681 (\"ipv6: Avoid double dst_free\"),\nDST_NOCACHE is also set to rt6_info which does not have\na parent (i.e. rt->dst.from is NULL).\n\nThis patch catches the rt->dst.from == NULL case.\n\nFixes: 8e3d5be73681 (\"ipv6: Avoid double dst_free\")\nSigned-off-by: Martin KaFai Lau <kafai@fb.com>\nCc: Hannes Frederic Sowa <hannes@stressinduktion.org>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":false,"url":"https://api.github.com/repos/masahir0y/linux-yamada/commits/02bcf4e082e4dc634409a6a6cb7def8806d6e5e6"}]}