{"push_id":720839746,"size":1000,"distinct_size":2098,"ref":"refs/heads/master","head":"1715ab0c1a06978a9f4e4978a717c5f8d8013835","before":"eef6cc0c43002df55b10377b5a641ec5cce46aa9","commits":[{"sha":"d7cf552c040efbcc291a331061f11944df44a6b9","author":{"email":"0e091c935e53b483ce302ea7a3b7eacb9583e677@gmail.com","name":"Roman Pen"},"message":"blktrace: fix accounting of partially completed requests\n\ncommit af5040da01ef980670b3741b3e10733ee3e33566 upstream.\n\ntrace_block_rq_complete does not take into account that request can\nbe partially completed, so we can get the following incorrect output\nof blkparser:\n\n  C   R 232 + 240 [0]\n  C   R 240 + 232 [0]\n  C   R 248 + 224 [0]\n  C   R 256 + 216 [0]\n\nbut should be:\n\n  C   R 232 + 8 [0]\n  C   R 240 + 8 [0]\n  C   R 248 + 8 [0]\n  C   R 256 + 8 [0]\n\nAlso, the whole output summary statistics of completed requests and\nfinal throughput will be incorrect.\n\nThis patch takes into account real completion size of the request and\nfixes wrong completion accounting.\n\nSigned-off-by: Roman Pen <r.peniaev@gmail.com>\nCC: Steven Rostedt <rostedt@goodmis.org>\nCC: Frederic Weisbecker <fweisbec@gmail.com>\nCC: Ingo Molnar <mingo@redhat.com>\nCC: linux-kernel@vger.kernel.org\nSigned-off-by: Jens Axboe <axboe@fb.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/d7cf552c040efbcc291a331061f11944df44a6b9"},{"sha":"fdd6eb65e83d308f1d8278a6860ca19ebce4c476","author":{"email":"74c05afa918858348d6db8037d82fa8124870113@openvz.org","name":"Andrey Vagin"},"message":"netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len\n\ncommit 223b02d923ecd7c84cf9780bb3686f455d279279 upstream.\n\n\"len\" contains sizeof(nf_ct_ext) and size of extensions. In a worst\ncase it can contain all extensions. Bellow you can find sizes for all\ntypes of extensions. Their sum is definitely bigger than 256.\n\nnf_ct_ext_types[0]->len = 24\nnf_ct_ext_types[1]->len = 32\nnf_ct_ext_types[2]->len = 24\nnf_ct_ext_types[3]->len = 32\nnf_ct_ext_types[4]->len = 152\nnf_ct_ext_types[5]->len = 2\nnf_ct_ext_types[6]->len = 16\nnf_ct_ext_types[7]->len = 8\n\nI have seen \"len\" up to 280 and my host has crashes w/o this patch.\n\nThe right way to fix this problem is reducing the size of the ecache\nextension (4) and Florian is going to do this, but these changes will\nbe quite large to be appropriate for a stable tree.\n\nFixes: 5b423f6a40a0 (netfilter: nf_conntrack: fix racy timer handling with reliable)\nCc: Pablo Neira Ayuso <pablo@netfilter.org>\nCc: Patrick McHardy <kaber@trash.net>\nCc: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>\nCc: \"David S. Miller\" <davem@davemloft.net>\nSigned-off-by: Andrey Vagin <avagin@openvz.org>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/fdd6eb65e83d308f1d8278a6860ca19ebce4c476"},{"sha":"f5690809cdecc925a245d133b583c1a5b413cadc","author":{"email":"16a9a54ddf4259952e3c118c763138e83693d7fd@perches.com","name":"Joe Perches"},"message":"net: Add net_ratelimited_function and net_<level>_ratelimited macros\n\ncommit 3a3bfb61e64476ff1e4ac3122cb6dec9c79b795c upstream.\n\n__ratelimit() can be considered an inverted bool test because\nit returns true when not ratelimited.  Several tests in the\nkernel tree use this __ratelimit() function incorrectly.\n\nNo net_ratelimit uses are incorrect currently though.\n\nMost uses of net_ratelimit are to log something via printk or\npr_<level>.\n\nIn order to minimize the uses of net_ratelimit, and to start\nstandardizing the code style used for __ratelimit() and net_ratelimit(),\nadd a net_ratelimited_function() macro and net_<level>_ratelimited()\nlogging macros similar to pr_<level>_ratelimited that use the global\nnet_ratelimit instead of a static per call site \"struct ratelimit_state\".\n\nSigned-off-by: Joe Perches <joe@perches.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/f5690809cdecc925a245d133b583c1a5b413cadc"},{"sha":"088c94ccc5454ce28e277770870cbda7af328ebf","author":{"email":"17c2d8920621522552b392f72d8fdb4d1e866b44@suug.ch","name":"Thomas Graf"},"message":"netfilter: Can't fail and free after table replacement\n\ncommit c58dd2dd443c26d856a168db108a0cd11c285bf3 upstream.\n\nAll xtables variants suffer from the defect that the copy_to_user()\nto copy the counters to user memory may fail after the table has\nalready been exchanged and thus exposed. Return an error at this\npoint will result in freeing the already exposed table. Any\nsubsequent packet processing will result in a kernel panic.\n\nWe can't copy the counters before exposing the new tables as we\nwant provide the counter state after the old table has been\nunhooked. Therefore convert this into a silent error.\n\nCc: Florian Westphal <fw@strlen.de>\nSigned-off-by: Thomas Graf <tgraf@suug.ch>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/088c94ccc5454ce28e277770870cbda7af328ebf"},{"sha":"4dfc00c73224f6f68f7d967be4e274652451f1ab","author":{"email":"43232e92d70cc7aa53504ad0397085ee47bad87f@goodmis.org","name":"Steven Rostedt (Red Hat)"},"message":"tracepoint: Do not waste memory on mods with no tracepoints\n\ncommit 7dec935a3aa04412cba2cebe1524ae0d34a30c24 upstream.\n\nNo reason to allocate tp_module structures for modules that have no\ntracepoints. This just wastes memory.\n\nFixes: b75ef8b44b1c \"Tracepoint: Dissociate from module mutex\"\nAcked-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>\nSigned-off-by: Steven Rostedt <rostedt@goodmis.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/4dfc00c73224f6f68f7d967be4e274652451f1ab"},{"sha":"f313a3cec59c668abf76447c7b917aa3b5bf9dcc","author":{"email":"c9df6394cb541f693236245820fbe23866f1a3fe@linux-m68k.org","name":"Andreas Schwab"},"message":"powerpc: Add vr save/restore functions\n\ncommit 8fe9c93e7453e67b8bd09f263ec1bb0783c733fc upstream.\n\nGCC 4.8 now generates out-of-line vr save/restore functions when\noptimizing for size.  They are needed for the raid6 altivec support.\n\nSigned-off-by: Andreas Schwab <schwab@linux-m68k.org>\nSigned-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>\nCc: Guenter Roeck <linux@roeck-us.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/f313a3cec59c668abf76447c7b917aa3b5bf9dcc"},{"sha":"a8da1b96cea3b1d88dd946ea0b07197ec7f5dfcf","author":{"email":"52f8f9962b7f38d8269c63c0859d68147c8d10f0@redhat.com","name":"Mikulas Patocka"},"message":"tgafb: fix mode setting with fbset\n\ncommit 624966589041deb32a2626ee2e176e8274581101 upstream.\n\nMode setting in the TGA driver is broken for these reasons:\n\n- info->fix.line_length is set just once in tgafb_init_fix function. If\n  we change videomode, info->fix.line_length is not recalculated - so\n  the video mode is changed but the screen is corrupted because of wrong\n  info->fix.line_length.\n\n- info->fix.smem_len is set in tgafb_init_fix to the size of the default\n  video mode (640x480). If we set a higher resolution,\n  info->fix.smem_len is smaller than the current screen size, preventing\n  the userspace program from mapping the framebuffer.\n\nThis patch fixes it:\n\n- info->fix.line_length initialization is moved to tgafb_set_par so that\n  it is recalculated with each mode change.\n\n- info->fix.smem_len is set to a fixed value representing the real\n  amount of video ram (the values are taken from xfree86 driver).\n\n- add a check to tgafb_check_var to prevent us from setting a videomode\n  that doesn't fit into videoram.\n\n- in tgafb_register, tgafb_init_fix is moved upwards, to be called\n  before fb_find_mode (because fb_find_mode already needs the videoram\n  size set in tgafb_init_fix).\n\nSigned-off-by: Mikulas Patocka <mpatocka@redhat.com>\nSigned-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/a8da1b96cea3b1d88dd946ea0b07197ec7f5dfcf"},{"sha":"0df37f7b8deb51c18d7e0f25727529370cceef78","author":{"email":"5b1e7895819cf7d6bc77091b09bbfd6d330a4e74@gmx.de","name":"Helge Deller"},"message":"parisc: fix epoll_pwait syscall on compat kernel\n\ncommit ab3e55b119c9653b19ea4edffb86f04db867ac98 upstream.\n\nThis bug was detected with the libio-epoll-perl debian package where the\ntest case IO-Ppoll-compat.t failed.\n\nSigned-off-by: Helge Deller <deller@gmx.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/0df37f7b8deb51c18d7e0f25727529370cceef78"},{"sha":"1ee0f6a359e0b6805890ad8091bee91d45e8593d","author":{"email":"d5fddbc10d7d0c19347bebdeca1e9c9f92c33d10@jp.fujitsu.com","name":"Mizuma, Masayoshi"},"message":"mm/hugetlb.c: add cond_resched_lock() in return_unused_surplus_pages()\n\ncommit 7848a4bf51b34f41fcc9bd77e837126d99ae84e3 upstream.\n\nsoft lockup in freeing gigantic hugepage fixed in commit 55f67141a892 \"mm:\nhugetlb: fix softlockup when a large number of hugepages are freed.\" can\nhappen in return_unused_surplus_pages(), so let's fix it.\n\nSigned-off-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>\nSigned-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>\nCc: Joonsoo Kim <iamjoonsoo.kim@lge.com>\nCc: Michal Hocko <mhocko@suse.cz>\nCc: Aneesh Kumar <aneesh.kumar@linux.vnet.ibm.com>\nCc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/1ee0f6a359e0b6805890ad8091bee91d45e8593d"},{"sha":"d7fc1dbb8642dd0d7ae801c44080d929f248242e","author":{"email":"252de8b0565405725b8d6c14cb06d77a207c1132@systec-electronic.com","name":"Michael Ulbricht"},"message":"USB: cdc-acm: Remove Motorola/Telit H24 serial interfaces from ACM driver\n\ncommit 895d240d1db0b2736d779200788e4c4aea28a0c6 upstream.\n\nBy specifying NO_UNION_NORMAL the ACM driver does only use the first two\nUSB interfaces (modem data & control). The AT Port, Diagnostic and NMEA\ninterfaces are left to the USB serial driver.\n\nSigned-off-by: Michael Ulbricht <michael.ulbricht@systec-electronic.com>\nSigned-off-by: Alexander Stein <alexander.stein@systec-electronic.com>\nSigned-off-by: Oliver Neukum <oliver@neukum.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/d7fc1dbb8642dd0d7ae801c44080d929f248242e"},{"sha":"91a85d4d5e073059883459d720e8750b85642011","author":{"email":"2be88ae07a73b8c2a75656d36b1412903f7f78b8@tristanbruns.de","name":"Tristan Bruns"},"message":"USB: cp210x: Add 8281 (Nanotec Plug & Drive)\n\ncommit 72b3007951010ce1bbf950e23b19d9839fa905a5 upstream.\n\nSigned-off-by: Tristan Bruns <tristan@tristanbruns.de>\nSigned-off-by: Johan Hovold <jhovold@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/91a85d4d5e073059883459d720e8750b85642011"},{"sha":"202f1ad30e3ce599397cff11accbe44ceea82de6","author":{"email":"6a430eed381e126d51a8cce8db662f765ce314bc@gmail.com","name":"Johan Hovold"},"message":"Revert \"USB: serial: add usbid for dell wwan card to sierra.c\"\n\ncommit 2e01280d2801c72878cf3a7119eac30077b463d5 upstream.\n\nThis reverts commit 1ebca9dad5abe8b2ed4dbd186cd657fb47c1f321.\n\nThis device was erroneously added to the sierra driver even though it's\nnot a Sierra device and was already handled by the option driver.\n\nCc: Richard Farina <sidhayn@gmail.com>\nSigned-off-by: Johan Hovold <jhovold@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/202f1ad30e3ce599397cff11accbe44ceea82de6"},{"sha":"99162a8c54580f6424d09f4da811cbe0b2b912c4","author":{"email":"6a430eed381e126d51a8cce8db662f765ce314bc@gmail.com","name":"Johan Hovold"},"message":"USB: io_ti: fix firmware download on big-endian machines\n\ncommit 5509076d1b4485ce9fb07705fcbcd2695907ab5b upstream.\n\nDuring firmware download the device expects memory addresses in\nbig-endian byte order. As the wIndex parameter which hold the address is\nsent in little-endian byte order regardless of host byte order, we need\nto use swab16 rather than cpu_to_be16.\n\nAlso make sure to handle the struct ti_i2c_desc size parameter which is\nreturned in little-endian byte order.\n\nReported-by: Ludovic Drolez <ldrolez@debian.org>\nTested-by: Ludovic Drolez <ldrolez@debian.org>\nSigned-off-by: Johan Hovold <jhovold@gmail.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/99162a8c54580f6424d09f4da811cbe0b2b912c4"},{"sha":"4c115d020019077d5f017ca5ed2495a019fbe2fa","author":{"email":"8a2957e0063f2abf61bd145b6236a74a3708ac54@mork.no","name":"Bjørn Mork"},"message":"usb: option: add and update a number of CMOTech devices\n\ncommit 34f972d6156fe9eea2ab7bb418c71f9d1d5c8e7b upstream.\n\nA number of older CMOTech modems are based on Qualcomm\nchips.  The blacklisted interfaces are QMI/wwan.\n\nReported-by: Lars Melin <larsm17@gmail.com>\nSigned-off-by: Bjørn Mork <bjorn@mork.no>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/4c115d020019077d5f017ca5ed2495a019fbe2fa"},{"sha":"331d69e57ee9e844be3910301e48826f033a8c03","author":{"email":"76f728c1c3997bf5bfe7e9261eff720c92409a2f@gmail.com","name":"Christopher Friedt"},"message":"drm/vmwgfx: correct fb_fix_screeninfo.line_length\n\ncommit aa6de142c901cd2d90ef08db30ae87da214bedcc upstream.\n\nPreviously, the vmwgfx_fb driver would allow users to call FBIOSET_VINFO, but it would not adjust\nthe FINFO properly, resulting in distorted screen rendering. The patch corrects that behaviour.\n\nSee https://bugs.gentoo.org/show_bug.cgi?id=494794 for examples.\n\nSigned-off-by: Christopher Friedt <chrisfriedt@gmail.com>\nReviewed-by: Thomas Hellstrom <thellstrom@vmware.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/331d69e57ee9e844be3910301e48826f033a8c03"},{"sha":"6d75d8d86410dddd86747423a9ea29ab74b45afc","author":{"email":"bf84f557a1e54fd62cd73c6847f7d9df60e9fbef@gmail.com","name":"Alex Deucher"},"message":"drm/radeon: call drm_edid_to_eld when we update the edid\n\ncommit 16086279353cbfecbb3ead474072dced17b97ddc upstream.\n\nThis needs to be done to update some of the fields in\nthe connector structure used by the audio code.\n\nNoticed by several users on irc.\n\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Christian König <christian.koenig@amd.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/6d75d8d86410dddd86747423a9ea29ab74b45afc"},{"sha":"e7bcea2f6101c49f976102bd054749529f47702a","author":{"email":"20b70f0af00562e63758b9ee42012ecc96c58590@redhat.com","name":"Oleg Nesterov"},"message":"list: introduce list_next_entry() and list_prev_entry()\n\n[ Upstream commit 008208c6b26f21c2648c250a09c55e737c02c5f8 ]\n\nAdd two trivial helpers list_next_entry() and list_prev_entry(), they\ncan have a lot of users including list.h itself.  In fact the 1st one is\nalready defined in events/core.c and bnx2x_sp.c, so the patch simply\nmoves the definition to list.h.\n\nSigned-off-by: Oleg Nesterov <oleg@redhat.com>\nCc: Eilon Greenstein <eilong@broadcom.com>\nCc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\nCc: Peter Zijlstra <a.p.zijlstra@chello.nl>\nSigned-off-by: Andrew Morton <akpm@linux-foundation.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/e7bcea2f6101c49f976102bd054749529f47702a"},{"sha":"e032862106eee88581bf2c72bdedf2852d5e487e","author":{"email":"9ff04a02a69f376b2b9aeec27187017cbf3cf5f9@redhat.com","name":"Daniel Borkmann"},"message":"net: sctp: wake up all assocs if sndbuf policy is per socket\n\n[ Upstream commit 52c35befb69b005c3fc5afdaae3a5717ad013411 ]\n\nSCTP charges chunks for wmem accounting via skb->truesize in\nsctp_set_owner_w(), and sctp_wfree() respectively as the\nreverse operation. If a sender runs out of wmem, it needs to\nwait via sctp_wait_for_sndbuf(), and gets woken up by a call\nto __sctp_write_space() mostly via sctp_wfree().\n\n__sctp_write_space() is being called per association. Although\nwe assign sk->sk_write_space() to sctp_write_space(), which\nis then being done per socket, it is only used if send space\nis increased per socket option (SO_SNDBUF), as SOCK_USE_WRITE_QUEUE\nis set and therefore not invoked in sock_wfree().\n\nCommit 4c3a5bdae293 (\"sctp: Don't charge for data in sndbuf\nagain when transmitting packet\") fixed an issue where in case\nsctp_packet_transmit() manages to queue up more than sndbuf\nbytes, sctp_wait_for_sndbuf() will never be woken up again\nunless it is interrupted by a signal. However, a still\nremaining issue is that if net.sctp.sndbuf_policy=0, that is\naccounting per socket, and one-to-many sockets are in use,\nthe reclaimed write space from sctp_wfree() is 'unfairly'\nhanded back on the server to the association that is the lucky\none to be woken up again via __sctp_write_space(), while\nthe remaining associations are never be woken up again\n(unless by a signal).\n\nThe effect disappears with net.sctp.sndbuf_policy=1, that\nis wmem accounting per association, as it guarantees a fair\nshare of wmem among associations.\n\nTherefore, if we have reclaimed memory in case of per socket\naccounting, wake all related associations to a socket in a\nfair manner, that is, traverse the socket association list\nstarting from the current neighbour of the association and\nissue a __sctp_write_space() to everyone until we end up\nwaking ourselves. This guarantees that no association is\npreferred over another and even if more associations are\ntaken into the one-to-many session, all receivers will get\nmessages from the server and are not stalled forever on\nhigh load. This setting still leaves the advantage of per\nsocket accounting in touch as an association can still use\nup global limits if unused by others.\n\nFixes: 4eb701dfc618 (\"[SCTP] Fix SCTP sendbuffer accouting.\")\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nCc: Thomas Graf <tgraf@suug.ch>\nCc: Neil Horman <nhorman@tuxdriver.com>\nCc: Vlad Yasevich <vyasevic@redhat.com>\nAcked-by: Vlad Yasevich <vyasevic@redhat.com>\nAcked-by: Neil Horman <nhorman@tuxdriver.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/e032862106eee88581bf2c72bdedf2852d5e487e"},{"sha":"eb2cdcb5b3a594ec4c28f5cd1b8b68641eded7ed","author":{"email":"9ff04a02a69f376b2b9aeec27187017cbf3cf5f9@redhat.com","name":"Daniel Borkmann"},"message":"net: sctp: test if association is dead in sctp_wake_up_waiters\n\n[ Upstream commit 1e1cdf8ac78793e0875465e98a648df64694a8d0 ]\n\nIn function sctp_wake_up_waiters(), we need to involve a test\nif the association is declared dead. If so, we don't have any\nreference to a possible sibling association anymore and need\nto invoke sctp_write_space() instead, and normally walk the\nsocket's associations and notify them of new wmem space. The\nreason for special casing is that otherwise, we could run\ninto the following issue when a sctp_primitive_SEND() call\nfrom sctp_sendmsg() fails, and tries to flush an association's\noutq, i.e. in the following way:\n\nsctp_association_free()\n`-> list_del(&asoc->asocs)         <-- poisons list pointer\n    asoc->base.dead = true\n    sctp_outq_free(&asoc->outqueue)\n    `-> __sctp_outq_teardown()\n     `-> sctp_chunk_free()\n      `-> consume_skb()\n       `-> sctp_wfree()\n        `-> sctp_wake_up_waiters() <-- dereferences poisoned pointers\n                                       if asoc->ep->sndbuf_policy=0\n\nTherefore, only walk the list in an 'optimized' way if we find\nthat the current association is still active. We could also use\nlist_del_init() in addition when we call sctp_association_free(),\nbut as Vlad suggests, we want to trap such bugs and thus leave\nit poisoned as is.\n\nWhy is it safe to resolve the issue by testing for asoc->base.dead?\nParallel calls to sctp_sendmsg() are protected under socket lock,\nthat is lock_sock()/release_sock(). Only within that path under\nlock held, we're setting skb/chunk owner via sctp_set_owner_w().\nEventually, chunks are freed directly by an association still\nunder that lock. So when traversing association list on destruction\ntime from sctp_wake_up_waiters() via sctp_wfree(), a different\nCPU can't be running sctp_wfree() while another one calls\nsctp_association_free() as both happens under the same lock.\nTherefore, this can also not race with setting/testing against\nasoc->base.dead as we are guaranteed for this to happen in order,\nunder lock. Further, Vlad says: the times we check asoc->base.dead\nis when we've cached an association pointer for later processing.\nIn between cache and processing, the association may have been\nfreed and is simply still around due to reference counts. We check\nasoc->base.dead under a lock, so it should always be safe to check\nand not race against sctp_association_free(). Stress-testing seems\nfine now, too.\n\nFixes: cd253f9f357d (\"net: sctp: wake up all assocs if sndbuf policy is per socket\")\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nCc: Vlad Yasevich <vyasevic@redhat.com>\nAcked-by: Neil Horman <nhorman@tuxdriver.com>\nAcked-by: Vlad Yasevich <vyasevic@redhat.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/eb2cdcb5b3a594ec4c28f5cd1b8b68641eded7ed"},{"sha":"6f422ec54c35b6380aacd31a520e17c420f6c943","author":{"email":"69f647420f51f633e6995091b80be9c4b4165b2b@gmail.com","name":"Dmitry Petukhov"},"message":"l2tp: take PMTU from tunnel UDP socket\n\n[ Upstream commit f34c4a35d87949fbb0e0f31eba3c054e9f8199ba ]\n\nWhen l2tp driver tries to get PMTU for the tunnel destination, it uses\nthe pointer to struct sock that represents PPPoX socket, while it\nshould use the pointer that represents UDP socket of the tunnel.\n\nSigned-off-by: Dmitry Petukhov <dmgenp@gmail.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/RolanDroid/MonsterKernel/commits/6f422ec54c35b6380aacd31a520e17c420f6c943"}]}