{"push_id":856587191,"size":10,"distinct_size":10,"ref":"refs/heads/master","head":"b053d6745e3e53c18da444ace62641b2324a4402","before":"4ecd5c10e3293f5a1a2de7e0f820ffbf6afe8b4e","commits":[{"sha":"745639adb0709a570a428f2eb55adf425bcf4c25","author":{"email":"cf8250ffc3403545b26ea448b3679e86cf72a9df@outlook.com","name":"SandPox"},"message":"ipvs: fix oops in ip_vs_dst_event on rmmod\ncommit 283283c4da91adc44b03519f434ee1e7e91d6fdb upstream.\n\nAfter commit 39f618b4fd95ae243d940ec64c961009c74e3333 (3.4)\n\"ipvs: reset ipvs pointer in netns\" we can oops in\nip_vs_dst_event on rmmod ip_vs because ip_vs_control_cleanup\nis called after the ipvs_core_ops subsys is unregistered and\nnet->ipvs is NULL. Fix it by exiting early from ip_vs_dst_event\nif ipvs is NULL. It is safe because all services and dests\nfor the net are already freed.\n\nSigned-off-by: Julian Anastasov <ja@ssi.bg>\nSigned-off-by: Simon Horman <horms@verge.net.au>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nAcked-by: David Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/SandPox/android_kernel_samsung_kyleproxx/commits/745639adb0709a570a428f2eb55adf425bcf4c25"},{"sha":"316fa8fedff5d40ea9b725071f176e08aef6d12d","author":{"email":"cf8250ffc3403545b26ea448b3679e86cf72a9df@outlook.com","name":"SandPox"},"message":"netfilter: nf_conntrack: fix racy timer handling with reliable events\ncommit 5b423f6a40a0327f9d40bc8b97ce9be266f74368 upstream.\n\nExisting code assumes that del_timer returns true for alive conntrack\nentries. However, this is not true if reliable events are enabled.\nIn that case, del_timer may return true for entries that were\njust inserted in the dying list. Note that packets / ctnetlink may\nhold references to conntrack entries that were just inserted to such\nlist.\n\nThis patch fixes the issue by adding an independent timer for\nevent delivery. This increases the size of the ecache extension.\nStill we can revisit this later and use variable size extensions\nto allocate this area on demand.\n\nTested-by: Oliver Smith <olipro@8.c.9.b.0.7.4.0.1.0.0.2.ip6.arpa>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nAcked-by: David Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/SandPox/android_kernel_samsung_kyleproxx/commits/316fa8fedff5d40ea9b725071f176e08aef6d12d"},{"sha":"e76b3919fe4b3acb8ee8961a37c37c6333d4d95d","author":{"email":"cf8250ffc3403545b26ea448b3679e86cf72a9df@outlook.com","name":"SandPox"},"message":"netfilter: ipset: fix timeout value overflow bug\ncommit 127f559127f5175e4bec3dab725a34845d956591 upstream.\n\nLarge timeout parameters could result wrong timeout values due to\nan overflow at msec to jiffies conversion (reported by Andreas Herz)\n\n[ This patch was mangled by Pablo Neira Ayuso since David Laight and\n  Eric Dumazet noticed that we were using hardcoded 1000 instead of\n  MSEC_PER_SEC to calculate the timeout ]\n\nSigned-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nAcked-by: David Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/SandPox/android_kernel_samsung_kyleproxx/commits/e76b3919fe4b3acb8ee8961a37c37c6333d4d95d"},{"sha":"51ad091f0fae10ac9e75558fb3b46f8fc1573973","author":{"email":"cf8250ffc3403545b26ea448b3679e86cf72a9df@outlook.com","name":"SandPox"},"message":"netfilter: ipset: timeout fixing bug broke SET target special timeout value\ncommit a73f89a61f92b364f0b4a3be412b5b70553afc23 upstream.\n\nThe patch \"127f559 netfilter: ipset: fix timeout value overflow bug\"\nbroke the SET target when no timeout was specified.\n\nReported-by: Jean-Philippe Menil <jean-philippe.menil@univ-nantes.fr>\nSigned-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nAcked-by: David Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/SandPox/android_kernel_samsung_kyleproxx/commits/51ad091f0fae10ac9e75558fb3b46f8fc1573973"},{"sha":"40e77a637408db5ecb0833fd4987c3d1e9b368fa","author":{"email":"cf8250ffc3403545b26ea448b3679e86cf72a9df@outlook.com","name":"SandPox"},"message":"ipvs: fix oops on NAT reply in br_nf context\ncommit 9e33ce453f8ac8452649802bee1f410319408f4b upstream.\n\nIPVS should not reset skb->nf_bridge in FORWARD hook\nby calling nf_reset for NAT replies. It triggers oops in\nbr_nf_forward_finish.\n\n[  579.781508] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004\n[  579.781669] IP: [<ffffffff817b1ca5>] br_nf_forward_finish+0x58/0x112\n[  579.781792] PGD 218f9067 PUD 0\n[  579.781865] Oops: 0000 [#1] SMP\n[  579.781945] CPU 0\n[  579.781983] Modules linked in:\n[  579.782047]\n[  579.782080]\n[  579.782114] Pid: 4644, comm: qemu Tainted: G        W    3.5.0-rc5-00006-g95e69f9 #282 Hewlett-Packard  /30E8\n[  579.782300] RIP: 0010:[<ffffffff817b1ca5>]  [<ffffffff817b1ca5>] br_nf_forward_finish+0x58/0x112\n[  579.782455] RSP: 0018:ffff88007b003a98  EFLAGS: 00010287\n[  579.782541] RAX: 0000000000000008 RBX: ffff8800762ead00 RCX: 000000000001670a\n[  579.782653] RDX: 0000000000000000 RSI: 000000000000000a RDI: ffff8800762ead00\n[  579.782845] RBP: ffff88007b003ac8 R08: 0000000000016630 R09: ffff88007b003a90\n[  579.782957] R10: ffff88007b0038e8 R11: ffff88002da37540 R12: ffff88002da01a02\n[  579.783066] R13: ffff88002da01a80 R14: ffff88002d83c000 R15: ffff88002d82a000\n[  579.783177] FS:  0000000000000000(0000) GS:ffff88007b000000(0063) knlGS:00000000f62d1b70\n[  579.783306] CS:  0010 DS: 002b ES: 002b CR0: 000000008005003b\n[  579.783395] CR2: 0000000000000004 CR3: 00000000218fe000 CR4: 00000000000027f0\n[  579.783505] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  579.783684] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n[  579.783795] Process qemu (pid: 4644, threadinfo ffff880021b20000, task ffff880021aba760)\n[  579.783919] Stack:\n[  579.783959]  ffff88007693cedc ffff8800762ead00 ffff88002da01a02 ffff8800762ead00\n[  579.784110]  ffff88002da01a02 ffff88002da01a80 ffff88007b003b18 ffffffff817b26c7\n[  579.784260]  ffff880080000000 ffffffff81ef59f0 ffff8800762ead00 ffffffff81ef58b0\n[  579.784477] Call Trace:\n[  579.784523]  <IRQ>\n[  579.784562]\n[  579.784603]  [<ffffffff817b26c7>] br_nf_forward_ip+0x275/0x2c8\n[  579.784707]  [<ffffffff81704b58>] nf_iterate+0x47/0x7d\n[  579.784797]  [<ffffffff817ac32e>] ? br_dev_queue_push_xmit+0xae/0xae\n[  579.784906]  [<ffffffff81704bfb>] nf_hook_slow+0x6d/0x102\n[  579.784995]  [<ffffffff817ac32e>] ? br_dev_queue_push_xmit+0xae/0xae\n[  579.785175]  [<ffffffff8187fa95>] ? _raw_write_unlock_bh+0x19/0x1b\n[  579.785179]  [<ffffffff817ac417>] __br_forward+0x97/0xa2\n[  579.785179]  [<ffffffff817ad366>] br_handle_frame_finish+0x1a6/0x257\n[  579.785179]  [<ffffffff817b2386>] br_nf_pre_routing_finish+0x26d/0x2cb\n[  579.785179]  [<ffffffff817b2cf0>] br_nf_pre_routing+0x55d/0x5c1\n[  579.785179]  [<ffffffff81704b58>] nf_iterate+0x47/0x7d\n[  579.785179]  [<ffffffff817ad1c0>] ? br_handle_local_finish+0x44/0x44\n[  579.785179]  [<ffffffff81704bfb>] nf_hook_slow+0x6d/0x102\n[  579.785179]  [<ffffffff817ad1c0>] ? br_handle_local_finish+0x44/0x44\n[  579.785179]  [<ffffffff81551525>] ? sky2_poll+0xb35/0xb54\n[  579.785179]  [<ffffffff817ad62a>] br_handle_frame+0x213/0x229\n[  579.785179]  [<ffffffff817ad417>] ? br_handle_frame_finish+0x257/0x257\n[  579.785179]  [<ffffffff816e3b47>] __netif_receive_skb+0x2b4/0x3f1\n[  579.785179]  [<ffffffff816e69fc>] process_backlog+0x99/0x1e2\n[  579.785179]  [<ffffffff816e6800>] net_rx_action+0xdf/0x242\n[  579.785179]  [<ffffffff8107e8a8>] __do_softirq+0xc1/0x1e0\n[  579.785179]  [<ffffffff8135a5ba>] ? trace_hardirqs_off_thunk+0x3a/0x6c\n[  579.785179]  [<ffffffff8188812c>] call_softirq+0x1c/0x30\n\nThe steps to reproduce as follow,\n\n1. On Host1, setup brige br0(192.168.1.106)\n2. Boot a kvm guest(192.168.1.105) on Host1 and start httpd\n3. Start IPVS service on Host1\n   ipvsadm -A -t 192.168.1.106:80 -s rr\n   ipvsadm -a -t 192.168.1.106:80 -r 192.168.1.105:80 -m\n4. Run apache benchmark on Host2(192.168.1.101)\n   ab -n 1000 http://192.168.1.106/\n\nip_vs_reply4\n  ip_vs_out\n    handle_response\n      ip_vs_notrack\n        nf_reset()\n        {\n          skb->nf_bridge = NULL;\n        }\n\nActually, IPVS wants in this case just to replace nfct\nwith untracked version. So replace the nf_reset(skb) call\nin ip_vs_notrack() with a nf_conntrack_put(skb->nfct) call.\n\nSigned-off-by: Lin Ming <mlin@ss.pku.edu.cn>\nSigned-off-by: Julian Anastasov <ja@ssi.bg>\nSigned-off-by: Simon Horman <horms@verge.net.au>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nAcked-by: David Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/SandPox/android_kernel_samsung_kyleproxx/commits/40e77a637408db5ecb0833fd4987c3d1e9b368fa"},{"sha":"b1ed6fbbe1fffaf2230d724295af2873913d739f","author":{"email":"cf8250ffc3403545b26ea448b3679e86cf72a9df@outlook.com","name":"SandPox"},"message":"netfilter: nf_nat_sip: fix incorrect handling of EBUSY for RTCP expectation\ncommit 3f509c689a07a4aa989b426893d8491a7ffcc410 upstream.\n\nWe're hitting bug while trying to reinsert an already existing\nexpectation:\n\nkernel BUG at kernel/timer.c:895!\ninvalid opcode: 0000 [#1] SMP\n[...]\nCall Trace:\n <IRQ>\n [<ffffffffa0069563>] nf_ct_expect_related_report+0x4a0/0x57a [nf_conntrack]\n [<ffffffff812d423a>] ? in4_pton+0x72/0x131\n [<ffffffffa00ca69e>] ip_nat_sdp_media+0xeb/0x185 [nf_nat_sip]\n [<ffffffffa00b5b9b>] set_expected_rtp_rtcp+0x32d/0x39b [nf_conntrack_sip]\n [<ffffffffa00b5f15>] process_sdp+0x30c/0x3ec [nf_conntrack_sip]\n [<ffffffff8103f1eb>] ? irq_exit+0x9a/0x9c\n [<ffffffffa00ca738>] ? ip_nat_sdp_media+0x185/0x185 [nf_nat_sip]\n\nWe have to remove the RTP expectation if the RTCP expectation hits EBUSY\nsince we keep trying with other ports until we succeed.\n\nReported-by: Rafal Fitt <rafalf@aplusc.com.pl>\nAcked-by: David Miller <davem@davemloft.net>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/SandPox/android_kernel_samsung_kyleproxx/commits/b1ed6fbbe1fffaf2230d724295af2873913d739f"},{"sha":"c228ff1355628a2ac064b9f7b34d894a57a44dac","author":{"email":"cf8250ffc3403545b26ea448b3679e86cf72a9df@outlook.com","name":"SandPox"},"message":"netfilter: nf_nat_sip: fix via header translation with multiple parameters\ncommit f22eb25cf5b1157b29ef88c793b71972efc47143 upstream.\n\nVia-headers are parsed beginning at the first character after the Via-address.\nWhen the address is translated first and its length decreases, the offset to\nstart parsing at is incorrect and header parameters might be missed.\n\nUpdate the offset after translating the Via-address to fix this.\n\nSigned-off-by: Patrick McHardy <kaber@trash.net>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nAcked-by: David Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/SandPox/android_kernel_samsung_kyleproxx/commits/c228ff1355628a2ac064b9f7b34d894a57a44dac"},{"sha":"71881bb7499408b7ad810549042c8b3780286c26","author":{"email":"cf8250ffc3403545b26ea448b3679e86cf72a9df@outlook.com","name":"SandPox"},"message":"netfilter: nf_ct_expect: fix possible access to uninitialized timer\ncommit 2614f86490122bf51eb7c12ec73927f1900f4e7d upstream.\n\nIn __nf_ct_expect_check, the function refresh_timer returns 1\nif a matching expectation is found and its timer is successfully\nrefreshed. This results in nf_ct_expect_related returning 0.\nNote that at this point:\n\n- the passed expectation is not inserted in the expectation table\n  and its timer was not initialized, since we have refreshed one\n  matching/existing expectation.\n\n- nf_ct_expect_alloc uses kmem_cache_alloc, so the expectation\n  timer is in some undefined state just after the allocation,\n  until it is appropriately initialized.\n\nThis can be a problem for the SIP helper during the expectation\naddition:\n\n ...\n if (nf_ct_expect_related(rtp_exp) == 0) {\n         if (nf_ct_expect_related(rtcp_exp) != 0)\n                 nf_ct_unexpect_related(rtp_exp);\n ...\n\nNote that nf_ct_expect_related(rtp_exp) may return 0 for the timer refresh\ncase that is detailed above. Then, if nf_ct_unexpect_related(rtcp_exp)\nreturns != 0, nf_ct_unexpect_related(rtp_exp) is called, which does:\n\n spin_lock_bh(&nf_conntrack_lock);\n if (del_timer(&exp->timeout)) {\n         nf_ct_unlink_expect(exp);\n         nf_ct_expect_put(exp);\n }\n spin_unlock_bh(&nf_conntrack_lock);\n\nNote that del_timer always returns false if the timer has been\ninitialized.  However, the timer was not initialized since setup_timer\nwas not called, therefore, the expectation timer remains in some\nundefined state. If I'm not missing anything, this may lead to the\nremoval an unexistent expectation.\n\nTo fix this, the optimization that allows refreshing an expectation\nis removed. Now nf_conntrack_expect_related looks more consistent\nto me since it always add the expectation in case that it returns\nsuccess.\n\nThanks to Patrick McHardy for participating in the discussion of\nthis patch.\n\nI think this may be the source of the problem described by:\nhttp://marc.info/?l=netfilter-devel&m=134073514719421&w=2\n\nReported-by: Rafal Fitt <rafalf@aplusc.com.pl>\nAcked-by: Patrick McHardy <kaber@trash.net>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nAcked-by: David Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/SandPox/android_kernel_samsung_kyleproxx/commits/71881bb7499408b7ad810549042c8b3780286c26"},{"sha":"49e57ec40cc366bf9eb82c892d227ba0c165e0c8","author":{"email":"cf8250ffc3403545b26ea448b3679e86cf72a9df@outlook.com","name":"SandPox"},"message":"netfilter: limit, hashlimit: avoid duplicated inline\ncommit 7a909ac70f6b0823d9f23a43f19598d4b57ac901 upstream.\n\ncredit_cap can be set to credit, which avoids inlining user2credits\ntwice. Also, remove inline keyword and let compiler decide.\n\nold:\n    684     192       0     876     36c net/netfilter/xt_limit.o\n   4927     344      32    5303    14b7 net/netfilter/xt_hashlimit.o\nnow:\n    668     192       0     860     35c net/netfilter/xt_limit.o\n   4793     344      32    5169    1431 net/netfilter/xt_hashlimit.o\n\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nAcked-by: David Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/SandPox/android_kernel_samsung_kyleproxx/commits/49e57ec40cc366bf9eb82c892d227ba0c165e0c8"},{"sha":"b053d6745e3e53c18da444ace62641b2324a4402","author":{"email":"cf8250ffc3403545b26ea448b3679e86cf72a9df@outlook.com","name":"SandPox"},"message":"netfilter: xt_limit: have r->cost != 0 case work\ncommit 82e6bfe2fbc4d48852114c4f979137cd5bf1d1a8 upstream.\n\nCommit v2.6.19-rc1~1272^2~41 tells us that r->cost != 0 can happen when\na running state is saved to userspace and then reinstated from there.\n\nMake sure that private xt_limit area is initialized with correct values.\nOtherwise, random matchings due to use of uninitialized memory.\n\nSigned-off-by: Jan Engelhardt <jengelh@inai.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nAcked-by: David Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/SandPox/android_kernel_samsung_kyleproxx/commits/b053d6745e3e53c18da444ace62641b2324a4402"}]}