From: Pi-Hsun Shih <pihsun(a)chromium.org>
commit 6989310f5d4327e8595664954edd40a7f99ddd0d upstream.
Use offsetof to calculate offset of a field to take advantage of
compiler built-in version when possible, and avoid UBSAN warning when
compiling with Clang:
==================================================================
UBSAN: Undefined behaviour in net/wireless/wext-core.c:525:14
member access within null pointer of type 'struct iw_point'
CPU: 3 PID: 165 Comm: kworker/u16:3 Tainted: G S W 4.19.23 #43
Workqueue: cfg80211 __cfg80211_scan_done [cfg80211]
Call trace:
dump_backtrace+0x0/0x194
show_stack+0x20/0x2c
__dump_stack+0x20/0x28
dump_stack+0x70/0x94
ubsan_epilogue+0x14/0x44
ubsan_type_mismatch_common+0xf4/0xfc
__ubsan_handle_type_mismatch_v1+0x34/0x54
wireless_send_event+0x3cc/0x470
___cfg80211_scan_done+0x13c/0x220 [cfg80211]
__cfg80211_scan_done+0x28/0x34 [cfg80211]
process_one_work+0x170/0x35c
worker_thread+0x254/0x380
kthread+0x13c/0x158
ret_from_fork+0x10/0x18
===================================================================
Signed-off-by: Pi-Hsun Shih <pihsun(a)chromium.org>
Reviewed-by: Nick Desaulniers <ndesaulniers(a)google.com>
Link: https://lore.kernel.org/r/20191204081307.138765-1-pihsun@chromium.org
Signed-off-by: Johannes Berg <johannes.berg(a)intel.com>
Signed-off-by: Nick Desaulniers <ndesaulniers(a)google.com>
---
Fix landed in v5.7-rc1. Thanks to James Hsu of MediaTek for the report.
include/uapi/linux/wireless.h | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/wireless.h b/include/uapi/linux/wireless.h
index 86eca3208b6b..a2c006a364e0 100644
--- a/include/uapi/linux/wireless.h
+++ b/include/uapi/linux/wireless.h
@@ -74,6 +74,8 @@
#include <linux/socket.h> /* for "struct sockaddr" et al */
#include <linux/if.h> /* for IFNAMSIZ and co... */
+#include <stddef.h> /* for offsetof */
+
/***************************** VERSION *****************************/
/*
* This constant is used to know the availability of the wireless
@@ -1090,8 +1092,7 @@ struct iw_event {
/* iw_point events are special. First, the payload (extra data) come at
* the end of the event, so they are bigger than IW_EV_POINT_LEN. Second,
* we omit the pointer, so start at an offset. */
-#define IW_EV_POINT_OFF (((char *) &(((struct iw_point *) NULL)->length)) - \
- (char *) NULL)
+#define IW_EV_POINT_OFF offsetof(struct iw_point, length)
#define IW_EV_POINT_LEN (IW_EV_LCP_LEN + sizeof(struct iw_point) - \
IW_EV_POINT_OFF)
--
2.28.0.163.g6104cc2f0b6-goog
The patch titled
Subject: cma: don't quit at first error when activating reserved areas
has been added to the -mm tree. Its filename is
cma-dont-quit-at-first-error-when-activating-reserved-areas.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/cma-dont-quit-at-first-error-when-…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/cma-dont-quit-at-first-error-when-…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Mike Kravetz <mike.kravetz(a)oracle.com>
Subject: cma: don't quit at first error when activating reserved areas
The routine cma_init_reserved_areas is designed to activate all
reserved cma areas. It quits when it first encounters an error.
This can leave some areas in a state where they are reserved but
not activated. There is no feedback to code which performed the
reservation. Attempting to allocate memory from areas in such a
state will result in a BUG.
Modify cma_init_reserved_areas to always attempt to activate all
areas. The called routine, cma_activate_area is responsible for
leaving the area in a valid state. No one is making active use
of returned error codes, so change the routine to void.
How to reproduce: This example uses kernelcore, hugetlb and cma
as an easy way to reproduce. However, this is a more general cma
issue.
Two node x86 VM 16GB total, 8GB per node
Kernel command line parameters, kernelcore=4G hugetlb_cma=8G
Related boot time messages,
hugetlb_cma: reserve 8192 MiB, up to 4096 MiB per node
cma: Reserved 4096 MiB at 0x0000000100000000
hugetlb_cma: reserved 4096 MiB on node 0
cma: Reserved 4096 MiB at 0x0000000300000000
hugetlb_cma: reserved 4096 MiB on node 1
cma: CMA area hugetlb could not be activated
# echo 8 > /sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] SMP PTI
...
Call Trace:
bitmap_find_next_zero_area_off+0x51/0x90
cma_alloc+0x1a5/0x310
alloc_fresh_huge_page+0x78/0x1a0
alloc_pool_huge_page+0x6f/0xf0
set_max_huge_pages+0x10c/0x250
nr_hugepages_store_common+0x92/0x120
? __kmalloc+0x171/0x270
kernfs_fop_write+0xc1/0x1a0
vfs_write+0xc7/0x1f0
ksys_write+0x5f/0xe0
do_syscall_64+0x4d/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Link: http://lkml.kernel.org/r/20200730163123.6451-1-mike.kravetz@oracle.com
Fixes: c64be2bb1c6e ("drivers: add Contiguous Memory Allocator")
Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Reviewed-by: Roman Gushchin <guro(a)fb.com>
Acked-by: Barry Song <song.bao.hua(a)hisilicon.com>
Cc: Marek Szyprowski <m.szyprowski(a)samsung.com>
Cc: Michal Nazarewicz <mina86(a)mina86.com>
Cc: Kyungmin Park <kyungmin.park(a)samsung.com>
Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/cma.c | 23 +++++++++--------------
1 file changed, 9 insertions(+), 14 deletions(-)
--- a/mm/cma.c~cma-dont-quit-at-first-error-when-activating-reserved-areas
+++ a/mm/cma.c
@@ -93,17 +93,15 @@ static void cma_clear_bitmap(struct cma
mutex_unlock(&cma->lock);
}
-static int __init cma_activate_area(struct cma *cma)
+static void __init cma_activate_area(struct cma *cma)
{
unsigned long base_pfn = cma->base_pfn, pfn = base_pfn;
unsigned i = cma->count >> pageblock_order;
struct zone *zone;
cma->bitmap = bitmap_zalloc(cma_bitmap_maxno(cma), GFP_KERNEL);
- if (!cma->bitmap) {
- cma->count = 0;
- return -ENOMEM;
- }
+ if (!cma->bitmap)
+ goto out_error;
WARN_ON_ONCE(!pfn_valid(pfn));
zone = page_zone(pfn_to_page(pfn));
@@ -133,25 +131,22 @@ static int __init cma_activate_area(stru
spin_lock_init(&cma->mem_head_lock);
#endif
- return 0;
+ return;
not_in_zone:
- pr_err("CMA area %s could not be activated\n", cma->name);
bitmap_free(cma->bitmap);
+out_error:
cma->count = 0;
- return -EINVAL;
+ pr_err("CMA area %s could not be activated\n", cma->name);
+ return;
}
static int __init cma_init_reserved_areas(void)
{
int i;
- for (i = 0; i < cma_area_count; i++) {
- int ret = cma_activate_area(&cma_areas[i]);
-
- if (ret)
- return ret;
- }
+ for (i = 0; i < cma_area_count; i++)
+ cma_activate_area(&cma_areas[i]);
return 0;
}
_
Patches currently in -mm which might be from mike.kravetz(a)oracle.com are
hugetlbfs-prevent-filesystem-stacking-of-hugetlbfs.patch
cma-dont-quit-at-first-error-when-activating-reserved-areas.patch
The patch titled
Subject: mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible
has been added to the -mm tree. Its filename is
mm-hugetlb-fix-calculation-of-adjust_range_if_pmd_sharing_possible.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-hugetlb-fix-calculation-of-adju…
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-hugetlb-fix-calculation-of-adju…
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Peter Xu <peterx(a)redhat.com>
Subject: mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible
This is found by code observation only.
Firstly, the worst case scenario should assume the whole range was covered
by pmd sharing. The old algorithm might not work as expected for ranges
like (1g-2m, 1g+2m), where the adjusted range should be (0, 1g+2m) but the
expected range should be (0, 2g).
Since at it, remove the loop since it should not be required. With that,
the new code should be faster too when the invalidating range is huge.
Mike said:
: With range (1g-2m, 1g+2m) within a vma (0, 2g) the existing code will only
: adjust to (0, 1g+2m) which is incorrect.
:
: We should cc stable. The original reason for adjusting the range was to
: prevent data corruption (getting wrong page). Since the range is not
: always adjusted correctly, the potential for corruption still exists.
:
: However, I am fairly confident that adjust_range_if_pmd_sharing_possible
: is only gong to be called in two cases:
:
: 1) for a single page
: 2) for range == entire vma
:
: In those cases, the current code should produce the correct results.
:
: To be safe, let's just cc stable.
Link: http://lkml.kernel.org/r/20200730201636.74778-1-peterx@redhat.com
Fixes: 017b1660df89 ("mm: migration: fix migration of huge PMD shared pages")
Signed-off-by: Peter Xu <peterx(a)redhat.com>
Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: Andrea Arcangeli <aarcange(a)redhat.com>
Cc: Matthew Wilcox <willy(a)infradead.org>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
mm/hugetlb.c | 24 ++++++++++--------------
1 file changed, 10 insertions(+), 14 deletions(-)
--- a/mm/hugetlb.c~mm-hugetlb-fix-calculation-of-adjust_range_if_pmd_sharing_possible
+++ a/mm/hugetlb.c
@@ -5314,25 +5314,21 @@ static bool vma_shareable(struct vm_area
void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma,
unsigned long *start, unsigned long *end)
{
- unsigned long check_addr;
+ unsigned long a_start, a_end;
if (!(vma->vm_flags & VM_MAYSHARE))
return;
- for (check_addr = *start; check_addr < *end; check_addr += PUD_SIZE) {
- unsigned long a_start = check_addr & PUD_MASK;
- unsigned long a_end = a_start + PUD_SIZE;
+ /* Extend the range to be PUD aligned for a worst case scenario */
+ a_start = ALIGN_DOWN(*start, PUD_SIZE);
+ a_end = ALIGN(*end, PUD_SIZE);
- /*
- * If sharing is possible, adjust start/end if necessary.
- */
- if (range_in_vma(vma, a_start, a_end)) {
- if (a_start < *start)
- *start = a_start;
- if (a_end > *end)
- *end = a_end;
- }
- }
+ /*
+ * Intersect the range with the vma range, since pmd sharing won't be
+ * across vma after all
+ */
+ *start = max(vma->vm_start, a_start);
+ *end = min(vma->vm_end, a_end);
}
/*
_
Patches currently in -mm which might be from peterx(a)redhat.com are
mm-hugetlb-fix-calculation-of-adjust_range_if_pmd_sharing_possible.patch
mm-do-page-fault-accounting-in-handle_mm_fault.patch
mm-alpha-use-general-page-fault-accounting.patch
mm-arc-use-general-page-fault-accounting.patch
mm-arm-use-general-page-fault-accounting.patch
mm-arm64-use-general-page-fault-accounting.patch
mm-csky-use-general-page-fault-accounting.patch
mm-hexagon-use-general-page-fault-accounting.patch
mm-ia64-use-general-page-fault-accounting.patch
mm-m68k-use-general-page-fault-accounting.patch
mm-microblaze-use-general-page-fault-accounting.patch
mm-mips-use-general-page-fault-accounting.patch
mm-nds32-use-general-page-fault-accounting.patch
mm-nios2-use-general-page-fault-accounting.patch
mm-openrisc-use-general-page-fault-accounting.patch
mm-parisc-use-general-page-fault-accounting.patch
mm-powerpc-use-general-page-fault-accounting.patch
mm-riscv-use-general-page-fault-accounting.patch
mm-s390-use-general-page-fault-accounting.patch
mm-sh-use-general-page-fault-accounting.patch
mm-sparc32-use-general-page-fault-accounting.patch
mm-sparc64-use-general-page-fault-accounting.patch
mm-x86-use-general-page-fault-accounting.patch
mm-xtensa-use-general-page-fault-accounting.patch
mm-clean-up-the-last-pieces-of-page-fault-accountings.patch
mm-gup-remove-task_struct-pointer-for-all-gup-code.patch
I'm announcing the release of the 5.7.12 kernel.
All users of the 5.7 kernel series must upgrade.
The updated 5.7.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.7.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 -
drivers/base/regmap/regmap-debugfs.c | 6 ++++
drivers/net/wan/x25_asy.c | 21 ++++++++++-----
fs/io_uring.c | 47 +++++++++++++++++++----------------
include/linux/tcp.h | 4 ++
net/ax25/af_ax25.c | 10 +++++--
net/core/dev.c | 2 -
net/core/net-sysfs.c | 2 -
net/core/rtnetlink.c | 3 +-
net/core/sock_reuseport.c | 1
net/ipv4/tcp_input.c | 11 ++++----
net/ipv4/tcp_output.c | 13 +++++----
net/ipv4/udp.c | 17 +++++++-----
net/ipv6/ip6_gre.c | 11 ++++----
net/ipv6/udp.c | 17 +++++++-----
net/qrtr/qrtr.c | 1
net/rxrpc/recvmsg.c | 2 -
net/rxrpc/sendmsg.c | 2 -
net/sched/act_ct.c | 16 ++++++++++-
net/sctp/stream.c | 27 +++++++++++++-------
net/tipc/link.c | 2 -
21 files changed, 139 insertions(+), 78 deletions(-)
Cong Wang (1):
qrtr: orphan socket in qrtr_release()
Dan Carpenter (1):
AX.25: Prevent integer overflows in connect and sendmsg
David Howells (1):
rxrpc: Fix sendmsg() returning EPIPE due to recvmsg() returning ENODATA
Greg Kroah-Hartman (1):
Linux 5.7.12
Jens Axboe (1):
io_uring: ensure double poll additions work with both request types
Kuniyuki Iwashima (2):
udp: Copy has_conns in reuseport_grow().
udp: Improve load balancing for SO_REUSEPORT.
Miaohe Lin (1):
net: udp: Fix wrong clean up for IS_UDPLITE macro
Peilin Ye (2):
AX.25: Fix out-of-bounds read in ax25_connect()
AX.25: Prevent out-of-bounds read in ax25_sendmsg()
Peng Fan (1):
regmap: debugfs: check count when read regmap file
Subash Abhinov Kasiviswanathan (1):
dev: Defer free of skbs in flush_backlog
Tung Nguyen (1):
tipc: allow to build NACK message in link timeout function
Wei Yongjun (1):
ip6_gre: fix null-ptr-deref in ip6gre_init_net()
Weilong Chen (1):
rtnetlink: Fix memory(net_device) leak when ->newlink fails
Xie He (1):
drivers/net/wan/x25_asy: Fix to make it work
Xin Long (2):
sctp: shrink stream outq only when new outcnt < old outcnt
sctp: shrink stream outq when fails to do addstream reconf
Xiongfeng Wang (1):
net-sysfs: add a newline when printing 'tx_timeout' by sysfs
Yuchung Cheng (1):
tcp: allow at most one TLP probe per flight
wenxu (1):
net/sched: act_ct: fix restore the qdisc_skb_cb after defrag
I'm announcing the release of the 5.4.55 kernel.
All users of the 5.4 kernel series must upgrade.
The updated 5.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 -
drivers/base/power/wakeup.c | 3 ++
drivers/base/regmap/regmap-debugfs.c | 6 +++++
drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 2 -
drivers/net/wan/x25_asy.c | 21 ++++++++++++-------
include/linux/tcp.h | 4 ++-
net/ax25/af_ax25.c | 10 +++++++--
net/core/dev.c | 2 -
net/core/net-sysfs.c | 2 -
net/core/rtnetlink.c | 3 +-
net/core/sock_reuseport.c | 1
net/ipv4/tcp_input.c | 11 +++++-----
net/ipv4/tcp_output.c | 13 +++++++-----
net/ipv4/udp.c | 17 +++++++++------
net/ipv6/ip6_gre.c | 11 +++++-----
net/ipv6/udp.c | 17 +++++++++------
net/qrtr/qrtr.c | 1
net/rxrpc/recvmsg.c | 2 -
net/rxrpc/sendmsg.c | 2 -
net/sctp/stream.c | 27 ++++++++++++++++---------
20 files changed, 102 insertions(+), 55 deletions(-)
Cong Wang (1):
qrtr: orphan socket in qrtr_release()
Dan Carpenter (1):
AX.25: Prevent integer overflows in connect and sendmsg
David Howells (1):
rxrpc: Fix sendmsg() returning EPIPE due to recvmsg() returning ENODATA
Greg Kroah-Hartman (1):
Linux 5.4.55
Kuniyuki Iwashima (2):
udp: Copy has_conns in reuseport_grow().
udp: Improve load balancing for SO_REUSEPORT.
Miaohe Lin (1):
net: udp: Fix wrong clean up for IS_UDPLITE macro
Peilin Ye (2):
AX.25: Fix out-of-bounds read in ax25_connect()
AX.25: Prevent out-of-bounds read in ax25_sendmsg()
Peng Fan (1):
regmap: debugfs: check count when read regmap file
Subash Abhinov Kasiviswanathan (1):
dev: Defer free of skbs in flush_backlog
Vladimir Oltean (1):
Revert "dpaa_eth: fix usage as DSA master, try 3"
Wei Yongjun (1):
ip6_gre: fix null-ptr-deref in ip6gre_init_net()
Weilong Chen (1):
rtnetlink: Fix memory(net_device) leak when ->newlink fails
Xie He (1):
drivers/net/wan/x25_asy: Fix to make it work
Xin Long (2):
sctp: shrink stream outq only when new outcnt < old outcnt
sctp: shrink stream outq when fails to do addstream reconf
Xiongfeng Wang (1):
net-sysfs: add a newline when printing 'tx_timeout' by sysfs
Yuchung Cheng (1):
tcp: allow at most one TLP probe per flight
zhuguangqing (1):
PM: wakeup: Show statistics for deleted wakeup sources again
I'm announcing the release of the 4.19.136 kernel.
All users of the 4.19 kernel series must upgrade.
The updated 4.19.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
drivers/base/regmap/regmap-debugfs.c | 6 ++++++
drivers/net/wan/x25_asy.c | 21 ++++++++++++++-------
include/linux/tcp.h | 4 +++-
net/ax25/af_ax25.c | 10 ++++++++--
net/core/dev.c | 2 +-
net/core/net-sysfs.c | 2 +-
net/core/rtnetlink.c | 3 ++-
net/core/sock_reuseport.c | 1 +
net/ipv4/tcp_input.c | 11 ++++++-----
net/ipv4/tcp_output.c | 13 ++++++++-----
net/ipv4/udp.c | 17 ++++++++++-------
net/ipv6/ip6_gre.c | 11 ++++++-----
net/ipv6/udp.c | 17 ++++++++++-------
net/qrtr/qrtr.c | 1 +
net/rxrpc/recvmsg.c | 2 +-
net/rxrpc/sendmsg.c | 2 +-
net/sctp/stream.c | 27 ++++++++++++++++++---------
18 files changed, 98 insertions(+), 54 deletions(-)
Cong Wang (1):
qrtr: orphan socket in qrtr_release()
Dan Carpenter (1):
AX.25: Prevent integer overflows in connect and sendmsg
David Howells (1):
rxrpc: Fix sendmsg() returning EPIPE due to recvmsg() returning ENODATA
Greg Kroah-Hartman (1):
Linux 4.19.136
Kuniyuki Iwashima (2):
udp: Copy has_conns in reuseport_grow().
udp: Improve load balancing for SO_REUSEPORT.
Miaohe Lin (1):
net: udp: Fix wrong clean up for IS_UDPLITE macro
Peilin Ye (2):
AX.25: Fix out-of-bounds read in ax25_connect()
AX.25: Prevent out-of-bounds read in ax25_sendmsg()
Peng Fan (1):
regmap: debugfs: check count when read regmap file
Subash Abhinov Kasiviswanathan (1):
dev: Defer free of skbs in flush_backlog
Wei Yongjun (1):
ip6_gre: fix null-ptr-deref in ip6gre_init_net()
Weilong Chen (1):
rtnetlink: Fix memory(net_device) leak when ->newlink fails
Xie He (1):
drivers/net/wan/x25_asy: Fix to make it work
Xin Long (2):
sctp: shrink stream outq only when new outcnt < old outcnt
sctp: shrink stream outq when fails to do addstream reconf
Xiongfeng Wang (1):
net-sysfs: add a newline when printing 'tx_timeout' by sysfs
Yuchung Cheng (1):
tcp: allow at most one TLP probe per flight
I'm announcing the release of the 4.14.191 kernel.
All users of the 4.14 kernel series must upgrade.
The updated 4.14.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.14.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 +-
drivers/base/regmap/regmap-debugfs.c | 6 ++++++
drivers/net/wan/x25_asy.c | 21 ++++++++++++++-------
fs/xfs/libxfs/xfs_bmap.c | 4 ++++
include/linux/tcp.h | 4 +++-
mm/page_owner.c | 1 -
net/ax25/af_ax25.c | 10 ++++++++--
net/core/dev.c | 2 +-
net/core/net-sysfs.c | 2 +-
net/core/rtnetlink.c | 3 ++-
net/ipv4/tcp_input.c | 11 ++++++-----
net/ipv4/tcp_output.c | 13 ++++++++-----
net/ipv4/udp.c | 2 +-
net/ipv6/ip6_gre.c | 11 ++++++-----
net/ipv6/udp.c | 2 +-
net/rxrpc/recvmsg.c | 2 +-
net/rxrpc/sendmsg.c | 2 +-
17 files changed, 64 insertions(+), 34 deletions(-)
Dan Carpenter (1):
AX.25: Prevent integer overflows in connect and sendmsg
David Howells (1):
rxrpc: Fix sendmsg() returning EPIPE due to recvmsg() returning ENODATA
Eric Sandeen (1):
xfs: set format back to extents if xfs_bmap_extents_to_btree
Greg Kroah-Hartman (1):
Linux 4.14.191
Miaohe Lin (1):
net: udp: Fix wrong clean up for IS_UDPLITE macro
Oscar Salvador (1):
mm/page_owner.c: remove drain_all_pages from init_early_allocated_pages
Peilin Ye (2):
AX.25: Fix out-of-bounds read in ax25_connect()
AX.25: Prevent out-of-bounds read in ax25_sendmsg()
Peng Fan (1):
regmap: debugfs: check count when read regmap file
Subash Abhinov Kasiviswanathan (1):
dev: Defer free of skbs in flush_backlog
Wei Yongjun (1):
ip6_gre: fix null-ptr-deref in ip6gre_init_net()
Weilong Chen (1):
rtnetlink: Fix memory(net_device) leak when ->newlink fails
Xie He (1):
drivers/net/wan/x25_asy: Fix to make it work
Xiongfeng Wang (1):
net-sysfs: add a newline when printing 'tx_timeout' by sysfs
Yuchung Cheng (1):
tcp: allow at most one TLP probe per flight