--- /dev/null
+From foo@baz Sun Dec 31 11:31:10 CET 2017
+From: Eric Dumazet <edumazet@google.com>
+Date: Mon, 11 Dec 2017 07:17:39 -0800
+Subject: ipv4: igmp: guard against silly MTU values
+
+From: Eric Dumazet <edumazet@google.com>
+
+
+[ Upstream commit b5476022bbada3764609368f03329ca287528dc8 ]
+
+IPv4 stack reacts to changes to small MTU, by disabling itself under
+RTNL.
+
+But there is a window where threads not using RTNL can see a wrong
+device mtu. This can lead to surprises, in igmp code where it is
+assumed the mtu is suitable.
+
+Fix this by reading device mtu once and checking IPv4 minimal MTU.
+
+This patch adds missing IPV4_MIN_MTU define, to not abuse
+ETH_MIN_MTU anymore.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/ip.h | 2 ++
+ net/ipv4/devinet.c | 2 +-
+ net/ipv4/igmp.c | 24 +++++++++++++++---------
+ net/ipv4/ip_tunnel.c | 4 ++--
+ 4 files changed, 20 insertions(+), 12 deletions(-)
+
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -33,6 +33,8 @@
+ #include <net/flow.h>
+ #include <net/flow_keys.h>
+
++#define IPV4_MIN_MTU 68 /* RFC 791 */
++
+ struct sock;
+
+ struct inet_skb_parm {
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -1328,7 +1328,7 @@ skip:
+
+ static bool inetdev_valid_mtu(unsigned int mtu)
+ {
+- return mtu >= 68;
++ return mtu >= IPV4_MIN_MTU;
+ }
+
+ static void inetdev_send_gratuitous_arp(struct net_device *dev,
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -402,16 +402,17 @@ static int grec_size(struct ip_mc_list *
+ }
+
+ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ip_mc_list *pmc,
+- int type, struct igmpv3_grec **ppgr)
++ int type, struct igmpv3_grec **ppgr, unsigned int mtu)
+ {
+ struct net_device *dev = pmc->interface->dev;
+ struct igmpv3_report *pih;
+ struct igmpv3_grec *pgr;
+
+- if (!skb)
+- skb = igmpv3_newpack(dev, dev->mtu);
+- if (!skb)
+- return NULL;
++ if (!skb) {
++ skb = igmpv3_newpack(dev, mtu);
++ if (!skb)
++ return NULL;
++ }
+ pgr = (struct igmpv3_grec *)skb_put(skb, sizeof(struct igmpv3_grec));
+ pgr->grec_type = type;
+ pgr->grec_auxwords = 0;
+@@ -433,10 +434,15 @@ static struct sk_buff *add_grec(struct s
+ struct igmpv3_grec *pgr = NULL;
+ struct ip_sf_list *psf, *psf_next, *psf_prev, **psf_list;
+ int scount, stotal, first, isquery, truncate;
++ unsigned int mtu;
+
+ if (pmc->multiaddr == IGMP_ALL_HOSTS)
+ return skb;
+
++ mtu = READ_ONCE(dev->mtu);
++ if (mtu < IPV4_MIN_MTU)
++ return skb;
++
+ isquery = type == IGMPV3_MODE_IS_INCLUDE ||
+ type == IGMPV3_MODE_IS_EXCLUDE;
+ truncate = type == IGMPV3_MODE_IS_EXCLUDE ||
+@@ -457,7 +463,7 @@ static struct sk_buff *add_grec(struct s
+ AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
+ if (skb)
+ igmpv3_sendpack(skb);
+- skb = igmpv3_newpack(dev, dev->mtu);
++ skb = igmpv3_newpack(dev, mtu);
+ }
+ }
+ first = 1;
+@@ -484,12 +490,12 @@ static struct sk_buff *add_grec(struct s
+ pgr->grec_nsrcs = htons(scount);
+ if (skb)
+ igmpv3_sendpack(skb);
+- skb = igmpv3_newpack(dev, dev->mtu);
++ skb = igmpv3_newpack(dev, mtu);
+ first = 1;
+ scount = 0;
+ }
+ if (first) {
+- skb = add_grhead(skb, pmc, type, &pgr);
++ skb = add_grhead(skb, pmc, type, &pgr, mtu);
+ first = 0;
+ }
+ if (!skb)
+@@ -523,7 +529,7 @@ empty_source:
+ igmpv3_sendpack(skb);
+ skb = NULL; /* add_grhead will get a new one */
+ }
+- skb = add_grhead(skb, pmc, type, &pgr);
++ skb = add_grhead(skb, pmc, type, &pgr, mtu);
+ }
+ }
+ if (pgr)
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -395,8 +395,8 @@ static int ip_tunnel_bind_dev(struct net
+ dev->needed_headroom = t_hlen + hlen;
+ mtu -= (dev->hard_header_len + t_hlen);
+
+- if (mtu < 68)
+- mtu = 68;
++ if (mtu < IPV4_MIN_MTU)
++ mtu = IPV4_MIN_MTU;
+
+ return mtu;
+ }
--- /dev/null
+From foo@baz Sun Dec 31 11:31:10 CET 2017
+From: Eric Dumazet <edumazet@google.com>
+Date: Mon, 11 Dec 2017 07:03:38 -0800
+Subject: ipv6: mcast: better catch silly mtu values
+
+From: Eric Dumazet <edumazet@google.com>
+
+
+[ Upstream commit b9b312a7a451e9c098921856e7cfbc201120e1a7 ]
+
+syzkaller reported crashes in IPv6 stack [1]
+
+Xin Long found that lo MTU was set to silly values.
+
+IPv6 stack reacts to changes to small MTU, by disabling itself under
+RTNL.
+
+But there is a window where threads not using RTNL can see a wrong
+device mtu. This can lead to surprises, in mld code where it is assumed
+the mtu is suitable.
+
+Fix this by reading device mtu once and checking IPv6 minimal MTU.
+
+[1]
+ skbuff: skb_over_panic: text:0000000010b86b8d len:196 put:20
+ head:000000003b477e60 data:000000000e85441e tail:0xd4 end:0xc0 dev:lo
+ ------------[ cut here ]------------
+ kernel BUG at net/core/skbuff.c:104!
+ invalid opcode: 0000 [#1] SMP KASAN
+ Dumping ftrace buffer:
+ (ftrace buffer empty)
+ Modules linked in:
+ CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.15.0-rc2-mm1+ #39
+ Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
+ Google 01/01/2011
+ RIP: 0010:skb_panic+0x15c/0x1f0 net/core/skbuff.c:100
+ RSP: 0018:ffff8801db307508 EFLAGS: 00010286
+ RAX: 0000000000000082 RBX: ffff8801c517e840 RCX: 0000000000000000
+ RDX: 0000000000000082 RSI: 1ffff1003b660e61 RDI: ffffed003b660e95
+ RBP: ffff8801db307570 R08: 1ffff1003b660e23 R09: 0000000000000000
+ R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff85bd4020
+ R13: ffffffff84754ed2 R14: 0000000000000014 R15: ffff8801c4e26540
+ FS: 0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000463610 CR3: 00000001c6698000 CR4: 00000000001406e0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ <IRQ>
+ skb_over_panic net/core/skbuff.c:109 [inline]
+ skb_put+0x181/0x1c0 net/core/skbuff.c:1694
+ add_grhead.isra.24+0x42/0x3b0 net/ipv6/mcast.c:1695
+ add_grec+0xa55/0x1060 net/ipv6/mcast.c:1817
+ mld_send_cr net/ipv6/mcast.c:1903 [inline]
+ mld_ifc_timer_expire+0x4d2/0x770 net/ipv6/mcast.c:2448
+ call_timer_fn+0x23b/0x840 kernel/time/timer.c:1320
+ expire_timers kernel/time/timer.c:1357 [inline]
+ __run_timers+0x7e1/0xb60 kernel/time/timer.c:1660
+ run_timer_softirq+0x4c/0xb0 kernel/time/timer.c:1686
+ __do_softirq+0x29d/0xbb2 kernel/softirq.c:285
+ invoke_softirq kernel/softirq.c:365 [inline]
+ irq_exit+0x1d3/0x210 kernel/softirq.c:405
+ exiting_irq arch/x86/include/asm/apic.h:540 [inline]
+ smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052
+ apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:920
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Tested-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/mcast.c | 25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -1670,16 +1670,16 @@ static int grec_size(struct ifmcaddr6 *p
+ }
+
+ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
+- int type, struct mld2_grec **ppgr)
++ int type, struct mld2_grec **ppgr, unsigned int mtu)
+ {
+- struct net_device *dev = pmc->idev->dev;
+ struct mld2_report *pmr;
+ struct mld2_grec *pgr;
+
+- if (!skb)
+- skb = mld_newpack(pmc->idev, dev->mtu);
+- if (!skb)
+- return NULL;
++ if (!skb) {
++ skb = mld_newpack(pmc->idev, mtu);
++ if (!skb)
++ return NULL;
++ }
+ pgr = (struct mld2_grec *)skb_put(skb, sizeof(struct mld2_grec));
+ pgr->grec_type = type;
+ pgr->grec_auxwords = 0;
+@@ -1702,10 +1702,15 @@ static struct sk_buff *add_grec(struct s
+ struct mld2_grec *pgr = NULL;
+ struct ip6_sf_list *psf, *psf_next, *psf_prev, **psf_list;
+ int scount, stotal, first, isquery, truncate;
++ unsigned int mtu;
+
+ if (pmc->mca_flags & MAF_NOREPORT)
+ return skb;
+
++ mtu = READ_ONCE(dev->mtu);
++ if (mtu < IPV6_MIN_MTU)
++ return skb;
++
+ isquery = type == MLD2_MODE_IS_INCLUDE ||
+ type == MLD2_MODE_IS_EXCLUDE;
+ truncate = type == MLD2_MODE_IS_EXCLUDE ||
+@@ -1726,7 +1731,7 @@ static struct sk_buff *add_grec(struct s
+ AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
+ if (skb)
+ mld_sendpack(skb);
+- skb = mld_newpack(idev, dev->mtu);
++ skb = mld_newpack(idev, mtu);
+ }
+ }
+ first = 1;
+@@ -1753,12 +1758,12 @@ static struct sk_buff *add_grec(struct s
+ pgr->grec_nsrcs = htons(scount);
+ if (skb)
+ mld_sendpack(skb);
+- skb = mld_newpack(idev, dev->mtu);
++ skb = mld_newpack(idev, mtu);
+ first = 1;
+ scount = 0;
+ }
+ if (first) {
+- skb = add_grhead(skb, pmc, type, &pgr);
++ skb = add_grhead(skb, pmc, type, &pgr, mtu);
+ first = 0;
+ }
+ if (!skb)
+@@ -1792,7 +1797,7 @@ empty_source:
+ mld_sendpack(skb);
+ skb = NULL; /* add_grhead will get a new one */
+ }
+- skb = add_grhead(skb, pmc, type, &pgr);
++ skb = add_grhead(skb, pmc, type, &pgr, mtu);
+ }
+ }
+ if (pgr)
--- /dev/null
+From foo@baz Sun Dec 31 11:31:10 CET 2017
+From: Kevin Cernekee <cernekee@chromium.org>
+Date: Mon, 11 Dec 2017 11:13:45 -0800
+Subject: net: igmp: Use correct source address on IGMPv3 reports
+
+From: Kevin Cernekee <cernekee@chromium.org>
+
+
+[ Upstream commit a46182b00290839fa3fa159d54fd3237bd8669f0 ]
+
+Closing a multicast socket after the final IPv4 address is deleted
+from an interface can generate a membership report that uses the
+source IP from a different interface. The following test script, run
+from an isolated netns, reproduces the issue:
+
+ #!/bin/bash
+
+ ip link add dummy0 type dummy
+ ip link add dummy1 type dummy
+ ip link set dummy0 up
+ ip link set dummy1 up
+ ip addr add 10.1.1.1/24 dev dummy0
+ ip addr add 192.168.99.99/24 dev dummy1
+
+ tcpdump -U -i dummy0 &
+ socat EXEC:"sleep 2" \
+ UDP4-DATAGRAM:239.101.1.68:8889,ip-add-membership=239.0.1.68:10.1.1.1 &
+
+ sleep 1
+ ip addr del 10.1.1.1/24 dev dummy0
+ sleep 5
+ kill %tcpdump
+
+RFC 3376 specifies that the report must be sent with a valid IP source
+address from the destination subnet, or from address 0.0.0.0. Add an
+extra check to make sure this is the case.
+
+Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/igmp.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -89,6 +89,7 @@
+ #include <linux/rtnetlink.h>
+ #include <linux/times.h>
+ #include <linux/pkt_sched.h>
++#include <linux/byteorder/generic.h>
+
+ #include <net/net_namespace.h>
+ #include <net/arp.h>
+@@ -318,6 +319,23 @@ igmp_scount(struct ip_mc_list *pmc, int
+ return scount;
+ }
+
++/* source address selection per RFC 3376 section 4.2.13 */
++static __be32 igmpv3_get_srcaddr(struct net_device *dev,
++ const struct flowi4 *fl4)
++{
++ struct in_device *in_dev = __in_dev_get_rcu(dev);
++
++ if (!in_dev)
++ return htonl(INADDR_ANY);
++
++ for_ifa(in_dev) {
++ if (inet_ifa_match(fl4->saddr, ifa))
++ return fl4->saddr;
++ } endfor_ifa(in_dev);
++
++ return htonl(INADDR_ANY);
++}
++
+ static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu)
+ {
+ struct sk_buff *skb;
+@@ -366,7 +384,7 @@ static struct sk_buff *igmpv3_newpack(st
+ pip->frag_off = htons(IP_DF);
+ pip->ttl = 1;
+ pip->daddr = fl4.daddr;
+- pip->saddr = fl4.saddr;
++ pip->saddr = igmpv3_get_srcaddr(dev, &fl4);
+ pip->protocol = IPPROTO_IGMP;
+ pip->tot_len = 0; /* filled in later */
+ ip_select_ident(skb, NULL);
--- /dev/null
+From foo@baz Sun Dec 31 11:31:10 CET 2017
+From: Mohamed Ghannam <simo.ghannam@gmail.com>
+Date: Sun, 10 Dec 2017 03:50:58 +0000
+Subject: net: ipv4: fix for a race condition in raw_sendmsg
+
+From: Mohamed Ghannam <simo.ghannam@gmail.com>
+
+
+[ Upstream commit 8f659a03a0ba9289b9aeb9b4470e6fb263d6f483 ]
+
+inet->hdrincl is racy, and could lead to uninitialized stack pointer
+usage, so its value should be read only once.
+
+Fixes: c008ba5bdc9f ("ipv4: Avoid reading user iov twice after raw_probe_proto_opt")
+Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/raw.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/net/ipv4/raw.c
++++ b/net/ipv4/raw.c
+@@ -483,11 +483,16 @@ static int raw_sendmsg(struct kiocb *ioc
+ u8 tos;
+ int err;
+ struct ip_options_data opt_copy;
++ int hdrincl;
+
+ err = -EMSGSIZE;
+ if (len > 0xFFFF)
+ goto out;
+
++ /* hdrincl should be READ_ONCE(inet->hdrincl)
++ * but READ_ONCE() doesn't work with bit fields
++ */
++ hdrincl = inet->hdrincl;
+ /*
+ * Check the flags.
+ */
+@@ -560,7 +565,7 @@ static int raw_sendmsg(struct kiocb *ioc
+ /* Linux does not mangle headers on raw sockets,
+ * so that IP options + IP_HDRINCL is non-sense.
+ */
+- if (inet->hdrincl)
++ if (hdrincl)
+ goto done;
+ if (ipc.opt->opt.srr) {
+ if (!daddr)
+@@ -582,12 +587,12 @@ static int raw_sendmsg(struct kiocb *ioc
+
+ flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
+ RT_SCOPE_UNIVERSE,
+- inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
++ hdrincl ? IPPROTO_RAW : sk->sk_protocol,
+ inet_sk_flowi_flags(sk) |
+- (inet->hdrincl ? FLOWI_FLAG_KNOWN_NH : 0),
++ (hdrincl ? FLOWI_FLAG_KNOWN_NH : 0),
+ daddr, saddr, 0, 0);
+
+- if (!inet->hdrincl) {
++ if (!hdrincl) {
+ err = raw_probe_proto_opt(&fl4, msg);
+ if (err)
+ goto done;
+@@ -609,7 +614,7 @@ static int raw_sendmsg(struct kiocb *ioc
+ goto do_confirm;
+ back_from_confirm:
+
+- if (inet->hdrincl)
++ if (hdrincl)
+ err = raw_send_hdrinc(sk, &fl4, msg->msg_iov, len,
+ &rt, msg->msg_flags);
+
--- /dev/null
+From foo@baz Sun Dec 31 11:31:10 CET 2017
+From: Tobias Jordan <Tobias.Jordan@elektrobit.com>
+Date: Wed, 6 Dec 2017 15:23:23 +0100
+Subject: net: mvmdio: disable/unprepare clocks in EPROBE_DEFER case
+
+From: Tobias Jordan <Tobias.Jordan@elektrobit.com>
+
+
+[ Upstream commit 589bf32f09852041fbd3b7ce1a9e703f95c230ba ]
+
+add appropriate calls to clk_disable_unprepare() by jumping to out_mdio
+in case orion_mdio_probe() returns -EPROBE_DEFER.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Fixes: 3d604da1e954 ("net: mvmdio: get and enable optional clock")
+Signed-off-by: Tobias Jordan <Tobias.Jordan@elektrobit.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/mvmdio.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/marvell/mvmdio.c
++++ b/drivers/net/ethernet/marvell/mvmdio.c
+@@ -241,7 +241,8 @@ static int orion_mdio_probe(struct platf
+ dev->regs + MVMDIO_ERR_INT_MASK);
+
+ } else if (dev->err_interrupt == -EPROBE_DEFER) {
+- return -EPROBE_DEFER;
++ ret = -EPROBE_DEFER;
++ goto out_mdio;
+ }
+
+ mutex_init(&dev->lock);
--- /dev/null
+From foo@baz Sun Dec 31 11:31:10 CET 2017
+From: Sebastian Sjoholm <ssjoholm@mac.com>
+Date: Mon, 11 Dec 2017 21:51:14 +0100
+Subject: net: qmi_wwan: add Sierra EM7565 1199:9091
+
+From: Sebastian Sjoholm <ssjoholm@mac.com>
+
+
+[ Upstream commit aceef61ee56898cfa7b6960fb60b9326c3860441 ]
+
+Sierra Wireless EM7565 is an Qualcomm MDM9x50 based M.2 modem.
+The USB id is added to qmi_wwan.c to allow QMI communication
+with the EM7565.
+
+Signed-off-by: Sebastian Sjoholm <ssjoholm@mac.com>
+Acked-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/qmi_wwan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -778,6 +778,7 @@ static const struct usb_device_id produc
+ {QMI_FIXED_INTF(0x1199, 0x9079, 10)}, /* Sierra Wireless EM74xx */
+ {QMI_FIXED_INTF(0x1199, 0x907b, 8)}, /* Sierra Wireless EM74xx */
+ {QMI_FIXED_INTF(0x1199, 0x907b, 10)}, /* Sierra Wireless EM74xx */
++ {QMI_FIXED_INTF(0x1199, 0x9091, 8)}, /* Sierra Wireless EM7565 */
+ {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)}, /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
+ {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */
+ {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */
--- /dev/null
+From foo@baz Sun Dec 31 11:31:10 CET 2017
+From: Kevin Cernekee <cernekee@chromium.org>
+Date: Wed, 6 Dec 2017 12:12:27 -0800
+Subject: netlink: Add netns check on taps
+
+From: Kevin Cernekee <cernekee@chromium.org>
+
+
+[ Upstream commit 93c647643b48f0131f02e45da3bd367d80443291 ]
+
+Currently, a nlmon link inside a child namespace can observe systemwide
+netlink activity. Filter the traffic so that nlmon can only sniff
+netlink messages from its own netns.
+
+Test case:
+
+ vpnns -- bash -c "ip link add nlmon0 type nlmon; \
+ ip link set nlmon0 up; \
+ tcpdump -i nlmon0 -q -w /tmp/nlmon.pcap -U" &
+ sudo ip xfrm state add src 10.1.1.1 dst 10.1.1.2 proto esp \
+ spi 0x1 mode transport \
+ auth sha1 0x6162633132330000000000000000000000000000 \
+ enc aes 0x00000000000000000000000000000000
+ grep --binary abc123 /tmp/nlmon.pcap
+
+Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netlink/af_netlink.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -270,6 +270,9 @@ static int __netlink_deliver_tap_skb(str
+ struct sock *sk = skb->sk;
+ int ret = -ENOMEM;
+
++ if (!net_eq(dev_net(dev), sock_net(sk)))
++ return 0;
++
+ dev_hold(dev);
+
+ if (is_vmalloc_addr(skb->head))
--- /dev/null
+From foo@baz Sun Dec 31 11:31:10 CET 2017
+From: Tonghao Zhang <xiangxia.m.yue@gmail.com>
+Date: Fri, 22 Dec 2017 10:15:20 -0800
+Subject: sctp: Replace use of sockets_allocated with specified macro.
+
+From: Tonghao Zhang <xiangxia.m.yue@gmail.com>
+
+
+[ Upstream commit 8cb38a602478e9f806571f6920b0a3298aabf042 ]
+
+The patch(180d8cd942ce) replaces all uses of struct sock fields'
+memory_pressure, memory_allocated, sockets_allocated, and sysctl_mem
+to accessor macros. But the sockets_allocated field of sctp sock is
+not replaced at all. Then replace it now for unifying the code.
+
+Fixes: 180d8cd942ce ("foundations of per-cgroup memory pressure controlling.")
+Cc: Glauber Costa <glommer@parallels.com>
+Signed-off-by: Tonghao Zhang <zhangtonghao@didichuxing.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/socket.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -4166,7 +4166,7 @@ static int sctp_init_sock(struct sock *s
+ SCTP_DBG_OBJCNT_INC(sock);
+
+ local_bh_disable();
+- percpu_counter_inc(&sctp_sockets_allocated);
++ sk_sockets_allocated_inc(sk);
+ sock_prot_inuse_add(net, sk->sk_prot, 1);
+
+ /* Nothing can fail after this block, otherwise
+@@ -4210,7 +4210,7 @@ static void sctp_destroy_sock(struct soc
+ }
+ sctp_endpoint_free(sp->ep);
+ local_bh_disable();
+- percpu_counter_dec(&sctp_sockets_allocated);
++ sk_sockets_allocated_dec(sk);
+ sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
+ local_bh_enable();
+ }
ring-buffer-mask-out-the-info-bits-when-returning-buffer-page-length.patch
asoc-twl4030-fix-child-node-lookup.patch
kbuild-add-fno-stack-check-to-kernel-build-options.patch
+ipv4-igmp-guard-against-silly-mtu-values.patch
+ipv6-mcast-better-catch-silly-mtu-values.patch
+net-igmp-use-correct-source-address-on-igmpv3-reports.patch
+netlink-add-netns-check-on-taps.patch
+net-qmi_wwan-add-sierra-em7565-1199-9091.patch
+tcp-md5sig-use-skb-s-saddr-when-replying-to-an-incoming-segment.patch
+tg3-fix-rx-hang-on-mtu-change-with-5717-5719.patch
+net-mvmdio-disable-unprepare-clocks-in-eprobe_defer-case.patch
+sctp-replace-use-of-sockets_allocated-with-specified-macro.patch
+net-ipv4-fix-for-a-race-condition-in-raw_sendmsg.patch
--- /dev/null
+From foo@baz Sun Dec 31 11:31:10 CET 2017
+From: Christoph Paasch <cpaasch@apple.com>
+Date: Mon, 11 Dec 2017 00:05:46 -0800
+Subject: tcp md5sig: Use skb's saddr when replying to an incoming segment
+
+From: Christoph Paasch <cpaasch@apple.com>
+
+
+[ Upstream commit 30791ac41927ebd3e75486f9504b6d2280463bf0 ]
+
+The MD5-key that belongs to a connection is identified by the peer's
+IP-address. When we are in tcp_v4(6)_reqsk_send_ack(), we are replying
+to an incoming segment from tcp_check_req() that failed the seq-number
+checks.
+
+Thus, to find the correct key, we need to use the skb's saddr and not
+the daddr.
+
+This bug seems to have been there since quite a while, but probably got
+unnoticed because the consequences are not catastrophic. We will call
+tcp_v4_reqsk_send_ack only to send a challenge-ACK back to the peer,
+thus the connection doesn't really fail.
+
+Fixes: 9501f9722922 ("tcp md5sig: Let the caller pass appropriate key for tcp_v{4,6}_do_calc_md5_hash().")
+Signed-off-by: Christoph Paasch <cpaasch@apple.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_ipv4.c | 2 +-
+ net/ipv6/tcp_ipv6.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -810,7 +810,7 @@ static void tcp_v4_reqsk_send_ack(struct
+ tcp_time_stamp,
+ req->ts_recent,
+ 0,
+- tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&ip_hdr(skb)->daddr,
++ tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&ip_hdr(skb)->saddr,
+ AF_INET),
+ inet_rsk(req)->no_srccheck ? IP_REPLY_ARG_NOSRCCHECK : 0,
+ ip_hdr(skb)->tos);
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1001,7 +1001,7 @@ static void tcp_v6_reqsk_send_ack(struct
+ tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
+ tcp_rsk(req)->rcv_nxt, req->rcv_wnd,
+ tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
+- tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
++ tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr),
+ 0, 0);
+ }
+
--- /dev/null
+From foo@baz Sun Dec 31 11:31:10 CET 2017
+From: Brian King <brking@linux.vnet.ibm.com>
+Date: Fri, 15 Dec 2017 15:21:50 -0600
+Subject: tg3: Fix rx hang on MTU change with 5717/5719
+
+From: Brian King <brking@linux.vnet.ibm.com>
+
+
+[ Upstream commit 748a240c589824e9121befb1cba5341c319885bc ]
+
+This fixes a hang issue seen when changing the MTU size from 1500 MTU
+to 9000 MTU on both 5717 and 5719 chips. In discussion with Broadcom,
+they've indicated that these chipsets have the same phy as the 57766
+chipset, so the same workarounds apply. This has been tested by IBM
+on both Power 8 and Power 9 systems as well as by Broadcom on x86
+hardware and has been confirmed to resolve the hang issue.
+
+Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -14202,7 +14202,9 @@ static int tg3_change_mtu(struct net_dev
+ /* Reset PHY, otherwise the read DMA engine will be in a mode that
+ * breaks all requests to 256 bytes.
+ */
+- if (tg3_asic_rev(tp) == ASIC_REV_57766)
++ if (tg3_asic_rev(tp) == ASIC_REV_57766 ||
++ tg3_asic_rev(tp) == ASIC_REV_5717 ||
++ tg3_asic_rev(tp) == ASIC_REV_5719)
+ reset_phy = true;
+
+ err = tg3_restart_hw(tp, reset_phy);
projects / thirdparty / kernel / stable-queue.git / commitdiff
