<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/net, branch tegra</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>ethtool: Introduce a method for getting time stamping capabilities.</title>
<updated>2014-03-31T14:00:13+00:00</updated>
<author>
<name>Richard Cochran</name>
<email>richardcochran@gmail.com</email>
</author>
<published>2012-04-03T22:59:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=854877d2e30d5f7bb6a591186a2d26b2d69aa185'/>
<id>854877d2e30d5f7bb6a591186a2d26b2d69aa185</id>
<content type='text'>
This commit adds a new ethtool ioctl that exposes the SO_TIMESTAMPING
capabilities of a network interface. In addition, user space programs
can use this ioctl to discover the PTP Hardware Clock (PHC) device
associated with the interface.

Since software receive time stamps are handled by the stack, the generic
ethtool code can answer the query correctly in case the MAC or PHY
drivers lack special time stamping features.

Signed-off-by: Richard Cochran &lt;richardcochran@gmail.com&gt;
Reviewed-by: Ben Hutchings &lt;bhutchings@solarflare.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This commit adds a new ethtool ioctl that exposes the SO_TIMESTAMPING
capabilities of a network interface. In addition, user space programs
can use this ioctl to discover the PTP Hardware Clock (PHC) device
associated with the interface.

Since software receive time stamps are handled by the stack, the generic
ethtool code can answer the query correctly in case the MAC or PHY
drivers lack special time stamping features.

Signed-off-by: Richard Cochran &lt;richardcochran@gmail.com&gt;
Reviewed-by: Ben Hutchings &lt;bhutchings@solarflare.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ethtool: Centralise validation of ETHTOOL_{G, S}RXFHINDIR parameters</title>
<updated>2014-03-30T23:19:57+00:00</updated>
<author>
<name>Ben Hutchings</name>
<email>bhutchings@solarflare.com</email>
</author>
<published>2011-12-15T13:55:01+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=5701f7db2d05c59b7edb51325a4cbed72aec7c90'/>
<id>5701f7db2d05c59b7edb51325a4cbed72aec7c90</id>
<content type='text'>
Add a new ethtool operation (get_rxfh_indir_size) to get the
indirectional table size.  Use this to validate the user buffer size
before calling get_rxfh_indir or set_rxfh_indir.  Use get_rxnfc to get
the number of RX rings, and validate the contents of the new
indirection table before calling set_rxfh_indir.  Remove this
validation from drivers.

Signed-off-by: Ben Hutchings &lt;bhutchings@solarflare.com&gt;
Acked-by: Dimitris Michailidis &lt;dm@chelsio.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Add a new ethtool operation (get_rxfh_indir_size) to get the
indirectional table size.  Use this to validate the user buffer size
before calling get_rxfh_indir or set_rxfh_indir.  Use get_rxnfc to get
the number of RX rings, and validate the contents of the new
indirection table before calling set_rxfh_indir.  Remove this
validation from drivers.

Signed-off-by: Ben Hutchings &lt;bhutchings@solarflare.com&gt;
Acked-by: Dimitris Michailidis &lt;dm@chelsio.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>bluetooth: hid: make Android code conditional</title>
<updated>2012-12-04T20:16:47+00:00</updated>
<author>
<name>Mursalin Akon</name>
<email>makon@nvidia.com</email>
</author>
<published>2012-11-29T22:33:57+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=8024dfe1ac9035050c3402ceef52475dd59f3237'/>
<id>8024dfe1ac9035050c3402ceef52475dd59f3237</id>
<content type='text'>
Commit 7c786ce33a1b4194cb95aa1e68bc38d552eda932
introduced couple of fields, which are not used
in standard bluez user space stack. However,
Android bluez use them. This CL, conditionally
builds the part of the code introduced in the
above commit.

Bug 1178960

Change-Id: I7254fe83c7fb4bbfd14e00dda3ec3a14afc1b234
Signed-off-by: Mursalin Akon &lt;makon@nvidia.com&gt;
(cherry picked from commit e3375fd96fa5e0d7cfcda848d797cd512c12b7a6)
Reviewed-on: http://git-master/r/167540
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Eric Brower &lt;ebrower@nvidia.com&gt;
Reviewed-by: Matthew Pedro &lt;mapedro@nvidia.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Commit 7c786ce33a1b4194cb95aa1e68bc38d552eda932
introduced couple of fields, which are not used
in standard bluez user space stack. However,
Android bluez use them. This CL, conditionally
builds the part of the code introduced in the
above commit.

Bug 1178960

Change-Id: I7254fe83c7fb4bbfd14e00dda3ec3a14afc1b234
Signed-off-by: Mursalin Akon &lt;makon@nvidia.com&gt;
(cherry picked from commit e3375fd96fa5e0d7cfcda848d797cd512c12b7a6)
Reviewed-on: http://git-master/r/167540
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Eric Brower &lt;ebrower@nvidia.com&gt;
Reviewed-by: Matthew Pedro &lt;mapedro@nvidia.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>mac80211 &amp; nl80211: add support to abort a scan request on tx</title>
<updated>2012-07-12T15:28:05+00:00</updated>
<author>
<name>Wei Ni</name>
<email>wni@nvidia.com</email>
</author>
<published>2011-11-22T10:17:43+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=44713c41b7857936322397eb8f75d14b6e913d4b'/>
<id>44713c41b7857936322397eb8f75d14b6e913d4b</id>
<content type='text'>
This fix comes from:
https://gerrit.chromium.org/gerrit/#change,5744
https://gerrit.chromium.org/gerrit/#change,5745

So that it can work with the related wpa_supplicant tool.

BUG=895591

Change-Id: Ie81f6d6052bd45dab13c936f9f0c5f4eb277496a
Original-Signed-off-by: Wei Ni &lt;wni@nvidia.com&gt;
Signed-off-by: Rhyland Klein &lt;rklein@nvidia.com&gt;
Reviewed-on: http://git-master/r/111333
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bharat Nihalani &lt;bnihalani@nvidia.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This fix comes from:
https://gerrit.chromium.org/gerrit/#change,5744
https://gerrit.chromium.org/gerrit/#change,5745

So that it can work with the related wpa_supplicant tool.

BUG=895591

Change-Id: Ie81f6d6052bd45dab13c936f9f0c5f4eb277496a
Original-Signed-off-by: Wei Ni &lt;wni@nvidia.com&gt;
Signed-off-by: Rhyland Klein &lt;rklein@nvidia.com&gt;
Reviewed-on: http://git-master/r/111333
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bharat Nihalani &lt;bnihalani@nvidia.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>cfg80211: fix a crash in nl80211_send_station</title>
<updated>2012-06-15T08:45:19+00:00</updated>
<author>
<name>Felix Fietkau</name>
<email>nbd@openwrt.org</email>
</author>
<published>2011-08-11T01:00:33+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=c1fbf58a26c01b33196d0e4832f2ef742ff1b871'/>
<id>c1fbf58a26c01b33196d0e4832f2ef742ff1b871</id>
<content type='text'>
mac80211 leaves sinfo-&gt;assoc_req_ies uninitialized, causing a random
pointer memory access in nl80211_send_station.
Instead of checking if the pointer is null, use sinfo-&gt;filled, like
the rest of the fields.

Signed-off-by: Felix Fietkau &lt;nbd@openwrt.org&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
mac80211 leaves sinfo-&gt;assoc_req_ies uninitialized, causing a random
pointer memory access in nl80211_send_station.
Instead of checking if the pointer is null, use sinfo-&gt;filled, like
the rest of the fields.

Signed-off-by: Felix Fietkau &lt;nbd@openwrt.org&gt;
Signed-off-by: John W. Linville &lt;linville@tuxdriver.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ah: Don't return NET_XMIT_DROP on input.</title>
<updated>2012-02-10T02:20:28+00:00</updated>
<author>
<name>Nick Bowler</name>
<email>nbowler@elliptictech.com</email>
</author>
<published>2011-11-10T09:01:27+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=84a4439801e1b6ba9289b893fe083c996d34cc70'/>
<id>84a4439801e1b6ba9289b893fe083c996d34cc70</id>
<content type='text'>
commit 4b90a603a1b21d63cf743cc833680cb195a729f6 upstream.

When the ahash driver returns -EBUSY, AH4/6 input functions return
NET_XMIT_DROP, presumably copied from the output code path.  But
returning transmit codes on input doesn't make a lot of sense.
Since NET_XMIT_DROP is a positive int, this gets interpreted as
the next header type (i.e., success).  As that can only end badly,
remove the check.

Signed-off-by: Nick Bowler &lt;nbowler@elliptictech.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Varun Wadekar &lt;vwadekar@nvidia.com&gt;
Change-Id: Ia5db571c5c73a87397fa10dfb668f85b7942f3b0
Reviewed-on: http://git-master/r/79659
Reviewed-by: Automatic_Commit_Validation_User
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 4b90a603a1b21d63cf743cc833680cb195a729f6 upstream.

When the ahash driver returns -EBUSY, AH4/6 input functions return
NET_XMIT_DROP, presumably copied from the output code path.  But
returning transmit codes on input doesn't make a lot of sense.
Since NET_XMIT_DROP is a positive int, this gets interpreted as
the next header type (i.e., success).  As that can only end badly,
remove the check.

Signed-off-by: Nick Bowler &lt;nbowler@elliptictech.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Varun Wadekar &lt;vwadekar@nvidia.com&gt;
Change-Id: Ia5db571c5c73a87397fa10dfb668f85b7942f3b0
Reviewed-on: http://git-master/r/79659
Reviewed-by: Automatic_Commit_Validation_User
</pre>
</div>
</content>
</entry>
<entry>
<title>tcp: md5: using remote adress for md5 lookup in rst packet</title>
<updated>2012-02-08T22:31:41+00:00</updated>
<author>
<name>shawnlu</name>
<email>shawn.lu@ericsson.com</email>
</author>
<published>2012-01-20T12:22:04+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=7e14f410185a53b6112c629c12815b110e6f40c6'/>
<id>7e14f410185a53b6112c629c12815b110e6f40c6</id>
<content type='text'>
[ Upstream commit 8a622e71f58ec9f092fc99eacae0e6cf14f6e742 ]

md5 key is added in socket through remote address.
remote address should be used in finding md5 key when
sending out reset packet.

Signed-off-by: shawnlu &lt;shawn.lu@ericsson.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Varun Wadekar &lt;vwadekar@nvidia.com&gt;
Change-Id: Ib092cc760c830540564414aa1d400e5eb78208f6
Reviewed-on: http://git-master/r/79697
Reviewed-by: Automatic_Commit_Validation_User
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 8a622e71f58ec9f092fc99eacae0e6cf14f6e742 ]

md5 key is added in socket through remote address.
remote address should be used in finding md5 key when
sending out reset packet.

Signed-off-by: shawnlu &lt;shawn.lu@ericsson.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Varun Wadekar &lt;vwadekar@nvidia.com&gt;
Change-Id: Ib092cc760c830540564414aa1d400e5eb78208f6
Reviewed-on: http://git-master/r/79697
Reviewed-by: Automatic_Commit_Validation_User
</pre>
</div>
</content>
</entry>
<entry>
<title>tcp: fix tcp_trim_head() to adjust segment count with skb MSS</title>
<updated>2012-02-08T22:31:34+00:00</updated>
<author>
<name>Neal Cardwell</name>
<email>ncardwell@google.com</email>
</author>
<published>2012-01-28T17:29:46+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=c6d519412d7ef7ab7fb351b64421876b3b95d88d'/>
<id>c6d519412d7ef7ab7fb351b64421876b3b95d88d</id>
<content type='text'>
[ Upstream commit 5b35e1e6e9ca651e6b291c96d1106043c9af314a ]

This commit fixes tcp_trim_head() to recalculate the number of
segments in the skb with the skb's existing MSS, so trimming the head
causes the skb segment count to be monotonically non-increasing - it
should stay the same or go down, but not increase.

Previously tcp_trim_head() used the current MSS of the connection. But
if there was a decrease in MSS between original transmission and ACK
(e.g. due to PMTUD), this could cause tcp_trim_head() to
counter-intuitively increase the segment count when trimming bytes off
the head of an skb. This violated assumptions in tcp_tso_acked() that
tcp_trim_head() only decreases the packet count, so that packets_acked
in tcp_tso_acked() could underflow, leading tcp_clean_rtx_queue() to
pass u32 pkts_acked values as large as 0xffffffff to
ca_ops-&gt;pkts_acked().

As an aside, if tcp_trim_head() had really wanted the skb to reflect
the current MSS, it should have called tcp_set_skb_tso_segs()
unconditionally, since a decrease in MSS would mean that a
single-packet skb should now be sliced into multiple segments.

Signed-off-by: Neal Cardwell &lt;ncardwell@google.com&gt;
Acked-by: Nandita Dukkipati &lt;nanditad@google.com&gt;
Acked-by: Ilpo Järvinen &lt;ilpo.jarvinen@helsinki.fi&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Varun Wadekar &lt;vwadekar@nvidia.com&gt;
Change-Id: I8e7359bbd561e78d0d9be4c3f871b22114504c8b
Reviewed-on: http://git-master/r/79696
Reviewed-by: Automatic_Commit_Validation_User
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 5b35e1e6e9ca651e6b291c96d1106043c9af314a ]

This commit fixes tcp_trim_head() to recalculate the number of
segments in the skb with the skb's existing MSS, so trimming the head
causes the skb segment count to be monotonically non-increasing - it
should stay the same or go down, but not increase.

Previously tcp_trim_head() used the current MSS of the connection. But
if there was a decrease in MSS between original transmission and ACK
(e.g. due to PMTUD), this could cause tcp_trim_head() to
counter-intuitively increase the segment count when trimming bytes off
the head of an skb. This violated assumptions in tcp_tso_acked() that
tcp_trim_head() only decreases the packet count, so that packets_acked
in tcp_tso_acked() could underflow, leading tcp_clean_rtx_queue() to
pass u32 pkts_acked values as large as 0xffffffff to
ca_ops-&gt;pkts_acked().

As an aside, if tcp_trim_head() had really wanted the skb to reflect
the current MSS, it should have called tcp_set_skb_tso_segs()
unconditionally, since a decrease in MSS would mean that a
single-packet skb should now be sliced into multiple segments.

Signed-off-by: Neal Cardwell &lt;ncardwell@google.com&gt;
Acked-by: Nandita Dukkipati &lt;nanditad@google.com&gt;
Acked-by: Ilpo Järvinen &lt;ilpo.jarvinen@helsinki.fi&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Varun Wadekar &lt;vwadekar@nvidia.com&gt;
Change-Id: I8e7359bbd561e78d0d9be4c3f871b22114504c8b
Reviewed-on: http://git-master/r/79696
Reviewed-by: Automatic_Commit_Validation_User
</pre>
</div>
</content>
</entry>
<entry>
<title>rds: Make rds_sock_lock BH rather than IRQ safe.</title>
<updated>2012-02-08T22:31:29+00:00</updated>
<author>
<name>David S. Miller</name>
<email>davem@davemloft.net</email>
</author>
<published>2012-01-24T22:03:44+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=fd0ee4525f9cd149b960a1b33e86129eaede864c'/>
<id>fd0ee4525f9cd149b960a1b33e86129eaede864c</id>
<content type='text'>
[ Upstream commit efc3dbc37412c027e363736b4f4c74ee5e8ecffc ]

rds_sock_info() triggers locking warnings because we try to perform a
local_bh_enable() (via sock_i_ino()) while hardware interrupts are
disabled (via taking rds_sock_lock).

There is no reason for rds_sock_lock to be a hardware IRQ disabling
lock, none of these access paths run in hardware interrupt context.

Therefore making it a BH disabling lock is safe and sufficient to
fix this bug.

Reported-by: Kumar Sanghvi &lt;kumaras@chelsio.com&gt;
Reported-by: Josh Boyer &lt;jwboyer@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Varun Wadekar &lt;vwadekar@nvidia.com&gt;
Change-Id: Ie8ac0fd3307c1d827994aa113764bc3ad96ab1a3
Reviewed-on: http://git-master/r/79695
Reviewed-by: Automatic_Commit_Validation_User
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit efc3dbc37412c027e363736b4f4c74ee5e8ecffc ]

rds_sock_info() triggers locking warnings because we try to perform a
local_bh_enable() (via sock_i_ino()) while hardware interrupts are
disabled (via taking rds_sock_lock).

There is no reason for rds_sock_lock to be a hardware IRQ disabling
lock, none of these access paths run in hardware interrupt context.

Therefore making it a BH disabling lock is safe and sufficient to
fix this bug.

Reported-by: Kumar Sanghvi &lt;kumaras@chelsio.com&gt;
Reported-by: Josh Boyer &lt;jwboyer@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Varun Wadekar &lt;vwadekar@nvidia.com&gt;
Change-Id: Ie8ac0fd3307c1d827994aa113764bc3ad96ab1a3
Reviewed-on: http://git-master/r/79695
Reviewed-by: Automatic_Commit_Validation_User
</pre>
</div>
</content>
</entry>
<entry>
<title>l2tp: l2tp_ip - fix possible oops on packet receive</title>
<updated>2012-02-08T22:31:13+00:00</updated>
<author>
<name>James Chapman</name>
<email>jchapman@katalix.com</email>
</author>
<published>2012-01-25T02:39:05+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=76844f79d0c9484b132e2dd5542d272329420a7d'/>
<id>76844f79d0c9484b132e2dd5542d272329420a7d</id>
<content type='text'>
[ Upstream commit 68315801dbf3ab2001679fd2074c9dc5dcf87dfa ]

When a packet is received on an L2TP IP socket (L2TPv3 IP link
encapsulation), the l2tpip socket's backlog_rcv function calls
xfrm4_policy_check(). This is not necessary, since it was called
before the skb was added to the backlog. With CONFIG_NET_NS enabled,
xfrm4_policy_check() will oops if skb-&gt;dev is null, so this trivial
patch removes the call.

This bug has always been present, but only when CONFIG_NET_NS is
enabled does it cause problems. Most users are probably using UDP
encapsulation for L2TP, hence the problem has only recently
surfaced.

EIP: 0060:[&lt;c12bb62b&gt;] EFLAGS: 00210246 CPU: 0
EIP is at l2tp_ip_recvmsg+0xd4/0x2a7
EAX: 00000001 EBX: d77b5180 ECX: 00000000 EDX: 00200246
ESI: 00000000 EDI: d63cbd30 EBP: d63cbd18 ESP: d63cbcf4
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Call Trace:
 [&lt;c1218568&gt;] sock_common_recvmsg+0x31/0x46
 [&lt;c1215c92&gt;] __sock_recvmsg_nosec+0x45/0x4d
 [&lt;c12163a1&gt;] __sock_recvmsg+0x31/0x3b
 [&lt;c1216828&gt;] sock_recvmsg+0x96/0xab
 [&lt;c10b2693&gt;] ? might_fault+0x47/0x81
 [&lt;c10b2693&gt;] ? might_fault+0x47/0x81
 [&lt;c1167fd0&gt;] ? _copy_from_user+0x31/0x115
 [&lt;c121e8c8&gt;] ? copy_from_user+0x8/0xa
 [&lt;c121ebd6&gt;] ? verify_iovec+0x3e/0x78
 [&lt;c1216604&gt;] __sys_recvmsg+0x10a/0x1aa
 [&lt;c1216792&gt;] ? sock_recvmsg+0x0/0xab
 [&lt;c105a99b&gt;] ? __lock_acquire+0xbdf/0xbee
 [&lt;c12d5a99&gt;] ? do_page_fault+0x193/0x375
 [&lt;c10d1200&gt;] ? fcheck_files+0x9b/0xca
 [&lt;c10d1259&gt;] ? fget_light+0x2a/0x9c
 [&lt;c1216bbb&gt;] sys_recvmsg+0x2b/0x43
 [&lt;c1218145&gt;] sys_socketcall+0x16d/0x1a5
 [&lt;c11679f0&gt;] ? trace_hardirqs_on_thunk+0xc/0x10
 [&lt;c100305f&gt;] sysenter_do_call+0x12/0x38
Code: c6 05 8c ea a8 c1 01 e8 0c d4 d9 ff 85 f6 74 07 3e ff 86 80 00 00 00 b9 17 b6 2b c1 ba 01 00 00 00 b8 78 ed 48 c1 e8 23 f6 d9 ff &lt;ff&gt; 76 0c 68 28 e3 30 c1 68 2d 44 41 c1 e8 89 57 01 00 83 c4 0c

Signed-off-by: James Chapman &lt;jchapman@katalix.com&gt;
Acked-by: Eric Dumazet &lt;eric.dumazet@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Varun Wadekar &lt;vwadekar@nvidia.com&gt;
Change-Id: I343ca4e0871cd48dfc62ef7d1b45e0be3109688a
Reviewed-on: http://git-master/r/79693
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 68315801dbf3ab2001679fd2074c9dc5dcf87dfa ]

When a packet is received on an L2TP IP socket (L2TPv3 IP link
encapsulation), the l2tpip socket's backlog_rcv function calls
xfrm4_policy_check(). This is not necessary, since it was called
before the skb was added to the backlog. With CONFIG_NET_NS enabled,
xfrm4_policy_check() will oops if skb-&gt;dev is null, so this trivial
patch removes the call.

This bug has always been present, but only when CONFIG_NET_NS is
enabled does it cause problems. Most users are probably using UDP
encapsulation for L2TP, hence the problem has only recently
surfaced.

EIP: 0060:[&lt;c12bb62b&gt;] EFLAGS: 00210246 CPU: 0
EIP is at l2tp_ip_recvmsg+0xd4/0x2a7
EAX: 00000001 EBX: d77b5180 ECX: 00000000 EDX: 00200246
ESI: 00000000 EDI: d63cbd30 EBP: d63cbd18 ESP: d63cbcf4
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Call Trace:
 [&lt;c1218568&gt;] sock_common_recvmsg+0x31/0x46
 [&lt;c1215c92&gt;] __sock_recvmsg_nosec+0x45/0x4d
 [&lt;c12163a1&gt;] __sock_recvmsg+0x31/0x3b
 [&lt;c1216828&gt;] sock_recvmsg+0x96/0xab
 [&lt;c10b2693&gt;] ? might_fault+0x47/0x81
 [&lt;c10b2693&gt;] ? might_fault+0x47/0x81
 [&lt;c1167fd0&gt;] ? _copy_from_user+0x31/0x115
 [&lt;c121e8c8&gt;] ? copy_from_user+0x8/0xa
 [&lt;c121ebd6&gt;] ? verify_iovec+0x3e/0x78
 [&lt;c1216604&gt;] __sys_recvmsg+0x10a/0x1aa
 [&lt;c1216792&gt;] ? sock_recvmsg+0x0/0xab
 [&lt;c105a99b&gt;] ? __lock_acquire+0xbdf/0xbee
 [&lt;c12d5a99&gt;] ? do_page_fault+0x193/0x375
 [&lt;c10d1200&gt;] ? fcheck_files+0x9b/0xca
 [&lt;c10d1259&gt;] ? fget_light+0x2a/0x9c
 [&lt;c1216bbb&gt;] sys_recvmsg+0x2b/0x43
 [&lt;c1218145&gt;] sys_socketcall+0x16d/0x1a5
 [&lt;c11679f0&gt;] ? trace_hardirqs_on_thunk+0xc/0x10
 [&lt;c100305f&gt;] sysenter_do_call+0x12/0x38
Code: c6 05 8c ea a8 c1 01 e8 0c d4 d9 ff 85 f6 74 07 3e ff 86 80 00 00 00 b9 17 b6 2b c1 ba 01 00 00 00 b8 78 ed 48 c1 e8 23 f6 d9 ff &lt;ff&gt; 76 0c 68 28 e3 30 c1 68 2d 44 41 c1 e8 89 57 01 00 83 c4 0c

Signed-off-by: James Chapman &lt;jchapman@katalix.com&gt;
Acked-by: Eric Dumazet &lt;eric.dumazet@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
Signed-off-by: Varun Wadekar &lt;vwadekar@nvidia.com&gt;
Change-Id: I343ca4e0871cd48dfc62ef7d1b45e0be3109688a
Reviewed-on: http://git-master/r/79693
</pre>
</div>
</content>
</entry>
</feed>
