1. 24 Apr, 2018 8 commits
    • Yonghong Song's avatar
      tools/bpf: remove test_sock_addr from TEST_GEN_PROGS · 6595c742
      Yonghong Song authored
      Since test_sock_addr is not supposed to run by itself,
      remove it from TEST_GEN_PROGS and add it to
      TEST_GEN_PROGS_EXTENDED. This way, run_tests will
      not run test_sock_addr. The corresponding test to run
      is test_sock_addr.sh.
      Signed-off-by: default avatarYonghong Song <yhs@fb.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      6595c742
    • Anders Roxell's avatar
      selftests: bpf: update .gitignore with missing file · b6fd9cf7
      Anders Roxell authored
      Fixes: c0fa1b6c ("bpf: btf: Add BTF tests")
      Signed-off-by: default avatarAnders Roxell <anders.roxell@linaro.org>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      b6fd9cf7
    • Daniel Borkmann's avatar
      Merge branch 'bpf-map-val-as-key' · 68db35b1
      Daniel Borkmann authored
      Paul Chaignon says:
      
      ====================
      Currently, helpers that expect ARG_PTR_TO_MAP_KEY and ARG_PTR_TO_MAP_VALUE
      can only access stack and packet memory.  This patchset allows these
      helpers to directly access map values by passing registers of type
      PTR_TO_MAP_VALUE.
      
      The first patch changes the verifier; the second adds new test cases.
      
      The first three versions of this patchset were sent on the iovisor-dev
      mailing list only.
      
      Changelogs:
        Changes in v5:
          - Refactor using check_helper_mem_access.
        Changes in v4:
          - Rebase.
        Changes in v3:
          - Bug fixes.
          - Negative test cases.
        Changes in v2:
          - Additional test cases for adjusted maps.
      ====================
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      68db35b1
    • Paul Chaignon's avatar
      tools/bpf: add verifier tests for accesses to map values · 5f90dd6a
      Paul Chaignon authored
      This patch adds new test cases for accesses to map values from map
      helpers.
      Signed-off-by: default avatarPaul Chaignon <paul.chaignon@orange.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      5f90dd6a
    • Paul Chaignon's avatar
      bpf: allow map helpers access to map values directly · d71962f3
      Paul Chaignon authored
      Helpers that expect ARG_PTR_TO_MAP_KEY and ARG_PTR_TO_MAP_VALUE can only
      access stack and packet memory.  Allow these helpers to directly access
      map values by passing registers of type PTR_TO_MAP_VALUE.
      
      This change removes the need for an extra copy to the stack when using a
      map value to perform a second map lookup, as in the following:
      
      struct bpf_map_def SEC("maps") infobyreq = {
          .type = BPF_MAP_TYPE_HASHMAP,
          .key_size = sizeof(struct request *),
          .value_size = sizeof(struct info_t),
          .max_entries = 1024,
      };
      struct bpf_map_def SEC("maps") counts = {
          .type = BPF_MAP_TYPE_HASHMAP,
          .key_size = sizeof(struct info_t),
          .value_size = sizeof(u64),
          .max_entries = 1024,
      };
      SEC("kprobe/blk_account_io_start")
      int bpf_blk_account_io_start(struct pt_regs *ctx)
      {
          struct info_t *info = bpf_map_lookup_elem(&infobyreq, &ctx->di);
          u64 *count = bpf_map_lookup_elem(&counts, info);
          (*count)++;
      }
      Signed-off-by: default avatarPaul Chaignon <paul.chaignon@orange.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      d71962f3
    • Daniel Borkmann's avatar
      Merge branch 'bpf-xfrm-states' · 0e25d14e
      Daniel Borkmann authored
      Eyal Birger says:
      
      ====================
      This patchset adds support for fetching XFRM state information from
      an eBPF program called from TC.
      
      The first patch introduces a helper for fetching an XFRM state from the
      skb's secpath. The XFRM state is modeled using a new virtual struct which
      contains the SPI, peer address, and reqid values of the state; This struct
      can be extended in the future to provide additional state information.
      
      The second patch adds a test example in test_tunnel_bpf.sh. The sample
      validates the correct extraction of state information by the eBPF program.
      
      v3:
        - Kept SPI and peer IPv4 address in state in network byte order
          following suggestion from Alexei Starovoitov
      v2:
        - Fixed two comments by Daniel Borkmann:
          - disallow reserved flags in helper call
          - avoid compiling in helper code when CONFIG_XFRM is off
      ====================
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      0e25d14e
    • Eyal Birger's avatar
      samples/bpf: extend test_tunnel_bpf.sh with xfrm state test · 29a36f9e
      Eyal Birger authored
      Add a test for fetching xfrm state parameters from a tc program running
      on ingress.
      Signed-off-by: default avatarEyal Birger <eyal.birger@gmail.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      29a36f9e
    • Eyal Birger's avatar
      bpf: add helper for getting xfrm states · 12bed760
      Eyal Birger authored
      This commit introduces a helper which allows fetching xfrm state
      parameters by eBPF programs attached to TC.
      
      Prototype:
      bpf_skb_get_xfrm_state(skb, index, xfrm_state, size, flags)
      
      skb: pointer to skb
      index: the index in the skb xfrm_state secpath array
      xfrm_state: pointer to 'struct bpf_xfrm_state'
      size: size of 'struct bpf_xfrm_state'
      flags: reserved for future extensions
      
      The helper returns 0 on success. Non zero if no xfrm state at the index
      is found - or non exists at all.
      
      struct bpf_xfrm_state currently includes the SPI, peer IPv4/IPv6
      address and the reqid; it can be further extended by adding elements to
      its end - indicating the populated fields by the 'size' argument -
      keeping backwards compatibility.
      
      Typical usage:
      
      struct bpf_xfrm_state x = {};
      bpf_skb_get_xfrm_state(skb, 0, &x, sizeof(x), 0);
      ...
      Signed-off-by: default avatarEyal Birger <eyal.birger@gmail.com>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      12bed760
  2. 23 Apr, 2018 3 commits
  3. 21 Apr, 2018 10 commits
  4. 20 Apr, 2018 19 commits
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal · 83beed7b
      Linus Torvalds authored
      Pull thermal fixes from Eduardo Valentin:
       "A couple of fixes for the thermal subsystem"
      
      * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal:
        dt-bindings: thermal: Remove "cooling-{min|max}-level" properties
        dt-bindings: thermal: remove no longer needed samsung thermal properties
      83beed7b
    • Linus Torvalds's avatar
      Merge tag 'mmc-v4.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · 7e3cb169
      Linus Torvalds authored
      Pull MMC fixes from Ulf Hansson:
       "A couple of MMC host fixes:
      
         - sdhci-pci: Fixup tuning for AMD for eMMC HS200 mode
      
         - renesas_sdhi_internal_dmac: Avoid data corruption by limiting
           DMA RX"
      
      * tag 'mmc-v4.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
        mmc: renesas_sdhi_internal_dmac: limit DMA RX for old SoCs
        mmc: sdhci-pci: Only do AMD tuning for HS200
      7e3cb169
    • Linus Torvalds's avatar
      Merge tag 'md/4.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md · 7768ee3f
      Linus Torvalds authored
      Pull MD fixes from Shaohua Li:
       "Three small fixes for MD:
      
         - md-cluster fix for faulty device from Guoqing
      
         - writehint fix for writebehind IO for raid1 from Mariusz
      
         - a live lock fix for interrupted recovery from Yufen"
      
      * tag 'md/4.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md:
        raid1: copy write hint from master bio to behind bio
        md/raid1: exit sync request if MD_RECOVERY_INTR is set
        md-cluster: don't update recovery_offset for faulty device
      7768ee3f
    • David Howells's avatar
      vfs: Undo an overly zealous MS_RDONLY -> SB_RDONLY conversion · a9e5b732
      David Howells authored
      In do_mount() when the MS_* flags are being converted to MNT_* flags,
      MS_RDONLY got accidentally convered to SB_RDONLY.
      
      Undo this change.
      
      Fixes: e462ec50 ("VFS: Differentiate mount flags (MS_*) from internal superblock flags")
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      a9e5b732
    • David Howells's avatar
      afs: Fix server record deletion · 66062592
      David Howells authored
      AFS server records get removed from the net->fs_servers tree when
      they're deleted, but not from the net->fs_addresses{4,6} lists, which
      can lead to an oops in afs_find_server() when a server record has been
      removed, for instance during rmmod.
      
      Fix this by deleting the record from the by-address lists before posting
      it for RCU destruction.
      
      The reason this hasn't been noticed before is that the fileserver keeps
      probing the local cache manager, thereby keeping the service record
      alive, so the oops would only happen when a fileserver eventually gets
      bored and stops pinging or if the module gets rmmod'd and a call comes
      in from the fileserver during the window between the server records
      being destroyed and the socket being closed.
      
      The oops looks something like:
      
        BUG: unable to handle kernel NULL pointer dereference at 000000000000001c
        ...
        Workqueue: kafsd afs_process_async_call [kafs]
        RIP: 0010:afs_find_server+0x271/0x36f [kafs]
        ...
        Call Trace:
         afs_deliver_cb_init_call_back_state3+0x1f2/0x21f [kafs]
         afs_deliver_to_call+0x1ee/0x5e8 [kafs]
         afs_process_async_call+0x5b/0xd0 [kafs]
         process_one_work+0x2c2/0x504
         worker_thread+0x1d4/0x2ac
         kthread+0x11f/0x127
         ret_from_fork+0x24/0x30
      
      Fixes: d2ddc776 ("afs: Overhaul volume and server record caching and fileserver rotation")
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      66062592
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net · a72db42c
      Linus Torvalds authored
      Pull networking fixes from David Miller:
      
       1) Unbalanced refcounting in TIPC, from Jon Maloy.
      
       2) Only allow TCP_MD5SIG to be set on sockets in close or listen state.
          Once the connection is established it makes no sense to change this.
          From Eric Dumazet.
      
       3) Missing attribute validation in neigh_dump_table(), also from Eric
          Dumazet.
      
       4) Fix address comparisons in SCTP, from Xin Long.
      
       5) Neigh proxy table clearing can deadlock, from Wolfgang Bumiller.
      
       6) Fix tunnel refcounting in l2tp, from Guillaume Nault.
      
       7) Fix double list insert in team driver, from Paolo Abeni.
      
       8) af_vsock.ko module was accidently made unremovable, from Stefan
          Hajnoczi.
      
       9) Fix reference to freed llc_sap object in llc stack, from Cong Wang.
      
      10) Don't assume netdevice struct is DMA'able memory in virtio_net
          driver, from Michael S. Tsirkin.
      
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (62 commits)
        net/smc: fix shutdown in state SMC_LISTEN
        bnxt_en: Fix memory fault in bnxt_ethtool_init()
        virtio_net: sparse annotation fix
        virtio_net: fix adding vids on big-endian
        virtio_net: split out ctrl buffer
        net: hns: Avoid action name truncation
        docs: ip-sysctl.txt: fix name of some ipv6 variables
        vmxnet3: fix incorrect dereference when rxvlan is disabled
        llc: hold llc_sap before release_sock()
        MAINTAINERS: Direct networking documentation changes to netdev
        atm: iphase: fix spelling mistake: "Tansmit" -> "Transmit"
        net: qmi_wwan: add Wistron Neweb D19Q1
        net: caif: fix spelling mistake "UKNOWN" -> "UNKNOWN"
        net: stmmac: Disable ACS Feature for GMAC >= 4
        net: mvpp2: Fix DMA address mask size
        net: change the comment of dev_mc_init
        net: qualcomm: rmnet: Fix warning seen with fill_info
        tun: fix vlan packet truncation
        tipc: fix infinite loop when dumping link monitor summary
        tipc: fix use-after-free in tipc_nametbl_stop
        ...
      a72db42c
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · b9abdcfd
      Linus Torvalds authored
      Pull vfs fixes from Al Viro:
       "Assorted fixes.
      
        Some of that is only a matter with fault injection (broken handling of
        small allocation failure in various mount-related places), but the
        last one is a root-triggerable stack overflow, and combined with
        userns it gets really nasty ;-/"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        Don't leak MNT_INTERNAL away from internal mounts
        mm,vmscan: Allow preallocating memory for register_shrinker().
        rpc_pipefs: fix double-dput()
        orangefs_kill_sb(): deal with allocation failures
        jffs2_kill_sb(): deal with failed allocations
        hypfs_kill_super(): deal with failed allocations
      b9abdcfd
    • Linus Torvalds's avatar
      Merge tag 'ecryptfs-4.17-rc2-fixes' of... · 43f70c96
      Linus Torvalds authored
      Merge tag 'ecryptfs-4.17-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs
      
      Pull eCryptfs fixes from Tyler Hicks:
       "Minor cleanups and a bug fix to completely ignore unencrypted
        filenames in the lower filesystem when filename encryption is enabled
        at the eCryptfs layer"
      
      * tag 'ecryptfs-4.17-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs:
        eCryptfs: don't pass up plaintext names when using filename encryption
        ecryptfs: fix spelling mistake: "cadidate" -> "candidate"
        ecryptfs: lookup: Don't check if mount_crypt_stat is NULL
      43f70c96
    • Linus Torvalds's avatar
      Merge tag 'for_v4.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs · 0d9cf33b
      Linus Torvalds authored
       - isofs memory leak fix
      
       - two fsnotify fixes of event mask handling
      
       - udf fix of UTF-16 handling
      
       - couple other smaller cleanups
      
      * tag 'for_v4.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
        udf: Fix leak of UTF-16 surrogates into encoded strings
        fs: ext2: Adding new return type vm_fault_t
        isofs: fix potential memory leak in mount option parsing
        MAINTAINERS: add an entry for FSNOTIFY infrastructure
        fsnotify: fix typo in a comment about mark->g_list
        fsnotify: fix ignore mask logic in send_to_group()
        isofs compress: Remove VLA usage
        fs: quota: Replace GFP_ATOMIC with GFP_KERNEL in dquot_init
        fanotify: fix logic of events on child
      0d9cf33b
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid · 4d189053
      Linus Torvalds authored
      Pull HID updates from Jiri Kosina:
      
       - suspend/resume handling fix for Raydium I2C-connected touchscreen
         from Aaron Ma
      
       - protocol fixup for certain BT-connected Wacoms from Aaron Armstrong
         Skomra
      
       - battery level reporting fix on BT-connected mice from Dmitry Torokhov
      
       - hidraw race condition fix from Rodrigo Rivas Costa
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
        HID: i2c-hid: fix inverted return value from i2c_hid_command()
        HID: i2c-hid: Fix resume issue on Raydium touchscreen device
        HID: wacom: bluetooth: send exit report for recent Bluetooth devices
        HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device
        HID: input: fix battery level reporting on BT mice
      4d189053
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching · 41e3bef5
      Linus Torvalds authored
      Pull livepatching fix from Jiri Kosina:
       "Shadow variable API list_head initialization fix from Petr Mladek"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching:
        livepatch: Allow to call a custom callback when freeing shadow variables
        livepatch: Initialize shadow variables safely by a custom callback
      41e3bef5
    • Paolo Abeni's avatar
      tun: do not compute the rxhash, if not needed · cf1a1e07
      Paolo Abeni authored
      Currently, the tun driver, in absence of an eBPF steering program,
      always compute the rxhash in its rx path, even when such value
      is later unused due to additional checks (
      
      This changeset moves the all the related checks just before the
      __skb_get_hash_symmetric(), so that the latter is no more computed
      when unneeded.
      
      Also replace an unneeded RCU section with rcu_access_pointer().
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Acked-by: default avatarJason Wang <jasowang@redhat.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cf1a1e07
    • Raghuram Chary J's avatar
      lan78xx: Add support to dump lan78xx registers · 49621865
      Raghuram Chary J authored
      In order to dump lan78xx family registers using ethtool, add
      support at lan78xx driver level.
      Signed-off-by: default avatarRaghuram Chary J <raghuramchary.jallipalli@microchip.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      49621865
    • David S. Miller's avatar
      Merge branch 'lan78xx-Read-configuration-from-Device-Tree' · 0a8b275d
      David S. Miller authored
      Phil Elwell says:
      
      ====================
      lan78xx: Read configuration from Device Tree
      
      The Microchip LAN78XX family of devices are Ethernet controllers with
      a USB interface. Despite being discoverable devices it can be useful to
      be able to configure them from Device Tree, particularly in low-cost
      applications without an EEPROM or programmed OTP.
      
      This patch set adds support for reading the MAC address and LED modes from
      Device Tree.
      
      v4:
      - Rename nodes in bindings doc.
      
      v3:
      - Move LED setting into PHY driver.
      
      v2:
      - Use eth_platform_get_mac_address.
      - Support up to 4 LEDs, and move LED mode constants into dt-bindings header.
      - Improve bindings document.
      - Remove EEE support.
      ====================
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0a8b275d
    • Phil Elwell's avatar
      dt-bindings: Document the DT bindings for lan78xx · 01d26589
      Phil Elwell authored
      The Microchip LAN78XX family of devices are Ethernet controllers with
      a USB interface. Despite being discoverable devices it can be useful to
      be able to configure them from Device Tree, particularly in low-cost
      applications without an EEPROM or programmed OTP.
      
      Document the supported properties in a bindings file.
      Signed-off-by: default avatarPhil Elwell <phil@raspberrypi.org>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      01d26589
    • Phil Elwell's avatar
      lan78xx: Read LED states from Device Tree · 1827b067
      Phil Elwell authored
      Add support for DT property "microchip,led-modes", a vector of zero
      to four cells (u32s) in the range 0-15, each of which sets the mode
      for one of the LEDs. Some possible values are:
      
          0=link/activity          1=link1000/activity
          2=link100/activity       3=link10/activity
          4=link100/1000/activity  5=link10/1000/activity
          6=link10/100/activity    14=off    15=on
      
      These values are given symbolic constants in a dt-bindings header.
      
      Also use the presence of the DT property to indicate that the
      LEDs should be enabled - necessary in the event that no valid OTP
      or EEPROM is available.
      Signed-off-by: default avatarPhil Elwell <phil@raspberrypi.org>
      Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1827b067
    • Phil Elwell's avatar
      lan78xx: Read MAC address from DT if present · 760db29b
      Phil Elwell authored
      There is a standard mechanism for locating and using a MAC address from
      the Device Tree. Use this facility in the lan78xx driver to support
      applications without programmed EEPROM or OTP. At the same time,
      regularise the handling of the different address sources.
      Signed-off-by: default avatarPhil Elwell <phil@raspberrypi.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      760db29b
    • Bert Kenward's avatar
      sfc: set and clear interrupt affinity hints · a83762d9
      Bert Kenward authored
      Use cpumask_local_spread to provide interrupt affinity hints
      for each queue. This will spread interrupts across NUMA local
      CPUs first, extending to remote nodes if needed.
      Signed-off-by: default avatarBert Kenward <bkenward@solarflare.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a83762d9
    • Eric Dumazet's avatar
      net/ipv6: Fix ip6_convert_metrics() bug · 263243d6
      Eric Dumazet authored
      If ip6_convert_metrics() fails to allocate memory, it should not
      overwrite rt->fib6_metrics or we risk a crash later as syzbot found.
      
      BUG: KASAN: null-ptr-deref in atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
      BUG: KASAN: null-ptr-deref in refcount_sub_and_test+0x92/0x330 lib/refcount.c:179
      Read of size 4 at addr 0000000000000044 by task syzkaller832429/4487
      
      CPU: 1 PID: 4487 Comm: syzkaller832429 Not tainted 4.16.0+ #6
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
       __dump_stack lib/dump_stack.c:77 [inline]
       dump_stack+0x1b9/0x294 lib/dump_stack.c:113
       kasan_report_error mm/kasan/report.c:352 [inline]
       kasan_report.cold.7+0x6d/0x2fe mm/kasan/report.c:412
       check_memory_region_inline mm/kasan/kasan.c:260 [inline]
       check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267
       kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272
       atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
       refcount_sub_and_test+0x92/0x330 lib/refcount.c:179
       refcount_dec_and_test+0x1a/0x20 lib/refcount.c:212
       fib6_info_destroy+0x2d0/0x3c0 net/ipv6/ip6_fib.c:206
       fib6_info_release include/net/ip6_fib.h:304 [inline]
       ip6_route_info_create+0x677/0x3240 net/ipv6/route.c:3020
       ip6_route_add+0x23/0xb0 net/ipv6/route.c:3030
       inet6_rtm_newroute+0x142/0x160 net/ipv6/route.c:4406
       rtnetlink_rcv_msg+0x466/0xc10 net/core/rtnetlink.c:4648
       netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2448
       rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4666
       netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
       netlink_unicast+0x58b/0x740 net/netlink/af_netlink.c:1336
       netlink_sendmsg+0x9f0/0xfa0 net/netlink/af_netlink.c:1901
       sock_sendmsg_nosec net/socket.c:629 [inline]
       sock_sendmsg+0xd5/0x120 net/socket.c:639
       ___sys_sendmsg+0x805/0x940 net/socket.c:2117
       __sys_sendmsg+0x115/0x270 net/socket.c:2155
       SYSC_sendmsg net/socket.c:2164 [inline]
       SyS_sendmsg+0x29/0x30 net/socket.c:2162
       do_syscall_64+0x29e/0x9d0 arch/x86/entry/common.c:287
       entry_SYSCALL_64_after_hwframe+0x42/0xb7
      
      Fixes: d4ead6b3 ("net/ipv6: move metrics from dst to rt6_info")
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: David Ahern <dsa@cumulusnetworks.com>
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Acked-by: default avatarDavid Ahern <dsa@cumulusnetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      263243d6