From: Xin Long <lucien....@gmail.com> Date: Mon, 17 Jun 2019 21:34:12 +0800
> There are two kinds of crashes reported many times by syzbot with no > reproducer. Call Traces are like: ... > They were caused by the fib_nh_common percpu member 'nhc_pcpu_rth_output' > overwritten by another percpu variable 'dev->tstats' access overflow in > tipc udp media xmit path when counting packets on a non tunnel device. > > The fix is to make udp tunnel work with no tunnel device by allowing not > to count packets on the tstats when the tunnel dev is NULL in Patches 1/3 > and 2/3, then pass a NULL tunnel dev in tipc_udp_tunnel() in Patch 3/3. Series applied and queued up for -stable. Thanks for putting all of those syzbot reported by tags in there.
