#define _GNU_SOURCE
#include <sched.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <sys/prctl.h>
#include <sys/wait.h>

#define NSIO    0xb7
#define NS_GET_USERNS   _IO(NSIO, 0x1)

#define pr_err(fmt, ...) \
		({ \
			fprintf(stderr, "%s:%d:" fmt ": %m\n", \
				__func__, __LINE__, ##__VA_ARGS__); \
			1; \
		})

int main(int argc, char *argvp[])
{
	int pfd[2], ns, uns, init_uns;
	struct stat st1, st2;
	char path[128];
	pid_t pid;
	char c;

	if (pipe(pfd))
		return 1;

	pid = fork();
	if (pid < 0)
		return pr_err("fork");
	if (pid == 0) {
		prctl(PR_SET_PDEATHSIG, SIGKILL);
		if (unshare(CLONE_NEWUTS | CLONE_NEWUSER))
			return pr_err("unshare");
		close(pfd[0]);
		close(pfd[1]);
		while (1)
			sleep(1);
		return 0;
	}
	close(pfd[1]);
	if (read(pfd[0], &c, 1) != 0)
		return pr_err("Unable to read from pipe");
	close(pfd[0]);

	snprintf(path, sizeof(path), "/proc/%d/ns/uts", pid);
	ns = open(path, O_RDONLY);
	if (ns < 0)
		return pr_err("Unable to open %s", path);

	uns = ioctl(ns, NS_GET_USERNS);
	if (uns < 0)
		return pr_err("Unable to get an owning user namespace");

	if (fstat(uns, &st1))
		return pr_err("fstat");

	snprintf(path, sizeof(path), "/proc/%d/ns/user", pid);
	if (stat(path, &st2))
		return pr_err("stat");

	if (st1.st_ino != st2.st_ino)
		return pr_err("NS_GET_USERNS returned a wrong namespace");

	init_uns = ioctl(uns, NS_GET_USERNS);
	if (uns < 0)
		return pr_err("Unable to get an owning user namespace");

	if (ioctl(init_uns, NS_GET_USERNS) >= 0 || errno != EPERM)
		return pr_err("Don't get EPERM");

	if (unshare(CLONE_NEWUSER))
		return pr_err("unshare");

	if (ioctl(ns, NS_GET_USERNS) >= 0 || errno != EPERM)
		return pr_err("Don't get EPERM");
	if (ioctl(init_uns, NS_GET_USERNS) >= 0 || errno != EPERM)
		return pr_err("Don't get EPERM");

	kill(pid, SIGKILL);
	wait(NULL);
	return 0;
}
c46c69dbd7544ab2cd585ccf48f360a4'>diff</a></td><td class='form'><form class='right' method='get' action='/cgit.cgi/linux/net-next.git/log/net'>
<input type='hidden' name='id' value='62e13097c46c69dbd7544ab2cd585ccf48f360a4'/><input type='hidden' name='showmsg' value='1'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/cgit.cgi/linux/net-next.git/log/?id=62e13097c46c69dbd7544ab2cd585ccf48f360a4&amp;showmsg=1'>root</a>/<a href='/cgit.cgi/linux/net-next.git/log/net?id=62e13097c46c69dbd7544ab2cd585ccf48f360a4&amp;showmsg=1'>net</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/cgit.cgi/linux/net-next.git/log/net?id=62e13097c46c69dbd7544ab2cd585ccf48f360a4'>Collapse</a>)</th><th class='left'>Author</th><th class='left'>Files</th><th class='left'>Lines</th></tr>
<tr class='logheader'><td><span title='2017-02-01 14:10:03 -0500'>2017-02-01</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?id=f3b20313aef93f9cfda76fec2c05625f88510f18'>net/sched: act_psample: Remove unnecessary ASSERT_RTNL</a></td><td>Yotam Gigi</td><td>1</td><td><span class='deletions'>-1</span>/<span class='insertions'>+0</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
The ASSERT_RTNL is not necessary in the init function, as it does not
touch any rtnl protected structures, as opposed to the mirred action which
does have to hold a net device.

Reported-by: Cong Wang &lt;xiyou.wangcong@gmail.com&gt;
Reviewed-by: Jiri Pirko &lt;jiri@mellanox.com&gt;
Signed-off-by: Yotam Gigi &lt;yotamg@mellanox.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-01 14:10:03 -0500'>2017-02-01</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?id=cadb9c9fdbc6a624d57b5ecdfd412b5800848703'>net/sched: act_sample: Fix error path in init</a></td><td>Yotam Gigi</td><td>1</td><td><span class='deletions'>-1</span>/<span class='insertions'>+4</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
Fix error path of in sample init, by releasing the tc hash in case of
failure in psample_group creation.

Fixes: 5c5670fae430 ("net/sched: Introduce sample tc action")
Reported-by: Cong Wang &lt;xiyou.wangcong@gmail.com&gt;
Reviewed-by: Jiri Pirko &lt;jiri@mellanox.com&gt;
Signed-off-by: Yotam Gigi &lt;yotamg@mellanox.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-01 12:13:52 -0500'>2017-02-01</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?id=1f5e29ce7989eb75652774004b962ee1eb6e56ca'>net: ipv6: add NLM_F_APPEND in notifications when applicable</a></td><td>David Ahern</td><td>1</td><td><span class='deletions'>-0</span>/<span class='insertions'>+3</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
IPv6 does not set the NLM_F_APPEND flag in notifications to signal that
a NEWROUTE is an append versus a new route or a replaced one. Add the
flag if the request has it.

Signed-off-by: David Ahern &lt;dsa@cumulusnetworks.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-01 12:02:48 -0500'>2017-02-01</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?id=b2504a5dbef3305ef41988ad270b0e8ec289331c'>net: reduce skb_warn_bad_offload() noise</a></td><td>Eric Dumazet</td><td>1</td><td><span class='deletions'>-3</span>/<span class='insertions'>+9</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
Dmitry reported warnings occurring in __skb_gso_segment() [1]

All SKB_GSO_DODGY producers can allow user space to feed
packets that trigger the current check.

We could prevent them from doing so, rejecting packets, but
this might add regressions to existing programs.

It turns out our SKB_GSO_DODGY handlers properly set up checksum
information that is needed anyway when packets needs to be segmented.

By checking again skb_needs_check() after skb_mac_gso_segment(),
we should remove these pesky warnings, at a very minor cost.

With help from Willem de Bruijn

[1]
WARNING: CPU: 1 PID: 6768 at net/core/dev.c:2439 skb_warn_bad_offload+0x2af/0x390 net/core/dev.c:2434
lo: caps=(0x000000a2803b7c69, 0x0000000000000000) len=138 data_len=0 gso_size=15883 gso_type=4 ip_summed=0
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 6768 Comm: syz-executor1 Not tainted 4.9.0 #5
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801c063ecd8 ffffffff82346bdf ffffffff00000001 1ffff100380c7d2e
 ffffed00380c7d26 0000000041b58ab3 ffffffff84b37e38 ffffffff823468f1
 ffffffff84820740 ffffffff84f289c0 dffffc0000000000 ffff8801c063ee20
Call Trace:
 [&lt;ffffffff82346bdf&gt;] __dump_stack lib/dump_stack.c:15 [inline]
 [&lt;ffffffff82346bdf&gt;] dump_stack+0x2ee/0x3ef lib/dump_stack.c:51
 [&lt;ffffffff81827e34&gt;] panic+0x1fb/0x412 kernel/panic.c:179
 [&lt;ffffffff8141f704&gt;] __warn+0x1c4/0x1e0 kernel/panic.c:542
 [&lt;ffffffff8141f7e5&gt;] warn_slowpath_fmt+0xc5/0x100 kernel/panic.c:565
 [&lt;ffffffff8356cbaf&gt;] skb_warn_bad_offload+0x2af/0x390 net/core/dev.c:2434
 [&lt;ffffffff83585cd2&gt;] __skb_gso_segment+0x482/0x780 net/core/dev.c:2706
 [&lt;ffffffff83586f19&gt;] skb_gso_segment include/linux/netdevice.h:3985 [inline]
 [&lt;ffffffff83586f19&gt;] validate_xmit_skb+0x5c9/0xc20 net/core/dev.c:2969
 [&lt;ffffffff835892bb&gt;] __dev_queue_xmit+0xe6b/0x1e70 net/core/dev.c:3383
 [&lt;ffffffff8358a2d7&gt;] dev_queue_xmit+0x17/0x20 net/core/dev.c:3424
 [&lt;ffffffff83ad161d&gt;] packet_snd net/packet/af_packet.c:2930 [inline]
 [&lt;ffffffff83ad161d&gt;] packet_sendmsg+0x32ed/0x4d30 net/packet/af_packet.c:2955
 [&lt;ffffffff834f0aaa&gt;] sock_sendmsg_nosec net/socket.c:621 [inline]
 [&lt;ffffffff834f0aaa&gt;] sock_sendmsg+0xca/0x110 net/socket.c:631
 [&lt;ffffffff834f329a&gt;] ___sys_sendmsg+0x8fa/0x9f0 net/socket.c:1954
 [&lt;ffffffff834f5e58&gt;] __sys_sendmsg+0x138/0x300 net/socket.c:1988
 [&lt;ffffffff834f604d&gt;] SYSC_sendmsg net/socket.c:1999 [inline]
 [&lt;ffffffff834f604d&gt;] SyS_sendmsg+0x2d/0x50 net/socket.c:1995
 [&lt;ffffffff84371941&gt;] entry_SYSCALL_64_fastpath+0x1f/0xc2

Signed-off-by: Eric Dumazet &lt;edumazet@google.com&gt;
Reported-by: Dmitry Vyukov  &lt;dvyukov@google.com&gt;
Cc: Willem de Bruijn &lt;willemb@google.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-01 11:53:23 -0500'>2017-02-01</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?id=160ca0142431c19386db976302fd4b07c587f651'>rtnetlink: Handle IFLA_MASTER parameter when processing rtnl_newlink</a></td><td>Theuns Verwoerd</td><td>1</td><td><span class='deletions'>-1</span>/<span class='insertions'>+6</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
Allow a master interface to be specified as one of the parameters when
creating a new interface via rtnl_newlink.  Previously this would
require invoking interface creation, waiting for it to complete, and
then separately binding that new interface to a master.

In particular, this is used when creating a macvlan child interface for
VRRP in a VRF configuration, allowing the interface creator to specify
directly what master interface should be inherited by the child,
without having to deal with asynchronous complications and potential
race conditions.

Signed-off-by: Theuns Verwoerd &lt;theuns.verwoerd@alliedtelesis.co.nz&gt;
Acked-by: David Ahern &lt;dsa@cumulusnetworks.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>