Commit 15ba2236 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 

Pull networking fixes from David Miller:

 1) Null termination fix in dns_resolver got the pointer dereferncing
    wrong, fix from Ben Hutchings.

 2) ip_options_compile() has a benign but real buffer overflow when
    parsing options.  From Eric Dumazet.

 3) Table updates can crash in netfilter's nftables if none of the state
    flags indicate an actual change, from Pablo Neira Ayuso.

 4) Fix race in nf_tables dumping, also from Pablo.

 5) GRE-GRO support broke the forwarding path because the segmentation
    state was not fully initialized in these paths, from Jerry Chu.

 6) sunvnet driver leaks objects and potentially crashes on module
    unload, from Sowmini Varadhan.

 7) We can accidently generate the same handle for several u32
    classifier filters, fix from Cong Wang.

 8) Several edge case bug fixes in fragment handling in xen-netback,
    from Zoltan Kiss.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (21 commits)
  ipv4: fix buffer overflow in ip_options_compile()
  batman-adv: fix TT VLAN inconsistency on VLAN re-add
  batman-adv: drop QinQ claim frames in bridge loop avoidance
  dns_resolver: Null-terminate the right string
  xen-netback: Fix pointer incrementation to avoid incorrect logging
  xen-netback: Fix releasing header slot on error path
  xen-netback: Fix releasing frag_list skbs in error path
  xen-netback: Fix handling frag_list on grant op error path
  net_sched: avoid generating same handle for u32 filters
  net: huawei_cdc_ncm: add "subclass 3" devices
  net: qmi_wwan: add two Sierra Wireless/Netgear devices
  wan/x25_asy: integer overflow in x25_asy_change_mtu()
  net: ppp: fix creating PPP pass and active filters
  net/mlx4_en: cq->irq_desc wasn't set in legacy EQ's
  sunvnet: clean up objects created in vnet_new() on vnet_exit()
  r8169: Enable RX_MULTI_EN for RTL_GIGA_MAC_VER_40
  net-gre-gro: Fix a bug that breaks the forwarding path
  netfilter: nf_tables: 64bit stats need some extra synchronization
  netfilter: nf_tables: set NLM_F_DUMP_INTR if netlink dumping is stale
  netfilter: nf_tables: safe RCU iteration on list when dumping
  ...
parents 89faa06e 850717ef

drivers/isdn/i4l/isdn_ppp.c

+16 −4
Original line number Diff line number Diff line
@@ -638,9 +638,15 @@ isdn_ppp_ioctl(int min, struct file *file, unsigned int cmd, unsigned long arg) 
		fprog.len = len;

		fprog.filter = code;



		if (is->pass_filter)

		if (is->pass_filter) {

			sk_unattached_filter_destroy(is->pass_filter);

		err = sk_unattached_filter_create(&is->pass_filter, &fprog);

			is->pass_filter = NULL;

		}

		if (fprog.filter != NULL)

			err = sk_unattached_filter_create(&is->pass_filter,

							  &fprog);

		else

			err = 0;

		kfree(code);



		return err;
@@ -657,9 +663,15 @@ isdn_ppp_ioctl(int min, struct file *file, unsigned int cmd, unsigned long arg) 
		fprog.len = len;

		fprog.filter = code;



		if (is->active_filter)

		if (is->active_filter) {

			sk_unattached_filter_destroy(is->active_filter);

		err = sk_unattached_filter_create(&is->active_filter, &fprog);

			is->active_filter = NULL;

		}

		if (fprog.filter != NULL)

			err = sk_unattached_filter_create(&is->active_filter,

							  &fprog);

		else

			err = 0;

		kfree(code);



		return err;

drivers/net/ethernet/mellanox/mlx4/en_cq.c

+4 −3
Original line number Diff line number Diff line
@@ -129,14 +129,15 @@ int mlx4_en_activate_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq, 
						  name);

				}



				cq->irq_desc =

					irq_to_desc(mlx4_eq_get_irq(mdev->dev,

								    cq->vector));

			}

		} else {

			cq->vector = (cq->ring + 1 + priv->port) %

				mdev->dev->caps.num_comp_vectors;

		}



		cq->irq_desc =

			irq_to_desc(mlx4_eq_get_irq(mdev->dev,

						    cq->vector));

	} else {

		/* For TX we use the same irq per

		ring we assigned for the RX    */

drivers/net/ethernet/realtek/r8169.c

+2 −0
Original line number Diff line number Diff line
@@ -4240,6 +4240,8 @@ static void rtl_init_rxcfg(struct rtl8169_private *tp) 
		RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST);

		break;

	case RTL_GIGA_MAC_VER_40:

		RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);

		break;

	case RTL_GIGA_MAC_VER_41:

	case RTL_GIGA_MAC_VER_42:

	case RTL_GIGA_MAC_VER_43:

drivers/net/ethernet/sun/sunvnet.c

+19 −1
Original line number Diff line number Diff line
@@ -1083,6 +1083,24 @@ static struct vnet *vnet_find_or_create(const u64 *local_mac) 
	return vp;

}



static void vnet_cleanup(void)

{

	struct vnet *vp;

	struct net_device *dev;



	mutex_lock(&vnet_list_mutex);

	while (!list_empty(&vnet_list)) {

		vp = list_first_entry(&vnet_list, struct vnet, list);

		list_del(&vp->list);

		dev = vp->dev;

		/* vio_unregister_driver() should have cleaned up port_list */

		BUG_ON(!list_empty(&vp->port_list));

		unregister_netdev(dev);

		free_netdev(dev);

	}

	mutex_unlock(&vnet_list_mutex);

}



static const char *local_mac_prop = "local-mac-address";



static struct vnet *vnet_find_parent(struct mdesc_handle *hp,
@@ -1240,7 +1258,6 @@ static int vnet_port_remove(struct vio_dev *vdev) 


		kfree(port);



		unregister_netdev(vp->dev);

	}

	return 0;

}
@@ -1268,6 +1285,7 @@ static int __init vnet_init(void) 
static void __exit vnet_exit(void)

{

	vio_unregister_driver(&vnet_port_driver);

	vnet_cleanup();

}



module_init(vnet_init);

drivers/net/ppp/ppp_generic.c

+16 −6
Original line number Diff line number Diff line
@@ -757,10 +757,15 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 
			};



			ppp_lock(ppp);

			if (ppp->pass_filter)

			if (ppp->pass_filter) {

				sk_unattached_filter_destroy(ppp->pass_filter);

				ppp->pass_filter = NULL;

			}

			if (fprog.filter != NULL)

				err = sk_unattached_filter_create(&ppp->pass_filter,

								  &fprog);

			else

				err = 0;

			kfree(code);

			ppp_unlock(ppp);

		}
@@ -778,10 +783,15 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 
			};



			ppp_lock(ppp);

			if (ppp->active_filter)

			if (ppp->active_filter) {

				sk_unattached_filter_destroy(ppp->active_filter);

				ppp->active_filter = NULL;

			}

			if (fprog.filter != NULL)

				err = sk_unattached_filter_create(&ppp->active_filter,

								  &fprog);

			else

				err = 0;

			kfree(code);

			ppp_unlock(ppp);

		}

CRA Git | Maintained and supported by SUSTech CRA and CCSE