Commit 19835b1b authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 

Pull networking fixes from David Miller:
 "Another week, another set of bug fixes:

   1) Fix pskb_pull length in __xfrm_transport_prep(), from Xin Long.

   2) Fix double xfrm_state put in esp{4,6}_gro_receive(), also from Xin
      Long.

   3) Re-arm discovery timer properly in mac80211 mesh code, from Linus
      Lüssing.

   4) Prevent buffer overflows in nf_conntrack_pptp debug code, from
      Pablo Neira Ayuso.

   5) Fix race in ktls code between tls_sw_recvmsg() and
      tls_decrypt_done(), from Vinay Kumar Yadav.

   6) Fix crashes on TCP fallback in MPTCP code, from Paolo Abeni.

   7) More validation is necessary of untrusted GSO packets coming from
      virtualization devices, from Willem de Bruijn.

   8) Fix endianness of bnxt_en firmware message length accesses, from
      Edwin Peer.

   9) Fix infinite loop in sch_fq_pie, from Davide Caratti.

  10) Fix lockdep splat in DSA by setting lockless TX in netdev features
      for slave ports, from Vladimir Oltean.

  11) Fix suspend/resume crashes in mlx5, from Mark Bloch.

  12) Fix use after free in bpf fmod_ret, from Alexei Starovoitov.

  13) ARP retransmit timer guard uses wrong offset, from Hongbin Liu.

  14) Fix leak in inetdev_init(), from Yang Yingliang.

  15) Don't try to use inet hash and unhash in l2tp code, results in
      crashes. From Eric Dumazet"

* git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (77 commits)
  l2tp: add sk_family checks to l2tp_validate_socket
  l2tp: do not use inet_hash()/inet_unhash()
  net: qrtr: Allocate workqueue before kernel_bind
  mptcp: remove msk from the token container at destruction time.
  mptcp: fix race between MP_JOIN and close
  mptcp: fix unblocking connect()
  net/sched: act_ct: add nat mangle action only for NAT-conntrack
  devinet: fix memleak in inetdev_init()
  virtio_vsock: Fix race condition in virtio_transport_recv_pkt
  drivers/net/ibmvnic: Update VNIC protocol version reporting
  NFC: st21nfca: add missed kfree_skb() in an error path
  neigh: fix ARP retransmit timer guard
  bpf, selftests: Add a verifier test for assigning 32bit reg states to 64bit ones
  bpf, selftests: Verifier bounds tests need to be updated
  bpf: Fix a verifier issue when assigning 32bit reg states to 64bit ones
  bpf: Fix use-after-free in fmod_ret check
  net/mlx5e: replace EINVAL in mlx5e_flower_parse_meta()
  net/mlx5e: Fix MLX5_TC_CT dependencies
  net/mlx5e: Properly set default values when disabling adaptive moderation
  net/mlx5e: Fix arch depending casting issue in FEC
  ...
parents ffeb595d d9a81a22

arch/powerpc/Kconfig

+1 −0
Original line number Original line Diff line number Diff line
@@ -126,6 +126,7 @@ config PPC 
	select ARCH_HAS_MMIOWB			if PPC64

	select ARCH_HAS_MMIOWB			if PPC64

	select ARCH_HAS_PHYS_TO_DMA

	select ARCH_HAS_PHYS_TO_DMA

	select ARCH_HAS_PMEM_API

	select ARCH_HAS_PMEM_API

	select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE

	select ARCH_HAS_PTE_DEVMAP		if PPC_BOOK3S_64

	select ARCH_HAS_PTE_DEVMAP		if PPC_BOOK3S_64

	select ARCH_HAS_PTE_SPECIAL

	select ARCH_HAS_PTE_SPECIAL

	select ARCH_HAS_MEMBARRIER_CALLBACKS

	select ARCH_HAS_MEMBARRIER_CALLBACKS

drivers/crypto/chelsio/chtls/chtls_io.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -682,7 +682,7 @@ int chtls_push_frames(struct chtls_sock *csk, int comp) 
				make_tx_data_wr(sk, skb, immdlen, len,

				make_tx_data_wr(sk, skb, immdlen, len,

						credits_needed, completion);

						credits_needed, completion);

			tp->snd_nxt += len;

			tp->snd_nxt += len;

			tp->lsndtime = tcp_time_stamp(tp);

			tp->lsndtime = tcp_jiffies32;

			if (completion)

			if (completion)

				ULP_SKB_CB(skb)->flags &= ~ULPCB_FLAG_NEED_HDR;

				ULP_SKB_CB(skb)->flags &= ~ULPCB_FLAG_NEED_HDR;

		} else {

		} else {

drivers/net/bonding/bond_sysfs_slave.c

+3 −1
Original line number Original line Diff line number Diff line
@@ -149,8 +149,10 @@ int bond_sysfs_slave_add(struct slave *slave) 




	err = kobject_init_and_add(&slave->kobj, &slave_ktype,

	err = kobject_init_and_add(&slave->kobj, &slave_ktype,

				   &(slave->dev->dev.kobj), "bonding_slave");

				   &(slave->dev->dev.kobj), "bonding_slave");

	if (err)

	if (err) {

		kobject_put(&slave->kobj);

		return err;

		return err;

	}





	for (a = slave_attrs; *a; ++a) {

	for (a = slave_attrs; *a; ++a) {

		err = sysfs_create_file(&slave->kobj, &((*a)->attr));

		err = sysfs_create_file(&slave->kobj, &((*a)->attr));

drivers/net/dsa/ocelot/felix.c

+6 −2
Original line number Original line Diff line number Diff line
@@ -102,13 +102,17 @@ static void felix_vlan_add(struct dsa_switch *ds, int port, 
			   const struct switchdev_obj_port_vlan *vlan)

			   const struct switchdev_obj_port_vlan *vlan)

{

{

	struct ocelot *ocelot = ds->priv;

	struct ocelot *ocelot = ds->priv;

	u16 flags = vlan->flags;

	u16 vid;

	u16 vid;

	int err;

	int err;





	if (dsa_is_cpu_port(ds, port))

		flags &= ~BRIDGE_VLAN_INFO_UNTAGGED;



	for (vid = vlan->vid_begin; vid <= vlan->vid_end; vid++) {

	for (vid = vlan->vid_begin; vid <= vlan->vid_end; vid++) {

		err = ocelot_vlan_add(ocelot, port, vid,

		err = ocelot_vlan_add(ocelot, port, vid,

				      vlan->flags & BRIDGE_VLAN_INFO_PVID,

				      flags & BRIDGE_VLAN_INFO_PVID,

				      vlan->flags & BRIDGE_VLAN_INFO_UNTAGGED);

				      flags & BRIDGE_VLAN_INFO_UNTAGGED);

		if (err) {

		if (err) {

			dev_err(ds->dev, "Failed to add VLAN %d to port %d: %d\n",

			dev_err(ds->dev, "Failed to add VLAN %d to port %d: %d\n",

				vid, port, err);

				vid, port, err);

drivers/net/ethernet/broadcom/bnxt/bnxt.c

+5 −11
Original line number Original line Diff line number Diff line
@@ -4176,14 +4176,12 @@ static int bnxt_hwrm_do_send_msg(struct bnxt *bp, void *msg, u32 msg_len, 
	int i, intr_process, rc, tmo_count;

	int i, intr_process, rc, tmo_count;

	struct input *req = msg;

	struct input *req = msg;

	u32 *data = msg;

	u32 *data = msg;

	__le32 *resp_len;

	u8 *valid;

	u8 *valid;

	u16 cp_ring_id, len = 0;

	u16 cp_ring_id, len = 0;

	struct hwrm_err_output *resp = bp->hwrm_cmd_resp_addr;

	struct hwrm_err_output *resp = bp->hwrm_cmd_resp_addr;

	u16 max_req_len = BNXT_HWRM_MAX_REQ_LEN;

	u16 max_req_len = BNXT_HWRM_MAX_REQ_LEN;

	struct hwrm_short_input short_input = {0};

	struct hwrm_short_input short_input = {0};

	u32 doorbell_offset = BNXT_GRCPF_REG_CHIMP_COMM_TRIGGER;

	u32 doorbell_offset = BNXT_GRCPF_REG_CHIMP_COMM_TRIGGER;

	u8 *resp_addr = (u8 *)bp->hwrm_cmd_resp_addr;

	u32 bar_offset = BNXT_GRCPF_REG_CHIMP_COMM;

	u32 bar_offset = BNXT_GRCPF_REG_CHIMP_COMM;

	u16 dst = BNXT_HWRM_CHNL_CHIMP;

	u16 dst = BNXT_HWRM_CHNL_CHIMP;
@@ -4201,7 +4199,6 @@ static int bnxt_hwrm_do_send_msg(struct bnxt *bp, void *msg, u32 msg_len, 
		bar_offset = BNXT_GRCPF_REG_KONG_COMM;

		bar_offset = BNXT_GRCPF_REG_KONG_COMM;

		doorbell_offset = BNXT_GRCPF_REG_KONG_COMM_TRIGGER;

		doorbell_offset = BNXT_GRCPF_REG_KONG_COMM_TRIGGER;

		resp = bp->hwrm_cmd_kong_resp_addr;

		resp = bp->hwrm_cmd_kong_resp_addr;

		resp_addr = (u8 *)bp->hwrm_cmd_kong_resp_addr;

	}

	}





	memset(resp, 0, PAGE_SIZE);

	memset(resp, 0, PAGE_SIZE);
@@ -4270,7 +4267,6 @@ static int bnxt_hwrm_do_send_msg(struct bnxt *bp, void *msg, u32 msg_len, 
	tmo_count = HWRM_SHORT_TIMEOUT_COUNTER;

	tmo_count = HWRM_SHORT_TIMEOUT_COUNTER;

	timeout = timeout - HWRM_SHORT_MIN_TIMEOUT * HWRM_SHORT_TIMEOUT_COUNTER;

	timeout = timeout - HWRM_SHORT_MIN_TIMEOUT * HWRM_SHORT_TIMEOUT_COUNTER;

	tmo_count += DIV_ROUND_UP(timeout, HWRM_MIN_TIMEOUT);

	tmo_count += DIV_ROUND_UP(timeout, HWRM_MIN_TIMEOUT);

	resp_len = (__le32 *)(resp_addr + HWRM_RESP_LEN_OFFSET);





	if (intr_process) {

	if (intr_process) {

		u16 seq_id = bp->hwrm_intr_seq_id;

		u16 seq_id = bp->hwrm_intr_seq_id;
@@ -4298,9 +4294,8 @@ static int bnxt_hwrm_do_send_msg(struct bnxt *bp, void *msg, u32 msg_len, 
					   le16_to_cpu(req->req_type));

					   le16_to_cpu(req->req_type));

			return -EBUSY;

			return -EBUSY;

		}

		}

		len = (le32_to_cpu(*resp_len) & HWRM_RESP_LEN_MASK) >>

		len = le16_to_cpu(resp->resp_len);

		      HWRM_RESP_LEN_SFT;

		valid = ((u8 *)resp) + len - 1;

		valid = resp_addr + len - 1;

	} else {

	} else {

		int j;

		int j;
@@ -4311,8 +4306,7 @@ static int bnxt_hwrm_do_send_msg(struct bnxt *bp, void *msg, u32 msg_len, 
			 */

			 */

			if (test_bit(BNXT_STATE_FW_FATAL_COND, &bp->state))

			if (test_bit(BNXT_STATE_FW_FATAL_COND, &bp->state))

				return -EBUSY;

				return -EBUSY;

			len = (le32_to_cpu(*resp_len) & HWRM_RESP_LEN_MASK) >>

			len = le16_to_cpu(resp->resp_len);

			      HWRM_RESP_LEN_SFT;

			if (len)

			if (len)

				break;

				break;

			/* on first few passes, just barely sleep */

			/* on first few passes, just barely sleep */
@@ -4334,7 +4328,7 @@ static int bnxt_hwrm_do_send_msg(struct bnxt *bp, void *msg, u32 msg_len, 
		}

		}





		/* Last byte of resp contains valid bit */

		/* Last byte of resp contains valid bit */

		valid = resp_addr + len - 1;

		valid = ((u8 *)resp) + len - 1;

		for (j = 0; j < HWRM_VALID_BIT_DELAY_USEC; j++) {

		for (j = 0; j < HWRM_VALID_BIT_DELAY_USEC; j++) {

			/* make sure we read from updated DMA memory */

			/* make sure we read from updated DMA memory */

			dma_rmb();

			dma_rmb();
@@ -9310,7 +9304,7 @@ static void __bnxt_close_nic(struct bnxt *bp, bool irq_re_init, 
	bnxt_free_skbs(bp);

	bnxt_free_skbs(bp);





	/* Save ring stats before shutdown */

	/* Save ring stats before shutdown */

	if (bp->bnapi)

	if (bp->bnapi && irq_re_init)

		bnxt_get_ring_stats(bp, &bp->net_stats_prev);

		bnxt_get_ring_stats(bp, &bp->net_stats_prev);

	if (irq_re_init) {

	if (irq_re_init) {

		bnxt_free_irq(bp);

		bnxt_free_irq(bp);

CRA Git | Maintained and supported by SUSTech CRA and CCSE