Commit 6288c1d8 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 

Pull networking fixes from Jakub Kicinski:
 "One more set of fixes from the networking tree:

   - add missing input validation in nl80211_del_key(), preventing
     out-of-bounds access

   - last minute fix / improvement of a MRP netlink (uAPI) interface
     introduced in 5.9 (current) release

   - fix "unresolved symbol" build error under CONFIG_NET w/o
     CONFIG_INET due to missing tcp_timewait_sock and inet_timewait_sock
     BTF.

   - fix 32 bit sub-register bounds tracking in the bpf verifier for OR
     case

   - tcp: fix receive window update in tcp_add_backlog()

   - openvswitch: handle DNAT tuple collision in conntrack-related code

   - r8169: wait for potential PHY reset to finish after applying a FW
     file, avoiding unexpected PHY behaviour and failures later on

   - mscc: fix tail dropping watermarks for Ocelot switches

   - avoid use-after-free in macsec code after a call to the GRO layer

   - avoid use-after-free in sctp error paths

   - add a device id for Cellient MPL200 WWAN card

   - rxrpc fixes:
      - fix the xdr encoding of the contents read from an rxrpc key
      - fix a BUG() for a unsupported encoding type.
      - fix missing _bh lock annotations.
      - fix acceptance handling for an incoming call where the incoming
        call is encrypted.
      - the server token keyring isn't network namespaced - it belongs
        to the server, so there's no need. Namespacing it means that
        request_key() fails to find it.
      - fix a leak of the server keyring"

* git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (21 commits)
  net: usb: qmi_wwan: add Cellient MPL200 card
  macsec: avoid use-after-free in macsec_handle_frame()
  r8169: consider that PHY reset may still be in progress after applying firmware
  openvswitch: handle DNAT tuple collision
  sctp: fix sctp_auth_init_hmacs() error path
  bridge: Netlink interface fix.
  net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key()
  bpf: Fix scalar32_min_max_or bounds tracking
  tcp: fix receive window update in tcp_add_backlog()
  net: usb: rtl8150: set random MAC address when set_ethernet_addr() fails
  mptcp: more DATA FIN fixes
  net: mscc: ocelot: warn when encoding an out-of-bounds watermark value
  net: mscc: ocelot: divide watermark value by 60 when writing to SYS_ATOP
  net: qrtr: ns: Fix the incorrect usage of rcu_read_lock()
  rxrpc: Fix server keyring leak
  rxrpc: The server keyring isn't network-namespaced
  rxrpc: Fix accept on a connection that need securing
  rxrpc: Fix some missing _bh annotations on locking conn->state_lock
  rxrpc: Downgrade the BUG() for unsupported token type in rxrpc_read()
  rxrpc: Fix rxkad token xdr encoding
  ...
parents 3d006ee4 28802e7c

drivers/net/dsa/ocelot/felix_vsc9959.c

+2 −0
Original line number Diff line number Diff line
@@ -1171,6 +1171,8 @@ static int vsc9959_prevalidate_phy_mode(struct ocelot *ocelot, int port, 
 */

static u16 vsc9959_wm_enc(u16 value)

{

	WARN_ON(value >= 16 * BIT(8));



	if (value >= BIT(8))

		return BIT(8) | (value / 16);

drivers/net/dsa/ocelot/seville_vsc9953.c

+2 −0
Original line number Diff line number Diff line
@@ -911,6 +911,8 @@ static int vsc9953_prevalidate_phy_mode(struct ocelot *ocelot, int port, 
 */

static u16 vsc9953_wm_enc(u16 value)

{

	WARN_ON(value >= 16 * BIT(9));



	if (value >= BIT(9))

		return BIT(9) | (value / 16);

drivers/net/ethernet/mscc/ocelot.c

+6 −6
Original line number Diff line number Diff line
@@ -1253,7 +1253,7 @@ void ocelot_port_set_maxlen(struct ocelot *ocelot, int port, size_t sdu) 
	struct ocelot_port *ocelot_port = ocelot->ports[port];

	int maxlen = sdu + ETH_HLEN + ETH_FCS_LEN;

	int pause_start, pause_stop;

	int atop_wm;

	int atop, atop_tot;



	if (port == ocelot->npi) {

		maxlen += OCELOT_TAG_LEN;
@@ -1274,12 +1274,12 @@ void ocelot_port_set_maxlen(struct ocelot *ocelot, int port, size_t sdu) 
	ocelot_fields_write(ocelot, port, SYS_PAUSE_CFG_PAUSE_STOP,

			    pause_stop);



	/* Tail dropping watermark */

	atop_wm = (ocelot->shared_queue_sz - 9 * maxlen) /

	/* Tail dropping watermarks */

	atop_tot = (ocelot->shared_queue_sz - 9 * maxlen) /

		   OCELOT_BUFFER_CELL_SZ;

	ocelot_write_rix(ocelot, ocelot->ops->wm_enc(9 * maxlen),

			 SYS_ATOP, port);

	ocelot_write(ocelot, ocelot->ops->wm_enc(atop_wm), SYS_ATOP_TOT_CFG);

	atop = (9 * maxlen) / OCELOT_BUFFER_CELL_SZ;

	ocelot_write_rix(ocelot, ocelot->ops->wm_enc(atop), SYS_ATOP, port);

	ocelot_write(ocelot, ocelot->ops->wm_enc(atop_tot), SYS_ATOP_TOT_CFG);

}

EXPORT_SYMBOL(ocelot_port_set_maxlen);

drivers/net/ethernet/mscc/ocelot_vsc7514.c

+2 −0
Original line number Diff line number Diff line
@@ -745,6 +745,8 @@ static int ocelot_reset(struct ocelot *ocelot) 
 */

static u16 ocelot_wm_enc(u16 value)

{

	WARN_ON(value >= 16 * BIT(8));



	if (value >= BIT(8))

		return BIT(8) | (value / 16);

drivers/net/ethernet/realtek/r8169_main.c

+7 −0
Original line number Diff line number Diff line
@@ -2058,11 +2058,18 @@ static void rtl_release_firmware(struct rtl8169_private *tp) 


void r8169_apply_firmware(struct rtl8169_private *tp)

{

	int val;



	/* TODO: release firmware if rtl_fw_write_firmware signals failure. */

	if (tp->rtl_fw) {

		rtl_fw_write_firmware(tp, tp->rtl_fw);

		/* At least one firmware doesn't reset tp->ocp_base. */

		tp->ocp_base = OCP_STD_PHY_BASE;



		/* PHY soft reset may still be in progress */

		phy_read_poll_timeout(tp->phydev, MII_BMCR, val,

				      !(val & BMCR_RESET),

				      50000, 600000, true);

	}

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE