Skip to content

Commit 918fe1b

Browse files
torvaldstorvalds
committed
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller: 1) Infinite loop in _decode_session6(), from Eric Dumazet. 2) Pass correct argument to nla_strlcpy() in netfilter, also from Eric Dumazet. 3) Out of bounds memory access in ipv6 srh code, from Mathieu Xhonneux. 4) NULL deref in XDP_REDIRECT handling of tun driver, from Toshiaki Makita. 5) Incorrect idr release in cls_flower, from Paul Blakey. 6) Probe error handling fix in davinci_emac, from Dan Carpenter. 7) Memory leak in XPS configuration, from Alexander Duyck. 8) Use after free with cloned sockets in kcm, from Kirill Tkhai. 9) MTU handling fixes fo ip_tunnel and ip6_tunnel, from Nicolas Dichtel. 10) Fix UAPI hole in bpf data structure for 32-bit compat applications, from Daniel Borkmann. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (33 commits) bpf: fix uapi hole for 32 bit compat applications net: usb: cdc_mbim: add flag FLAG_SEND_ZLP ip6_tunnel: remove magic mtu value 0xFFF8 ip_tunnel: restore binding to ifaces with a large mtu net: dsa: b53: Add BCM5389 support kcm: Fix use-after-free caused by clonned sockets net-sysfs: Fix memory leak in XPS configuration ixgbe: fix parsing of TC actions for HW offload net: ethernet: davinci_emac: fix error handling in probe() net/ncsi: Fix array size in dumpit handler cls_flower: Fix incorrect idr release when failing to modify rule net/sonic: Use dma_mapping_error() xfrm Fix potential error pointer dereference in xfrm_bundle_create. vhost_net: flush batched heads before trying to busy polling tun: Fix NULL pointer dereference in XDP redirect be2net: Fix error detection logic for BE3 net: qmi_wwan: Add Netgear Aircard 779S mlxsw: spectrum: Forbid creation of VLAN 1 over port/LAG atm: zatm: fix memcmp casting iwlwifi: pcie: compare with number of IRQs requested for, not number of CPUs ...
2 parents e0255ae + cd075ce commit 918fe1b

File tree

38 files changed

+192
-115
lines changed

38 files changed

+192
-115
lines changed

‎Documentation/devicetree/bindings/net/dsa/b53.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ Required properties:
1010
"brcm,bcm53128"
1111
"brcm,bcm5365"
1212
"brcm,bcm5395"
13+
"brcm,bcm5389"
1314
"brcm,bcm5397"
1415
"brcm,bcm5398"
1516

‎drivers/atm/zatm.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1151,8 +1151,8 @@ static void eprom_get_byte(struct zatm_dev *zatm_dev, unsigned char *byte,
11511151
}
11521152

11531153

1154-
static unsigned char eprom_try_esi(struct atm_dev *dev, unsigned short cmd,
1155-
int offset, int swap)
1154+
static int eprom_try_esi(struct atm_dev *dev, unsigned short cmd, int offset,
1155+
int swap)
11561156
{
11571157
unsigned char buf[ZEPROM_SIZE];
11581158
struct zatm_dev *zatm_dev;

‎drivers/net/dsa/b53/b53_common.c

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1711,6 +1711,18 @@ static const struct b53_chip_data b53_switch_chips[] = {
17111711
.cpu_port = B53_CPU_PORT_25,
17121712
.duplex_reg = B53_DUPLEX_STAT_FE,
17131713
},
1714+
{
1715+
.chip_id = BCM5389_DEVICE_ID,
1716+
.dev_name = "BCM5389",
1717+
.vlans = 4096,
1718+
.enabled_ports = 0x1f,
1719+
.arl_entries = 4,
1720+
.cpu_port = B53_CPU_PORT,
1721+
.vta_regs = B53_VTA_REGS,
1722+
.duplex_reg = B53_DUPLEX_STAT_GE,
1723+
.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
1724+
.jumbo_size_reg = B53_JUMBO_MAX_SIZE,
1725+
},
17141726
{
17151727
.chip_id = BCM5395_DEVICE_ID,
17161728
.dev_name = "BCM5395",
@@ -2034,6 +2046,7 @@ int b53_switch_detect(struct b53_device *dev)
20342046
else
20352047
dev->chip_id = BCM5365_DEVICE_ID;
20362048
break;
2049+
case BCM5389_DEVICE_ID:
20372050
case BCM5395_DEVICE_ID:
20382051
case BCM5397_DEVICE_ID:
20392052
case BCM5398_DEVICE_ID:

‎drivers/net/dsa/b53/b53_mdio.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,7 @@ static const struct b53_io_ops b53_mdio_ops = {
285285
#define B53_BRCM_OUI_1 0x0143bc00
286286
#define B53_BRCM_OUI_2 0x03625c00
287287
#define B53_BRCM_OUI_3 0x00406000
288+
#define B53_BRCM_OUI_4 0x01410c00
288289

289290
static int b53_mdio_probe(struct mdio_device *mdiodev)
290291
{
@@ -311,7 +312,8 @@ static int b53_mdio_probe(struct mdio_device *mdiodev)
311312
*/
312313
if ((phy_id & 0xfffffc00) != B53_BRCM_OUI_1 &&
313314
(phy_id & 0xfffffc00) != B53_BRCM_OUI_2 &&
314-
(phy_id & 0xfffffc00) != B53_BRCM_OUI_3) {
315+
(phy_id & 0xfffffc00) != B53_BRCM_OUI_3 &&
316+
(phy_id & 0xfffffc00) != B53_BRCM_OUI_4) {
315317
dev_err(&mdiodev->dev, "Unsupported device: 0x%08x\n", phy_id);
316318
return -ENODEV;
317319
}
@@ -360,6 +362,7 @@ static const struct of_device_id b53_of_match[] = {
360362
{ .compatible = "brcm,bcm53125" },
361363
{ .compatible = "brcm,bcm53128" },
362364
{ .compatible = "brcm,bcm5365" },
365+
{ .compatible = "brcm,bcm5389" },
363366
{ .compatible = "brcm,bcm5395" },
364367
{ .compatible = "brcm,bcm5397" },
365368
{ .compatible = "brcm,bcm5398" },

‎drivers/net/dsa/b53/b53_priv.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ struct b53_io_ops {
4848
enum {
4949
BCM5325_DEVICE_ID = 0x25,
5050
BCM5365_DEVICE_ID = 0x65,
51+
BCM5389_DEVICE_ID = 0x89,
5152
BCM5395_DEVICE_ID = 0x95,
5253
BCM5397_DEVICE_ID = 0x97,
5354
BCM5398_DEVICE_ID = 0x98,

‎drivers/net/ethernet/emulex/benet/be_main.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3309,7 +3309,9 @@ void be_detect_error(struct be_adapter *adapter)
33093309
if ((val & POST_STAGE_FAT_LOG_START)
33103310
!= POST_STAGE_FAT_LOG_START &&
33113311
(val & POST_STAGE_ARMFW_UE)
3312-
!= POST_STAGE_ARMFW_UE)
3312+
!= POST_STAGE_ARMFW_UE &&
3313+
(val & POST_STAGE_RECOVERABLE_ERR)
3314+
!= POST_STAGE_RECOVERABLE_ERR)
33133315
return;
33143316
}
33153317

‎drivers/net/ethernet/intel/ixgbe/ixgbe_main.c

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9054,7 +9054,6 @@ static int parse_tc_actions(struct ixgbe_adapter *adapter,
90549054
{
90559055
const struct tc_action *a;
90569056
LIST_HEAD(actions);
9057-
int err;
90589057

90599058
if (!tcf_exts_has_actions(exts))
90609059
return -EINVAL;
@@ -9075,11 +9074,11 @@ static int parse_tc_actions(struct ixgbe_adapter *adapter,
90759074

90769075
if (!dev)
90779076
return -EINVAL;
9078-
err = handle_redirect_action(adapter, dev->ifindex, queue,
9079-
action);
9080-
if (err == 0)
9081-
return err;
9077+
return handle_redirect_action(adapter, dev->ifindex,
9078+
queue, action);
90829079
}
9080+
9081+
return -EINVAL;
90839082
}
90849083

90859084
return -EINVAL;

‎drivers/net/ethernet/mellanox/mlxsw/spectrum.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4433,6 +4433,11 @@ static int mlxsw_sp_netdevice_port_upper_event(struct net_device *lower_dev,
44334433
NL_SET_ERR_MSG_MOD(extack, "Can not put a VLAN on an OVS port");
44344434
return -EINVAL;
44354435
}
4436+
if (is_vlan_dev(upper_dev) &&
4437+
vlan_dev_vlan_id(upper_dev) == 1) {
4438+
NL_SET_ERR_MSG_MOD(extack, "Creating a VLAN device with VID 1 is unsupported: VLAN 1 carries untagged traffic");
4439+
return -EINVAL;
4440+
}
44364441
break;
44374442
case NETDEV_CHANGEUPPER:
44384443
upper_dev = info->upper_dev;

‎drivers/net/ethernet/natsemi/sonic.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ static int sonic_open(struct net_device *dev)
8484
for (i = 0; i < SONIC_NUM_RRS; i++) {
8585
dma_addr_t laddr = dma_map_single(lp->device, skb_put(lp->rx_skb[i], SONIC_RBSIZE),
8686
SONIC_RBSIZE, DMA_FROM_DEVICE);
87-
if (!laddr) {
87+
if (dma_mapping_error(lp->device, laddr)) {
8888
while(i > 0) { /* free any that were mapped successfully */
8989
i--;
9090
dma_unmap_single(lp->device, lp->rx_laddr[i], SONIC_RBSIZE, DMA_FROM_DEVICE);

‎drivers/net/ethernet/socionext/netsec.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1674,8 +1674,8 @@ static int netsec_probe(struct platform_device *pdev)
16741674
if (ret)
16751675
goto unreg_napi;
16761676

1677-
if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)))
1678-
dev_warn(&pdev->dev, "Failed to enable 64-bit DMA\n");
1677+
if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(40)))
1678+
dev_warn(&pdev->dev, "Failed to set DMA mask\n");
16791679

16801680
ret = register_netdev(ndev);
16811681
if (ret) {

‎drivers/net/ethernet/ti/davinci_emac.c

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1873,22 +1873,22 @@ static int davinci_emac_probe(struct platform_device *pdev)
18731873
if (IS_ERR(priv->txchan)) {
18741874
dev_err(&pdev->dev, "error initializing tx dma channel\n");
18751875
rc = PTR_ERR(priv->txchan);
1876-
goto no_cpdma_chan;
1876+
goto err_free_dma;
18771877
}
18781878

18791879
priv->rxchan = cpdma_chan_create(priv->dma, EMAC_DEF_RX_CH,
18801880
emac_rx_handler, 1);
18811881
if (IS_ERR(priv->rxchan)) {
18821882
dev_err(&pdev->dev, "error initializing rx dma channel\n");
18831883
rc = PTR_ERR(priv->rxchan);
1884-
goto no_cpdma_chan;
1884+
goto err_free_txchan;
18851885
}
18861886

18871887
res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
18881888
if (!res) {
18891889
dev_err(&pdev->dev, "error getting irq res\n");
18901890
rc = -ENOENT;
1891-
goto no_cpdma_chan;
1891+
goto err_free_rxchan;
18921892
}
18931893
ndev->irq = res->start;
18941894

@@ -1914,7 +1914,7 @@ static int davinci_emac_probe(struct platform_device *pdev)
19141914
pm_runtime_put_noidle(&pdev->dev);
19151915
dev_err(&pdev->dev, "%s: failed to get_sync(%d)\n",
19161916
__func__, rc);
1917-
goto no_cpdma_chan;
1917+
goto err_napi_del;
19181918
}
19191919

19201920
/* register the network device */
@@ -1924,7 +1924,7 @@ static int davinci_emac_probe(struct platform_device *pdev)
19241924
dev_err(&pdev->dev, "error in register_netdev\n");
19251925
rc = -ENODEV;
19261926
pm_runtime_put(&pdev->dev);
1927-
goto no_cpdma_chan;
1927+
goto err_napi_del;
19281928
}
19291929

19301930

@@ -1937,11 +1937,13 @@ static int davinci_emac_probe(struct platform_device *pdev)
19371937

19381938
return 0;
19391939

1940-
no_cpdma_chan:
1941-
if (priv->txchan)
1942-
cpdma_chan_destroy(priv->txchan);
1943-
if (priv->rxchan)
1944-
cpdma_chan_destroy(priv->rxchan);
1940+
err_napi_del:
1941+
netif_napi_del(&priv->napi);
1942+
err_free_rxchan:
1943+
cpdma_chan_destroy(priv->rxchan);
1944+
err_free_txchan:
1945+
cpdma_chan_destroy(priv->txchan);
1946+
err_free_dma:
19451947
cpdma_ctlr_destroy(priv->dma);
19461948
no_pdata:
19471949
if (of_phy_is_fixed_link(np))

‎drivers/net/tun.c

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1650,7 +1650,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
16501650
else
16511651
*skb_xdp = 0;
16521652

1653-
preempt_disable();
1653+
local_bh_disable();
16541654
rcu_read_lock();
16551655
xdp_prog = rcu_dereference(tun->xdp_prog);
16561656
if (xdp_prog && !*skb_xdp) {
@@ -1675,7 +1675,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
16751675
if (err)
16761676
goto err_redirect;
16771677
rcu_read_unlock();
1678-
preempt_enable();
1678+
local_bh_enable();
16791679
return NULL;
16801680
case XDP_TX:
16811681
get_page(alloc_frag->page);
@@ -1684,7 +1684,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
16841684
goto err_redirect;
16851685
tun_xdp_flush(tun->dev);
16861686
rcu_read_unlock();
1687-
preempt_enable();
1687+
local_bh_enable();
16881688
return NULL;
16891689
case XDP_PASS:
16901690
delta = orig_data - xdp.data;
@@ -1703,7 +1703,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
17031703
skb = build_skb(buf, buflen);
17041704
if (!skb) {
17051705
rcu_read_unlock();
1706-
preempt_enable();
1706+
local_bh_enable();
17071707
return ERR_PTR(-ENOMEM);
17081708
}
17091709

@@ -1713,15 +1713,15 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
17131713
alloc_frag->offset += buflen;
17141714

17151715
rcu_read_unlock();
1716-
preempt_enable();
1716+
local_bh_enable();
17171717

17181718
return skb;
17191719

17201720
err_redirect:
17211721
put_page(alloc_frag->page);
17221722
err_xdp:
17231723
rcu_read_unlock();
1724-
preempt_enable();
1724+
local_bh_enable();
17251725
this_cpu_inc(tun->pcpu_stats->rx_dropped);
17261726
return NULL;
17271727
}
@@ -1917,16 +1917,19 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
19171917
struct bpf_prog *xdp_prog;
19181918
int ret;
19191919

1920+
local_bh_disable();
19201921
rcu_read_lock();
19211922
xdp_prog = rcu_dereference(tun->xdp_prog);
19221923
if (xdp_prog) {
19231924
ret = do_xdp_generic(xdp_prog, skb);
19241925
if (ret != XDP_PASS) {
19251926
rcu_read_unlock();
1927+
local_bh_enable();
19261928
return total_len;
19271929
}
19281930
}
19291931
rcu_read_unlock();
1932+
local_bh_enable();
19301933
}
19311934

19321935
rcu_read_lock();

‎drivers/net/usb/cdc_mbim.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -609,7 +609,7 @@ static const struct driver_info cdc_mbim_info_ndp_to_end = {
609609
*/
610610
static const struct driver_info cdc_mbim_info_avoid_altsetting_toggle = {
611611
.description = "CDC MBIM",
612-
.flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN,
612+
.flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN | FLAG_SEND_ZLP,
613613
.bind = cdc_mbim_bind,
614614
.unbind = cdc_mbim_unbind,
615615
.manage_power = cdc_mbim_manage_power,

‎drivers/net/usb/qmi_wwan.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1103,6 +1103,7 @@ static const struct usb_device_id products[] = {
11031103
{QMI_FIXED_INTF(0x05c6, 0x920d, 5)},
11041104
{QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)}, /* YUGA CLM920-NC5 */
11051105
{QMI_FIXED_INTF(0x0846, 0x68a2, 8)},
1106+
{QMI_FIXED_INTF(0x0846, 0x68d3, 8)}, /* Netgear Aircard 779S */
11061107
{QMI_FIXED_INTF(0x12d1, 0x140c, 1)}, /* Huawei E173 */
11071108
{QMI_FIXED_INTF(0x12d1, 0x14ac, 1)}, /* Huawei E1820 */
11081109
{QMI_FIXED_INTF(0x1435, 0xd181, 3)}, /* Wistron NeWeb D18Q1 */

‎drivers/net/wireless/intel/iwlwifi/pcie/trans.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1590,14 +1590,13 @@ static void iwl_pcie_set_interrupt_capa(struct pci_dev *pdev,
15901590
struct iwl_trans *trans)
15911591
{
15921592
struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
1593-
int max_irqs, num_irqs, i, ret, nr_online_cpus;
1593+
int max_irqs, num_irqs, i, ret;
15941594
u16 pci_cmd;
15951595

15961596
if (!trans->cfg->mq_rx_supported)
15971597
goto enable_msi;
15981598

1599-
nr_online_cpus = num_online_cpus();
1600-
max_irqs = min_t(u32, nr_online_cpus + 2, IWL_MAX_RX_HW_QUEUES);
1599+
max_irqs = min_t(u32, num_online_cpus() + 2, IWL_MAX_RX_HW_QUEUES);
16011600
for (i = 0; i < max_irqs; i++)
16021601
trans_pcie->msix_entries[i].entry = i;
16031602

@@ -1623,16 +1622,17 @@ static void iwl_pcie_set_interrupt_capa(struct pci_dev *pdev,
16231622
* Two interrupts less: non rx causes shared with FBQ and RSS.
16241623
* More than two interrupts: we will use fewer RSS queues.
16251624
*/
1626-
if (num_irqs <= nr_online_cpus) {
1625+
if (num_irqs <= max_irqs - 2) {
16271626
trans_pcie->trans->num_rx_queues = num_irqs + 1;
16281627
trans_pcie->shared_vec_mask = IWL_SHARED_IRQ_NON_RX |
16291628
IWL_SHARED_IRQ_FIRST_RSS;
1630-
} else if (num_irqs == nr_online_cpus + 1) {
1629+
} else if (num_irqs == max_irqs - 1) {
16311630
trans_pcie->trans->num_rx_queues = num_irqs;
16321631
trans_pcie->shared_vec_mask = IWL_SHARED_IRQ_NON_RX;
16331632
} else {
16341633
trans_pcie->trans->num_rx_queues = num_irqs - 1;
16351634
}
1635+
WARN_ON(trans_pcie->trans->num_rx_queues > IWL_MAX_RX_HW_QUEUES);
16361636

16371637
trans_pcie->alloc_vecs = num_irqs;
16381638
trans_pcie->msix_enabled = true;

‎drivers/net/wireless/ralink/rt2x00/rt2x00queue.c

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -372,16 +372,15 @@ static void rt2x00queue_create_tx_descriptor_ht(struct rt2x00_dev *rt2x00dev,
372372

373373
/*
374374
* Determine IFS values
375-
* - Use TXOP_BACKOFF for probe and management frames except beacons
375+
* - Use TXOP_BACKOFF for management frames except beacons
376376
* - Use TXOP_SIFS for fragment bursts
377377
* - Use TXOP_HTTXOP for everything else
378378
*
379379
* Note: rt2800 devices won't use CTS protection (if used)
380380
* for frames not transmitted with TXOP_HTTXOP
381381
*/
382-
if ((ieee80211_is_mgmt(hdr->frame_control) &&
383-
!ieee80211_is_beacon(hdr->frame_control)) ||
384-
(tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE))
382+
if (ieee80211_is_mgmt(hdr->frame_control) &&
383+
!ieee80211_is_beacon(hdr->frame_control))
385384
txdesc->u.ht.txop = TXOP_BACKOFF;
386385
else if (!(tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT))
387386
txdesc->u.ht.txop = TXOP_SIFS;

0 commit comments

Comments
 (0)