Skip to content

Commit 8c3b756

Browse files
torvaldstorvalds
committed
Merge tag 'net-6.9-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni: "Including fixes from bluetooth and IPsec. The bridge patch is actually a follow-up to a recent fix in the same area. We have a pending v6.8 AF_UNIX regression; it should be solved soon, but not in time for this PR. Current release - regressions: - eth: ks8851: Queue RX packets in IRQ handler instead of disabling BHs - net: bridge: fix corrupted ethernet header on multicast-to-unicast Current release - new code bugs: - xfrm: fix possible bad pointer derferencing in error path Previous releases - regressionis: - core: fix out-of-bounds access in ops_init - ipv6: - fix potential uninit-value access in __ip6_make_skb() - fib6_rules: avoid possible NULL dereference in fib6_rule_action() - tcp: use refcount_inc_not_zero() in tcp_twsk_unique(). - rtnetlink: correct nested IFLA_VF_VLAN_LIST attribute validation - rxrpc: fix congestion control algorithm - bluetooth: - l2cap: fix slab-use-after-free in l2cap_connect() - msft: fix slab-use-after-free in msft_do_close() - eth: hns3: fix kernel crash when devlink reload during initialization - eth: dsa: mv88e6xxx: add phylink_get_caps for the mv88e6320/21 family Previous releases - always broken: - xfrm: preserve vlan tags for transport mode software GRO - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets - eth: hns3: keep using user config after hardware reset" * tag 'net-6.9-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits) net: dsa: mv88e6xxx: read cmode on mv88e6320/21 serdes only ports net: dsa: mv88e6xxx: add phylink_get_caps for the mv88e6320/21 family net: hns3: fix kernel crash when devlink reload during initialization net: hns3: fix port vlan filter not disabled issue net: hns3: use appropriate barrier function after setting a bit value net: hns3: release PTP resources if pf initialization failed net: hns3: change type of numa_node_mask as nodemask_t net: hns3: direct return when receive a unknown mailbox message net: hns3: using user configure after hardware reset net/smc: fix neighbour and rtable leak in smc_ib_find_route() ipv6: prevent NULL dereference in ip6_output() hsr: Simplify code for announcing HSR nodes timer setup ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() dt-bindings: net: mediatek: remove wrongly added clocks and SerDes rxrpc: Only transmit one ACK per jumbo packet received rxrpc: Fix congestion control algorithm selftests: test_bridge_neigh_suppress.sh: Fix failures due to duplicate MAC ipv6: Fix potential uninit-value access in __ip6_make_skb() net: phy: marvell-88q2xxx: add support for Rev B1 and B2 appletalk: Improve handling of broadcast packets ...
2 parents 62788b0 + 6e7ffa1 commit 8c3b756

47 files changed

Lines changed: 519 additions & 205 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎Documentation/devicetree/bindings/net/mediatek,net.yaml‎

Lines changed: 2 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -337,8 +337,8 @@ allOf:
337337
minItems: 4
338338

339339
clocks:
340-
minItems: 34
341-
maxItems: 34
340+
minItems: 24
341+
maxItems: 24
342342

343343
clock-names:
344344
items:
@@ -351,18 +351,6 @@ allOf:
351351
- const: ethwarp_wocpu1
352352
- const: ethwarp_wocpu0
353353
- const: esw
354-
- const: netsys0
355-
- const: netsys1
356-
- const: sgmii_tx250m
357-
- const: sgmii_rx250m
358-
- const: sgmii2_tx250m
359-
- const: sgmii2_rx250m
360-
- const: top_usxgmii0_sel
361-
- const: top_usxgmii1_sel
362-
- const: top_sgm0_sel
363-
- const: top_sgm1_sel
364-
- const: top_xfi_phy0_xtal_sel
365-
- const: top_xfi_phy1_xtal_sel
366354
- const: top_eth_gmii_sel
367355
- const: top_eth_refck_50m_sel
368356
- const: top_eth_sys_200m_sel
@@ -375,16 +363,10 @@ allOf:
375363
- const: top_netsys_sync_250m_sel
376364
- const: top_netsys_ppefb_250m_sel
377365
- const: top_netsys_warp_sel
378-
- const: wocpu1
379-
- const: wocpu0
380366
- const: xgp1
381367
- const: xgp2
382368
- const: xgp3
383369

384-
mediatek,sgmiisys:
385-
minItems: 2
386-
maxItems: 2
387-
388370
patternProperties:
389371
"^mac@[0-1]$":
390372
type: object

‎Documentation/netlink/specs/rt_link.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1144,6 +1144,12 @@ attribute-sets:
11441144
-
11451145
name: mcast-querier-state
11461146
type: binary
1147+
-
1148+
name: fdb-n-learned
1149+
type: u32
1150+
-
1151+
name: fdb-max-learned
1152+
type: u32
11471153
-
11481154
name: linkinfo-brport-attrs
11491155
name-prefix: ifla-brport-

‎MAINTAINERS‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5709,7 +5709,7 @@ Q: http://patchwork.linuxtv.org/project/linux-media/list/
57095709
F: drivers/media/dvb-frontends/cxd2820r*
57105710

57115711
CXGB3 ETHERNET DRIVER (CXGB3)
5712-
M: Raju Rangoju <rajur@chelsio.com>
5712+
M: Potnuri Bharat Teja <bharat@chelsio.com>
57135713
L: netdev@vger.kernel.org
57145714
S: Supported
57155715
W: http://www.chelsio.com
@@ -5730,7 +5730,7 @@ W: http://www.chelsio.com
57305730
F: drivers/crypto/chelsio
57315731

57325732
CXGB4 ETHERNET DRIVER (CXGB4)
5733-
M: Raju Rangoju <rajur@chelsio.com>
5733+
M: Potnuri Bharat Teja <bharat@chelsio.com>
57345734
L: netdev@vger.kernel.org
57355735
S: Supported
57365736
W: http://www.chelsio.com
@@ -5759,7 +5759,7 @@ F: drivers/infiniband/hw/cxgb4/
57595759
F: include/uapi/rdma/cxgb4-abi.h
57605760

57615761
CXGB4VF ETHERNET DRIVER (CXGB4VF)
5762-
M: Raju Rangoju <rajur@chelsio.com>
5762+
M: Potnuri Bharat Teja <bharat@chelsio.com>
57635763
L: netdev@vger.kernel.org
57645764
S: Supported
57655765
W: http://www.chelsio.com

‎arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-pico6.dts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,8 @@
8282
};
8383

8484
&mmc1 {
85-
bt_reset: bt-reset {
85+
bluetooth@2 {
86+
reg = <2>;
8687
compatible = "mediatek,mt7921s-bluetooth";
8788
pinctrl-names = "default";
8889
pinctrl-0 = <&bt_pins_reset>;

‎drivers/bluetooth/btqca.c‎

Lines changed: 92 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,6 @@
1515

1616
#define VERSION "0.1"
1717

18-
#define QCA_BDADDR_DEFAULT (&(bdaddr_t) {{ 0xad, 0x5a, 0x00, 0x00, 0x00, 0x00 }})
19-
2018
int qca_read_soc_version(struct hci_dev *hdev, struct qca_btsoc_version *ver,
2119
enum qca_btsoc_type soc_type)
2220
{
@@ -101,7 +99,8 @@ static int qca_read_fw_build_info(struct hci_dev *hdev)
10199
{
102100
struct sk_buff *skb;
103101
struct edl_event_hdr *edl;
104-
char cmd, build_label[QCA_FW_BUILD_VER_LEN];
102+
char *build_label;
103+
char cmd;
105104
int build_lbl_len, err = 0;
106105

107106
bt_dev_dbg(hdev, "QCA read fw build info");
@@ -116,6 +115,11 @@ static int qca_read_fw_build_info(struct hci_dev *hdev)
116115
return err;
117116
}
118117

118+
if (skb->len < sizeof(*edl)) {
119+
err = -EILSEQ;
120+
goto out;
121+
}
122+
119123
edl = (struct edl_event_hdr *)(skb->data);
120124
if (!edl) {
121125
bt_dev_err(hdev, "QCA read fw build info with no header");
@@ -131,14 +135,25 @@ static int qca_read_fw_build_info(struct hci_dev *hdev)
131135
goto out;
132136
}
133137

138+
if (skb->len < sizeof(*edl) + 1) {
139+
err = -EILSEQ;
140+
goto out;
141+
}
142+
134143
build_lbl_len = edl->data[0];
135-
if (build_lbl_len <= QCA_FW_BUILD_VER_LEN - 1) {
136-
memcpy(build_label, edl->data + 1, build_lbl_len);
137-
*(build_label + build_lbl_len) = '\0';
144+
145+
if (skb->len < sizeof(*edl) + 1 + build_lbl_len) {
146+
err = -EILSEQ;
147+
goto out;
138148
}
139149

150+
build_label = kstrndup(&edl->data[1], build_lbl_len, GFP_KERNEL);
151+
if (!build_label)
152+
goto out;
153+
140154
hci_set_fw_info(hdev, "%s", build_label);
141155

156+
kfree(build_label);
142157
out:
143158
kfree_skb(skb);
144159
return err;
@@ -237,6 +252,11 @@ static int qca_read_fw_board_id(struct hci_dev *hdev, u16 *bid)
237252
goto out;
238253
}
239254

255+
if (skb->len < 3) {
256+
err = -EILSEQ;
257+
goto out;
258+
}
259+
240260
*bid = (edl->data[1] << 8) + edl->data[2];
241261
bt_dev_dbg(hdev, "%s: bid = %x", __func__, *bid);
242262

@@ -267,9 +287,10 @@ int qca_send_pre_shutdown_cmd(struct hci_dev *hdev)
267287
}
268288
EXPORT_SYMBOL_GPL(qca_send_pre_shutdown_cmd);
269289

270-
static void qca_tlv_check_data(struct hci_dev *hdev,
290+
static int qca_tlv_check_data(struct hci_dev *hdev,
271291
struct qca_fw_config *config,
272-
u8 *fw_data, enum qca_btsoc_type soc_type)
292+
u8 *fw_data, size_t fw_size,
293+
enum qca_btsoc_type soc_type)
273294
{
274295
const u8 *data;
275296
u32 type_len;
@@ -279,12 +300,16 @@ static void qca_tlv_check_data(struct hci_dev *hdev,
279300
struct tlv_type_patch *tlv_patch;
280301
struct tlv_type_nvm *tlv_nvm;
281302
uint8_t nvm_baud_rate = config->user_baud_rate;
303+
u8 type;
282304

283305
config->dnld_mode = QCA_SKIP_EVT_NONE;
284306
config->dnld_type = QCA_SKIP_EVT_NONE;
285307

286308
switch (config->type) {
287309
case ELF_TYPE_PATCH:
310+
if (fw_size < 7)
311+
return -EINVAL;
312+
288313
config->dnld_mode = QCA_SKIP_EVT_VSE_CC;
289314
config->dnld_type = QCA_SKIP_EVT_VSE_CC;
290315

@@ -293,6 +318,9 @@ static void qca_tlv_check_data(struct hci_dev *hdev,
293318
bt_dev_dbg(hdev, "File version : 0x%x", fw_data[6]);
294319
break;
295320
case TLV_TYPE_PATCH:
321+
if (fw_size < sizeof(struct tlv_type_hdr) + sizeof(struct tlv_type_patch))
322+
return -EINVAL;
323+
296324
tlv = (struct tlv_type_hdr *)fw_data;
297325
type_len = le32_to_cpu(tlv->type_len);
298326
tlv_patch = (struct tlv_type_patch *)tlv->data;
@@ -332,25 +360,64 @@ static void qca_tlv_check_data(struct hci_dev *hdev,
332360
break;
333361

334362
case TLV_TYPE_NVM:
363+
if (fw_size < sizeof(struct tlv_type_hdr))
364+
return -EINVAL;
365+
335366
tlv = (struct tlv_type_hdr *)fw_data;
336367

337368
type_len = le32_to_cpu(tlv->type_len);
338-
length = (type_len >> 8) & 0x00ffffff;
369+
length = type_len >> 8;
370+
type = type_len & 0xff;
339371

340-
BT_DBG("TLV Type\t\t : 0x%x", type_len & 0x000000ff);
372+
/* Some NVM files have more than one set of tags, only parse
373+
* the first set when it has type 2 for now. When there is
374+
* more than one set there is an enclosing header of type 4.
375+
*/
376+
if (type == 4) {
377+
if (fw_size < 2 * sizeof(struct tlv_type_hdr))
378+
return -EINVAL;
379+
380+
tlv++;
381+
382+
type_len = le32_to_cpu(tlv->type_len);
383+
length = type_len >> 8;
384+
type = type_len & 0xff;
385+
}
386+
387+
BT_DBG("TLV Type\t\t : 0x%x", type);
341388
BT_DBG("Length\t\t : %d bytes", length);
342389

390+
if (type != 2)
391+
break;
392+
393+
if (fw_size < length + (tlv->data - fw_data))
394+
return -EINVAL;
395+
343396
idx = 0;
344397
data = tlv->data;
345-
while (idx < length) {
398+
while (idx < length - sizeof(struct tlv_type_nvm)) {
346399
tlv_nvm = (struct tlv_type_nvm *)(data + idx);
347400

348401
tag_id = le16_to_cpu(tlv_nvm->tag_id);
349402
tag_len = le16_to_cpu(tlv_nvm->tag_len);
350403

404+
if (length < idx + sizeof(struct tlv_type_nvm) + tag_len)
405+
return -EINVAL;
406+
351407
/* Update NVM tags as needed */
352408
switch (tag_id) {
409+
case EDL_TAG_ID_BD_ADDR:
410+
if (tag_len != sizeof(bdaddr_t))
411+
return -EINVAL;
412+
413+
memcpy(&config->bdaddr, tlv_nvm->data, sizeof(bdaddr_t));
414+
415+
break;
416+
353417
case EDL_TAG_ID_HCI:
418+
if (tag_len < 3)
419+
return -EINVAL;
420+
354421
/* HCI transport layer parameters
355422
* enabling software inband sleep
356423
* onto controller side.
@@ -366,6 +433,9 @@ static void qca_tlv_check_data(struct hci_dev *hdev,
366433
break;
367434

368435
case EDL_TAG_ID_DEEP_SLEEP:
436+
if (tag_len < 1)
437+
return -EINVAL;
438+
369439
/* Sleep enable mask
370440
* enabling deep sleep feature on controller.
371441
*/
@@ -374,14 +444,16 @@ static void qca_tlv_check_data(struct hci_dev *hdev,
374444
break;
375445
}
376446

377-
idx += (sizeof(u16) + sizeof(u16) + 8 + tag_len);
447+
idx += sizeof(struct tlv_type_nvm) + tag_len;
378448
}
379449
break;
380450

381451
default:
382452
BT_ERR("Unknown TLV type %d", config->type);
383-
break;
453+
return -EINVAL;
384454
}
455+
456+
return 0;
385457
}
386458

387459
static int qca_tlv_send_segment(struct hci_dev *hdev, int seg_size,
@@ -531,7 +603,9 @@ static int qca_download_firmware(struct hci_dev *hdev,
531603
memcpy(data, fw->data, size);
532604
release_firmware(fw);
533605

534-
qca_tlv_check_data(hdev, config, data, soc_type);
606+
ret = qca_tlv_check_data(hdev, config, data, size, soc_type);
607+
if (ret)
608+
goto out;
535609

536610
segment = data;
537611
remain = size;
@@ -614,7 +688,7 @@ int qca_set_bdaddr_rome(struct hci_dev *hdev, const bdaddr_t *bdaddr)
614688
}
615689
EXPORT_SYMBOL_GPL(qca_set_bdaddr_rome);
616690

617-
static int qca_check_bdaddr(struct hci_dev *hdev)
691+
static int qca_check_bdaddr(struct hci_dev *hdev, const struct qca_fw_config *config)
618692
{
619693
struct hci_rp_read_bd_addr *bda;
620694
struct sk_buff *skb;
@@ -638,7 +712,7 @@ static int qca_check_bdaddr(struct hci_dev *hdev)
638712
}
639713

640714
bda = (struct hci_rp_read_bd_addr *)skb->data;
641-
if (!bacmp(&bda->bdaddr, QCA_BDADDR_DEFAULT))
715+
if (!bacmp(&bda->bdaddr, &config->bdaddr))
642716
set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
643717

644718
kfree_skb(skb);
@@ -667,7 +741,7 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
667741
enum qca_btsoc_type soc_type, struct qca_btsoc_version ver,
668742
const char *firmware_name)
669743
{
670-
struct qca_fw_config config;
744+
struct qca_fw_config config = {};
671745
int err;
672746
u8 rom_ver = 0;
673747
u32 soc_ver;
@@ -852,7 +926,7 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
852926
break;
853927
}
854928

855-
err = qca_check_bdaddr(hdev);
929+
err = qca_check_bdaddr(hdev, &config);
856930
if (err)
857931
return err;
858932

‎drivers/bluetooth/btqca.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
#define EDL_PATCH_CONFIG_RES_EVT (0x00)
3030
#define QCA_DISABLE_LOGGING_SUB_OP (0x14)
3131

32+
#define EDL_TAG_ID_BD_ADDR 2
3233
#define EDL_TAG_ID_HCI (17)
3334
#define EDL_TAG_ID_DEEP_SLEEP (27)
3435

@@ -47,7 +48,6 @@
4748
#define get_soc_ver(soc_id, rom_ver) \
4849
((le32_to_cpu(soc_id) << 16) | (le16_to_cpu(rom_ver)))
4950

50-
#define QCA_FW_BUILD_VER_LEN 255
5151
#define QCA_HSP_GF_SOC_ID 0x1200
5252
#define QCA_HSP_GF_SOC_MASK 0x0000ff00
5353

@@ -94,6 +94,7 @@ struct qca_fw_config {
9494
uint8_t user_baud_rate;
9595
enum qca_tlv_dnld_mode dnld_mode;
9696
enum qca_tlv_dnld_mode dnld_type;
97+
bdaddr_t bdaddr;
9798
};
9899

99100
struct edl_event_hdr {

0 commit comments

Comments
 (0)