Skip to content

Commit f3f19f9

Browse files
torvaldstorvalds
committed
Merge tag 'net-5.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski: "Including fixes from wireless, and bluetooth. No outstanding fires. Current release - regressions: - eth: atlantic: always deep reset on pm op, fix null-deref Current release - new code bugs: - rds: use maybe_get_net() when acquiring refcount on TCP sockets [refinement of a previous fix] - eth: ocelot: mark traps with a bool instead of guessing type based on list membership Previous releases - regressions: - net: fix skipping features in for_each_netdev_feature() - phy: micrel: fix null-derefs on suspend/resume and probe - bcmgenet: check for Wake-on-LAN interrupt probe deferral Previous releases - always broken: - ipv4: drop dst in multicast routing path, prevent leaks - ping: fix address binding wrt vrf - net: fix wrong network header length when BPF protocol translation is used on skbs with a fraglist - bluetooth: fix the creation of hdev->name - rfkill: uapi: fix RFKILL_IOCTL_MAX_SIZE ioctl request definition - wifi: iwlwifi: iwl-dbg: use del_timer_sync() before freeing - wifi: ath11k: reduce the wait time of 11d scan and hw scan while adding an interface - mac80211: fix rx reordering with non explicit / psmp ack policy - mac80211: reset MBSSID parameters upon connection - nl80211: fix races in nl80211_set_tx_bitrate_mask() - tls: fix context leak on tls_device_down - sched: act_pedit: really ensure the skb is writable - batman-adv: don't skb_split skbuffs with frag_list - eth: ocelot: fix various issues with TC actions (null-deref; bad stats; ineffective drops; ineffective filter removal)" * tag 'net-5.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (61 commits) tls: Fix context leak on tls_device_down net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe() net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending net: dsa: bcm_sf2: Fix Wake-on-LAN with mac_link_down() mlxsw: Avoid warning during ip6gre device removal net: bcmgenet: Check for Wake-on-LAN interrupt probe deferral net: ethernet: mediatek: ppe: fix wrong size passed to memset() Bluetooth: Fix the creation of hdev->name i40e: i40e_main: fix a missing check on list iterator net/sched: act_pedit: really ensure the skb is writable s390/lcs: fix variable dereferenced before check s390/ctcm: fix potential memory leak s390/ctcm: fix variable dereferenced before check net: atlantic: verify hw_head_ lies within TX buffer ring net: atlantic: add check for MAX_SKB_FRAGS net: atlantic: reduce scope of is_rsc_complete net: atlantic: fix "frag[0] not initialized" net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe() net: phy: micrel: Fix incorrect variable type in micrel decnet: Use container_of() for struct dn_neigh casts ...
2 parents 0ac824f + 3740651 commit f3f19f9

74 files changed

Lines changed: 848 additions & 228 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.mailmap‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,7 @@ Juha Yrjola <at solidboot.com>
205205
Juha Yrjola <juha.yrjola@nokia.com>
206206
Juha Yrjola <juha.yrjola@solidboot.com>
207207
Julien Thierry <julien.thierry.kdev@gmail.com> <julien.thierry@arm.com>
208+
Kalle Valo <kvalo@kernel.org> <kvalo@codeaurora.org>
208209
Kalyan Thota <quic_kalyant@quicinc.com> <kalyan_t@codeaurora.org>
209210
Kay Sievers <kay.sievers@vrfy.org>
210211
Kees Cook <keescook@chromium.org> <kees.cook@canonical.com>

‎MAINTAINERS‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3571,8 +3571,9 @@ M: Andy Gospodarek <andy@greyhouse.net>
35713571
L: netdev@vger.kernel.org
35723572
S: Supported
35733573
W: http://sourceforge.net/projects/bonding/
3574+
F: Documentation/networking/bonding.rst
35743575
F: drivers/net/bonding/
3575-
F: include/net/bonding.h
3576+
F: include/net/bond*
35763577
F: include/uapi/linux/if_bonding.h
35773578

35783579
BOSCH SENSORTEC BMA400 ACCELEROMETER IIO DRIVER
@@ -10131,7 +10132,7 @@ S: Supported
1013110132
F: drivers/net/wireless/intel/iwlegacy/
1013210133

1013310134
INTEL WIRELESS WIFI LINK (iwlwifi)
10134-
M: Luca Coelho <luciano.coelho@intel.com>
10135+
M: Gregory Greenman <gregory.greenman@intel.com>
1013510136
L: linux-wireless@vger.kernel.org
1013610137
S: Supported
1013710138
W: https://wireless.wiki.kernel.org/en/users/drivers/iwlwifi

‎drivers/net/dsa/bcm_sf2.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -809,6 +809,9 @@ static void bcm_sf2_sw_mac_link_down(struct dsa_switch *ds, int port,
809809
struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds);
810810
u32 reg, offset;
811811

812+
if (priv->wol_ports_mask & BIT(port))
813+
return;
814+
812815
if (port != core_readl(priv, CORE_IMP0_PRT_ID)) {
813816
if (priv->type == BCM4908_DEVICE_ID ||
814817
priv->type == BCM7445_DEVICE_ID)

‎drivers/net/dsa/ocelot/felix.c‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -403,6 +403,7 @@ static int felix_update_trapping_destinations(struct dsa_switch *ds,
403403
{
404404
struct ocelot *ocelot = ds->priv;
405405
struct felix *felix = ocelot_to_felix(ocelot);
406+
struct ocelot_vcap_block *block_vcap_is2;
406407
struct ocelot_vcap_filter *trap;
407408
enum ocelot_mask_mode mask_mode;
408409
unsigned long port_mask;
@@ -422,9 +423,13 @@ static int felix_update_trapping_destinations(struct dsa_switch *ds,
422423
/* We are sure that "cpu" was found, otherwise
423424
* dsa_tree_setup_default_cpu() would have failed earlier.
424425
*/
426+
block_vcap_is2 = &ocelot->block[VCAP_IS2];
425427

426428
/* Make sure all traps are set up for that destination */
427-
list_for_each_entry(trap, &ocelot->traps, trap_list) {
429+
list_for_each_entry(trap, &block_vcap_is2->rules, list) {
430+
if (!trap->is_trap)
431+
continue;
432+
428433
/* Figure out the current trapping destination */
429434
if (using_tag_8021q) {
430435
/* Redirect to the tag_8021q CPU port. If timestamps

‎drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -449,7 +449,7 @@ static int aq_pm_freeze(struct device *dev)
449449

450450
static int aq_pm_suspend_poweroff(struct device *dev)
451451
{
452-
return aq_suspend_common(dev, false);
452+
return aq_suspend_common(dev, true);
453453
}
454454

455455
static int aq_pm_thaw(struct device *dev)
@@ -459,7 +459,7 @@ static int aq_pm_thaw(struct device *dev)
459459

460460
static int aq_pm_resume_restore(struct device *dev)
461461
{
462-
return atl_resume_common(dev, false);
462+
return atl_resume_common(dev, true);
463463
}
464464

465465
static const struct dev_pm_ops aq_pm_ops = {

‎drivers/net/ethernet/aquantia/atlantic/aq_ring.c‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -346,7 +346,6 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
346346
int budget)
347347
{
348348
struct net_device *ndev = aq_nic_get_ndev(self->aq_nic);
349-
bool is_rsc_completed = true;
350349
int err = 0;
351350

352351
for (; (self->sw_head != self->hw_head) && budget;
@@ -364,31 +363,35 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
364363
continue;
365364

366365
if (!buff->is_eop) {
366+
unsigned int frag_cnt = 0U;
367367
buff_ = buff;
368368
do {
369+
bool is_rsc_completed = true;
370+
369371
if (buff_->next >= self->size) {
370372
err = -EIO;
371373
goto err_exit;
372374
}
375+
376+
frag_cnt++;
373377
next_ = buff_->next,
374378
buff_ = &self->buff_ring[next_];
375379
is_rsc_completed =
376380
aq_ring_dx_in_range(self->sw_head,
377381
next_,
378382
self->hw_head);
379383

380-
if (unlikely(!is_rsc_completed))
381-
break;
384+
if (unlikely(!is_rsc_completed) ||
385+
frag_cnt > MAX_SKB_FRAGS) {
386+
err = 0;
387+
goto err_exit;
388+
}
382389

383390
buff->is_error |= buff_->is_error;
384391
buff->is_cso_err |= buff_->is_cso_err;
385392

386393
} while (!buff_->is_eop);
387394

388-
if (!is_rsc_completed) {
389-
err = 0;
390-
goto err_exit;
391-
}
392395
if (buff->is_error ||
393396
(buff->is_lro && buff->is_cso_err)) {
394397
buff_ = buff;
@@ -446,7 +449,7 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
446449
ALIGN(hdr_len, sizeof(long)));
447450

448451
if (buff->len - hdr_len > 0) {
449-
skb_add_rx_frag(skb, 0, buff->rxdata.page,
452+
skb_add_rx_frag(skb, i++, buff->rxdata.page,
450453
buff->rxdata.pg_off + hdr_len,
451454
buff->len - hdr_len,
452455
AQ_CFG_RX_FRAME_MAX);
@@ -455,7 +458,6 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
455458

456459
if (!buff->is_eop) {
457460
buff_ = buff;
458-
i = 1U;
459461
do {
460462
next_ = buff_->next;
461463
buff_ = &self->buff_ring[next_];

‎drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -889,6 +889,13 @@ int hw_atl_b0_hw_ring_tx_head_update(struct aq_hw_s *self,
889889
err = -ENXIO;
890890
goto err_exit;
891891
}
892+
893+
/* Validate that the new hw_head_ is reasonable. */
894+
if (hw_head_ >= ring->size) {
895+
err = -ENXIO;
896+
goto err_exit;
897+
}
898+
892899
ring->hw_head = hw_head_;
893900
err = aq_hw_err_from_flags(self);
894901

‎drivers/net/ethernet/broadcom/genet/bcmgenet.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3999,6 +3999,10 @@ static int bcmgenet_probe(struct platform_device *pdev)
39993999
goto err;
40004000
}
40014001
priv->wol_irq = platform_get_irq_optional(pdev, 2);
4002+
if (priv->wol_irq == -EPROBE_DEFER) {
4003+
err = priv->wol_irq;
4004+
goto err;
4005+
}
40024006

40034007
priv->base = devm_platform_ioremap_resource(pdev, 0);
40044008
if (IS_ERR(priv->base)) {

‎drivers/net/ethernet/chelsio/cxgb4/t4_hw.c‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2793,14 +2793,14 @@ int t4_get_raw_vpd_params(struct adapter *adapter, struct vpd_params *p)
27932793
goto out;
27942794
na = ret;
27952795

2796-
memcpy(p->id, vpd + id, min_t(int, id_len, ID_LEN));
2796+
memcpy(p->id, vpd + id, min_t(unsigned int, id_len, ID_LEN));
27972797
strim(p->id);
2798-
memcpy(p->sn, vpd + sn, min_t(int, sn_len, SERNUM_LEN));
2798+
memcpy(p->sn, vpd + sn, min_t(unsigned int, sn_len, SERNUM_LEN));
27992799
strim(p->sn);
2800-
memcpy(p->pn, vpd + pn, min_t(int, pn_len, PN_LEN));
2800+
memcpy(p->pn, vpd + pn, min_t(unsigned int, pn_len, PN_LEN));
28012801
strim(p->pn);
2802-
memcpy(p->na, vpd + na, min_t(int, na_len, MACADDR_LEN));
2803-
strim((char *)p->na);
2802+
memcpy(p->na, vpd + na, min_t(unsigned int, na_len, MACADDR_LEN));
2803+
strim(p->na);
28042804

28052805
out:
28062806
vfree(vpd);

‎drivers/net/ethernet/dec/tulip/tulip_core.c‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1399,8 +1399,10 @@ static int tulip_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
13991399

14001400
/* alloc_etherdev ensures aligned and zeroed private structures */
14011401
dev = alloc_etherdev (sizeof (*tp));
1402-
if (!dev)
1402+
if (!dev) {
1403+
pci_disable_device(pdev);
14031404
return -ENOMEM;
1405+
}
14041406

14051407
SET_NETDEV_DEV(dev, &pdev->dev);
14061408
if (pci_resource_len (pdev, 0) < tulip_tbl[chip_idx].io_size) {
@@ -1785,6 +1787,7 @@ static int tulip_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
17851787

17861788
err_out_free_netdev:
17871789
free_netdev (dev);
1790+
pci_disable_device(pdev);
17881791
return -ENODEV;
17891792
}
17901793

0 commit comments

Comments
 (0)