Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'net-6.1-rc9' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski:
"Including fixes from bluetooth, can and netfilter.
Current release - new code bugs:
- bonding: ipv6: correct address used in Neighbour Advertisement
parsing (src vs dst typo)
- fec: properly scope IRQ coalesce setup during link up to supported
chips only
Previous releases - regressions:
- Bluetooth fixes for fake CSR clones (knockoffs):
- re-add ERR_DATA_REPORTING quirk
- fix crash when device is replugged
- Bluetooth:
- silence a user-triggerable dmesg error message
- L2CAP: fix u8 overflow, oob access
- correct vendor codec definition
- fix support for Read Local Supported Codecs V2
- ti: am65-cpsw: fix RGMII configuration at SPEED_10
- mana: fix race on per-CQ variable NAPI work_done
Previous releases - always broken:
- af_unix: diag: fetch user_ns from in_skb in unix_diag_get_exact(),
avoid null-deref
- af_can: fix NULL pointer dereference in can_rcv_filter
- can: slcan: fix UAF with a freed work
- can: can327: flush TX_work on ldisc .close()
- macsec: add missing attribute validation for offload
- ipv6: avoid use-after-free in ip6_fragment()
- nft_set_pipapo: actually validate intervals in fields after the
first one
- mvneta: prevent oob access in mvneta_config_rss()
- ipv4: fix incorrect route flushing when table ID 0 is used, or when
source address is deleted
- phy: mxl-gpy: add workaround for IRQ bug on GPY215B and GPY215C"
* tag 'net-6.1-rc9' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (77 commits)
net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing()
s390/qeth: fix use-after-free in hsci
macsec: add missing attribute validation for offload
net: mvneta: Fix an out of bounds check
net: thunderbolt: fix memory leak in tbnet_open()
ipv6: avoid use-after-free in ip6_fragment()
net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq()
net: phy: mxl-gpy: add MDINT workaround
net: dsa: mv88e6xxx: accept phy-mode = "internal" for internal PHY ports
xen/netback: don't call kfree_skb() under spin_lock_irqsave()
dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove()
ethernet: aeroflex: fix potential skb leak in greth_init_rings()
tipc: call tipc_lxc_xmit without holding node_read_lock
can: esd_usb: Allow REC and TEC to return to zero
can: can327: flush TX_work on ldisc .close()
can: slcan: fix freed work crash
can: af_can: fix NULL pointer dereference in can_rcv_filter
net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions()
ipv4: Fix incorrect route flushing when table ID 0 is used
ipv4: Fix incorrect route flushing when source address is deleted
...
+643
-164
+1
.clang-format
+1
.clang-format
+6
drivers/bluetooth/btusb.c
+6
drivers/bluetooth/btusb.c
···
2056
2056
2057
2057
rp = (struct hci_rp_read_local_version *)skb->data;
2058
2058
2059
+
bt_dev_info(hdev, "CSR: Setting up dongle with HCI ver=%u rev=%04x; LMP ver=%u subver=%04x; manufacturer=%u",
2060
+
le16_to_cpu(rp->hci_ver), le16_to_cpu(rp->hci_rev),
2061
+
le16_to_cpu(rp->lmp_ver), le16_to_cpu(rp->lmp_subver),
2062
+
le16_to_cpu(rp->manufacturer));
2063
+
2059
2064
/* Detect a wide host of Chinese controllers that aren't CSR.
2060
2065
*
2061
2066
* Known fake bcdDevices: 0x0100, 0x0134, 0x1915, 0x2520, 0x7558, 0x8891
···
2123
2118
* without these the controller will lock up.
2124
2119
*/
2125
2120
set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
2121
+
set_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks);
2126
2122
set_bit(HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, &hdev->quirks);
2127
2123
set_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks);
2128
2124
+1
-1
drivers/net/bonding/bond_main.c
+1
-1
drivers/net/bonding/bond_main.c
···
3247
3247
goto out;
3248
3248
3249
3249
saddr = &combined->ip6.saddr;
3250
-
daddr = &combined->ip6.saddr;
3250
+
daddr = &combined->ip6.daddr;
3251
3251
3252
3252
slave_dbg(bond->dev, slave->dev, "%s: %s/%d av %d sv %d sip %pI6c tip %pI6c\n",
3253
3253
__func__, slave->dev->name, bond_slave_state(slave),
+10
-7
drivers/net/can/can327.c
+10
-7
drivers/net/can/can327.c
···
796
796
797
797
netif_stop_queue(dev);
798
798
799
-
/* Give UART one final chance to flush. */
800
-
clear_bit(TTY_DO_WRITE_WAKEUP, &elm->tty->flags);
801
-
flush_work(&elm->tx_work);
799
+
/* We don't flush the UART TX queue here, as we want final stop
800
+
* commands (like the above dummy char) to be flushed out.
801
+
*/
802
802
803
803
can_rx_offload_disable(&elm->offload);
804
804
elm->can.state = CAN_STATE_STOPPED;
···
1069
1069
{
1070
1070
struct can327 *elm = (struct can327 *)tty->disc_data;
1071
1071
1072
-
/* unregister_netdev() calls .ndo_stop() so we don't have to.
1073
-
* Our .ndo_stop() also flushes the TTY write wakeup handler,
1074
-
* so we can safely set elm->tty = NULL after this.
1075
-
*/
1072
+
/* unregister_netdev() calls .ndo_stop() so we don't have to. */
1076
1073
unregister_candev(elm->dev);
1074
+
1075
+
/* Give UART one final chance to flush.
1076
+
* No need to clear TTY_DO_WRITE_WAKEUP since .write_wakeup() is
1077
+
* serialised against .close() and will not be called once we return.
1078
+
*/
1079
+
flush_work(&elm->tx_work);
1077
1080
1078
1081
/* Mark channel as dead */
1079
1082
spin_lock_bh(&elm->lock);
+6
-4
drivers/net/can/slcan/slcan-core.c
+6
-4
drivers/net/can/slcan/slcan-core.c
···
864
864
{
865
865
struct slcan *sl = (struct slcan *)tty->disc_data;
866
866
867
-
/* unregister_netdev() calls .ndo_stop() so we don't have to.
868
-
* Our .ndo_stop() also flushes the TTY write wakeup handler,
869
-
* so we can safely set sl->tty = NULL after this.
870
-
*/
871
867
unregister_candev(sl->dev);
868
+
869
+
/*
870
+
* The netdev needn't be UP (so .ndo_stop() is not called). Hence make
871
+
* sure this is not running before freeing it up.
872
+
*/
873
+
flush_work(&sl->tx_work);
872
874
873
875
/* Mark channel as dead */
874
876
spin_lock_bh(&sl->lock);
+6
drivers/net/can/usb/esd_usb.c
+6
drivers/net/can/usb/esd_usb.c
···
234
234
u8 rxerr = msg->msg.rx.data[2];
235
235
u8 txerr = msg->msg.rx.data[3];
236
236
237
+
netdev_dbg(priv->netdev,
238
+
"CAN_ERR_EV_EXT: dlc=%#02x state=%02x ecc=%02x rec=%02x tec=%02x\n",
239
+
msg->msg.rx.dlc, state, ecc, rxerr, txerr);
240
+
237
241
skb = alloc_can_err_skb(priv->netdev, &cf);
238
242
if (skb == NULL) {
239
243
stats->rx_dropped++;
···
264
260
break;
265
261
default:
266
262
priv->can.state = CAN_STATE_ERROR_ACTIVE;
263
+
txerr = 0;
264
+
rxerr = 0;
267
265
break;
268
266
}
269
267
} else {
+5
-2
drivers/net/dsa/mv88e6xxx/chip.c
+5
-2
drivers/net/dsa/mv88e6xxx/chip.c
···
833
833
834
834
chip->info->ops->phylink_get_caps(chip, port, config);
835
835
836
-
/* Internal ports need GMII for PHYLIB */
837
-
if (mv88e6xxx_phy_is_internal(ds, port))
836
+
if (mv88e6xxx_phy_is_internal(ds, port)) {
837
+
__set_bit(PHY_INTERFACE_MODE_INTERNAL,
838
+
config->supported_interfaces);
839
+
/* Internal ports with no phy-mode need GMII for PHYLIB */
838
840
__set_bit(PHY_INTERFACE_MODE_GMII,
839
841
config->supported_interfaces);
842
+
}
840
843
}
841
844
842
845
static void mv88e6xxx_mac_config(struct dsa_switch *ds, int port,
+2
drivers/net/dsa/sja1105/sja1105_devlink.c
+2
drivers/net/dsa/sja1105/sja1105_devlink.c
+1
-1
drivers/net/dsa/sja1105/sja1105_main.c
+1
-1
drivers/net/dsa/sja1105/sja1105_main.c
+1
drivers/net/ethernet/aeroflex/greth.c
+1
drivers/net/ethernet/aeroflex/greth.c
+2
-1
drivers/net/ethernet/broadcom/Kconfig
+2
-1
drivers/net/ethernet/broadcom/Kconfig
···
71
71
config BCMGENET
72
72
tristate "Broadcom GENET internal MAC support"
73
73
depends on HAS_IOMEM
74
+
depends on PTP_1588_CLOCK_OPTIONAL || !ARCH_BCM2835
74
75
select MII
75
76
select PHYLIB
76
77
select FIXED_PHY
77
78
select BCM7XXX_PHY
78
79
select MDIO_BCM_UNIMAC
79
80
select DIMLIB
80
-
select BROADCOM_PHY if (ARCH_BCM2835 && PTP_1588_CLOCK_OPTIONAL)
81
+
select BROADCOM_PHY if ARCH_BCM2835
81
82
help
82
83
This driver supports the built-in Ethernet MACs found in the
83
84
Broadcom BCM7xxx Set Top Box family chipset.
+3
-1
drivers/net/ethernet/cavium/thunder/nicvf_main.c
+3
-1
drivers/net/ethernet/cavium/thunder/nicvf_main.c
···
2239
2239
err = register_netdev(netdev);
2240
2240
if (err) {
2241
2241
dev_err(dev, "Failed to register netdevice\n");
2242
-
goto err_unregister_interrupts;
2242
+
goto err_destroy_workqueue;
2243
2243
}
2244
2244
2245
2245
nic->msg_enable = debug;
···
2248
2248
2249
2249
return 0;
2250
2250
2251
+
err_destroy_workqueue:
2252
+
destroy_workqueue(nic->nicvf_rx_mode_wq);
2251
2253
err_unregister_interrupts:
2252
2254
nicvf_unregister_interrupts(nic);
2253
2255
err_free_netdev:
+4
drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-flower.c
+4
drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-flower.c
···
132
132
DMA_TO_DEVICE);
133
133
if (unlikely(dma_mapping_error(dev, acl_entry_cfg->key_iova))) {
134
134
dev_err(dev, "DMA mapping failed\n");
135
+
kfree(cmd_buff);
135
136
return -EFAULT;
136
137
}
137
138
···
143
142
DMA_TO_DEVICE);
144
143
if (err) {
145
144
dev_err(dev, "dpsw_acl_add_entry() failed %d\n", err);
145
+
kfree(cmd_buff);
146
146
return err;
147
147
}
148
148
···
174
172
DMA_TO_DEVICE);
175
173
if (unlikely(dma_mapping_error(dev, acl_entry_cfg->key_iova))) {
176
174
dev_err(dev, "DMA mapping failed\n");
175
+
kfree(cmd_buff);
177
176
return -EFAULT;
178
177
}
179
178
···
185
182
DMA_TO_DEVICE);
186
183
if (err) {
187
184
dev_err(dev, "dpsw_acl_remove_entry() failed %d\n", err);
185
+
kfree(cmd_buff);
188
186
return err;
189
187
}
190
188
+2
-1
drivers/net/ethernet/freescale/fec_main.c
+2
-1
drivers/net/ethernet/freescale/fec_main.c
···
1220
1220
writel(0, fep->hwp + FEC_IMASK);
1221
1221
1222
1222
/* Init the interrupt coalescing */
1223
-
fec_enet_itr_coal_set(ndev);
1223
+
if (fep->quirks & FEC_QUIRK_HAS_COALESCE)
1224
+
fec_enet_itr_coal_set(ndev);
1224
1225
}
1225
1226
1226
1227
static int fec_enet_ipc_handle_init(struct fec_enet_private *fep)
+1
-1
drivers/net/ethernet/hisilicon/hisi_femac.c
+1
-1
drivers/net/ethernet/hisilicon/hisi_femac.c
+1
-1
drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+1
-1
drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+2
-2
drivers/net/ethernet/intel/e1000e/netdev.c
+2
-2
drivers/net/ethernet/intel/e1000e/netdev.c
···
5936
5936
e1000_tx_queue(tx_ring, tx_flags, count);
5937
5937
/* Make sure there is space in the ring for the next send. */
5938
5938
e1000_maybe_stop_tx(tx_ring,
5939
-
(MAX_SKB_FRAGS *
5939
+
((MAX_SKB_FRAGS + 1) *
5940
5940
DIV_ROUND_UP(PAGE_SIZE,
5941
-
adapter->tx_fifo_limit) + 2));
5941
+
adapter->tx_fifo_limit) + 4));
5942
5942
5943
5943
if (!netdev_xmit_more() ||
5944
5944
netif_xmit_stopped(netdev_get_tx_queue(netdev, 0))) {
+2
-10
drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+2
-10
drivers/net/ethernet/intel/i40e/i40e_ethtool.c
···
4464
4464
return -EOPNOTSUPP;
4465
4465
4466
4466
/* First 4 bytes of L4 header */
4467
-
if (usr_ip4_spec->l4_4_bytes == htonl(0xFFFFFFFF))
4468
-
new_mask |= I40E_L4_SRC_MASK | I40E_L4_DST_MASK;
4469
-
else if (!usr_ip4_spec->l4_4_bytes)
4470
-
new_mask &= ~(I40E_L4_SRC_MASK | I40E_L4_DST_MASK);
4471
-
else
4467
+
if (usr_ip4_spec->l4_4_bytes)
4472
4468
return -EOPNOTSUPP;
4473
4469
4474
4470
/* Filtering on Type of Service is not supported. */
···
4503
4507
else
4504
4508
return -EOPNOTSUPP;
4505
4509
4506
-
if (usr_ip6_spec->l4_4_bytes == htonl(0xFFFFFFFF))
4507
-
new_mask |= I40E_L4_SRC_MASK | I40E_L4_DST_MASK;
4508
-
else if (!usr_ip6_spec->l4_4_bytes)
4509
-
new_mask &= ~(I40E_L4_SRC_MASK | I40E_L4_DST_MASK);
4510
-
else
4510
+
if (usr_ip6_spec->l4_4_bytes)
4511
4511
return -EOPNOTSUPP;
4512
4512
4513
4513
/* Filtering on Traffic class is not supported. */
+18
-1
drivers/net/ethernet/intel/i40e/i40e_main.c
+18
-1
drivers/net/ethernet/intel/i40e/i40e_main.c
···
10655
10655
}
10656
10656
10657
10657
/**
10658
+
* i40e_clean_xps_state - clean xps state for every tx_ring
10659
+
* @vsi: ptr to the VSI
10660
+
**/
10661
+
static void i40e_clean_xps_state(struct i40e_vsi *vsi)
10662
+
{
10663
+
int i;
10664
+
10665
+
if (vsi->tx_rings)
10666
+
for (i = 0; i < vsi->num_queue_pairs; i++)
10667
+
if (vsi->tx_rings[i])
10668
+
clear_bit(__I40E_TX_XPS_INIT_DONE,
10669
+
vsi->tx_rings[i]->state);
10670
+
}
10671
+
10672
+
/**
10658
10673
* i40e_prep_for_reset - prep for the core to reset
10659
10674
* @pf: board private structure
10660
10675
*
···
10693
10678
i40e_pf_quiesce_all_vsi(pf);
10694
10679
10695
10680
for (v = 0; v < pf->num_alloc_vsi; v++) {
10696
-
if (pf->vsi[v])
10681
+
if (pf->vsi[v]) {
10682
+
i40e_clean_xps_state(pf->vsi[v]);
10697
10683
pf->vsi[v]->seid = 0;
10684
+
}
10698
10685
}
10699
10686
10700
10687
i40e_shutdown_adminq(&pf->hw);
+2
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+2
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
···
1578
1578
i40e_cleanup_reset_vf(vf);
1579
1579
1580
1580
i40e_flush(hw);
1581
+
usleep_range(20000, 40000);
1581
1582
clear_bit(I40E_VF_STATE_RESETTING, &vf->vf_states);
1582
1583
1583
1584
return true;
···
1702
1701
}
1703
1702
1704
1703
i40e_flush(hw);
1704
+
usleep_range(20000, 40000);
1705
1705
clear_bit(__I40E_VF_DISABLE, pf->state);
1706
1706
1707
1707
return true;
+2
drivers/net/ethernet/intel/igb/igb_ethtool.c
+2
drivers/net/ethernet/intel/igb/igb_ethtool.c
+1
-1
drivers/net/ethernet/marvell/mvneta.c
+1
-1
drivers/net/ethernet/marvell/mvneta.c
···
4271
4271
/* Use the cpu associated to the rxq when it is online, in all
4272
4272
* the other cases, use the cpu 0 which can't be offline.
4273
4273
*/
4274
-
if (cpu_online(pp->rxq_def))
4274
+
if (pp->rxq_def < nr_cpu_ids && cpu_online(pp->rxq_def))
4275
4275
elected_cpu = pp->rxq_def;
4276
4276
4277
4277
max_cpu = num_present_cpus();
+6
-1
drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
+6
-1
drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
···
1134
1134
return err;
1135
1135
1136
1136
tc->flow_ht_params = tc_flow_ht_params;
1137
-
return rhashtable_init(&tc->flow_table, &tc->flow_ht_params);
1137
+
err = rhashtable_init(&tc->flow_table, &tc->flow_ht_params);
1138
+
if (err) {
1139
+
kfree(tc->tc_entries_bitmap);
1140
+
tc->tc_entries_bitmap = NULL;
1141
+
}
1142
+
return err;
1138
1143
}
1139
1144
EXPORT_SYMBOL(otx2_init_tc);
1140
1145
+2
-2
drivers/net/ethernet/microchip/encx24j600-regmap.c
+2
-2
drivers/net/ethernet/microchip/encx24j600-regmap.c
···
359
359
goto err_out;
360
360
361
361
usleep_range(26, 100);
362
-
while ((ret = regmap_read(ctx->regmap, MISTAT, &mistat) != 0) &&
362
+
while (((ret = regmap_read(ctx->regmap, MISTAT, &mistat)) == 0) &&
363
363
(mistat & BUSY))
364
364
cpu_relax();
365
365
···
397
397
goto err_out;
398
398
399
399
usleep_range(26, 100);
400
-
while ((ret = regmap_read(ctx->regmap, MISTAT, &mistat) != 0) &&
400
+
while (((ret = regmap_read(ctx->regmap, MISTAT, &mistat)) == 0) &&
401
401
(mistat & BUSY))
402
402
cpu_relax();
403
403
+1
-1
drivers/net/ethernet/microchip/sparx5/sparx5_fdma.c
+1
-1
drivers/net/ethernet/microchip/sparx5/sparx5_fdma.c
···
317
317
next_dcb_hw = sparx5_fdma_next_dcb(tx, tx->curr_entry);
318
318
db_hw = &next_dcb_hw->db[0];
319
319
if (!(db_hw->status & FDMA_DCB_STATUS_DONE))
320
-
tx->dropped++;
320
+
return -EINVAL;
321
321
db = list_first_entry(&tx->db_list, struct sparx5_db, list);
322
322
list_move_tail(&db->list, &tx->db_list);
323
323
next_dcb_hw->nextptr = FDMA_DCB_INVALID_DATA;
+3
drivers/net/ethernet/microchip/sparx5/sparx5_main.c
+3
drivers/net/ethernet/microchip/sparx5/sparx5_main.c
···
887
887
888
888
cleanup_ports:
889
889
sparx5_cleanup_ports(sparx5);
890
+
if (sparx5->mact_queue)
891
+
destroy_workqueue(sparx5->mact_queue);
890
892
cleanup_config:
891
893
kfree(configs);
892
894
cleanup_pnode:
···
913
911
sparx5_cleanup_ports(sparx5);
914
912
/* Unregister netdevs */
915
913
sparx5_unregister_notifier_blocks(sparx5);
914
+
destroy_workqueue(sparx5->mact_queue);
916
915
917
916
return 0;
918
917
}
+24
-17
drivers/net/ethernet/microchip/sparx5/sparx5_packet.c
+24
-17
drivers/net/ethernet/microchip/sparx5/sparx5_packet.c
···
234
234
sparx5_set_port_ifh(ifh, port->portno);
235
235
236
236
if (sparx5->ptp && skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
237
-
ret = sparx5_ptp_txtstamp_request(port, skb);
238
-
if (ret)
239
-
return ret;
237
+
if (sparx5_ptp_txtstamp_request(port, skb) < 0)
238
+
return NETDEV_TX_BUSY;
240
239
241
240
sparx5_set_port_ifh_rew_op(ifh, SPARX5_SKB_CB(skb)->rew_op);
242
241
sparx5_set_port_ifh_pdu_type(ifh, SPARX5_SKB_CB(skb)->pdu_type);
···
249
250
else
250
251
ret = sparx5_inject(sparx5, ifh, skb, dev);
251
252
252
-
if (ret == NETDEV_TX_OK) {
253
-
stats->tx_bytes += skb->len;
254
-
stats->tx_packets++;
253
+
if (ret == -EBUSY)
254
+
goto busy;
255
+
if (ret < 0)
256
+
goto drop;
255
257
256
-
if (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP &&
257
-
SPARX5_SKB_CB(skb)->rew_op == IFH_REW_OP_TWO_STEP_PTP)
258
-
return ret;
258
+
stats->tx_bytes += skb->len;
259
+
stats->tx_packets++;
260
+
sparx5->tx.packets++;
259
261
260
-
dev_kfree_skb_any(skb);
261
-
} else {
262
-
stats->tx_dropped++;
262
+
if (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP &&
263
+
SPARX5_SKB_CB(skb)->rew_op == IFH_REW_OP_TWO_STEP_PTP)
264
+
return NETDEV_TX_OK;
263
265
264
-
if (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP &&
265
-
SPARX5_SKB_CB(skb)->rew_op == IFH_REW_OP_TWO_STEP_PTP)
266
-
sparx5_ptp_txtstamp_release(port, skb);
267
-
}
268
-
return ret;
266
+
dev_consume_skb_any(skb);
267
+
return NETDEV_TX_OK;
268
+
drop:
269
+
stats->tx_dropped++;
270
+
sparx5->tx.dropped++;
271
+
dev_kfree_skb_any(skb);
272
+
return NETDEV_TX_OK;
273
+
busy:
274
+
if (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP &&
275
+
SPARX5_SKB_CB(skb)->rew_op == IFH_REW_OP_TWO_STEP_PTP)
276
+
sparx5_ptp_txtstamp_release(port, skb);
277
+
return NETDEV_TX_BUSY;
269
278
}
270
279
271
280
static enum hrtimer_restart sparx5_injection_timeout(struct hrtimer *tmr)
+8
-1
drivers/net/ethernet/microsoft/mana/gdma.h
+8
-1
drivers/net/ethernet/microsoft/mana/gdma.h
···
498
498
499
499
#define GDMA_DRV_CAP_FLAG_1_EQ_SHARING_MULTI_VPORT BIT(0)
500
500
501
-
#define GDMA_DRV_CAP_FLAGS1 GDMA_DRV_CAP_FLAG_1_EQ_SHARING_MULTI_VPORT
501
+
/* Advertise to the NIC firmware: the NAPI work_done variable race is fixed,
502
+
* so the driver is able to reliably support features like busy_poll.
503
+
*/
504
+
#define GDMA_DRV_CAP_FLAG_1_NAPI_WKDONE_FIX BIT(2)
505
+
506
+
#define GDMA_DRV_CAP_FLAGS1 \
507
+
(GDMA_DRV_CAP_FLAG_1_EQ_SHARING_MULTI_VPORT | \
508
+
GDMA_DRV_CAP_FLAG_1_NAPI_WKDONE_FIX)
502
509
503
510
#define GDMA_DRV_CAP_FLAGS2 0
504
511
+11
-5
drivers/net/ethernet/microsoft/mana/mana_en.c
+11
-5
drivers/net/ethernet/microsoft/mana/mana_en.c
···
1303
1303
xdp_do_flush();
1304
1304
}
1305
1305
1306
-
static void mana_cq_handler(void *context, struct gdma_queue *gdma_queue)
1306
+
static int mana_cq_handler(void *context, struct gdma_queue *gdma_queue)
1307
1307
{
1308
1308
struct mana_cq *cq = context;
1309
1309
u8 arm_bit;
1310
+
int w;
1310
1311
1311
1312
WARN_ON_ONCE(cq->gdma_cq != gdma_queue);
1312
1313
···
1316
1315
else
1317
1316
mana_poll_tx_cq(cq);
1318
1317
1319
-
if (cq->work_done < cq->budget &&
1320
-
napi_complete_done(&cq->napi, cq->work_done)) {
1318
+
w = cq->work_done;
1319
+
1320
+
if (w < cq->budget &&
1321
+
napi_complete_done(&cq->napi, w)) {
1321
1322
arm_bit = SET_ARM_BIT;
1322
1323
} else {
1323
1324
arm_bit = 0;
1324
1325
}
1325
1326
1326
1327
mana_gd_ring_cq(gdma_queue, arm_bit);
1328
+
1329
+
return w;
1327
1330
}
1328
1331
1329
1332
static int mana_poll(struct napi_struct *napi, int budget)
1330
1333
{
1331
1334
struct mana_cq *cq = container_of(napi, struct mana_cq, napi);
1335
+
int w;
1332
1336
1333
1337
cq->work_done = 0;
1334
1338
cq->budget = budget;
1335
1339
1336
-
mana_cq_handler(cq, cq->gdma_cq);
1340
+
w = mana_cq_handler(cq, cq->gdma_cq);
1337
1341
1338
-
return min(cq->work_done, budget);
1342
+
return min(w, budget);
1339
1343
}
1340
1344
1341
1345
static void mana_schedule_napi(void *context, struct gdma_queue *gdma_queue)
+3
-3
drivers/net/ethernet/netronome/nfp/nfdk/dp.c
+3
-3
drivers/net/ethernet/netronome/nfp/nfdk/dp.c
···
282
282
dma_len = skb_headlen(skb);
283
283
if (skb_is_gso(skb))
284
284
type = NFDK_DESC_TX_TYPE_TSO;
285
-
else if (!nr_frags && dma_len < NFDK_TX_MAX_DATA_PER_HEAD)
285
+
else if (!nr_frags && dma_len <= NFDK_TX_MAX_DATA_PER_HEAD)
286
286
type = NFDK_DESC_TX_TYPE_SIMPLE;
287
287
else
288
288
type = NFDK_DESC_TX_TYPE_GATHER;
···
927
927
dma_len = pkt_len;
928
928
dma_addr = rxbuf->dma_addr + dma_off;
929
929
930
-
if (dma_len < NFDK_TX_MAX_DATA_PER_HEAD)
930
+
if (dma_len <= NFDK_TX_MAX_DATA_PER_HEAD)
931
931
type = NFDK_DESC_TX_TYPE_SIMPLE;
932
932
else
933
933
type = NFDK_DESC_TX_TYPE_GATHER;
···
1325
1325
txbuf = &tx_ring->ktxbufs[wr_idx];
1326
1326
1327
1327
dma_len = skb_headlen(skb);
1328
-
if (dma_len < NFDK_TX_MAX_DATA_PER_HEAD)
1328
+
if (dma_len <= NFDK_TX_MAX_DATA_PER_HEAD)
1329
1329
type = NFDK_DESC_TX_TYPE_SIMPLE;
1330
1330
else
1331
1331
type = NFDK_DESC_TX_TYPE_GATHER;
+1
-1
drivers/net/ethernet/renesas/ravb_main.c
+1
-1
drivers/net/ethernet/renesas/ravb_main.c
+4
-4
drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+4
-4
drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
···
108
108
109
109
axi->axi_lpi_en = of_property_read_bool(np, "snps,lpi_en");
110
110
axi->axi_xit_frm = of_property_read_bool(np, "snps,xit_frm");
111
-
axi->axi_kbbe = of_property_read_bool(np, "snps,axi_kbbe");
112
-
axi->axi_fb = of_property_read_bool(np, "snps,axi_fb");
113
-
axi->axi_mb = of_property_read_bool(np, "snps,axi_mb");
114
-
axi->axi_rb = of_property_read_bool(np, "snps,axi_rb");
111
+
axi->axi_kbbe = of_property_read_bool(np, "snps,kbbe");
112
+
axi->axi_fb = of_property_read_bool(np, "snps,fb");
113
+
axi->axi_mb = of_property_read_bool(np, "snps,mb");
114
+
axi->axi_rb = of_property_read_bool(np, "snps,rb");
115
115
116
116
if (of_property_read_u32(np, "snps,wr_osr_lmt", &axi->axi_wr_osr_lmt))
117
117
axi->axi_wr_osr_lmt = 1;
+1
-1
drivers/net/ethernet/ti/am65-cpsw-nuss.c
+1
-1
drivers/net/ethernet/ti/am65-cpsw-nuss.c
···
1454
1454
1455
1455
if (speed == SPEED_1000)
1456
1456
mac_control |= CPSW_SL_CTL_GIG;
1457
-
if (speed == SPEED_10 && interface == PHY_INTERFACE_MODE_RGMII)
1457
+
if (speed == SPEED_10 && phy_interface_mode_is_rgmii(interface))
1458
1458
/* Can be used with in band mode only */
1459
1459
mac_control |= CPSW_SL_CTL_EXT_EN;
1460
1460
if (speed == SPEED_100 && interface == PHY_INTERFACE_MODE_RMII)
+1
-1
drivers/net/ieee802154/ca8210.c
+1
-1
drivers/net/ieee802154/ca8210.c
+1
-1
drivers/net/ieee802154/cc2520.c
+1
-1
drivers/net/ieee802154/cc2520.c
+1
drivers/net/macsec.c
+1
drivers/net/macsec.c
···
3698
3698
[IFLA_MACSEC_SCB] = { .type = NLA_U8 },
3699
3699
[IFLA_MACSEC_REPLAY_PROTECT] = { .type = NLA_U8 },
3700
3700
[IFLA_MACSEC_VALIDATION] = { .type = NLA_U8 },
3701
+
[IFLA_MACSEC_OFFLOAD] = { .type = NLA_U8 },
3701
3702
};
3702
3703
3703
3704
static void macsec_free_netdev(struct net_device *dev)
+3
-1
drivers/net/mdio/fwnode_mdio.c
+3
-1
drivers/net/mdio/fwnode_mdio.c
···
98
98
*/
99
99
rc = phy_device_register(phy);
100
100
if (rc) {
101
+
device_set_node(&phy->mdio.dev, NULL);
101
102
fwnode_handle_put(child);
102
103
return rc;
103
104
}
···
154
153
/* All data is now stored in the phy struct, so register it */
155
154
rc = phy_device_register(phy);
156
155
if (rc) {
157
-
fwnode_handle_put(phy->mdio.dev.fwnode);
156
+
phy->mdio.dev.fwnode = NULL;
157
+
fwnode_handle_put(child);
158
158
goto clean_phy;
159
159
}
160
160
} else if (is_of_node(child)) {
+2
-1
drivers/net/mdio/of_mdio.c
+2
-1
drivers/net/mdio/of_mdio.c
+2
drivers/net/phy/mdio_device.c
+2
drivers/net/phy/mdio_device.c
···
21
21
#include <linux/slab.h>
22
22
#include <linux/string.h>
23
23
#include <linux/unistd.h>
24
+
#include <linux/property.h>
24
25
25
26
void mdio_device_free(struct mdio_device *mdiodev)
26
27
{
···
31
30
32
31
static void mdio_device_release(struct device *dev)
33
32
{
33
+
fwnode_handle_put(dev->fwnode);
34
34
kfree(to_mdio_device(dev));
35
35
}
36
36
+85
drivers/net/phy/mxl-gpy.c
+85
drivers/net/phy/mxl-gpy.c
···
9
9
#include <linux/module.h>
10
10
#include <linux/bitfield.h>
11
11
#include <linux/hwmon.h>
12
+
#include <linux/mutex.h>
12
13
#include <linux/phy.h>
13
14
#include <linux/polynomial.h>
14
15
#include <linux/netdevice.h>
···
71
70
#define VPSPEC1_TEMP_STA 0x0E
72
71
#define VPSPEC1_TEMP_STA_DATA GENMASK(9, 0)
73
72
73
+
/* Mailbox */
74
+
#define VSPEC1_MBOX_DATA 0x5
75
+
#define VSPEC1_MBOX_ADDRLO 0x6
76
+
#define VSPEC1_MBOX_CMD 0x7
77
+
#define VSPEC1_MBOX_CMD_ADDRHI GENMASK(7, 0)
78
+
#define VSPEC1_MBOX_CMD_RD (0 << 8)
79
+
#define VSPEC1_MBOX_CMD_READY BIT(15)
80
+
74
81
/* WoL */
75
82
#define VPSPEC2_WOL_CTL 0x0E06
76
83
#define VPSPEC2_WOL_AD01 0x0E08
···
86
77
#define VPSPEC2_WOL_AD45 0x0E0A
87
78
#define WOL_EN BIT(0)
88
79
80
+
/* Internal registers, access via mbox */
81
+
#define REG_GPIO0_OUT 0xd3ce00
82
+
89
83
struct gpy_priv {
84
+
/* serialize mailbox acesses */
85
+
struct mutex mbox_lock;
86
+
90
87
u8 fw_major;
91
88
u8 fw_minor;
92
89
};
···
202
187
}
203
188
#endif
204
189
190
+
static int gpy_mbox_read(struct phy_device *phydev, u32 addr)
191
+
{
192
+
struct gpy_priv *priv = phydev->priv;
193
+
int val, ret;
194
+
u16 cmd;
195
+
196
+
mutex_lock(&priv->mbox_lock);
197
+
198
+
ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, VSPEC1_MBOX_ADDRLO,
199
+
addr);
200
+
if (ret)
201
+
goto out;
202
+
203
+
cmd = VSPEC1_MBOX_CMD_RD;
204
+
cmd |= FIELD_PREP(VSPEC1_MBOX_CMD_ADDRHI, addr >> 16);
205
+
206
+
ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, VSPEC1_MBOX_CMD, cmd);
207
+
if (ret)
208
+
goto out;
209
+
210
+
/* The mbox read is used in the interrupt workaround. It was observed
211
+
* that a read might take up to 2.5ms. This is also the time for which
212
+
* the interrupt line is stuck low. To be on the safe side, poll the
213
+
* ready bit for 10ms.
214
+
*/
215
+
ret = phy_read_mmd_poll_timeout(phydev, MDIO_MMD_VEND1,
216
+
VSPEC1_MBOX_CMD, val,
217
+
(val & VSPEC1_MBOX_CMD_READY),
218
+
500, 10000, false);
219
+
if (ret)
220
+
goto out;
221
+
222
+
ret = phy_read_mmd(phydev, MDIO_MMD_VEND1, VSPEC1_MBOX_DATA);
223
+
224
+
out:
225
+
mutex_unlock(&priv->mbox_lock);
226
+
return ret;
227
+
}
228
+
205
229
static int gpy_config_init(struct phy_device *phydev)
206
230
{
207
231
int ret;
···
253
199
/* Clear all pending interrupts */
254
200
ret = phy_read(phydev, PHY_ISTAT);
255
201
return ret < 0 ? ret : 0;
202
+
}
203
+
204
+
static bool gpy_has_broken_mdint(struct phy_device *phydev)
205
+
{
206
+
/* At least these PHYs are known to have broken interrupt handling */
207
+
return phydev->drv->phy_id == PHY_ID_GPY215B ||
208
+
phydev->drv->phy_id == PHY_ID_GPY215C;
256
209
}
257
210
258
211
static int gpy_probe(struct phy_device *phydev)
···
279
218
if (!priv)
280
219
return -ENOMEM;
281
220
phydev->priv = priv;
221
+
mutex_init(&priv->mbox_lock);
282
222
283
223
fw_version = phy_read(phydev, PHY_FWV);
284
224
if (fw_version < 0)
···
553
491
554
492
if (!(reg & PHY_IMASK_MASK))
555
493
return IRQ_NONE;
494
+
495
+
/* The PHY might leave the interrupt line asserted even after PHY_ISTAT
496
+
* is read. To avoid interrupt storms, delay the interrupt handling as
497
+
* long as the PHY drives the interrupt line. An internal bus read will
498
+
* stall as long as the interrupt line is asserted, thus just read a
499
+
* random register here.
500
+
* Because we cannot access the internal bus at all while the interrupt
501
+
* is driven by the PHY, there is no way to make the interrupt line
502
+
* unstuck (e.g. by changing the pinmux to GPIO input) during that time
503
+
* frame. Therefore, polling is the best we can do and won't do any more
504
+
* harm.
505
+
* It was observed that this bug happens on link state and link speed
506
+
* changes on a GPY215B and GYP215C independent of the firmware version
507
+
* (which doesn't mean that this list is exhaustive).
508
+
*/
509
+
if (gpy_has_broken_mdint(phydev) &&
510
+
(reg & (PHY_IMASK_LSTC | PHY_IMASK_LSPC))) {
511
+
reg = gpy_mbox_read(phydev, REG_GPIO0_OUT);
512
+
if (reg < 0) {
513
+
phy_error(phydev);
514
+
return IRQ_NONE;
515
+
}
516
+
}
556
517
557
518
phy_trigger_machine(phydev);
558
519
+2
-2
drivers/net/plip/plip.c
+2
-2
drivers/net/plip/plip.c
···
450
450
}
451
451
rcv->state = PLIP_PK_DONE;
452
452
if (rcv->skb) {
453
-
kfree_skb(rcv->skb);
453
+
dev_kfree_skb_irq(rcv->skb);
454
454
rcv->skb = NULL;
455
455
}
456
456
snd->state = PLIP_PK_DONE;
457
457
if (snd->skb) {
458
-
dev_kfree_skb(snd->skb);
458
+
dev_consume_skb_irq(snd->skb);
459
459
snd->skb = NULL;
460
460
}
461
461
spin_unlock_irq(&nl->lock);
+1
drivers/net/thunderbolt.c
+1
drivers/net/thunderbolt.c
+23
-4
drivers/net/vmxnet3/vmxnet3_drv.c
+23
-4
drivers/net/vmxnet3/vmxnet3_drv.c
···
75
75
76
76
for (i = 0; i < adapter->intr.num_intrs; i++)
77
77
vmxnet3_enable_intr(adapter, i);
78
-
adapter->shared->devRead.intrConf.intrCtrl &=
78
+
if (!VMXNET3_VERSION_GE_6(adapter) ||
79
+
!adapter->queuesExtEnabled) {
80
+
adapter->shared->devRead.intrConf.intrCtrl &=
79
81
cpu_to_le32(~VMXNET3_IC_DISABLE_ALL);
82
+
} else {
83
+
adapter->shared->devReadExt.intrConfExt.intrCtrl &=
84
+
cpu_to_le32(~VMXNET3_IC_DISABLE_ALL);
85
+
}
80
86
}
81
87
82
88
···
91
85
{
92
86
int i;
93
87
94
-
adapter->shared->devRead.intrConf.intrCtrl |=
88
+
if (!VMXNET3_VERSION_GE_6(adapter) ||
89
+
!adapter->queuesExtEnabled) {
90
+
adapter->shared->devRead.intrConf.intrCtrl |=
95
91
cpu_to_le32(VMXNET3_IC_DISABLE_ALL);
92
+
} else {
93
+
adapter->shared->devReadExt.intrConfExt.intrCtrl |=
94
+
cpu_to_le32(VMXNET3_IC_DISABLE_ALL);
95
+
}
96
96
for (i = 0; i < adapter->intr.num_intrs; i++)
97
97
vmxnet3_disable_intr(adapter, i);
98
98
}
···
1408
1396
};
1409
1397
u32 num_pkts = 0;
1410
1398
bool skip_page_frags = false;
1399
+
bool encap_lro = false;
1411
1400
struct Vmxnet3_RxCompDesc *rcd;
1412
1401
struct vmxnet3_rx_ctx *ctx = &rq->rx_ctx;
1413
1402
u16 segCnt = 0, mss = 0;
···
1569
1556
if (VMXNET3_VERSION_GE_2(adapter) &&
1570
1557
rcd->type == VMXNET3_CDTYPE_RXCOMP_LRO) {
1571
1558
struct Vmxnet3_RxCompDescExt *rcdlro;
1559
+
union Vmxnet3_GenericDesc *gdesc;
1560
+
1572
1561
rcdlro = (struct Vmxnet3_RxCompDescExt *)rcd;
1562
+
gdesc = (union Vmxnet3_GenericDesc *)rcd;
1573
1563
1574
1564
segCnt = rcdlro->segCnt;
1575
1565
WARN_ON_ONCE(segCnt == 0);
1576
1566
mss = rcdlro->mss;
1577
1567
if (unlikely(segCnt <= 1))
1578
1568
segCnt = 0;
1569
+
encap_lro = (le32_to_cpu(gdesc->dword[0]) &
1570
+
(1UL << VMXNET3_RCD_HDR_INNER_SHIFT));
1579
1571
} else {
1580
1572
segCnt = 0;
1581
1573
}
···
1648
1630
vmxnet3_rx_csum(adapter, skb,
1649
1631
(union Vmxnet3_GenericDesc *)rcd);
1650
1632
skb->protocol = eth_type_trans(skb, adapter->netdev);
1651
-
if (!rcd->tcp ||
1633
+
if ((!rcd->tcp && !encap_lro) ||
1652
1634
!(adapter->netdev->features & NETIF_F_LRO))
1653
1635
goto not_lro;
1654
1636
···
1657
1639
SKB_GSO_TCPV4 : SKB_GSO_TCPV6;
1658
1640
skb_shinfo(skb)->gso_size = mss;
1659
1641
skb_shinfo(skb)->gso_segs = segCnt;
1660
-
} else if (segCnt != 0 || skb->len > mtu) {
1642
+
} else if ((segCnt != 0 || skb->len > mtu) && !encap_lro) {
1661
1643
u32 hlen;
1662
1644
1663
1645
hlen = vmxnet3_get_hdr_len(adapter, skb,
···
1686
1668
napi_gro_receive(&rq->napi, skb);
1687
1669
1688
1670
ctx->skb = NULL;
1671
+
encap_lro = false;
1689
1672
num_pkts++;
1690
1673
}
1691
1674
+1
drivers/net/wwan/iosm/iosm_ipc_mux.c
+1
drivers/net/wwan/iosm/iosm_ipc_mux.c
+6
drivers/net/xen-netfront.c
+6
drivers/net/xen-netfront.c
+1
-1
drivers/s390/net/qeth_l2_main.c
+1
-1
drivers/s390/net/qeth_l2_main.c
···
758
758
struct list_head *iter;
759
759
int err = 0;
760
760
761
-
kfree(br2dev_event_work);
762
761
QETH_CARD_TEXT_(card, 4, "b2dw%04lx", event);
763
762
QETH_CARD_TEXT_(card, 4, "ma%012llx", ether_addr_to_u64(addr));
764
763
···
814
815
dev_put(brdev);
815
816
dev_put(lsyncdev);
816
817
dev_put(dstdev);
818
+
kfree(br2dev_event_work);
817
819
}
818
820
819
821
static int qeth_l2_br2dev_queue_work(struct net_device *brdev,
+11
-1
include/net/bluetooth/hci.h
+11
-1
include/net/bluetooth/hci.h
···
228
228
*/
229
229
HCI_QUIRK_VALID_LE_STATES,
230
230
231
+
/* When this quirk is set, then erroneous data reporting
232
+
* is ignored. This is mainly due to the fact that the HCI
233
+
* Read Default Erroneous Data Reporting command is advertised,
234
+
* but not supported; these controllers often reply with unknown
235
+
* command and tend to lock up randomly. Needing a hard reset.
236
+
*
237
+
* This quirk can be set before hci_register_dev is called or
238
+
* during the hdev->setup vendor callback.
239
+
*/
240
+
HCI_QUIRK_BROKEN_ERR_DATA_REPORTING,
241
+
231
242
/*
232
243
* When this quirk is set, then the hci_suspend_notifier is not
233
244
* registered. This is intended for devices which drop completely
···
1435
1424
} __packed;
1436
1425
1437
1426
struct hci_vnd_codec_v2 {
1438
-
__u8 id;
1439
1427
__le16 cid;
1440
1428
__le16 vid;
1441
1429
__u8 transport;
-3
include/net/ping.h
-3
include/net/ping.h
···
16
16
#define PING_HTABLE_SIZE 64
17
17
#define PING_HTABLE_MASK (PING_HTABLE_SIZE-1)
18
18
19
-
#define ping_portaddr_for_each_entry(__sk, node, list) \
20
-
hlist_nulls_for_each_entry(__sk, node, list, sk_nulls_node)
21
-
22
19
/*
23
20
* gid_t is either uint or ushort. We want to pass it to
24
21
* proc_dointvec_minmax(), so it must not be larger than MAX_INT
+1
net/bluetooth/6lowpan.c
+1
net/bluetooth/6lowpan.c
+3
-1
net/bluetooth/af_bluetooth.c
+3
-1
net/bluetooth/af_bluetooth.c
···
737
737
738
738
err = bt_sysfs_init();
739
739
if (err < 0)
740
-
return err;
740
+
goto cleanup_led;
741
741
742
742
err = sock_register(&bt_sock_family_ops);
743
743
if (err)
···
773
773
sock_unregister(PF_BLUETOOTH);
774
774
cleanup_sysfs:
775
775
bt_sysfs_cleanup();
776
+
cleanup_led:
777
+
bt_leds_cleanup();
776
778
return err;
777
779
}
778
780
+10
-9
net/bluetooth/hci_codec.c
+10
-9
net/bluetooth/hci_codec.c
···
72
72
continue;
73
73
}
74
74
75
-
skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_CODEC_CAPS,
76
-
sizeof(*cmd), cmd,
77
-
HCI_CMD_TIMEOUT);
75
+
skb = __hci_cmd_sync_sk(hdev, HCI_OP_READ_LOCAL_CODEC_CAPS,
76
+
sizeof(*cmd), cmd, 0, HCI_CMD_TIMEOUT, NULL);
78
77
if (IS_ERR(skb)) {
79
78
bt_dev_err(hdev, "Failed to read codec capabilities (%ld)",
80
79
PTR_ERR(skb));
···
126
127
struct hci_op_read_local_codec_caps caps;
127
128
__u8 i;
128
129
129
-
skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_CODECS, 0, NULL,
130
-
HCI_CMD_TIMEOUT);
130
+
skb = __hci_cmd_sync_sk(hdev, HCI_OP_READ_LOCAL_CODECS, 0, NULL,
131
+
0, HCI_CMD_TIMEOUT, NULL);
131
132
132
133
if (IS_ERR(skb)) {
133
134
bt_dev_err(hdev, "Failed to read local supported codecs (%ld)",
···
157
158
for (i = 0; i < std_codecs->num; i++) {
158
159
caps.id = std_codecs->codec[i];
159
160
caps.direction = 0x00;
160
-
hci_read_codec_capabilities(hdev, LOCAL_CODEC_ACL_MASK, &caps);
161
+
hci_read_codec_capabilities(hdev,
162
+
LOCAL_CODEC_ACL_MASK | LOCAL_CODEC_SCO_MASK, &caps);
161
163
}
162
164
163
165
skb_pull(skb, flex_array_size(std_codecs, codec, std_codecs->num)
···
178
178
caps.cid = vnd_codecs->codec[i].cid;
179
179
caps.vid = vnd_codecs->codec[i].vid;
180
180
caps.direction = 0x00;
181
-
hci_read_codec_capabilities(hdev, LOCAL_CODEC_ACL_MASK, &caps);
181
+
hci_read_codec_capabilities(hdev,
182
+
LOCAL_CODEC_ACL_MASK | LOCAL_CODEC_SCO_MASK, &caps);
182
183
}
183
184
184
185
error:
···
195
194
struct hci_op_read_local_codec_caps caps;
196
195
__u8 i;
197
196
198
-
skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_CODECS_V2, 0, NULL,
199
-
HCI_CMD_TIMEOUT);
197
+
skb = __hci_cmd_sync_sk(hdev, HCI_OP_READ_LOCAL_CODECS_V2, 0, NULL,
198
+
0, HCI_CMD_TIMEOUT, NULL);
200
199
201
200
if (IS_ERR(skb)) {
202
201
bt_dev_err(hdev, "Failed to read local supported codecs (%ld)",
+6
-2
net/bluetooth/hci_core.c
+6
-2
net/bluetooth/hci_core.c
···
2764
2764
{
2765
2765
int ret = 0;
2766
2766
2767
-
if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) {
2767
+
if (!hdev->suspend_notifier.notifier_call &&
2768
+
!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) {
2768
2769
hdev->suspend_notifier.notifier_call = hci_suspend_notifier;
2769
2770
ret = register_pm_notifier(&hdev->suspend_notifier);
2770
2771
}
···
2777
2776
{
2778
2777
int ret = 0;
2779
2778
2780
-
if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks))
2779
+
if (hdev->suspend_notifier.notifier_call) {
2781
2780
ret = unregister_pm_notifier(&hdev->suspend_notifier);
2781
+
if (!ret)
2782
+
hdev->suspend_notifier.notifier_call = NULL;
2783
+
}
2782
2784
2783
2785
return ret;
2784
2786
}
+1
-1
net/bluetooth/hci_request.c
+1
-1
net/bluetooth/hci_request.c
+13
-6
net/bluetooth/hci_sync.c
+13
-6
net/bluetooth/hci_sync.c
···
12
12
#include <net/bluetooth/mgmt.h>
13
13
14
14
#include "hci_request.h"
15
+
#include "hci_codec.h"
15
16
#include "hci_debugfs.h"
16
17
#include "smp.h"
17
18
#include "eir.h"
···
3781
3780
static int hci_read_def_err_data_reporting_sync(struct hci_dev *hdev)
3782
3781
{
3783
3782
if (!(hdev->commands[18] & 0x04) ||
3784
-
!(hdev->features[0][6] & LMP_ERR_DATA_REPORTING))
3783
+
!(hdev->features[0][6] & LMP_ERR_DATA_REPORTING) ||
3784
+
test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks))
3785
3785
return 0;
3786
3786
3787
3787
return __hci_cmd_sync_status(hdev, HCI_OP_READ_DEF_ERR_DATA_REPORTING,
···
4240
4238
/* Read local codec list if the HCI command is supported */
4241
4239
static int hci_read_local_codecs_sync(struct hci_dev *hdev)
4242
4240
{
4243
-
if (!(hdev->commands[29] & 0x20))
4244
-
return 0;
4241
+
if (hdev->commands[45] & 0x04)
4242
+
hci_read_supported_codecs_v2(hdev);
4243
+
else if (hdev->commands[29] & 0x20)
4244
+
hci_read_supported_codecs(hdev);
4245
4245
4246
-
return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_CODECS, 0, NULL,
4247
-
HCI_CMD_TIMEOUT);
4246
+
return 0;
4248
4247
}
4249
4248
4250
4249
/* Read local pairing options if the HCI command is supported */
···
4301
4298
bool enabled = hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED);
4302
4299
4303
4300
if (!(hdev->commands[18] & 0x08) ||
4304
-
!(hdev->features[0][6] & LMP_ERR_DATA_REPORTING))
4301
+
!(hdev->features[0][6] & LMP_ERR_DATA_REPORTING) ||
4302
+
test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks))
4305
4303
return 0;
4306
4304
4307
4305
if (enabled == hdev->err_data_reporting)
···
4461
4457
HCI_QUIRK_BROKEN(STORED_LINK_KEY,
4462
4458
"HCI Delete Stored Link Key command is advertised, "
4463
4459
"but not supported."),
4460
+
HCI_QUIRK_BROKEN(ERR_DATA_REPORTING,
4461
+
"HCI Read Default Erroneous Data Reporting command is "
4462
+
"advertised, but not supported."),
4464
4463
HCI_QUIRK_BROKEN(READ_TRANSMIT_POWER,
4465
4464
"HCI Read Transmit Power Level command is advertised, "
4466
4465
"but not supported."),
+1
net/bluetooth/iso.c
+1
net/bluetooth/iso.c
+2
-1
net/bluetooth/l2cap_core.c
+2
-1
net/bluetooth/l2cap_core.c
···
4453
4453
4454
4454
chan->ident = cmd->ident;
4455
4455
l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
4456
-
chan->num_conf_rsp++;
4456
+
if (chan->num_conf_rsp < L2CAP_CONF_MAX_CONF_RSP)
4457
+
chan->num_conf_rsp++;
4457
4458
4458
4459
/* Reset config buffer. */
4459
4460
chan->conf_len = 0;
+3
-3
net/can/af_can.c
+3
-3
net/can/af_can.c
···
677
677
static int can_rcv(struct sk_buff *skb, struct net_device *dev,
678
678
struct packet_type *pt, struct net_device *orig_dev)
679
679
{
680
-
if (unlikely(dev->type != ARPHRD_CAN || (!can_is_can_skb(skb)))) {
680
+
if (unlikely(dev->type != ARPHRD_CAN || !can_get_ml_priv(dev) || !can_is_can_skb(skb))) {
681
681
pr_warn_once("PF_CAN: dropped non conform CAN skbuff: dev type %d, len %d\n",
682
682
dev->type, skb->len);
683
683
···
692
692
static int canfd_rcv(struct sk_buff *skb, struct net_device *dev,
693
693
struct packet_type *pt, struct net_device *orig_dev)
694
694
{
695
-
if (unlikely(dev->type != ARPHRD_CAN || (!can_is_canfd_skb(skb)))) {
695
+
if (unlikely(dev->type != ARPHRD_CAN || !can_get_ml_priv(dev) || !can_is_canfd_skb(skb))) {
696
696
pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d\n",
697
697
dev->type, skb->len);
698
698
···
707
707
static int canxl_rcv(struct sk_buff *skb, struct net_device *dev,
708
708
struct packet_type *pt, struct net_device *orig_dev)
709
709
{
710
-
if (unlikely(dev->type != ARPHRD_CAN || (!can_is_canxl_skb(skb)))) {
710
+
if (unlikely(dev->type != ARPHRD_CAN || !can_get_ml_priv(dev) || !can_is_canxl_skb(skb))) {
711
711
pr_warn_once("PF_CAN: dropped non conform CAN XL skbuff: dev type %d, len %d\n",
712
712
dev->type, skb->len);
713
713
+2
-1
net/dsa/tag_hellcreek.c
+2
-1
net/dsa/tag_hellcreek.c
+2
-1
net/dsa/tag_ksz.c
+2
-1
net/dsa/tag_ksz.c
+2
-1
net/dsa/tag_sja1105.c
+2
-1
net/dsa/tag_sja1105.c
···
665
665
* padding and trailer we need to account for the fact that
666
666
* skb->data points to skb_mac_header(skb) + ETH_HLEN.
667
667
*/
668
-
pskb_trim_rcsum(skb, start_of_padding - ETH_HLEN);
668
+
if (pskb_trim_rcsum(skb, start_of_padding - ETH_HLEN))
669
+
return NULL;
669
670
/* Trap-to-host frame, no timestamp trailer */
670
671
} else {
671
672
*source_port = SJA1110_RX_HEADER_SRC_PORT(rx_header);
+3
net/ipv4/fib_frontend.c
+3
net/ipv4/fib_frontend.c
+1
net/ipv4/fib_semantics.c
+1
net/ipv4/fib_semantics.c
···
423
423
nfi->fib_prefsrc == fi->fib_prefsrc &&
424
424
nfi->fib_priority == fi->fib_priority &&
425
425
nfi->fib_type == fi->fib_type &&
426
+
nfi->fib_tb_id == fi->fib_tb_id &&
426
427
memcmp(nfi->fib_metrics, fi->fib_metrics,
427
428
sizeof(u32) * RTAX_MAX) == 0 &&
428
429
!((nfi->fib_flags ^ fi->fib_flags) & ~RTNH_COMPARE_MASK) &&
+29
-19
net/ipv4/ip_gre.c
+29
-19
net/ipv4/ip_gre.c
···
1492
1492
struct ip_tunnel_parm *p = &t->parms;
1493
1493
__be16 o_flags = p->o_flags;
1494
1494
1495
-
if (t->erspan_ver <= 2) {
1496
-
if (t->erspan_ver != 0 && !t->collect_md)
1497
-
o_flags |= TUNNEL_KEY;
1498
-
1499
-
if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, t->erspan_ver))
1500
-
goto nla_put_failure;
1501
-
1502
-
if (t->erspan_ver == 1) {
1503
-
if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, t->index))
1504
-
goto nla_put_failure;
1505
-
} else if (t->erspan_ver == 2) {
1506
-
if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, t->dir))
1507
-
goto nla_put_failure;
1508
-
if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, t->hwid))
1509
-
goto nla_put_failure;
1510
-
}
1511
-
}
1512
-
1513
1495
if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
1514
1496
nla_put_be16(skb, IFLA_GRE_IFLAGS,
1515
1497
gre_tnl_flags_to_gre_flags(p->i_flags)) ||
···
1527
1545
}
1528
1546
1529
1547
return 0;
1548
+
1549
+
nla_put_failure:
1550
+
return -EMSGSIZE;
1551
+
}
1552
+
1553
+
static int erspan_fill_info(struct sk_buff *skb, const struct net_device *dev)
1554
+
{
1555
+
struct ip_tunnel *t = netdev_priv(dev);
1556
+
1557
+
if (t->erspan_ver <= 2) {
1558
+
if (t->erspan_ver != 0 && !t->collect_md)
1559
+
t->parms.o_flags |= TUNNEL_KEY;
1560
+
1561
+
if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, t->erspan_ver))
1562
+
goto nla_put_failure;
1563
+
1564
+
if (t->erspan_ver == 1) {
1565
+
if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, t->index))
1566
+
goto nla_put_failure;
1567
+
} else if (t->erspan_ver == 2) {
1568
+
if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, t->dir))
1569
+
goto nla_put_failure;
1570
+
if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, t->hwid))
1571
+
goto nla_put_failure;
1572
+
}
1573
+
}
1574
+
1575
+
return ipgre_fill_info(skb, dev);
1530
1576
1531
1577
nla_put_failure:
1532
1578
return -EMSGSIZE;
···
1638
1628
.changelink = erspan_changelink,
1639
1629
.dellink = ip_tunnel_dellink,
1640
1630
.get_size = ipgre_get_size,
1641
-
.fill_info = ipgre_fill_info,
1631
+
.fill_info = erspan_fill_info,
1642
1632
.get_link_net = ip_tunnel_get_link_net,
1643
1633
};
1644
1634
+6
-1
net/ipv4/ping.c
+6
-1
net/ipv4/ping.c
···
49
49
#include <net/transp_v6.h>
50
50
#endif
51
51
52
+
#define ping_portaddr_for_each_entry(__sk, node, list) \
53
+
hlist_nulls_for_each_entry(__sk, node, list, sk_nulls_node)
54
+
#define ping_portaddr_for_each_entry_rcu(__sk, node, list) \
55
+
hlist_nulls_for_each_entry_rcu(__sk, node, list, sk_nulls_node)
56
+
52
57
struct ping_table {
53
58
struct hlist_nulls_head hash[PING_HTABLE_SIZE];
54
59
spinlock_t lock;
···
197
192
return NULL;
198
193
}
199
194
200
-
ping_portaddr_for_each_entry(sk, hnode, hslot) {
195
+
ping_portaddr_for_each_entry_rcu(sk, hnode, hslot) {
201
196
isk = inet_sk(sk);
202
197
203
198
pr_debug("iterate\n");
+5
net/ipv6/ip6_output.c
+5
net/ipv6/ip6_output.c
···
920
920
if (err < 0)
921
921
goto fail;
922
922
923
+
/* We prevent @rt from being freed. */
924
+
rcu_read_lock();
925
+
923
926
for (;;) {
924
927
/* Prepare header of the next frame,
925
928
* before previous one went down. */
···
946
943
if (err == 0) {
947
944
IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
948
945
IPSTATS_MIB_FRAGOKS);
946
+
rcu_read_unlock();
949
947
return 0;
950
948
}
951
949
···
954
950
955
951
IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
956
952
IPSTATS_MIB_FRAGFAILS);
953
+
rcu_read_unlock();
957
954
return err;
958
955
959
956
slow_path_clean:
+1
net/mac802154/iface.c
+1
net/mac802154/iface.c
+3
-3
net/netfilter/nf_conntrack_core.c
+3
-3
net/netfilter/nf_conntrack_core.c
···
891
891
zone = nf_ct_zone(ct);
892
892
893
893
if (!nf_ct_ext_valid_pre(ct->ext)) {
894
-
NF_CT_STAT_INC(net, insert_failed);
894
+
NF_CT_STAT_INC_ATOMIC(net, insert_failed);
895
895
return -ETIMEDOUT;
896
896
}
897
897
···
938
938
939
939
if (!nf_ct_ext_valid_post(ct->ext)) {
940
940
nf_ct_kill(ct);
941
-
NF_CT_STAT_INC(net, drop);
941
+
NF_CT_STAT_INC_ATOMIC(net, drop);
942
942
return -ETIMEDOUT;
943
943
}
944
944
···
1275
1275
*/
1276
1276
if (!nf_ct_ext_valid_post(ct->ext)) {
1277
1277
nf_ct_kill(ct);
1278
-
NF_CT_STAT_INC(net, drop);
1278
+
NF_CT_STAT_INC_ATOMIC(net, drop);
1279
1279
return NF_DROP;
1280
1280
}
1281
1281
+10
-9
net/netfilter/nf_conntrack_netlink.c
+10
-9
net/netfilter/nf_conntrack_netlink.c
···
328
328
}
329
329
330
330
#ifdef CONFIG_NF_CONNTRACK_MARK
331
-
static int ctnetlink_dump_mark(struct sk_buff *skb, u32 mark)
331
+
static int ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct)
332
332
{
333
+
u32 mark = READ_ONCE(ct->mark);
334
+
335
+
if (!mark)
336
+
return 0;
337
+
333
338
if (nla_put_be32(skb, CTA_MARK, htonl(mark)))
334
339
goto nla_put_failure;
335
340
return 0;
···
548
543
static int ctnetlink_dump_info(struct sk_buff *skb, struct nf_conn *ct)
549
544
{
550
545
if (ctnetlink_dump_status(skb, ct) < 0 ||
551
-
ctnetlink_dump_mark(skb, READ_ONCE(ct->mark)) < 0 ||
546
+
ctnetlink_dump_mark(skb, ct) < 0 ||
552
547
ctnetlink_dump_secctx(skb, ct) < 0 ||
553
548
ctnetlink_dump_id(skb, ct) < 0 ||
554
549
ctnetlink_dump_use(skb, ct) < 0 ||
···
727
722
struct sk_buff *skb;
728
723
unsigned int type;
729
724
unsigned int flags = 0, group;
730
-
u32 mark;
731
725
int err;
732
726
733
727
if (events & (1 << IPCT_DESTROY)) {
···
831
827
}
832
828
833
829
#ifdef CONFIG_NF_CONNTRACK_MARK
834
-
mark = READ_ONCE(ct->mark);
835
-
if ((events & (1 << IPCT_MARK) || mark) &&
836
-
ctnetlink_dump_mark(skb, mark) < 0)
830
+
if (events & (1 << IPCT_MARK) &&
831
+
ctnetlink_dump_mark(skb, ct) < 0)
837
832
goto nla_put_failure;
838
833
#endif
839
834
nlmsg_end(skb, nlh);
···
2674
2671
{
2675
2672
const struct nf_conntrack_zone *zone;
2676
2673
struct nlattr *nest_parms;
2677
-
u32 mark;
2678
2674
2679
2675
zone = nf_ct_zone(ct);
2680
2676
···
2735
2733
goto nla_put_failure;
2736
2734
2737
2735
#ifdef CONFIG_NF_CONNTRACK_MARK
2738
-
mark = READ_ONCE(ct->mark);
2739
-
if (mark && ctnetlink_dump_mark(skb, mark) < 0)
2736
+
if (ctnetlink_dump_mark(skb, ct) < 0)
2740
2737
goto nla_put_failure;
2741
2738
#endif
2742
2739
if (ctnetlink_dump_labels(skb, ct) < 0)
+3
-3
net/netfilter/nf_flow_table_offload.c
+3
-3
net/netfilter/nf_flow_table_offload.c
···
997
997
struct net *net = read_pnet(&offload->flowtable->net);
998
998
999
999
if (offload->cmd == FLOW_CLS_REPLACE) {
1000
-
NF_FLOW_TABLE_STAT_INC(net, count_wq_add);
1000
+
NF_FLOW_TABLE_STAT_INC_ATOMIC(net, count_wq_add);
1001
1001
queue_work(nf_flow_offload_add_wq, &offload->work);
1002
1002
} else if (offload->cmd == FLOW_CLS_DESTROY) {
1003
-
NF_FLOW_TABLE_STAT_INC(net, count_wq_del);
1003
+
NF_FLOW_TABLE_STAT_INC_ATOMIC(net, count_wq_del);
1004
1004
queue_work(nf_flow_offload_del_wq, &offload->work);
1005
1005
} else {
1006
-
NF_FLOW_TABLE_STAT_INC(net, count_wq_stats);
1006
+
NF_FLOW_TABLE_STAT_INC_ATOMIC(net, count_wq_stats);
1007
1007
queue_work(nf_flow_offload_stats_wq, &offload->work);
1008
1008
}
1009
1009
}
+3
-2
net/netfilter/nft_set_pipapo.c
+3
-2
net/netfilter/nft_set_pipapo.c
···
1162
1162
struct nft_pipapo_match *m = priv->clone;
1163
1163
u8 genmask = nft_genmask_next(net);
1164
1164
struct nft_pipapo_field *f;
1165
+
const u8 *start_p, *end_p;
1165
1166
int i, bsize_max, err = 0;
1166
1167
1167
1168
if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END))
···
1203
1202
}
1204
1203
1205
1204
/* Validate */
1205
+
start_p = start;
1206
+
end_p = end;
1206
1207
nft_pipapo_for_each_field(f, i, m) {
1207
-
const u8 *start_p = start, *end_p = end;
1208
-
1209
1208
if (f->rules >= (unsigned long)NFT_PIPAPO_RULE0_MAX)
1210
1209
return -ENOSPC;
1211
1210
+6
net/nfc/nci/ntf.c
+6
net/nfc/nci/ntf.c
···
240
240
target->sens_res = nfca_poll->sens_res;
241
241
target->sel_res = nfca_poll->sel_res;
242
242
target->nfcid1_len = nfca_poll->nfcid1_len;
243
+
if (target->nfcid1_len > ARRAY_SIZE(target->nfcid1))
244
+
return -EPROTO;
243
245
if (target->nfcid1_len > 0) {
244
246
memcpy(target->nfcid1, nfca_poll->nfcid1,
245
247
target->nfcid1_len);
···
250
248
nfcb_poll = (struct rf_tech_specific_params_nfcb_poll *)params;
251
249
252
250
target->sensb_res_len = nfcb_poll->sensb_res_len;
251
+
if (target->sensb_res_len > ARRAY_SIZE(target->sensb_res))
252
+
return -EPROTO;
253
253
if (target->sensb_res_len > 0) {
254
254
memcpy(target->sensb_res, nfcb_poll->sensb_res,
255
255
target->sensb_res_len);
···
260
256
nfcf_poll = (struct rf_tech_specific_params_nfcf_poll *)params;
261
257
262
258
target->sensf_res_len = nfcf_poll->sensf_res_len;
259
+
if (target->sensf_res_len > ARRAY_SIZE(target->sensf_res))
260
+
return -EPROTO;
263
261
if (target->sensf_res_len > 0) {
264
262
memcpy(target->sensf_res, nfcf_poll->sensf_res,
265
263
target->sensf_res_len);
+3
-1
net/tipc/link.c
+3
-1
net/tipc/link.c
+9
-3
net/tipc/node.c
+9
-3
net/tipc/node.c
···
1689
1689
struct tipc_node *n;
1690
1690
struct sk_buff_head xmitq;
1691
1691
bool node_up = false;
1692
+
struct net *peer_net;
1692
1693
int bearer_id;
1693
1694
int rc;
1694
1695
···
1706
1705
return -EHOSTUNREACH;
1707
1706
}
1708
1707
1708
+
rcu_read_lock();
1709
1709
tipc_node_read_lock(n);
1710
1710
node_up = node_is_up(n);
1711
-
if (node_up && n->peer_net && check_net(n->peer_net)) {
1711
+
peer_net = n->peer_net;
1712
+
tipc_node_read_unlock(n);
1713
+
if (node_up && peer_net && check_net(peer_net)) {
1712
1714
/* xmit inner linux container */
1713
-
tipc_lxc_xmit(n->peer_net, list);
1715
+
tipc_lxc_xmit(peer_net, list);
1714
1716
if (likely(skb_queue_empty(list))) {
1715
-
tipc_node_read_unlock(n);
1717
+
rcu_read_unlock();
1716
1718
tipc_node_put(n);
1717
1719
return 0;
1718
1720
}
1719
1721
}
1722
+
rcu_read_unlock();
1720
1723
1724
+
tipc_node_read_lock(n);
1721
1725
bearer_id = n->active_links[selector & 1];
1722
1726
if (unlikely(bearer_id == INVALID_BEARER_ID)) {
1723
1727
tipc_node_read_unlock(n);
+12
-8
net/unix/diag.c
+12
-8
net/unix/diag.c
···
114
114
return nla_put(nlskb, UNIX_DIAG_RQLEN, sizeof(rql), &rql);
115
115
}
116
116
117
-
static int sk_diag_dump_uid(struct sock *sk, struct sk_buff *nlskb)
117
+
static int sk_diag_dump_uid(struct sock *sk, struct sk_buff *nlskb,
118
+
struct user_namespace *user_ns)
118
119
{
119
-
uid_t uid = from_kuid_munged(sk_user_ns(nlskb->sk), sock_i_uid(sk));
120
+
uid_t uid = from_kuid_munged(user_ns, sock_i_uid(sk));
120
121
return nla_put(nlskb, UNIX_DIAG_UID, sizeof(uid_t), &uid);
121
122
}
122
123
123
124
static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_req *req,
124
-
u32 portid, u32 seq, u32 flags, int sk_ino)
125
+
struct user_namespace *user_ns,
126
+
u32 portid, u32 seq, u32 flags, int sk_ino)
125
127
{
126
128
struct nlmsghdr *nlh;
127
129
struct unix_diag_msg *rep;
···
169
167
goto out_nlmsg_trim;
170
168
171
169
if ((req->udiag_show & UDIAG_SHOW_UID) &&
172
-
sk_diag_dump_uid(sk, skb))
170
+
sk_diag_dump_uid(sk, skb, user_ns))
173
171
goto out_nlmsg_trim;
174
172
175
173
nlmsg_end(skb, nlh);
···
181
179
}
182
180
183
181
static int sk_diag_dump(struct sock *sk, struct sk_buff *skb, struct unix_diag_req *req,
184
-
u32 portid, u32 seq, u32 flags)
182
+
struct user_namespace *user_ns,
183
+
u32 portid, u32 seq, u32 flags)
185
184
{
186
185
int sk_ino;
187
186
···
193
190
if (!sk_ino)
194
191
return 0;
195
192
196
-
return sk_diag_fill(sk, skb, req, portid, seq, flags, sk_ino);
193
+
return sk_diag_fill(sk, skb, req, user_ns, portid, seq, flags, sk_ino);
197
194
}
198
195
199
196
static int unix_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
···
217
214
goto next;
218
215
if (!(req->udiag_states & (1 << sk->sk_state)))
219
216
goto next;
220
-
if (sk_diag_dump(sk, skb, req,
217
+
if (sk_diag_dump(sk, skb, req, sk_user_ns(skb->sk),
221
218
NETLINK_CB(cb->skb).portid,
222
219
cb->nlh->nlmsg_seq,
223
220
NLM_F_MULTI) < 0) {
···
285
282
if (!rep)
286
283
goto out;
287
284
288
-
err = sk_diag_fill(sk, rep, req, NETLINK_CB(in_skb).portid,
285
+
err = sk_diag_fill(sk, rep, req, sk_user_ns(NETLINK_CB(in_skb).sk),
286
+
NETLINK_CB(in_skb).portid,
289
287
nlh->nlmsg_seq, 0, req->udiag_ino);
290
288
if (err < 0) {
291
289
nlmsg_free(rep);
+1
tools/testing/selftests/net/.gitignore
+1
tools/testing/selftests/net/.gitignore
+1
-1
tools/testing/selftests/net/af_unix/Makefile
+1
-1
tools/testing/selftests/net/af_unix/Makefile
+178
tools/testing/selftests/net/af_unix/diag_uid.c
+178
tools/testing/selftests/net/af_unix/diag_uid.c
···
1
+
// SPDX-License-Identifier: GPL-2.0
2
+
/* Copyright Amazon.com Inc. or its affiliates. */
3
+
4
+
#define _GNU_SOURCE
5
+
#include <sched.h>
6
+
7
+
#include <unistd.h>
8
+
#include <linux/netlink.h>
9
+
#include <linux/rtnetlink.h>
10
+
#include <linux/sock_diag.h>
11
+
#include <linux/unix_diag.h>
12
+
#include <sys/socket.h>
13
+
#include <sys/stat.h>
14
+
#include <sys/types.h>
15
+
#include <sys/un.h>
16
+
17
+
#include "../../kselftest_harness.h"
18
+
19
+
FIXTURE(diag_uid)
20
+
{
21
+
int netlink_fd;
22
+
int unix_fd;
23
+
__u32 inode;
24
+
__u64 cookie;
25
+
};
26
+
27
+
FIXTURE_VARIANT(diag_uid)
28
+
{
29
+
int unshare;
30
+
int udiag_show;
31
+
};
32
+
33
+
FIXTURE_VARIANT_ADD(diag_uid, uid)
34
+
{
35
+
.unshare = 0,
36
+
.udiag_show = UDIAG_SHOW_UID
37
+
};
38
+
39
+
FIXTURE_VARIANT_ADD(diag_uid, uid_unshare)
40
+
{
41
+
.unshare = CLONE_NEWUSER,
42
+
.udiag_show = UDIAG_SHOW_UID
43
+
};
44
+
45
+
FIXTURE_SETUP(diag_uid)
46
+
{
47
+
struct stat file_stat;
48
+
socklen_t optlen;
49
+
int ret;
50
+
51
+
if (variant->unshare)
52
+
ASSERT_EQ(unshare(variant->unshare), 0);
53
+
54
+
self->netlink_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_SOCK_DIAG);
55
+
ASSERT_NE(self->netlink_fd, -1);
56
+
57
+
self->unix_fd = socket(AF_UNIX, SOCK_STREAM, 0);
58
+
ASSERT_NE(self->unix_fd, -1);
59
+
60
+
ret = fstat(self->unix_fd, &file_stat);
61
+
ASSERT_EQ(ret, 0);
62
+
63
+
self->inode = file_stat.st_ino;
64
+
65
+
optlen = sizeof(self->cookie);
66
+
ret = getsockopt(self->unix_fd, SOL_SOCKET, SO_COOKIE, &self->cookie, &optlen);
67
+
ASSERT_EQ(ret, 0);
68
+
}
69
+
70
+
FIXTURE_TEARDOWN(diag_uid)
71
+
{
72
+
close(self->netlink_fd);
73
+
close(self->unix_fd);
74
+
}
75
+
76
+
int send_request(struct __test_metadata *_metadata,
77
+
FIXTURE_DATA(diag_uid) *self,
78
+
const FIXTURE_VARIANT(diag_uid) *variant)
79
+
{
80
+
struct {
81
+
struct nlmsghdr nlh;
82
+
struct unix_diag_req udr;
83
+
} req = {
84
+
.nlh = {
85
+
.nlmsg_len = sizeof(req),
86
+
.nlmsg_type = SOCK_DIAG_BY_FAMILY,
87
+
.nlmsg_flags = NLM_F_REQUEST
88
+
},
89
+
.udr = {
90
+
.sdiag_family = AF_UNIX,
91
+
.udiag_ino = self->inode,
92
+
.udiag_cookie = {
93
+
(__u32)self->cookie,
94
+
(__u32)(self->cookie >> 32)
95
+
},
96
+
.udiag_show = variant->udiag_show
97
+
}
98
+
};
99
+
struct sockaddr_nl nladdr = {
100
+
.nl_family = AF_NETLINK
101
+
};
102
+
struct iovec iov = {
103
+
.iov_base = &req,
104
+
.iov_len = sizeof(req)
105
+
};
106
+
struct msghdr msg = {
107
+
.msg_name = &nladdr,
108
+
.msg_namelen = sizeof(nladdr),
109
+
.msg_iov = &iov,
110
+
.msg_iovlen = 1
111
+
};
112
+
113
+
return sendmsg(self->netlink_fd, &msg, 0);
114
+
}
115
+
116
+
void render_response(struct __test_metadata *_metadata,
117
+
struct unix_diag_req *udr, __u32 len)
118
+
{
119
+
unsigned int rta_len = len - NLMSG_LENGTH(sizeof(*udr));
120
+
struct rtattr *attr;
121
+
uid_t uid;
122
+
123
+
ASSERT_GT(len, sizeof(*udr));
124
+
ASSERT_EQ(udr->sdiag_family, AF_UNIX);
125
+
126
+
attr = (struct rtattr *)(udr + 1);
127
+
ASSERT_NE(RTA_OK(attr, rta_len), 0);
128
+
ASSERT_EQ(attr->rta_type, UNIX_DIAG_UID);
129
+
130
+
uid = *(uid_t *)RTA_DATA(attr);
131
+
ASSERT_EQ(uid, getuid());
132
+
}
133
+
134
+
void receive_response(struct __test_metadata *_metadata,
135
+
FIXTURE_DATA(diag_uid) *self)
136
+
{
137
+
long buf[8192 / sizeof(long)];
138
+
struct sockaddr_nl nladdr = {
139
+
.nl_family = AF_NETLINK
140
+
};
141
+
struct iovec iov = {
142
+
.iov_base = buf,
143
+
.iov_len = sizeof(buf)
144
+
};
145
+
struct msghdr msg = {
146
+
.msg_name = &nladdr,
147
+
.msg_namelen = sizeof(nladdr),
148
+
.msg_iov = &iov,
149
+
.msg_iovlen = 1
150
+
};
151
+
struct unix_diag_req *udr;
152
+
struct nlmsghdr *nlh;
153
+
int ret;
154
+
155
+
ret = recvmsg(self->netlink_fd, &msg, 0);
156
+
ASSERT_GT(ret, 0);
157
+
158
+
nlh = (struct nlmsghdr *)buf;
159
+
ASSERT_NE(NLMSG_OK(nlh, ret), 0);
160
+
ASSERT_EQ(nlh->nlmsg_type, SOCK_DIAG_BY_FAMILY);
161
+
162
+
render_response(_metadata, NLMSG_DATA(nlh), nlh->nlmsg_len);
163
+
164
+
nlh = NLMSG_NEXT(nlh, ret);
165
+
ASSERT_EQ(NLMSG_OK(nlh, ret), 0);
166
+
}
167
+
168
+
TEST_F(diag_uid, 1)
169
+
{
170
+
int ret;
171
+
172
+
ret = send_request(_metadata, self, variant);
173
+
ASSERT_GT(ret, 0);
174
+
175
+
receive_response(_metadata, self);
176
+
}
177
+
178
+
TEST_HARNESS_MAIN
+1
-1
tools/testing/selftests/net/config
+1
-1
tools/testing/selftests/net/config
+37
tools/testing/selftests/net/fib_tests.sh
+37
tools/testing/selftests/net/fib_tests.sh
···
1711
1711
1712
1712
$IP addr add dev dummy1 172.16.104.1/24
1713
1713
$IP addr add dev dummy1 172.16.104.11/24
1714
+
$IP addr add dev dummy1 172.16.104.12/24
1715
+
$IP addr add dev dummy1 172.16.104.13/24
1714
1716
$IP addr add dev dummy2 172.16.104.1/24
1715
1717
$IP addr add dev dummy2 172.16.104.11/24
1718
+
$IP addr add dev dummy2 172.16.104.12/24
1716
1719
$IP route add 172.16.105.0/24 via 172.16.104.2 src 172.16.104.11
1720
+
$IP route add 172.16.106.0/24 dev lo src 172.16.104.12
1721
+
$IP route add table 0 172.16.107.0/24 via 172.16.104.2 src 172.16.104.13
1717
1722
$IP route add vrf red 172.16.105.0/24 via 172.16.104.2 src 172.16.104.11
1723
+
$IP route add vrf red 172.16.106.0/24 dev lo src 172.16.104.12
1718
1724
set +e
1719
1725
1720
1726
# removing address from device in vrf should only remove route from vrf table
1727
+
echo " Regular FIB info"
1728
+
1721
1729
$IP addr del dev dummy2 172.16.104.11/24
1722
1730
$IP ro ls vrf red | grep -q 172.16.105.0/24
1723
1731
log_test $? 1 "Route removed from VRF when source address deleted"
···
1742
1734
1743
1735
$IP ro ls vrf red | grep -q 172.16.105.0/24
1744
1736
log_test $? 0 "Route in VRF is not removed by address delete"
1737
+
1738
+
# removing address from device in vrf should only remove route from vrf
1739
+
# table even when the associated fib info only differs in table ID
1740
+
echo " Identical FIB info with different table ID"
1741
+
1742
+
$IP addr del dev dummy2 172.16.104.12/24
1743
+
$IP ro ls vrf red | grep -q 172.16.106.0/24
1744
+
log_test $? 1 "Route removed from VRF when source address deleted"
1745
+
1746
+
$IP ro ls | grep -q 172.16.106.0/24
1747
+
log_test $? 0 "Route in default VRF not removed"
1748
+
1749
+
$IP addr add dev dummy2 172.16.104.12/24
1750
+
$IP route add vrf red 172.16.106.0/24 dev lo src 172.16.104.12
1751
+
1752
+
$IP addr del dev dummy1 172.16.104.12/24
1753
+
$IP ro ls | grep -q 172.16.106.0/24
1754
+
log_test $? 1 "Route removed in default VRF when source address deleted"
1755
+
1756
+
$IP ro ls vrf red | grep -q 172.16.106.0/24
1757
+
log_test $? 0 "Route in VRF is not removed by address delete"
1758
+
1759
+
# removing address from device in default vrf should remove route from
1760
+
# the default vrf even when route was inserted with a table ID of 0.
1761
+
echo " Table ID 0"
1762
+
1763
+
$IP addr del dev dummy1 172.16.104.13/24
1764
+
$IP ro ls | grep -q 172.16.107.0/24
1765
+
log_test $? 1 "Route removed in default VRF when source address deleted"
1745
1766
1746
1767
$IP li del dummy1
1747
1768
$IP li del dummy2
+1
-1
tools/testing/selftests/net/rtnetlink.sh
+1
-1
tools/testing/selftests/net/rtnetlink.sh
···
782
782
tmpl proto esp src $srcip dst $dstip spi 9 \
783
783
mode transport reqid 42
784
784
check_err $?
785
-
ip x p add dir out src $dstip/24 dst $srcip/24 \
785
+
ip x p add dir in src $dstip/24 dst $srcip/24 \
786
786
tmpl proto esp src $dstip dst $srcip spi 9 \
787
787
mode transport reqid 42
788
788
check_err $?
+1
-1
tools/testing/selftests/net/toeplitz.sh
+1
-1
tools/testing/selftests/net/toeplitz.sh
···
32
32
# This is determined by reading the RSS indirection table using ethtool.
33
33
get_rss_cfg_num_rxqs() {
34
34
echo $(ethtool -x "${DEV}" |
35
-
egrep [[:space:]]+[0-9]+:[[:space:]]+ |
35
+
grep -E [[:space:]]+[0-9]+:[[:space:]]+ |
36
36
cut -d: -f2- |
37
37
awk '{$1=$1};1' |
38
38
tr ' ' '\n' |