tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:
"Let's begin the holiday weekend with some networking fixes:

1) Whoops need to restrict cfg80211 wiphy names even more to 64
bytes. From Eric Biggers.

2) Fix flags being ignored when using kernel_connect() with SCTP,
from Xin Long.

3) Use after free in DCCP, from Alexey Kodanev.

4) Need to check rhltable_init() return value in ipmr code, from Eric
Dumazet.

5) XDP handling fixes in virtio_net from Jason Wang.

6) Missing RTA_TABLE in rtm_ipv4_policy[], from Roopa Prabhu.

7) Need to use IRQ disabling spinlocks in mlx4_qp_lookup(), from Jack
Morgenstein.

8) Prevent out-of-bounds speculation using indexes in BPF, from
Daniel Borkmann.

9) Fix regression added by AF_PACKET link layer cure, from Willem de
Bruijn.

10) Correct ENIC dma mask, from Govindarajulu Varadarajan.

11) Missing config options for PMTU tests, from Stefano Brivio"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (48 commits)
ibmvnic: Fix partial success login retries
selftests/net: Add missing config options for PMTU tests
mlx4_core: allocate ICM memory in page size chunks
enic: set DMA mask to 47 bit
ppp: remove the PPPIOCDETACH ioctl
ipv4: remove warning in ip_recv_error
net : sched: cls_api: deal with egdev path only if needed
vhost: synchronize IOTLB message with dev cleanup
packet: fix reserve calculation
net/mlx5: IPSec, Fix a race between concurrent sandbox QP commands
net/mlx5e: When RXFCS is set, add FCS data into checksum calculation
bpf: properly enforce index mask to prevent out-of-bounds speculation
net/mlx4: Fix irq-unsafe spinlock usage
net: phy: broadcom: Fix bcm_write_exp()
net: phy: broadcom: Fix auxiliary control register reads
net: ipv4: add missing RTA_TABLE to rtm_ipv4_policy
net/mlx4: fix spelling mistake: "Inrerface" -> "Interface" and rephrase message
ibmvnic: Only do H_EOI for mobility events
tuntap: correctly set SOCKWQ_ASYNC_NOSPACE
virtio-net: fix leaking page for gso packet during mergeable XDP
...

Linus Torvalds 03250e10 62d18ecf

+372 -193
-6
Documentation/networking/ppp_generic.txt
··· 300 300 The ioctl calls available on an instance of /dev/ppp attached to a 301 301 channel are: 302 302 303 - * PPPIOCDETACH detaches the instance from the channel. This ioctl is 304 - deprecated since the same effect can be achieved by closing the 305 - instance. In order to prevent possible races this ioctl will fail 306 - with an EINVAL error if more than one file descriptor refers to this 307 - instance (i.e. as a result of dup(), dup2() or fork()). 308 - 309 303 * PPPIOCCONNECT connects this channel to a PPP interface. The 310 304 argument should point to an int containing the interface unit 311 305 number. It will return an EINVAL error if the channel is already
+4 -4
MAINTAINERS
··· 2332 2332 F: Documentation/devicetree/bindings/gpio/gpio-ath79.txt 2333 2333 2334 2334 ATHEROS ATH GENERIC UTILITIES 2335 - M: "Luis R. Rodriguez" <mcgrof@do-not-panic.com> 2335 + M: Kalle Valo <kvalo@codeaurora.org> 2336 2336 L: linux-wireless@vger.kernel.org 2337 2337 S: Supported 2338 2338 F: drivers/net/wireless/ath/* ··· 2347 2347 F: drivers/net/wireless/ath/ath5k/ 2348 2348 2349 2349 ATHEROS ATH6KL WIRELESS DRIVER 2350 - M: Kalle Valo <kvalo@qca.qualcomm.com> 2350 + M: Kalle Valo <kvalo@codeaurora.org> 2351 2351 L: linux-wireless@vger.kernel.org 2352 2352 W: http://wireless.kernel.org/en/users/Drivers/ath6kl 2353 2353 T: git git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git ··· 11626 11626 F: drivers/media/tuners/qt1010* 11627 11627 11628 11628 QUALCOMM ATHEROS ATH10K WIRELESS DRIVER 11629 - M: Kalle Valo <kvalo@qca.qualcomm.com> 11629 + M: Kalle Valo <kvalo@codeaurora.org> 11630 11630 L: ath10k@lists.infradead.org 11631 11631 W: http://wireless.kernel.org/en/users/Drivers/ath10k 11632 11632 T: git git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git ··· 11677 11677 F: drivers/media/platform/qcom/venus/ 11678 11678 11679 11679 QUALCOMM WCN36XX WIRELESS DRIVER 11680 - M: Eugene Krasnikov <k.eugene.e@gmail.com> 11680 + M: Kalle Valo <kvalo@codeaurora.org> 11681 11681 L: wcn36xx@lists.infradead.org 11682 11682 W: http://wireless.kernel.org/en/users/Drivers/wcn36xx 11683 11683 T: git git://github.com/KrasnikovEugene/wcn36xx.git
+1 -1
drivers/bcma/driver_mips.c
··· 184 184 { 185 185 int i; 186 186 static const char *irq_name[] = {"2(S)", "3", "4", "5", "6", "D", "I"}; 187 - char interrupts[20]; 187 + char interrupts[25]; 188 188 char *ints = interrupts; 189 189 190 190 for (i = 0; i < ARRAY_SIZE(irq_name); i++)
+15 -7
drivers/isdn/hardware/eicon/diva.c
··· 388 388 ** Receive and process command from user mode utility 389 389 */ 390 390 void *diva_xdi_open_adapter(void *os_handle, const void __user *src, 391 - int length, 391 + int length, void *mptr, 392 392 divas_xdi_copy_from_user_fn_t cp_fn) 393 393 { 394 - diva_xdi_um_cfg_cmd_t msg; 394 + diva_xdi_um_cfg_cmd_t *msg = (diva_xdi_um_cfg_cmd_t *)mptr; 395 395 diva_os_xdi_adapter_t *a = NULL; 396 396 diva_os_spin_lock_magic_t old_irql; 397 397 struct list_head *tmp; ··· 401 401 length, sizeof(diva_xdi_um_cfg_cmd_t))) 402 402 return NULL; 403 403 } 404 - if ((*cp_fn) (os_handle, &msg, src, sizeof(msg)) <= 0) { 404 + if ((*cp_fn) (os_handle, msg, src, sizeof(*msg)) <= 0) { 405 405 DBG_ERR(("A: A(?) open, write error")) 406 406 return NULL; 407 407 } 408 408 diva_os_enter_spin_lock(&adapter_lock, &old_irql, "open_adapter"); 409 409 list_for_each(tmp, &adapter_queue) { 410 410 a = list_entry(tmp, diva_os_xdi_adapter_t, link); 411 - if (a->controller == (int)msg.adapter) 411 + if (a->controller == (int)msg->adapter) 412 412 break; 413 413 a = NULL; 414 414 } 415 415 diva_os_leave_spin_lock(&adapter_lock, &old_irql, "open_adapter"); 416 416 417 417 if (!a) { 418 - DBG_ERR(("A: A(%d) open, adapter not found", msg.adapter)) 418 + DBG_ERR(("A: A(%d) open, adapter not found", msg->adapter)) 419 419 } 420 420 421 421 return (a); ··· 437 437 438 438 int 439 439 diva_xdi_write(void *adapter, void *os_handle, const void __user *src, 440 - int length, divas_xdi_copy_from_user_fn_t cp_fn) 440 + int length, void *mptr, 441 + divas_xdi_copy_from_user_fn_t cp_fn) 441 442 { 443 + diva_xdi_um_cfg_cmd_t *msg = (diva_xdi_um_cfg_cmd_t *)mptr; 442 444 diva_os_xdi_adapter_t *a = (diva_os_xdi_adapter_t *) adapter; 443 445 void *data; 444 446 ··· 461 459 return (-2); 462 460 } 463 461 464 - length = (*cp_fn) (os_handle, data, src, length); 462 + if (msg) { 463 + *(diva_xdi_um_cfg_cmd_t *)data = *msg; 464 + length = (*cp_fn) (os_handle, (char *)data + sizeof(*msg), 465 + src + sizeof(*msg), length - sizeof(*msg)); 466 + } else { 467 + length = (*cp_fn) (os_handle, data, src, length); 468 + } 465 469 if (length > 0) { 466 470 if ((*(a->interface.cmd_proc)) 467 471 (a, (diva_xdi_um_cfg_cmd_t *) data, length)) {
+3 -2
drivers/isdn/hardware/eicon/diva.h
··· 20 20 int max_length, divas_xdi_copy_to_user_fn_t cp_fn); 21 21 22 22 int diva_xdi_write(void *adapter, void *os_handle, const void __user *src, 23 - int length, divas_xdi_copy_from_user_fn_t cp_fn); 23 + int length, void *msg, 24 + divas_xdi_copy_from_user_fn_t cp_fn); 24 25 25 26 void *diva_xdi_open_adapter(void *os_handle, const void __user *src, 26 - int length, 27 + int length, void *msg, 27 28 divas_xdi_copy_from_user_fn_t cp_fn); 28 29 29 30 void diva_xdi_close_adapter(void *adapter, void *os_handle);
+11 -7
drivers/isdn/hardware/eicon/divasmain.c
··· 591 591 static ssize_t divas_write(struct file *file, const char __user *buf, 592 592 size_t count, loff_t *ppos) 593 593 { 594 + diva_xdi_um_cfg_cmd_t msg; 594 595 int ret = -EINVAL; 595 596 596 597 if (!file->private_data) { 597 598 file->private_data = diva_xdi_open_adapter(file, buf, 598 - count, 599 + count, &msg, 599 600 xdi_copy_from_user); 600 - } 601 - if (!file->private_data) { 602 - return (-ENODEV); 601 + if (!file->private_data) 602 + return (-ENODEV); 603 + ret = diva_xdi_write(file->private_data, file, 604 + buf, count, &msg, xdi_copy_from_user); 605 + } else { 606 + ret = diva_xdi_write(file->private_data, file, 607 + buf, count, NULL, xdi_copy_from_user); 603 608 } 604 609 605 - ret = diva_xdi_write(file->private_data, file, 606 - buf, count, xdi_copy_from_user); 607 610 switch (ret) { 608 611 case -1: /* Message should be removed from rx mailbox first */ 609 612 ret = -EBUSY; ··· 625 622 static ssize_t divas_read(struct file *file, char __user *buf, 626 623 size_t count, loff_t *ppos) 627 624 { 625 + diva_xdi_um_cfg_cmd_t msg; 628 626 int ret = -EINVAL; 629 627 630 628 if (!file->private_data) { 631 629 file->private_data = diva_xdi_open_adapter(file, buf, 632 - count, 630 + count, &msg, 633 631 xdi_copy_from_user); 634 632 } 635 633 if (!file->private_data) {
+7 -3
drivers/net/ethernet/amd/pcnet32.c
··· 1552 1552 if (!ioaddr) { 1553 1553 if (pcnet32_debug & NETIF_MSG_PROBE) 1554 1554 pr_err("card has no PCI IO resources, aborting\n"); 1555 - return -ENODEV; 1555 + err = -ENODEV; 1556 + goto err_disable_dev; 1556 1557 } 1557 1558 1558 1559 err = pci_set_dma_mask(pdev, PCNET32_DMA_MASK); 1559 1560 if (err) { 1560 1561 if (pcnet32_debug & NETIF_MSG_PROBE) 1561 1562 pr_err("architecture does not support 32bit PCI busmaster DMA\n"); 1562 - return err; 1563 + goto err_disable_dev; 1563 1564 } 1564 1565 if (!request_region(ioaddr, PCNET32_TOTAL_SIZE, "pcnet32_probe_pci")) { 1565 1566 if (pcnet32_debug & NETIF_MSG_PROBE) 1566 1567 pr_err("io address range already allocated\n"); 1567 - return -EBUSY; 1568 + err = -EBUSY; 1569 + goto err_disable_dev; 1568 1570 } 1569 1571 1570 1572 err = pcnet32_probe1(ioaddr, 1, pdev); 1573 + 1574 + err_disable_dev: 1571 1575 if (err < 0) 1572 1576 pci_disable_device(pdev); 1573 1577
+4 -4
drivers/net/ethernet/cisco/enic/enic_main.c
··· 2747 2747 pci_set_master(pdev); 2748 2748 2749 2749 /* Query PCI controller on system for DMA addressing 2750 - * limitation for the device. Try 64-bit first, and 2750 + * limitation for the device. Try 47-bit first, and 2751 2751 * fail to 32-bit. 2752 2752 */ 2753 2753 2754 - err = pci_set_dma_mask(pdev, DMA_BIT_MASK(64)); 2754 + err = pci_set_dma_mask(pdev, DMA_BIT_MASK(47)); 2755 2755 if (err) { 2756 2756 err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32)); 2757 2757 if (err) { ··· 2765 2765 goto err_out_release_regions; 2766 2766 } 2767 2767 } else { 2768 - err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)); 2768 + err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(47)); 2769 2769 if (err) { 2770 2770 dev_err(dev, "Unable to obtain %u-bit DMA " 2771 - "for consistent allocations, aborting\n", 64); 2771 + "for consistent allocations, aborting\n", 47); 2772 2772 goto err_out_release_regions; 2773 2773 } 2774 2774 using_dac = 1;
+1
drivers/net/ethernet/freescale/fec_main.c
··· 1 + // SPDX-License-Identifier: GPL-2.0+ 1 2 /* 2 3 * Fast Ethernet Controller (FEC) driver for Motorola MPC8xx. 3 4 * Copyright (c) 1997 Dan Malek (dmalek@jlc.net)
+1 -13
drivers/net/ethernet/freescale/fec_ptp.c
··· 1 + // SPDX-License-Identifier: GPL-2.0 1 2 /* 2 3 * Fast Ethernet Controller (ENET) PTP driver for MX6x. 3 4 * 4 5 * Copyright (C) 2012 Freescale Semiconductor, Inc. 5 - * 6 - * This program is free software; you can redistribute it and/or modify it 7 - * under the terms and conditions of the GNU General Public License, 8 - * version 2, as published by the Free Software Foundation. 9 - * 10 - * This program is distributed in the hope it will be useful, but WITHOUT 11 - * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 12 - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 13 - * more details. 14 - * 15 - * You should have received a copy of the GNU General Public License along with 16 - * this program; if not, write to the Free Software Foundation, Inc., 17 - * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA. 18 6 */ 19 7 20 8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+15 -7
drivers/net/ethernet/ibm/ibmvnic.c
··· 796 796 struct ibmvnic_adapter *adapter = netdev_priv(netdev); 797 797 unsigned long timeout = msecs_to_jiffies(30000); 798 798 int retry_count = 0; 799 + bool retry; 799 800 int rc; 800 801 801 802 do { 803 + retry = false; 802 804 if (retry_count > IBMVNIC_MAX_QUEUES) { 803 805 netdev_warn(netdev, "Login attempts exceeded\n"); 804 806 return -1; ··· 824 822 retry_count++; 825 823 release_sub_crqs(adapter, 1); 826 824 825 + retry = true; 826 + netdev_dbg(netdev, 827 + "Received partial success, retrying...\n"); 827 828 adapter->init_done_rc = 0; 828 829 reinit_completion(&adapter->init_done); 829 830 send_cap_queries(adapter); ··· 854 849 netdev_warn(netdev, "Adapter login failed\n"); 855 850 return -1; 856 851 } 857 - } while (adapter->init_done_rc == PARTIALSUCCESS); 852 + } while (retry); 858 853 859 854 /* handle pending MAC address changes after successful login */ 860 855 if (adapter->mac_change_pending) { ··· 2622 2617 { 2623 2618 struct device *dev = &adapter->vdev->dev; 2624 2619 unsigned long rc; 2625 - u64 val; 2626 2620 2627 2621 if (scrq->hw_irq > 0x100000000ULL) { 2628 2622 dev_err(dev, "bad hw_irq = %lx\n", scrq->hw_irq); 2629 2623 return 1; 2630 2624 } 2631 2625 2632 - val = (0xff000000) | scrq->hw_irq; 2633 - rc = plpar_hcall_norets(H_EOI, val); 2634 - if (rc) 2635 - dev_err(dev, "H_EOI FAILED irq 0x%llx. rc=%ld\n", 2636 - val, rc); 2626 + if (adapter->resetting && 2627 + adapter->reset_reason == VNIC_RESET_MOBILITY) { 2628 + u64 val = (0xff000000) | scrq->hw_irq; 2629 + 2630 + rc = plpar_hcall_norets(H_EOI, val); 2631 + if (rc) 2632 + dev_err(dev, "H_EOI FAILED irq 0x%llx. rc=%ld\n", 2633 + val, rc); 2634 + } 2637 2635 2638 2636 rc = plpar_hcall_norets(H_VIOCTL, adapter->vdev->unit_address, 2639 2637 H_ENABLE_VIO_INTERRUPT, scrq->hw_irq, 0, 0);
+9 -7
drivers/net/ethernet/mellanox/mlx4/icm.c
··· 43 43 #include "fw.h" 44 44 45 45 /* 46 - * We allocate in as big chunks as we can, up to a maximum of 256 KB 47 - * per chunk. 46 + * We allocate in page size (default 4KB on many archs) chunks to avoid high 47 + * order memory allocations in fragmented/high usage memory situation. 48 48 */ 49 49 enum { 50 - MLX4_ICM_ALLOC_SIZE = 1 << 18, 51 - MLX4_TABLE_CHUNK_SIZE = 1 << 18 50 + MLX4_ICM_ALLOC_SIZE = PAGE_SIZE, 51 + MLX4_TABLE_CHUNK_SIZE = PAGE_SIZE, 52 52 }; 53 53 54 54 static void mlx4_free_icm_pages(struct mlx4_dev *dev, struct mlx4_icm_chunk *chunk) ··· 398 398 u64 size; 399 399 400 400 obj_per_chunk = MLX4_TABLE_CHUNK_SIZE / obj_size; 401 + if (WARN_ON(!obj_per_chunk)) 402 + return -EINVAL; 401 403 num_icm = (nobj + obj_per_chunk - 1) / obj_per_chunk; 402 404 403 - table->icm = kcalloc(num_icm, sizeof(*table->icm), GFP_KERNEL); 405 + table->icm = kvzalloc(num_icm * sizeof(*table->icm), GFP_KERNEL); 404 406 if (!table->icm) 405 407 return -ENOMEM; 406 408 table->virt = virt; ··· 448 446 mlx4_free_icm(dev, table->icm[i], use_coherent); 449 447 } 450 448 451 - kfree(table->icm); 449 + kvfree(table->icm); 452 450 453 451 return -ENOMEM; 454 452 } ··· 464 462 mlx4_free_icm(dev, table->icm[i], table->coherent); 465 463 } 466 464 467 - kfree(table->icm); 465 + kvfree(table->icm); 468 466 }
+1 -1
drivers/net/ethernet/mellanox/mlx4/intf.c
··· 172 172 list_add_tail(&dev_ctx->list, &priv->ctx_list); 173 173 spin_unlock_irqrestore(&priv->ctx_lock, flags); 174 174 175 - mlx4_dbg(dev, "Inrerface for protocol %d restarted with when bonded mode is %s\n", 175 + mlx4_dbg(dev, "Interface for protocol %d restarted with bonded mode %s\n", 176 176 dev_ctx->intf->protocol, enable ? 177 177 "enabled" : "disabled"); 178 178 }
+2 -2
drivers/net/ethernet/mellanox/mlx4/qp.c
··· 393 393 struct mlx4_qp_table *qp_table = &mlx4_priv(dev)->qp_table; 394 394 struct mlx4_qp *qp; 395 395 396 - spin_lock(&qp_table->lock); 396 + spin_lock_irq(&qp_table->lock); 397 397 398 398 qp = __mlx4_qp_lookup(dev, qpn); 399 399 400 - spin_unlock(&qp_table->lock); 400 + spin_unlock_irq(&qp_table->lock); 401 401 return qp; 402 402 } 403 403
+42
drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
··· 615 615 return (ethertype == htons(ETH_P_IP) || ethertype == htons(ETH_P_IPV6)); 616 616 } 617 617 618 + static __be32 mlx5e_get_fcs(struct sk_buff *skb) 619 + { 620 + int last_frag_sz, bytes_in_prev, nr_frags; 621 + u8 *fcs_p1, *fcs_p2; 622 + skb_frag_t *last_frag; 623 + __be32 fcs_bytes; 624 + 625 + if (!skb_is_nonlinear(skb)) 626 + return *(__be32 *)(skb->data + skb->len - ETH_FCS_LEN); 627 + 628 + nr_frags = skb_shinfo(skb)->nr_frags; 629 + last_frag = &skb_shinfo(skb)->frags[nr_frags - 1]; 630 + last_frag_sz = skb_frag_size(last_frag); 631 + 632 + /* If all FCS data is in last frag */ 633 + if (last_frag_sz >= ETH_FCS_LEN) 634 + return *(__be32 *)(skb_frag_address(last_frag) + 635 + last_frag_sz - ETH_FCS_LEN); 636 + 637 + fcs_p2 = (u8 *)skb_frag_address(last_frag); 638 + bytes_in_prev = ETH_FCS_LEN - last_frag_sz; 639 + 640 + /* Find where the other part of the FCS is - Linear or another frag */ 641 + if (nr_frags == 1) { 642 + fcs_p1 = skb_tail_pointer(skb); 643 + } else { 644 + skb_frag_t *prev_frag = &skb_shinfo(skb)->frags[nr_frags - 2]; 645 + 646 + fcs_p1 = skb_frag_address(prev_frag) + 647 + skb_frag_size(prev_frag); 648 + } 649 + fcs_p1 -= bytes_in_prev; 650 + 651 + memcpy(&fcs_bytes, fcs_p1, bytes_in_prev); 652 + memcpy(((u8 *)&fcs_bytes) + bytes_in_prev, fcs_p2, last_frag_sz); 653 + 654 + return fcs_bytes; 655 + } 656 + 618 657 static inline void mlx5e_handle_csum(struct net_device *netdev, 619 658 struct mlx5_cqe64 *cqe, 620 659 struct mlx5e_rq *rq, ··· 682 643 skb->csum = csum_partial(skb->data + ETH_HLEN, 683 644 network_depth - ETH_HLEN, 684 645 skb->csum); 646 + if (unlikely(netdev->features & NETIF_F_RXFCS)) 647 + skb->csum = csum_add(skb->csum, 648 + (__force __wsum)mlx5e_get_fcs(skb)); 685 649 rq->stats.csum_complete++; 686 650 return; 687 651 }
+5 -7
drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
··· 237 237 context->buf.sg[0].data = &context->command; 238 238 239 239 spin_lock_irqsave(&fdev->ipsec->pending_cmds_lock, flags); 240 - list_add_tail(&context->list, &fdev->ipsec->pending_cmds); 240 + res = mlx5_fpga_sbu_conn_sendmsg(fdev->ipsec->conn, &context->buf); 241 + if (!res) 242 + list_add_tail(&context->list, &fdev->ipsec->pending_cmds); 241 243 spin_unlock_irqrestore(&fdev->ipsec->pending_cmds_lock, flags); 242 244 243 - res = mlx5_fpga_sbu_conn_sendmsg(fdev->ipsec->conn, &context->buf); 244 245 if (res) { 245 - mlx5_fpga_warn(fdev, "Failure sending IPSec command: %d\n", 246 - res); 247 - spin_lock_irqsave(&fdev->ipsec->pending_cmds_lock, flags); 248 - list_del(&context->list); 249 - spin_unlock_irqrestore(&fdev->ipsec->pending_cmds_lock, flags); 246 + mlx5_fpga_warn(fdev, "Failed to send IPSec command: %d\n", res); 250 247 kfree(context); 251 248 return ERR_PTR(res); 252 249 } 250 + 253 251 /* Context will be freed by wait func after completion */ 254 252 return context; 255 253 }
+1 -1
drivers/net/ethernet/qlogic/qed/qed_cxt.c
··· 77 77 #define ILT_CFG_REG(cli, reg) PSWRQ2_REG_ ## cli ## _ ## reg ## _RT_OFFSET 78 78 79 79 /* ILT entry structure */ 80 - #define ILT_ENTRY_PHY_ADDR_MASK 0x000FFFFFFFFFFFULL 80 + #define ILT_ENTRY_PHY_ADDR_MASK (~0ULL >> 12) 81 81 #define ILT_ENTRY_PHY_ADDR_SHIFT 0 82 82 #define ILT_ENTRY_VALID_MASK 0x1ULL 83 83 #define ILT_ENTRY_VALID_SHIFT 52
+3 -3
drivers/net/phy/bcm-cygnus.c
··· 61 61 return rc; 62 62 63 63 /* make rcal=100, since rdb default is 000 */ 64 - rc = bcm_phy_write_exp(phydev, MII_BRCM_CORE_EXPB1, 0x10); 64 + rc = bcm_phy_write_exp_sel(phydev, MII_BRCM_CORE_EXPB1, 0x10); 65 65 if (rc < 0) 66 66 return rc; 67 67 68 68 /* CORE_EXPB0, Reset R_CAL/RC_CAL Engine */ 69 - rc = bcm_phy_write_exp(phydev, MII_BRCM_CORE_EXPB0, 0x10); 69 + rc = bcm_phy_write_exp_sel(phydev, MII_BRCM_CORE_EXPB0, 0x10); 70 70 if (rc < 0) 71 71 return rc; 72 72 73 73 /* CORE_EXPB0, Disable Reset R_CAL/RC_CAL Engine */ 74 - rc = bcm_phy_write_exp(phydev, MII_BRCM_CORE_EXPB0, 0x00); 74 + rc = bcm_phy_write_exp_sel(phydev, MII_BRCM_CORE_EXPB0, 0x00); 75 75 76 76 return 0; 77 77 }
+1 -1
drivers/net/phy/bcm-phy-lib.c
··· 56 56 /* The register must be written to both the Shadow Register Select and 57 57 * the Shadow Read Register Selector 58 58 */ 59 - phy_write(phydev, MII_BCM54XX_AUX_CTL, regnum | 59 + phy_write(phydev, MII_BCM54XX_AUX_CTL, MII_BCM54XX_AUXCTL_SHDWSEL_MASK | 60 60 regnum << MII_BCM54XX_AUXCTL_SHDWSEL_READ_SHIFT); 61 61 return phy_read(phydev, MII_BCM54XX_AUX_CTL); 62 62 }
+7
drivers/net/phy/bcm-phy-lib.h
··· 14 14 #ifndef _LINUX_BCM_PHY_LIB_H 15 15 #define _LINUX_BCM_PHY_LIB_H 16 16 17 + #include <linux/brcmphy.h> 17 18 #include <linux/phy.h> 18 19 19 20 int bcm_phy_write_exp(struct phy_device *phydev, u16 reg, u16 val); 20 21 int bcm_phy_read_exp(struct phy_device *phydev, u16 reg); 22 + 23 + static inline int bcm_phy_write_exp_sel(struct phy_device *phydev, 24 + u16 reg, u16 val) 25 + { 26 + return bcm_phy_write_exp(phydev, reg | MII_BCM54XX_EXP_SEL_ER, val); 27 + } 21 28 22 29 int bcm54xx_auxctl_write(struct phy_device *phydev, u16 regnum, u16 val); 23 30 int bcm54xx_auxctl_read(struct phy_device *phydev, u16 regnum);
+2 -2
drivers/net/phy/bcm7xxx.c
··· 65 65 static void r_rc_cal_reset(struct phy_device *phydev) 66 66 { 67 67 /* Reset R_CAL/RC_CAL Engine */ 68 - bcm_phy_write_exp(phydev, 0x00b0, 0x0010); 68 + bcm_phy_write_exp_sel(phydev, 0x00b0, 0x0010); 69 69 70 70 /* Disable Reset R_AL/RC_CAL Engine */ 71 - bcm_phy_write_exp(phydev, 0x00b0, 0x0000); 71 + bcm_phy_write_exp_sel(phydev, 0x00b0, 0x0000); 72 72 } 73 73 74 74 static int bcm7xxx_28nm_b0_afe_config_init(struct phy_device *phydev)
+5 -22
drivers/net/ppp/ppp_generic.c
··· 605 605 606 606 if (cmd == PPPIOCDETACH) { 607 607 /* 608 - * We have to be careful here... if the file descriptor 609 - * has been dup'd, we could have another process in the 610 - * middle of a poll using the same file *, so we had 611 - * better not free the interface data structures - 612 - * instead we fail the ioctl. Even in this case, we 613 - * shut down the interface if we are the owner of it. 614 - * Actually, we should get rid of PPPIOCDETACH, userland 615 - * (i.e. pppd) could achieve the same effect by closing 616 - * this fd and reopening /dev/ppp. 608 + * PPPIOCDETACH is no longer supported as it was heavily broken, 609 + * and is only known to have been used by pppd older than 610 + * ppp-2.4.2 (released November 2003). 617 611 */ 612 + pr_warn_once("%s (%d) used obsolete PPPIOCDETACH ioctl\n", 613 + current->comm, current->pid); 618 614 err = -EINVAL; 619 - if (pf->kind == INTERFACE) { 620 - ppp = PF_TO_PPP(pf); 621 - rtnl_lock(); 622 - if (file == ppp->owner) 623 - unregister_netdevice(ppp->dev); 624 - rtnl_unlock(); 625 - } 626 - if (atomic_long_read(&file->f_count) < 2) { 627 - ppp_release(NULL, file); 628 - err = 0; 629 - } else 630 - pr_warn("PPPIOCDETACH file->f_count=%ld\n", 631 - atomic_long_read(&file->f_count)); 632 615 goto out; 633 616 } 634 617
+15 -4
drivers/net/tun.c
··· 1423 1423 dev->max_mtu = MAX_MTU - dev->hard_header_len; 1424 1424 } 1425 1425 1426 + static bool tun_sock_writeable(struct tun_struct *tun, struct tun_file *tfile) 1427 + { 1428 + struct sock *sk = tfile->socket.sk; 1429 + 1430 + return (tun->dev->flags & IFF_UP) && sock_writeable(sk); 1431 + } 1432 + 1426 1433 /* Character device part */ 1427 1434 1428 1435 /* Poll */ ··· 1452 1445 if (!ptr_ring_empty(&tfile->tx_ring)) 1453 1446 mask |= EPOLLIN | EPOLLRDNORM; 1454 1447 1455 - if (tun->dev->flags & IFF_UP && 1456 - (sock_writeable(sk) || 1457 - (!test_and_set_bit(SOCKWQ_ASYNC_NOSPACE, &sk->sk_socket->flags) && 1458 - sock_writeable(sk)))) 1448 + /* Make sure SOCKWQ_ASYNC_NOSPACE is set if not writable to 1449 + * guarantee EPOLLOUT to be raised by either here or 1450 + * tun_sock_write_space(). Then process could get notification 1451 + * after it writes to a down device and meets -EIO. 1452 + */ 1453 + if (tun_sock_writeable(tun, tfile) || 1454 + (!test_and_set_bit(SOCKWQ_ASYNC_NOSPACE, &sk->sk_socket->flags) && 1455 + tun_sock_writeable(tun, tfile))) 1459 1456 mask |= EPOLLOUT | EPOLLWRNORM; 1460 1457 1461 1458 if (tun->dev->reg_state != NETREG_REGISTERED)
+10 -11
drivers/net/virtio_net.c
··· 707 707 void *data; 708 708 u32 act; 709 709 710 + /* Transient failure which in theory could occur if 711 + * in-flight packets from before XDP was enabled reach 712 + * the receive path after XDP is loaded. 713 + */ 714 + if (unlikely(hdr->hdr.gso_type)) 715 + goto err_xdp; 716 + 710 717 /* This happens when rx buffer size is underestimated 711 718 * or headroom is not enough because of the buffer 712 719 * was refilled before XDP is set. This should only ··· 733 726 } else { 734 727 xdp_page = page; 735 728 } 736 - 737 - /* Transient failure which in theory could occur if 738 - * in-flight packets from before XDP was enabled reach 739 - * the receive path after XDP is loaded. In practice I 740 - * was not able to create this condition. 741 - */ 742 - if (unlikely(hdr->hdr.gso_type)) 743 - goto err_xdp; 744 729 745 730 /* Allow consuming headroom but reserve enough space to push 746 731 * the descriptor on if we get an XDP_TX return code. ··· 774 775 } 775 776 *xdp_xmit = true; 776 777 if (unlikely(xdp_page != page)) 777 - goto err_xdp; 778 + put_page(page); 778 779 rcu_read_unlock(); 779 780 goto xdp_xmit; 780 781 case XDP_REDIRECT: ··· 786 787 } 787 788 *xdp_xmit = true; 788 789 if (unlikely(xdp_page != page)) 789 - goto err_xdp; 790 + put_page(page); 790 791 rcu_read_unlock(); 791 792 goto xdp_xmit; 792 793 default: ··· 874 875 rcu_read_unlock(); 875 876 err_skb: 876 877 put_page(page); 877 - while (--num_buf) { 878 + while (num_buf-- > 1) { 878 879 buf = virtqueue_get_buf(rq->vq, &len); 879 880 if (unlikely(!buf)) { 880 881 pr_debug("%s: rx error: %d buffers missing\n",
+2 -2
drivers/net/wireless/mac80211_hwsim.c
··· 3340 3340 static int hwsim_dump_radio_nl(struct sk_buff *skb, 3341 3341 struct netlink_callback *cb) 3342 3342 { 3343 - int last_idx = cb->args[0]; 3343 + int last_idx = cb->args[0] - 1; 3344 3344 struct mac80211_hwsim_data *data = NULL; 3345 3345 int res = 0; 3346 3346 void *hdr; ··· 3368 3368 last_idx = data->idx; 3369 3369 } 3370 3370 3371 - cb->args[0] = last_idx; 3371 + cb->args[0] = last_idx + 1; 3372 3372 3373 3373 /* list changed, but no new element sent, set interrupted flag */ 3374 3374 if (skb->len == 0 && cb->prev_seq && cb->seq != cb->prev_seq) {
+2 -2
drivers/ssb/Kconfig
··· 117 117 118 118 config SSB_DRIVER_PCICORE_POSSIBLE 119 119 bool 120 - depends on SSB_PCIHOST && SSB = y 120 + depends on SSB_PCIHOST 121 121 default y 122 122 123 123 config SSB_DRIVER_PCICORE ··· 131 131 132 132 config SSB_PCICORE_HOSTMODE 133 133 bool "Hostmode support for SSB PCI core" 134 - depends on SSB_DRIVER_PCICORE && SSB_DRIVER_MIPS 134 + depends on SSB_DRIVER_PCICORE && SSB_DRIVER_MIPS && SSB = y 135 135 help 136 136 PCIcore hostmode operation (external PCI bus). 137 137
+3
drivers/vhost/vhost.c
··· 981 981 { 982 982 int ret = 0; 983 983 984 + mutex_lock(&dev->mutex); 984 985 vhost_dev_lock_vqs(dev); 985 986 switch (msg->type) { 986 987 case VHOST_IOTLB_UPDATE: ··· 1017 1016 } 1018 1017 1019 1018 vhost_dev_unlock_vqs(dev); 1019 + mutex_unlock(&dev->mutex); 1020 + 1020 1021 return ret; 1021 1022 } 1022 1023 ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
+1 -1
include/linux/bpf_verifier.h
··· 142 142 struct bpf_insn_aux_data { 143 143 union { 144 144 enum bpf_reg_type ptr_type; /* pointer type for load/store insns */ 145 - struct bpf_map *map_ptr; /* pointer for call insn into lookup_elem */ 145 + unsigned long map_state; /* pointer/poison value for maps */ 146 146 s32 call_imm; /* saved imm field of call insn */ 147 147 }; 148 148 int ctx_field_size; /* the ctx field size for load insn, maybe 0 */
+2
include/net/sctp/sctp.h
··· 103 103 /* 104 104 * sctp/socket.c 105 105 */ 106 + int sctp_inet_connect(struct socket *sock, struct sockaddr *uaddr, 107 + int addr_len, int flags); 106 108 int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb); 107 109 int sctp_inet_listen(struct socket *sock, int backlog); 108 110 void sctp_write_space(struct sock *sk);
+1 -1
include/uapi/linux/nl80211.h
··· 2698 2698 #define NL80211_ATTR_KEYS NL80211_ATTR_KEYS 2699 2699 #define NL80211_ATTR_FEATURE_FLAGS NL80211_ATTR_FEATURE_FLAGS 2700 2700 2701 - #define NL80211_WIPHY_NAME_MAXLEN 128 2701 + #define NL80211_WIPHY_NAME_MAXLEN 64 2702 2702 2703 2703 #define NL80211_MAX_SUPP_RATES 32 2704 2704 #define NL80211_MAX_SUPP_HT_RATES 77
+1 -1
include/uapi/linux/ppp-ioctl.h
··· 106 106 #define PPPIOCGIDLE _IOR('t', 63, struct ppp_idle) /* get idle time */ 107 107 #define PPPIOCNEWUNIT _IOWR('t', 62, int) /* create new ppp unit */ 108 108 #define PPPIOCATTACH _IOW('t', 61, int) /* attach to ppp unit */ 109 - #define PPPIOCDETACH _IOW('t', 60, int) /* detach from ppp unit/chan */ 109 + #define PPPIOCDETACH _IOW('t', 60, int) /* obsolete, do not use */ 110 110 #define PPPIOCSMRRU _IOW('t', 59, int) /* set multilink MRU */ 111 111 #define PPPIOCCONNECT _IOW('t', 58, int) /* connect channel to unit */ 112 112 #define PPPIOCDISCONN _IO('t', 57) /* disconnect channel */
+64 -22
kernel/bpf/verifier.c
··· 156 156 #define BPF_COMPLEXITY_LIMIT_INSNS 131072 157 157 #define BPF_COMPLEXITY_LIMIT_STACK 1024 158 158 159 - #define BPF_MAP_PTR_POISON ((void *)0xeB9F + POISON_POINTER_DELTA) 159 + #define BPF_MAP_PTR_UNPRIV 1UL 160 + #define BPF_MAP_PTR_POISON ((void *)((0xeB9FUL << 1) + \ 161 + POISON_POINTER_DELTA)) 162 + #define BPF_MAP_PTR(X) ((struct bpf_map *)((X) & ~BPF_MAP_PTR_UNPRIV)) 163 + 164 + static bool bpf_map_ptr_poisoned(const struct bpf_insn_aux_data *aux) 165 + { 166 + return BPF_MAP_PTR(aux->map_state) == BPF_MAP_PTR_POISON; 167 + } 168 + 169 + static bool bpf_map_ptr_unpriv(const struct bpf_insn_aux_data *aux) 170 + { 171 + return aux->map_state & BPF_MAP_PTR_UNPRIV; 172 + } 173 + 174 + static void bpf_map_ptr_store(struct bpf_insn_aux_data *aux, 175 + const struct bpf_map *map, bool unpriv) 176 + { 177 + BUILD_BUG_ON((unsigned long)BPF_MAP_PTR_POISON & BPF_MAP_PTR_UNPRIV); 178 + unpriv |= bpf_map_ptr_unpriv(aux); 179 + aux->map_state = (unsigned long)map | 180 + (unpriv ? BPF_MAP_PTR_UNPRIV : 0UL); 181 + } 160 182 161 183 struct bpf_call_arg_meta { 162 184 struct bpf_map *map_ptr; ··· 2380 2358 return 0; 2381 2359 } 2382 2360 2361 + static int 2362 + record_func_map(struct bpf_verifier_env *env, struct bpf_call_arg_meta *meta, 2363 + int func_id, int insn_idx) 2364 + { 2365 + struct bpf_insn_aux_data *aux = &env->insn_aux_data[insn_idx]; 2366 + 2367 + if (func_id != BPF_FUNC_tail_call && 2368 + func_id != BPF_FUNC_map_lookup_elem) 2369 + return 0; 2370 + if (meta->map_ptr == NULL) { 2371 + verbose(env, "kernel subsystem misconfigured verifier\n"); 2372 + return -EINVAL; 2373 + } 2374 + 2375 + if (!BPF_MAP_PTR(aux->map_state)) 2376 + bpf_map_ptr_store(aux, meta->map_ptr, 2377 + meta->map_ptr->unpriv_array); 2378 + else if (BPF_MAP_PTR(aux->map_state) != meta->map_ptr) 2379 + bpf_map_ptr_store(aux, BPF_MAP_PTR_POISON, 2380 + meta->map_ptr->unpriv_array); 2381 + return 0; 2382 + } 2383 + 2383 2384 static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn_idx) 2384 2385 { 2385 2386 const struct bpf_func_proto *fn = NULL; ··· 2457 2412 err = check_func_arg(env, BPF_REG_2, fn->arg2_type, &meta); 2458 2413 if (err) 2459 2414 return err; 2460 - if (func_id == BPF_FUNC_tail_call) { 2461 - if (meta.map_ptr == NULL) { 2462 - verbose(env, "verifier bug\n"); 2463 - return -EINVAL; 2464 - } 2465 - env->insn_aux_data[insn_idx].map_ptr = meta.map_ptr; 2466 - } 2467 2415 err = check_func_arg(env, BPF_REG_3, fn->arg3_type, &meta); 2468 2416 if (err) 2469 2417 return err; ··· 2464 2426 if (err) 2465 2427 return err; 2466 2428 err = check_func_arg(env, BPF_REG_5, fn->arg5_type, &meta); 2429 + if (err) 2430 + return err; 2431 + 2432 + err = record_func_map(env, &meta, func_id, insn_idx); 2467 2433 if (err) 2468 2434 return err; 2469 2435 ··· 2495 2453 } else if (fn->ret_type == RET_VOID) { 2496 2454 regs[BPF_REG_0].type = NOT_INIT; 2497 2455 } else if (fn->ret_type == RET_PTR_TO_MAP_VALUE_OR_NULL) { 2498 - struct bpf_insn_aux_data *insn_aux; 2499 - 2500 2456 regs[BPF_REG_0].type = PTR_TO_MAP_VALUE_OR_NULL; 2501 2457 /* There is no offset yet applied, variable or fixed */ 2502 2458 mark_reg_known_zero(env, regs, BPF_REG_0); ··· 2510 2470 } 2511 2471 regs[BPF_REG_0].map_ptr = meta.map_ptr; 2512 2472 regs[BPF_REG_0].id = ++env->id_gen; 2513 - insn_aux = &env->insn_aux_data[insn_idx]; 2514 - if (!insn_aux->map_ptr) 2515 - insn_aux->map_ptr = meta.map_ptr; 2516 - else if (insn_aux->map_ptr != meta.map_ptr) 2517 - insn_aux->map_ptr = BPF_MAP_PTR_POISON; 2518 2473 } else { 2519 2474 verbose(env, "unknown return type %d of func %s#%d\n", 2520 2475 fn->ret_type, func_id_name(func_id), func_id); ··· 5505 5470 struct bpf_insn *insn = prog->insnsi; 5506 5471 const struct bpf_func_proto *fn; 5507 5472 const int insn_cnt = prog->len; 5473 + struct bpf_insn_aux_data *aux; 5508 5474 struct bpf_insn insn_buf[16]; 5509 5475 struct bpf_prog *new_prog; 5510 5476 struct bpf_map *map_ptr; ··· 5580 5544 insn->imm = 0; 5581 5545 insn->code = BPF_JMP | BPF_TAIL_CALL; 5582 5546 5547 + aux = &env->insn_aux_data[i + delta]; 5548 + if (!bpf_map_ptr_unpriv(aux)) 5549 + continue; 5550 + 5583 5551 /* instead of changing every JIT dealing with tail_call 5584 5552 * emit two extra insns: 5585 5553 * if (index >= max_entries) goto out; 5586 5554 * index &= array->index_mask; 5587 5555 * to avoid out-of-bounds cpu speculation 5588 5556 */ 5589 - map_ptr = env->insn_aux_data[i + delta].map_ptr; 5590 - if (map_ptr == BPF_MAP_PTR_POISON) { 5557 + if (bpf_map_ptr_poisoned(aux)) { 5591 5558 verbose(env, "tail_call abusing map_ptr\n"); 5592 5559 return -EINVAL; 5593 5560 } 5594 - if (!map_ptr->unpriv_array) 5595 - continue; 5561 + 5562 + map_ptr = BPF_MAP_PTR(aux->map_state); 5596 5563 insn_buf[0] = BPF_JMP_IMM(BPF_JGE, BPF_REG_3, 5597 5564 map_ptr->max_entries, 2); 5598 5565 insn_buf[1] = BPF_ALU32_IMM(BPF_AND, BPF_REG_3, ··· 5619 5580 */ 5620 5581 if (prog->jit_requested && BITS_PER_LONG == 64 && 5621 5582 insn->imm == BPF_FUNC_map_lookup_elem) { 5622 - map_ptr = env->insn_aux_data[i + delta].map_ptr; 5623 - if (map_ptr == BPF_MAP_PTR_POISON || 5624 - !map_ptr->ops->map_gen_lookup) 5583 + aux = &env->insn_aux_data[i + delta]; 5584 + if (bpf_map_ptr_poisoned(aux)) 5585 + goto patch_call_imm; 5586 + 5587 + map_ptr = BPF_MAP_PTR(aux->map_state); 5588 + if (!map_ptr->ops->map_gen_lookup) 5625 5589 goto patch_call_imm; 5626 5590 5627 5591 cnt = map_ptr->ops->map_gen_lookup(map_ptr, insn_buf);
+1 -1
net/batman-adv/multicast.c
··· 1536 1536 1537 1537 if (!ret && primary_if) 1538 1538 *primary_if = hard_iface; 1539 - else 1539 + else if (hard_iface) 1540 1540 batadv_hardif_put(hard_iface); 1541 1541 1542 1542 return ret;
+67 -17
net/batman-adv/translation-table.c
··· 862 862 struct batadv_orig_node_vlan *vlan; 863 863 u8 *tt_change_ptr; 864 864 865 - rcu_read_lock(); 865 + spin_lock_bh(&orig_node->vlan_list_lock); 866 866 hlist_for_each_entry_rcu(vlan, &orig_node->vlan_list, list) { 867 867 num_vlan++; 868 868 num_entries += atomic_read(&vlan->tt.num_entries); ··· 900 900 *tt_change = (struct batadv_tvlv_tt_change *)tt_change_ptr; 901 901 902 902 out: 903 - rcu_read_unlock(); 903 + spin_unlock_bh(&orig_node->vlan_list_lock); 904 904 return tvlv_len; 905 905 } 906 906 ··· 931 931 struct batadv_tvlv_tt_vlan_data *tt_vlan; 932 932 struct batadv_softif_vlan *vlan; 933 933 u16 num_vlan = 0; 934 - u16 num_entries = 0; 934 + u16 vlan_entries = 0; 935 + u16 total_entries = 0; 935 936 u16 tvlv_len; 936 937 u8 *tt_change_ptr; 937 938 int change_offset; 938 939 939 - rcu_read_lock(); 940 + spin_lock_bh(&bat_priv->softif_vlan_list_lock); 940 941 hlist_for_each_entry_rcu(vlan, &bat_priv->softif_vlan_list, list) { 942 + vlan_entries = atomic_read(&vlan->tt.num_entries); 943 + if (vlan_entries < 1) 944 + continue; 945 + 941 946 num_vlan++; 942 - num_entries += atomic_read(&vlan->tt.num_entries); 947 + total_entries += vlan_entries; 943 948 } 944 949 945 950 change_offset = sizeof(**tt_data); ··· 952 947 953 948 /* if tt_len is negative, allocate the space needed by the full table */ 954 949 if (*tt_len < 0) 955 - *tt_len = batadv_tt_len(num_entries); 950 + *tt_len = batadv_tt_len(total_entries); 956 951 957 952 tvlv_len = *tt_len; 958 953 tvlv_len += change_offset; ··· 969 964 970 965 tt_vlan = (struct batadv_tvlv_tt_vlan_data *)(*tt_data + 1); 971 966 hlist_for_each_entry_rcu(vlan, &bat_priv->softif_vlan_list, list) { 967 + vlan_entries = atomic_read(&vlan->tt.num_entries); 968 + if (vlan_entries < 1) 969 + continue; 970 + 972 971 tt_vlan->vid = htons(vlan->vid); 973 972 tt_vlan->crc = htonl(vlan->tt.crc); 974 973 ··· 983 974 *tt_change = (struct batadv_tvlv_tt_change *)tt_change_ptr; 984 975 985 976 out: 986 - rcu_read_unlock(); 977 + spin_unlock_bh(&bat_priv->softif_vlan_list_lock); 987 978 return tvlv_len; 988 979 } 989 980 ··· 1547 1538 * handled by a given originator 1548 1539 * @entry: the TT global entry to check 1549 1540 * @orig_node: the originator to search in the list 1541 + * @flags: a pointer to store TT flags for the given @entry received 1542 + * from @orig_node 1550 1543 * 1551 1544 * find out if an orig_node is already in the list of a tt_global_entry. 1552 1545 * ··· 1556 1545 */ 1557 1546 static bool 1558 1547 batadv_tt_global_entry_has_orig(const struct batadv_tt_global_entry *entry, 1559 - const struct batadv_orig_node *orig_node) 1548 + const struct batadv_orig_node *orig_node, 1549 + u8 *flags) 1560 1550 { 1561 1551 struct batadv_tt_orig_list_entry *orig_entry; 1562 1552 bool found = false; ··· 1565 1553 orig_entry = batadv_tt_global_orig_entry_find(entry, orig_node); 1566 1554 if (orig_entry) { 1567 1555 found = true; 1556 + 1557 + if (flags) 1558 + *flags = orig_entry->flags; 1559 + 1568 1560 batadv_tt_orig_list_entry_put(orig_entry); 1569 1561 } 1570 1562 ··· 1747 1731 if (!(common->flags & BATADV_TT_CLIENT_TEMP)) 1748 1732 goto out; 1749 1733 if (batadv_tt_global_entry_has_orig(tt_global_entry, 1750 - orig_node)) 1734 + orig_node, NULL)) 1751 1735 goto out_remove; 1752 1736 batadv_tt_global_del_orig_list(tt_global_entry); 1753 1737 goto add_orig_entry; ··· 2896 2880 } 2897 2881 2898 2882 /** 2899 - * batadv_tt_local_valid() - verify that given tt entry is a valid one 2883 + * batadv_tt_local_valid() - verify local tt entry and get flags 2900 2884 * @entry_ptr: to be checked local tt entry 2901 2885 * @data_ptr: not used but definition required to satisfy the callback prototype 2886 + * @flags: a pointer to store TT flags for this client to 2887 + * 2888 + * Checks the validity of the given local TT entry. If it is, then the provided 2889 + * flags pointer is updated. 2902 2890 * 2903 2891 * Return: true if the entry is a valid, false otherwise. 2904 2892 */ 2905 - static bool batadv_tt_local_valid(const void *entry_ptr, const void *data_ptr) 2893 + static bool batadv_tt_local_valid(const void *entry_ptr, 2894 + const void *data_ptr, 2895 + u8 *flags) 2906 2896 { 2907 2897 const struct batadv_tt_common_entry *tt_common_entry = entry_ptr; 2908 2898 2909 2899 if (tt_common_entry->flags & BATADV_TT_CLIENT_NEW) 2910 2900 return false; 2901 + 2902 + if (flags) 2903 + *flags = tt_common_entry->flags; 2904 + 2911 2905 return true; 2912 2906 } 2913 2907 2908 + /** 2909 + * batadv_tt_global_valid() - verify global tt entry and get flags 2910 + * @entry_ptr: to be checked global tt entry 2911 + * @data_ptr: an orig_node object (may be NULL) 2912 + * @flags: a pointer to store TT flags for this client to 2913 + * 2914 + * Checks the validity of the given global TT entry. If it is, then the provided 2915 + * flags pointer is updated either with the common (summed) TT flags if data_ptr 2916 + * is NULL or the specific, per originator TT flags otherwise. 2917 + * 2918 + * Return: true if the entry is a valid, false otherwise. 2919 + */ 2914 2920 static bool batadv_tt_global_valid(const void *entry_ptr, 2915 - const void *data_ptr) 2921 + const void *data_ptr, 2922 + u8 *flags) 2916 2923 { 2917 2924 const struct batadv_tt_common_entry *tt_common_entry = entry_ptr; 2918 2925 const struct batadv_tt_global_entry *tt_global_entry; ··· 2949 2910 struct batadv_tt_global_entry, 2950 2911 common); 2951 2912 2952 - return batadv_tt_global_entry_has_orig(tt_global_entry, orig_node); 2913 + return batadv_tt_global_entry_has_orig(tt_global_entry, orig_node, 2914 + flags); 2953 2915 } 2954 2916 2955 2917 /** ··· 2960 2920 * @hash: hash table containing the tt entries 2961 2921 * @tt_len: expected tvlv tt data buffer length in number of bytes 2962 2922 * @tvlv_buff: pointer to the buffer to fill with the TT data 2963 - * @valid_cb: function to filter tt change entries 2923 + * @valid_cb: function to filter tt change entries and to return TT flags 2964 2924 * @cb_data: data passed to the filter function as argument 2925 + * 2926 + * Fills the tvlv buff with the tt entries from the specified hash. If valid_cb 2927 + * is not provided then this becomes a no-op. 2965 2928 */ 2966 2929 static void batadv_tt_tvlv_generate(struct batadv_priv *bat_priv, 2967 2930 struct batadv_hashtable *hash, 2968 2931 void *tvlv_buff, u16 tt_len, 2969 2932 bool (*valid_cb)(const void *, 2970 - const void *), 2933 + const void *, 2934 + u8 *flags), 2971 2935 void *cb_data) 2972 2936 { 2973 2937 struct batadv_tt_common_entry *tt_common_entry; 2974 2938 struct batadv_tvlv_tt_change *tt_change; 2975 2939 struct hlist_head *head; 2976 2940 u16 tt_tot, tt_num_entries = 0; 2941 + u8 flags; 2942 + bool ret; 2977 2943 u32 i; 2978 2944 2979 2945 tt_tot = batadv_tt_entries(tt_len); 2980 2946 tt_change = (struct batadv_tvlv_tt_change *)tvlv_buff; 2947 + 2948 + if (!valid_cb) 2949 + return; 2981 2950 2982 2951 rcu_read_lock(); 2983 2952 for (i = 0; i < hash->size; i++) { ··· 2997 2948 if (tt_tot == tt_num_entries) 2998 2949 break; 2999 2950 3000 - if ((valid_cb) && (!valid_cb(tt_common_entry, cb_data))) 2951 + ret = valid_cb(tt_common_entry, cb_data, &flags); 2952 + if (!ret) 3001 2953 continue; 3002 2954 3003 2955 ether_addr_copy(tt_change->addr, tt_common_entry->addr); 3004 - tt_change->flags = tt_common_entry->flags; 2956 + tt_change->flags = flags; 3005 2957 tt_change->vid = htons(tt_common_entry->vid); 3006 2958 memset(tt_change->reserved, 0, 3007 2959 sizeof(tt_change->reserved));
-2
net/dccp/proto.c
··· 283 283 284 284 dccp_clear_xmit_timers(sk); 285 285 ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk); 286 - ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); 287 286 dp->dccps_hc_rx_ccid = NULL; 288 - dp->dccps_hc_tx_ccid = NULL; 289 287 290 288 __skb_queue_purge(&sk->sk_receive_queue); 291 289 __skb_queue_purge(&sk->sk_write_queue);
+1
net/ipv4/fib_frontend.c
··· 649 649 [RTA_ENCAP] = { .type = NLA_NESTED }, 650 650 [RTA_UID] = { .type = NLA_U32 }, 651 651 [RTA_MARK] = { .type = NLA_U32 }, 652 + [RTA_TABLE] = { .type = NLA_U32 }, 652 653 }; 653 654 654 655 static int rtm_to_fib_config(struct net *net, struct sk_buff *skb,
-2
net/ipv4/ip_sockglue.c
··· 505 505 int err; 506 506 int copied; 507 507 508 - WARN_ON_ONCE(sk->sk_family == AF_INET6); 509 - 510 508 err = -EAGAIN; 511 509 skb = sock_dequeue_err_skb(sk); 512 510 if (!skb)
+4 -1
net/ipv4/ipmr_base.c
··· 43 43 write_pnet(&mrt->net, net); 44 44 45 45 mrt->ops = *ops; 46 - rhltable_init(&mrt->mfc_hash, mrt->ops.rht_params); 46 + if (rhltable_init(&mrt->mfc_hash, mrt->ops.rht_params)) { 47 + kfree(mrt); 48 + return NULL; 49 + } 47 50 INIT_LIST_HEAD(&mrt->mfc_cache_list); 48 51 INIT_LIST_HEAD(&mrt->mfc_unres_queue); 49 52
+4 -4
net/mac80211/mesh_plink.c
··· 401 401 402 402 static void mesh_sta_info_init(struct ieee80211_sub_if_data *sdata, 403 403 struct sta_info *sta, 404 - struct ieee802_11_elems *elems, bool insert) 404 + struct ieee802_11_elems *elems) 405 405 { 406 406 struct ieee80211_local *local = sdata->local; 407 407 struct ieee80211_supported_band *sband; ··· 447 447 sta->sta.bandwidth = IEEE80211_STA_RX_BW_20; 448 448 } 449 449 450 - if (insert) 450 + if (!test_sta_flag(sta, WLAN_STA_RATE_CONTROL)) 451 451 rate_control_rate_init(sta); 452 452 else 453 453 rate_control_rate_update(local, sband, sta, changed); ··· 551 551 rcu_read_lock(); 552 552 sta = sta_info_get(sdata, addr); 553 553 if (sta) { 554 - mesh_sta_info_init(sdata, sta, elems, false); 554 + mesh_sta_info_init(sdata, sta, elems); 555 555 } else { 556 556 rcu_read_unlock(); 557 557 /* can't run atomic */ ··· 561 561 return NULL; 562 562 } 563 563 564 - mesh_sta_info_init(sdata, sta, elems, true); 564 + mesh_sta_info_init(sdata, sta, elems); 565 565 566 566 if (sta_info_insert_rcu(sta)) 567 567 return NULL;
+1 -1
net/packet/af_packet.c
··· 2911 2911 if (unlikely(offset < 0)) 2912 2912 goto out_free; 2913 2913 } else if (reserve) { 2914 - skb_push(skb, reserve); 2914 + skb_reserve(skb, -reserve); 2915 2915 } 2916 2916 2917 2917 /* Returns -EFAULT on error */
+1 -1
net/sched/cls_api.c
··· 1588 1588 return ret; 1589 1589 ok_count = ret; 1590 1590 1591 - if (!exts) 1591 + if (!exts || ok_count) 1592 1592 return ok_count; 1593 1593 ret = tc_exts_setup_cb_egdev_call(exts, type, type_data, err_stop); 1594 1594 if (ret < 0)
+1 -1
net/sctp/ipv6.c
··· 1006 1006 .owner = THIS_MODULE, 1007 1007 .release = inet6_release, 1008 1008 .bind = inet6_bind, 1009 - .connect = inet_dgram_connect, 1009 + .connect = sctp_inet_connect, 1010 1010 .socketpair = sock_no_socketpair, 1011 1011 .accept = inet_accept, 1012 1012 .getname = sctp_getname,
+1 -1
net/sctp/protocol.c
··· 1012 1012 .owner = THIS_MODULE, 1013 1013 .release = inet_release, /* Needs to be wrapped... */ 1014 1014 .bind = inet_bind, 1015 - .connect = inet_dgram_connect, 1015 + .connect = sctp_inet_connect, 1016 1016 .socketpair = sock_no_socketpair, 1017 1017 .accept = inet_accept, 1018 1018 .getname = inet_getname, /* Semantics are different. */
+35 -16
net/sctp/socket.c
··· 1086 1086 */ 1087 1087 static int __sctp_connect(struct sock *sk, 1088 1088 struct sockaddr *kaddrs, 1089 - int addrs_size, 1089 + int addrs_size, int flags, 1090 1090 sctp_assoc_t *assoc_id) 1091 1091 { 1092 1092 struct net *net = sock_net(sk); ··· 1104 1104 union sctp_addr *sa_addr = NULL; 1105 1105 void *addr_buf; 1106 1106 unsigned short port; 1107 - unsigned int f_flags = 0; 1108 1107 1109 1108 sp = sctp_sk(sk); 1110 1109 ep = sp->ep; ··· 1253 1254 sp->pf->to_sk_daddr(sa_addr, sk); 1254 1255 sk->sk_err = 0; 1255 1256 1256 - /* in-kernel sockets don't generally have a file allocated to them 1257 - * if all they do is call sock_create_kern(). 1258 - */ 1259 - if (sk->sk_socket->file) 1260 - f_flags = sk->sk_socket->file->f_flags; 1261 - 1262 - timeo = sock_sndtimeo(sk, f_flags & O_NONBLOCK); 1257 + timeo = sock_sndtimeo(sk, flags & O_NONBLOCK); 1263 1258 1264 1259 if (assoc_id) 1265 1260 *assoc_id = asoc->assoc_id; ··· 1341 1348 sctp_assoc_t *assoc_id) 1342 1349 { 1343 1350 struct sockaddr *kaddrs; 1344 - int err = 0; 1351 + int err = 0, flags = 0; 1345 1352 1346 1353 pr_debug("%s: sk:%p addrs:%p addrs_size:%d\n", 1347 1354 __func__, sk, addrs, addrs_size); ··· 1360 1367 if (err) 1361 1368 goto out_free; 1362 1369 1363 - err = __sctp_connect(sk, kaddrs, addrs_size, assoc_id); 1370 + /* in-kernel sockets don't generally have a file allocated to them 1371 + * if all they do is call sock_create_kern(). 1372 + */ 1373 + if (sk->sk_socket->file) 1374 + flags = sk->sk_socket->file->f_flags; 1375 + 1376 + err = __sctp_connect(sk, kaddrs, addrs_size, flags, assoc_id); 1364 1377 1365 1378 out_free: 1366 1379 kvfree(kaddrs); ··· 4396 4397 * len: the size of the address. 4397 4398 */ 4398 4399 static int sctp_connect(struct sock *sk, struct sockaddr *addr, 4399 - int addr_len) 4400 + int addr_len, int flags) 4400 4401 { 4401 - int err = 0; 4402 + struct inet_sock *inet = inet_sk(sk); 4402 4403 struct sctp_af *af; 4404 + int err = 0; 4403 4405 4404 4406 lock_sock(sk); 4405 4407 4406 4408 pr_debug("%s: sk:%p, sockaddr:%p, addr_len:%d\n", __func__, sk, 4407 4409 addr, addr_len); 4410 + 4411 + /* We may need to bind the socket. */ 4412 + if (!inet->inet_num) { 4413 + if (sk->sk_prot->get_port(sk, 0)) { 4414 + release_sock(sk); 4415 + return -EAGAIN; 4416 + } 4417 + inet->inet_sport = htons(inet->inet_num); 4418 + } 4408 4419 4409 4420 /* Validate addr_len before calling common connect/connectx routine. */ 4410 4421 af = sctp_get_af_specific(addr->sa_family); ··· 4424 4415 /* Pass correct addr len to common routine (so it knows there 4425 4416 * is only one address being passed. 4426 4417 */ 4427 - err = __sctp_connect(sk, addr, af->sockaddr_len, NULL); 4418 + err = __sctp_connect(sk, addr, af->sockaddr_len, flags, NULL); 4428 4419 } 4429 4420 4430 4421 release_sock(sk); 4431 4422 return err; 4423 + } 4424 + 4425 + int sctp_inet_connect(struct socket *sock, struct sockaddr *uaddr, 4426 + int addr_len, int flags) 4427 + { 4428 + if (addr_len < sizeof(uaddr->sa_family)) 4429 + return -EINVAL; 4430 + 4431 + if (uaddr->sa_family == AF_UNSPEC) 4432 + return -EOPNOTSUPP; 4433 + 4434 + return sctp_connect(sock->sk, uaddr, addr_len, flags); 4432 4435 } 4433 4436 4434 4437 /* FIXME: Write comments. */ ··· 8745 8724 .name = "SCTP", 8746 8725 .owner = THIS_MODULE, 8747 8726 .close = sctp_close, 8748 - .connect = sctp_connect, 8749 8727 .disconnect = sctp_disconnect, 8750 8728 .accept = sctp_accept, 8751 8729 .ioctl = sctp_ioctl, ··· 8787 8767 .name = "SCTPv6", 8788 8768 .owner = THIS_MODULE, 8789 8769 .close = sctp_close, 8790 - .connect = sctp_connect, 8791 8770 .disconnect = sctp_disconnect, 8792 8771 .accept = sctp_accept, 8793 8772 .ioctl = sctp_ioctl,
+2 -1
net/wireless/nl80211.c
··· 15555 15555 if (!ft_event->target_ap) 15556 15556 return; 15557 15557 15558 - msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL); 15558 + msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len, 15559 + GFP_KERNEL); 15559 15560 if (!msg) 15560 15561 return; 15561 15562
+3
net/wireless/reg.c
··· 916 916 const struct fwdb_header *hdr = regdb; 917 917 const struct fwdb_country *country; 918 918 919 + if (!regdb) 920 + return -ENODATA; 921 + 919 922 if (IS_ERR(regdb)) 920 923 return PTR_ERR(regdb); 921 924
+2
tools/testing/selftests/bpf/config
··· 5 5 CONFIG_TEST_BPF=m 6 6 CONFIG_CGROUP_BPF=y 7 7 CONFIG_NETDEVSIM=m 8 + CONFIG_NET_CLS_ACT=y 9 + CONFIG_NET_SCH_INGRESS=y
+5
tools/testing/selftests/net/config
··· 7 7 CONFIG_IPV6=y 8 8 CONFIG_IPV6_MULTIPLE_TABLES=y 9 9 CONFIG_VETH=y 10 + CONFIG_INET_XFRM_MODE_TUNNEL=y 11 + CONFIG_NET_IPVTI=y 12 + CONFIG_INET6_XFRM_MODE_TUNNEL=y 13 + CONFIG_IPV6_VTI=y 14 + CONFIG_DUMMY=y
+3 -1
tools/testing/selftests/net/reuseport_bpf_numa.c
··· 23 23 #include <unistd.h> 24 24 #include <numa.h> 25 25 26 + #include "../kselftest.h" 27 + 26 28 static const int PORT = 8888; 27 29 28 30 static void build_rcv_group(int *rcv_fd, size_t len, int family, int proto) ··· 231 229 int *rcv_fd, nodes; 232 230 233 231 if (numa_available() < 0) 234 - error(1, errno, "no numa api support"); 232 + ksft_exit_skip("no numa api support\n"); 235 233 236 234 nodes = numa_max_node() + 1; 237 235