tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue

Tony Nguyen says:

====================
Intel Wired LAN Driver Updates 2025-12-17 (i40e, iavf, idpf, e1000)

For i40e:
Przemyslaw immediately schedules service task following changes to
filters to ensure timely setup for PTP.

Gregory Herrero adjusts VF descriptor size checks to be device specific.

For iavf:
Kohei Enju corrects a couple of condition checks which caused off-by-one
issues.

For idpf:
Larysa fixes LAN memory region call to follow expected requirements.

Brian Vazquez reduces mailbox wait time during init to avoid lengthy
delays.

For e1000:
Guangshuo Li adds validation of data length to prevent out-of-bounds
access.

* '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:
e1000: fix OOB in e1000_tbi_should_accept()
idpf: reduce mbx_task schedule delay to 300us
idpf: fix LAN memory regions command on some NVMs
iavf: fix off-by-one issues in iavf_config_rss_reg()
i40e: validate ring_len parameter against hardware-specific values
i40e: fix scheduling in set_rx_mode
====================

Link: https://patch.msgid.link/
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

Paolo Abeni 352df98b d5dc2830

+31 -18
+9 -1
drivers/net/ethernet/intel/e1000/e1000_main.c
··· 4094 4094 u32 length, const u8 *data) 4095 4095 { 4096 4096 struct e1000_hw *hw = &adapter->hw; 4097 - u8 last_byte = *(data + length - 1); 4097 + u8 last_byte; 4098 + 4099 + /* Guard against OOB on data[length - 1] */ 4100 + if (unlikely(!length)) 4101 + return false; 4102 + /* Upper bound: length must not exceed rx_buffer_len */ 4103 + if (unlikely(length > adapter->rx_buffer_len)) 4104 + return false; 4105 + last_byte = *(data + length - 1); 4098 4106 4099 4107 if (TBI_ACCEPT(hw, status, errors, length, last_byte)) { 4100 4108 unsigned long irq_flags;
+11
drivers/net/ethernet/intel/i40e/i40e.h
··· 1422 1422 return (pf->lan_veb != I40E_NO_VEB) ? pf->veb[pf->lan_veb] : NULL; 1423 1423 } 1424 1424 1425 + static inline u32 i40e_get_max_num_descriptors(const struct i40e_pf *pf) 1426 + { 1427 + const struct i40e_hw *hw = &pf->hw; 1428 + 1429 + switch (hw->mac.type) { 1430 + case I40E_MAC_XL710: 1431 + return I40E_MAX_NUM_DESCRIPTORS_XL710; 1432 + default: 1433 + return I40E_MAX_NUM_DESCRIPTORS; 1434 + } 1435 + } 1425 1436 #endif /* _I40E_H_ */
-12
drivers/net/ethernet/intel/i40e/i40e_ethtool.c
··· 2013 2013 drvinfo->n_priv_flags += I40E_GL_PRIV_FLAGS_STR_LEN; 2014 2014 } 2015 2015 2016 - static u32 i40e_get_max_num_descriptors(struct i40e_pf *pf) 2017 - { 2018 - struct i40e_hw *hw = &pf->hw; 2019 - 2020 - switch (hw->mac.type) { 2021 - case I40E_MAC_XL710: 2022 - return I40E_MAX_NUM_DESCRIPTORS_XL710; 2023 - default: 2024 - return I40E_MAX_NUM_DESCRIPTORS; 2025 - } 2026 - } 2027 - 2028 2016 static void i40e_get_ringparam(struct net_device *netdev, 2029 2017 struct ethtool_ringparam *ring, 2030 2018 struct kernel_ethtool_ringparam *kernel_ring,
+1
drivers/net/ethernet/intel/i40e/i40e_main.c
··· 2234 2234 vsi->flags |= I40E_VSI_FLAG_FILTER_CHANGED; 2235 2235 set_bit(__I40E_MACVLAN_SYNC_PENDING, vsi->back->state); 2236 2236 } 2237 + i40e_service_event_schedule(vsi->back); 2237 2238 } 2238 2239 2239 2240 /**
+2 -2
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
··· 656 656 657 657 /* ring_len has to be multiple of 8 */ 658 658 if (!IS_ALIGNED(info->ring_len, 8) || 659 - info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) { 659 + info->ring_len > i40e_get_max_num_descriptors(pf)) { 660 660 ret = -EINVAL; 661 661 goto error_context; 662 662 } ··· 726 726 727 727 /* ring_len has to be multiple of 32 */ 728 728 if (!IS_ALIGNED(info->ring_len, 32) || 729 - info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) { 729 + info->ring_len > i40e_get_max_num_descriptors(pf)) { 730 730 ret = -EINVAL; 731 731 goto error_param; 732 732 }
+2 -2
drivers/net/ethernet/intel/iavf/iavf_main.c
··· 1726 1726 u16 i; 1727 1727 1728 1728 dw = (u32 *)adapter->rss_key; 1729 - for (i = 0; i <= adapter->rss_key_size / 4; i++) 1729 + for (i = 0; i < adapter->rss_key_size / 4; i++) 1730 1730 wr32(hw, IAVF_VFQF_HKEY(i), dw[i]); 1731 1731 1732 1732 dw = (u32 *)adapter->rss_lut; 1733 - for (i = 0; i <= adapter->rss_lut_size / 4; i++) 1733 + for (i = 0; i < adapter->rss_lut_size / 4; i++) 1734 1734 wr32(hw, IAVF_VFQF_HLUT(i), dw[i]); 1735 1735 1736 1736 iavf_flush(hw);
+1 -1
drivers/net/ethernet/intel/idpf/idpf_lib.c
··· 1271 1271 idpf_mb_irq_enable(adapter); 1272 1272 else 1273 1273 queue_delayed_work(adapter->mbx_wq, &adapter->mbx_task, 1274 - msecs_to_jiffies(300)); 1274 + usecs_to_jiffies(300)); 1275 1275 1276 1276 idpf_recv_mb_msg(adapter); 1277 1277 }
+5
drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
··· 1016 1016 struct idpf_vc_xn_params xn_params = { 1017 1017 .vc_op = VIRTCHNL2_OP_GET_LAN_MEMORY_REGIONS, 1018 1018 .recv_buf.iov_len = IDPF_CTLQ_MAX_BUF_LEN, 1019 + .send_buf.iov_len = 1020 + sizeof(struct virtchnl2_get_lan_memory_regions) + 1021 + sizeof(struct virtchnl2_mem_region), 1019 1022 .timeout_ms = IDPF_VC_XN_DEFAULT_TIMEOUT_MSEC, 1020 1023 }; 1021 1024 int num_regions, size; ··· 1031 1028 return -ENOMEM; 1032 1029 1033 1030 xn_params.recv_buf.iov_base = rcvd_regions; 1031 + rcvd_regions->num_memory_regions = cpu_to_le16(1); 1032 + xn_params.send_buf.iov_base = rcvd_regions; 1034 1033 reply_sz = idpf_vc_xn_exec(adapter, &xn_params); 1035 1034 if (reply_sz < 0) 1036 1035 return reply_sz;