Merge tag 'net-5.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

+1

Documentation/userspace-api/ioctl/ioctl-number.rst

··· 104 104 '8' all SNP8023 advanced NIC card 105 105 <mailto:mcr@solidum.com> 106 106 ';' 64-7F linux/vfio.h 107 + '=' 00-3f uapi/linux/ptp_clock.h <mailto:richardcochran@gmail.com> 107 108 '@' 00-0F linux/radeonfb.h conflict! 108 109 '@' 00-0F drivers/video/aty/aty128fb.c conflict! 109 110 'A' 00-1F linux/apm_bios.h conflict!

-1

MAINTAINERS

··· 11291 11291 F: drivers/net/ethernet/marvell/octeontx2/af/ 11292 11292 11293 11293 MARVELL PRESTERA ETHERNET SWITCH DRIVER 11294 - M: Vadym Kochan <vkochan@marvell.com> 11295 11294 M: Taras Chornyi <tchornyi@marvell.com> 11296 11295 S: Supported 11297 11296 W: https://github.com/Marvell-switching/switchdev-prestera

+5

arch/arm64/net/bpf_jit_comp.c

··· 1136 1136 return prog; 1137 1137 } 1138 1138 1139 + u64 bpf_jit_alloc_exec_limit(void) 1140 + { 1141 + return BPF_JIT_REGION_SIZE; 1142 + } 1143 + 1139 1144 void *bpf_jit_alloc_exec(unsigned long size) 1140 1145 { 1141 1146 return __vmalloc_node_range(size, PAGE_SIZE, BPF_JIT_REGION_START,

+7 -1

arch/riscv/net/bpf_jit_core.c

··· 125 125 126 126 if (i == NR_JIT_ITERATIONS) { 127 127 pr_err("bpf-jit: image did not converge in <%d passes!\n", i); 128 - bpf_jit_binary_free(jit_data->header); 128 + if (jit_data->header) 129 + bpf_jit_binary_free(jit_data->header); 129 130 prog = orig_prog; 130 131 goto out_offset; 131 132 } ··· 165 164 bpf_jit_prog_release_other(prog, prog == orig_prog ? 166 165 tmp : orig_prog); 167 166 return prog; 167 + } 168 + 169 + u64 bpf_jit_alloc_exec_limit(void) 170 + { 171 + return BPF_JIT_REGION_SIZE; 168 172 } 169 173 170 174 void *bpf_jit_alloc_exec(unsigned long size)

+8 -8

drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c

··· 137 137 .name = "uc", 138 138 .cmd = HNAE3_DBG_CMD_MAC_UC, 139 139 .dentry = HNS3_DBG_DENTRY_MAC, 140 - .buf_len = HNS3_DBG_READ_LEN, 140 + .buf_len = HNS3_DBG_READ_LEN_128KB, 141 141 .init = hns3_dbg_common_file_init, 142 142 }, 143 143 { ··· 256 256 .name = "tqp", 257 257 .cmd = HNAE3_DBG_CMD_REG_TQP, 258 258 .dentry = HNS3_DBG_DENTRY_REG, 259 - .buf_len = HNS3_DBG_READ_LEN, 259 + .buf_len = HNS3_DBG_READ_LEN_128KB, 260 260 .init = hns3_dbg_common_file_init, 261 261 }, 262 262 { ··· 298 298 .name = "fd_tcam", 299 299 .cmd = HNAE3_DBG_CMD_FD_TCAM, 300 300 .dentry = HNS3_DBG_DENTRY_FD, 301 - .buf_len = HNS3_DBG_READ_LEN, 301 + .buf_len = HNS3_DBG_READ_LEN_1MB, 302 302 .init = hns3_dbg_common_file_init, 303 303 }, 304 304 { ··· 462 462 { "TAIL", 2 }, 463 463 { "HEAD", 2 }, 464 464 { "FBDNUM", 2 }, 465 - { "PKTNUM", 2 }, 465 + { "PKTNUM", 5 }, 466 466 { "COPYBREAK", 2 }, 467 467 { "RING_EN", 2 }, 468 468 { "RX_RING_EN", 2 }, ··· 565 565 { "HEAD", 2 }, 566 566 { "FBDNUM", 2 }, 567 567 { "OFFSET", 2 }, 568 - { "PKTNUM", 2 }, 568 + { "PKTNUM", 5 }, 569 569 { "RING_EN", 2 }, 570 570 { "TX_RING_EN", 2 }, 571 571 { "BASE_ADDR", 10 }, ··· 790 790 } 791 791 792 792 static const struct hns3_dbg_item tx_bd_info_items[] = { 793 - { "BD_IDX", 5 }, 794 - { "ADDRESS", 2 }, 793 + { "BD_IDX", 2 }, 794 + { "ADDRESS", 13 }, 795 795 { "VLAN_TAG", 2 }, 796 796 { "SIZE", 2 }, 797 797 { "T_CS_VLAN_TSO", 2 }, 798 798 { "OT_VLAN_TAG", 3 }, 799 - { "TV", 2 }, 799 + { "TV", 5 }, 800 800 { "OLT_VLAN_LEN", 2 }, 801 801 { "PAYLEN_OL4CS", 2 }, 802 802 { "BD_FE_SC_VLD", 2 },

+14 -16

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c

··· 391 391 static int hclge_dbg_dump_dcb_qset(struct hclge_dev *hdev, char *buf, int len, 392 392 int *pos) 393 393 { 394 - struct hclge_dbg_bitmap_cmd *bitmap; 394 + struct hclge_dbg_bitmap_cmd req; 395 395 struct hclge_desc desc; 396 396 u16 qset_id, qset_num; 397 397 int ret; ··· 408 408 if (ret) 409 409 return ret; 410 410 411 - bitmap = (struct hclge_dbg_bitmap_cmd *)&desc.data[1]; 411 + req.bitmap = (u8)le32_to_cpu(desc.data[1]); 412 412 413 413 *pos += scnprintf(buf + *pos, len - *pos, 414 414 "%04u %#x %#x %#x %#x\n", 415 - qset_id, bitmap->bit0, bitmap->bit1, 416 - bitmap->bit2, bitmap->bit3); 415 + qset_id, req.bit0, req.bit1, req.bit2, 416 + req.bit3); 417 417 } 418 418 419 419 return 0; ··· 422 422 static int hclge_dbg_dump_dcb_pri(struct hclge_dev *hdev, char *buf, int len, 423 423 int *pos) 424 424 { 425 - struct hclge_dbg_bitmap_cmd *bitmap; 425 + struct hclge_dbg_bitmap_cmd req; 426 426 struct hclge_desc desc; 427 427 u8 pri_id, pri_num; 428 428 int ret; ··· 439 439 if (ret) 440 440 return ret; 441 441 442 - bitmap = (struct hclge_dbg_bitmap_cmd *)&desc.data[1]; 442 + req.bitmap = (u8)le32_to_cpu(desc.data[1]); 443 443 444 444 *pos += scnprintf(buf + *pos, len - *pos, 445 445 "%03u %#x %#x %#x\n", 446 - pri_id, bitmap->bit0, bitmap->bit1, 447 - bitmap->bit2); 446 + pri_id, req.bit0, req.bit1, req.bit2); 448 447 } 449 448 450 449 return 0; ··· 452 453 static int hclge_dbg_dump_dcb_pg(struct hclge_dev *hdev, char *buf, int len, 453 454 int *pos) 454 455 { 455 - struct hclge_dbg_bitmap_cmd *bitmap; 456 + struct hclge_dbg_bitmap_cmd req; 456 457 struct hclge_desc desc; 457 458 u8 pg_id; 458 459 int ret; ··· 465 466 if (ret) 466 467 return ret; 467 468 468 - bitmap = (struct hclge_dbg_bitmap_cmd *)&desc.data[1]; 469 + req.bitmap = (u8)le32_to_cpu(desc.data[1]); 469 470 470 471 *pos += scnprintf(buf + *pos, len - *pos, 471 472 "%03u %#x %#x %#x\n", 472 - pg_id, bitmap->bit0, bitmap->bit1, 473 - bitmap->bit2); 473 + pg_id, req.bit0, req.bit1, req.bit2); 474 474 } 475 475 476 476 return 0; ··· 509 511 static int hclge_dbg_dump_dcb_port(struct hclge_dev *hdev, char *buf, int len, 510 512 int *pos) 511 513 { 512 - struct hclge_dbg_bitmap_cmd *bitmap; 514 + struct hclge_dbg_bitmap_cmd req; 513 515 struct hclge_desc desc; 514 516 u8 port_id = 0; 515 517 int ret; ··· 519 521 if (ret) 520 522 return ret; 521 523 522 - bitmap = (struct hclge_dbg_bitmap_cmd *)&desc.data[1]; 524 + req.bitmap = (u8)le32_to_cpu(desc.data[1]); 523 525 524 526 *pos += scnprintf(buf + *pos, len - *pos, "port_mask: %#x\n", 525 - bitmap->bit0); 527 + req.bit0); 526 528 *pos += scnprintf(buf + *pos, len - *pos, "port_shaping_pass: %#x\n", 527 - bitmap->bit1); 529 + req.bit1); 528 530 529 531 return 0; 530 532 }

+6 -29

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c

··· 2847 2847 { 2848 2848 if (!test_bit(HCLGE_STATE_REMOVING, &hdev->state) && 2849 2849 !test_and_set_bit(HCLGE_STATE_MBX_SERVICE_SCHED, &hdev->state)) 2850 - mod_delayed_work_on(cpumask_first(&hdev->affinity_mask), 2851 - hclge_wq, &hdev->service_task, 0); 2850 + mod_delayed_work(hclge_wq, &hdev->service_task, 0); 2852 2851 } 2853 2852 2854 2853 static void hclge_reset_task_schedule(struct hclge_dev *hdev) 2855 2854 { 2856 2855 if (!test_bit(HCLGE_STATE_REMOVING, &hdev->state) && 2856 + test_bit(HCLGE_STATE_SERVICE_INITED, &hdev->state) && 2857 2857 !test_and_set_bit(HCLGE_STATE_RST_SERVICE_SCHED, &hdev->state)) 2858 - mod_delayed_work_on(cpumask_first(&hdev->affinity_mask), 2859 - hclge_wq, &hdev->service_task, 0); 2858 + mod_delayed_work(hclge_wq, &hdev->service_task, 0); 2860 2859 } 2861 2860 2862 2861 static void hclge_errhand_task_schedule(struct hclge_dev *hdev) 2863 2862 { 2864 2863 if (!test_bit(HCLGE_STATE_REMOVING, &hdev->state) && 2865 2864 !test_and_set_bit(HCLGE_STATE_ERR_SERVICE_SCHED, &hdev->state)) 2866 - mod_delayed_work_on(cpumask_first(&hdev->affinity_mask), 2867 - hclge_wq, &hdev->service_task, 0); 2865 + mod_delayed_work(hclge_wq, &hdev->service_task, 0); 2868 2866 } 2869 2867 2870 2868 void hclge_task_schedule(struct hclge_dev *hdev, unsigned long delay_time) 2871 2869 { 2872 2870 if (!test_bit(HCLGE_STATE_REMOVING, &hdev->state) && 2873 2871 !test_bit(HCLGE_STATE_RST_FAIL, &hdev->state)) 2874 - mod_delayed_work_on(cpumask_first(&hdev->affinity_mask), 2875 - hclge_wq, &hdev->service_task, 2876 - delay_time); 2872 + mod_delayed_work(hclge_wq, &hdev->service_task, delay_time); 2877 2873 } 2878 2874 2879 2875 static int hclge_get_mac_link_status(struct hclge_dev *hdev, int *link_status) ··· 3487 3491 hdev->num_msi_used += 1; 3488 3492 } 3489 3493 3490 - static void hclge_irq_affinity_notify(struct irq_affinity_notify *notify, 3491 - const cpumask_t *mask) 3492 - { 3493 - struct hclge_dev *hdev = container_of(notify, struct hclge_dev, 3494 - affinity_notify); 3495 - 3496 - cpumask_copy(&hdev->affinity_mask, mask); 3497 - } 3498 - 3499 - static void hclge_irq_affinity_release(struct kref *ref) 3500 - { 3501 - } 3502 - 3503 3494 static void hclge_misc_affinity_setup(struct hclge_dev *hdev) 3504 3495 { 3505 3496 irq_set_affinity_hint(hdev->misc_vector.vector_irq, 3506 3497 &hdev->affinity_mask); 3507 - 3508 - hdev->affinity_notify.notify = hclge_irq_affinity_notify; 3509 - hdev->affinity_notify.release = hclge_irq_affinity_release; 3510 - irq_set_affinity_notifier(hdev->misc_vector.vector_irq, 3511 - &hdev->affinity_notify); 3512 3498 } 3513 3499 3514 3500 static void hclge_misc_affinity_teardown(struct hclge_dev *hdev) 3515 3501 { 3516 - irq_set_affinity_notifier(hdev->misc_vector.vector_irq, NULL); 3517 3502 irq_set_affinity_hint(hdev->misc_vector.vector_irq, NULL); 3518 3503 } 3519 3504 ··· 13029 13052 { 13030 13053 pr_info("%s is initializing\n", HCLGE_NAME); 13031 13054 13032 - hclge_wq = alloc_workqueue("%s", 0, 0, HCLGE_NAME); 13055 + hclge_wq = alloc_workqueue("%s", WQ_UNBOUND, 0, HCLGE_NAME); 13033 13056 if (!hclge_wq) { 13034 13057 pr_err("%s: failed to create workqueue\n", HCLGE_NAME); 13035 13058 return -ENOMEM;

-1

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h

··· 944 944 945 945 /* affinity mask and notify for misc interrupt */ 946 946 cpumask_t affinity_mask; 947 - struct irq_affinity_notify affinity_notify; 948 947 struct hclge_ptp *ptp; 949 948 struct devlink *devlink; 950 949 };

+4 -1

drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c

··· 2232 2232 void hclgevf_reset_task_schedule(struct hclgevf_dev *hdev) 2233 2233 { 2234 2234 if (!test_bit(HCLGEVF_STATE_REMOVING, &hdev->state) && 2235 + test_bit(HCLGEVF_STATE_SERVICE_INITED, &hdev->state) && 2235 2236 !test_and_set_bit(HCLGEVF_STATE_RST_SERVICE_SCHED, 2236 2237 &hdev->state)) 2237 2238 mod_delayed_work(hclgevf_wq, &hdev->service_task, 0); ··· 3450 3449 3451 3450 hclgevf_init_rxd_adv_layout(hdev); 3452 3451 3452 + set_bit(HCLGEVF_STATE_SERVICE_INITED, &hdev->state); 3453 + 3453 3454 hdev->last_reset_time = jiffies; 3454 3455 dev_info(&hdev->pdev->dev, "finished initializing %s driver\n", 3455 3456 HCLGEVF_DRIVER_NAME); ··· 3902 3899 { 3903 3900 pr_info("%s is initializing\n", HCLGEVF_NAME); 3904 3901 3905 - hclgevf_wq = alloc_workqueue("%s", 0, 0, HCLGEVF_NAME); 3902 + hclgevf_wq = alloc_workqueue("%s", WQ_UNBOUND, 0, HCLGEVF_NAME); 3906 3903 if (!hclgevf_wq) { 3907 3904 pr_err("%s: failed to create workqueue\n", HCLGEVF_NAME); 3908 3905 return -ENOMEM;

+1

drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h

··· 146 146 HCLGEVF_STATE_REMOVING, 147 147 HCLGEVF_STATE_NIC_REGISTERED, 148 148 HCLGEVF_STATE_ROCE_REGISTERED, 149 + HCLGEVF_STATE_SERVICE_INITED, 149 150 /* task states */ 150 151 HCLGEVF_STATE_RST_SERVICE_SCHED, 151 152 HCLGEVF_STATE_RST_HANDLING,

+4 -14

drivers/net/ethernet/intel/ice/ice_lag.c

··· 100 100 */ 101 101 static void ice_lag_info_event(struct ice_lag *lag, void *ptr) 102 102 { 103 - struct net_device *event_netdev, *netdev_tmp; 104 103 struct netdev_notifier_bonding_info *info; 105 104 struct netdev_bonding_info *bonding_info; 105 + struct net_device *event_netdev; 106 106 const char *lag_netdev_name; 107 107 108 108 event_netdev = netdev_notifier_info_to_dev(ptr); ··· 122 122 netdev_dbg(lag->netdev, "Bonding event recv, but slave info not for us\n"); 123 123 goto lag_out; 124 124 } 125 - 126 - rcu_read_lock(); 127 - for_each_netdev_in_bond_rcu(lag->upper_netdev, netdev_tmp) { 128 - if (!netif_is_ice(netdev_tmp)) 129 - continue; 130 - 131 - if (netdev_tmp && netdev_tmp != lag->netdev && 132 - lag->peer_netdev != netdev_tmp) { 133 - dev_hold(netdev_tmp); 134 - lag->peer_netdev = netdev_tmp; 135 - } 136 - } 137 - rcu_read_unlock(); 138 125 139 126 if (bonding_info->slave.state) 140 127 ice_lag_set_backup(lag); ··· 305 318 break; 306 319 case NETDEV_BONDING_INFO: 307 320 ice_lag_info_event(lag, ptr); 321 + break; 322 + case NETDEV_UNREGISTER: 323 + ice_lag_unlink(lag, ptr); 308 324 break; 309 325 default: 310 326 break;

+3

drivers/net/ethernet/intel/ice/ice_ptp.c

··· 1571 1571 */ 1572 1572 void ice_ptp_release(struct ice_pf *pf) 1573 1573 { 1574 + if (!test_bit(ICE_FLAG_PTP, pf->flags)) 1575 + return; 1576 + 1574 1577 /* Disable timestamping for both Tx and Rx */ 1575 1578 ice_ptp_cfg_timestamp(pf, false); 1576 1579

+115 -33

drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c

··· 226 226 227 227 static void print_nix_qsize(struct seq_file *filp, struct rvu_pfvf *pfvf); 228 228 229 + static void get_lf_str_list(struct rvu_block block, int pcifunc, 230 + char *lfs) 231 + { 232 + int lf = 0, seq = 0, len = 0, prev_lf = block.lf.max; 233 + 234 + for_each_set_bit(lf, block.lf.bmap, block.lf.max) { 235 + if (lf >= block.lf.max) 236 + break; 237 + 238 + if (block.fn_map[lf] != pcifunc) 239 + continue; 240 + 241 + if (lf == prev_lf + 1) { 242 + prev_lf = lf; 243 + seq = 1; 244 + continue; 245 + } 246 + 247 + if (seq) 248 + len += sprintf(lfs + len, "-%d,%d", prev_lf, lf); 249 + else 250 + len += (len ? sprintf(lfs + len, ",%d", lf) : 251 + sprintf(lfs + len, "%d", lf)); 252 + 253 + prev_lf = lf; 254 + seq = 0; 255 + } 256 + 257 + if (seq) 258 + len += sprintf(lfs + len, "-%d", prev_lf); 259 + 260 + lfs[len] = '\0'; 261 + } 262 + 263 + static int get_max_column_width(struct rvu *rvu) 264 + { 265 + int index, pf, vf, lf_str_size = 12, buf_size = 256; 266 + struct rvu_block block; 267 + u16 pcifunc; 268 + char *buf; 269 + 270 + buf = kzalloc(buf_size, GFP_KERNEL); 271 + if (!buf) 272 + return -ENOMEM; 273 + 274 + for (pf = 0; pf < rvu->hw->total_pfs; pf++) { 275 + for (vf = 0; vf <= rvu->hw->total_vfs; vf++) { 276 + pcifunc = pf << 10 | vf; 277 + if (!pcifunc) 278 + continue; 279 + 280 + for (index = 0; index < BLK_COUNT; index++) { 281 + block = rvu->hw->block[index]; 282 + if (!strlen(block.name)) 283 + continue; 284 + 285 + get_lf_str_list(block, pcifunc, buf); 286 + if (lf_str_size <= strlen(buf)) 287 + lf_str_size = strlen(buf) + 1; 288 + } 289 + } 290 + } 291 + 292 + kfree(buf); 293 + return lf_str_size; 294 + } 295 + 229 296 /* Dumps current provisioning status of all RVU block LFs */ 230 297 static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp, 231 298 char __user *buffer, 232 299 size_t count, loff_t *ppos) 233 300 { 234 - int index, off = 0, flag = 0, go_back = 0, len = 0; 301 + int index, off = 0, flag = 0, len = 0, i = 0; 235 302 struct rvu *rvu = filp->private_data; 236 - int lf, pf, vf, pcifunc; 303 + int bytes_not_copied = 0; 237 304 struct rvu_block block; 238 - int bytes_not_copied; 239 - int lf_str_size = 12; 305 + int pf, vf, pcifunc; 240 306 int buf_size = 2048; 307 + int lf_str_size; 241 308 char *lfs; 242 309 char *buf; 243 310 ··· 315 248 buf = kzalloc(buf_size, GFP_KERNEL); 316 249 if (!buf) 317 250 return -ENOSPC; 251 + 252 + /* Get the maximum width of a column */ 253 + lf_str_size = get_max_column_width(rvu); 318 254 319 255 lfs = kzalloc(lf_str_size, GFP_KERNEL); 320 256 if (!lfs) { ··· 332 262 "%-*s", lf_str_size, 333 263 rvu->hw->block[index].name); 334 264 } 265 + 335 266 off += scnprintf(&buf[off], buf_size - 1 - off, "\n"); 267 + bytes_not_copied = copy_to_user(buffer + (i * off), buf, off); 268 + if (bytes_not_copied) 269 + goto out; 270 + 271 + i++; 272 + *ppos += off; 336 273 for (pf = 0; pf < rvu->hw->total_pfs; pf++) { 337 274 for (vf = 0; vf <= rvu->hw->total_vfs; vf++) { 275 + off = 0; 276 + flag = 0; 338 277 pcifunc = pf << 10 | vf; 339 278 if (!pcifunc) 340 279 continue; 341 280 342 281 if (vf) { 343 282 sprintf(lfs, "PF%d:VF%d", pf, vf - 1); 344 - go_back = scnprintf(&buf[off], 345 - buf_size - 1 - off, 346 - "%-*s", lf_str_size, lfs); 283 + off = scnprintf(&buf[off], 284 + buf_size - 1 - off, 285 + "%-*s", lf_str_size, lfs); 347 286 } else { 348 287 sprintf(lfs, "PF%d", pf); 349 - go_back = scnprintf(&buf[off], 350 - buf_size - 1 - off, 351 - "%-*s", lf_str_size, lfs); 288 + off = scnprintf(&buf[off], 289 + buf_size - 1 - off, 290 + "%-*s", lf_str_size, lfs); 352 291 } 353 292 354 - off += go_back; 355 - for (index = 0; index < BLKTYPE_MAX; index++) { 293 + for (index = 0; index < BLK_COUNT; index++) { 356 294 block = rvu->hw->block[index]; 357 295 if (!strlen(block.name)) 358 296 continue; 359 297 len = 0; 360 298 lfs[len] = '\0'; 361 - for (lf = 0; lf < block.lf.max; lf++) { 362 - if (block.fn_map[lf] != pcifunc) 363 - continue; 299 + get_lf_str_list(block, pcifunc, lfs); 300 + if (strlen(lfs)) 364 301 flag = 1; 365 - len += sprintf(&lfs[len], "%d,", lf); 366 - } 367 302 368 - if (flag) 369 - len--; 370 - lfs[len] = '\0'; 371 303 off += scnprintf(&buf[off], buf_size - 1 - off, 372 304 "%-*s", lf_str_size, lfs); 373 - if (!strlen(lfs)) 374 - go_back += lf_str_size; 375 305 } 376 - if (!flag) 377 - off -= go_back; 378 - else 379 - flag = 0; 380 - off--; 381 - off += scnprintf(&buf[off], buf_size - 1 - off, "\n"); 306 + if (flag) { 307 + off += scnprintf(&buf[off], 308 + buf_size - 1 - off, "\n"); 309 + bytes_not_copied = copy_to_user(buffer + 310 + (i * off), 311 + buf, off); 312 + if (bytes_not_copied) 313 + goto out; 314 + 315 + i++; 316 + *ppos += off; 317 + } 382 318 } 383 319 } 384 320 385 - bytes_not_copied = copy_to_user(buffer, buf, off); 321 + out: 386 322 kfree(lfs); 387 323 kfree(buf); 388 - 389 324 if (bytes_not_copied) 390 325 return -EFAULT; 391 326 392 - *ppos = off; 393 - return off; 327 + return *ppos; 394 328 } 395 329 396 330 RVU_DEBUG_FOPS(rsrc_status, rsrc_attach_status, NULL); ··· 578 504 if (cmd_buf) 579 505 ret = -EINVAL; 580 506 581 - if (!strncmp(subtoken, "help", 4) || ret < 0) { 507 + if (ret < 0 || !strncmp(subtoken, "help", 4)) { 582 508 dev_info(rvu->dev, "Use echo <%s-lf > qsize\n", blk_string); 583 509 goto qsize_write_done; 584 510 } ··· 1793 1719 u16 pcifunc; 1794 1720 char *str; 1795 1721 1722 + /* Ingress policers do not exist on all platforms */ 1723 + if (!nix_hw->ipolicer) 1724 + return 0; 1725 + 1796 1726 for (layer = 0; layer < BAND_PROF_NUM_LAYERS; layer++) { 1797 1727 if (layer == BAND_PROF_INVAL_LAYER) 1798 1728 continue; ··· 1845 1767 struct nix_ipolicer *ipolicer; 1846 1768 int layer; 1847 1769 char *str; 1770 + 1771 + /* Ingress policers do not exist on all platforms */ 1772 + if (!nix_hw->ipolicer) 1773 + return 0; 1848 1774 1849 1775 seq_puts(m, "\nBandwidth profile resource free count\n"); 1850 1776 seq_puts(m, "=====================================\n");

+3

drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c

··· 2507 2507 return; 2508 2508 2509 2509 nix_hw = get_nix_hw(rvu->hw, blkaddr); 2510 + if (!nix_hw) 2511 + return; 2512 + 2510 2513 vlan = &nix_hw->txvlan; 2511 2514 2512 2515 mutex_lock(&vlan->rsrc_lock);

+12 -13

drivers/net/ethernet/mellanox/mlxsw/pci.c

··· 353 353 struct sk_buff *skb; 354 354 int err; 355 355 356 - elem_info->u.rdq.skb = NULL; 357 356 skb = netdev_alloc_skb_ip_align(NULL, buf_len); 358 357 if (!skb) 359 358 return -ENOMEM; 360 - 361 - /* Assume that wqe was previously zeroed. */ 362 359 363 360 err = mlxsw_pci_wqe_frag_map(mlxsw_pci, wqe, 0, skb->data, 364 361 buf_len, DMA_FROM_DEVICE); ··· 594 597 struct pci_dev *pdev = mlxsw_pci->pdev; 595 598 struct mlxsw_pci_queue_elem_info *elem_info; 596 599 struct mlxsw_rx_info rx_info = {}; 597 - char *wqe; 600 + char wqe[MLXSW_PCI_WQE_SIZE]; 598 601 struct sk_buff *skb; 599 602 u16 byte_count; 600 603 int err; 601 604 602 605 elem_info = mlxsw_pci_queue_elem_info_consumer_get(q); 603 - skb = elem_info->u.sdq.skb; 604 - if (!skb) 605 - return; 606 - wqe = elem_info->elem; 607 - mlxsw_pci_wqe_frag_unmap(mlxsw_pci, wqe, 0, DMA_FROM_DEVICE); 606 + skb = elem_info->u.rdq.skb; 607 + memcpy(wqe, elem_info->elem, MLXSW_PCI_WQE_SIZE); 608 608 609 609 if (q->consumer_counter++ != consumer_counter_limit) 610 610 dev_dbg_ratelimited(&pdev->dev, "Consumer counter does not match limit in RDQ\n"); 611 + 612 + err = mlxsw_pci_rdq_skb_alloc(mlxsw_pci, elem_info); 613 + if (err) { 614 + dev_err_ratelimited(&pdev->dev, "Failed to alloc skb for RDQ\n"); 615 + goto out; 616 + } 617 + 618 + mlxsw_pci_wqe_frag_unmap(mlxsw_pci, wqe, 0, DMA_FROM_DEVICE); 611 619 612 620 if (mlxsw_pci_cqe_lag_get(cqe_v, cqe)) { 613 621 rx_info.is_lag = true; ··· 649 647 skb_put(skb, byte_count); 650 648 mlxsw_core_skb_receive(mlxsw_pci->core, skb, &rx_info); 651 649 652 - memset(wqe, 0, q->elem_size); 653 - err = mlxsw_pci_rdq_skb_alloc(mlxsw_pci, elem_info); 654 - if (err) 655 - dev_dbg_ratelimited(&pdev->dev, "Failed to alloc skb for RDQ\n"); 650 + out: 656 651 /* Everything is set up, ring doorbell to pass elem to HW */ 657 652 q->producer_counter++; 658 653 mlxsw_pci_queue_doorbell_producer_ring(mlxsw_pci, q);

+31 -4

drivers/net/ethernet/microchip/lan743x_main.c

··· 1743 1743 ret = -EINVAL; 1744 1744 goto cleanup; 1745 1745 } 1746 + if (dma_set_mask_and_coherent(&tx->adapter->pdev->dev, 1747 + DMA_BIT_MASK(64))) { 1748 + if (dma_set_mask_and_coherent(&tx->adapter->pdev->dev, 1749 + DMA_BIT_MASK(32))) { 1750 + dev_warn(&tx->adapter->pdev->dev, 1751 + "lan743x_: No suitable DMA available\n"); 1752 + ret = -ENOMEM; 1753 + goto cleanup; 1754 + } 1755 + } 1746 1756 ring_allocation_size = ALIGN(tx->ring_size * 1747 1757 sizeof(struct lan743x_tx_descriptor), 1748 1758 PAGE_SIZE); ··· 1944 1934 index); 1945 1935 } 1946 1936 1947 - static int lan743x_rx_init_ring_element(struct lan743x_rx *rx, int index) 1937 + static int lan743x_rx_init_ring_element(struct lan743x_rx *rx, int index, 1938 + gfp_t gfp) 1948 1939 { 1949 1940 struct net_device *netdev = rx->adapter->netdev; 1950 1941 struct device *dev = &rx->adapter->pdev->dev; ··· 1959 1948 1960 1949 descriptor = &rx->ring_cpu_ptr[index]; 1961 1950 buffer_info = &rx->buffer_info[index]; 1962 - skb = __netdev_alloc_skb(netdev, buffer_length, GFP_ATOMIC | GFP_DMA); 1951 + skb = __netdev_alloc_skb(netdev, buffer_length, gfp); 1963 1952 if (!skb) 1964 1953 return -ENOMEM; 1965 1954 dma_ptr = dma_map_single(dev, skb->data, buffer_length, DMA_FROM_DEVICE); ··· 2121 2110 2122 2111 /* save existing skb, allocate new skb and map to dma */ 2123 2112 skb = buffer_info->skb; 2124 - if (lan743x_rx_init_ring_element(rx, rx->last_head)) { 2113 + if (lan743x_rx_init_ring_element(rx, rx->last_head, 2114 + GFP_ATOMIC | GFP_DMA)) { 2125 2115 /* failed to allocate next skb. 2126 2116 * Memory is very low. 2127 2117 * Drop this packet and reuse buffer. ··· 2288 2276 ret = -EINVAL; 2289 2277 goto cleanup; 2290 2278 } 2279 + if (dma_set_mask_and_coherent(&rx->adapter->pdev->dev, 2280 + DMA_BIT_MASK(64))) { 2281 + if (dma_set_mask_and_coherent(&rx->adapter->pdev->dev, 2282 + DMA_BIT_MASK(32))) { 2283 + dev_warn(&rx->adapter->pdev->dev, 2284 + "lan743x_: No suitable DMA available\n"); 2285 + ret = -ENOMEM; 2286 + goto cleanup; 2287 + } 2288 + } 2291 2289 ring_allocation_size = ALIGN(rx->ring_size * 2292 2290 sizeof(struct lan743x_rx_descriptor), 2293 2291 PAGE_SIZE); ··· 2337 2315 2338 2316 rx->last_head = 0; 2339 2317 for (index = 0; index < rx->ring_size; index++) { 2340 - ret = lan743x_rx_init_ring_element(rx, index); 2318 + ret = lan743x_rx_init_ring_element(rx, index, GFP_KERNEL); 2341 2319 if (ret) 2342 2320 goto cleanup; 2343 2321 } 2344 2322 return 0; 2345 2323 2346 2324 cleanup: 2325 + netif_warn(rx->adapter, ifup, rx->adapter->netdev, 2326 + "Error allocating memory for LAN743x\n"); 2327 + 2347 2328 lan743x_rx_ring_cleanup(rx); 2348 2329 return ret; 2349 2330 } ··· 3044 3019 if (ret) { 3045 3020 netif_err(adapter, probe, adapter->netdev, 3046 3021 "lan743x_hardware_init returned %d\n", ret); 3022 + lan743x_pci_cleanup(adapter); 3023 + return ret; 3047 3024 } 3048 3025 3049 3026 /* open netdev when netdev is at running state while resume.

+11 -5

drivers/net/ethernet/netronome/nfp/bpf/main.c

··· 182 182 nfp_bpf_check_mtu(struct nfp_app *app, struct net_device *netdev, int new_mtu) 183 183 { 184 184 struct nfp_net *nn = netdev_priv(netdev); 185 - unsigned int max_mtu; 185 + struct nfp_bpf_vnic *bv; 186 + struct bpf_prog *prog; 186 187 187 188 if (~nn->dp.ctrl & NFP_NET_CFG_CTRL_BPF) 188 189 return 0; 189 190 190 - max_mtu = nn_readb(nn, NFP_NET_CFG_BPF_INL_MTU) * 64 - 32; 191 - if (new_mtu > max_mtu) { 192 - nn_info(nn, "BPF offload active, MTU over %u not supported\n", 193 - max_mtu); 191 + if (nn->xdp_hw.prog) { 192 + prog = nn->xdp_hw.prog; 193 + } else { 194 + bv = nn->app_priv; 195 + prog = bv->tc_prog; 196 + } 197 + 198 + if (nfp_bpf_offload_check_mtu(nn, prog, new_mtu)) { 199 + nn_info(nn, "BPF offload active, potential packet access beyond hardware packet boundary"); 194 200 return -EBUSY; 195 201 } 196 202 return 0;

+2

drivers/net/ethernet/netronome/nfp/bpf/main.h

··· 560 560 void nfp_bpf_jit_prepare(struct nfp_prog *nfp_prog); 561 561 int nfp_bpf_jit(struct nfp_prog *prog); 562 562 bool nfp_bpf_supported_opcode(u8 code); 563 + bool nfp_bpf_offload_check_mtu(struct nfp_net *nn, struct bpf_prog *prog, 564 + unsigned int mtu); 563 565 564 566 int nfp_verify_insn(struct bpf_verifier_env *env, int insn_idx, 565 567 int prev_insn_idx);

+13 -4

drivers/net/ethernet/netronome/nfp/bpf/offload.c

··· 481 481 return 0; 482 482 } 483 483 484 + bool nfp_bpf_offload_check_mtu(struct nfp_net *nn, struct bpf_prog *prog, 485 + unsigned int mtu) 486 + { 487 + unsigned int fw_mtu, pkt_off; 488 + 489 + fw_mtu = nn_readb(nn, NFP_NET_CFG_BPF_INL_MTU) * 64 - 32; 490 + pkt_off = min(prog->aux->max_pkt_offset, mtu); 491 + 492 + return fw_mtu < pkt_off; 493 + } 494 + 484 495 static int 485 496 nfp_net_bpf_load(struct nfp_net *nn, struct bpf_prog *prog, 486 497 struct netlink_ext_ack *extack) 487 498 { 488 499 struct nfp_prog *nfp_prog = prog->aux->offload->dev_priv; 489 - unsigned int fw_mtu, pkt_off, max_stack, max_prog_len; 500 + unsigned int max_stack, max_prog_len; 490 501 dma_addr_t dma_addr; 491 502 void *img; 492 503 int err; 493 504 494 - fw_mtu = nn_readb(nn, NFP_NET_CFG_BPF_INL_MTU) * 64 - 32; 495 - pkt_off = min(prog->aux->max_pkt_offset, nn->dp.netdev->mtu); 496 - if (fw_mtu < pkt_off) { 505 + if (nfp_bpf_offload_check_mtu(nn, prog, nn->dp.netdev->mtu)) { 497 506 NL_SET_ERR_MSG_MOD(extack, "BPF offload not supported with potential packet access beyond HW packet split boundary"); 498 507 return -EOPNOTSUPP; 499 508 }

+2 -3

drivers/net/ethernet/nxp/lpc_eth.c

··· 1015 1015 napi_disable(&pldat->napi); 1016 1016 netif_stop_queue(ndev); 1017 1017 1018 - if (ndev->phydev) 1019 - phy_stop(ndev->phydev); 1020 - 1021 1018 spin_lock_irqsave(&pldat->lock, flags); 1022 1019 __lpc_eth_reset(pldat); 1023 1020 netif_carrier_off(ndev); ··· 1022 1025 writel(0, LPC_ENET_MAC2(pldat->net_base)); 1023 1026 spin_unlock_irqrestore(&pldat->lock, flags); 1024 1027 1028 + if (ndev->phydev) 1029 + phy_stop(ndev->phydev); 1025 1030 clk_disable_unprepare(pldat->clk); 1026 1031 1027 1032 return 0;

+1

drivers/net/ethernet/realtek/r8169_main.c

··· 157 157 { PCI_VDEVICE(REALTEK, 0x8129) }, 158 158 { PCI_VDEVICE(REALTEK, 0x8136), RTL_CFG_NO_GBIT }, 159 159 { PCI_VDEVICE(REALTEK, 0x8161) }, 160 + { PCI_VDEVICE(REALTEK, 0x8162) }, 160 161 { PCI_VDEVICE(REALTEK, 0x8167) }, 161 162 { PCI_VDEVICE(REALTEK, 0x8168) }, 162 163 { PCI_VDEVICE(NCUBE, 0x8168) },

+89 -67

drivers/net/phy/phy.c

··· 243 243 } 244 244 } 245 245 246 - int phy_ethtool_ksettings_set(struct phy_device *phydev, 247 - const struct ethtool_link_ksettings *cmd) 248 - { 249 - __ETHTOOL_DECLARE_LINK_MODE_MASK(advertising); 250 - u8 autoneg = cmd->base.autoneg; 251 - u8 duplex = cmd->base.duplex; 252 - u32 speed = cmd->base.speed; 253 - 254 - if (cmd->base.phy_address != phydev->mdio.addr) 255 - return -EINVAL; 256 - 257 - linkmode_copy(advertising, cmd->link_modes.advertising); 258 - 259 - /* We make sure that we don't pass unsupported values in to the PHY */ 260 - linkmode_and(advertising, advertising, phydev->supported); 261 - 262 - /* Verify the settings we care about. */ 263 - if (autoneg != AUTONEG_ENABLE && autoneg != AUTONEG_DISABLE) 264 - return -EINVAL; 265 - 266 - if (autoneg == AUTONEG_ENABLE && linkmode_empty(advertising)) 267 - return -EINVAL; 268 - 269 - if (autoneg == AUTONEG_DISABLE && 270 - ((speed != SPEED_1000 && 271 - speed != SPEED_100 && 272 - speed != SPEED_10) || 273 - (duplex != DUPLEX_HALF && 274 - duplex != DUPLEX_FULL))) 275 - return -EINVAL; 276 - 277 - phydev->autoneg = autoneg; 278 - 279 - if (autoneg == AUTONEG_DISABLE) { 280 - phydev->speed = speed; 281 - phydev->duplex = duplex; 282 - } 283 - 284 - linkmode_copy(phydev->advertising, advertising); 285 - 286 - linkmode_mod_bit(ETHTOOL_LINK_MODE_Autoneg_BIT, 287 - phydev->advertising, autoneg == AUTONEG_ENABLE); 288 - 289 - phydev->master_slave_set = cmd->base.master_slave_cfg; 290 - phydev->mdix_ctrl = cmd->base.eth_tp_mdix_ctrl; 291 - 292 - /* Restart the PHY */ 293 - phy_start_aneg(phydev); 294 - 295 - return 0; 296 - } 297 - EXPORT_SYMBOL(phy_ethtool_ksettings_set); 298 - 299 246 void phy_ethtool_ksettings_get(struct phy_device *phydev, 300 247 struct ethtool_link_ksettings *cmd) 301 248 { 249 + mutex_lock(&phydev->lock); 302 250 linkmode_copy(cmd->link_modes.supported, phydev->supported); 303 251 linkmode_copy(cmd->link_modes.advertising, phydev->advertising); 304 252 linkmode_copy(cmd->link_modes.lp_advertising, phydev->lp_advertising); ··· 265 317 cmd->base.autoneg = phydev->autoneg; 266 318 cmd->base.eth_tp_mdix_ctrl = phydev->mdix_ctrl; 267 319 cmd->base.eth_tp_mdix = phydev->mdix; 320 + mutex_unlock(&phydev->lock); 268 321 } 269 322 EXPORT_SYMBOL(phy_ethtool_ksettings_get); 270 323 ··· 700 751 } 701 752 702 753 /** 754 + * _phy_start_aneg - start auto-negotiation for this PHY device 755 + * @phydev: the phy_device struct 756 + * 757 + * Description: Sanitizes the settings (if we're not autonegotiating 758 + * them), and then calls the driver's config_aneg function. 759 + * If the PHYCONTROL Layer is operating, we change the state to 760 + * reflect the beginning of Auto-negotiation or forcing. 761 + */ 762 + static int _phy_start_aneg(struct phy_device *phydev) 763 + { 764 + int err; 765 + 766 + lockdep_assert_held(&phydev->lock); 767 + 768 + if (!phydev->drv) 769 + return -EIO; 770 + 771 + if (AUTONEG_DISABLE == phydev->autoneg) 772 + phy_sanitize_settings(phydev); 773 + 774 + err = phy_config_aneg(phydev); 775 + if (err < 0) 776 + return err; 777 + 778 + if (phy_is_started(phydev)) 779 + err = phy_check_link_status(phydev); 780 + 781 + return err; 782 + } 783 + 784 + /** 703 785 * phy_start_aneg - start auto-negotiation for this PHY device 704 786 * @phydev: the phy_device struct 705 787 * ··· 743 763 { 744 764 int err; 745 765 746 - if (!phydev->drv) 747 - return -EIO; 748 - 749 766 mutex_lock(&phydev->lock); 750 - 751 - if (AUTONEG_DISABLE == phydev->autoneg) 752 - phy_sanitize_settings(phydev); 753 - 754 - err = phy_config_aneg(phydev); 755 - if (err < 0) 756 - goto out_unlock; 757 - 758 - if (phy_is_started(phydev)) 759 - err = phy_check_link_status(phydev); 760 - out_unlock: 767 + err = _phy_start_aneg(phydev); 761 768 mutex_unlock(&phydev->lock); 762 769 763 770 return err; ··· 766 799 767 800 return ret < 0 ? ret : 0; 768 801 } 802 + 803 + int phy_ethtool_ksettings_set(struct phy_device *phydev, 804 + const struct ethtool_link_ksettings *cmd) 805 + { 806 + __ETHTOOL_DECLARE_LINK_MODE_MASK(advertising); 807 + u8 autoneg = cmd->base.autoneg; 808 + u8 duplex = cmd->base.duplex; 809 + u32 speed = cmd->base.speed; 810 + 811 + if (cmd->base.phy_address != phydev->mdio.addr) 812 + return -EINVAL; 813 + 814 + linkmode_copy(advertising, cmd->link_modes.advertising); 815 + 816 + /* We make sure that we don't pass unsupported values in to the PHY */ 817 + linkmode_and(advertising, advertising, phydev->supported); 818 + 819 + /* Verify the settings we care about. */ 820 + if (autoneg != AUTONEG_ENABLE && autoneg != AUTONEG_DISABLE) 821 + return -EINVAL; 822 + 823 + if (autoneg == AUTONEG_ENABLE && linkmode_empty(advertising)) 824 + return -EINVAL; 825 + 826 + if (autoneg == AUTONEG_DISABLE && 827 + ((speed != SPEED_1000 && 828 + speed != SPEED_100 && 829 + speed != SPEED_10) || 830 + (duplex != DUPLEX_HALF && 831 + duplex != DUPLEX_FULL))) 832 + return -EINVAL; 833 + 834 + mutex_lock(&phydev->lock); 835 + phydev->autoneg = autoneg; 836 + 837 + if (autoneg == AUTONEG_DISABLE) { 838 + phydev->speed = speed; 839 + phydev->duplex = duplex; 840 + } 841 + 842 + linkmode_copy(phydev->advertising, advertising); 843 + 844 + linkmode_mod_bit(ETHTOOL_LINK_MODE_Autoneg_BIT, 845 + phydev->advertising, autoneg == AUTONEG_ENABLE); 846 + 847 + phydev->master_slave_set = cmd->base.master_slave_cfg; 848 + phydev->mdix_ctrl = cmd->base.eth_tp_mdix_ctrl; 849 + 850 + /* Restart the PHY */ 851 + _phy_start_aneg(phydev); 852 + 853 + mutex_unlock(&phydev->lock); 854 + return 0; 855 + } 856 + EXPORT_SYMBOL(phy_ethtool_ksettings_set); 769 857 770 858 /** 771 859 * phy_speed_down - set speed to lowest speed supported by both link partners

+6

drivers/net/usb/lan78xx.c

··· 4122 4122 4123 4123 dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out, 1); 4124 4124 4125 + /* Reject broken descriptors. */ 4126 + if (dev->maxpacket == 0) { 4127 + ret = -ENODEV; 4128 + goto out4; 4129 + } 4130 + 4125 4131 /* driver requires remote-wakeup capability during autosuspend. */ 4126 4132 intf->needs_remote_wakeup = 1; 4127 4133

+1

drivers/net/usb/usbnet.c

··· 1790 1790 dev->maxpacket = usb_maxpacket (dev->udev, dev->out, 1); 1791 1791 if (dev->maxpacket == 0) { 1792 1792 /* that is a broken device */ 1793 + status = -ENODEV; 1793 1794 goto out4; 1794 1795 } 1795 1796

-1

drivers/net/vmxnet3/vmxnet3_drv.c

··· 3833 3833 vmxnet3_free_intr_resources(adapter); 3834 3834 3835 3835 netif_device_detach(netdev); 3836 - netif_tx_stop_all_queues(netdev); 3837 3836 3838 3837 /* Create wake-up filters. */ 3839 3838 pmConf = adapter->pm_conf;

+8

drivers/net/xen-netfront.c

··· 1730 1730 1731 1731 dev_dbg(&dev->dev, "%s\n", dev->nodename); 1732 1732 1733 + netif_tx_lock_bh(info->netdev); 1734 + netif_device_detach(info->netdev); 1735 + netif_tx_unlock_bh(info->netdev); 1736 + 1733 1737 xennet_disconnect_backend(info); 1734 1738 return 0; 1735 1739 } ··· 2353 2349 * domain a kick because we've probably just requeued some 2354 2350 * packets. 2355 2351 */ 2352 + netif_tx_lock_bh(np->netdev); 2353 + netif_device_attach(np->netdev); 2354 + netif_tx_unlock_bh(np->netdev); 2355 + 2356 2356 netif_carrier_on(np->netdev); 2357 2357 for (j = 0; j < num_queues; ++j) { 2358 2358 queue = &np->queues[j];

+2 -2

drivers/nfc/port100.c

··· 1006 1006 1007 1007 skb = port100_alloc_skb(dev, 0); 1008 1008 if (!skb) 1009 - return -ENOMEM; 1009 + return 0; 1010 1010 1011 1011 resp = port100_send_cmd_sync(dev, PORT100_CMD_GET_COMMAND_TYPE, skb); 1012 1012 if (IS_ERR(resp)) 1013 - return PTR_ERR(resp); 1013 + return 0; 1014 1014 1015 1015 if (resp->len < 8) 1016 1016 mask = 0;

+5 -2

include/linux/bpf.h

··· 929 929 * stored in the map to make sure that all callers and callees have 930 930 * the same prog type and JITed flag. 931 931 */ 932 - enum bpf_prog_type type; 933 - bool jited; 932 + struct { 933 + spinlock_t lock; 934 + enum bpf_prog_type type; 935 + bool jited; 936 + } owner; 934 937 /* Programs with direct jumps into programs part of this array. */ 935 938 struct list_head poke_progs; 936 939 struct bpf_map *map;

+4 -4

include/linux/bpf_types.h

··· 101 101 #endif 102 102 BPF_MAP_TYPE(BPF_MAP_TYPE_ARRAY_OF_MAPS, array_of_maps_map_ops) 103 103 BPF_MAP_TYPE(BPF_MAP_TYPE_HASH_OF_MAPS, htab_of_maps_map_ops) 104 - #ifdef CONFIG_NET 105 - BPF_MAP_TYPE(BPF_MAP_TYPE_DEVMAP, dev_map_ops) 106 - BPF_MAP_TYPE(BPF_MAP_TYPE_DEVMAP_HASH, dev_map_hash_ops) 107 - BPF_MAP_TYPE(BPF_MAP_TYPE_SK_STORAGE, sk_storage_map_ops) 108 104 #ifdef CONFIG_BPF_LSM 109 105 BPF_MAP_TYPE(BPF_MAP_TYPE_INODE_STORAGE, inode_storage_map_ops) 110 106 #endif 111 107 BPF_MAP_TYPE(BPF_MAP_TYPE_TASK_STORAGE, task_storage_map_ops) 108 + #ifdef CONFIG_NET 109 + BPF_MAP_TYPE(BPF_MAP_TYPE_DEVMAP, dev_map_ops) 110 + BPF_MAP_TYPE(BPF_MAP_TYPE_DEVMAP_HASH, dev_map_hash_ops) 111 + BPF_MAP_TYPE(BPF_MAP_TYPE_SK_STORAGE, sk_storage_map_ops) 112 112 BPF_MAP_TYPE(BPF_MAP_TYPE_CPUMAP, cpu_map_ops) 113 113 #if defined(CONFIG_XDP_SOCKETS) 114 114 BPF_MAP_TYPE(BPF_MAP_TYPE_XSKMAP, xsk_map_ops)

+1

include/linux/filter.h

··· 1051 1051 extern int bpf_jit_harden; 1052 1052 extern int bpf_jit_kallsyms; 1053 1053 extern long bpf_jit_limit; 1054 + extern long bpf_jit_limit_max; 1054 1055 1055 1056 typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size); 1056 1057

+1

include/linux/skmsg.h

··· 128 128 struct sk_msg *msg, u32 bytes); 129 129 int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg, 130 130 int len, int flags); 131 + bool sk_msg_is_readable(struct sock *sk); 131 132 132 133 static inline void sk_msg_check_to_free(struct sk_msg *msg, u32 i, u32 bytes) 133 134 {

-2

include/net/cfg80211.h

··· 5376 5376 * netdev and may otherwise be used by driver read-only, will be update 5377 5377 * by cfg80211 on change_interface 5378 5378 * @mgmt_registrations: list of registrations for management frames 5379 - * @mgmt_registrations_lock: lock for the list 5380 5379 * @mgmt_registrations_need_update: mgmt registrations were updated, 5381 5380 * need to propagate the update to the driver 5382 5381 * @mtx: mutex used to lock data in this struct, may be used by drivers ··· 5422 5423 u32 identifier; 5423 5424 5424 5425 struct list_head mgmt_registrations; 5425 - spinlock_t mgmt_registrations_lock; 5426 5426 u8 mgmt_registrations_need_update:1; 5427 5427 5428 5428 struct mutex mtx;

+4

include/net/mptcp.h

··· 69 69 struct { 70 70 u64 sndr_key; 71 71 u64 rcvr_key; 72 + u64 data_seq; 73 + u32 subflow_seq; 74 + u16 data_len; 75 + __sum16 csum; 72 76 }; 73 77 struct { 74 78 struct mptcp_addr_info addr;

+7 -1

include/net/sock.h

··· 1208 1208 #endif 1209 1209 1210 1210 bool (*stream_memory_free)(const struct sock *sk, int wake); 1211 - bool (*stream_memory_read)(const struct sock *sk); 1211 + bool (*sock_is_readable)(struct sock *sk); 1212 1212 /* Memory pressure */ 1213 1213 void (*enter_memory_pressure)(struct sock *sk); 1214 1214 void (*leave_memory_pressure)(struct sock *sk); ··· 2820 2820 2821 2821 int sock_bind_add(struct sock *sk, struct sockaddr *addr, int addr_len); 2822 2822 2823 + static inline bool sk_is_readable(struct sock *sk) 2824 + { 2825 + if (sk->sk_prot->sock_is_readable) 2826 + return sk->sk_prot->sock_is_readable(sk); 2827 + return false; 2828 + } 2823 2829 #endif /* _SOCK_H */

+3 -8

include/net/tls.h

··· 358 358 int __user *optlen); 359 359 int tls_sk_attach(struct sock *sk, int optname, char __user *optval, 360 360 unsigned int optlen); 361 + void tls_err_abort(struct sock *sk, int err); 361 362 362 363 int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx); 363 364 void tls_sw_strparser_arm(struct sock *sk, struct tls_context *ctx); ··· 376 375 void tls_sw_free_ctx_rx(struct tls_context *tls_ctx); 377 376 int tls_sw_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, 378 377 int nonblock, int flags, int *addr_len); 379 - bool tls_sw_stream_read(const struct sock *sk); 378 + bool tls_sw_sock_is_readable(struct sock *sk); 380 379 ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos, 381 380 struct pipe_inode_info *pipe, 382 381 size_t len, unsigned int flags); ··· 467 466 #endif 468 467 } 469 468 470 - static inline void tls_err_abort(struct sock *sk, int err) 471 - { 472 - sk->sk_err = err; 473 - sk_error_report(sk); 474 - } 475 - 476 469 static inline bool tls_bigint_increment(unsigned char *seq, int len) 477 470 { 478 471 int i; ··· 507 512 struct cipher_context *ctx) 508 513 { 509 514 if (tls_bigint_increment(ctx->rec_seq, prot->rec_seq_size)) 510 - tls_err_abort(sk, EBADMSG); 515 + tls_err_abort(sk, -EBADMSG); 511 516 512 517 if (prot->version != TLS_1_3_VERSION && 513 518 prot->cipher_type != TLS_CIPHER_CHACHA20_POLY1305)

+3 -2

include/net/udp.h

··· 494 494 * CHECKSUM_NONE in __udp_gso_segment. UDP GRO indeed builds partial 495 495 * packets in udp_gro_complete_segment. As does UDP GSO, verified by 496 496 * udp_send_skb. But when those packets are looped in dev_loopback_xmit 497 - * their ip_summed is set to CHECKSUM_UNNECESSARY. Reset in this 498 - * specific case, where PARTIAL is both correct and required. 497 + * their ip_summed CHECKSUM_NONE is changed to CHECKSUM_UNNECESSARY. 498 + * Reset in this specific case, where PARTIAL is both correct and 499 + * required. 499 500 */ 500 501 if (skb->pkt_type == PACKET_LOOPBACK) 501 502 skb->ip_summed = CHECKSUM_PARTIAL;

+1

kernel/bpf/arraymap.c

··· 1072 1072 INIT_WORK(&aux->work, prog_array_map_clear_deferred); 1073 1073 INIT_LIST_HEAD(&aux->poke_progs); 1074 1074 mutex_init(&aux->poke_mutex); 1075 + spin_lock_init(&aux->owner.lock); 1075 1076 1076 1077 map = array_map_alloc(attr); 1077 1078 if (IS_ERR(map)) {

+16 -8

kernel/bpf/core.c

··· 524 524 int bpf_jit_kallsyms __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON); 525 525 int bpf_jit_harden __read_mostly; 526 526 long bpf_jit_limit __read_mostly; 527 + long bpf_jit_limit_max __read_mostly; 527 528 528 529 static void 529 530 bpf_prog_ksym_set_addr(struct bpf_prog *prog) ··· 818 817 static int __init bpf_jit_charge_init(void) 819 818 { 820 819 /* Only used as heuristic here to derive limit. */ 821 - bpf_jit_limit = min_t(u64, round_up(bpf_jit_alloc_exec_limit() >> 2, 820 + bpf_jit_limit_max = bpf_jit_alloc_exec_limit(); 821 + bpf_jit_limit = min_t(u64, round_up(bpf_jit_limit_max >> 2, 822 822 PAGE_SIZE), LONG_MAX); 823 823 return 0; 824 824 } ··· 1823 1821 bool bpf_prog_array_compatible(struct bpf_array *array, 1824 1822 const struct bpf_prog *fp) 1825 1823 { 1824 + bool ret; 1825 + 1826 1826 if (fp->kprobe_override) 1827 1827 return false; 1828 1828 1829 - if (!array->aux->type) { 1829 + spin_lock(&array->aux->owner.lock); 1830 + 1831 + if (!array->aux->owner.type) { 1830 1832 /* There's no owner yet where we could check for 1831 1833 * compatibility. 1832 1834 */ 1833 - array->aux->type = fp->type; 1834 - array->aux->jited = fp->jited; 1835 - return true; 1835 + array->aux->owner.type = fp->type; 1836 + array->aux->owner.jited = fp->jited; 1837 + ret = true; 1838 + } else { 1839 + ret = array->aux->owner.type == fp->type && 1840 + array->aux->owner.jited == fp->jited; 1836 1841 } 1837 - 1838 - return array->aux->type == fp->type && 1839 - array->aux->jited == fp->jited; 1842 + spin_unlock(&array->aux->owner.lock); 1843 + return ret; 1840 1844 } 1841 1845 1842 1846 static int bpf_check_tail_call(const struct bpf_prog *fp)

+7 -4

kernel/bpf/syscall.c

··· 543 543 544 544 if (map->map_type == BPF_MAP_TYPE_PROG_ARRAY) { 545 545 array = container_of(map, struct bpf_array, map); 546 - type = array->aux->type; 547 - jited = array->aux->jited; 546 + spin_lock(&array->aux->owner.lock); 547 + type = array->aux->owner.type; 548 + jited = array->aux->owner.jited; 549 + spin_unlock(&array->aux->owner.lock); 548 550 } 549 551 550 552 seq_printf(m, ··· 1339 1337 void __user *values = u64_to_user_ptr(attr->batch.values); 1340 1338 void __user *keys = u64_to_user_ptr(attr->batch.keys); 1341 1339 u32 value_size, cp, max_count; 1342 - int ufd = attr->map_fd; 1340 + int ufd = attr->batch.map_fd; 1343 1341 void *key, *value; 1344 1342 struct fd f; 1345 1343 int err = 0; 1346 1344 1347 - f = fdget(ufd); 1348 1345 if (attr->batch.elem_flags & ~BPF_F_LOCK) 1349 1346 return -EINVAL; 1350 1347 ··· 1368 1367 return -ENOMEM; 1369 1368 } 1370 1369 1370 + f = fdget(ufd); /* bpf_map_do_batch() guarantees ufd is valid */ 1371 1371 for (cp = 0; cp < max_count; cp++) { 1372 1372 err = -EFAULT; 1373 1373 if (copy_from_user(key, keys + cp * map->key_size, ··· 1388 1386 1389 1387 kvfree(value); 1390 1388 kvfree(key); 1389 + fdput(f); 1391 1390 return err; 1392 1391 } 1393 1392

+3 -1

kernel/cgroup/cgroup.c

··· 2187 2187 * And don't kill the default root. 2188 2188 */ 2189 2189 if (list_empty(&root->cgrp.self.children) && root != &cgrp_dfl_root && 2190 - !percpu_ref_is_dying(&root->cgrp.self.refcnt)) 2190 + !percpu_ref_is_dying(&root->cgrp.self.refcnt)) { 2191 + cgroup_bpf_offline(&root->cgrp); 2191 2192 percpu_ref_kill(&root->cgrp.self.refcnt); 2193 + } 2192 2194 cgroup_put(&root->cgrp); 2193 2195 kernfs_kill_sb(sb); 2194 2196 }

+7 -3

net/batman-adv/bridge_loop_avoidance.c

··· 1560 1560 return 0; 1561 1561 1562 1562 bat_priv->bla.claim_hash = batadv_hash_new(128); 1563 - bat_priv->bla.backbone_hash = batadv_hash_new(32); 1564 - 1565 - if (!bat_priv->bla.claim_hash || !bat_priv->bla.backbone_hash) 1563 + if (!bat_priv->bla.claim_hash) 1566 1564 return -ENOMEM; 1565 + 1566 + bat_priv->bla.backbone_hash = batadv_hash_new(32); 1567 + if (!bat_priv->bla.backbone_hash) { 1568 + batadv_hash_destroy(bat_priv->bla.claim_hash); 1569 + return -ENOMEM; 1570 + } 1567 1571 1568 1572 batadv_hash_set_lock_class(bat_priv->bla.claim_hash, 1569 1573 &batadv_claim_hash_lock_class_key);

+40 -16

net/batman-adv/main.c

··· 190 190 191 191 bat_priv->gw.generation = 0; 192 192 193 - ret = batadv_v_mesh_init(bat_priv); 194 - if (ret < 0) 195 - goto err; 196 - 197 193 ret = batadv_originator_init(bat_priv); 198 - if (ret < 0) 199 - goto err; 194 + if (ret < 0) { 195 + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); 196 + goto err_orig; 197 + } 200 198 201 199 ret = batadv_tt_init(bat_priv); 202 - if (ret < 0) 203 - goto err; 200 + if (ret < 0) { 201 + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); 202 + goto err_tt; 203 + } 204 + 205 + ret = batadv_v_mesh_init(bat_priv); 206 + if (ret < 0) { 207 + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); 208 + goto err_v; 209 + } 204 210 205 211 ret = batadv_bla_init(bat_priv); 206 - if (ret < 0) 207 - goto err; 212 + if (ret < 0) { 213 + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); 214 + goto err_bla; 215 + } 208 216 209 217 ret = batadv_dat_init(bat_priv); 210 - if (ret < 0) 211 - goto err; 218 + if (ret < 0) { 219 + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); 220 + goto err_dat; 221 + } 212 222 213 223 ret = batadv_nc_mesh_init(bat_priv); 214 - if (ret < 0) 215 - goto err; 224 + if (ret < 0) { 225 + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); 226 + goto err_nc; 227 + } 216 228 217 229 batadv_gw_init(bat_priv); 218 230 batadv_mcast_init(bat_priv); ··· 234 222 235 223 return 0; 236 224 237 - err: 238 - batadv_mesh_free(soft_iface); 225 + err_nc: 226 + batadv_dat_free(bat_priv); 227 + err_dat: 228 + batadv_bla_free(bat_priv); 229 + err_bla: 230 + batadv_v_mesh_free(bat_priv); 231 + err_v: 232 + batadv_tt_free(bat_priv); 233 + err_tt: 234 + batadv_originator_free(bat_priv); 235 + err_orig: 236 + batadv_purge_outstanding_packets(bat_priv, NULL); 237 + atomic_set(&bat_priv->mesh_state, BATADV_MESH_INACTIVE); 238 + 239 239 return ret; 240 240 } 241 241

+3 -1

net/batman-adv/network-coding.c

··· 152 152 &batadv_nc_coding_hash_lock_class_key); 153 153 154 154 bat_priv->nc.decoding_hash = batadv_hash_new(128); 155 - if (!bat_priv->nc.decoding_hash) 155 + if (!bat_priv->nc.decoding_hash) { 156 + batadv_hash_destroy(bat_priv->nc.coding_hash); 156 157 goto err; 158 + } 157 159 158 160 batadv_hash_set_lock_class(bat_priv->nc.decoding_hash, 159 161 &batadv_nc_decoding_hash_lock_class_key);

+3 -1

net/batman-adv/translation-table.c

··· 4162 4162 return ret; 4163 4163 4164 4164 ret = batadv_tt_global_init(bat_priv); 4165 - if (ret < 0) 4165 + if (ret < 0) { 4166 + batadv_tt_local_table_free(bat_priv); 4166 4167 return ret; 4168 + } 4167 4169 4168 4170 batadv_tvlv_handler_register(bat_priv, batadv_tt_tvlv_ogm_handler_v1, 4169 4171 batadv_tt_tvlv_unicast_handler_v1,

+8 -1

net/core/dev.c

··· 3163 3163 3164 3164 qoffset = sb_dev->tc_to_txq[tc].offset; 3165 3165 qcount = sb_dev->tc_to_txq[tc].count; 3166 + if (unlikely(!qcount)) { 3167 + net_warn_ratelimited("%s: invalid qcount, qoffset %u for tc %u\n", 3168 + sb_dev->name, qoffset, tc); 3169 + qoffset = 0; 3170 + qcount = dev->real_num_tx_queues; 3171 + } 3166 3172 } 3167 3173 3168 3174 if (skb_rx_queue_recorded(skb)) { ··· 3912 3906 skb_reset_mac_header(skb); 3913 3907 __skb_pull(skb, skb_network_offset(skb)); 3914 3908 skb->pkt_type = PACKET_LOOPBACK; 3915 - skb->ip_summed = CHECKSUM_UNNECESSARY; 3909 + if (skb->ip_summed == CHECKSUM_NONE) 3910 + skb->ip_summed = CHECKSUM_UNNECESSARY; 3916 3911 WARN_ON(!skb_dst(skb)); 3917 3912 skb_dst_force(skb); 3918 3913 netif_rx_ni(skb);

+2 -2

net/core/net-sysfs.c

··· 1973 1973 int netdev_change_owner(struct net_device *ndev, const struct net *net_old, 1974 1974 const struct net *net_new) 1975 1975 { 1976 + kuid_t old_uid = GLOBAL_ROOT_UID, new_uid = GLOBAL_ROOT_UID; 1977 + kgid_t old_gid = GLOBAL_ROOT_GID, new_gid = GLOBAL_ROOT_GID; 1976 1978 struct device *dev = &ndev->dev; 1977 - kuid_t old_uid, new_uid; 1978 - kgid_t old_gid, new_gid; 1979 1979 int error; 1980 1980 1981 1981 net_ns_get_ownership(net_old, &old_uid, &old_gid);

+23 -13

net/core/skbuff.c

··· 80 80 #include <linux/indirect_call_wrapper.h> 81 81 82 82 #include "datagram.h" 83 + #include "sock_destructor.h" 83 84 84 85 struct kmem_cache *skbuff_head_cache __ro_after_init; 85 86 static struct kmem_cache *skbuff_fclone_cache __ro_after_init; ··· 1805 1804 struct sk_buff *skb_expand_head(struct sk_buff *skb, unsigned int headroom) 1806 1805 { 1807 1806 int delta = headroom - skb_headroom(skb); 1807 + int osize = skb_end_offset(skb); 1808 + struct sock *sk = skb->sk; 1808 1809 1809 1810 if (WARN_ONCE(delta <= 0, 1810 1811 "%s is expecting an increase in the headroom", __func__)) 1811 1812 return skb; 1812 1813 1813 - /* pskb_expand_head() might crash, if skb is shared */ 1814 - if (skb_shared(skb)) { 1814 + delta = SKB_DATA_ALIGN(delta); 1815 + /* pskb_expand_head() might crash, if skb is shared. */ 1816 + if (skb_shared(skb) || !is_skb_wmem(skb)) { 1815 1817 struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC); 1816 1818 1817 - if (likely(nskb)) { 1818 - if (skb->sk) 1819 - skb_set_owner_w(nskb, skb->sk); 1820 - consume_skb(skb); 1821 - } else { 1822 - kfree_skb(skb); 1823 - } 1819 + if (unlikely(!nskb)) 1820 + goto fail; 1821 + 1822 + if (sk) 1823 + skb_set_owner_w(nskb, sk); 1824 + consume_skb(skb); 1824 1825 skb = nskb; 1825 1826 } 1826 - if (skb && 1827 - pskb_expand_head(skb, SKB_DATA_ALIGN(delta), 0, GFP_ATOMIC)) { 1828 - kfree_skb(skb); 1829 - skb = NULL; 1827 + if (pskb_expand_head(skb, delta, 0, GFP_ATOMIC)) 1828 + goto fail; 1829 + 1830 + if (sk && is_skb_wmem(skb)) { 1831 + delta = skb_end_offset(skb) - osize; 1832 + refcount_add(delta, &sk->sk_wmem_alloc); 1833 + skb->truesize += delta; 1830 1834 } 1831 1835 return skb; 1836 + 1837 + fail: 1838 + kfree_skb(skb); 1839 + return NULL; 1832 1840 } 1833 1841 EXPORT_SYMBOL(skb_expand_head); 1834 1842

+14

net/core/skmsg.c

··· 474 474 } 475 475 EXPORT_SYMBOL_GPL(sk_msg_recvmsg); 476 476 477 + bool sk_msg_is_readable(struct sock *sk) 478 + { 479 + struct sk_psock *psock; 480 + bool empty = true; 481 + 482 + rcu_read_lock(); 483 + psock = sk_psock(sk); 484 + if (likely(psock)) 485 + empty = list_empty(&psock->ingress_msg); 486 + rcu_read_unlock(); 487 + return !empty; 488 + } 489 + EXPORT_SYMBOL_GPL(sk_msg_is_readable); 490 + 477 491 static struct sk_msg *sk_psock_create_ingress_msg(struct sock *sk, 478 492 struct sk_buff *skb) 479 493 {

+12

net/core/sock_destructor.h

··· 1 + /* SPDX-License-Identifier: GPL-2.0-or-later */ 2 + #ifndef _NET_CORE_SOCK_DESTRUCTOR_H 3 + #define _NET_CORE_SOCK_DESTRUCTOR_H 4 + #include <net/tcp.h> 5 + 6 + static inline bool is_skb_wmem(const struct sk_buff *skb) 7 + { 8 + return skb->destructor == sock_wfree || 9 + skb->destructor == __sock_wfree || 10 + (IS_ENABLED(CONFIG_INET) && skb->destructor == tcp_wfree); 11 + } 12 + #endif

+1 -1

net/core/sysctl_net_core.c

··· 419 419 .mode = 0600, 420 420 .proc_handler = proc_dolongvec_minmax_bpf_restricted, 421 421 .extra1 = &long_one, 422 - .extra2 = &long_max, 422 + .extra2 = &bpf_jit_limit_max, 423 423 }, 424 424 #endif 425 425 {

+1 -4

net/ipv4/tcp.c

··· 486 486 { 487 487 if (tcp_epollin_ready(sk, target)) 488 488 return true; 489 - 490 - if (sk->sk_prot->stream_memory_read) 491 - return sk->sk_prot->stream_memory_read(sk); 492 - return false; 489 + return sk_is_readable(sk); 493 490 } 494 491 495 492 /*

+13 -14

net/ipv4/tcp_bpf.c

··· 150 150 EXPORT_SYMBOL_GPL(tcp_bpf_sendmsg_redir); 151 151 152 152 #ifdef CONFIG_BPF_SYSCALL 153 - static bool tcp_bpf_stream_read(const struct sock *sk) 154 - { 155 - struct sk_psock *psock; 156 - bool empty = true; 157 - 158 - rcu_read_lock(); 159 - psock = sk_psock(sk); 160 - if (likely(psock)) 161 - empty = list_empty(&psock->ingress_msg); 162 - rcu_read_unlock(); 163 - return !empty; 164 - } 165 - 166 153 static int tcp_msg_wait_data(struct sock *sk, struct sk_psock *psock, 167 154 long timeo) 168 155 { ··· 219 232 bool cork = false, enospc = sk_msg_full(msg); 220 233 struct sock *sk_redir; 221 234 u32 tosend, delta = 0; 235 + u32 eval = __SK_NONE; 222 236 int ret; 223 237 224 238 more_data: ··· 263 275 case __SK_REDIRECT: 264 276 sk_redir = psock->sk_redir; 265 277 sk_msg_apply_bytes(psock, tosend); 278 + if (!psock->apply_bytes) { 279 + /* Clean up before releasing the sock lock. */ 280 + eval = psock->eval; 281 + psock->eval = __SK_NONE; 282 + psock->sk_redir = NULL; 283 + } 266 284 if (psock->cork) { 267 285 cork = true; 268 286 psock->cork = NULL; 269 287 } 270 288 sk_msg_return(sk, msg, tosend); 271 289 release_sock(sk); 290 + 272 291 ret = tcp_bpf_sendmsg_redir(sk_redir, msg, tosend, flags); 292 + 293 + if (eval == __SK_REDIRECT) 294 + sock_put(sk_redir); 295 + 273 296 lock_sock(sk); 274 297 if (unlikely(ret < 0)) { 275 298 int free = sk_msg_free_nocharge(sk, msg); ··· 478 479 prot[TCP_BPF_BASE].unhash = sock_map_unhash; 479 480 prot[TCP_BPF_BASE].close = sock_map_close; 480 481 prot[TCP_BPF_BASE].recvmsg = tcp_bpf_recvmsg; 481 - prot[TCP_BPF_BASE].stream_memory_read = tcp_bpf_stream_read; 482 + prot[TCP_BPF_BASE].sock_is_readable = sk_msg_is_readable; 482 483 483 484 prot[TCP_BPF_TX] = prot[TCP_BPF_BASE]; 484 485 prot[TCP_BPF_TX].sendmsg = tcp_bpf_sendmsg;

+3

net/ipv4/udp.c

··· 2867 2867 !(sk->sk_shutdown & RCV_SHUTDOWN) && first_packet_length(sk) == -1) 2868 2868 mask &= ~(EPOLLIN | EPOLLRDNORM); 2869 2869 2870 + /* psock ingress_msg queue should not contain any bad checksum frames */ 2871 + if (sk_is_readable(sk)) 2872 + mask |= EPOLLIN | EPOLLRDNORM; 2870 2873 return mask; 2871 2874 2872 2875 }

+1

net/ipv4/udp_bpf.c

··· 114 114 *prot = *base; 115 115 prot->close = sock_map_close; 116 116 prot->recvmsg = udp_bpf_recvmsg; 117 + prot->sock_is_readable = sk_msg_is_readable; 117 118 } 118 119 119 120 static void udp_bpf_check_v6_needs_rebuild(struct proto *ops)

+5 -4

net/mac80211/mesh.c

··· 672 672 u8 *ie, u8 ie_len) 673 673 { 674 674 struct ieee80211_supported_band *sband; 675 - const u8 *cap; 675 + const struct element *cap; 676 676 const struct ieee80211_he_operation *he_oper = NULL; 677 677 678 678 sband = ieee80211_get_sband(sdata); ··· 687 687 688 688 sdata->vif.bss_conf.he_support = true; 689 689 690 - cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION, ie, ie_len); 691 - if (cap && cap[1] >= ieee80211_he_oper_size(&cap[3])) 692 - he_oper = (void *)(cap + 3); 690 + cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ie, ie_len); 691 + if (cap && cap->datalen >= 1 + sizeof(*he_oper) && 692 + cap->datalen >= 1 + ieee80211_he_oper_size(cap->data + 1)) 693 + he_oper = (void *)(cap->data + 1); 693 694 694 695 if (he_oper) 695 696 sdata->vif.bss_conf.he_oper.params =

+24 -15

net/mptcp/options.c

··· 485 485 mpext = mptcp_get_ext(skb); 486 486 data_len = mpext ? mpext->data_len : 0; 487 487 488 - /* we will check ext_copy.data_len in mptcp_write_options() to 488 + /* we will check ops->data_len in mptcp_write_options() to 489 489 * discriminate between TCPOLEN_MPTCP_MPC_ACK_DATA and 490 490 * TCPOLEN_MPTCP_MPC_ACK 491 491 */ 492 - opts->ext_copy.data_len = data_len; 492 + opts->data_len = data_len; 493 493 opts->suboptions = OPTION_MPTCP_MPC_ACK; 494 494 opts->sndr_key = subflow->local_key; 495 495 opts->rcvr_key = subflow->remote_key; ··· 505 505 len = TCPOLEN_MPTCP_MPC_ACK_DATA; 506 506 if (opts->csum_reqd) { 507 507 /* we need to propagate more info to csum the pseudo hdr */ 508 - opts->ext_copy.data_seq = mpext->data_seq; 509 - opts->ext_copy.subflow_seq = mpext->subflow_seq; 510 - opts->ext_copy.csum = mpext->csum; 508 + opts->data_seq = mpext->data_seq; 509 + opts->subflow_seq = mpext->subflow_seq; 510 + opts->csum = mpext->csum; 511 511 len += TCPOLEN_MPTCP_DSS_CHECKSUM; 512 512 } 513 513 *size = ALIGN(len, 4); ··· 1227 1227 WRITE_ONCE(msk->rcv_wnd_sent, ack_seq); 1228 1228 } 1229 1229 1230 - static u16 mptcp_make_csum(const struct mptcp_ext *mpext) 1230 + static u16 __mptcp_make_csum(u64 data_seq, u32 subflow_seq, u16 data_len, __sum16 sum) 1231 1231 { 1232 1232 struct csum_pseudo_header header; 1233 1233 __wsum csum; ··· 1237 1237 * always the 64-bit value, irrespective of what length is used in the 1238 1238 * DSS option itself. 1239 1239 */ 1240 - header.data_seq = cpu_to_be64(mpext->data_seq); 1241 - header.subflow_seq = htonl(mpext->subflow_seq); 1242 - header.data_len = htons(mpext->data_len); 1240 + header.data_seq = cpu_to_be64(data_seq); 1241 + header.subflow_seq = htonl(subflow_seq); 1242 + header.data_len = htons(data_len); 1243 1243 header.csum = 0; 1244 1244 1245 - csum = csum_partial(&header, sizeof(header), ~csum_unfold(mpext->csum)); 1245 + csum = csum_partial(&header, sizeof(header), ~csum_unfold(sum)); 1246 1246 return (__force u16)csum_fold(csum); 1247 + } 1248 + 1249 + static u16 mptcp_make_csum(const struct mptcp_ext *mpext) 1250 + { 1251 + return __mptcp_make_csum(mpext->data_seq, mpext->subflow_seq, mpext->data_len, 1252 + mpext->csum); 1247 1253 } 1248 1254 1249 1255 void mptcp_write_options(__be32 *ptr, const struct tcp_sock *tp, ··· 1343 1337 len = TCPOLEN_MPTCP_MPC_SYN; 1344 1338 } else if (OPTION_MPTCP_MPC_SYNACK & opts->suboptions) { 1345 1339 len = TCPOLEN_MPTCP_MPC_SYNACK; 1346 - } else if (opts->ext_copy.data_len) { 1340 + } else if (opts->data_len) { 1347 1341 len = TCPOLEN_MPTCP_MPC_ACK_DATA; 1348 1342 if (opts->csum_reqd) 1349 1343 len += TCPOLEN_MPTCP_DSS_CHECKSUM; ··· 1372 1366 1373 1367 put_unaligned_be64(opts->rcvr_key, ptr); 1374 1368 ptr += 2; 1375 - if (!opts->ext_copy.data_len) 1369 + if (!opts->data_len) 1376 1370 goto mp_capable_done; 1377 1371 1378 1372 if (opts->csum_reqd) { 1379 - put_unaligned_be32(opts->ext_copy.data_len << 16 | 1380 - mptcp_make_csum(&opts->ext_copy), ptr); 1373 + put_unaligned_be32(opts->data_len << 16 | 1374 + __mptcp_make_csum(opts->data_seq, 1375 + opts->subflow_seq, 1376 + opts->data_len, 1377 + opts->csum), ptr); 1381 1378 } else { 1382 - put_unaligned_be32(opts->ext_copy.data_len << 16 | 1379 + put_unaligned_be32(opts->data_len << 16 | 1383 1380 TCPOPT_NOP << 8 | TCPOPT_NOP, ptr); 1384 1381 } 1385 1382 ptr += 1;

+85 -54

net/sctp/sm_statefuns.c

··· 156 156 void *arg, 157 157 struct sctp_cmd_seq *commands); 158 158 159 + static enum sctp_disposition 160 + __sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep, 161 + const struct sctp_association *asoc, 162 + const union sctp_subtype type, void *arg, 163 + struct sctp_cmd_seq *commands); 164 + 159 165 /* Small helper function that checks if the chunk length 160 166 * is of the appropriate length. The 'required_length' argument 161 167 * is set to be the size of a specific chunk we are testing. ··· 343 337 if (!chunk->singleton) 344 338 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 345 339 340 + /* Make sure that the INIT chunk has a valid length. 341 + * Normally, this would cause an ABORT with a Protocol Violation 342 + * error, but since we don't have an association, we'll 343 + * just discard the packet. 344 + */ 345 + if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) 346 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 347 + 346 348 /* If the packet is an OOTB packet which is temporarily on the 347 349 * control endpoint, respond with an ABORT. 348 350 */ ··· 364 350 */ 365 351 if (chunk->sctp_hdr->vtag != 0) 366 352 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); 367 - 368 - /* Make sure that the INIT chunk has a valid length. 369 - * Normally, this would cause an ABORT with a Protocol Violation 370 - * error, but since we don't have an association, we'll 371 - * just discard the packet. 372 - */ 373 - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) 374 - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 375 353 376 354 /* If the INIT is coming toward a closing socket, we'll send back 377 355 * and ABORT. Essentially, this catches the race of INIT being ··· 710 704 struct sock *sk; 711 705 int error = 0; 712 706 707 + if (asoc && !sctp_vtag_verify(chunk, asoc)) 708 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 709 + 713 710 /* If the packet is an OOTB packet which is temporarily on the 714 711 * control endpoint, respond with an ABORT. 715 712 */ ··· 727 718 * in sctp_unpack_cookie(). 728 719 */ 729 720 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) 730 - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 721 + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 722 + commands); 731 723 732 724 /* If the endpoint is not listening or if the number of associations 733 725 * on the TCP-style socket exceed the max backlog, respond with an ··· 1534 1524 if (!chunk->singleton) 1535 1525 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 1536 1526 1527 + /* Make sure that the INIT chunk has a valid length. */ 1528 + if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) 1529 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 1530 + 1537 1531 /* 3.1 A packet containing an INIT chunk MUST have a zero Verification 1538 1532 * Tag. 1539 1533 */ 1540 1534 if (chunk->sctp_hdr->vtag != 0) 1541 1535 return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); 1542 - 1543 - /* Make sure that the INIT chunk has a valid length. 1544 - * In this case, we generate a protocol violation since we have 1545 - * an association established. 1546 - */ 1547 - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) 1548 - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 1549 - commands); 1550 1536 1551 1537 if (SCTP_INPUT_CB(chunk->skb)->encap_port != chunk->transport->encap_port) 1552 1538 return sctp_sf_new_encap_port(net, ep, asoc, type, arg, commands); ··· 1888 1882 * its peer. 1889 1883 */ 1890 1884 if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) { 1891 - disposition = sctp_sf_do_9_2_reshutack(net, ep, asoc, 1892 - SCTP_ST_CHUNK(chunk->chunk_hdr->type), 1893 - chunk, commands); 1885 + disposition = __sctp_sf_do_9_2_reshutack(net, ep, asoc, 1886 + SCTP_ST_CHUNK(chunk->chunk_hdr->type), 1887 + chunk, commands); 1894 1888 if (SCTP_DISPOSITION_NOMEM == disposition) 1895 1889 goto nomem; 1896 1890 ··· 2208 2202 * enough for the chunk header. Cookie length verification is 2209 2203 * done later. 2210 2204 */ 2211 - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) 2212 - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 2213 - commands); 2205 + if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) { 2206 + if (!sctp_vtag_verify(chunk, asoc)) 2207 + asoc = NULL; 2208 + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, commands); 2209 + } 2214 2210 2215 2211 /* "Decode" the chunk. We have no optional parameters so we 2216 2212 * are in good shape. ··· 2349 2341 */ 2350 2342 if (SCTP_ADDR_DEL == 2351 2343 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest)) 2352 - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands); 2344 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2353 2345 2354 2346 if (!sctp_err_chunk_valid(chunk)) 2355 2347 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); ··· 2395 2387 */ 2396 2388 if (SCTP_ADDR_DEL == 2397 2389 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest)) 2398 - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands); 2390 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2399 2391 2400 2392 if (!sctp_err_chunk_valid(chunk)) 2401 2393 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); ··· 2665 2657 */ 2666 2658 if (SCTP_ADDR_DEL == 2667 2659 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest)) 2668 - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands); 2660 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 2669 2661 2670 2662 if (!sctp_err_chunk_valid(chunk)) 2671 2663 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); ··· 2978 2970 * that belong to this association, it should discard the INIT chunk and 2979 2971 * retransmit the SHUTDOWN ACK chunk. 2980 2972 */ 2981 - enum sctp_disposition sctp_sf_do_9_2_reshutack( 2982 - struct net *net, 2983 - const struct sctp_endpoint *ep, 2984 - const struct sctp_association *asoc, 2985 - const union sctp_subtype type, 2986 - void *arg, 2987 - struct sctp_cmd_seq *commands) 2973 + static enum sctp_disposition 2974 + __sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep, 2975 + const struct sctp_association *asoc, 2976 + const union sctp_subtype type, void *arg, 2977 + struct sctp_cmd_seq *commands) 2988 2978 { 2989 2979 struct sctp_chunk *chunk = arg; 2990 2980 struct sctp_chunk *reply; ··· 3014 3008 return SCTP_DISPOSITION_CONSUME; 3015 3009 nomem: 3016 3010 return SCTP_DISPOSITION_NOMEM; 3011 + } 3012 + 3013 + enum sctp_disposition 3014 + sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep, 3015 + const struct sctp_association *asoc, 3016 + const union sctp_subtype type, void *arg, 3017 + struct sctp_cmd_seq *commands) 3018 + { 3019 + struct sctp_chunk *chunk = arg; 3020 + 3021 + if (!chunk->singleton) 3022 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3023 + 3024 + if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) 3025 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3026 + 3027 + if (chunk->sctp_hdr->vtag != 0) 3028 + return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); 3029 + 3030 + return __sctp_sf_do_9_2_reshutack(net, ep, asoc, type, arg, commands); 3017 3031 } 3018 3032 3019 3033 /* ··· 3688 3662 3689 3663 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES); 3690 3664 3665 + if (asoc && !sctp_vtag_verify(chunk, asoc)) 3666 + asoc = NULL; 3667 + 3691 3668 ch = (struct sctp_chunkhdr *)chunk->chunk_hdr; 3692 3669 do { 3693 3670 /* Report violation if the chunk is less then minimal */ ··· 3806 3777 3807 3778 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS); 3808 3779 3809 - /* If the chunk length is invalid, we don't want to process 3810 - * the reset of the packet. 3811 - */ 3812 - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) 3813 - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3814 - 3815 3780 /* We need to discard the rest of the packet to prevent 3816 3781 * potential boomming attacks from additional bundled chunks. 3817 3782 * This is documented in SCTP Threats ID. ··· 3832 3809 struct sctp_cmd_seq *commands) 3833 3810 { 3834 3811 struct sctp_chunk *chunk = arg; 3812 + 3813 + if (!sctp_vtag_verify(chunk, asoc)) 3814 + asoc = NULL; 3835 3815 3836 3816 /* Make sure that the SHUTDOWN_ACK chunk has a valid length. */ 3837 3817 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) ··· 3871 3845 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3872 3846 } 3873 3847 3848 + /* Make sure that the ASCONF ADDIP chunk has a valid length. */ 3849 + if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk))) 3850 + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 3851 + commands); 3852 + 3874 3853 /* ADD-IP: Section 4.1.1 3875 3854 * This chunk MUST be sent in an authenticated way by using 3876 3855 * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk ··· 3884 3853 */ 3885 3854 if (!asoc->peer.asconf_capable || 3886 3855 (!net->sctp.addip_noauth && !chunk->auth)) 3887 - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, 3888 - commands); 3889 - 3890 - /* Make sure that the ASCONF ADDIP chunk has a valid length. */ 3891 - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk))) 3892 - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 3893 - commands); 3856 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 3894 3857 3895 3858 hdr = (struct sctp_addiphdr *)chunk->skb->data; 3896 3859 serial = ntohl(hdr->serial); ··· 4013 3988 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 4014 3989 } 4015 3990 3991 + /* Make sure that the ADDIP chunk has a valid length. */ 3992 + if (!sctp_chunk_length_valid(asconf_ack, 3993 + sizeof(struct sctp_addip_chunk))) 3994 + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 3995 + commands); 3996 + 4016 3997 /* ADD-IP, Section 4.1.2: 4017 3998 * This chunk MUST be sent in an authenticated way by using 4018 3999 * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk ··· 4027 3996 */ 4028 3997 if (!asoc->peer.asconf_capable || 4029 3998 (!net->sctp.addip_noauth && !asconf_ack->auth)) 4030 - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, 4031 - commands); 4032 - 4033 - /* Make sure that the ADDIP chunk has a valid length. */ 4034 - if (!sctp_chunk_length_valid(asconf_ack, 4035 - sizeof(struct sctp_addip_chunk))) 4036 - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, 4037 - commands); 3999 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 4038 4000 4039 4001 addip_hdr = (struct sctp_addiphdr *)asconf_ack->skb->data; 4040 4002 rcvd_serial = ntohl(addip_hdr->serial); ··· 4599 4575 { 4600 4576 struct sctp_chunk *chunk = arg; 4601 4577 4578 + if (asoc && !sctp_vtag_verify(chunk, asoc)) 4579 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 4580 + 4602 4581 /* Make sure that the chunk has a valid length. 4603 4582 * Since we don't know the chunk type, we use a general 4604 4583 * chunkhdr structure to make a comparison. ··· 4668 4641 struct sctp_cmd_seq *commands) 4669 4642 { 4670 4643 struct sctp_chunk *chunk = arg; 4644 + 4645 + if (!sctp_vtag_verify(chunk, asoc)) 4646 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); 4671 4647 4672 4648 /* Make sure that the chunk has a valid length. */ 4673 4649 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) ··· 6378 6348 * yet. 6379 6349 */ 6380 6350 switch (chunk->chunk_hdr->type) { 6351 + case SCTP_CID_INIT: 6381 6352 case SCTP_CID_INIT_ACK: 6382 6353 { 6383 6354 struct sctp_initack_chunk *initack;

+1 -1

net/smc/af_smc.c

··· 1057 1057 if (smc->clcsock->sk->sk_err) { 1058 1058 smc->sk.sk_err = smc->clcsock->sk->sk_err; 1059 1059 } else if ((1 << smc->clcsock->sk->sk_state) & 1060 - (TCPF_SYN_SENT | TCP_SYN_RECV)) { 1060 + (TCPF_SYN_SENT | TCPF_SYN_RECV)) { 1061 1061 rc = sk_stream_wait_connect(smc->clcsock->sk, &timeo); 1062 1062 if ((rc == -EPIPE) && 1063 1063 ((1 << smc->clcsock->sk->sk_state) &

+1 -1

net/smc/smc_llc.c

··· 1822 1822 link->smcibdev->ibdev->name, link->ibport); 1823 1823 link->state = SMC_LNK_ACTIVE; 1824 1824 if (link->lgr->llc_testlink_time) { 1825 - link->llc_testlink_time = link->lgr->llc_testlink_time * HZ; 1825 + link->llc_testlink_time = link->lgr->llc_testlink_time; 1826 1826 schedule_delayed_work(&link->llc_testlink_wrk, 1827 1827 link->llc_testlink_time); 1828 1828 }

+21 -11

net/tipc/crypto.c

··· 2285 2285 u16 key_gen = msg_key_gen(hdr); 2286 2286 u16 size = msg_data_sz(hdr); 2287 2287 u8 *data = msg_data(hdr); 2288 + unsigned int keylen; 2289 + 2290 + /* Verify whether the size can exist in the packet */ 2291 + if (unlikely(size < sizeof(struct tipc_aead_key) + TIPC_AEAD_KEYLEN_MIN)) { 2292 + pr_debug("%s: message data size is too small\n", rx->name); 2293 + goto exit; 2294 + } 2295 + 2296 + keylen = ntohl(*((__be32 *)(data + TIPC_AEAD_ALG_NAME))); 2297 + 2298 + /* Verify the supplied size values */ 2299 + if (unlikely(size != keylen + sizeof(struct tipc_aead_key) || 2300 + keylen > TIPC_AEAD_KEY_SIZE_MAX)) { 2301 + pr_debug("%s: invalid MSG_CRYPTO key size\n", rx->name); 2302 + goto exit; 2303 + } 2288 2304 2289 2305 spin_lock(&rx->lock); 2290 2306 if (unlikely(rx->skey || (key_gen == rx->key_gen && rx->key.keys))) { 2291 2307 pr_err("%s: key existed <%p>, gen %d vs %d\n", rx->name, 2292 2308 rx->skey, key_gen, rx->key_gen); 2293 - goto exit; 2309 + goto exit_unlock; 2294 2310 } 2295 2311 2296 2312 /* Allocate memory for the key */ 2297 2313 skey = kmalloc(size, GFP_ATOMIC); 2298 2314 if (unlikely(!skey)) { 2299 2315 pr_err("%s: unable to allocate memory for skey\n", rx->name); 2300 - goto exit; 2316 + goto exit_unlock; 2301 2317 } 2302 2318 2303 2319 /* Copy key from msg data */ 2304 - skey->keylen = ntohl(*((__be32 *)(data + TIPC_AEAD_ALG_NAME))); 2320 + skey->keylen = keylen; 2305 2321 memcpy(skey->alg_name, data, TIPC_AEAD_ALG_NAME); 2306 2322 memcpy(skey->key, data + TIPC_AEAD_ALG_NAME + sizeof(__be32), 2307 2323 skey->keylen); 2308 - 2309 - /* Sanity check */ 2310 - if (unlikely(size != tipc_aead_key_size(skey))) { 2311 - kfree(skey); 2312 - skey = NULL; 2313 - goto exit; 2314 - } 2315 2324 2316 2325 rx->key_gen = key_gen; 2317 2326 rx->skey_mode = msg_key_mode(hdr); ··· 2328 2319 rx->nokey = 0; 2329 2320 mb(); /* for nokey flag */ 2330 2321 2331 - exit: 2322 + exit_unlock: 2332 2323 spin_unlock(&rx->lock); 2333 2324 2325 + exit: 2334 2326 /* Schedule the key attaching on this crypto */ 2335 2327 if (likely(skey && queue_delayed_work(tx->wq, &rx->work, 0))) 2336 2328 return true;

+2 -2

net/tls/tls_main.c

··· 681 681 682 682 prot[TLS_BASE][TLS_SW] = prot[TLS_BASE][TLS_BASE]; 683 683 prot[TLS_BASE][TLS_SW].recvmsg = tls_sw_recvmsg; 684 - prot[TLS_BASE][TLS_SW].stream_memory_read = tls_sw_stream_read; 684 + prot[TLS_BASE][TLS_SW].sock_is_readable = tls_sw_sock_is_readable; 685 685 prot[TLS_BASE][TLS_SW].close = tls_sk_proto_close; 686 686 687 687 prot[TLS_SW][TLS_SW] = prot[TLS_SW][TLS_BASE]; 688 688 prot[TLS_SW][TLS_SW].recvmsg = tls_sw_recvmsg; 689 - prot[TLS_SW][TLS_SW].stream_memory_read = tls_sw_stream_read; 689 + prot[TLS_SW][TLS_SW].sock_is_readable = tls_sw_sock_is_readable; 690 690 prot[TLS_SW][TLS_SW].close = tls_sk_proto_close; 691 691 692 692 #ifdef CONFIG_TLS_DEVICE

+15 -6

net/tls/tls_sw.c

··· 35 35 * SOFTWARE. 36 36 */ 37 37 38 + #include <linux/bug.h> 38 39 #include <linux/sched/signal.h> 39 40 #include <linux/module.h> 40 41 #include <linux/splice.h> ··· 43 42 44 43 #include <net/strparser.h> 45 44 #include <net/tls.h> 45 + 46 + noinline void tls_err_abort(struct sock *sk, int err) 47 + { 48 + WARN_ON_ONCE(err >= 0); 49 + /* sk->sk_err should contain a positive error code. */ 50 + sk->sk_err = -err; 51 + sk_error_report(sk); 52 + } 46 53 47 54 static int __skb_nsg(struct sk_buff *skb, int offset, int len, 48 55 unsigned int recursion_level) ··· 428 419 429 420 tx_err: 430 421 if (rc < 0 && rc != -EAGAIN) 431 - tls_err_abort(sk, EBADMSG); 422 + tls_err_abort(sk, -EBADMSG); 432 423 433 424 return rc; 434 425 } ··· 459 450 460 451 /* If err is already set on socket, return the same code */ 461 452 if (sk->sk_err) { 462 - ctx->async_wait.err = sk->sk_err; 453 + ctx->async_wait.err = -sk->sk_err; 463 454 } else { 464 455 ctx->async_wait.err = err; 465 456 tls_err_abort(sk, err); ··· 772 763 msg_pl->sg.size + prot->tail_size, i); 773 764 if (rc < 0) { 774 765 if (rc != -EINPROGRESS) { 775 - tls_err_abort(sk, EBADMSG); 766 + tls_err_abort(sk, -EBADMSG); 776 767 if (split) { 777 768 tls_ctx->pending_open_record_frags = true; 778 769 tls_merge_open_record(sk, rec, tmp, orig_end); ··· 1836 1827 err = decrypt_skb_update(sk, skb, &msg->msg_iter, 1837 1828 &chunk, &zc, async_capable); 1838 1829 if (err < 0 && err != -EINPROGRESS) { 1839 - tls_err_abort(sk, EBADMSG); 1830 + tls_err_abort(sk, -EBADMSG); 1840 1831 goto recv_end; 1841 1832 } 1842 1833 ··· 2016 2007 } 2017 2008 2018 2009 if (err < 0) { 2019 - tls_err_abort(sk, EBADMSG); 2010 + tls_err_abort(sk, -EBADMSG); 2020 2011 goto splice_read_end; 2021 2012 } 2022 2013 ctx->decrypted = 1; ··· 2035 2026 return copied ? : err; 2036 2027 } 2037 2028 2038 - bool tls_sw_stream_read(const struct sock *sk) 2029 + bool tls_sw_sock_is_readable(struct sock *sk) 2039 2030 { 2040 2031 struct tls_context *tls_ctx = tls_get_ctx(sk); 2041 2032 struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);

+4

net/unix/af_unix.c

··· 3052 3052 /* readable? */ 3053 3053 if (!skb_queue_empty_lockless(&sk->sk_receive_queue)) 3054 3054 mask |= EPOLLIN | EPOLLRDNORM; 3055 + if (sk_is_readable(sk)) 3056 + mask |= EPOLLIN | EPOLLRDNORM; 3055 3057 3056 3058 /* Connection-based need to check for termination and startup */ 3057 3059 if ((sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) && ··· 3092 3090 3093 3091 /* readable? */ 3094 3092 if (!skb_queue_empty_lockless(&sk->sk_receive_queue)) 3093 + mask |= EPOLLIN | EPOLLRDNORM; 3094 + if (sk_is_readable(sk)) 3095 3095 mask |= EPOLLIN | EPOLLRDNORM; 3096 3096 3097 3097 /* Connection-based need to check for termination and startup */

+2

net/unix/unix_bpf.c

··· 102 102 *prot = *base; 103 103 prot->close = sock_map_close; 104 104 prot->recvmsg = unix_bpf_recvmsg; 105 + prot->sock_is_readable = sk_msg_is_readable; 105 106 } 106 107 107 108 static void unix_stream_bpf_rebuild_protos(struct proto *prot, ··· 111 110 *prot = *base; 112 111 prot->close = sock_map_close; 113 112 prot->recvmsg = unix_bpf_recvmsg; 113 + prot->sock_is_readable = sk_msg_is_readable; 114 114 prot->unhash = sock_map_unhash; 115 115 } 116 116

+1 -1

net/wireless/core.c

··· 524 524 INIT_WORK(&rdev->propagate_cac_done_wk, cfg80211_propagate_cac_done_wk); 525 525 INIT_WORK(&rdev->mgmt_registrations_update_wk, 526 526 cfg80211_mgmt_registrations_update_wk); 527 + spin_lock_init(&rdev->mgmt_registrations_lock); 527 528 528 529 #ifdef CONFIG_CFG80211_DEFAULT_PS 529 530 rdev->wiphy.flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT; ··· 1280 1279 INIT_LIST_HEAD(&wdev->event_list); 1281 1280 spin_lock_init(&wdev->event_lock); 1282 1281 INIT_LIST_HEAD(&wdev->mgmt_registrations); 1283 - spin_lock_init(&wdev->mgmt_registrations_lock); 1284 1282 INIT_LIST_HEAD(&wdev->pmsr_list); 1285 1283 spin_lock_init(&wdev->pmsr_lock); 1286 1284 INIT_WORK(&wdev->pmsr_free_wk, cfg80211_pmsr_free_wk);

+2

net/wireless/core.h

··· 100 100 struct work_struct propagate_cac_done_wk; 101 101 102 102 struct work_struct mgmt_registrations_update_wk; 103 + /* lock for all wdev lists */ 104 + spinlock_t mgmt_registrations_lock; 103 105 104 106 /* must be last because of the way we do wiphy_priv(), 105 107 * and it should at least be aligned to NETDEV_ALIGN */

+14 -12

net/wireless/mlme.c

··· 452 452 453 453 lockdep_assert_held(&rdev->wiphy.mtx); 454 454 455 - spin_lock_bh(&wdev->mgmt_registrations_lock); 455 + spin_lock_bh(&rdev->mgmt_registrations_lock); 456 456 if (!wdev->mgmt_registrations_need_update) { 457 - spin_unlock_bh(&wdev->mgmt_registrations_lock); 457 + spin_unlock_bh(&rdev->mgmt_registrations_lock); 458 458 return; 459 459 } 460 460 ··· 479 479 rcu_read_unlock(); 480 480 481 481 wdev->mgmt_registrations_need_update = 0; 482 - spin_unlock_bh(&wdev->mgmt_registrations_lock); 482 + spin_unlock_bh(&rdev->mgmt_registrations_lock); 483 483 484 484 rdev_update_mgmt_frame_registrations(rdev, wdev, &upd); 485 485 } ··· 503 503 int match_len, bool multicast_rx, 504 504 struct netlink_ext_ack *extack) 505 505 { 506 + struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 506 507 struct cfg80211_mgmt_registration *reg, *nreg; 507 508 int err = 0; 508 509 u16 mgmt_type; ··· 549 548 if (!nreg) 550 549 return -ENOMEM; 551 550 552 - spin_lock_bh(&wdev->mgmt_registrations_lock); 551 + spin_lock_bh(&rdev->mgmt_registrations_lock); 553 552 554 553 list_for_each_entry(reg, &wdev->mgmt_registrations, list) { 555 554 int mlen = min(match_len, reg->match_len); ··· 584 583 list_add(&nreg->list, &wdev->mgmt_registrations); 585 584 } 586 585 wdev->mgmt_registrations_need_update = 1; 587 - spin_unlock_bh(&wdev->mgmt_registrations_lock); 586 + spin_unlock_bh(&rdev->mgmt_registrations_lock); 588 587 589 588 cfg80211_mgmt_registrations_update(wdev); 590 589 ··· 592 591 593 592 out: 594 593 kfree(nreg); 595 - spin_unlock_bh(&wdev->mgmt_registrations_lock); 594 + spin_unlock_bh(&rdev->mgmt_registrations_lock); 596 595 597 596 return err; 598 597 } ··· 603 602 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 604 603 struct cfg80211_mgmt_registration *reg, *tmp; 605 604 606 - spin_lock_bh(&wdev->mgmt_registrations_lock); 605 + spin_lock_bh(&rdev->mgmt_registrations_lock); 607 606 608 607 list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) { 609 608 if (reg->nlportid != nlportid) ··· 616 615 schedule_work(&rdev->mgmt_registrations_update_wk); 617 616 } 618 617 619 - spin_unlock_bh(&wdev->mgmt_registrations_lock); 618 + spin_unlock_bh(&rdev->mgmt_registrations_lock); 620 619 621 620 if (nlportid && rdev->crit_proto_nlportid == nlportid) { 622 621 rdev->crit_proto_nlportid = 0; ··· 629 628 630 629 void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev) 631 630 { 631 + struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 632 632 struct cfg80211_mgmt_registration *reg, *tmp; 633 633 634 - spin_lock_bh(&wdev->mgmt_registrations_lock); 634 + spin_lock_bh(&rdev->mgmt_registrations_lock); 635 635 list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) { 636 636 list_del(&reg->list); 637 637 kfree(reg); 638 638 } 639 639 wdev->mgmt_registrations_need_update = 1; 640 - spin_unlock_bh(&wdev->mgmt_registrations_lock); 640 + spin_unlock_bh(&rdev->mgmt_registrations_lock); 641 641 642 642 cfg80211_mgmt_registrations_update(wdev); 643 643 } ··· 786 784 data = buf + ieee80211_hdrlen(mgmt->frame_control); 787 785 data_len = len - ieee80211_hdrlen(mgmt->frame_control); 788 786 789 - spin_lock_bh(&wdev->mgmt_registrations_lock); 787 + spin_lock_bh(&rdev->mgmt_registrations_lock); 790 788 791 789 list_for_each_entry(reg, &wdev->mgmt_registrations, list) { 792 790 if (reg->frame_type != ftype) ··· 810 808 break; 811 809 } 812 810 813 - spin_unlock_bh(&wdev->mgmt_registrations_lock); 811 + spin_unlock_bh(&rdev->mgmt_registrations_lock); 814 812 815 813 trace_cfg80211_return_bool(result); 816 814 return result;

+5 -2

net/wireless/scan.c

··· 418 418 } 419 419 ssid_len = ssid[1]; 420 420 ssid = ssid + 2; 421 - rcu_read_unlock(); 422 421 423 422 /* check if nontrans_bss is in the list */ 424 423 list_for_each_entry(bss, &trans_bss->nontrans_list, nontrans_list) { 425 - if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len)) 424 + if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len)) { 425 + rcu_read_unlock(); 426 426 return 0; 427 + } 427 428 } 429 + 430 + rcu_read_unlock(); 428 431 429 432 /* add to the list */ 430 433 list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list);

+7 -7

net/wireless/util.c

··· 1028 1028 !(rdev->wiphy.interface_modes & (1 << ntype))) 1029 1029 return -EOPNOTSUPP; 1030 1030 1031 - /* if it's part of a bridge, reject changing type to station/ibss */ 1032 - if (netif_is_bridge_port(dev) && 1033 - (ntype == NL80211_IFTYPE_ADHOC || 1034 - ntype == NL80211_IFTYPE_STATION || 1035 - ntype == NL80211_IFTYPE_P2P_CLIENT)) 1036 - return -EBUSY; 1037 - 1038 1031 if (ntype != otype) { 1032 + /* if it's part of a bridge, reject changing type to station/ibss */ 1033 + if (netif_is_bridge_port(dev) && 1034 + (ntype == NL80211_IFTYPE_ADHOC || 1035 + ntype == NL80211_IFTYPE_STATION || 1036 + ntype == NL80211_IFTYPE_P2P_CLIENT)) 1037 + return -EBUSY; 1038 + 1039 1039 dev->ieee80211_ptr->use_4addr = false; 1040 1040 dev->ieee80211_ptr->mesh_id_up_len = 0; 1041 1041 wdev_lock(dev->ieee80211_ptr);

+20 -55

tools/testing/selftests/bpf/prog_tests/sockmap_listen.c

··· 949 949 int err, n; 950 950 u32 key; 951 951 char b; 952 - int retries = 100; 953 952 954 953 zero_verdict_count(verd_mapfd); 955 954 ··· 1001 1002 goto close_peer1; 1002 1003 if (pass != 1) 1003 1004 FAIL("%s: want pass count 1, have %d", log_prefix, pass); 1004 - again: 1005 - n = read(c0, &b, 1); 1006 - if (n < 0) { 1007 - if (errno == EAGAIN && retries--) { 1008 - usleep(1000); 1009 - goto again; 1010 - } 1011 - FAIL_ERRNO("%s: read", log_prefix); 1012 - } 1005 + n = recv_timeout(c0, &b, 1, 0, IO_TIMEOUT_SEC); 1006 + if (n < 0) 1007 + FAIL_ERRNO("%s: recv_timeout", log_prefix); 1013 1008 if (n == 0) 1014 - FAIL("%s: incomplete read", log_prefix); 1009 + FAIL("%s: incomplete recv", log_prefix); 1015 1010 1016 1011 close_peer1: 1017 1012 xclose(p1); ··· 1564 1571 const char *log_prefix = redir_mode_str(mode); 1565 1572 int c0, c1, p0, p1; 1566 1573 unsigned int pass; 1567 - int retries = 100; 1568 1574 int err, n; 1569 1575 int sfd[2]; 1570 1576 u32 key; ··· 1598 1606 if (pass != 1) 1599 1607 FAIL("%s: want pass count 1, have %d", log_prefix, pass); 1600 1608 1601 - again: 1602 - n = read(mode == REDIR_INGRESS ? p0 : c0, &b, 1); 1603 - if (n < 0) { 1604 - if (errno == EAGAIN && retries--) { 1605 - usleep(1000); 1606 - goto again; 1607 - } 1608 - FAIL_ERRNO("%s: read", log_prefix); 1609 - } 1609 + n = recv_timeout(mode == REDIR_INGRESS ? p0 : c0, &b, 1, 0, IO_TIMEOUT_SEC); 1610 + if (n < 0) 1611 + FAIL_ERRNO("%s: recv_timeout", log_prefix); 1610 1612 if (n == 0) 1611 - FAIL("%s: incomplete read", log_prefix); 1613 + FAIL("%s: incomplete recv", log_prefix); 1612 1614 1613 1615 close: 1614 1616 xclose(c1); ··· 1734 1748 const char *log_prefix = redir_mode_str(mode); 1735 1749 int c0, c1, p0, p1; 1736 1750 unsigned int pass; 1737 - int retries = 100; 1738 1751 int err, n; 1739 1752 u32 key; 1740 1753 char b; ··· 1766 1781 if (pass != 1) 1767 1782 FAIL("%s: want pass count 1, have %d", log_prefix, pass); 1768 1783 1769 - again: 1770 - n = read(mode == REDIR_INGRESS ? p0 : c0, &b, 1); 1771 - if (n < 0) { 1772 - if (errno == EAGAIN && retries--) { 1773 - usleep(1000); 1774 - goto again; 1775 - } 1776 - FAIL_ERRNO("%s: read", log_prefix); 1777 - } 1784 + n = recv_timeout(mode == REDIR_INGRESS ? p0 : c0, &b, 1, 0, IO_TIMEOUT_SEC); 1785 + if (n < 0) 1786 + FAIL_ERRNO("%s: recv_timeout", log_prefix); 1778 1787 if (n == 0) 1779 - FAIL("%s: incomplete read", log_prefix); 1788 + FAIL("%s: incomplete recv", log_prefix); 1780 1789 1781 1790 close_cli1: 1782 1791 xclose(c1); ··· 1820 1841 const char *log_prefix = redir_mode_str(mode); 1821 1842 int c0, c1, p0, p1; 1822 1843 unsigned int pass; 1823 - int retries = 100; 1824 1844 int err, n; 1825 1845 int sfd[2]; 1826 1846 u32 key; ··· 1854 1876 if (pass != 1) 1855 1877 FAIL("%s: want pass count 1, have %d", log_prefix, pass); 1856 1878 1857 - again: 1858 - n = read(mode == REDIR_INGRESS ? p0 : c0, &b, 1); 1859 - if (n < 0) { 1860 - if (errno == EAGAIN && retries--) { 1861 - usleep(1000); 1862 - goto again; 1863 - } 1864 - FAIL_ERRNO("%s: read", log_prefix); 1865 - } 1879 + n = recv_timeout(mode == REDIR_INGRESS ? p0 : c0, &b, 1, 0, IO_TIMEOUT_SEC); 1880 + if (n < 0) 1881 + FAIL_ERRNO("%s: recv_timeout", log_prefix); 1866 1882 if (n == 0) 1867 - FAIL("%s: incomplete read", log_prefix); 1883 + FAIL("%s: incomplete recv", log_prefix); 1868 1884 1869 1885 close_cli1: 1870 1886 xclose(c1); ··· 1904 1932 int sfd[2]; 1905 1933 u32 key; 1906 1934 char b; 1907 - int retries = 100; 1908 1935 1909 1936 zero_verdict_count(verd_mapfd); 1910 1937 ··· 1934 1963 if (pass != 1) 1935 1964 FAIL("%s: want pass count 1, have %d", log_prefix, pass); 1936 1965 1937 - again: 1938 - n = read(mode == REDIR_INGRESS ? p0 : c0, &b, 1); 1939 - if (n < 0) { 1940 - if (errno == EAGAIN && retries--) { 1941 - usleep(1000); 1942 - goto again; 1943 - } 1944 - FAIL_ERRNO("%s: read", log_prefix); 1945 - } 1966 + n = recv_timeout(mode == REDIR_INGRESS ? p0 : c0, &b, 1, 0, IO_TIMEOUT_SEC); 1967 + if (n < 0) 1968 + FAIL_ERRNO("%s: recv_timeout", log_prefix); 1946 1969 if (n == 0) 1947 - FAIL("%s: incomplete read", log_prefix); 1970 + FAIL("%s: incomplete recv", log_prefix); 1948 1971 1949 1972 close: 1950 1973 xclose(c1);

+3

tools/testing/selftests/net/fcnal-test.sh

··· 445 445 ip -netns ${NSA} link set dev ${NSA_DEV} down 446 446 ip -netns ${NSA} link del dev ${NSA_DEV} 447 447 448 + ip netns pids ${NSA} | xargs kill 2>/dev/null 448 449 ip netns del ${NSA} 449 450 fi 450 451 452 + ip netns pids ${NSB} | xargs kill 2>/dev/null 451 453 ip netns del ${NSB} 454 + ip netns pids ${NSC} | xargs kill 2>/dev/null 452 455 ip netns del ${NSC} >/dev/null 2>&1 453 456 } 454 457

Configure Feed

Configure Feed